Operational Risk Event: Failed Settlement and Control Breakdown
On a Friday, a dealer member, Pinehurst Financial, fails to deliver $12 million of municipal bonds because the operations team transposed a CUSIP in the settlement instruction. The counterparty declares a buy-in and purchases the bonds at a $180,000 higher price. Pinehurst must cover the loss. The same week, a trader exceeded her $50 million limit by $8 million for two hours before the risk system alerted. The system's limit monitoring runs on a 30-minute batch cycle, and the alert went to a distribution list that included a former employee. The firm's operational risk capital is based on a three-year average of losses, and this year's losses are already $2.4 million against a $3 million budget. The COO asks whether these events should be reported as operational risk losses and whether the limit breach is a control failure.
1. Classify each event and determine whether it is an operational risk loss. Explain how the loss should be captured and whether it affects regulatory capital.
Read the worked answer
The failed settlement is an operational risk event. It arises from a process error (CUSIP transposition) in settlement instructions, which is an execution, delivery, and process management failure. The $180,000 buy-in cost is a direct operational risk loss. It should be captured in the operational risk loss database with the event date, discovery date, business line, event type, root cause, and recovery status. Any insurance recovery should be netted only when realized.
The limit breach is also an operational risk event, but it is primarily a control failure rather than a direct loss. The trader exceeded the $50 million limit by $8 million for two hours. If no loss resulted, it is a near-miss or control breach that should be logged. The 30-minute batch cycle and the stale distribution list are control weaknesses that allowed the breach to persist and delayed escalation. These should be recorded as issues with remediation owners and dates.
Regulatory capital: under the standardized approach for operational risk, the capital charge is based on the business indicator, not directly on the three-year average of losses under Basel III's new framework. Under the older basic indicator or standardized approach, the charge is based on gross income, not losses. The firm's internal practice of budgeting losses at $3 million is a management tool, not a regulatory capital calculation. The $180,000 loss reduces earnings and therefore retained earnings and CET1 by $180,000, but it does not directly change the operational risk capital formula. The firm should ensure its loss data is complete and accurate for internal capital adequacy assessment and stress testing.
2. Recommend control improvements and describe how the firm should report these events to senior management and the board.
Read the worked answer
Control improvements should address root causes. For settlement: implement a pre-release validation that matches CUSIP, quantity, and counterparty against the trade blotter; require maker-checker sign-off on settlement instructions; and add a real-time exception report for failed trades. For limits: move to real-time or near-real-time limit monitoring, or at minimum reduce the batch cycle to intraday; maintain a current alert distribution list with named individuals and backups; and require acknowledgment of alerts. Add a hard block in the order management system that prevents orders exceeding the limit rather than only alerting after the fact.
Reporting: the COO should receive an incident report within 24 hours, and the risk committee should review a monthly operational risk dashboard showing losses, near-misses, control breaches, and remediation status. The board risk committee should receive a quarterly summary, with immediate escalation for material events. The firm should define thresholds for what constitutes a reportable event, for example losses over $100,000 or limit breaches over 10%.
The firm should also conduct a root-cause analysis and track remediation to completion, with internal audit validating closure. The events should be considered in the firm's risk and control self-assessment and in scenario analysis for operational risk capital. Finally, the firm should review whether the trader's breach requires disciplinary action and whether the desk's supervisory structure is adequate. Document all actions and retain records for regulatory review.