Use data to find risks and act on them

Read the original article by Praful Mainker, published with permission from Endurance Advisory Partners. This edition uses plain language.

Risk teams need more than reports. They need facts they can act on. Those facts should show what happened, who may be affected and what to check next.

Start with the data the bank already holds. Loans, accounts, complaints and risk reviews can each show part of the picture. Public data can add context. Check the source, quality and right to use each set.

A key risk is that records sit in separate systems. Fields may be missing or used in different ways. Old records may be hard to reach. These gaps can lead to a sound-looking report built on weak data.

Risk teams also need a way to test what the business reports. If they rely only on the business team’s view, they may miss the same issues. The second line needs enough access to ask its own questions.

A report that counts cases is useful. But a count alone does not explain a risk. Read the source complaints. Link them to the process, product and other facts. Ask whether a pattern is new, growing or causing harm.

AI can help with this work. Natural language processing, or NLP, helps study written text. It can help teams find patterns across complaints that use different words. The team must still check the output and its limits.

A method trained only on past labels may miss a new issue. A method that finds groups without fixed labels can widen the search. It still needs testing. No method should be treated as free of bias just because it uses AI.

Consider a new enforcement action at another bank. The risk team may ask, “Could the same issue exist here?” There may be no set of past cases with the right label. One option is to compare a known or made-up example with the bank’s records. Similar cases can guide further review. They do not, on their own, prove the same failure. A search based on known or made-up examples tests that defined concern. It does not prove discovery beyond the examples. Keep source narratives separate from labels and past reviewer judgments.

Useful output should make the next step clear. Show the pattern, its source records, possible causes and open questions. Link the finding to the risk review. Name the person who will act and agree how to test the result.

The data program and risk program need to work together. Good tools cannot fix unclear roles or poor records. Better data, sound checks and clear owners make it easier to act on what the bank learns.

Could a reviewer trace the latest risk finding from the source data to the action taken?