LEARN. PRACTICE. GROW.Concept and mechanism
A risk indicator needs a clear relationship to the scenario and control it tracks. Counting exceptions or completed reviews can help, but an overall percentage hides criticality differences. If 95 of one hundred access rights were reviewed and the remaining five are privileged, management needs to know that concentration. Preserve numerator and denominator and add age, impact, owner, and action. An improving trend does not mean meeting the limit: fifteen overdue exceptions remain above a limit of ten even if there were twenty before. Exercise thresholds are synthetic, not official limits imposed by a regulator or BNP Paribas.
Guided application
Reporting should support decisions. Showing exposure, deviation, alternatives, consequences, and the authority that needs to act is more useful than attaching many documents without synthesis. Precision should also match evidence: a subjective 7.43% estimate does not become objective through two decimal places. Explaining method and uncertainty helps the committee compare options. When risk is temporarily accepted, record conditions, mitigation, owner, and expiry. At expiry, reassess and obtain an authorized decision; absence of loss does not renew acceptance. Closing an action requires remediation evidence and, where applicable, observed effectiveness. A promise to finish next week is still outstanding work.
Example: 98% control completion coexists with four overdue privileged controls. The summary shows progress and the decision needed on those exceptions.
Common pitfalls
Average treated as uniform exposure; removed limit treated as compliance; decimal precision treated as certainty; temporary acceptance treated as permanent.
Related topics: Scope, governance, and accountability · Risk assessment and control effectiveness · Events, near misses, and response
Present the measure with context and connect each deviation to a trackable decision.
Reference: Revisions to the principles for the sound management of operational risk · DR operational risk professional assessment2026.10