IIBF Operational Risk Management study guide
IIBF Operational Risk Management · Work through your exam, one topic at a time.
The IIBF Certificate Examination in Operational Risk Management is a professional certification offered by the Indian Institute of Banking & Finance, a body established in 1928 whose stated vision is "To be the premier Institute for developing and nurturing competent professionals in banking and finance field." The credential is aimed at bankers, risk officers, auditors, compliance staff and finance professionals who need a structured grounding in non-financial risk rather than credit or market risk. Because operational risk cuts across every branch, process and system, the syllabus typically spans the definition and regulatory context of operational risk; identification, assessment and measurement including loss data and risk-and-control self-assessment; controls, mitigation and insurance; fraud risk and preventive vigilance; IT, cyber and digital banking exposures; and business continuity, outsourcing, people and compliance risk. The IIBF Operational Risk Management study guide has 6 sections and about 2,204 words.
01Operational risk: definition, scope and regulatory context
This domain tests the Basel definition of operational risk, exactly what it includes and excludes, the Indian regulatory expectations built on it, and the capital framework banks apply. Basel II (2004) defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.
381 words, about 2 min02Operational risk identification, assessment and measurement
This domain tests how a bank finds its operational risks, scores them consistently, and turns the output into capital and management information. Process mapping and flow-charting, explicitly covering hand-offs and system interfaces.
375 words, about 2 min03Operational risk management tools, controls and mitigation
This domain tests the control vocabulary and the practical design of controls that avoid, reduce, transfer or accept operational risk. Preventive controls stop the event: maker-checker, four-eyes principle, segregation of duties, access restriction, authorisation limits, dual custody, staff screening and training.
355 words, about 2 min04Fraud risk, preventive vigilance and internal controls
This domain tests fraud classification and reporting, the vigilance machinery in Indian banks, and the internal controls that stop fraud before money leaves the bank. RBI's fraud directions require a board-approved fraud risk management policy, board-level oversight of frauds, and reporting of frauds to RBI through the prescribed channel.
359 words, about 2 min05Information technology, cyber security and digital banking risks
This domain tests RBI's IT governance and cyber security expectations and the risk profile of digital channels and cards. RBI's Master Direction on IT Governance, Risk, Controls and Assurance Practices requires board-approved IT and information security policies, a documented IT risk assessment, segregation between IT operations and IT security, change and patch management, privileged access management, backup and restoration testing, and independent IT audit.
365 words, about 2 min06Business continuity, outsourcing, people and compliance risk
This domain tests resilience planning, third-party risk, and the human and compliance dimensions of operational risk. The Business Impact Analysis identifies critical processes, dependencies and maximum tolerable downtime.
369 words, about 2 min