Institutional Research Publication
The Method
In plain terms: take a real business activity, score how exposed it is, score how well its controls contain that exposure, and turn both into one comparable risk number.
Risk Accounting converts observable business activity and structured assessments of exposure and mitigation into a common, method-defined representation of inherent and residual non-financial risk.
Stage 01
Business activity
Stage 02
Exposure weighting
Stage 03
Inherent Risk
Stage 04
Mitigation assessment
Stage 05
Residual Risk
Foundational Concepts
Method at a Glance
Before exploring the sequential steps, the method establishes two foundational constructs to distinguish between baseline exposure and control effectiveness.
Exposure
The structural and activity-related basis used to represent the risk associated with an identifiable business activity, product, service, or process prior to mitigating factors.
Mitigation
The assessment considers whether expected mitigation is present and how effectively it operates in practice.
STEP 1
Define the Activity / Product / Process
The method begins with an identifiable activity, product, service, or process, defined consistently through time so that changes can be interpreted against a stable reference.
Unit of Observation
Consistent Reference & Transparent Scope
The definition emphasizes transparent boundaries for observation, exposure weighting, and mitigation assessment.
STEP 2
Exposure Uncertainty Factor (EUF)
EUF represents structural risk characteristics and uncertainty associated with the defined activity, product, service, or process. It is distinct from amount, volume, or throughput.
Structural characteristics
Inherent Structural Attributes
Structural uncertainty captures complexity, operational dependencies, and environment stability. It establishes an exposure profile distinct from changes in day-to-day activity.
STEP 3
Value-Based Weighting / Business Activity
Actual business activity or throughput contributes to exposure through value-based weighting and remains distinct from structural uncertainty represented by EUF.
Business activity / weighting
Observable throughput or transaction scale informs the relative weight of the unit without asserting mechanical, proportional, or predictive causation on ultimate losses.
Distinct from structural uncertainty
The method distinguishes changes in business activity from changes in structural exposure and mitigation.
STEP 4
Inherent Risk
Inherent Risk represents the exposure associated with the defined activity before mitigation is considered.
Structural exposure
+
Business activity / weighting
→
Inherent Risk expressed in Risk Units
Mathematical relationships and conversion mechanisms follow the canonical methodology specification without heuristic approximations.
STEP 5
E-RCSA and Mitigation Assessment
E-RCSA provides a structured assessment of the effectiveness of the controls and other mitigation arrangements relevant to the activity being measured.
Mitigation expectation
Assesses whether the expected mitigation arrangements are present for the activity being measured.
Operating effectiveness
Assesses how effectively the mitigation arrangements operate in practice.
Supporting evidence
Considers the supporting information relevant to the assessment.
Assessment result
Records the assessment result used by the method to represent mitigation effectiveness through the Risk Mitigation Index.
STEP 6
Risk Mitigation Index (RMI)
The Risk Mitigation Index (RMI) is the method-defined normalized representation of mitigation effectiveness used in Risk Accounting. It represents the assessed effectiveness of the relevant mitigation arrangements and provides the method input used to move from the inherent-risk position to the residual-risk position.
STEP 7
Residual Risk
Residual Risk is the method-defined risk position remaining after the effect of assessed mitigation has been reflected. Both Inherent Risk and Residual Risk are expressed in Risk Units.
Inherent Risk
→
mitigation represented through RMI
→
Residual Risk
Methodological Qualification
Residual risk expresses residual exposure under method assumptions, avoiding predictive claims or equivalence to capitalised accounting reserves.
A Concrete Worked Example: Commercial Payment Processing
To see how the calculations work in practice, consider a commercial bank unit that processes corporate wire transfers:
- 1. Activity Volume & Scale: The department processes 1,000 corporate transfers daily, establishing the baseline operational scale.
- 2. Exposure Uncertainty Factor (EUF): Operational conditions (transaction velocity, fraud attractiveness, system dependencies, staff turnover) are scored on a standardised scale. The team calculates an EUF of 1.40.
