UDAAP Risk Assessment Matrix

The ABA UDAAP Risk Assessment Matrix provides a systematic method to assess and manage UDAAP risk. Note that it is not designed to be the blueprint for a successful UDAAP program that works in isolation from your policies and procedures or your overall risk assessment framework.

The Matrix has three main sections:

1. Inherent Risk Indicators
2. Quality of UDAAP Risk Management (risk controls and mitigation)
3. UDAAP Risk Summary (residual risk and risk direction)

This format is very similar to other risk assessment tools you have likely used or developed for such areas as fair lending, or compliance management systems. It is intended to be scalable. In other words, the methodology can be used at the institution level, business level, or at the product, service or activity level.

The matrix provides a universal list of possible risk issues and control features that could be at play in any specific financial institution. Your responsibility is to determine, based on the type of assessment you are preparing as well as your institution’s footprint, complexity of operations, use of third parties, loan and deposit products, services, and activities, among other things, which of the factors listed in the matrix are relevant to your UDAAP risk assessment. And because UDAAP is so dynamic, you will need to think about what you may need to add.

Lastly, keep in mind that this is not a once and done process. The risk assessment should be performed as often as you feel necessary to ensure you are staying on top of UDAAP risks that may arise in your institution.