The Reconciliation Gap at Northbridge Asset Management
Northbridge Asset Management, a UK wealth manager with £14bn under management, outsourced its trade reconciliation and settlement matching to a third-party administrator fourteen months ago. In March a mapping error introduced during the administrator's platform upgrade caused an FX settlement to fail: £2.3m of client money sat unsecured for three business days before being recovered in full. Investigation showed the firm's oversight team had cut daily exception review to weekly after two departures, and the incident was logged in the operations team's local register but not escalated to the Risk Committee for six weeks. Client money reconciliations are also subject to the FCA's CASS rules. The firm's operational risk appetite statement contains one quantitative line: 'no single operational loss event exceeding £1m'. The CRO has asked the Risk Committee to decide whether the framework needs changing before the annual ORSA-style review, and whether a fully recovered, zero-loss outcome should be recorded as an incident or a near miss.
1. Identify the risk categories engaged by this event and the specific control failures that allowed it to happen and to remain unescalated for six weeks.
Read the worked answer
The primary category is operational risk - a failed process and system change - but the event is not single-category. Because client money was unsecured, it also engages regulatory/compliance risk (CASS reconciliation and segregation duties) and conduct risk (potential client detriment), with a secondary reputational exposure. The outsourcing arrangement adds third-party risk, which is a subset of operational risk but carries its own oversight obligations.
The control failures are distinct and each is actionable:
- Change management: the administrator's platform upgrade was not preceded by a firm-side impact assessment or followed by end-to-end testing of the mapping; the firm relied on the vendor's own sign-off.
- Control design: automated matching was treated as a control without independent validation or a four-eyes sample check, so a systematic mapping error passed silently.
- Resourcing and key-person dependency: two departures removed the only staff who understood the exception queue, and daily review was downgraded to weekly without a formal change approval or risk assessment.
- Escalation: there was no defined event-notification threshold or timeline, so escalation depended on individual judgement.
- Third-party oversight: no reconciliation-accuracy KPI or service review meant the vendor's error rate was invisible to the second line.
The key point for the exam is that the recovery of the money does not remove the control failure; the exposure existed for three days regardless of outcome.
2. Critically evaluate the firm's operational risk appetite statement and set out a more robust structure for the Risk Committee to consider.
Read the worked answer
The statement is inadequate for four reasons. First, it is outcome-based and lagging: it measures realised loss, so it is silent on the process failures, near misses and control breakdowns that precede loss. A firm can breach its control environment repeatedly and never breach a £1m loss threshold. Second, it is single-dimensioned: it says nothing about frequency, client harm, regulatory breach, or the number of risk events. Third, it is not cascaded: no business-line or process-level limits exist, so nobody owns a number. Fourth, a loss threshold expressed in pounds ignores that some events are intolerable at any value - an unsecured client money position is one.
A better structure has several layers:
- Zero-tolerance statements for things that cannot be traded off: client money segregation breaches, sanctions breaches, market abuse, unremediated regulator findings. 'Zero' should be reserved for a small number of genuine prohibitions, otherwise it destroys prioritisation.
- Quantitative tolerances expressed as an annual aggregate operational loss budget (e.g. a percentage of revenue), a single-event ceiling, and a frequency cap on events above a lower threshold.
- Leading indicators with escalation triggers: ageing of reconciliation exceptions, overdue breaks, change-failure rate, key-person coverage, vendor SLA breaches.
- Qualitative appetite for conduct, regulatory and reputational risk, with defined escalation paths and timeframes.
Appetite should be board-approved, cascaded into limits, monitored monthly through a KRI dashboard, and explicitly linked to the risk register and to scenario analysis used in capital planning.
3. Advise whether a fully recovered, zero-loss event should be recorded as an incident, a near miss, or neither, and what the Risk Committee should require.
Read the worked answer
It should be recorded as an incident, and separately flagged as having produced no financial loss. The distinction the exam wants is between the event and the outcome.
An operational risk event is an event arising from inadequate or failed internal processes, people, systems or external events - the failed settlement and the unsecured client money position meet that definition independently of whether money was ultimately recovered. An organisation that classifies by outcome will systematically under-capture risk, because recoveries are frequently luck or the product of a control that happened to work, not evidence that the exposure was absent.
Classifying it solely as a 'near miss' would understate severity and bias the loss data used for scenario analysis and operational risk capital. A near miss should be reserved for cases where the failure did not translate into an exposure at all - for example, a reconciliation break identified before any settlement instruction was released.
The Risk Committee should require: root-cause analysis with a named owner and dated remediation; a check that no other mapping errors exist across the vendor platform; a defined escalation matrix specifying which events reach the committee and within how many business days; capture in the event and near-miss database for trend analysis; and reporting of CASS-related matters through the appropriate governance route, with board visibility. It should also ask whether recovery was tested or coincidental - that answer determines whether the residual risk is genuinely low.