<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

The New COVID-19 Risk Environment: Reassessing Risk

author Michael Berman
3 min read
Apr 17, 2020

Risk has always been a part of banking. But today, with the spread of COVID-19 wreaking havoc on customers, the economy, and how we live and do business, banking might feel even riskier.

But is it? Not necessarily in the way you might think.

The Risks Aren’t New

The risks facing financial institutions are well known and studied. They have been identified by everyone from regulators to academics to risk officers. They include operational, transaction, financial, credit, strategic, compliance, reputation, concentration, and cyber risks, among others.

While the COVID-19 pandemic is a new event, it does not create new risks. Yes, the spread of COVID-19 may lead to increased loan defaults, branch closures, or personnel shortages—but these are all known risks.

If your FI has a good enterprise risk management (ERM) program in place, these risks were identified long ago. Controls are in place to mitigate them.

What’s Changed?

While the risks themselves haven’t changed, inherent risk has.

Inherent risk is the risk that an activity would pose if there weren’t any controls or other mitigating factors in place. An example is the risk of a cyberattack when there are no firewalls or other defenses.

Inherent risk is defined by two elements: the impact of an event and its probability.

Under the COVID-19 pandemic, the potential impact of an event hasn’t changed. A cyberattack, large-scale employee absenteeism, an increase in loan defaults, or other known risks would probably have the same impact on your FI today as it would have in January before COVID-19 was a widespread problem. A cyberattack or increase in loan defaults is bad no matter when it happens.

What has changed is probability. Many of the risks FIs have identified, assessed, and monitored are far more likely to occur in today’s environment than they would have two months ago. Between working from home and opportunistic cyber crooks, the likelihood of suffering a cyberattack has increased. Large-scale employee absenteeism is far more likely. The rapid decline in the economy makes loan defaults much more likely.

This increase in probability increases inherent risk. An activity that posed a moderate risk before COVID-19 might suddenly be high risk because it’s far more likely to occur. For example, a staff suddenly working remotely from their personal devices can cause the likelihood of unauthorized access to FI systems to increase dramatically. (Download the Ncontracts Work-From-Home (WFH) Risk Assessment.)

Dealing with an Increase in Risk Probability

When risk increases, more or better controls are needed to mitigate it. Residual risk is defined as the risk that remains after accounting for controls. In the case of a cyberattack, it’s the risk that remains after considering deterrence measures like firewalls and penetration testing.

Residual risk is all about control effectiveness. The greater the inherent risk, the stronger the controls need to be. Controls that are 50 percent effective might be enough to mitigate the impact of a low probability event. They may not be up to the task when that low-probability event becomes a high-probability event.

Existing controls may need to be expanded or new controls introduced. It’s all about ensuring the controls remain commensurate with the risks.

Reassessing Risks

There’s a good chance your FI is experiencing increased inherent risk in critical areas, but there is only one way to know for sure: revisiting your risk assessments.

That includes:

  • Reviewing existing assessments, focusing on probability.
  • Looking for areas where probability has increased.
  • Gauging the impact on inherent risk.
  • If inherent risk has increased, assessing residual risk (the effectiveness of existing controls).
  • Adding or improving controls as needed.

There may not be time to review every area, so focus on your most critical areas.

COVID-19 is putting a strain on FIs and their resources, but now is not the time to put risk management on the backburner. Make time to reassess inherent risk and determine if your FI’s controls are sufficient.

You don’t want to find out the hard way.

 

Related: Creating Reliable Risk Assessments

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply CRA Business Resiliency Lending Compliance Blog Vendor CFPB Ncontinuity Business Continuity Third-Party Vendor Management Cybersecurity Fintech NVendor Strategic Planning Ncyber Ntransmittal Regulatory Updates Audits & Findings Company Culture OCC Regulatory Compliance Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Artificial Intelligence Audit Findings Board Portal Call Report Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Nboardportal Verify integrated risk management
Business Impact Analysis
Risk Management

Business Impact Analysis

Oct 31, 2018 1 min read
Is Your Institution Prepared for These Emerging Risks?
Risk Management

Is Your Institution Prepared for These Emerging Risks?

Aug 26, 2019 2 min read
Ncast Podcast Launches with Remote Exam & Cyber Risk Discussion with ABA’s Paul Benda
Risk Management

Ncast Podcast Launches with Remote Exam & Cyber Risk Discussion with ABA’s Paul Benda

Nov 12, 2020 1 min read