Risks
CUBE has developed a Risk Taxonomy based on customer risk data and insights from the industry. The lowest level of the risk event hierarchy is driven by data from customers.
The Data Technical Standards (DTS) codification of Risk allows customers to extract value and view data in additional dimensions. It also enables CUBE to connect and calibrate customer data at the risk level, in addition to the control level.
The DTS empowers CUBE and customers to:
- Identify Risk Events, which refer to the location or manner in which the loss occurs.
- Identify instances where customers are not articulating a genuine Risk Event, as it may be a Risk Threat, Risk Consequence, or neither of these.
Risk Definition
To reflect the commonality observed across customer data sets, CUBE has developed a three-level Risk Taxonomy. Level 3 (L3) is a network-driven list of Risk Events identified from customer data and industry datasets. Levels 1 and 2 are SME-driven aggregations of the Level 3 Risk Events.
CUBE utilizes the industry-standard Bow Tie Methodology and industry risk taxonomies to define its L3 Risk Event Taxonomy. The Bow Tie Model is depicted below:
The Bow Tie Methodology facilitates the identification of risks and controls. It enables the identification of:
- Threats that can result in risk events and the subsequent consequences of that risk event.
- Which side of the Risk Event controls reside.
Through this approach, the Bow Tie Methodology empowers CUBE and customers to concentrate on the Risk Event as the primary data point, rather than Risk Threats, Risk Consequences, or Non-Risks.
Risks at L3 must be constructed using a negative adjective or negative noun. For example:
- Inaccurate external report
- Third-party documentation deficiencies
- Breach of financial sanctions or embargo orders
- Failure to deal with regulator appropriately
| Risk | Definition |
|---|---|
| Risk Event (focus of the matching) | What went wrong or could go wrong. The event requires a negative adjective or negative noun |
| Risk Threat | Circumstance that can cause the event to happen |
| Risk Consequence | The result / implications of the event occurring |
| Other | None of the above (non-risk). Unclear / contradictory names and descriptions. Not found in the CUBE Risk Index |