Exposures and vulnerabilities are top-down risk identification tools. Business risk exposure is inherent in every financial firm while vulnerabilities are the weakest links in business activities.

The key benefit of using a list of exposures and vulnerabilities as a brainstorming technique for risk identification is that it is business specific.

Examples of vulnerabilities are issues in control systems, systems overdue for updates, overdue resolutions of issues, stand-alone systems, unmonitored operations or people, blind spots among others.

A, B & D are incorrect. Examples of exposures are critical third parties, key persons, key distribution channels, main drivers of revenue, sources of goodwill among others.

Things to Remember

• Exposures and vulnerabilities are key components of top-down risk identification tools.
• Business risk exposure is inherent in every financial firm.
• Vulnerabilities represent the weakest links in business activities.
• Using a list of exposures and vulnerabilities as a brainstorming technique for risk identification is business-specific.
• Examples of vulnerabilities include issues in control systems, systems overdue for updates, overdue resolutions of issues, stand-alone systems, unmonitored operations or people, and blind spots.
• Examples of exposures include critical third parties, key persons, key distribution channels, main drivers of revenue, and sources of goodwill.