37. Competent authorities should assign risk scores to individual risks to capital in accordance with the criteria specified in Title 6, and scores to risks to liquidity and funding in accordance with the criteria specified in Title 8. These scores represent the likelihood that a risk will have a significant prudential impact on the institution (e.g. potential loss), after considering the quality of risk controls to mitigate this impact (i.e. residual risk), but before consideration of the institution's ability to mitigate the risk through available capital or liquidity resources.
38. Competent authorities should determine the risk score predominantly through an assessment of inherent risk, but they should also reflect considerations about risk management and controls. In particular, the adequacy of management and controls may increase or - in some cases - reduce the risk of significant prudential impact (i.e. considerations relating to inherent risk may under- or overestimate the leve
…