Risk Metric
What is Risk Metric?
A quantifiable measure used to track and communicate the level of risk exposure and the effectiveness of risk management activities.
Frameworks that govern risk metric
What the standards actually require on risk metric
Requirements naming risk metric across 5 standards, quoted from the control text.
Establish governance + risk management + three lines of defense per OSFI Guideline B-13 Technology and Cyber Risk Management (issued July 2022, effective 1 January 2024).
OSFIB13-1 · Governance, Risk Management, and Three Lines of Defense →Advanced or automated analytics supply predictive information and real-time risk metrics.
ffiec-cybersecurity-assessment-tool-cat::D1.RM.RA.Inn.3 · D1.RM.RA.Inn.3 Risk Assessment (Innovative 3) →Advanced control principles for cyber risk identification, assessment, treatment and monitoring (required, with baseline and intermediate, of an AI whose inherent risk is high).
hkma-cyber-resilience-assessment-framework-c-raf::2.2.A · 2.2 Cyber risk identification, assessment, treatment and monitoring: advanced level →The FI should institute a process to assess and monitor the design and operating effectiveness of IT controls against identified risks;
monetary-authority-of-singapore-technology-risk-management-guidelines::4.5 · 4.5 Risk Monitoring, Review and Reporting →Every source of liquidity risk, and every event that could cause it to crystallise, is identified; the consequences are considered under both normal and stressed conditions;
principles-for-doing-business-at-lloyd-s::P9.1 · 9.1 Identify and assess key sources of liquidity risk with monitoring and reporting →Questions people ask about risk metric
What is Risk Metric?
Why is Risk Metric important for compliance?
Which compliance frameworks address Risk Metric?
Where can I learn more about Risk Metric?
See how Risk Metric applies across compliance frameworks
Our platform maps 1,016 frameworks with 316K cross-framework control mappings. Explore how this concept is addressed across standards.