Risk Management Frameworks
The risk management frameworks domain tests how a firm organises risk identification, assessment, control, monitoring, and reporting: the risk operating model, taxonomy, appetite, RCSA, KRIs, loss data, and capital.
Core rules and concepts
- ISO 31000:2018 and COSO ERM 2017 provide principles; Basel's Principles for the Sound Management of Operational Risk (2021) set expectations for governance, risk appetite, taxonomy, and reporting.
- The three lines model: the first line owns risk and controls; the second line provides independent risk and compliance oversight; the third line is internal audit.
- A risk appetite framework translates appetite into statements, metrics, limits, and escalation; it must be board-approved and used in decisions.
- RCSA identifies processes, risks, controls, and residual risk; control testing provides evidence and challenges self-assessment bias.
- Basel event types are internal fraud; external fraud; employment practices and workplace safety; clients, products, and business practices; damage to physical assets; business disruption and system failures; execution, delivery, and process management.
- Loss data (internal, external, scenario, KRI) support measurement; Basel's SMA uses a business indicator component and loss component.
Worked example
In loan origination, an RCSA shows manual income verification as a key control. The business rates residual risk low, but testing finds the control fails 15% of the time because staff override exceptions. The KRI override rate breaches threshold. The second line challenges the low rating, and the risk is re-rated medium-high with an action plan to automate verification and monitor overrides monthly. Residual risk must reflect control effectiveness, not just inherent exposure.
Traps that cost marks
Rating inherent risk as residual; relying on self-assessment without testing; having a taxonomy that cannot aggregate losses; an appetite statement with no limits or escalation; using KRIs only as after-the-fact reporting.