IIBF Operational Risk Management flashcards
IIBF Operational Risk Management · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Basel II operational risk definition
- The risk of loss from inadequate or failed internal processes, people, systems, or external events; includes legal risk but excludes strategic and reputational risk.
- Basic Indicator Approach
- Operational risk capital = 15% of average annual gross income over the previous three years (positive years only).
- Standardised Approach beta factors
- Capital = sum of beta × gross income per business line; betas range from 12% to 18% depending on the line.
- Seven operational risk event types
- Internal fraud; external fraud; employment practices; clients/products/business practices; damage to physical assets; business disruption; execution/delivery/process management.
- Legal risk inclusion
- Legal risk is included in the Basel definition of operational risk, covering losses from legal proceedings or regulatory actions.
- Risk and Control Self-Assessment
- A workshop-based tool where process owners identify risks, assess inherent and residual risk, and evaluate control effectiveness.
- Key Risk Indicator
- A forward-looking metric with green, amber, and red thresholds that signals increasing risk exposure and triggers management action.
- Loss distribution approach
- An AMA method that models frequency and severity distributions to estimate operational risk capital at 99.9% confidence over one year.
- Scenario analysis
- Expert judgement used to estimate the frequency and severity of plausible severe events, feeding capital models and risk assessments.
- Risk heat map
- A visual tool plotting likelihood against impact to prioritise risks; high-likelihood/high-impact risks need immediate mitigation.
- Four T's of risk treatment
- Tolerate, Treat (mitigate), Transfer, and Terminate (avoid) are the four ways to respond to identified risks.
- Segregation of duties
- A preventive control ensuring no single person controls all stages of a transaction: initiation, authorisation, recording, and reconciliation.
- Insurance mitigation cap
- Under Basel, insurance can reduce operational risk capital by at most 20% of the total operational risk capital charge.
- Preventive vs detective controls
- Preventive controls stop events before they occur (e.g., access controls); detective controls identify events after they occur (e.g., reconciliations).
- Fraud triangle
- Three conditions that lead to fraud: pressure (incentive), opportunity, and rationalisation.
- Central Fraud Registry
- RBI-maintained database of fraud information shared among banks; banks must check it before sanctioning loans.
- Fraud reporting timeline
- As per RBI's 2024 directions, frauds above ₹1 lakh must be reported to RBI within 14 days of detection.
- Teeming and lading
- A fraud scheme where cash received from one customer is misappropriated and later covered using receipts from another customer.
- CIA triad
- Confidentiality, Integrity, and Availability are the three core principles of information security.
- Two-factor authentication
- A security process requiring two different authentication factors; mandatory in India for card-not-present and internet banking transactions.
- RBI Cyber Security Framework
- RBI's 2016 framework mandating a board-approved cyber security policy, a Security Operations Centre, and incident response plans for banks.
- Phishing
- A cyber attack using deceptive emails or messages to trick users into revealing sensitive information such as passwords or card details.
- CERT-In reporting timeline
- Specified cyber security incidents must be reported to CERT-In within 6 hours of detection, as per Indian regulations.
- Recovery Time Objective
- The maximum acceptable downtime for a business process or system after a disruption, defined in the business continuity plan.
- Recovery Point Objective
- The maximum acceptable amount of data loss measured in time, determining backup frequency in disaster recovery planning.
- Material outsourcing
- Outsourcing of critical activities that requires board approval, due diligence, contractual safeguards, and a contingency plan under RBI guidelines.
- Three lines of defence
- First line (business) owns risk; second line (risk and compliance) monitors; third line (internal audit) provides independent assurance.
- Compliance risk
- The risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws and regulations.
- People risk
- Risk arising from key person dependency, inadequate training, high attrition, or employee misconduct within an organisation.
- Business impact analysis
- A BCM process that identifies critical business functions and quantifies the impact of their disruption over time.
- Whistleblower policy
- A mechanism allowing employees to report unethical or fraudulent behaviour confidentially without fear of retaliation.
- Residual risk
- The level of risk remaining after controls and mitigation measures have been applied; should be within the bank's risk appetite.