Fid Risk Technicals

• What’s the difference between a risk and a control?

• A risk is a potential threat that could cause a negative outcome and can be categorized into people, systems, and external events. An example would be a person creating a fake vendor account and paying themselves company funds.

•  A control can be defined as a procedure or policy that is meant to prevent a risk from happening. An example of this would be requiring multiple people to check validity of the vendor accounts before depositing funds.

• How would you define operational risk, and how is it different from financial risk?

• Operational risk is day-to-day failures such as system outages or vendor failures. Financial risk is more quantifiable with dealing the risk of monetary loss, this can be further separated into market risk and credit risk.

• What’s the difference between market risk and credit risk? Give an example of each.

• Market risk is the risk of monetary loss due to a larger scale financial market and economy going down. An example of this is rising interest rates which can increase borrowing costs. Credit risk is a smaller scale where there is risk that a borrower will fail to meet financial obligations. For example, a person does not pay back their loan sufficiently.

• What makes a risk “high severity” versus “high likelihood,” and why do risk teams care about both?

• High severity looks at the magnitude of the risk, such as how much the financial loss would be

• High likelihood looks at the probability and the frequency of the risk. Risk teams care about both because 

• Walk me through how you’d assess the risk of a new process or product.

• First define the scope of the process or product. Meaning how large of an audience it would have and also what kind of boundaries it would have.

• Second, brainstorming with other teams about potential vulnerabilities the process or product could have

• Also quantitatively measuring the risk through scaling of numbers and also the severity and likelihood of risk. 

• What’s the difference between a preventive control and a detective control? Give an example of each.

• A preventative control is a measure to prevent a threat from happening. Example would be separation of duties to prevent fraud. Detective is meant to uncover threat/fraud. Examples would be inventory checks to make sure nothing is missing or unaccounted for.

If a control is in place but keeps failing, what would you look at first?

I would try to find out whether the failure of the control is due to a design issue or execution issue. For example, if there are any design flaws that make it too complex or undermine the threat or if it is an execution issue to check if there are any bottlenecks

• How do all financial statements connect 

• The 3 financial statements connect together through net income, working capital, and ending cash

• The net income from the income statement flows into the cash flow statement and then into retained earnings on the balance sheet