I am ready to discuss a study case to compare qualitative and quantitative risk assessments in compliance at the IE Law School. Students will compere the outcomes, biases and techniques used in both approaches. Your comments and suggestions are welcome. Enjoy the case! #complianceofficer #operationalrisk #internalcontrols #fraud #riskmanager #risks #compliance #riskassessment

1. Study case4
You are the compliance officer of a water
utility company serving 400k customers
You need to assess the risk of non
compliance with a concession contract
clause
This clause allows the regulator to
automatically apply a 100 EUR fine per
each unattended customer complain after
24 hours
Your annual budget for this fine is 30M EUR

2. Study case4
Customer offices can usually address
complains in less than 24 hours
However, unusual events such as heavy rains
or operational issues lead to large water cuts
and complains unable to be addressed in less
than 24 hours
These events may affect from few hundred to
potentially all customers
Several events and large fines occurred last
year and all your stakeholders are sensitive to
this contract clause

3. Study case4
You hold a workshop for a qualitative
assessment to assess this risk
COO – “The risk is very high, remember the
heavy rains and the operational problems
last year. We received 200,000 complains!”
Commercial Mgr – “Even worse, if the CRM
system is broken down, all customers will
be affected and complain.”
Operation Mgr – “Last year was very
unusual. It will not happen again.”

4. Study case4
CRM Manager – “Chances for a system
failure are very low, and maybe, not all
customers will complain. IT failures are less
important than heavy rains.”
CCO – “Let´s all agree that it is a “yellow
risk” to increase compliance controls. I will
update the registry. Let´s have a coffee
break.”
CEO – Declined your meeting, he needed
to attend urgent decision-making tasks.

5. Study case4
You ask the CFO for the fines paid related to this clause in the
last 4 years when the contract was awarded. He provided a
report without highlighting any real risk. Good, it is definitely a
“yellow risk”…
Account: 5.14.1022 Fines and Penalties
Cost Element: 3 Clause 210. Customer support
Balance
2019 35,000,000
2018 6,000,000
2017 3,600,000
2016 13,300,000

6. Study case4
Since you have no excuse to avoid using better data, you ask the
operation manager to assess the factors triggering customers to
massively complain. The expert prepares this matrix for you:
Heavy rains System breakdown Operational issues
Expected events per year
- Min (33% occurrence) 0 0 40
- Most likely 2 0 60
- Max 15 1 150
Expected unaddressed complains per event
- Min 2.000 300.000 200
- Most likely 10.000 300.000 400
- Max 15.000 400.000 1.000

7. Study case4
When using a
qualitative
assessment
technique as
Monte Carlo,
you discover a
maximum
annual loss of
77M EUR! The
CEO shows up.
Your budget is here
Nr.MonteCarloSimulations

8. Study case4
You prepare a tornado
chart to study the risk
factors.
With this data, the CEO
approves a 15M EUR
business continuity plan
for the CMR system.
0 EUR 30M EUR 60M EUR
Heavy rains
System breakdown
Operational
issues
Yourbudget

9. Study case4
After treatment,
the probable
maximum loss
was diminished
to 37.5M EUR a
year.
Your budget is here
Nr.MonteCarloSimulations

10. Averages are evil
Your budget was much higher
than the average expected
loss, but 20% of the scenarios
exceeded it
Historical data is not perfect
The previous history of paid
fines understated the potential
probability and impact of this
risk60° 0°