CISI Operational Risk

It is a multiple-choice examination delivered by CISI, taken either at a test centre or by remote invigilation depending on the option you book. The current number of questions, time allowed and pass mark are published by CISI on its own website, so check there before you book rather than relying on second-hand figures.

Most candidates find it manageable with structured study but not trivial. The difficulty lies less in memorising definitions and more in applying them: many questions describe a scenario and ask which control, risk category or treatment is most appropriate. Candidates with operational or risk experience usually find the scenarios intuitive; those without need to practise applying concepts.

A common approach is four to eight weeks of part-time study, depending on prior exposure to risk work. Work through the official workbook chapter by chapter, then spend the final two weeks on question practice and reviewing your weak areas. If you already work in operations or risk, you can compress the early chapters but should not skip the regulatory and capital material.

Follow the workbook order for a first pass, because later chapters assume the vocabulary from earlier ones. On revision, group topics: definitions and enterprise risk management first, then identification and measurement, then controls, incidents and mitigation. Regulatory capital and governance are easier to retain once you understand the underlying risk concepts, so revisit them last.

CISI sets its own retake rules, including any waiting period or additional fee, and these can change. Check the current policy on the CISI website or with your training provider before booking. In practice, candidates who fail usually do so narrowly, and a focused few weeks on the topics they scored weakest in is normally enough.

Three recurring problems: confusing operational risk with credit or market risk in scenario questions; memorising control names without understanding what each control actually achieves; and neglecting the regulatory capital chapter because it feels technical. Another common error is skimming the question stem, which often contains the detail that makes one answer clearly better than the others.

Expect some quantitative content, particularly around loss data, capital calculation approaches and basic probability or impact ratings used in risk assessment. You do not need advanced mathematics, but you should understand what each calculation represents and when it applies. Practise worked examples until the logic is clear rather than memorising numbers.

Use them as a diagnostic, not a crutch. Attempt a block without notes, mark your answers, then read the explanation for every question, including the ones you got right. Keep a log of repeated errors by topic and revisit those chapters. Towards the end, sit a full timed paper to get used to the pace.

CISI qualifications and the study involved are generally relevant to continuing professional development for people in financial services roles, but the exact treatment depends on your firm and your professional body's rules. Confirm with your compliance or learning and development team how it should be recorded in your CPD log.