One ERM platform for the two risks that sink banks: operational risk — with RCSA, loss events, and KRIs as first-class workflows — and technology risk, where incidents and failed changes feed straight into the risk and loss model. ISO 27005, NIST CSF, Basel, and NIA Qatar, preloaded.
Enterprise risk lives where the work happens. Map the process, the risks it carries, and the controls that hold — so RCSA, loss events, tech incidents, and risk aggregation all roll up to an owner, not a spreadsheet.
Every business process has an owner and a hierarchy — payments, treasury, lending, change management. The risks roll up to the people accountable for them.
RCSA campaigns scoped to each process: inherent, control, residual — with second-line challenge and management sign-off. Not a once-a-year spreadsheet.
Design and operating effectiveness, mapped across ISO 27005, NIST CSF, and NIA Qatar at once. Change a control, watch residual recompute.
Operational risk and technology risk — the two that show up in every regulator's ICAAP letter — most tools scatter across modules. Unified here under one process-centric model, so a loss event links to the process, the risk, and the control that failed.
Map business processes, owners, and the risks each one carries.
process → risk → controlInherent and residual scoring, heatmaps, treatment plans.
R-001 … R-240Self-assessment campaigns with challenge and second-line review.
campaign → review → sign-offDesign and operating effectiveness, mapped to every framework once.
ISO · NIST · NIANear-miss to actual loss, Basel-categorised, with root cause.
Basel 7 × business lineOutages, failed changes, batch failures — linked to risk and loss.
incident → loss → issueThresholds, tolerances, escalation, and trend forecasting.
breach → actionForward-looking: outage, fraud, third-party, ransomware.
forward-looking| ID | Risk | Severity | Mapped control | Effectiveness | Owner |
|---|---|---|---|---|---|
| R-042 | Batch settlement job fails past cut-off | CRITICAL | OPS-CHG-04 | 41% | S. Okafor |
| R-017 | Unreviewed privileged access in core banking | HIGH | ISO-A.5.17 | 63% | M. Chen |
| R-091 | Vendor offboarding lacks access revocation | HIGH | TPRM-09 | 58% | J. Patel |
| R-008 | Payment reconciliation breaks on FX cut-over | MEDIUM | OPS-REC-02 | 71% | R. Adeyemi |
| R-103 | DR failover untested for the core platform | MEDIUM | ITSC-13 | 77% | L. Novak |
| R-055 | Manual journal overrides above threshold | LOW | FIN-CTL-07 | 88% | D. Rossi |
Field notes from people who have run enterprise risk inside regulated banks — RCSA, technology incidents, and practical framework crosswalks for the GCC and beyond.
If it runs once a year and nobody challenges it, it is theatre. How to make RCSA a living second-line process.
7 min read · by S. VisserCore banking outages start as routine changes. Link incidents to risk and loss before the regulator asks.
5 min read · by M. ChenThe overlap is bigger than vendors admit. A practical crosswalk for Gulf financial institutions.
9 min read · by J. PatelNo deck. We map a process to its risks and controls, run an RCSA, link a tech incident to a loss event, and show you the gaps live. Free, no obligation.