IIBF Operational Risk Management common mistakes
IIBF Operational Risk Management · Understand the traps and how to avoid them.
Treating operational risk as synonymous with 'other risks' or as a residual category, so questions asking which event type or risk class a scenario belongs to are answered by elimination rather than by definition.
Candidates memorise the phrase 'risk of loss resulting from inadequate or failed internal processes, people and systems or from external events' without unpacking its four causes, so they cannot map a scenario to a cause and default to 'it is not credit or market risk, therefore operational risk' reasoning that fails on classification items.
What to do instead
Before answering any classification question, write the four causes (processes, people, systems, external events) and the inclusion of legal risk but exclusion of strategic and reputational risk. Then force the scenario into exactly one cause and check whether the exam's framing treats legal risk as included. Practise with 20 short scenarios and justify the cause in one line each.
Confusing the three Basel event-type boundaries that sit closest together: execution/delivery/process management versus clients/products/business practices versus external fraud, especially for mis-selling, rogue trading and vendor disputes.
The event-type taxonomy is learned as a list of seven labels rather than as decision rules, and several real events plausibly fit two categories (a mis-sold product involves both a process failure and a business-practice failure), so candidates pick the label that sounds most dramatic.
What to do instead
Build a one-page boundary sheet with the discriminating question for each pair: was the loss driven by a failed transaction/process step, by an intentional act against a client or market, by an internal person's dishonesty, or by a third party's dishonesty? Memorise the standard placement of mis-selling, market manipulation, rogue trading, theft by employees, and system downtime.
Computing operational risk capital or expected loss using the wrong inputs, for example applying the basic indicator approach to a single business line, or using gross income where the question supplies average positive gross income over three years.
Candidates learn the approaches by name and headline formula but not the eligibility conditions, the treatment of negative gross income years, or which business line indicator applies under the standardised approach, so they substitute whichever figure appears first in the stem.
What to do instead
Write out each approach with its eligibility test and exact formula, including how negative gross income years are excluded and how the three-year average is formed. Then solve five numerical items showing every intermediate line, and check the units and period before selecting an answer.
Choosing a control type by its label rather than by where it sits in the process, so a detective control is selected when the question asks for a preventive one, or a compensating control is described as primary.
Candidates memorise control names (reconciliation, maker-checker, segregation of duties) without classifying each as preventive, detective or corrective, and without noting that the same control can be preventive in one process and detective in another.
What to do instead
For each control on the syllabus, state its timing (before, during, after the event), its nature (manual or automated) and whether it is primary or compensating. Answer control-design questions by first identifying the risk event and its timing, then selecting the control that acts before it.
Treating key risk indicators as if they were key performance indicators, or accepting a KRI without a threshold, owner or escalation path, when the question asks what makes a KRI effective.
The terms look similar and revision notes often list example indicators without the design attributes, so candidates select a metric that measures business volume rather than risk exposure, or accept a lagging loss figure as a leading indicator.
What to do instead
Memorise the design test for a KRI: it must be measurable, forward-looking where possible, linked to a specific risk, and paired with a tolerance threshold and an escalation trigger. Reject options that are pure volume or profit metrics, and reject indicators with no threshold or owner.
Answering fraud-control questions with detection measures when the stem asks for prevention, or missing that segregation of duties and maker-checker are the primary preventive controls against internal fraud while reconciliation and surprise checks are detective.
Fraud is studied as a list of schemes (teeming and lading, kiting, ghost employees, evergreening) rather than as a control problem, so candidates match the scheme to any control that mentions it instead of matching the control to the stage of the fraud.
What to do instead
For each major fraud scheme, write the specific preventive control, the detective control and the red flag. Learn the preventive core: segregation of duties, dual authorisation, access restriction, mandatory leave and rotation, and vendor/customer due diligence. Then answer by matching the stage named in the stem.
Confusing the roles in the three lines model, for example naming internal audit as the owner of a control or the risk function as the first line, when the question asks who owns or monitors a given risk.
Candidates learn the model as a diagram with three boxes but not the accountability rule that the business owns the risk and the control, while risk and compliance provide oversight and internal audit provides independent assurance.
What to do instead
State the ownership rule explicitly: first line owns and operates controls, second line sets frameworks and challenges, third line gives independent assurance. For any 'who is responsible' item, ask whether the activity is operating, overseeing or assuring, and select accordingly.
Mixing up cyber-related concepts such as vulnerability, threat and risk, or confusing incident response stages with business continuity stages, when the question asks which activity a described step represents.
Cyber and continuity content is learned as overlapping lists of terms, and the distinctions (a vulnerability is a weakness, a threat is an actor or event, risk combines likelihood and impact) are not rehearsed, so candidates choose the most technical-sounding option.
What to do instead
Write one-line definitions for threat, vulnerability, likelihood, impact and risk, and test each against a short scenario. Separately memorise the continuity sequence (business impact analysis, recovery objectives, strategy, plan, testing) and the incident response sequence, and never substitute one sequence for the other.
Treating recovery time objective and recovery point objective as interchangeable, or accepting an outsourcing arrangement where the service provider's continuity plan is not tested or the bank has no exit strategy.
The two objectives are both expressed in time and are often revised together, and outsourcing is studied as a procurement process rather than as a risk-retention decision, so candidates miss that accountability cannot be outsourced.
What to do instead
Fix the definitions: recovery time is how long until the service is restored, recovery point is how much data loss is tolerable. For outsourcing, memorise the non-negotiables: due diligence, contractual service levels, audit and access rights, tested continuity arrangements, regulatory notification where required, and a documented exit plan.
Answering people and compliance questions with the wrong escalation or governance body, for example assigning disciplinary action to the risk committee or treating a whistleblower report as a line-management matter.
Governance structures are learned as names on an organogram without their decision rights, and compliance is reduced to 'follow the rules' rather than a framework of identification, assessment, monitoring, reporting and training, so candidates pick whichever committee sounds senior.
What to do instead
Build a table of each committee and role with its decision rights, reporting line and escalation trigger, and learn the compliance cycle as a sequence. For whistleblowing items, remember the independence requirement and protection of the reporter. Answer by matching the decision to the body that holds that authority.