ARNAIZ B&C
← Back to capabilities

Capability 03

Risk, controls and governance

Risk exposure, control effectiveness and governance oversight

Question this capability helps answer

Where is the actual exposure and how reliable is the system intended to contain it?

We make the relationship between risks, decisions, processes and controls visible. We do not assess controls as an isolated checklist: we examine whether they operate, produce evidence and enable boards and management to govern uncertainty.

Situations addressed

  • Actual exposure does not match the existing risk map or policy.

  • Controls are documented, but there is no evidence that they operate.

  • A board, committee or management team needs an independent view.

  • Growth, a transaction, an incident or regulatory change altered the risk profile.

What Arnaiz B&C does

  1. 01

    Defines critical decisions, objectives and exposures before assessing controls.

  2. 02

    Traces risks to processes, owners, evidence and oversight mechanisms.

  3. 03

    Tests design and operation using samples and verifiable sources.

  4. 04

    Identifies causes, dependencies, gaps and concentrations of control.

  5. 05

    Prioritizes actions by materiality, feasibility and governance effect.

Evidence and deliverables

  1. 01

    Risk map connected to decisions, processes and controls.

  2. 02

    Design, operation, evidence and ownership matrix.

  3. 03

    Prioritized findings with causes, exposure and limitations.

  4. 04

    Remediation, monitoring and governance roadmap.

When to involve Arnaiz B&C

  • When management receives abundant reports but little actionable certainty.

  • Before or after a transformation, acquisition or material change.

  • When an incident suggests a systemic control or oversight failure.

Sources that may be reviewed

  • Policies, processes, risk registers and governance structures.

  • Control samples, approvals, logs and evidence of operation.

  • Reports to management, the board, committees and assurance functions.

Client participation

  • Appoint the decision owner and a liaison for controlled access to information.

  • Provide context and facilitate sources; the firm retains independence over testing and conclusions.

  • Participate in scope, checkpoints and communication of risks, assumptions and limitations.

  • Coordinate privilege, confidentiality and communications with counsel where applicable.

Continuity

Related methods and capabilities

  • Express Diagnostic as an initial assessment powered by ARNAIZ RISK-360™.
  • SoftExpert technology to institutionalize and sustain management practices.
  • Forensic investigations if an exposure becomes a fact requiring reconstruction.

Explicit limitationThe assessment does not presume legal compliance or certify the absence of incidents. Every conclusion depends on scope, samples and available evidence.

Confidential assessment

Tell us what risk you need to make visible.

Share the general context without attaching sensitive evidence. The initial conversation will help determine whether this capability and the timing of the intervention are appropriate.

Tell us what you need to resolve.