Risk Assessments on Systems and Processes
Risk Assessments on Systems and Processes
Why Is This Important?
Risk assessments on systems and processes are a cornerstone of sustaining program performance in investment management. Without a structured approach to identifying, evaluating, and mitigating risks within the systems and processes that support investment performance measurement and reporting, firms expose themselves to significant operational, reputational, and regulatory hazards. Errors in performance data can lead to misstated returns, incorrect fee calculations, flawed investment decisions, and violations of compliance standards such as the GIPS® standards. For CIPM candidates, understanding risk assessments is essential because it demonstrates mastery of how to safeguard the integrity and reliability of performance-related outputs.
What Is a Risk Assessment on Systems and Processes?
A risk assessment on systems and processes is a systematic evaluation designed to identify potential points of failure, inaccuracy, or vulnerability within the workflows, technology platforms, data feeds, calculations, and reporting mechanisms used in performance measurement. It involves:
- Identifying risks: Cataloging all potential sources of error or disruption, including data input errors, system outages, incorrect calculation methodologies, unauthorized access, and inadequate documentation.
- Evaluating risks: Assessing the likelihood and potential impact of each identified risk. This is often done using a risk matrix that rates risks on scales of probability and severity.
- Prioritizing risks: Ranking risks to determine which require the most urgent attention and resource allocation.
- Mitigating risks: Implementing controls, procedures, and safeguards to reduce the likelihood or impact of identified risks.
- Monitoring and reviewing: Continuously tracking the effectiveness of controls and reassessing risks as systems, processes, and business environments evolve.
How Does It Work in Practice?
1. Scope Definition
The assessment begins by defining the scope — which systems and processes will be evaluated. This typically includes:
- Portfolio accounting systems
- Performance calculation engines
- Data warehouses and data feeds (market data, benchmark data, transaction data)
- Composite construction and maintenance processes
- Client reporting workflows
- Reconciliation processes
- Fee calculation systems
2. Risk Identification
Teams map out each process from end to end. At each step, they ask: What could go wrong here? Common risk categories include:
- Data integrity risks: Incorrect prices, missing transactions, stale data, manual input errors
- Technology risks: System failures, software bugs, inadequate disaster recovery
- Process risks: Lack of documented procedures, inconsistent application of methodologies, over-reliance on key personnel
- Compliance risks: Non-adherence to regulatory requirements, GIPS standards violations
- Security risks: Unauthorized access, data breaches, inadequate user permissions
3. Risk Evaluation
Each risk is evaluated based on two dimensions:
- Likelihood: How probable is it that this risk will materialize? (e.g., low, medium, high)
- Impact: If the risk does materialize, what is the severity of the consequence? (e.g., minor, moderate, critical)
A risk matrix or heat map is commonly used to visually represent and prioritize risks.
4. Control Design and Implementation
For each significant risk, controls are designed. Controls can be:
- Preventive: Designed to stop errors before they occur (e.g., automated validation checks, access controls, standardized templates)
- Detective: Designed to identify errors after they occur but before they reach the end user (e.g., reconciliation procedures, exception reports, supervisory reviews)
- Corrective: Designed to fix errors once detected (e.g., error correction protocols, restatement policies)
Automation is preferred over manual controls where possible, as it reduces human error and increases consistency.
5. Documentation
All identified risks, their evaluations, the controls in place, and the parties responsible for each control must be thoroughly documented. Documentation supports auditability, knowledge transfer, and ongoing monitoring.
6. Ongoing Monitoring and Review
Risk assessments are not one-time exercises. They should be revisited regularly and whenever there are significant changes to systems, processes, personnel, or regulatory requirements. Key performance indicators (KPIs) and key risk indicators (KRIs) should be tracked to measure the effectiveness of controls over time.
Key Concepts for the CIPM Exam
- Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems. Risk assessments on systems and processes are the primary tool for managing operational risk in performance measurement.
- Segregation of duties is a fundamental control principle — no single individual should have end-to-end control over a critical process without oversight.
- Reconciliation is one of the most important detective controls. Regular reconciliation of portfolio data between systems (e.g., front office vs. back office vs. custodian) catches discrepancies early.
- Business continuity planning (BCP) and disaster recovery (DR) are essential components of system risk mitigation.
- Change management procedures ensure that changes to systems or processes are tested, approved, and documented before implementation.
- Understanding the difference between inherent risk (the risk before controls are applied) and residual risk (the risk remaining after controls are applied) is critical.
Exam Tips: Answering Questions on Risk Assessments on Systems and Processes
1. Understand the Framework: Be comfortable with the entire risk assessment lifecycle — identification, evaluation, prioritization, mitigation, monitoring. Exam questions may test your knowledge of any step in this process.
2. Distinguish Between Control Types: Know the difference between preventive, detective, and corrective controls. Be prepared to classify specific examples. For instance, an automated validation rule is preventive; a monthly reconciliation is detective; a restatement policy is corrective.
3. Apply Practical Judgment: Scenario-based questions may describe a process and ask you to identify the most significant risk or the most appropriate control. Think about what could cause the greatest harm to data integrity and what control would most effectively address it.
4. Prioritize Data Integrity: Performance measurement relies on accurate data. When in doubt about the most critical risk, errors in input data (prices, transactions, benchmarks) are almost always high priority.
5. Think About Proportionality: The level of control should be proportional to the level of risk. Not every risk requires the most expensive or elaborate control. The exam may test whether you can recommend a proportionate response.
6. Remember the Human Element: Many risks arise from manual processes and key-person dependencies. When evaluating a scenario, consider whether there is adequate segregation of duties, cross-training, and documentation.
7. Link to GIPS and Compliance: Risk assessments support compliance with the GIPS standards and other regulatory frameworks. Be prepared to connect risk assessment concepts to broader compliance obligations, such as ensuring composite construction is accurate and returns are calculated consistently.
8. Use Process of Elimination: For multiple-choice questions, eliminate answers that describe risks or controls unrelated to the specific system or process described. Stay focused on the scenario provided.
9. Watch for Keywords: Terms like inherent risk, residual risk, control environment, materiality threshold, exception reporting, and escalation procedures are commonly tested. Ensure you can define and apply each one.
10. Practice Scenario Analysis: The CIPM exam often presents real-world scenarios. Practice reading a description of a firm's process and quickly identifying: (a) what the key risks are, (b) what controls are missing or inadequate, and (c) what improvements should be recommended.
Summary
Risk assessments on systems and processes are essential for maintaining the accuracy, reliability, and credibility of performance measurement outputs. By systematically identifying, evaluating, and controlling risks, firms protect themselves from operational failures and ensure compliance with industry standards. For the CIPM exam, mastering this topic requires understanding the risk assessment framework, differentiating between types of controls, and applying practical judgment to real-world scenarios.
