Risk Identification and Assessment
Identification methods
Risk identification is the systematic process of surfacing exposures before they crystallize. Candidates should know the main techniques: process mapping and risk-and-control self-assessments (RCSA), scenario analysis and workshops, loss-event data and near-miss review, external event databases, horizon scanning, and key risk indicators (KRIs) as early warnings. A common trap is treating RCSA as a measurement tool - it is primarily identification and qualitative assessment, feeding the risk register, not a quantification method.
Assessment: likelihood and impact
Assessment combines likelihood and impact, often on a heat map, with inherent risk (before controls), residual risk (after controls), and target risk (desired level). Understand that residual risk is what matters for appetite comparisons, and that control effectiveness must be evidenced, not assumed. Traps include double counting controls, rating a control effective because it is documented rather than tested, and confusing inherent with residual in scenario questions.
Risk taxonomy and interdependencies
Know the major categories: credit, market, liquidity, operational (including conduct, cyber, and model risk), strategic, and reputational. Reputational risk is generally a consequence of other risks rather than a standalone driver, and questions often test that distinction. Interdependencies matter: a liquidity stress can amplify market risk through fire sales; a cyber event can create conduct and reputational exposure.
Worked example and rule of thumb
A firm maps a payment process, identifies a manual reconciliation step, assesses inherent likelihood high and impact medium, documents a four-eyes control, tests it quarterly, and rates residual risk low with a KRI tracking reconciliation breaks. Rule of thumb: identify broadly, assess with evidence, and always state whether the rating is inherent or residual - most exam errors come from mixing the two.