Risk Mitigation and Controls
Control types
Mitigation reduces risk through controls, transfers, or structural changes. Know the categories: preventive controls (stop an event before it occurs, such as access restrictions), detective controls (identify after the fact, such as reconciliation and monitoring), and corrective controls (remediate). Transfers include insurance, hedging, collateral, and guarantees; avoiders exit the activity; reducers change process or limits. A frequent trap is labeling a detective control as preventive, or assuming insurance removes risk rather than transferring it with basis and counterparty risk remaining.
Control design and effectiveness
Strong controls are designed around specific risks, evidenced, tested, and owned. Key concepts: segregation of duties, four-eyes approval, maker-checker, reconciliation, limits and thresholds, and business continuity planning. Understand that controls have costs and can create new risks (overly rigid controls slow response; a single control may be relied on too heavily). Residual risk after controls should be compared to appetite, and compensating controls may be accepted temporarily with documented approval.
Hedging and collateral
Hedging reduces market risk but introduces basis risk, counterparty credit risk, and liquidity demands from margin calls. Collateral mitigates credit exposure but carries valuation, legal, and operational risk. Questions often test that a hedge which is effective in normal markets may fail in stress, and that mitigation does not equal elimination.
Worked example and rule of thumb
A firm faces payment fraud risk. Preventive: dual authorization and vendor master change controls. Detective: daily reconciliation and anomaly alerts. Corrective: recall procedures and insurance claim. Rule of thumb: for each material risk, require at least one preventive and one detective control, and name the residual risk after mitigation - if you cannot state it, the mitigation is not fully assessed.