35. Competent authorities should ensure that through the scoring of individual risks to capital, liquidity and funding they provide an indication of the potential prudential impact of a risk to the institution (e.g. potential loss) after considering the quality of risk controls to mitigate this impact (i.e. residual risk) but before considering capital or liquidity resources.
36. Competent authorities should determine the risk score predominantly through an assessment of inherent risk, but they should also reflect considerations about risk management and controls. In particular, the adequacy of management and controls may increase or - in so me cases - reduce the risk of significant prudential impact (i.e. considerations relating to inherent risk may under - or overestimate the level of risk depending on the adequacy of management and controls). The assessment of inherent risk and the adequacy of management and controls should be made with reference to the considerations specified in T
…