<img src="https://ws.zoominfo.com/pixel/pIUYSip8PKsGpxhxzC1V" width="1" height="1" style="display: none;">

Increasing Risk May Not Mean What You Think It Does

author Michael Berman
2 min read
Apr 13, 2018

When risk increases, the natural response is to take action to reduce that risk. But not every increase requires action. In fact, it may distract you from more important issues.

I'm talking about the risk of treating every risk the same.

Astute observers of risk have a variety of tools to monitor risk, from near real-time indicators to audits, exams, and reviews. But it's not enough to recognize that risk has increased. Its ultimate impact must be considered.

For example, a review might show that employees haven't been regularly reviewing a checklist to ensure the institution is collecting all five key pieces of customer information required under the Customer Identification Program (CIP) provisions of the USA PATRIOT Act when opening an account. On its surface, this may seem like a huge increase to the bank's BSA risk, requiring swift and immediate action. Memos should be sent. Training should be instituted. Sound the alarm!

But is that really necessary? Maybe not.

In this case, the checklist is just one control. There is also automated software to prevent an account opening from moving forward without the information and a quality control program that double checks a sample of new accounts. These two controls have a much greater impact and therefore influence residual BSA risk to a much greater degree.

The fact that the institution is inconsistent on the checklist, a relatively unimportant control, might not have a huge impact on the institution's overall BSA residual risk. The institution might even decide to discontinue the control due to its ineffectiveness.

 

On the other hand, perhaps the failure to use the checklist is part of a pattern of failing to follow policies and procedures, contributing to an increase in compliance risk. In that case, the risk goes well beyond forgetting a checklist. It indicates a problem with the entire institution's compliance culture.

How do you spot the difference? You need a system in place that makes it easy to understand the context of specific risks, including how they impact different business areas and categories of risk. Both inherent and residual risk should be monitored and risk exposure should be categorized by category and hierarchy to make it easy to understand the relationship between a particular risk and the institution as a whole.

That's why enterprise risk management is so important. It's not about immediately correcting every increase in risk. It's understanding exactly how a single increase in residual risk fits into the overall risk picture, impacting different risk areas and categories.

When reporting risk to the board, make sure you communicate the global perspective. It's not enough to know that risk is increasing. The board needs to know what it means. Not every risk increase means the same thing or requires the same attention. Good enterprise risk management allows the board and management to know what a risk increase really indicates.

Subscribe to the Nsight Blog

All Topics Risk & Compliance Product Insight Banks Lending Compliance Credit Unions Risk Management Fair Lending Nfairlending Cluster: Risk Management Compliance Lending Compliance Management Integrated Risk Blog Regulatory Compliance Management Nrisk News & Updates HMDA Risk Mortgage Lenders Vendor Management Ncomply Business Resiliency CRA Lending Compliance Blog Vendor CFPB Ncontinuity Third-Party Vendor Management Business Continuity Cybersecurity Fintech NVendor Strategic Planning Ncyber Regulatory Updates Ntransmittal Audits & Findings Regulatory Compliance OCC Company Culture Audit Nverify Compliance Management Exams FDIC Nfindings Findings NCUA Contract Management Employee Intranet Business Continuity Management Contract FRB Findings Management Enterprise Risk Management FFIEC Ncontracts manager Third-Party Vendors Vendor Risk Artificial Intelligence Vendor Risk Management Wealth Management 1071 ABA Bank Access Control Audit Findings Board Portal Call Report Compliance Risk Cybersecurity Assessment Digital Tansformation Due Diligence Efficiency Employee Engagement Exam findings FIEC Governance and Risk Management Inc. 5000 Internal Audit Management Mortgage Lending Nboardportal Verify integrated risk management
Mitigation Definition
Risk Management

Mitigation Definition

Nov 12, 2018 1 min read
Vendor Management: What the NCUA Really Wants
Risk & Compliance

Vendor Management: What the NCUA Really Wants

May 2, 2017 5 min read
Fintech Update: Agencies Encourage Increased Regulator Oversight of Third Parties, but Will Anything Happen?
Banks

Fintech Update: Agencies Encourage Increased Regulator Oversight of Third Parties, but Will Anything Happen?

Feb 5, 2019 4 min read