HKIB ECF-Operational Risk Core flashcards
HKIB ECF-Operational Risk Core · Build recall with a focused review session.
33 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Operational risk definition
- The risk of loss from inadequate or failed internal processes, people and systems, or external events. It includes legal risk but excludes strategic and reputational risk under the Basel definition.
- Seven loss event types
- Basel categories: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management.
- Internal fraud
- Losses due to acts by at least one internal party involving theft, fraud, misappropriation, circumvention of regulations or company policy, excluding diversity and discrimination events.
- External fraud
- Losses from acts by third parties involving theft, fraud, misappropriation, or circumvention of the law, such as card skimming, cheque fraud, hacking or robbery.
- Employment practices losses
- Losses arising from acts inconsistent with employment, health or safety laws or agreements, from personal injury claims, or from diversity and discrimination events.
- Clients and business practices
- Losses from unintentional or negligent failure to meet professional obligations to clients, or from the nature or design of a product, including fiduciary breaches and market manipulation.
- Damage to physical assets
- Losses from loss or damage to physical assets from natural disasters or other events such as earthquakes, fire, flood, vandalism or terrorism.
- Business disruption and system failures
- Losses from disruption of business or system failures, including hardware and software failures, telecommunications outages and utility supply interruptions.
- Execution and process management
- Losses from failed transaction processing or process management, and from relations with trade counterparties and vendors, including data entry errors and missed deadlines.
- Three lines model
- First line business units own and manage risk; second line risk and compliance set the framework and challenge; third line internal audit gives independent assurance to the board.
- Inherent versus residual risk
- Inherent risk is the exposure before controls are applied; residual risk is what remains after control effectiveness is assessed. Residual risk is compared against appetite.
- Risk control self-assessment
- A structured exercise where business units identify risks, rate likelihood and impact, assess control effectiveness and record residual risk and remediation actions in the risk register.
- Key risk indicator
- A forward-looking metric linked to a specific risk, with green, amber and red thresholds. A red breach triggers escalation, root-cause analysis and tracked remediation.
- Risk appetite statement
- The board-approved level of aggregate operational risk the firm is willing to accept, cascaded into tolerances per risk type and business line and monitored against actuals.
- Risk register
- A live inventory of identified risks, each with owner, cause, potential impact, existing controls, residual rating, linked KRIs and action plans with target dates.
- Preventive versus detective control
- Preventive controls stop an event before it occurs, such as access restrictions or segregation of duties. Detective controls identify events after they occur, such as reconciliations and exception reports.
- Segregation of duties
- A control ensuring no single person can initiate, approve, record and reconcile the same transaction, reducing fraud and error risk; compensating controls apply where full segregation is impractical.
- Four-eyes principle
- A preventive control requiring a second authorised person to review and approve an action or transaction before it is executed, reducing error and unauthorised activity.
- Loss data collection threshold
- The minimum loss amount above which incidents are captured in the internal loss database; smaller events may be aggregated separately for trend and control analysis.
- External loss data
- Loss events from other institutions, drawn from consortium or public databases, used to benchmark internal experience and to inform scenario analysis and tail-risk estimates.
- Scenario analysis
- A structured process where experts assess plausible severe events, estimate frequency and severity, and test whether controls and capital would withstand the impact.
- Business impact analysis
- A study identifying critical business processes, their dependencies and the maximum tolerable outage, producing recovery time objectives and recovery point objectives for continuity planning.
- Recovery time objective
- The maximum acceptable time to restore a process or system after disruption. It drives continuity strategy selection and is validated through periodic testing.
- Recovery point objective
- The maximum acceptable amount of data loss, expressed as time, after a disruption. It determines backup frequency and replication design.
- Basic Indicator Approach
- A Basel capital method applying a fixed 15 percent factor to average annual gross income over the previous three years, with zero-income years excluded from the average.
- Standardised Approach
- A Basel capital method dividing activities into eight business lines, each with a beta factor applied to gross income, then summing the resulting capital charges.
- Advanced Measurement Approach
- A Basel internal-model method where a bank estimates operational risk capital from loss data, scenarios, business environment and internal control factors, subject to supervisory approval.
- Change management control
- A process requiring impact assessment, testing, approval and rollback planning before system or process changes, addressing a common cause of disruption and processing losses.
- Third-party risk management
- Due diligence before onboarding, contractual service levels and audit rights, ongoing performance monitoring, and exit or concentration planning for critical outsourced providers.
- New product approval
- A pre-launch gate assessing operational risk, control adequacy, system capacity, regulatory permissions and client suitability, with sign-off from risk, compliance and operations.
- Near miss
- An event that did not cause loss but could have. Near misses are logged with root cause and remediation to prevent recurrence and to strengthen leading indicators.
- Operational risk dashboard
- A periodic report showing losses against appetite, KRI status, top risks, control-testing results and open issues, used by management and the board risk committee.
- Whistleblowing channel
- A confidential route for staff to report misconduct or control breaches without retaliation, supporting early detection of fraud and conduct failures.