Failed-Trade KRI Breach and the RCSA Rating Dispute
A Hong Kong retail bank's securities operations unit completed its Q3 RCSA with a self-assessed residual rating of Medium for 'trade processing and settlement'. In the last three weeks of the quarter, 3 of 40 matched-trade breaks remained unresolved beyond the two-day target, and the unit's failed-trade KRI moved from 0.8% to 2.6% against an amber threshold of 2.0%. The root cause was a settlement-platform release that went live without a change risk assessment; one experienced processor was also on leave. Quarterly losses were nil, but two near misses were logged. First line argues the spike is a one-off and wants to retain Medium so the unit stays outside heightened monitoring. Second line's operational risk manager believes High is warranted. The quarterly operational risk report to the Board Risk Committee is due in nine working days, and the platform release control gap has not yet been entered in the issue register.
1. How should the operational risk function test first line's 'one-off' claim, and what evidence would you require before deciding whether to re-rate residual risk to High?
Read the worked answer
Treat 'one-off' as a hypothesis to test, not an explanation. The decisive fact is the root cause: a production release went live without change risk assessment. That is a control design failure, so recurrence depends on how many releases bypass the control, not on luck. Evidence to require:
- the incident timeline and root-cause analysis, including whether the three breaks share a system or counterparty pattern;
- a sample of 20 releases from the last 12 months tested for completed change risk assessment, UAT sign-off and rollback plans;
- KRI history for 8–12 quarters to separate trend from spike;
- the two near misses, since they may show the control failing before the breach;
- evidence of compensating controls and whether staff on leave really mattered.
If the sample shows more than one unassessed release, the residual rating is High regardless of zero losses. Nil loss can reflect detection and recovery, not low risk. Re-rate to High on an interim basis, then confirm or downgrade with a documented rationale and a remediation date.
2. Who should own the decision to accept or reject the High residual rating, and what should the Board Risk Committee see?
Read the worked answer
First line owns the risk and remediation, but it cannot unilaterally set a residual rating when second line has identified a control gap. The decision rights should be: business unit proposes; operational risk challenges and records the disagreement; CRO or risk committee accepts High residual risk under delegated authority. The unit's wish to stay outside heightened monitoring is an incentive to under-report and should be escalated as a risk-culture point, not treated as a valid argument.
Because the Board Risk Committee report is due in nine working days, OR should escalate within five working days, with both positions and the evidence. The Board should see: the failed-trade KRI over 8–12 quarters; the 3 of 40 breaks and their ageing; the change-management control gap; the results of the release sample; near-miss history; the proposed remediation, owner and date; the accepted residual risk and who accepted it; and whether the risk appetite threshold for failed trades was breached. The issue register entry should be made immediately, not after the report, so the gap is not lost.
3. What weaknesses in KRI design does this event expose, and how should the indicator set be changed?
Read the worked answer
The KRI is lagging and too narrow. It measures unresolved breaks at one point and only in one unit, so it gave no warning that a release had bypassed change risk assessment. Improvements:
- Add a leading indicator - percentage of production releases with completed change risk assessment and UAT sign-off, target 100%, amber below 98%.
- Segment the failed-trade KRI by platform, counterparty and processing team, so a system-driven cluster is visible.
- Measure ageing (breaks over two days) rather than only the rate.
- Set thresholds from the bank's risk appetite and historical volatility, not round numbers, and review after each platform change.
- Pair each KRI with an owner and a defined action on breach.
- Include a near-miss count, since near misses preceded the breach.
Also assess whether the KRI is reported at the right level - a unit-level indicator that never reaches the operational risk committee is a design failure. Avoid adding many indicators; three or four well-chosen ones with clear escalation are better than a dashboard nobody acts on.