The Escalation That Went Sideways
A regional bank's operational risk policy says incidents above a 250,000 loss threshold must be escalated to the CRO within 24 hours and reported to the Board Risk Committee at its next meeting. A payment-processing defect caused an estimated 400,000 loss over three days. The business unit head classified it as 'below threshold' because 180,000 was expected to be recovered from a counterparty, bringing the net to 220,000. The CRO learned of it 11 days later through a corridor conversation. The Board Risk Committee meets in 5 days; the next meeting after that is in 3 months. The business unit head says the net-of-recovery treatment is 'standard practice.' The policy does not define whether the threshold is gross or net. The CRO must decide what to report and when.
1. Was the classification defensible? Analyse the gross-versus-net question and the effect of the policy gap.
Read the worked answer
The classification is not defensible as applied, though the policy gap is real and shared blame sits with the policy owner.
On gross vs net: for escalation thresholds, gross loss is the conventional basis because it measures the event's severity and the control failure, not the eventual financial outcome. A 400,000 event that happens to have a 180,000 recovery is still a 400,000 control failure; the recovery is a separate, uncertain, and often delayed benefit. Netting before escalation lets any incident be argued below threshold by assuming recovery - an incentive that rewards optimism.
The policy gap: the policy genuinely does not specify gross or net. That is a drafting failure owned by the second line. But a gap does not license the interpretation most favourable to the person being escalated about. Where a policy is silent, the prudent reading - and the one consistent with the policy's purpose (surface material events quickly) - is gross.
The 11-day corridor discovery is the more serious fact: whatever the threshold debate, the CRO was not told, and the escalation channel failed. The business unit head's 'standard practice' claim should be tested against how prior incidents were treated; if the practice was inconsistent, that is a further finding.
2. The CRO must act now. What should be reported to the Board Risk Committee in 5 days, and what should happen to the policy?
Read the worked answer
Report now, at the next meeting in 5 days - do not wait 3 months. The CRO should table:
- The incident on a gross basis (400,000), the recovery expectation flagged as uncertain, the three-day duration, and the control failure.
- The escalation failure - that the CRO learned 11 days late via a corridor conversation, and that the netting interpretation was applied without policy support.
- The policy gap (gross/net undefined) and the proposed fix.
- Any similar incidents re-examined under the same netting logic, since 'standard practice' implies a pattern.
Policy changes:
- Define the threshold as gross loss, with recoveries reported separately.
- Add an anti-netting clause: classification cannot be reduced by expected recoveries.
- Add a 'when in doubt, escalate' default and a named independent route to the CRO.
- Require confirmation of escalation so silence is visible.
People dimension: the business unit head's judgement should be reviewed, but the primary fix is the policy and the escalation channel. The CRO should avoid framing this as a single individual's error when the policy invited the ambiguity; both the gap and the conduct need addressing. Waiting 3 months would compound the original failure.