Risk Register Analysis
. Determine how to apply the risk driver method
. Determine how to identify a risk
. Evaluate different probabilities and impacts of risks
. Develop a risk register for evaluating costs
Purpose: As a project manager you will be responsible for determining risk, minimizing risk and
determining contingency plans for risks. Developing a risk register will help you identify risk, determine the
probability of the risk and determine how to minimize and setup contingencies for the risks.
Risk Register Analysis 2
Risk Drivers
A risk driver refers to an underlying factor, processes or errors that result into occurrence of
events that trigger a deviation from expected results or incurring of extra cost of operation in
order to meet the desired results (Martins et al, 2014). All businesses are vulnerable to risks and
risk drivers (Martins et al, 2014). In light to this, the following risk drivers were identified after a
risk analysis activity on a bank whose ATM machine provided incorrect amounts on the
customer’s register receipts at the window.
- According to Sullivan (2015), most states within the United States do not register,
monitor, examine or limit the Automated Teller machines owned by both private
individuals and their Independents Sales Organizations. Sponsoring banks of these ATMs
should conduct sufficient due diligence and background checks on the ATMs and the
Independent Sales Organizations. This is because the ATM or ISO ownership agreements
may change without the sponsoring bank’s knowledge. This results in the ATMs
becoming vulnerable to identity theft and money laundering schemes and ultimately theft.
Therefore, the irregularity in the bank ATM that is providing incorrect amounts on the
customer’s register receipts at the window could be as a result may be as a result of
money laundering schemes or fraud. - Additionally, banks nowadays conduct little or no due diligence on ATM machines
before procurement since they transfer that role to the ISOs and subcontractors who
distribute and supply ATM machines (Sivabalakrishnan et al., 2016). What this means is
that banks no longer conduct background checks on the ATM machines before purchase
to ensure that they purchase machines that do not have errors or are not faulty since they
trust the ISOs (Independent sales Organizations) and subcontractors to provide quality
Risk Register Analysis 3
machines. This leads to procurement of machines that are faulty and erroneous. The bank
ATM that is providing incorrect amounts on the customer’s register receipts at the
window could be as a result of the above mentioned risk driver.
- Another risk driver is when the ISOs sell and distribute the ATM machines through
subcontractors who are unknown to the sponsoring backs (Sivabalakrishnan et al., 2016).
Failure to conduct due diligence results in the unknown subcontractors operating the
ATM machines in fraudulent activities under the bank’s radar. An example of a money-
laundering scheme is where the subcontractors replenish the ATMs with dirty money that
is consequently withdrawn by unsuspecting customers. These schemes cause overloads
on the ATM machines thereby causing irregular activities and system failure. This risk
register analysis identified this risk as a possible risk causing the ATM to provide
incorrect amounts on the customer’s register receipts at the ATM’s window.
Risk Register Analysis 4
Probability of Occurrence of the Risk
The following risk register shows the probability of occurrence for these risks and the impact they will have to the customer. The first
table shows the grades/rating for probability of occurrence of the risk while the second is the risk assessment register
RISK REGISTER FOR: XYZ BANK
REGISTER OBJECTIVE: Identify, Mitigate and eliminate risks leading to irregular ATM activities
Rating for Likelihood of occurrence
Grade Grade Probability of Occurrence
A High probability
B Medium Probability
C Low probability
Risk Register Analysis 5
RISK REGISTER
Risk
ID #
Risk Description Suitable Contingency Plan
(Possible course of action in
case risk occurs)
Impact to customer
(How will occurrence of the
risk affect the customer)
Probability of
Occurrence
1 Most states in the US do not
register or monitor ATMs.
Unmonitored ATMs result are
susceptible to fraudulent
activities, which may be
evidenced by the wrong
figures, displayed in the ATM
receipts.
