Enterprise and Operational Risk Management
Enterprise and operational risk
Enterprise risk management integrates risk with strategy, appetite, capital, and performance. Candidates should understand a risk taxonomy, risk appetite statements, key risk indicators, scenario analysis, stress testing, and risk aggregation. Operational risk arises from people, processes, systems, and external events; it includes fraud, errors, cyber, third-party failure, legal and compliance breaches, and business disruption. RCSA - risk and control self-assessment - identifies risks, rates inherent and residual exposure, and documents controls. Business impact analysis identifies critical processes, dependencies, recovery time objectives, and recovery point objectives. KRIs should be forward-looking and tied to thresholds; lagging loss data is useful but insufficient.
Traps: reducing ERM to a compliance report, treating operational risk as only fraud, and using KRIs that are really KPIs. Aggregation is a common trap: adding risk scores across silos ignores correlation and concentration. Also watch for emerging risks omitted because they lack historical data, and for third-party risk treated as procurement rather than risk management. Governance questions may ask who owns operational risk - the business does, with independent challenge from the second line.
Worked example: a payment unit runs an RCSA. Inherent risk for manual refunds is rated 4 likelihood × 5 impact = 20. Controls include dual approval and daily reconciliation. Testing finds approval bypassed 10% of the time, so residual is raised to 3 × 5 = 15. The unit sets a KRI - bypass rate - with a 5% threshold, adds an automated block, and reports the trend monthly. That is a complete loop: identify, assess, control, monitor, report.
Rule of thumb: ERM connects risk to strategy; operational risk is managed in the process and escalated by exception.