Key Questions/Considerations in

Assessing a Risk Management

Framework
A risk framework is an overall plan of implementation of risk management, which
includes a combination of the scope, policy, profile and process. Frameworks are not
static documents and must be updated to reflect significant changes to a business’s
organizational structure, outsourcing arrangements, products or services, operating
environment, acquisitions or mergers, geographical area of operation, funding
arrangements and customer base. Some of the key considerations that risk practitioners
and institutions need to take into consideration when assessing the effectiveness of a
Risk Management Framework would include the following:

1. Are the objectives of the framework clearly stated?

2. Does the framework state how OR contributes to corporate governance?
3. Does the framework contribute to securing the business objectives?
4. Does the framework influence decision making?
5. Is the vocabulary adopted within the framework explained?
6. Is the framework comprehensive, describing the risk scope, risk policy,
risk profile and risk process?
7. Is the framework sufficiently clear and is the vocabulary adopted used
consistently?
8. Has the framework been explained to the board, business department heads and
line management, and is it understood?
9. Does the framework state the risk taxonomy adopted and hence the elements,
attributes and features being addressed?
10. Is an individual or a committee assigned the responsibility of maintaining
the framework? Does the framework state how risks are quantified?
11. Does the framework (depending on the business of the firm) state how the
regulatory capital to be set aside for risk losses is to be calculated?
12. Has an independent review of the framework been undertaken to evaluate it
against best practice?