Armoiries GaspozLAURENT GASPOZ
Skip directly to the CV

Animated experience — Risk management and intelligence

From weak signal to decision

  1. 01 — Framework and risk appetite

    Establish the risk management framework: connect strategic objectives, appetite, tolerances and accountabilities, to give a shared meaning to the word "risk".

    • Strategic objectives — Link the risk framework to the organization's objectives and business model.
    • Appetite and tolerance — Formalize acceptable thresholds by risk category and escalation limits.
    • Roles and three lines — Clarify responsibilities, coordination and independence across the lines of defense.
    Deliverables
    Risk management policy · Risk appetite statement · Roles and responsibilities matrix
    Interactions
    Board of Directors · Audit Committee · Executive Management · Internal Audit
    Competencies
    Enterprise Risk Management & governance · COSO ERM & ISO 31000 · Leadership & governance · Executive communication
    Expected outcomes
    A shared risk framework, connected to strategy and governance bodies

  2. 02 — Risk identification

    Identify risks by process, entity and theme, including emerging, cyber, third-party, project and fraud risks.

    • Workshops and interviews — Gather risks from business lines, support functions and management.
    • Risk register — Structure causes, events and consequences in a single, living register.
    • Emerging risks — Track technological, regulatory, geopolitical and climate developments.
    Deliverables
    Risk register · Risk taxonomy · Emerging risk watch
    Interactions
    Business lines · IT & cybersecurity · Compliance · Crisis management
    Competencies
    Risk maps and registers · Cyber, third-party and project risks · Active listening and workshop facilitation · Professional judgment
    Expected outcomes
    A complete and structured inventory of the organization's risks

  3. 03 — Assessment and prioritization

    Assess each risk in terms of impact and likelihood, before and after controls, then prioritize using heat maps readable by management.

    • Assessment scales — Define consistent financial and non-financial scales, comparable across entities.
    • Inherent and residual — Distinguish gross risk from net risk after accounting for existing controls.
    • Heat mapping — Position risks on a heat map and identify breaches of appetite.
    Deliverables
    Assessment scales · Risk heat map · List of risks outside appetite
    Interactions
    Risk owners · Finance · Internal Audit · Executive Management
    Competencies
    Impact-likelihood assessment · Inherent and residual risks · Prioritization · Quantitative analysis
    Expected outcomes
    A defensible prioritization of major risks

  4. 04 — Treatment and controls

    Choose the appropriate response for each risk and link significant risks to testable key controls and monitored action plans.

    • Response strategy — Decide to avoid, reduce, transfer or accept, consistent with appetite.
    • Risk-control matrix — Link each significant risk to the key controls covering it.
    • Action plans — Define actions, owners and deadlines, then track their effective execution.
    Deliverables
    Risk-control matrix · Treatment plans · Action tracking
    Interactions
    Process owners · Internal control · Insurance · IT
    Competencies
    Risk-control matrices · Testing, evidence and remediation · Resilience and continuity · Execution tracking
    Expected outcomes
    Major risks covered by explicit, traceable responses

  5. 05 — Indicators and weak signals

    Measure the real evolution of risks through stable indicators and leverage data and weak signals using analytics and responsible AI.

    • Key risk indicators — Define KRIs and KPIs linked to appetite thresholds and action plans.
    • Data and analytics — Cross internal and external sources to detect trends, anomalies and breaks.
    • Responsible AI — Govern AI usage: data quality, explainability, traceability, data protection.
    Deliverables
    Set of indicators · Risk dashboard · Responsible AI usage framework
    Interactions
    Data & analytics · IT · Data protection · Business lines
    Competencies
    Risk Intelligence and decision-making · Data analytics · Responsible AI · Weak signals
    Expected outcomes
    A dynamic and measured view of actual exposure

  6. 06 — Scenarios, decision and reporting

    Turn analysis into decision: simulate scenarios, inform management trade-offs and report to governance bodies in a traceable manner.

    • Scenarios and resilience — Test crisis, continuity and disruption situations to stress-test responses.
    • Decision support — Present options, consequences and costs for an informed management trade-off.
    • Reporting to governance bodies — Report to the Audit Committee and the Board on the evolution of the risk profile.
    Deliverables
    Scenario analyses · Trade-off memo · Risk report to governance bodies
    Interactions
    Board of Directors · Audit Committee · Executive Management · Internal Audit
    Competencies
    Scenarios and resilience · Executive communication · Integrated assurance · Accountability
    Expected outcomes
    Prioritized, traceable and documented decisions on risks