Operational risk, controls, reconciliation and business continuity
Operational risk questions test control design: how errors are prevented, detected, corrected and reported, and how the firm keeps operating when systems fail.
Three lines of defence
First line: operations, running processing, reconciliations and maker-checker. Second line: risk and compliance, setting policy, KRIs and oversight. Third line: internal audit. The TA maintains a risk and control self-assessment (RCSA), an error and breach log, and incident management with root-cause analysis.
Controls and reconciliation
Standard controls include segregation of duties, maker-checker on all register and cash entries, restricted system access, four-eyes review of NAV and dealing files, and dual authorisation on payments. Reconciliations should be daily and cover:
- Units in issue against the register and depositary/custody records (stock reconciliation).
- Cash per bank statements against the fund's accounting ledger.
- Suspense and box positions, with ageing and clearance. Breaks are investigated, aged, escalated by tolerance and resolved with a documented audit trail. Significant breaches are reported to the regulator, for example under FCA SUP 15.
Business continuity and outsourcing
BCP requires defined recovery time objectives (how quickly a service must be restored) and recovery point objectives (acceptable data loss), a documented plan, alternate sites, and tested scenarios including cyber and third-party failure. UK operational resilience rules require identifying important business services, setting impact tolerances and testing against them. Outsourcing under SYSC 8 requires due diligence, contractual rights, exit plans and ongoing monitoring.
Worked example
At 09:00 the stock reconciliation shows 12,000 units on the register against 12,050 in issue. Operations quarantines the break, checks the dealing file for an unposted subscription, posts the missing 50 units with maker-checker sign-off, re-reconciles and logs the incident. Root cause is a failed batch upload; the control is a daily end-of-day unit reconciliation with zero tolerance for unexplained breaks.
Traps
- Confusing RTO (time to restore) with RPO (acceptable data loss).
- Assuming outsourcing removes accountability.
- Treating reconciliation as an IT task rather than a control.
- Failing to age and escalate long-standing suspense items.