Risk Identification, Assessment and Aggregation
Identification
Risk identification draws on risk registers and taxonomies, process mapping, RCSA workshops, incident and near-miss data, internal and external loss data, KRIs, scenario analysis, bow-tie and fault-tree analysis, horizon scanning, and value-chain or SWOT analysis. Identification is continuous, not an annual event; emerging and interconnected risks are the usual gaps.
Assessment
Risks are assessed for likelihood and impact, ideally on both an inherent basis (before controls) and a residual basis (after controls), with control effectiveness evaluated separately. Quantification ranges from ordinal heat-map scoring through to loss distributions and Monte Carlo simulation, depending on the risk and the decision it informs.
Aggregation
Aggregation combines risks across units and risk types into a single firm view. It must handle correlation, common drivers, contagion and tail dependence. Diversification benefits are real but shrink under stress - correlations tend to rise in a crisis, so a stress aggregation must not assume benign correlations.
Traps
- Adding ordinal ratings arithmetically (2 + 3 = 5) - ordinal scales are not additive.
- Reporting inherent risk where residual is meant, or vice versa.
- Double counting the same exposure through multiple registers or business units.
- Assuming diversification in a stress scenario.
- Ignoring non-financial risks because they lack historical loss data.
Rule of thumb: maintain a single risk taxonomy and a common rating scale across the firm. Aggregate bottom-up by exposure driver, then recalibrate top-down with scenarios so the total is coherent and reconciles to capital and earnings.