Colin Calleja
Director of Risk
The Business Risk Assessment (BRA) is a regulatory obligation that has been drawing increased scrutiny by supervisory authorities. The BRA enables organisations to develop a thorough understanding of the inherent and residual risks present in their operating environment. BDO applies a BRA methodology which can be adopted to the industry or sector in which an organisation operates. The methodology meets of the regulatory requirements, emanating primarily from the FIAU Implementing Procedures. The BRA methodology is quantitative in nature.
BDO Malta’s Business Risk Assessment (BRA) Methodology
BDO’s Business Risk Assessment methodology is designed to reflect the nature, size and complexity of your organisation, as well as the industry or sector in which it operates. It is intended to identify and assess specific risks which may impact the organisation. A comprehensive risk scoring is applied to assess the inherent risks and control effectiveness implemented across the organisation.
BDO Malta’s Business Risk Assessment (BRA) process includes the following phases:
- an introductory phase and a walk-through phase where we understand the business environment
- a risk assessment phase comprising risk identification, analysis and evaluation, and
- a concluding phase with a Business risk assessment (BRA) report which details the organisation’s risk profile.
The BRA methodology considers five main risk factors: customer risk, geographical risk, interface risk, product risk and enterprise risk. It follows a 6-step process including: risk identification, risk evaluation, effectiveness control, risk mitigation, monitoring/review and continuous improvement.
How can BDO help?
BDO can assist organisations to complete their business risk assessment, not only for regulatory purposes, but with the aim of assessing their overall risk profile. In this respect, it is recommended that a business risk assessment is reviewed and updated on a regular to reflect the current business environment in which the organisation is operational.