CISI Operational Risk cheat sheet

Operational risk: risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events (Basel II definition).

Four causal categories: people, process, systems, external events. Legal risk is included; strategic and reputational risk are excluded from the Basel capital definition.

Operational risk is inherent in all activities; unlike market or credit risk, it is not taken for profit and cannot be eliminated, only managed.

Operational loss events often have low frequency/high severity (e.g. fraud, disasters) or high frequency/low severity (e.g. processing errors).

Operational risk is typically measured using loss data, risk and control self-assessments (RCSAs), key risk indicators (KRIs), and scenario analysis.

The 'three lines of defence' model: business units own risk (1st), risk/compliance functions oversee (2nd), internal audit provides independent assurance (3rd).

Operational risk management aims to protect earnings volatility, capital, reputation, and regulatory compliance, not to maximise returns.

ERM integrates operational, credit, market, liquidity, strategic, and reputational risk into a single firm-wide framework aligned with strategy.

Operational risk interacts with other risks: e.g. a credit loss may arise from a processing error (operational) or a market loss from a failed trade settlement.

Risk appetite statement expresses the amount of risk the firm is willing to accept in pursuit of objectives; risk tolerance sets operational boundaries.

Risk taxonomy provides a common language to categorise risks and map them to controls, owners, and capital.

The risk universe lists all identified risks; risk registers record assessed risks, controls, and owners at business-unit level.

ERM uses a 'risk-adjusted' view: economic capital allocation, risk-adjusted return on capital (RAROC), and stress testing inform decisions.

Governance: board sets appetite, senior management implements, risk committee oversees; independent risk function reports to the board or CRO.

Basel II (2004) introduced an explicit operational risk capital charge under Pillar 1, alongside credit and market risk.

Three approaches: Basic Indicator Approach (BIA) = 15% of average annual gross income over three years; Standardised Approach (TSA) uses business-line betas (12–18%); Advanced Measurement Approach (AMA) uses internal models.

Basel III (post-2010) retained operational risk capital; the Basel Committee's 2017 finalisation replaced all approaches with the Standardised Approach (SA), effective from 2023.

SA formula: Business Indicator (BI) component × marginal coefficients (12%, 15%, 18%) applied to BI ranges, plus a loss component based on 10-year average annual operational losses.

Loss component = 15 × average annual operational losses over 10 years (capped at 100% of the BI component).

Business Indicator = interest income/expense, services income, and financial income/expense, calculated per prescribed rules.

Pillar 2 (ICAAP/SREP) requires firms to assess operational risk capital adequacy beyond Pillar 1; Pillar 3 requires public disclosure of operational risk.

Other regulators: FCA/PRA in UK (SYSC, operational resilience rules), EBA in EU (CRR/CRD), and local conduct regulators impose additional requirements.

Risk identification techniques: process mapping, workshops, scenario analysis, loss data analysis, internal audit findings, and external event databases.

RCSA: business units identify risks and controls, assess likelihood and impact (often 1–5 scales), and rate inherent and residual risk.

Risk rating = likelihood × impact; heat maps plot risks by these dimensions to prioritise attention.

KRIs are metrics that provide early warning of increasing risk (e.g. number of failed trades, staff turnover); thresholds trigger escalation.

Loss data: internal loss data (actual events), external data (consortium databases), and near-misses (events that did not cause loss but could have).

Scenario analysis: experts estimate frequency and severity of plausible severe events to supplement sparse loss data, feeding capital models.

Measurement approaches: historical loss simulation, scenario-based, scorecard, and causal models; AMA required rigorous data and validation.

Stress testing and reverse stress testing test resilience to extreme operational events (e.g. cyber attack, system outage).

Risk appetite: the level of risk the firm is willing to accept to achieve its strategic objectives; expressed qualitatively and quantitatively.

Risk tolerance: the maximum acceptable deviation from appetite; breaches trigger escalation and remediation.

Risk appetite framework includes statements, metrics (KRIs), thresholds, governance, and reporting to the board.

Board approves risk appetite; the risk committee monitors; the CRO implements; business lines operate within limits.

Three lines of defence: 1st line owns and manages risk; 2nd line (risk/compliance) sets frameworks and challenges; 3rd line (internal audit) provides independent assurance.

Governance structures: board risk committee, audit committee, executive risk committee, and operational risk function.

