Operational Risk Flashcards
1
Q
Top Down approach
A
Senior Managment focuses on large exposure and strategic threats that could impact teh organisations, high level review
2
Q
Bottom up Approach
A
Looks at risks at teh busienss process level focusing on local vulerabilities
3
Q
Operational Risk
A
Incl;udes everything not credit or market risk
4
Q
Exposures
A
Includes key clients , pricnipal distribution channels, critical systems, priamryt revenuye sources, regulatory exposure and brand value
5
Q
Vulnerabilities
A
The weakest links within the organisatiosn such as weak and fragile systems unmaintained processes
6
Q
Risk Wheel
A
Tool used to spark creativity during risk identification brainstorming sessions
7
Q
Risk Cause Analysis
A
Finding cause of risk, using 5 whys methoid to find root of problem
8
Q
Scenario Anaylsis
A
Essential for calculating regulatory capital (AMA)
9
Q
AMA
A
Advanced Meassurment Approach
10
Q
Mitigation Biases
A
Myopia(receny bias), excesive foucs on extenral events. Bring in oustiders to avoid
11
Q
Preventative
A
Reduce likelihood of risk materliazing
12
Q
Detective
A
Early recognision of ongoing risks
13
Q
Corrective
A
Reduces imapct of incidents
14
Q
Directive
A
Guidlines and proceudres taht structure mode of operations to reduce risk
15
Q
Taxonomy
A
Provides a structered framework for identifying and managing risks, for easier organisation and communication across teh business
16
Q
Risk Connectivity
A
Interdependencies between diffrent risks
17
Q
Risk networks
A
Visual Representation oif conenctiosn ebtween diffrent risks
18
Q
Casual Loop Diagrams
A
Cause and effect relationship
19
Q
Bow Tie Anaylsis
A
Visualise pathway and control measures
20
Q
Network Anlysis Software
A
Software like Gephi adn UNCINET to map risk netwroks
21
Q
Benefits of Risk network
A
Provide holistic view, enhances predictive capabilities
22
Q
Challanges of risk networks
A
Complexity, continued collection/analysis, needs to be regulaur updated, inforamtion overload
23
Q
Risk Appetite
A
Refers to amount of risk an organisation is willing to take to achieve objectives
24
Q
Risk Tolerance
A
Metrics translating appetite into value at risk indicators
25
Key Controls
Internal controls and process
26
Risk Limits
Key indicators and thresholds which are monitored
27
Governance
Risk owner and accountability
28
Risk Capacity
Max amount of risk the organisation can take
29
Chllanges in Setting Risk Appetite
Balancing risk and oppertuntiy, quantifying, adapting to change
30
RCSA
Risk and Control Self assesment
31
Scale of RCSA
heatmap combing liklehood and imapct of issue, rating them from green to amber to red
32
Qualative assesment
Subject judgements
33
Quantatuive
Numericla data
34
Operational Risk Governance
Policies and structural used to manage operational risk
35
1st line of defence
Operational risk managment
36
2nd line of defence
Risk managment and compliance function
37
3rd line of defence
Internal audit
38
1.5 line of defence
Risk champion
39
Board of Directors Role
Sets tone at top adn approves risk amangment framework in line with strategic objectives
40
Senior Managment
Impliments risk managment framework
41
Risk Committee
Handles operational risk identification and managment and reviews effectivness
42
Audit Committe
Provides indipendnat oversight of the risk managment function
43
Risk policies
Define organsitions appraoch to risk managmentR
44
isk procedures
provide detailed steps for identifying assesing mitgation and monitoring risks for consitency
45
Risk indicators
Key risk indicators based of key perforamnce indicators
46
Reporting Mechanisms
Regaulr reporting to seniour managment, with real time dashboard and incident report systems
47
Risk Mitigation
Involves implimenting measures to reduce the likelihood and impact of identified risks
48
Avoidance
Eliminating activities or conditions that expose the organisation to risk
49
Reduction
Implimenting controls to reduce liklehood or impact of risks
50
Sharing
Trasnfering risk with other parties
51
Acceptance
Acknowledge the risk and choosing to accept it without additional controls
52
Preventative controls
Reduce liklehood of event happening
53
Detective Controls
Detect events during or after they occur
54
Directive controls
Directions for handerling risk, prcoedures/manual
55
Crrective Controls
mitigate impacts of a risk, e.g. back ups
56
Control testing
Self certification/ examination/observation/reperformance
57
Reporformance
Replicating control process on sample transactions. Most thorough control test
58
Optimistic Controls
Exceptional ability or motivation often become superficial tick box tasks
59
Duplicative Controls
"Four eye check" where more than one person reviews information. Dilutes accountability and reduce focus
60
More of the same controls
Adding more controls of teh same design after failure
61
Rule based misatkes
Caused by flawed or conflicting rules
62
Knowledged based mistakes
Resulting unformilarity or lack of training
63
Violations
Deliberate disregard for rules
64
Active error
Direct operator actions
65
Latent errors
Flawed processes or systems that only manifest later
66
Best practices for implimentation
Prioritise based on risk, allocate sufficient resources, traininga dn awrness adn document mitigation measures
67
RCA
Root Cause Analysis
68
Purpsoe of RCA
Helps pinpoint why an issue occured and prevent its reoccurance
69
5 Whys
Root cause analysis of asking why 5 times to find root cause
70
Fishbone Diagram
Visual tool that ctagorizes poetntial causes of problems
71
Pareto Analysis
Focuses on identifying the most signficiant cuases using 80/20 rule
