Risk scores
Risk scores are assigned to summarise risks to capital (as specified in Title 6). These scores represent the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss), after considering the quality of risk controls to mitigate this impact (i.e. residual risk), but before consideration of the institution’s ability to mitigate the risk through available capital or liquidity resources.
Competent authorities should determine the risk score through an assessment of an institution’s inherent risk level, while duly considering the adequacy of the institution’s risk management and controls framework. In particular, an adequate risk management and controls framework may mitigate the prudential impact of a specific risk, while a weak framework may amplify the prudential impact. The assessment of inherent risk and the adequacy of management and controls should be made with reference to the considerations specified in table 6 for credit and counterparty risk, in table 8 for market risk, in table 10 for operational risk, in table 12 for interest rate and credit spread risk in the banking book (IRRBB and CSRBB), in table 17 for liquidity and funding.
When assessing risks to capital, competent authorities should also consider relevant sub-categories (e.g. concentration risk or country risk as part of the credit and counterparty risk assessment, as set out in Title 6). Depending on the materiality of any of these subcategories to a particular institution, competent authorities may decide to assess and score them individually.
Competent authorities may use different methods to apply the risk scores, they could score ‘risk’ and ‘risk management and controls’ separately (resulting in an intermediate and final score) or score them together. Competent authorities may also aggregate all the risks to capital into an aggregate score.