HKIB ECF-Operational Risk Core cheat sheet
HKIB ECF-Operational Risk Core · Keep the key ideas within reach.
Operational Risk Management - Core Reference
Operational risk definition (Basel II): risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events; includes legal risk but excludes strategic and reputational risk.
Basel II loss event types (7): internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management.
Three lines model: first line (business units) owns and manages risk; second line (risk and compliance) sets framework, monitors and challenges; third line (internal audit) provides independent assurance to the board.
Risk control self-assessment (RCSA): business units identify risks, rate inherent risk (likelihood x impact), assess control effectiveness, and derive residual risk; outputs feed the risk register and action plans.
Key risk indicators (KRIs): forward-looking metrics with defined thresholds (green/amber/red); a KRI breaching red triggers escalation, root-cause analysis and remediation tracking.
Risk appetite: board-approved statement of the aggregate operational risk the firm accepts; cascades into tolerances per risk type and business line, and is monitored against actual loss and KRI data.
Loss data management: internal loss data captured above a collection threshold; external data (consortium/public databases) and scenario analysis supplement internal data for tail events and capital modelling.
Capital approaches under Basel II: Basic Indicator Approach (average gross income x 15%), Standardised Approach (business-line beta factors), Advanced Measurement Approach (internal models, supervisory approval).
Business continuity essentials: business impact analysis identifies critical processes and recovery time objectives (RTO); recovery point objective (RPO) sets tolerable data loss; plans are tested and refreshed periodically.
Operational Risk Management - Governance, Controls and Reporting
Three-lines escalation: an incident exceeding defined thresholds (financial, regulatory, reputational) must be reported by the first line to the second line and, where material, to the board risk committee and regulators.
Control types: preventive (stop an event before it occurs, e.g., segregation of duties, access controls) versus detective (identify after occurrence, e.g., reconciliation, exception reports); both map to specific risks in the register.
Segregation of duties: no single person should initiate, approve, record and reconcile the same transaction; compensating controls are required where staffing prevents full segregation.
Change management control: system and process changes require impact assessment, testing, approval and rollback plans; failed change is a recurring driver of business disruption and process-management losses.
Outsourcing and third-party risk: due diligence before onboarding, contractual service levels and audit rights, ongoing performance monitoring, and exit/concentration planning for critical providers.
New product approval (NPPA): before launch, assess operational risk, controls, systems capacity, regulatory permissions and client suitability; sign-off by risk, compliance and operations.
Incident and near-miss capture: record date, event type, root cause, impact (financial, regulatory, client), control failure and remediation owner; near misses are logged to prevent recurrence.
Reporting: operational risk dashboards present losses vs. appetite, KRI status, top risks, open issues and control-testing results; data quality and completeness of loss capture are themselves monitored.
Conduct and culture: whistleblowing channels, conflicts-of-interest registers, remuneration linked to risk outcomes, and tone-from-the-top are assessed as drivers of operational risk behaviour.