CISI Operational Risk study plan
CISI Operational Risk · Give each week a clear focus.
8 weeks · About 6 hours per week
Operational risk identification, assessment and measurement
Define operational risk and distinguish it from credit, market and liquidity risk using at least three examples.
Explain the purpose and steps of a risk and control self-assessment (RCSA).
Identify and apply common risk assessment techniques such as risk mapping, scenario analysis and key risk indicators.
Calculate a basic expected loss using frequency and severity assumptions, and explain the limitations of this approach.
Your checkpoint
A one-page RCSA for a simple business process (e.g., payment processing) with at least five risks, their likelihood and impact ratings, and two controls for each.
Operational risk identification, assessment and measurement & Introduction to operational risk
Compare and contrast the three main approaches to operational risk measurement: basic indicator, standardised and advanced measurement approaches.
Describe the role of loss data, scenario analysis, business environment and internal control factors (BEICF) in operational risk capital modelling.
Explain the operational risk definition and taxonomy used by Basel II/III and how it differs from other risk types.
Summarise the key drivers of operational risk, including people, processes, systems and external events.
Your checkpoint
A comparative table of the three measurement approaches covering data requirements, capital calculation and advantages/disadvantages, with a short paragraph explaining which approach suits a mid-sized bank.
Operational risk events, loss data and incident management & Control frameworks, key controls and control testing
Classify operational risk events into the seven Basel event types and give two examples of each.
Explain the elements of an effective incident management process, from identification to closure and root cause analysis.
Describe the purpose and structure of a loss data programme, including data collection, thresholds and data quality checks.
Identify key controls for a given process and explain how to test their design and operating effectiveness.
Your checkpoint
An incident log with five hypothetical events, each classified by Basel event type, with a root cause analysis and a proposed control improvement for each.
The regulatory framework and capital requirements for operational risk & Operational risk appetite, tolerance and governance
Outline the Basel operational risk regulatory framework, including the 2004 Basel II text and subsequent revisions (e.g., Basel III final reforms).
Explain the Standardised Approach for operational risk under the Basel III final reforms, including the Business Indicator and the Internal Loss Multiplier.
Define risk appetite and risk tolerance, and explain how they are articulated in a risk appetite statement.
Describe the roles and responsibilities of the board, senior management and the three lines of defence in operational risk governance.
Your checkpoint
A draft risk appetite statement for operational risk with at least three qualitative and three quantitative appetite metrics, plus a governance map showing responsibilities across the three lines of defence.
Operational risk in the context of enterprise risk management & Operational risk mitigation and transfer, including insurance
Explain how operational risk fits into an enterprise risk management (ERM) framework and how it interacts with other risk types.
Describe the process for identifying, assessing and managing operational risk in a new product or business change (e.g., new product approval process).
Compare risk mitigation techniques: insurance, outsourcing, hedging and internal controls, and explain their limitations.
Evaluate the role of insurance in operational risk transfer, including coverage types, exclusions and the treatment of insurance in regulatory capital.
Your checkpoint
A one-page ERM integration summary showing how operational risk is aggregated with other risks, plus a table of three insurance products with their coverage, exclusions and suitability for specific operational risks.
Business continuity, resilience and crisis management & Conduct risk, outsourcing and third-party risk
Define business continuity management (BCM) and explain the components of a business continuity plan (BCP).
Conduct a business impact analysis (BIA) for a critical process, including recovery time objectives (RTOs) and recovery point objectives (RPOs).
Explain the principles of operational resilience and how it extends beyond traditional BCM.
Identify conduct risk and explain how it is managed, including the role of culture and incentives.
Describe the key risks in outsourcing and third-party relationships and the controls to mitigate them.
Your checkpoint
A business impact analysis for a critical process with RTO/RPO, plus a third-party risk assessment checklist covering due diligence, contract clauses and ongoing monitoring.
Introduction to operational risk & Operational risk in the context of enterprise risk management & The regulatory framework and capital requirements for operational risk & Operational risk appetite, tolerance and governance
Review and consolidate the definitions and scope of operational risk, ERM, regulatory capital and governance.
Answer 30 multiple-choice questions covering these domains and score at least 80%.
Create a one-page summary sheet of key formulas, ratios and regulatory thresholds.
Explain the three lines of defence model and its application in a case study.
Your checkpoint
A completed practice exam (30 questions) with a score of 80% or above, and a personal list of weak areas with page references for further review.
Operational risk identification, assessment and measurement & Operational risk events, loss data and incident management & Control frameworks, key controls and control testing & Operational risk mitigation and transfer, including insurance & Business continuity, resilience and crisis management & Conduct risk, outsourcing and third-party risk
Review and consolidate risk assessment, loss data, control frameworks, mitigation, resilience and conduct/third-party risk.
Answer 40 multiple-choice questions covering these domains and score at least 80%.
Revisit all previously incorrect questions and write a short explanation for each correct answer.
Complete a timed full mock exam under exam conditions.
Your checkpoint
A full mock exam (60 questions) completed within 90 minutes with a score of at least 75%, and a final revision sheet of key takeaways.
Milestones
Week 2: Can explain the three operational risk measurement approaches and their data requirements without notes, and has completed the comparative table.
Week 4: Has drafted a risk appetite statement and can describe the Basel III Standardised Approach for operational risk, including the Business Indicator and Internal Loss Multiplier.
Week 6: Has completed a business impact analysis and a third-party risk checklist, and can explain the differences between BCM and operational resilience.
Week 8: Achieves at least 75% on a timed full mock exam and has a personal revision sheet covering all domains.