Operational and Enterprise Risk
Core Concepts
Operational risk is the risk of loss from inadequate or failed internal processes, people, systems, or external events. It includes fraud, cyber risk, business continuity, legal risk, and model risk. Enterprise risk management (ERM) takes a holistic view across all risk types, aligning risk with strategy. Key frameworks include COSO ERM and ISO 31000. Candidates should understand risk culture, risk appetite frameworks, and key risk indicators (KRIs). Operational risk capital is often calculated using the basic indicator, standardized, or advanced measurement approaches (though Basel has moved to a standardized approach). Business continuity planning (BCP) and disaster recovery (DR) are critical controls.
Traps in Questions
- Confusing operational risk with strategic or reputational risk.
- Assuming ERM eliminates risk; it optimizes it.
- Overlooking that people and culture are major operational risk drivers.
- Mixing up KRIs (early warning) with KPIs (performance).
Worked Example
A bank's online banking system fails for 4 hours, causing customer complaints and a regulatory fine. This is an operational risk event (system failure). The bank uses a KRI of "system uptime" and a BCP to restore service. ERM would assess the impact across reputational, legal, and financial dimensions.
Rule of thumb: Operational risk is everywhere; ERM connects the dots across silos.