Operational Risk

Question 1

What six organisational process areas can RM be applied to?

Answer 1

1. Production operations/operational risk.
2. Management of technology systems and processes/cyber security risk.
3. Programme and project (risk) management:
4. Supply change (risk) management.
5. Corporate social responsibility.
6. Regulatory reporting.

Question 2

What are five examples of operational risks?

Answer 2

1. Operational risks typically comprise manufacturing/production risks and professional service risks.
2. May include:
   - Plant/premises/production line breakdown;
   - IT disruptions;
   - Service delivery/supply chain disruptions;
   - Industrial action;
   - Staff absence.

Question 3

Name six conceivable consequences of operational risks.

Answer 3

1. Increased costs (e.g. plant repair, supply chain remediation).
2. Business disruption (e.g. non-delivery of goods and services).
3. Reduced productivity.
4. Customer dissatisfaction.
5. Compensation payments.
6. Reputational damage.

Question 4

What does cyber risk management address?

Answer 4

1. Cyber risk management addresses all forms of digital risk.
2. Quintessential area of information assurance.
3. Principally concerned with ensuring information and technical resources are:
   - Secure;
   - Accessible only by authorised personnel;
   - Used only for intended purposes;
   - Complete and intact.

Question 5

What are the five chief causes of cyber risk events?

Answer 5

1. Security breaches.
2. Power failures.
3. Data corruption.
4. Data entry / processing errors.
5. Social media.

Question 6

Name six IT risk factors.

Answer 6

1. Usage of social media to screen candidates - conceivable legal consequences.
2. Usage of social media amongst employees for bullying, harassment or trolling.
3. Reputational impacts.
4. Confidentiality breaches.
5. Data corruption.
6. Privacy.

Question 7

How may cyber risk be addressed?

Answer 7

1. Controls may be formal/technical or informal/HR-style.
2. Controls include:
   - Technical controls (system-based safeguards, encryption, firewalls).
   - Physical controls (prevention of unauthorised access; fire/theft protection; back-ups).
   - Procedural controls (usage policies, auditing, BCP).
   - People controls (cyber training).
   - Legal controls (compliance with legal and regulatory requirements).

Question 8

What is project risk management?

Answer 8

1. Planning and coordination of a team toward specific goals, with limited time and resources.
2. Projects are temporary but their outputs may be permanent.
3. Three key risks may arise during the project process:
   - Delay;
   - Overspend;
   - Defective execution.

Question 9

What is corporate social responsibility?

Answer 9

1. Linked to compliance but objective is to exceed minimum leg-reg obligations.
2. Form of SELF-REGULATION ensuring ETHICAL behaviour in accordance with (inter)national norms.

Question 10

Name five possible CSR activities.

Answer 10

1. Philanthropy.
2. Mitigation of carbon emissions.
3. Provision of subsidised health and education to employees.
4. Promotion of human rights and environmental causes.
5. Provision of free or subsidied goods and service to low income customers.

Question 11

What is sustainability concerned with?

Answer 11

1. Sustainability stems from the principle of triple bottom line reporting.
2. The triple bottom line consists of:
   - PEOPLE (better labour practices, living wage, employment rights).
   - PLANET (minimising organisational impact on environment).
   - PROFIT (delivering long-term stakeholder value).

Question 12

What five items are regulated organisations typically required to report on (to regulators)?

Answer 12

1. Organisational and director-level information.
2. Staff salaries, paid taxes and financial accounts.
3. Business plans.
4. Governance, internal controls, major risks and management of the same.
5. Major loss events, control failures, pollution, health and safety risk failures.

Question 13

What three regulatory reporting risks might arise?

Answer 13

1. Report deadlines are missed.
2. Reporting deadlines are met but reporting is incomplete.
3. Reporting deadlines are met, reporting is complete but reporting includes material errors.

Question 14

Which four functions are typically involved in supporting regulatory reporting?

Answer 14

1. Company secretary / governance professionals.
2. Compliance.
3. Finance - financial/management accounting; accounting ratios.
4. Health and safety function - serious H&S incidents.