Risk and Control Assessment (RCA) Programme for a large Industrial Group

This financial trading arm of a large industrial group needed to establish a full risk and control assessment programme for its headquarters activities and some of the foreign entities. Their risk function was not fully equipped to address the complexity of the tasks, and asked BDO to help, both to design and to deliver the programme of Risk and Control Assessments (RCA) workshops for the different entities.

The main challenge of this mission was to be able to deliver results quickly to demonstrate to senior management the benefits of the exercise.

In this organisation, a portion of the senior management, coming from a non-regulated industry background, did not fully grasp the criticality of the regulatory pressure for financial activities. They tended to consider the risk management function as a cost rather than a value contributing activity.

BDO was given the clear mandate to operate as efficiently as possible, to quickly demonstrate value and provide insights through the risk and control report to get buy in from the business lines.

In this mission, the history of the risk management function, the position of senior management and the particularly complex activities influenced the design of the RCA programme.

BDO had to factor in these constraints to decide how to segment the different parts of the firm to organise the RCA workshops. In parallel, they used information and lessons learned from incidents to gather insights on key risks and controls.

The RCA methodology for regulated financial entities is now well established. Based on BDO's long experience in the domain, they use the best practice expected by regulators to assess risks and controls. Alongside a widely accepted methodology, their main value add was to understand the complexities of the activities to design an effective programme and engage constructively all parties to the project.

Reporting on activities in early results was very important to get accepted by the senior management. BDO applied a strict project management methodology with regular reporting on the progress made and their deliverables. They worked in collaboration with the risk team and the internal control team, keeping internal audit informed as well. Overall, the project was executed on time, sometimes even ahead of time, to the satisfaction of the client.

As a result, the client submitted the results of its RCA programme to the satisfaction of the regulators. This was achieved for a fraction of the time and cost it would have incurred if they did this alone.