Risk assessment: what it is and why it is important for banks

The globalisation of financial markets, the development of information technology as well as the increasing competition have affected banking activities to a great extent, especially the associated risk management, which has become a pillar ensuring banks’ productivity and soundness. In fact, in terms of macro-assessment, analysis, priorities and strategy definition, this process allows to mitigate threats to resources and profits. To this goal, the risk assessment plays a crucial role.

What is risk assessment and what is it about? In a nutshell, risk assessment is a fundamental step of the wider risk management procedure, which helps businesses in general – and banks in particular – in preventing and managing possible problematic situations.

Risk assessment could be defined as the middle-level process within risk management to ensure that all risks associated with the activities – in this case those of a credit institution – are fully and immediately identified, measured, contained, controlled, mitigated and reported.

Let us look more closely to the substance of risk management as well as its steps, benefits and objectives.

What is risk assessment

‘Risk assessment’ refers to a process which identifies potential risks and analyses their consequences, both at a qualitative and quantitative level. This word is used to describe the procedure/general method of:

• identifying the dangers and risk factors which may cause damages (i.e., danger identification);
• analysing and assessing the risk associated with such dangers (so-called risk analysis and risk assessment);
• determining the appropriate ways to eliminate dangers or monitor risks when dangers cannot be eliminated (i.e., risk control).

What is the difference between risk management and risk assessment?

Risk assessment activities are preliminary to risk management: the former aims at locating and analysing the different risk types to which companies could be exposed, while the latter indicates the set of operations an undertaking should implement to preserve its own economic and financial balance.

Which elements generate risk?

Before delving into the risk assessment functioning, let us see what a risk is ‘composed of’. Risk can be expressed through the formula below:

Risk = Danger x Magnitude

That is, risk is the product of dangerousness (the likelihood that an event will occur in a given space/time) and magnitude, i.e., the seriousness of harmful consequences.
Clearly, in such context, risk control analytics becomes a crucial player. It could be defined as the identification and analysis of risks, to understand the priorities of an intervention and consequently take strategic actions to contain or mitigate those risks.

When is risk analysis carried out

Risk analysis can be carried out anytime and applies to any aspect of business, in this case banking activity, considering an infinite range of interlinked dangers and scenarios which can cause accidental, damaging and serious undesired events.

What are, in short, the steps of risk analysis?

There are four of them and they consist of the following:

1. identification and recording of risks;
2. assessment of dangers to determine risk level;
3. definition of prevention and protection measures;
4. implementation of measures.

Risk assessment 231: what it contains

Before examining the individual steps, it is essential to understand the content of Article 6, point 2, Legislative Decree No 231/2001, according to which the model needs to ‘a) identify those activities under which the crimes may be committed…’.

This represents the main part of the overall process to define the organisational model ex Legislative Decree No. 231/2001; in fact, it allows to identify industries and business processes exposed to the potential perpetration of one of the crimes provided for in the abovementioned Decree, thus putting in place the countermeasures aimed at avoiding that those risks materialise in the operativity context of the institution (in our case, a bank).

Risk assessment steps

As already stated above, the risk assessment process consists of four stages. The first one is risk identification, involving a description of the risks which might prevent a company from reaching its goals.

In this phase, two aspects should be taken into full account:

1. within the perimeter of Legislative Decree 231/2001, the focus will be on identifying those scenarios, threats or behaviours which characterise one of the crimes (especially in the case of event crimes) that, based on context analysis, could actually materialise. For instance, as regards corruption risk, given a context of relationships with public authorities and a business involving procurement management, there will be a need to characterise the assumption of conducts which could potentially expose to corruptive behaviours (e.g., donation of valuable commodities or selection of partners in breach of rules or in the absence of transparency);
2. in wider compliance analyses (used also for the purposes of Legislative Decree No. 231/2001) it will be helpful to locate within processes the potential violation of rules to which the organisation is generally subjected, given that, for some specific offences, such violation (including purely conduct-related or simple omissions) may constitute “predicate offences” of criminal relevance.

Once completed this task, the logical course followed will have to be demonstrated at documentation level and some action should be taken, such as:

• for those crimes which can be incorporated in a variegated manner, with composite or varying conducts, to draw a list of behaviours or situations (threats) which will consequently undergo an assessment;
• for the violation of rules which may occur by themselves and are included in the analysis perimeter, to create an inventory of the main regulatory and control obligations for the company.

The second step is risk analysis, which has to consider the following:

• uncertainties, including those causing possible positive and negative consequences;
• risk sources;
• events;
• likelihood that an event will occur;
• consequences of such events;
• effectiveness of current controls;
• effectiveness of potential future controls.

It should be noted that risk analysis will be more thorough and precise if the information used are of high quality – that is, accurate and comprehensive. Let us not forget that sometimes one may have to step out of the operational circle of his own company to obtain this information. Moreover, it is necessary to know, document and disclose any opinions, prejudices, assumptions, exclusions and possible limitations of the techniques used.

The third step is risk assessment, which means comparing the results of risk analysis with the company’s existing risk criteria, to establish whether taking further action is essential to deal with risks under assessment.

Finally, the fourth step is measure implementation, which may consist of different alternatives:

• no further action is needed, because the company is already compliant;
• to consider the implementation of other risk treatments;
• to re-consider the organisation’s objectives;
• to return to the risk analysis step, to develop a deeper understanding of the risks.

Find Out TIGREARM

An application suite to control banking and financial information.

Click on the button and go to the TIGREARM page to discover the modules or request a 15-day free trial (for a maximum of 3 modules)