Clearly, this first principle is the base upon which the other principles stand. If this principle is not followed, then the impact of the other principles is, to all intents and purposes, nullified. 2. Second, there needs to be a clear understanding of the risk inherent in the business model adopted by the institution.
The risk control framework needs to give a bird’s eye view of the risks associated with the high-level overarching strategy, individual business lines and specific portfolios. Even the risks associated with the off-balance sheet activities of the institution cannot be overlooked.