Operational Risk: Frameworks, Events, and Controls
Core concepts
Operational risk is the risk of loss from inadequate or failed internal processes, people, systems, or external events. Candidates must know the event-type taxonomy: internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, and execution/delivery/process management. Understand the three lines of defense model and the distinction between risk and control self-assessments (RCSA), key risk indicators (KRIs), and loss-event data. Know business continuity planning, outsourcing risk, cyber risk, and model risk. Be familiar with the basic indicator, standardized, and advanced measurement approaches conceptually, and how insurance can act as a mitigant. Understand the tail-heavy, asymmetric nature of operational losses.
Traps to watch
Questions often misclassify events: a rogue trader is internal fraud, while an external hacker is external fraud-do not conflate them. Another trap is treating operational risk as purely "back-office"-it spans legal, compliance, cyber, and conduct. Watch for confusion between frequency and severity distributions: high-frequency/low-severity events are managed by controls, while low-frequency/high-severity events need capital and insurance. Also remember that KRIs are forward-looking while loss data is backward-looking.
Worked rule of thumb
When classifying an event, ask three questions in order: Who caused it? (internal vs external), What failed? (process, system, people, or external event), and Where does it map in the taxonomy? For example, a payment system outage caused by a vendor failure maps to business disruption and system failures, not execution error-the failure originated in a system, not a person's handling.