Operational, model and enterprise risk management
Operational, model and enterprise risk management
This domain tests the management of losses from failed processes, people, systems and external events, the governance of models, and the aggregation of risk across the enterprise. Expect questions on Basel operational risk approaches, RCSA, KRIs, model validation, three lines roles and CPS 230.
Core rules and concepts
- Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or external events. It includes legal risk but not strategic or reputational risk as separate categories.
- Basel approaches: Basic Indicator Approach uses 15% of average positive gross income over three years; the Standardised Approach applies business-line betas; the Advanced Measurement Approach was replaced by the Standardised Measurement Approach, which multiplies a business indicator component by an internal loss multiplier.
- RCSA identifies risks and controls, assesses inherent and residual risk, and assigns control owners. KRIs provide early warning; loss data and scenario analysis feed capital and control decisions.
- Model risk is the risk of adverse consequences from incorrect or misused models. Governance includes a model inventory, tiering, independent validation, backtesting, change control and board reporting; the US SR 11-7 guidance is a common reference.
- Enterprise risk management aggregates risks, considers correlations and concentrations, and links risk to strategy and capital. APRA CPS 230 sets operational risk management expectations for regulated entities.
Worked example
A bank has average positive gross income of $200 million over three years. Under the Basic Indicator Approach, operational risk capital is 15% x $200m = $30 million. If a negative-gross-income year is excluded from the average, the calculation uses only the positive years. The reasoning is that the BIA is a proxy, not a precise measure; it ignores loss history and control quality, which is why larger banks move to more sensitive approaches. A model risk review would ask whether the gross income figure is defined consistently and whether the capital number is used alongside scenario and loss data.
Traps that cost marks
- Equating operational risk with fraud only; processes, systems, people and external events all count.
- Forgetting that the AMA is no longer available under the Basel III final reforms.
- Treating model risk as only quantitative models; scorecards, spreadsheets and vendor models are also in scope.
- Assuming the three lines model means three departments; it means three roles with independent assurance.
- Aggregating risks by simple addition while ignoring correlation, concentration and tail dependence.