Moment A
The program was never really built
A risk function exists on the org chart. The RCSA is a spreadsheet inherited from someone who left. There is no defensible link between the risks named, the controls tested, and the losses actually taken.
Operational Risk Advisory · For Financial Institutions
A risk program your examiner can follow.
Most operational risk programs fail the same way: the register is stale, the assessment is completed on schedule and acted on rarely, and the reporting cannot survive a regulator's follow-up question. Enderassey builds risk programs that hold up under scrutiny because they were designed by someone who has sat on the receiving end of the examination.
Who calls us
Three moments
Moment B
An exam or an audit is coming
The finding is already written in your head. You need the risk register, the control documentation, and the governance reporting to say the same thing, and you need it to be true before it is presented.
Moment C
The program outgrew the framework
The risk function was designed for a smaller operation. Product lines, third parties, and regulatory attention have all increased since, and the taxonomy and rating scales have not been revisited.
Engagement 01
4–6 weeks · Fixed fee
Operational Risk Program Diagnostic
What it is
A short, examiner-led assessment of the risk program you already have. We trace a sample of your risks from the register through the controls, the testing evidence, and the reporting, and we tell you where the chain breaks.
Designed for the executive who already suspects the answer but needs evidence, priorities, and a defensible plan before committing budget or headcount.
What you receive
A traceability test from risk to control to evidence to reported conclusion. An assessment of your RCSA methodology, risk register, issue management, and KRIs against what an examiner will actually ask for. A prioritized 90-day remediation plan.
If a full program build is warranted, you leave with its scope and its price. If it is not, we say so.
Engagement 02
3–6 months · Fixed fee
Operational Risk Program Build
What it is
A COSO-aligned operational risk management program, designed and stood up end to end: risk identification, risk and control self-assessment, the risk register, issue and action management, and the governance reporting that carries it to the board.
This is the program that was built once already, at a top-tier annuity carrier, from nothing. Assessment cycle time came down 50% through Lean process redesign, because cycle time determines whether the assessment is finished at all.
What you receive
A risk taxonomy your business actually recognizes. An RCSA methodology with rating scales, challenge criteria, and evidence standards. A working risk register with named owners and live issues. Key risk indicators tied to something that moves. A reporting pack your executives can defend without a translator.
The deliverable is a running cycle. We run the first assessment with your team and hand it over.
Engagement 03
Annual agreement · Continuous coverage
Fractional Risk Officer
What it is
Senior operational risk leadership on an annual agreement. A loaded risk officer costs well into six figures a year, and most mid-size operations need the judgment rather than the headcount.
When the examiner's request list arrives, you have a named practitioner who already knows your register, your controls, and your open issues.
What you receive
Quarterly control testing and challenge of the assessment cycle. Governance reporting support through to the board or risk committee. Regulator and auditor response support. An annual refresh of the taxonomy, the rating scales, and the key risk indicators.
Where both functions are needed, this engagement and the fractional fraud officer are covered under a single agreement.
How we price
Fixed scope and fixed fee, stated in writing.
Every Enderassey engagement is scoped and priced in writing before work begins. If the scope changes, the fee conversation happens before the work does.
The principal does the work. No leverage model, no junior staff learning on your engagement.
Next step
Start with a conversation
About thirty minutes, confidential, and carrying no obligation. Describe your program and your exposure, and we will tell you what will hold and what will not.