CISI Operational Risk common mistakes
CISI Operational Risk · Understand the traps and how to avoid them.
Treating operational risk as synonymous with 'anything that isn't market or credit risk' and giving vague, catch-all answers, instead of defining it as the risk of loss from inadequate or failed internal processes, people, systems, or external events.
Candidates carry over a loose working definition from general banking practice and never anchor it to the formal four-cause taxonomy that the syllabus and exam questions test against. When asked to classify or distinguish a scenario, they cannot map it to a cause category.
What to do instead
Memorise the four-cause definition verbatim and practise classifying 20 mixed scenarios (e.g. a rogue trader, a failed settlement system, a flood, a key-person resignation) into process, people, systems or external events, and separately into the Basel event types (internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption and system failures, execution/delivery/process management). Check each classification against the definition rather than intuition.
Confusing the three lines of defence model with the three components of Basel II operational risk capital (basic indicator, standardised, advanced measurement), or assigning control ownership to the second or third line.
Both frameworks use 'three' and are taught close together, so candidates blur the governance structure with the capital calculation approaches. They also misread the second line as a doer rather than an overseer.
What to do instead
Draw two separate diagrams from memory. For governance: first line owns and operates controls, second line (risk and compliance) sets frameworks, challenges and monitors, third line (internal audit) provides independent assurance. For capital: basic indicator approach, standardised approach, advanced measurement approaches. Then write one sentence per element and test yourself by asking 'who owns this control?' and 'how is this capital number calculated?' as distinct questions.
Mixing up risk appetite, risk tolerance and risk capacity, using them interchangeably in scenario questions about limits and breaches.
The terms overlap in everyday language, and candidates answer from general intuition rather than the formal hierarchy in which appetite is the high-level amount and type of risk an firm is willing to seek, tolerance is the acceptable variation around that appetite expressed as limits, and capacity is the maximum risk the firm could bear before failing.
What to do instead
Build a one-line hierarchy: capacity is the outer bound set by capital and viability, appetite is the chosen position inside capacity, tolerance is the permitted deviation around appetite expressed as quantitative limits and triggers. Practise with a numerical scenario (e.g. a loss limit of £2m with a 10% tolerance) and state which concept each number represents. Rehearse the escalation path when a tolerance is breached.
Describing the operational risk capital approaches without knowing which is most sensitive to risk and which requires supervisory approval, or omitting that the standardised approach uses business-line betas.
Candidates learn the names but not the differentiating features, so they cannot answer comparison or 'which approach is appropriate for a firm of this size' questions. They also assume the advanced approach is available to everyone.
What to do instead
Create a comparison table with columns for calculation basis, risk sensitivity, data requirements, and approval needed. Key anchors: basic indicator uses a single indicator (gross income) multiplied by a fixed percentage; standardised applies betas to eight business lines; advanced measurement approaches use the firm's own internal models and require explicit supervisory approval. Learn the direction of the trade-off (greater risk sensitivity means greater data and modelling burden) so you can reason rather than recall.
Treating a near miss as an operational risk loss event and including it in loss data totals, or conversely excluding it from incident management entirely.
Candidates conflate 'incident' with 'loss'. A near miss is an event that could have caused loss but did not, so it carries no loss amount but is highly valuable for control improvement. Mixing them corrupts both the loss data and the lessons-learned analysis.
What to do instead
Learn the three-way distinction: loss events (financial impact realised), near misses (no impact but potential), and control failures identified through testing. State explicitly that near misses are captured in the incident management system for analysis but excluded from loss amount aggregation. In exam scenarios, always ask 'did money actually leave?' before classifying.
Confusing inherent risk with residual risk, or forgetting that control effectiveness sits between them when describing a risk assessment.
Candidates jump straight to a single risk rating without articulating the assessment chain, so they cannot answer questions that ask what a control does to a risk score or why two firms rate the same risk differently.
What to do instead
Internalise the chain: inherent risk (before controls) → control effectiveness assessment → residual risk (after controls) → comparison against appetite. Practise by taking one risk, rating its inherent likelihood and impact, describing the key controls, judging control effectiveness, and deriving the residual rating. Always state which of the two ratings you are giving when a question asks for 'the risk rating'.
Answering insurance questions by saying insurance 'eliminates' or 'transfers all' operational risk, and ignoring exclusions, deductibles, coverage gaps, and the fact that reputational and regulatory risk are largely uninsurable.
Candidates treat insurance as a simple yes/no mitigation and do not consider that insurance transfers financial consequence, not the risk event itself, and leaves residual risk through policy limits and exclusions.
What to do instead
Frame insurance as transferring financial impact only, subject to policy terms. Learn the common limitations: exclusions (e.g. fines and penalties, deliberate acts), deductibles and retentions, limits of indemnity, claims timing and basis, and the uninsurability of reputational damage. In scenario answers, always state what residual risk remains after the policy responds, and note that insurance is a mitigant recorded in the control framework, not a substitute for controls.
Treating business continuity, resilience and crisis management as the same thing, and describing a business continuity plan as a document that guarantees continuity rather than a capability that must be tested.
The three concepts are adjacent and often taught together, so candidates collapse them. They also underestimate the testing and validation requirement, which is where most exam marks sit.
What to do instead
Separate the concepts: business continuity focuses on maintaining critical operations during disruption through recovery plans and recovery time objectives; operational resilience is the broader ability to anticipate, absorb, adapt to and recover from shocks, including severe but plausible scenarios; crisis management is the command, communication and decision-making structure invoked during a severe event. Learn the role of impact tolerances, business impact analysis, recovery time and recovery point objectives, and the requirement for regular testing with lessons learned fed back into plans.
Underestimating outsourcing and third-party risk by assuming that outsourcing transfers regulatory responsibility, or by focusing only on the contract rather than ongoing oversight.
Commercially it feels as though an outsourced activity has left the firm's risk profile, and contracts are visible while ongoing monitoring is not. Candidates therefore miss the retained accountability and concentration risk dimensions.
What to do instead
Memorise the principle that a firm cannot outsource its regulatory accountability: it remains responsible for the activity and for managing the third-party relationship. Learn the lifecycle (due diligence, risk assessment, contracting, ongoing monitoring, exit planning), the concepts of materiality, concentration risk and sub-outsourcing, and the need for access and audit rights. In scenario answers, always identify the retained risk and the monitoring obligation.
Treating conduct risk as a subset of compliance or as a reputational issue only, and failing to link conduct failures to customer outcomes, culture, incentives and the firm's obligations to act with integrity and treat customers fairly.
Candidates map conduct to 'following the rules' and miss the outcome-based framing, so they cannot answer questions about mis-selling, conflicts of interest, remuneration-driven behaviour, or the difference between a conduct breach and a prudential one.
What to do instead
Define conduct risk as the risk that the firm's behaviour or the behaviour of its staff leads to unfair customer outcomes or damages market integrity. Learn to connect drivers (culture, incentives, product design, sales targets, conflicts of interest) to outcomes (mis-selling, unsuitable advice, poor complaint handling) and to the response (conduct risk assessments, outcome testing, whistleblowing, remuneration adjustments). Practise articulating why a conduct failure can exist even where no rule was broken.