About

This workshop is aimed at risk practitioners and business managers who have, or are looking to, implement a robust and comprehensive risk and control assessment (RCA) process within their organization. The workshop covers all aspects of the RCA process from design and implementation through to carrying out assessments, reporting results and creating follow up actions. The workshop is aligned with the Basel II standards, current regulatory requirements, and ISO31000 when undertaking a RCA programme. This is a hands-on workshop with concepts reinforced through the use of case studies.
 
Key Learning Outcomes
•    Understanding risk, types of risk, and the management of risk
•    Understanding of the risk and reward trade-off
•    Understanding the RCA models
•    An understanding of the RCA process and how results can be used in scenario analysis, key risk indicators, incident management and compliance
•    Ability to design and implement an effective and efficient RCA process
•    Setting relevant risk assessment thresholds aligned with risk appetite of the business
•    Using RCA results to drive process improvement programme and treatments
•    The ability to produce meaningful reports as an output of the RCA process
•    Appreciation of system requirements and system pitfalls for an effective RCA process
•    The skill to be able to carry out an effective and engaging RCA workshops

Who Should Attend?
•    Group Operational Risk,
•    Risk Officers,
•    Risk Managers,
•    Financial Controllers,
•    internal auditors,
•    External Auditors,
•    Risk Advisers and Consultants,
•    Regulators,
•    Insurance Specialists,
•    Fraud Managers,
•    IT Security and Operations staff.

From the banking, insurance and financial sectors

Training Methodology
This intensive 1-day master class will combine tutorial sessions and case studies with interactive learning exercises. All attendees will be provided with a workbook and a certificate of completion.


Outline

Current status of Enterprise Risk Management
•    The past and the present
•    The risk management challenge
•    Organisation structure and lines of defence
•    Components of a risk management framework
•    Challenges for the CEO and the Board

Defining Risk & Control Assessment (RCA)
•    Key definitions
•    Objectives of RCA
•    The importance of linking to business context
•    Various approaches to RCA

A framework for Managing a RCA programme
•    The 7 R’s and 4 T’s
•    Align to business strategy, performance and process objectives using Balanced Scorecard, Porter’s Value Chain & FMEA
•    Identify risks and key controls
•    Assessing inherent and residual risk
•    Assessing the effectiveness of controls
•    Risk profile and map
•    Respond to the risk via 4 T’s
•    Develop action plans
•    Escalate, communicate and reports findings

Inputs into the RCA process
•    Access to data sources including ILD, ELD, Key Indicators, audit reports, other risk profiles, extreme event scenarios, other sources etc
•    Determining what risks to consider and the use of a central library
•    Identifying and assessing key controls, what is a control and what are the types of controls
•    Understanding control design versus performance
•    Setting the likelihood and consequence scales
•    How many scale levels are right?
•    Aligning consequence thresholds to reflect the risk appetite and tolerance of the business
•    Likelihood measures – what makes sense?
•    Using average, plausible or worst case

RCA Process in Action
•    Linking risks to business context, causes, events and key controls
•    Assessing the size of the risk:
•    Assessing the primary consequence and likelihood. What is the direct financial loss?
•    Assess the effectiveness of controls and establishing risk treatments
•    Determine the residual risk rating. Is inherent risk useful and can it be assessed?
•    Reaction planning and the worst case
•    RCA Case Study: Carrying out a RCA

Setting up the RCA process
•    Set the scope. Who should participate?
•    What background due diligence, research and preparation is required?
•    Carrying out the assessment

RCA Reporting
•    How to support the CRO and CEO
•    Types of reports and information to report
•    The value of dash board reporting

Using RCA outputs
•    Escalations, notifications and follow up
•    As a risk monitoring and management tool
•    As an input into the risk capital model, benchmarking tool, and driver of behavior

Review and evaluate the framework

The future of RCA
•    Pitfalls of RCA process to watch out for
•    Risk systems
•    Enterprise risk management


Facilitator

Paul Barton

Paul is principal and principal trainer of RiskHub Limited. Paul has experience in all facets of risk management with particular specialisation in Operational Risk Management. Prior to setting up RiskHub, Paul has spent nearly 16 years working in a risk management capacity both here and in Australia. Paul has extensive financial services experience where he headed up the risk and compliance functions across superannuation, wrap platforms, and insurance for BT Financial Group in Sydney. Most recently Paul has led the operational risk function at ANZ Bank in Wellington.



Paul Barton is also facilitating:

• Key Risk Indicators for the Financial Sector
• Operational Risk Management for Financial Institutions

In-house Training