11.2 Risk Identification

SEC Certification Examination Phase 1 General

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Corporate Structure & Capital Stock

1.1 Philippine Corporate Formation and Capital Structure 1.2 Common and Preferred Shares 1.3 Stockholder Rights and Corporate Actions 1.4 Corporate Debt and Fixed Income Instruments

2 Chapter 2: Financial Markets and Securities Products

2.1 Money Market and Capital Market Instruments 2.2 Collective Investment Schemes and Funds 2.3 Philippine Stock Exchange (PSE) Structure and Trading 2.4 Real Estate Investment Trusts (REITs) and Asset-Backed Securities

3 Chapter 3: Macroeconomic Principles and Monetary Policy

3.1 Gross Domestic Product, Inflation, and Business Cycles 3.2 Monetary Policy and the Bangko Sentral ng Pilipinas (BSP) 3.3 Fiscal Policy, National Debt, and Foreign Exchange 3.4 Philippine Financial Regulatory Architecture

4 Chapter 4: Financial Mathematics and Valuation Concepts

4.1 Time Value of Money and Interest Calculations 4.2 Bond Valuation and Yield Concepts 4.3 Equity Valuation Metrics and Financial Ratios 4.4 Investment Return, Risk Metrics, and Portfolio Principles

5 Chapter 5: The Securities Regulation Code (SRC) & Securities Registration

5.1 Legislative Framework and SEC Regulatory Powers 5.2 Definition and Scope of Securities 5.3 Mandatory Registration of Securities 5.4 Exempt Securities and Exempt Transactions

6 Chapter 6: Market Intermediaries & Trading Conduct

6.1 Registration of Brokers, Dealers, Associated Persons, and Salesmen 6.2 Duties and Ethical Standards of Market Professionals 6.3 Supervision and Compliance Organization 6.4 Books, Records, and Customer Account Handling

7 Chapter 7: Market Manipulation, Insider Trading & Public Disclosures

7.1 Prohibited Acts and Market Manipulation 7.2 Insider Trading and Unlawful Disclosures 7.3 Tender Offer Rules, Proxy Solicitation, and Periodic Reports

8 Chapter 8: Principles of Corporate Governance & Board Oversight

8.1 Evolution and Governance Framework in the Philippines 8.2 Board Composition, Roles, and Fiduciary Duties 8.3 Independent Directors and Term Limits 8.4 Board Committees and Special Responsibilities

9 Chapter 9: Internal Controls, Disclosure & Shareholder Rights

9.1 Internal Control System and Internal Audit Function 9.2 Related Party Transactions (RPT) Policy and Governance 9.3 Corporate Transparency and Timely Disclosure 9.4 Rights of Shareholders and Stakeholder Engagement

10 Chapter 10: Risk Concepts and Categories

10.1 Risk, Uncertainty, and Objectives 10.2 Financial Risks: Market, Credit, and Liquidity 10.3 Non-Financial Risks: Operational, Strategic, and Reputational

11 Chapter 11: Risk Management Process

11.1 Risk Management: Coordinated Direction and Control 11.2 Risk Identification 11.3 Risk Analysis and Evaluation

12 Chapter 12: Risk Treatment and Hedging

12.1 Risk Treatment, Mitigation, Monitoring, and Review 12.2 Hedging: Purpose and Exposure Identification 12.3 Hedging Strategies and Instruments 12.4 Integrated Risk Scenarios and Review

13 Chapter 13: AML Legal Framework & Institutional Governance

13.1 Anti-Money Laundering Act of 2001 (AMLA) and Amendments 13.2 Anti-Money Laundering Council (AMLC) Powers and Structure 13.3 Money Laundering Offenses and the Three Stages 13.4 Compliance Framework and Money Laundering Prevention Program (MLPP)

14 Chapter 14: Customer Due Diligence, Reporting & Record Keeping

14.1 Customer Due Diligence (CDD) and Know-Your-Customer (KYC) 14.2 Politically Exposed Persons (PEPs) and High-Risk Relationships 14.3 Covered and Suspicious Transaction Reporting 14.4 Record Keeping, Freezing of Assets, and Penalties

11.2 Risk Identification

Key Takeaways Explain This Topic AI

Risk identification asks what could help or hinder objectives, why it could happen, and what consequences could follow.

Identification should cover internal and external sources, existing and emerging risks, dependencies, concentrations, and control failure.

A risk register records structured information but does not replace inquiry, analysis, or ownership.

