We also track inherent risk, controls, and residual risk by products and task, then roll up to line of business ratings. Our assessment is based on the FFIEC guidance, but we have added additional fair lending and UDAAP factors based on recent consent orders, regulatory guidance, and exam experiences. As we go through our assessment, we consider findings from testing and reviews by the first, second, and third lines of defense; complaints; regulatory examinations; model validations; etc.
_________________________
Opinions are strictly my own, and have nothing to do with my employer.