Escalation protocols: defined triggers (e.g. KRI breach, loss above threshold) require reporting to senior management and board within set timeframes.

Culture and conduct: tone from the top, whistleblowing, and accountability reinforce risk appetite adherence.

Operational loss event: an event causing financial loss, regulatory impact, or reputational harm due to failed processes, people, systems, or external events.

Event categories (Basel): internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, execution/delivery/process management.

Loss data collection: capture event date, discovery date, amount, business line, event type, causes, and recoveries.

Near-miss: an event that did not result in loss but could have; recording near-misses improves risk identification.

Incident management: log, classify, escalate, investigate, remediate, and report incidents; root cause analysis prevents recurrence.

Loss data thresholds: firms set minimum loss amounts for capture (e.g. £10,000) to balance completeness and cost.

External loss data (e.g. ORX) supplements internal data for tail events and scenario calibration.

Regulatory reporting: material incidents may require notification to regulators (e.g. FCA/PRA) within specified timeframes.

Control: any action, policy, or procedure that reduces the likelihood or impact of a risk event.

Preventive controls stop an event occurring (e.g. segregation of duties, access controls); detective controls identify events after they occur (e.g. reconciliations, exception reports).

Key control: a control critical to managing a significant risk; its failure would materially increase risk.

Control testing: assess design effectiveness (is the control designed to mitigate the risk?) and operating effectiveness (is it working as intended?).

Testing methods: walkthroughs, sample testing, reperformance, observation, and data analytics.

Control rating: effective, partially effective, ineffective; failures require remediation plans with owners and deadlines.

COSO framework: control environment, risk assessment, control activities, information and communication, monitoring activities.

Segregation of duties, maker-checker, and four-eyes principles are fundamental preventive controls in operations.

Risk mitigation reduces likelihood or impact through controls, process redesign, diversification, or contingency planning.

Risk transfer shifts financial consequences to a third party, typically via insurance, outsourcing, or hedging (though operational risk cannot be fully hedged).

Insurance: covers specific perils (e.g. fraud, professional indemnity, cyber, property); policies have deductibles, limits, exclusions, and waiting periods.

Insurance mitigation in capital: under Basel II AMA, insurance may reduce operational risk capital by up to 20% subject to conditions (e.g. insurer rating, policy term, payout certainty).

Captive insurance: a subsidiary insurer owned by the firm to retain and manage risk; may reduce external premiums but retains risk within the group.

Outsourcing transfers activities but not ultimate responsibility; the firm remains accountable to regulators for outsourced functions.

Business continuity and disaster recovery are mitigation measures for business disruption events.

Residual risk after mitigation must be assessed and monitored; mitigation should be proportionate to the risk.

Business continuity management (BCM): capability to continue critical operations during and after disruption.

Business impact analysis (BIA): identifies critical processes, dependencies, and maximum tolerable downtime (MTD) / recovery time objectives (RTO).

Recovery point objective (RPO): maximum acceptable data loss measured in time; recovery time objective (RTO): target time to restore service.

Disaster recovery (DR): technical recovery of IT systems and data, often via backup sites or cloud failover.

Operational resilience: the ability of the firm to prevent, adapt, respond to, recover from, and learn from operational disruptions (FCA/PRA approach).

Crisis management: command and control structure, communication plans, and escalation during a severe incident.

Testing: regular exercises (tabletop, simulation, full failover) validate BCP and DR plans; lessons learned feed improvements.

Third-party dependencies (e.g. cloud providers) must be mapped and tested for resilience; concentration risk considered.

Conduct risk: risk that the firm's behaviour causes harm to customers, markets, or the firm's integrity (e.g. mis-selling, market abuse).

FCA conduct principles: treat customers fairly, act with integrity, due skill and care, communicate clearly, and manage conflicts of interest.

Conduct risk is managed through culture, incentives, training, monitoring, and complaint handling.

Outsourcing: transfer of a function to a third party; the firm retains regulatory responsibility and must manage the relationship.

Third-party risk management lifecycle: due diligence, contracting, onboarding, ongoing monitoring, and exit planning.

Concentration risk: over-reliance on a single third party (e.g. cloud provider) can threaten operational resilience.

Regulatory requirements: FCA SYSC 8 (outsourcing), EBA outsourcing guidelines, and PRA operational resilience rules require mapping of important business services.

Contract terms should include service levels, audit rights, data protection, termination, and subcontracting controls.