Methodology
Methodology
Why Most Banks Can't Identify Their Own Risks
The gap between having a risk register and having a risk identification process. And why the regulator sees the difference immediately.
Read more →Bank Risk Identification
A comprehensive, regulator-aligned methodology for bank risk identification — built from 20 years of doing it at the world's largest institutions.
Built across 6 institutions
Most banks have a risk register. Very few have a defensible risk identification process. The difference shows up when the regulator asks "how did you identify this?" and no one can answer.
ICAAP reviews, CCAR, SREP — supervisors consistently find incomplete risk identification, missing risk categories, and no documented methodology.
Static spreadsheets updated once a year, scored by people who weren't calibrated, with no confidence rating on the data underneath.
Ask three people in the risk function how risks are identified and you'll get three different answers. Or no answer at all.
The Evidence
In every case, the risk was identifiable before the loss materialised. We studied every one and asked: what went wrong in the risk identification process?
Barings Bank (1995)
$1.3B loss
Nick Leeson held both trading and settlement authority. Internal audit flagged the segregation-of-duties violation. Management ignored it.
Risk ID Failure: Governance bypass
Northern Rock (2007)
£26B loss
75% wholesale-funded. No scenario tested what happens when securitisation markets close. The business model was the risk.
Risk ID Failure: Complacency
Wells Fargo (2016)
$3B loss
3.5 million fake accounts opened to meet cross-selling targets. Whistleblower complaints treated as HR, not risk.
Risk ID Failure: Cultural suppression
We studied every one. Then built a methodology to prevent the next.
Explore the EvidenceStart by understanding your gaps, then get the tools to fix them — or bring us in to help.
27 questions. 10 minutes. Find out where your risk identification process is strong and where regulators will find weaknesses.
Free Self-AssessmentThe complete methodology: 16-chapter book, 30-tab Excel template pack, AI prompt library, and Copilot agent definition. Free.
Download FreeGap assessments, full implementation, and audit-readiness reviews. Expert guidance building or fixing your process.
Talk to UsThe Methodology
External context (PESTLE), internal environment and risk culture assessment, risk criteria, risk appetite, building the starting universe.
Top-down SWIFT workshops and Delphi method. Bottom-up with 10 specialist sub-processes. Mandatory reconciliation and enterprise portfolio view.
Four-dimensional scoring. Multi-dimensional impact. Data quality ratings. Bow-tie analysis for critical risks. Cost-benefit with ALARP.
Living risk inventory with full audit trail. One-page risk profiles for every material risk. KRIs with RAG thresholds.
Direct linkage to ICAAP/ILAAP/CCAR scenario design, strategic planning, Board reporting, and regulatory submissions.
Quarterly re-identification. Event-driven updates. Annual full re-identification. Internal audit assurance over the process itself.
Aligned to 16 regulatory frameworks
You need a process that survives regulatory scrutiny. Not a theoretical framework — a practical methodology you can implement and defend.
You don't have a team of 50. You need a framework that works with the team you have and meets the same regulatory standard as the global banks.
You're hiring your first risk person. Give them the blueprint so they don't have to build from scratch.
You advise banks and need a methodology to deliver. This gives you the complete framework, templates, and regulatory mapping.
You need to know what good looks like so you can assess whether your bank's process measures up.
Methodology
The gap between having a risk register and having a risk identification process. And why the regulator sees the difference immediately.
Read more →Regulatory
Across PRA, EBA, and the Fed, the same finding appears in supervisory reviews year after year. Here's what it is and how to fix it.
Read more →Case Study
If you don't attach a data quality rating to every risk score, you're presenting false precision to the Board. Here's why it matters.
Read more →