Enterprise Risk Posture & Exposure Aggregation

MeridianBank Holdings • Last Updated: 2024-12-19 08:42 UTC

TUFE
$73.4M
+66.4%
Risk Velocity
2.8
+24%
New risks / closed
Control Effectiveness
68.4%
-5.7pp
Controls tested effective
Regulatory Breach
31%
DORA: 23d
Probability by deadline
Vendor Concentration
8.2
Critical vendor
HHI-style index
Control Coverage
82%
104/127 risks
Controls mapped to risks

Total Unmitigated Financial Exposure by Domain (12-Week Trend)

Risk Appetite Utilization by Domain

Control Effectiveness Rate Trend

Open Finding Age Distribution

Incident-to-Control Gap Ratio

Cyber Security 1.8:1
Third-Party 2.1:1
Operational 1.2:1
Compliance 0.9:1
Financial 0.7:1
Legend: Incidents per effective control
Target: <1.0 (more controls than incidents)

Vendor Concentration

8.2
Top 3 vendors represent 61% of critical service exposure
CloudPrime (merged) 28%
DataCore Systems 19%
SecureNet Global 14%

Escalation Backlog

47
Items pending executive review >14 days
Critical (P1) 12
High (P2) 23
Medium (P3) 12

Open Findings (Avg Age)

201d
127 total findings, 8 blocking DORA compliance
>180 days 34
90-180 days 51
<90 days 42

Risk Register Summary (Top 10 by Residual Exposure)

ID Risk Title Domain Gross ($M) Residual ($M) Controls Status
R-2024-089 Cloud vendor single-point-of-failure Third-Party $18.4 $14.2 3/5
R-2024-061 Ransomware recovery time exceeds RTO Cyber $22.1 $9.7 7/9
R-2024-102 DORA compliance gaps in APAC region Compliance $11.8 $8.1 2/8
R-2023-247 Legacy system end-of-life December 2024 Operational $14.3 $7.6 5/7
R-2024-078 Model risk in credit decisioning AI Financial $9.2 $6.8 4/6
R-2024-113 Privileged access review backlog Cyber $8.4 $5.9 6/8
R-2024-091 Vendor data localization non-compliance Third-Party $7.1 $5.2 3/5
R-2024-055 Business continuity plan untested (EU) Operational $6.8 $4.7 2/4

Escalation Backlog Heatmap (by Domain × Priority)

Critical
High
Medium
Low
Cyber
7
11
4
1
Third-Party
3
8
5
2
Operational
2
3
2
1
Compliance
0
1
1
0
Financial
0
0
0
0
Total backlog: 47 items. Cyber domain accounts for 49% of all escalated items.

Risk Velocity by Quarter

Alert: Risk velocity has exceeded 2.0 for three consecutive weeks. New exposures are being created 2.8× faster than controls can mitigate them. Immediate capacity reallocation recommended.
Next Regulatory Deadline
DORA
23 days
8 open findings blocking
Board Risk Committee
Jan 15
27 days
Quarterly risk review
External Audit Start
Feb 3
46 days
SOC 2 Type II renewal
Risk Register Refresh
Dec 31
12 days
Annual risk re-rating