72
FMEA
Failure mode and effect Analysis, systemic method for evaluting processe to identify where and how they might fail
73
Conduct
Refers to behaviour of individuals within an organisation
74
Culture
Encompases the shared value beliefs and norms that influence how employees interactwithin an orgaisation
75
Keys to Change
Willingness and ability
76
Achieving change
Personal Motivation, Social motivation(peer pressure), Sturctural motivation( Formal rewards, incentive schmemes)
77
Influencing Envrioemt
Consult Influencers sucha s senioru managment and look to lead by example
78
Propinquity
proximity fosters and anhances collaberationa dn communication
79
Negative reinforcements
For repeated or international rule violations, predictable adn consitent toa void blame culture
80
Positive reinforcement
Underutilized but highly effective, reward good conduct
81
Incident Data collection
Process of gatehring detailed ifnormation about incidents and events taht may pose risks to teh organisation
82
Automated system
Use software to capture and log incidents in real time
83
Audits and rviews
Conduct regular audits and review sto ensure all incidents are recorded accuratly
84
Manaul Reproting
Encorage staff to report incidents through structured forms and channels
85
Basel Committe data quality requirment
Must maintain a 10 year history, 20 million EUR threhold event type
86
Direct losses
Immediate financial consequences
87
Indirect losses
Resulting impacts like loss of customer reputational damage increase compliance costs and lower employee moral
88
Non financial impacts fallacy
Wille vntually have fincial impacts on teh company
89
Loss reporting
Net vs gross reporting, net reimbursment. Gross is total impact
90
Threshold reporting
Vary from zero to 20,000. Must be justified and not manipulaterd
91
Grouped Losses
Combine multiple events from teh same failure into one loss for accurate reflections
92
Internal incident data
Operational Failures, proces sbreakdown, human error
93
External Incident data
Market disruptions, regulatory changes, comp[eitors failures
94
Near misses
Events that could have caused harm but did not
95
Self reporting requirment
Often mandatory to report incidents, if not could have repercussions
96
Boundary events
Occur where they materialize in a diffrent risk class than the cause. Basel suggest calssifying where materilised as long as credit losses are covered by riusk weighted capital
97
Key Risk indicators
metrics used to monitor teh level of exposure to risk and teh effectivness of controls within an organization
98
Exposure Indicators
Monitor changes in the organisations exposure to risk.
99
Stress indicators
Capture the stretch in organisational resources
100
Failure indicators
Indicate failure perofmrance or control weakness
101
Causal Indicators
Focus on the root cuase and drivers of key risks
102
Define KRIs
Uk corporate goivernance 2010, board defines risk appetite and ensures effective risk managment and internal controls.S houdl represent risk appetite
103
KPI
key perofrmance indicators
104
KCI
Key control Indicators
105
Track KRIs
Use colour coding. Green, no action, amber monitor, red act
106
Risk Reporting
Process of communicating information about teh risk enviroment
107
Golden Rules of reporting
Value must exceed cost, clear purpose, influence decision making
108
Top Risks
Top tenrisks reported to teh board and risk comittee
109
Monitrong vs Reporting
OMonitoring at oeprational level, reporting on a need to know managment basis
110
Alternatives to average
Medium and quartiles,
111
Loss data Split
Expected losses vs unexpected loss
112
Reporting loss % of Gross income
1.8-2.2%- high performance. 2.2-3% common range, above 3% higherr losses. Below 1.5% ussually under reproting
113
Inforamtion Security Risks
Encompass thfreat to teh confidentiality integrity and avliability of data
114
Cyber risk
having, virus, infection and phising attacks
115
Physical Risks
theft of device, social engenerering atatcks
116
Internal threats
Employee misconduct, mishandled exits with sensative inforamtion
117
External Threats
Third aprty failures, system disruption
118
ISO/IEC 27001:2013
Inforemation security standard
119
Information asset inventory
To identify and categorize inforamtion assets for better risk managment. identify critical assets, determine confidential level, assign protection prioritise
120
Behavioral Controls
Awaness campaigns, rules of conduct, monitoring and sanctions
121
Technical Controls
Prevntative measures(Firewall)
122
Detective measures
Data leak prevention and detection (DLPD), log in monitoring
123
Mitigating measures
Regulaur backups, system redundencies
124
Resilience
Capacity to recover quickly from difficulties toughness
125
Reputation
Beliefs or opions that are genrealy held about someone or soemthing based on behaviours
126
Reputation managment
Base on stakeholder perception, riskstems from uncertanty and random events
127
Realtionship between resliance and reputation
Strong reputation provide foundations for reilience
128
Response to crisis
Technical team, focus on restoring normal process, communication team: manages media and stakeholder communication
129
Building Reilience
Godo crisi managment, strong stakeholders, robust busienss continuity plan, crisi managment practices
130
Crisi Communication Stratergy
Regret, reason, remedy
131
Measuring Reputation and resiliance
Metircs: Customer satisfaction and loyalty, media coverage and public perception, employee engagment and retention.
132
Rising Operational Risk
Technological advnacment and digital transforamtions
