Summary - Operational Risk

Question 1

OPERATIONAL RISK
Definition

Answer 1

Operational risk is the risk of loss from inadequate or failed internal processes, people, systems, or from external events.

It includes fraud, mismanagement, cyber threats, legal risk, compliance failures, and business continuity failures.

It’s often non-financial, but can trigger huge financial and reputational impacts.

Question 2

OPERATIONAL RISK
Typical risk controls (8)

Answer 2

• Internal controls & segregation of duties: Prevent fraud or error.
• Policies, procedures, and training: To ensure consistent processes.
• Business continuity planning (BCP): For disasters, pandemics, cyberattacks.
• Incident reporting & root cause analysis: To learn from past events.
• Key Risk Indicators (KRIs): Early warnings for emerging risks.
• Whistleblower policies & audit functions: Internal checks and balances.
• Cybersecurity & IT controls: Firewalls, access management, system testing.
• Third-party risk management: Vendor assessments, SLAs, exit plans.

Question 3

OPERATIONAL RISK
Unique factors (5)

Answer 3

Hard to quantify: Models like scenario analysis and scorecards are used but subjective.

Low frequency, high severity events dominate: Tail risk is everything.

Rapid change exposure: Tech adoption and outsourcing shift the risk landscape fast.

Human error & conduct risk: Can’t be eliminated, only managed.

Reputational and regulatory knock-on effects: A small event can trigger massive fines or public backlash.

Question 4

OPERATIONAL RISK
Tools to identify risks (7)

Answer 4

Risk and Control Self-Assessments (RCSAs):
- Business units assess their own risks and controls.
- Helps identify and prioritize key operational risks.

Process Mapping / Flowcharts:
- Visual diagrams of processes to spot control gaps or failure points.

Key Risk Indicators (KRIs):
- Early-warning metrics (e.g. system downtime, staff turnover).
- Help detect rising operational risk before losses occur.

Scenario Analysis:
- Hypothetical severe-but-plausible scenarios (e.g. data breach, fraud).
- Used to assess impact and control adequacy.

Loss Event Data Analysis:
- Use internal or external databases of past incidents.
- Identify recurring weaknesses or high-risk areas.

Audits and Control Reviews:
- Independent internal or external reviews of processes.
- Help uncover latent or emerging risks.

Risk Registers:
- Centralized logs of identified risks with ratings and owners.
- A living document used across the business.

Question 5

OPERATIONAL RISK
- ACRONYM

Answer 5

“PROCESS FAILS”

P – Policies & procedures:
Documented rules for consistent, safe operations.

R – Risk indicators (KRIs):
Early signals of operational risk exposure.

O – Oversight (audit, compliance):
Independent checks on risk and control effectiveness.

C – Cybersecurity:
Tools to prevent breaches and system attacks.

E – Event reporting - learn from past mistakes:
Logging and analysing incidents to improve resilience.

S – Systems & IT controls:
Secure, stable technology and access management.

S – Segregation of duties:
Split tasks to avoid fraud and error.

F – Fraud detection:
Tools and reviews to catch misconduct early.

A – Awareness & training:
Educate staff to reduce human error.

I – Incident response plans:
Predefined actions for handling crises.

L – Legal & compliance risk:
Adherence to laws, regulations, and ethics.

S – Supplier/vendor management:
Monitor third-party risks and performance.