- 3. Inherent Risk: Multiply volume by EUF to determine gross inherent risk before controls:
1,000 × 1.40 = 1,400 Inherent Risk Units (RUs) - 4. Control Assessment (E-RCSA & RMI): The bank audits its controls—dual-authorisation thresholds, automated fraud screening, and staff training. These achieve an assessed Risk Mitigation Index (RMI) of 75% (0.75). The unmitigated residual factor is 25% (1.00 − 0.75).
- 5. Residual Risk: Multiply inherent risk by the unmitigated residual factor:
1,400 Inherent RUs × (1 − 0.75) = 350 Residual Risk Units (RUs)
The Management Benefit: Instead of subjective red-amber-green heatmaps, leadership tracks an objective, comparable number: 350 RUs. If payment volume surges 40% or a screening tool fails, the RU count spikes immediately—signalling rising exposure before losses occur.
Glossary of Key Terms
- Risk Unit (RU)
- The standard, additive unit of non-financial and operational risk. It quantifies the current exposure carried by an activity at a point in time.
- Exposure Uncertainty Factor (EUF)
- A standardised rating applied to activity volume that reflects environmental complexity, pace, technology dependency, and error susceptibility.
- Value-Based Weighting (VBW)
- An adjustment weighting that calibrates operational risk exposure against the financial scale and strategic value of the underlying activity.
- Risk and Control Self-Assessment (RCSA / E-RCSA)
- The structured evaluation process used by business units to evaluate the operational effectiveness of internal controls and risk mitigants.
- Risk Mitigation Index (RMI)
- A percentage score (0% to 100%) measuring how effectively internal controls contain and mitigate inherent exposure.
- Inherent Risk
- The gross operational risk generated by an activity before accounting for internal controls (Activity Volume × EUF).
- Residual Risk
- The net risk remaining after applying verified controls: Inherent RUs × (1 − RMI).
Measurement Standard
Risk Units — The Common Denomination
The Risk Unit is the method-defined common unit used within Risk Accounting. The empirical properties and limits of that common-unit representation remain subjects of ongoing research.
consistent measurement through time
Enables longitudinal tracking of a defined process against its own baseline under consistent evaluation protocols.
aggregation where methodologically justified
Allows organizational consolidation across peer activity units only where risk types share methodological compatibility.
comparison of inherent and residual positions
The resulting assessment provides the input used by the Risk Accounting method to represent mitigation effectiveness through the Risk Mitigation Index.
visibility of changes in activity versus mitigation
Disentangles operational expansion or contraction from shifts in control design and operational execution.
Process Architecture
The Complete Measurement Flow
The end-to-end structure operates as a controlled sequence from operational boundary to residual metric.
Activity / Product / Process
↓
Exposure characteristics (EUF) + Business activity / weighting (VBW)
↓
Inherent Risk (RUs)
↓
Mitigation assessment / E-RCSA
↓
Risk Mitigation Index
↓
Residual Risk (RUs)
Longitudinal Analysis
What Changes Over Time?
Risk Accounting provides structured visibility into operational evolution across distinct dimensions without claiming predictive certainty or proving mechanical causation.
Dimension 01
Changes in the level or composition of activity
Reflects alterations in transaction volumes, service delivery scales, or product mix through updated value-based weighting.
Dimension 02
Exposure characteristics where applicable
Captures changes in process design, dependencies, technology, or the operating environment that may affect EUF representation.
Dimension 03
Mitigation effectiveness
Monitors documented changes in control design, evidence trails, and sustained operational execution through E-RCSA reviews.
METHOD, EVIDENCE AND DEVELOPMENT
Three distinct domains
The method defines a measurement architecture. Research examines how its properties and outputs behave. Development documents proposed extensions and standards work. These domains should remain analytically distinct.
THE METHOD
Defines the measurement architecture, terminology, and calculation rules used to represent inherent and residual non-financial risk.
RESEARCH & EVIDENCE
Examines whether method properties and outputs behave as hypothesised through research, testing, and evidence review.
DEVELOPMENT & STANDARDS
Documents proposed extensions, governance, standards development, and ongoing methodological work.
Examine the evidence
Review the research examining how Risk Accounting’s method properties and outputs behave in practice.