When the Risk Owner Wants the Residual Score Lowered Before the Board Pack
A mid-sized regional bank runs its RCSA cycle annually. The operational risk team has completed 42 assessments across retail, treasury, and IT. One assessment covers wire-transfer fraud in corporate payments. The inherent score is 16 (likelihood 4 x impact 4) on a 5x5 matrix. The control set includes dual authorization, callback verification, and daily reconciliation. Testing in Q3 found 3 of 25 sampled wires above USD 1m lacked documented callback verification, and reconciliation was performed but not reviewed for 11 of 20 days sampled. The risk owner, the head of payments, has proposed a residual score of 6, arguing that no actual fraud loss occurred and that staff were newly trained. The CRO wants the board pack issued in five business days. The operational risk manager must recommend a residual score and document the rationale.
1. Recommend a residual likelihood and impact score and justify it against the testing evidence. State explicitly what you would reject in the risk owner's argument.
Read the worked answer
The residual score must be derived from the tested effectiveness of the controls, not from the absence of losses. Three of 25 sampled wires above USD 1m lacked documented callback verification, an observed failure rate of 12%. Reconciliation was unreviewed on 11 of 20 days, a 55% failure rate on the review control. A control that fails on a material sample cannot be credited as fully effective.
A defensible position is residual likelihood 4 (likely) and residual impact 4 (major) - the same as inherent - because the key preventive control is only partially operating and the detective control is unreliable. Some assessors would allow likelihood 3 if the dual authorization control tested clean, but that requires evidence the question does not supply; assuming it is clean would be the same error the risk owner is making.
Reject two parts of the argument. First, 'no loss occurred' is an outcome observation, not evidence of control effectiveness; low-frequency, high-severity events like wire fraud are precisely where absence of loss is uninformative. Second, 'staff were newly trained' is a remediation plan, not a tested control. Training does not become control evidence until it is delivered, evidenced, and shown to change behavior. Credit for remediation belongs in the next cycle or in a re-test, not in the current residual score. Document the gap, the score, and the remediation commitment with an owner and due date.
2. The CRO asks whether the assessment can be issued with the residual score unresolved between the risk owner and operational risk. What governance options exist and which do you recommend?
Read the worked answer
Three options exist. First, issue the board pack with the risk owner's score of 6 and a footnote - this subordinates the second line to the first line and misstates the risk to the board. Reject it. Second, escalate the disagreement to the CRO or the operational risk committee for a decision before issuance. Third, issue the second line's score with the disagreement recorded and the risk owner's rationale attached.
The recommended path is escalation to the CRO with a documented challenge, then issuance using the second line's score if no resolution is reached before the deadline. The RCSA framework should contain an explicit escalation and challenge clause so this is not improvised. The board pack should show the score, the control testing results that drive it, and the remediation plan. Concealing a known control failure to meet a reporting deadline is a conduct issue, not a scheduling one. Five business days is sufficient to escalate; the deadline does not justify a misstated residual.