Operational risk mitigation and transfer, including insurance
Mitigation and transfer reduce the frequency or severity of operational losses. The exam tests the risk mitigation hierarchy, how insurance works as a transfer mechanism, and its real limits.
The hierarchy
Avoid (exit the activity), reduce (stronger controls, automation, segregation), transfer (insurance, outsourcing, contractual indemnities), accept (documented rationale and provision). Most operational risk is reduced rather than transferred, because the firm retains the conduct and reputational consequences of an event whatever the policy says.
Insurance: what it can and cannot do
Policies include crime/fidelity, professional indemnity, cyber, property/business interruption and directors' and officers'. Recovery depends on: insured perils and triggers, exclusions (often cyber, war, pandemic, unencrypted data), deductibles, limits and sub-limits, claims notification deadlines, and reinstatement provisions.
Under the Basel AMA, insurance could reduce operational risk capital by at most 20%, subject to conditions: insurer rated A or better, initial policy term of at least one year, 90 days' notice of cancellation, and payout within one year. Insurance recognition is not available under the Basel III Standardised Approach.
Residual and basis risk
Transferred risk leaves residual risk: deductibles, uncovered perils, claims disputes, insurer default and payout timing mismatches. Basis risk is the gap between the loss suffered and the loss the policy pays. Captives are a common middle path for large firms.
Worked example
A cyber incident costs £10m. The policy has a £5m limit, a £500,000 deductible and excludes losses from unencrypted data; £2m of the loss relates to unencrypted records. Reasoning: the excluded £2m falls outside cover entirely; the remaining £8m is subject to the £500,000 deductible, so the claim is £7.5m, capped at the £5m limit. Net retained loss is £5m. The mitigation plan must therefore address encryption and limit adequacy, not just buy more cover.
Traps that cost marks
- Assuming insurance removes the risk rather than part of the loss.
- Forgetting exclusions, deductibles and limits when computing recovery.
- Quoting the 20% insurance cap without stating that it applies to the AMA.
- Ignoring insurer counterparty risk and payout timing.