Operational risk identification, assessment and measurement
Identification, assessment and measurement is the engine room of operational risk. The exam tests RCSA design, the difference between inherent and residual risk, KRI construction, scenario analysis and how loss data feeds capital.
Identification
Start from the process, not the org chart. Tools include process maps, risk and control matrices, workshops, walkthroughs, checklists, loss data analysis, external event databases and horizon scanning for emerging risks. The output is a risk register with an owner, cause, event, consequence and linked controls.
Assessment
Score inherent risk (before controls) then residual risk (after controls), usually on likelihood × impact scales of 1–5. Define each anchor explicitly: does a "4" likelihood mean once in two years or once in ten? Uncalibrated scales produce unusable heat maps and inconsistent escalation.
Key risk indicators
A good KRI is measurable, predictive, owned and thresholded. Distinguish lagging indicators (losses, complaints received) from leading indicators (failed access reviews, overdue control tests, turnover in a key team). Each KRI needs green/amber/red thresholds tied to appetite.
Measurement
Four inputs: internal loss data, external loss data (scaled to firm size), scenario analysis and business environment/internal control factors. Advanced firms model loss distributions (frequency × severity), use extreme value theory for the tail and apply correlation assumptions. Under the Basel III Standardised Approach, capital comes from the Business Indicator and an Internal Loss Multiplier, so loss data still matters directly.
Worked example
A wire-transfer process scores likelihood 4, impact 3 → inherent 12. Controls are an automated validation (strong) plus daily reconciliation (moderate). The assessment team judges the automated control reduces likelihood to 2, giving residual 6. Reasoning: impact does not change because controls detect but do not prevent the loss once the payment leaves the firm. Documenting that logic prevents the common error of downgrading both axes after adding a single control.
Traps that cost marks
- Calling a metric a KRI when it has no threshold, owner or reporting frequency.
- Scoring residual risk without evidence of control effectiveness.
- Using external loss data unscaled - a €500m bank's event is not directly comparable to a €5bn bank.
- Treating scenario analysis as a capital exercise only, disconnected from the register.