/Committee Pack
Live
6
Driver Register Summary: The driver register shows three Red-status drivers requiring escalation. Geopolitical Instability continues to deteriorate with sanctions additions and commodity price disruption. Cloud/Infrastructure Concentration remains structurally elevated pending multi-cloud migration. Critical Third-Party Dependency has worsened following DORA CTI designation reviews.
| ID | Risk Name | Category | Inherent | Residual | Owner |
|---|
| ID | Title | Severity | Status | Owner | Actions OD |
|---|
| ID | Title | Regulator | Rating | Status | Due |
|---|
Model Risk Committee Note: Three models are overdue for validation, including the Tier 1 HS-VaR model (276 days overdue) and the PD/LGD Credit Scoring model (547 days overdue). The Model Risk Committee is required to formally note these overdue items and confirm the compensating controls in place. A validation sprint is underway targeting completion by Q3 2026.
| ID | Model Name | Tier | Status | Lag (days) | Open Findings |
|---|
| ID | Control Name | Category | Effectiveness | Design | Next Test |
|---|
| ID | Title | Basel Category | Gross Loss | Status |
|---|
Risk Appetite Statement: The firm's risk appetite is calibrated at all three taxonomy layers. At the driver level, three drivers (Geopolitical, Cloud Concentration, Third-Party) are breaching appetite thresholds. At the event level, market risk event appetite is within tolerance. At the impact level, capital ratios remain above minimum thresholds with adequate headroom.
CRO Commentary: The risk profile remains elevated heading into Q2 2026. Three risk drivers are at Red status — Geopolitical Instability, Cloud/Infrastructure Concentration, and Critical Third-Party Dependency — requiring active board-level awareness. Model validation overdue metrics are a key concern: three Tier 1 models are overdue with the most critical (HS-VaR) now 276 days beyond its scheduled review. The committee is asked to note the 5 escalated issues and 73 overdue remediation actions.