INTERNATIONAL JOURNAL OF ARTIFICIAL INTELLIGENCE
ISSN: 2692-5206, Impact Factor: 12,23
American Academic publishers, volume 05, issue 06,2025
Journal:
https://www.academicpublishers.org/journals/index.php/ijai
page 612
EVALUATING RISK LEVELS IN THE BANKING SECTOR
Davron Akromovich Toshpulatov
Risk Manager at the “Uzbekistan Mortgage Refinancing Company” JSC
Associate Professor at the Department of “Bank Accounting and Audit”,
Tashkent State University of Economics
Doctor of Economic Sciences
E-mail:
Annotation.
This article examines the probability of risk occurrence within the banking sector
and analyzes their potential impact on the financial performance and stability of banks. A
comprehensive approach to risk assessment is proposed, including detailed mechanisms and
tools for evaluating various types of risks—such as credit, market, operational, and liquidity
risks. Particular attention is given to the development stages of a risk assessment matrix, which
serves as a strategic instrument for identifying, categorizing, and prioritizing risks based on
their likelihood and potential consequences. Moreover, the study addresses the essential aspects
of continuous risk monitoring and control processes, emphasizing the importance of timely
detection and effective management to mitigate adverse effects on banking operations. The
findings are intended to enhance risk management practices and support the development of
more resilient and sustainable banking systems.
Keywords:
risks, risk matrix, risk appetite, risk level, risk probability, risk impact, risk
monitoring, risk control.
Introduction
According to the Law “On Banks and Banking Activity,” it is necessary to develop effective
procedures for identifying, managing, monitoring, and reporting the risks that banks are
exposed to or may potentially face. In Uzbekistan, one of the key directions of banking sector
reform is to enhance the quality of credit portfolio and risk management, ensure moderate
growth in lending, implement balanced macroeconomic policies, and introduce technological
solutions for assessing financial risks [2]. These measures aim to strengthen the financial
stability of the banking system.
In this context, studying international practices in bank risk management becomes essential,
particularly in developing appropriate methods for assessing potential risks in banks and
determining necessary response measures based on the level of risk. Given the nature of
banking activities, most banking operations are inherently associated with various types of risks.
From this perspective, it is impossible to completely eliminate risks; therefore, it is crucial to
assess them in order to determine their level. This enables the adoption of appropriate actions—
whether accepting, avoiding, or mitigating the risks—thus playing a vital role in ensuring sound
risk management.
Analysis and Results
The risk matrix is a two-dimensional table where one axis represents the probability of a risk
event occurring, and the other shows the level of impact that event may have on a project or
bank. Although the design appears simple at first glance, it conceals a profound analytical
potential that transforms abstract threats into precise, measurable quantities. In other words, it is
INTERNATIONAL JOURNAL OF ARTIFICIAL INTELLIGENCE
ISSN: 2692-5206, Impact Factor: 12,23
American Academic publishers, volume 05, issue 06,2025
Journal:
https://www.academicpublishers.org/journals/index.php/ijai
page 613
a tool that helps visualize the likelihood of a potential risk relative to its impact. It serves as a
visual instrument to depict potential risks affecting the business.
Based on the probability and impact levels, risks can be classified as high, medium, or low. As
part of the risk management process, organizations use risk matrices to prioritize various risks
and develop appropriate mitigation strategies. The risk assessment matrix functions by
presenting different risks in a color-coded diagram according to their severity: high risks are
marked in red, medium risks in yellow, and low risks in green.
By evaluating both the likelihood and impact of risk events, the risk matrix provides a quick
snapshot of the threat landscape. This visualization allows auditors, risk managers, and
compliance specialists to more easily identify and determine how to mitigate events that may
have a significant impact on the bank.
Although the scale and complexity of business risks continue to increase, creating a risk
assessment matrix does not have to be a complicated process. Besides specialized software or
pre-made templates, simple spreadsheet tools like Microsoft Excel can be used to develop a risk
matrix. There are four main steps in creating a risk assessment matrix:
Step 1: Identifying the Risk Landscape
Due to the constantly increasing volume and complexity of business risks in banks, it is
essential to have a clear understanding of the overall risk landscape. Project risks differ from
corporate or macro-level risks in terms of categories and coordination strategies. Therefore,
specialists need to tailor their approaches based on the scope of the risk assessment.
To initiate the assessment process, brainstorming sessions are conducted with key stakeholders
within the bank to explore concepts and compile a list of ideas that will serve as the foundation
for the risk assessment matrix. Since risk analysis is subjective, gathering diverse input from
stakeholders is crucial, as it helps reduce the probability of losses arising from risks.
Risks are categorized according to the following criteria:
Strategic risk:
risks associated with unsuccessful business decisions.
Operational risk:
risks related to disruptions in internal processes/procedures.
Financial risk:
risks involving financial losses.
External risk:
risks stemming from uncontrollable sources.
It is important to begin with the highest-level risks associated with business functions such as
operations, then focus on specific processes within those functions, while considering pre-
identified risks.
Step 2: Defining Risk Criteria
Following the identification of larger risk areas through brainstorming, the criteria for assessing
these risks are established. As mentioned earlier, risk matrices typically utilize two intersecting
criteria:
Likelihood:
the probability or frequency of risk occurrence (X-axis).
