OR Flashcards
UK Regulation in Regulatory Expecation
Evolution of Cyber Risk Management in UK Banking:
2018- Introduction of new ORM regulations by FCA, PRA, and BoE
2020- Adjustments due to COVID-19 and WFH arrangements
US REG.
What is operational risk defined by the Basel Committee on Banking Supervision?
The risk or loss resulting from inadequate or failed internal processes, people, systems, and external events.
What does operational risk management (ORM) deal with?
Four specific causes: inadequate or failed internal processes, people, systems, and external events.
What is an ORM framework?
The total of the methods or processes used to control operational risk within a firm.
What are the four steps in the iterative cycle of risk management?
- Risk identification
- Risk assessment
- Risk mitigation
- Risk monitoring
What is the goal of risk identification?
To determine as many relevant risks as possible that could negatively impact the firm’s business goals.
What methods might be used during risk identification?
- Group brainstorming activities
- Interviews with staff
What does risk assessment involve?
Determining the probability and severity of identified risks for prioritization.
What tools are used in risk assessment?
- Stress testing
- Scenario analysis
What is the purpose of risk mitigation?
To minimize or eliminate risks that have a high probability of occurring or high severity if they occur.
What methods are commonly used in risk mitigation?
- Internal controls
- Purchasing insurance
- Minimizing exposure
What is the final step in the risk management process?
Risk monitoring
What is the objective of risk monitoring?
To verify if the risk management process is operating as expected and if the firm’s operations are robust.
What actions are taken if the risk management process is not operating as expected?
Remedial actions are taken in the first three steps before performing another step of risk monitoring and evaluation.
What activities are involved in risk monitoring?
- Reviewing incident reports
- Developing key risk indicators
What is more important consistency or accuracy while risk mapping?
consistency
Internal Fraud
rogue trading, employee defalcation. low severity and low loss
External Fraud
cyber attack, low s and low p
Employment practices and work safety
moderate frequency, low severity, legal risk
Client, business
high probability, very high severity, legal risk
business disruption and IT failure
low probability and low severity
execution, delivery and process management
high frequency and high loss
