CISI Operational Risk study guide
CISI Operational Risk · Work through your exam, one topic at a time.
The CISI Operational Risk examination is a professional qualification from the Chartered Institute for Securities & Investment (CISI) that tests whether a candidate understands how operational risk is identified, measured, governed and controlled inside a financial services firm. It is aimed at staff who work with operational risk day to day: risk and compliance professionals, operations and middle-office staff, internal auditors, control-testing teams, and line managers who own risks in their business unit. The CISI Operational Risk study guide has 10 sections and about 4,126 words.
01Introduction to operational risk
Operational risk is the domain examiners use to test whether you can define, classify and distinguish loss events from other risk types. Questions typically ask you to place a scenario in the right Basel category, identify the failed control, and explain why the loss is not credit or market risk.
432 words, about 2 min02Operational risk in the context of enterprise risk management
Enterprise risk management (ERM) is where operational risk stops being a back-office ledger and becomes part of how the board directs the firm. The exam tests whether you can position operational risk alongside credit, market, liquidity, strategic and conduct risk, and explain how it is aggregated, prioritised and reported.
446 words, about 2 min03The regulatory framework and capital requirements for operational risk
Regulatory capital for operational risk is a favourite exam area because the rules are precise and the arithmetic is checkable. You need the Basel definition and approaches, the post-reform Standardised Approach, and how the UK and EU regimes apply them.
427 words, about 2 min04Operational risk identification, assessment and measurement
Identification, assessment and measurement is the engine room of operational risk. The exam tests RCSA design, the difference between inherent and residual risk, KRI construction, scenario analysis and how loss data feeds capital.
418 words, about 2 min05Operational risk appetite, tolerance and governance
Risk appetite is the board's statement of how much operational risk the firm will accept to pursue its strategy. The exam tests the difference between appetite, tolerance and capacity, how appetite is expressed and cascaded, and the governance that makes it real.
440 words, about 2 min06Operational risk events, loss data and incident management
Loss data and incident management is where operational risk becomes evidence-based. The exam tests what to capture, how to classify and net losses, and how incidents are escalated and closed.
392 words, about 2 min07Control frameworks, key controls and control testing
Controls are the mechanism by which risk appetite is actually delivered. The exam tests control taxonomy, the difference between design and operating effectiveness, and how testing is scoped and evidenced.
382 words, about 2 min08Operational risk mitigation and transfer, including insurance
Mitigation and transfer reduce the frequency or severity of operational losses. The exam tests the risk mitigation hierarchy, how insurance works as a transfer mechanism, and its real limits.
394 words, about 2 min09Business continuity, resilience and crisis management
Business continuity, resilience and crisis management tests whether the firm can keep delivering through disruption. The exam distinguishes BCP from operational resilience, and requires correct use of RTO, RPO and MTPD.
388 words, about 2 min10Conduct risk, outsourcing and third-party risk
Conduct risk, outsourcing and third-party risk are the domains where operational risk meets regulation most directly. The exam tests conduct drivers and frameworks, and the controls required when someone else performs a critical activity.
407 words, about 2 min