Historical incidents are useful but insufficient because future conditions and extreme scenarios may differ from the past.

A clear cause-event-consequence statement produces better analysis and treatment than a one-word risk label.

Last updated: October 2026

11.2 Risk Identification

Risk identification is the systematic process of finding, recognizing, and describing risks that could affect objectives. Its purpose is completeness sufficient for decision making—not an endless list of every imaginable event. Identification starts with the objective, because a condition becomes relevant when it could alter an intended outcome.

Questions that expose risk

A structured review asks:

What must happen for the objective to succeed?

What could prevent, delay, degrade, or unexpectedly improve the result?

What internal or external sources create uncertainty?

What assumptions are being made, and how could they fail?

Where are the dependencies, single points of failure, and concentrations?

What changes in law, technology, markets, clients, competitors, or counterparties are emerging?

Which controls could fail, be overridden, or become obsolete?

What direct, indirect, delayed, or cumulative consequences could follow?

This approach avoids confusing a department with a risk. “Information technology” is an area; “unauthorized access changes customer account data, causing loss and regulatory breach” is a risk statement.

Identification techniques

No single method is complete. Common techniques include:

Interviews and workshops with process owners, control functions, technical specialists, and affected stakeholders.

Process mapping to identify handoffs, approvals, data inputs, reconciliations, and failure points.

Checklists and taxonomies based on regulation, industry experience, and prior assessments.

Incident, loss, complaint, and near-miss data showing how controls have failed.

Scenario analysis and stress exploration for rare, severe, or unprecedented events.

Document review of contracts, products, financial statements, audit findings, regulatory notices, and vendor arrangements.

Environmental scanning for legal, economic, technological, geopolitical, and social change.

Checklists improve consistency but can anchor the team to familiar risks. Workshops add judgment but can be dominated by senior voices. Incident data is concrete but backward-looking. Combining methods reduces blind spots.

Sources, events, and consequences

A strong description uses a cause-event-consequence form:

Because of source or cause , event may occur, leading to consequence for the objective .

For example: “Because customer cash reconciliations rely on a manual spreadsheet, an input error may remain undetected, causing an inaccurate balance, delayed settlement, client harm, and a books-and-records breach.” The statement makes it possible to test causes, controls, likelihood, and several consequences.

The same source can generate several events, and events can cascade. A vendor outage may halt order entry, delay confirmations, trigger complaints, and attract regulatory scrutiny. Dependencies should be explicit: the firm may appear diversified across systems while all use the same cloud region or telecommunications provider.

Emerging, aggregate, and systemic risk

An emerging risk is newly developing or changing in significance, often with limited data. Identification should not discard it merely because probability cannot yet be estimated precisely. Aggregate risk considers exposures that are modest individually but material together. Systemic risk concerns disruption that impairs broader market or financial-system functions through common exposures, interconnectedness, or loss of confidence.

The risk register

A useful register can record:

• Field Purpose
• Objective and risk statement Connect exposure to intended result
• Category and source Support aggregation without replacing narrative
• Owner Establish accountability
• Existing controls and control owner Show current response
• Inherent and residual assessment Distinguish exposure before and after controls
• Indicators and limits Enable monitoring
• Treatment actions, due dates, and status Track remediation
• Escalation and review date Keep information current

The register is an output, not the process itself. Copying last year's entries without challenging assumptions creates false confidence.

Completeness and stopping criteria

Identification is sufficiently complete when relevant perspectives and reliable sources have been used, major processes and dependencies have been examined, plausible severe scenarios have been considered, and additional effort is unlikely to change the decision materially. Unknowns and data gaps should be recorded rather than converted into unjustified certainty.

Exam method

Prefer a description that names cause, event, and consequence. Do not rely only on past losses. Look for hidden concentration, outsourcing dependencies, changes in conditions, and control failure. Assign an owner who can influence the risk—not merely the person who records it.

Completeness and Change Triggers

Identification should combine forward-looking and historical sources: process mapping, product approval, incident and near-miss data, complaints, audit findings, legal inventories, vendor dependencies, scenario workshops, market intelligence, and external loss events. The risk register is not static. New products, system migrations, acquisitions, regulatory changes, outsourced services, staffing changes, and unusual market conditions should trigger reassessment. A strong entry separates the underlying cause from the event and consequence, avoiding duplicates that describe the same exposure with different labels. It also identifies affected objectives and dependencies so later analysis does not overlook correlated or cascading failures.