Advising customers to report
any wrong or erroneous
figures immediately regardless
of how small the margin is to
help in investigation of the
ATMs and thus documentation
and monitoring
-Customers losing money to
the machine errors
-Reduced customer
satisfaction
-Reduced trust in the bank
B
2 Little or no due diligence
conducted by the banks on the
Advising customers to report
any wrong or erroneous
-Customers losing money to
the machine errors
A
Risk Register Analysis 6
ISO who distribute ATMs.
This results in possible
scenarios where the banks
procure faulty ATM machines
that show incorrect amounts
on the customer’s receipts.
figures immediately regardless
of how small the margin is to
help in investigation of the
ATMs and thus documentation
and monitoring
-Reduced customer
satisfaction
-Reduced trust in the bank
3 Banks failure to conduct due
diligence on all the ATMs
they sponsor resulting in
money laundering schemes by
undocumented ISOs and
subcontractors. This
overloads the ATM machines
which thus experience errors
and faults such as reporting
wrong figures on the
customer receipts
Sensitize customers to report
any wrong or erroneous
figures immediately regardless
of how small the margin is to
help in investigation of the
ATMs, ISOs and thus aid in
their documentation and
monitoring
-Customers losing money to
the machine errors
-Reduced customer
satisfaction
-Reduced trust in the bank
A
Risk Register Analysis 7
Risk Register Analysis 8
Risk Minimization and Mitigation
As noted in the risk assessment register above, the key factor causing the risks is lack of due
diligence on the part of the bank. The bank should therefore design and implement suitable
procedures and policies which detect and report suspicious activities, as well as conduct due
diligence on ATMs, their ISOs and subcontractors before and after purchase. Some of these
procedures and policies may include;
Background investigation on ISOs from public databases to discover possible concerns
that may exist regarding the ISOs before getting into business with them.
Conduct background checks on the credibility of the ISOs and subcontractors on
elements such as permits, documentations and licenses to ensure legit machines are
purchases
Monitor all ATMs that the bank sponsors thereby uncovering fraudulent undocumented
subcontractors who are likely to engage in money laundering activities through the
ATMs.
Conduct periodic system checks to establish patterns exhibited by the ATMs and thus
enable the bank be in apposition to detect and report an irregularity.
Ensure the bank only gets into business with ISOs that document their due diligence on
their subcontractors which show their terms of agreement, number of ATMS included in
the agreement, their locations, volume of transaction and source of money replenishment.
This will help ensure the bank only gets into business with legitimate ISOs and
subcontractors (Kaminskiy & Krivtsov, 2016).
Review and ascertain the sources the sources of money (currency) that replenish the
ATMs that the bank sponsors through the ISOs, subcontractors or private owners. This
Risk Register Analysis 9
involves reviewing their lending arrangements, armored transportation vehicles
agreements and all other relevant documents.
Customer awareness – The first step of mitigation of the risks is stopping them on their
tracks. A good place to start is educating clients to raise alarm of any irregular activities
encountered when using the ATMs regardless of how small the margin of error (risk).
This would help in profiling of all ATMs especially those that are used in fraudulent
activities such as money laundering.
Risk Register Analysis 10
References
Martins, C., Oliveira, T., & Popovič, A. (2014). Understanding the Internet banking adoption: A
unified theory of acceptance and use of technology and perceived risk application.
International Journal of Information Management, 34(1), 1-13.
Modarres, M., Kaminskiy, M. P., & Krivtsov, V. (2016). Reliability engineering and risk
analysis: a practical guide. CRC press.
Sivabalakrishnan, M., Menaka, R., & Jeeva, S. (2016). Critical Video Surveillance and
Identification of Human Behavior Analysis of ATM Security Systems. In Combating
Security Breaches and Criminal Activity in the Digital Sphere (pp. 93-118). IGI Global.
Sullivan, K. (2015). Money-Laundering Red Flags. In Anti–Money Laundering in a Nutshell
(pp. 159-169). Apress, Berkeley, CA.
