You know you need to perform risk assessments, but what really goes into the risk assessment process?
The performance of a risk assessment may take many forms but should always follow an established methodology. The COSO methodology is widely used by financial institutions, but others are available.
At a minimum, you should:
Interviewing a department isn’t an ideal method for assessing risk. Interviews produce qualitative data. This is non-numerical data based on observations and experiences. While this information is valuable for risk discussions and background, when it comes to measuring risk for assessments, this subjective data won’t be of much value to your institution or your regulators.
Quantitative data, or data that can be expressed with numbers, is much more valuable when making risk determinations. Examples include the number of high-risk customers, the dollar amount of foreign wires in a given time period, or financial losses due to fraud.
PPP Loan Audits: How to Proactively Address Regulatory and Litigation Risk
There is no great answer to this, as it will depend on the specifics of your institution. However, a good general rule of thumb would be to not sacrifice current ERM monitoring when taking on program enhancements.
This is why “right-sizing” is so important. It ensures resources are deployed efficiently and effectively.
Balancing the day-to-day with new assessments can benefit from a blended approach.
Evaluate your current monitoring and see where cuts can be made to streamline the process. This includes:
Related: Ignore KRIs and KPIs at Your Own Peril
Take the time and effort saved by your streamlining efforts and apply them to program development.
Using this approach should help you achieve the balance that you want without your program suffering. It will also add value to your current program by streamlining and focusing on your organization’s key risks and controls.