Risk and compliance: applied workshop

Risk, control and compliance

Use risk, control and compliance to make decisions inspectable.

Separate business risk, control and applicable requirements.

Teaching example: Likelihood and impact need separate supporting evidence.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Process and ownership

Use process and ownership to make decisions inspectable.

Map onboarding or procurement and assign owners.

Teaching example: A policy document does not prove a control operated.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Risk assessment

Use risk assessment to make decisions inspectable.

Rank five risks using a fictional scale and explain the order.

Teaching example: A score of 3×4=12 belongs to the supplied model, not an objective probability.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Control evidence and testing

Use control evidence and testing to make decisions inspectable.

Identify records needed to demonstrate control execution.

Teaching example: Approval evidence needs an approver, date and linked transaction.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Monitoring and escalation

Use monitoring and escalation to make decisions inspectable.

Design an exception log, review steps and escalation triggers.

Teaching example: A rule hit requires investigation; it is not a violation finding.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Policy reading and version control

Use policy reading and version control to make decisions inspectable.

Check publisher, scope, version and date of a requirement.

Teaching example: An older or overseas rule is not automatically a current Hong Kong requirement.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Issue reporting and remediation

Use issue reporting and remediation to make decisions inspectable.

Write findings, evidence, impact, owner and remediation timing.

Teaching example: Closing an issue requires evidence and review.. Predict the result, independently check the key step, and compare these assumptions with the actual role. Do not use demonstration results as real-world advice.

Worked example · fictional

From a problem to inspectable work

Synthetic exposure 5m, LGD 40%, PD 2% base and 4% stress; use only the PD×LGD×EAD illustration.

1. 0.04×0.4×5000000 = 80000. This is model expected loss, not worst loss or regulatory capital.
2. Further judgment: Low expected loss establishes effective controls?
3. Inspect design, operating evidence, tails and model limits

Deliver risk and control assessment: the calculation reference is 80000; the recommendation must respect Inspect design, operating evidence, tails and model limits. Separate numbers, inference and unknowns.

Failure case and repair

In Control evidence and testing, copy tool output without definitions, then retain the conclusion when asked: Low expected loss establishes effective controls?

Even a result of 80000 does not explain when Inspect design, operating evidence, tails and model limits is supported.

0.04×0.4×5000000 = 80000. This is model expected loss, not worst loss or regulatory capital. Then test assumptions in Policy reading and version control.