Risk Event Analysis

Risk Event Analysis allows risk owners to rate inherent risk, set tolerable risk levels and assess residual risk on a periodic basis for a risk event category. The risk event categories are developed at an enterprise level and are associated with the Risk Control Matrix.

Risk Event Categories can be imported to the Risk Control Matrix through the template library or risk owners can add, edit or delete risk event categories to the risk event analysis. They can also add or link risks to the risk event category.

• Inherent risk is the level of risk resident in the absence of controls. The inherent risk represented by a risk event category will fluctuate based on the organizational area and/or process in which the risk event category exists. For example, the inherent risk of internal fraud may be more or less in a Retail Banking unit than in a Commercial Banking unit.
• Tolerable risk is the level of risk that management is willing to accept for a given risk event category. The tolerable risk represented by a risk event category will fluctuate based on the organizational area and/or process in which the risk event category exists. For example, the tolerable risk of internal fraud may be greater at a major line of business level than at a secondary line of that business.

  Note: Tolerances are also applied to the recording of loss events. This section only relates to tolerable risk for purposes of Risk Control Self Assessment.

• Residual risk is the level of risk remaining when considering external factors, response strategies, and mitigating controls.