Risk Aggregation
What is Risk Aggregation?
The process of combining individual risks to understand their cumulative effect and total exposure across the organization.
Frameworks that govern risk aggregation
What the standards actually require on risk aggregation
Requirements naming risk aggregation across 3 standards, quoted from the control text.
The framework's risk data aggregation and reporting policies, procedures and processes, appropriate to the bank's size, complexity and risk profile and supporting supervisory reporting, should provide for the design, implementation and maintenance of a data ar...
occ-heightened-standards-12-cfr-part-30-appendix-d::II.J.1 · II.J.1 Data architecture and IT infrastructure for risk aggregation →Risk aggregations are subject to governance and oversight. Baseline: a risk framework is in place that covers exposure management and catastrophe risk; material issues are discussed regularly by senior management and the board;
principles-for-doing-business-at-lloyd-s::P2.10 · 2.10 Governance and oversight of risk aggregations →Input: events, inside the organisation or beyond it, that could stand in the way of its information security objectives. Action: identify risks tied to loss of confidentiality, integrity and availability.
iso-27005-2022::7.2.1 · Identifying and describing information security risks →Questions people ask about risk aggregation
What is Risk Aggregation?
Why is Risk Aggregation important for compliance?
Which compliance frameworks address Risk Aggregation?
Where can I learn more about Risk Aggregation?
See how Risk Aggregation applies across compliance frameworks
Our platform maps 1,027 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.