CISI Operational Risk flashcards
CISI Operational Risk · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Operational risk definition
- Risk of loss from inadequate or failed internal processes, people, systems, or external events. Includes legal risk but excludes strategic and reputational risk from the Basel capital definition.
- Three lines of defence
- Model where business units own and manage risk (first line), risk and compliance functions oversee and challenge (second line), and internal audit provides independent assurance (third line).
- Enterprise risk management
- Firm-wide integrated framework that identifies, assesses, and manages all risks (operational, credit, market, strategic, reputational) aligned with strategic objectives and risk appetite.
- Risk appetite statement
- Formal expression of the amount and type of risk a firm is willing to accept in pursuit of its objectives, often including qualitative statements and quantitative limits.
- Basic Indicator Approach
- Basel II operational risk capital method: capital = 15% of average annual gross income over the previous three years. Simplest of the three approaches.
- Standardised Approach (Basel II)
- Operational risk capital method dividing activities into eight business lines, each with a beta (12–18%) applied to gross income, then summed.
- Advanced Measurement Approach
- Basel II approach allowing firms to use internal models (loss data, scenarios, business environment, controls) to calculate operational risk capital, subject to supervisory approval.
- Business Indicator (Basel III)
- Component of the 2017 Standardised Approach for operational risk, calculated from interest income/expense, services income, and financial income/expense, used to determine capital.
- Loss component (SA)
- Part of the Basel III operational risk capital formula: 15 times the average annual operational losses over ten years, capped at 100% of the business indicator component.
- Risk and control self-assessment
- Process where business units identify risks, assess likelihood and impact, evaluate controls, and rate inherent and residual risk, often using workshops and standard templates.
- Key risk indicator
- Metric providing early warning of increasing risk exposure (e.g. failed trade count, staff turnover), with thresholds that trigger escalation when breached.
- Scenario analysis
- Expert-based estimation of frequency and severity of plausible severe operational events, used to supplement sparse loss data and inform capital modelling.
- Near miss
- An operational event that did not cause a loss but could have done so; recording near-misses improves risk identification and control effectiveness.
- Internal fraud
- Basel event type: losses due to acts by employees involving theft, fraud, or circumvention of regulations (e.g. unauthorised trading, embezzlement).
- External fraud
- Basel event type: losses due to third-party theft, fraud, or hacking (e.g. robbery, cheque fraud, cyber intrusion, card skimming).
- Execution, delivery and process management
- Basel event type covering failed transaction processing, settlement errors, documentation mistakes, and vendor disputes.
- Preventive control
- Control designed to stop a risk event from occurring, such as segregation of duties, access restrictions, or authorisation limits.
- Detective control
- Control designed to identify a risk event after it has occurred, such as reconciliations, exception reports, or post-trade monitoring.
- Control testing
- Assessment of a control's design effectiveness (is it designed to mitigate the risk?) and operating effectiveness (is it working as intended?), using walkthroughs, sampling, or reperformance.
- Segregation of duties
- Preventive control ensuring no single person controls all stages of a transaction, reducing fraud and error risk; often implemented as maker-checker.
- Insurance mitigation
- Transfer of operational risk losses to an insurer; under Basel II AMA, insurance may reduce operational risk capital by up to 20% subject to conditions.
- Captive insurance
- A subsidiary insurer owned by the firm to retain and manage risk internally, potentially reducing external premiums but keeping risk within the group.
- Residual risk
- The level of risk remaining after controls and mitigation have been applied; must be assessed and monitored against risk appetite.
- Business impact analysis
- Process identifying critical business processes, dependencies, and the maximum tolerable downtime, used to set recovery time and recovery point objectives.
- Recovery time objective
- The target time within which a business process or system must be restored after a disruption, derived from the business impact analysis.
- Recovery point objective
- The maximum acceptable amount of data loss measured in time (e.g. four hours), determining backup frequency requirements.
- Operational resilience
- The ability of a firm to prevent, adapt, respond to, recover from, and learn from operational disruptions, ensuring important business services continue.
- Crisis management
- Structured command and control process for managing severe incidents, including escalation, communication, and decision-making during disruption.
- Conduct risk
- Risk that a firm's behaviour causes harm to customers, markets, or its integrity, such as mis-selling, market abuse, or poor complaint handling.
- Outsourcing
- Transfer of a business function to a third party; the firm retains ultimate responsibility and must manage the relationship and regulatory obligations.
- Third-party risk management
- Lifecycle process of due diligence, contracting, onboarding, ongoing monitoring, and exit planning for third-party providers to manage risk.
- Concentration risk (third party)
- Over-reliance on a single third party or provider (e.g. cloud service) that could threaten operational resilience if it fails.