Operational risk in the context of enterprise risk management
Enterprise risk management (ERM) is where operational risk stops being a back-office ledger and becomes part of how the board directs the firm. The exam tests whether you can position operational risk alongside credit, market, liquidity, strategic and conduct risk, and explain how it is aggregated, prioritised and reported.
How operational risk fits the ERM framework
Frameworks such as COSO ERM and ISO 31000 run the same cycle: establish context, identify, assess, treat, monitor, report. Operational risk uses that cycle but has distinctive features:
- It is pervasive. Every process, person and system carries it, so the risk universe must be built from processes and services, not from a single department.
- It is largely non-financial in origin, so quantification leans on loss data, scenarios and KRIs rather than observed prices.
- It interacts with other risks. A cyber outage is operational; the liquidity and reputational consequences are second-order but must be modelled in scenario analysis.
The three lines model
The first line owns and manages risk in the business. The second line (operational risk, compliance) sets frameworks, challenges and aggregates. The third line (internal audit) gives independent assurance. Independence matters: the second line cannot own the controls it assures.
Aggregation and the top-risk view
Firms combine bottom-up data (loss events, RCSA results, control testing) with top-down judgement (scenario analysis, emerging risks) to produce a firm-wide risk profile. Aggregation must handle correlation: ten process risks in the same payment chain are not ten independent risks, and simply adding them overstates the aggregate.
Worked example
A firm's top-ten register ranks cyber first because a scenario exercise produced a £60m tail loss. Over three years, however, cyber produced £0.4m of losses while process errors produced £11m. Reasoning: both views are legitimate but answer different questions. The register should show cyber as the largest severity exposure and process error as the largest frequency exposure, with capital and control investment allocated to both, and the board paper should state the basis of ranking explicitly so the comparison is not misread.
Traps that cost marks
- Describing the three lines as three departments rather than three roles.
- Letting scenario severity dominate the register while ignoring loss history, or the reverse.
- Treating operational risk as a back-office topic, excluding front-office sales and conduct processes.
- Omitting emerging-risk scanning and risk culture from the ERM description.