Unit 3 - Topic 3 Flashcards
What is Operational risk?
It is the risk of loss from operational failure
4 points - What are the various types of operational loss events?
Acts of nature
Unintentional document execution errors
Conscious violations of law and regulation
Direct and Indirect acts of excessive risk taking
3 points - What are the 3 lines of defence model key areas?
Identify, Measure and Mitigate
4 points - What recognised as changes required for risk?
Recognising the world has changed rapidly
Expensive and significant control frameworks
Culture of business needs overhaul
Business models need changing
2 points - Who originally used the 3 lines of defence model?
FSA then larger banks followed suit
The greater the number of stakeholders involved in a business, the greater the need for a resilient and transparent risk management model.
2 points - What is the 1st line of defence and their correct actions?
Business Operations
- Operational management owns and manages the risk
Corrective actions:
Actions to address
Process
Control Deficiencies
4 points - What is the 2nd line of defence?
Control functions
Does not always provide risk management as a single line in defence - acts as monitoring, advisory and consultative support for the 1st line.
- Risk management committee (Chief risk officer that reports to senior management), has risk reports.
- Compliance function that reports to the board or senior management
- Finance function - monitors financial risk and financial reporting issues
- Security function - physical and data security, inspection and quality function (Anti money laundering checks).
3 points - What is the 3rd line of defence?
Internal audit
This provides the board and senior management with comprehensive assurance based on the highest level
Bank owned asset funders have extensive 3rd line of defence
- Reports independently to board or audit committee
- Might include internal audit or chief risk offices
- Shows how effective 1st and 2nd line has been
4 points - Criticisms of the 3 lines of defence model?
Misaligned incentives for risk takers in the 1st line of defence
Lack of organisational independence in 2nd line
Lack of skills and expertise in the 2nd line
Inadequate and subjective risk assessment performed by internal audit
3 points - What is missing from the defence model?
Business Unit managers
Risk and Compliance
External Audit
3 points - What are the additional lines of defence?
External auditors - ‘relationship of oversight to the 1st line’
Board
Regulators
4 points - What must the four lines model consider?
The roles, responsibilities, interactions between:
Internal and External audit
Regulatory financial supervisors
Model is only as strong as the people who work within it
Smaller organisations these models can be expensive to implement
5 points - What is risk management? - DIMER
Identify and define their risks
Quantify and measure the level of risk and residual risk
Develop and document clear mitigation strategies
Implement risk reporting and monitoring
Establish appropriate governance monitoring and control
10 points - Basic Risk Framework?
The organisations Strategic Objectives
Risk Assessment
- Risk analysis
Risk Identification
Risk description
Risk Estimation
Risk Evaluation
Risk Reporting
- Threats and opportunities
Decision
Risk Treatment
Residual risk reporting
Monitoring
4 points - What are the operational areas asset funders must look at risk?
Product delivery
Customer sales
On boarding new customers
In-life and default management