IIBF Operational Risk Management cheat sheet

Basel II definition: operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events; it includes legal risk but excludes strategic and reputational risk.

Basel II outlines seven event types: internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, and execution/delivery/process management.

The three Basel II approaches for operational risk capital are the Basic Indicator Approach (BIA), the Standardised Approach (TSA), and Advanced Measurement Approaches (AMA).

BIA capital charge = 15% of the average annual gross income over the previous three years (positive income years only).

Under TSA, capital = sum over eight business lines of (beta × gross income); beta values are 18% for corporate finance, trading & sales, and payment & settlement; 15% for commercial banking and agency services; 12% for retail banking and asset management; and 15% for retail brokerage.

AMA allows banks to use internal models, subject to supervisory approval, with a one-year holding period for operational risk data and a 99.9% confidence level over a one-year horizon.

The Basel Committee's Principles for the Sound Management of Operational Risk (2011, revised 2021) set out eleven principles covering governance, risk management environment, and disclosure.

In India, RBI's Guidance Note on Operational Risk (2005) and the Master Circular on Basel III Capital Regulations require banks to maintain operational risk management frameworks and allocate capital under the prescribed approaches.

Legal risk is included in operational risk, but strategic risk and reputational risk are excluded from the regulatory definition; reputational risk is however a key consideration in supervisory reviews.

Common identification tools include risk and control self-assessments (RCSA), process mapping, loss data collection, scenario analysis, key risk indicators (KRIs), and internal/external audit findings.

RCSA workshops typically score inherent risk and residual risk on likelihood and impact scales; residual risk = inherent risk minus effectiveness of controls.

Loss data is collected with a minimum threshold (often ₹1 lakh or equivalent) and classified by Basel event type, business line, and causal factor.

Key risk indicators (KRIs) should be measurable, forward-looking, and linked to specific risks; thresholds are set at green (normal), amber (warning), and red (breach) levels.

Scenario analysis involves expert judgement to estimate the frequency and severity of plausible but severe events; it feeds into capital modelling under AMA.

The risk heat map plots likelihood against impact to prioritise risks; risks in the high-likelihood/high-impact quadrant require immediate mitigation.

Operational risk capital under AMA is typically calculated as the sum of expected loss and unexpected loss, or via loss distribution approach (LDA) using frequency and severity distributions.

External loss databases (e.g., ORX) supplement internal data, especially for low-frequency, high-severity events.

Risk appetite for operational risk is expressed through tolerance limits, such as maximum acceptable loss per event, number of KRIs in red, or percentage of residual high risks.

The four T's of risk treatment are Tolerate, Treat (mitigate), Transfer, and Terminate (avoid).

Preventive controls aim to stop an event from occurring (e.g., segregation of duties, access controls); detective controls identify events after they occur (e.g., reconciliations, audits); corrective controls reduce impact after detection.

Segregation of duties ensures that no single person controls all stages of a transaction: initiation, authorisation, recording, and reconciliation.

Four-eyes principle requires a second authorised person to review and approve a transaction or action above a defined threshold.

Insurance is a common risk transfer tool, but under Basel it can only reduce capital by a maximum of 20% of the operational risk capital charge, subject to conditions.

Business process re-engineering, automation, and straight-through processing reduce manual errors and are preventive controls.

Control self-assessment results should be linked to the risk register, with action plans assigned to owners and tracked to closure.

The control environment is tested through internal audit, compliance reviews, and quality assurance; findings are rated by severity and tracked for remediation.

Risk mitigation must be documented, and residual risk after mitigation should be within the bank's risk appetite.

Fraud risk is the risk of loss from intentional deception by internal or external parties; it is a subset of operational risk.

Common internal fraud schemes include misappropriation of assets, teeming and lading, unauthorised lending, and manipulation of accounts; external fraud includes phishing, card skimming, and cheque fraud.

The fraud triangle explains fraud through three elements: pressure (incentive), opportunity, and rationalisation.

Preventive vigilance includes employee screening, rotation of duties, mandatory leave, surprise checks, and whistleblower mechanisms.

In India, RBI's guidelines on fraud risk management (2024) require banks to have a board-approved fraud risk management policy, a dedicated fraud monitoring function, and timely reporting to the Central Fraud Registry (CFR).

Frauds above ₹1 lakh must be reported to RBI within 14 days of detection (as per RBI's 2024 directions), and to the board/audit committee.

The Central Fraud Registry (CFR) is maintained by RBI for sharing fraud information among banks; banks must check the CFR before sanctioning loans.

Red flags for fraud include unusual transactions, lifestyle changes, refusal to take leave, and override of controls.

Internal controls such as maker-checker, reconciliation, and audit trails are key deterrents to fraud.

IT risk includes risks from system failures, data breaches, cyber attacks, inadequate change management, and third-party dependencies.

The CIA triad (Confidentiality, Integrity, Availability) is the core model for information security.

RBI's Cyber Security Framework (2016) mandates banks to have a board-approved cyber security policy, a Security Operations Centre (SOC), and incident response plans.

Phishing, vishing, smishing, ransomware, and distributed denial-of-service (DDoS) attacks are common cyber threats.

Two-factor authentication (2FA) is mandatory for card-not-present transactions and for internet banking in India.

Digital banking risks include unauthorised access, man-in-the-middle attacks, mobile malware, and API vulnerabilities.

Data protection laws (e.g., India's Digital Personal Data Protection Act, 2023) impose obligations on data fiduciaries to protect personal data and report breaches.

Incident response requires timely detection, containment, eradication, recovery, and reporting to regulators (e.g., CERT-In within 6 hours for specified incidents).

Business continuity and disaster recovery plans must cover IT systems, with recovery time objectives (RTO) and recovery point objectives (RPO) defined.

Business continuity management (BCM) aims to ensure critical operations continue during disruptions; it includes business impact analysis (BIA), recovery strategies, and testing.

Recovery time objective (RTO) is the maximum acceptable downtime; recovery point objective (RPO) is the maximum acceptable data loss measured in time.

Outsourcing risk arises when a bank relies on third parties for critical activities; RBI's guidelines require due diligence, contractual safeguards, and a contingency plan.

Material outsourcing arrangements require approval of the board or a committee, and the bank remains responsible for regulatory compliance.

People risk includes key person dependency, inadequate training, high attrition, and employee misconduct.

Compliance risk is the risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws and regulations.

The three lines of defence model: first line (business) owns risk; second line (risk and compliance) monitors; third line (internal audit) provides independent assurance.

Whistleblower policies and ethics codes are key controls for people and compliance risk.

Regular BCP testing (at least annually) and updating based on lessons learned are essential.