Impact:
the degree of effect if the risk materializes (Y-axis).
Achieving consensus on risk criteria is critical, as it not only influences how the risk matrix is
calculated but also guides discussions on how to mitigate the risks. Accurate measurement is
key to successful risk management!
Step 3: Risk Assessment
Next, risks are assessed qualitatively based on the pre-established criteria using a defined scale.
Many organizations use a three-tier scale to evaluate risk impact:
High risk
Medium risk
INTERNATIONAL JOURNAL OF ARTIFICIAL INTELLIGENCE
ISSN: 2692-5206, Impact Factor: 12,23
American Academic publishers, volume 05, issue 06,2025
Journal:
https://www.academicpublishers.org/journals/index.php/ijai
page 614
Low risk
A more detailed approach can be beneficial. Expanding the scale to a 5×5 matrix is common,
where 1 represents very low risk and 5 denotes extremely high risk. This provides more
granular information about severity levels and helps organizations allocate resources more
effectively.
Organizations may choose to adopt or develop their own 3×3 or 5×5 risk assessment matrix
templates. Best practices require at least three categories for both the likelihood and
impact/severity of each risk.
Banks may also assign an overall “risk score” to risks, typically calculated by adding or
multiplying the likelihood and impact scores. To avoid confusion, the bank’s risk assessment
matrix methodology should be formally documented in policies and procedures.
Risk Assessment Matrix
──────
Impact
───────►
Negligible
Minor
Medium
High
Catastrophic
1
2
3
4
5
─
─
─
Pr
ob
ab
ili
ty
─
─
►
Highly
Probable
5
5
10
15
20
25
Highly
Likely
4
4
8
12
16
20
Possible
3
3
6
9
12
15
Low
Probability
2
2
4
6
8
10
Rare
1
1
2
3
4
5
Step 4: Prioritizing Risks
Finally, by comparing different risk levels (high, medium, or low) against the risk criteria
(likelihood and impact), risks with the highest probability and impact are prioritized. A risk
assessment plan is then developed to effectively mitigate these prioritized risks.
It is important to remember that the level of risk is constantly changing, and the risk assessment
matrix should be updated several times a year (at least annually) to reflect the evolving risk
environment. Failure to update the risk assessment strategy may lead to overlooking emerging
risks that can disrupt business objectives and continuity.
Determining the Probability of Risk Occurrence
A critical component of the risk assessment matrix is determining the likelihood of risk
occurrence. If the probability of a risk is inaccurately assessed, it may result in missed
opportunities to prevent unnecessary losses.
Banks typically use the following five categories to determine the likelihood of a risk event:
5: Almost Certain.
Risks in this category have a nearly certain chance of occurring,
typically 91% or higher probability.
4: Likely.
Risks with a 61-90% probability. These risks require regular attention as they
may recur and thus demand consistent mitigation strategies.
3: Possible.
Risks that may occur about half the time, with a 41-60% likelihood, and
should be monitored closely.
INTERNATIONAL JOURNAL OF ARTIFICIAL INTELLIGENCE
ISSN: 2692-5206, Impact Factor: 12,23
American Academic publishers, volume 05, issue 06,2025
Journal:
https://www.academicpublishers.org/journals/index.php/ijai
page 615
2: Unlikely.
Risks with a relatively low chance of occurrence, ranging from 11-40%,
but they may still impact the business and should be tracked.
1: Rare.
Risks with a very low probability of occurrence, as the name implies.
Based on the scores collected from the risk matrix above, it is necessary to develop and
implement mitigation measures. These measures may focus on reducing, avoiding, or accepting
the risk. The following key strategies are typically applied:
Risk
Score
Risk Level
Risk Measures/Strategies
1-4
High Risk
Risk Avoidance
– abandoning risky activities or processes to
eliminate exposure to risk.
Risk Mitigation
– implementing additional control mechanisms,
such as conducting supplementary inspections.
Contingency Planning
– preparing a specific action plan to be
executed if the risk materializes.
5-10
Medium Risk
Risk Mitigation
– reducing risk by allocating additional
resources or optimizing processes.
Monitoring & Control
– continuously tracking risks and
preparing for potential consequences.
Risk Transfer
– shifting risk to a third party through insurance
or contractual agreements.
10-25
Low Risk
Risk Acceptance
– accepting the risk due to its low magnitude
and taking no significant remedial actions.
Minimal Monitoring
– regularly monitoring the risk if it has the
potential to increase.
Based on the results of the risk matrix, banks implement
measures such as strengthening internal control systems, training
employees, obtaining insurance, undertaking legal actions, and
optimizing processes.
Based on the results of the risk matrix, banks need to undertake measures such as strengthening
internal control systems, training employees, securing insurance, implementing legal actions,
and optimizing processes.
References:
1. Law of the Republic of Uzbekistan “On Banks and Banking Activity” (No. O‘RQ-580
dated November 5, 2019).
2. Decree of the President of the Republic of Uzbekistan No. PF-5992 dated January 12, 2020,
“On the Strategy for Reforming the Banking System of the Republic of Uzbekistan for
2020-2025”.
