I85PREP
⌘ K
IIBF Operational Risk Management study materials
IIBF Operational Risk Management study resources

IIBF Operational Risk Management: Operational risk identification, assessment and measurement

IIBF Operational Risk Management · Work through your exam, one topic at a time.

All guide sections

Operational risk identification, assessment and measurement

Operational risk identification, assessment and measurement

This domain tests how a bank finds its operational risks, scores them consistently, and turns the output into capital and management information.

Identification toolkit

  • Process mapping and flow-charting, explicitly covering hand-offs and system interfaces.
  • Risk and Control Self-Assessment (RCSA) workshops owned by business managers.
  • Internal loss data, near-miss data and external loss databases.
  • Key Risk Indicators (KRIs) with defined thresholds and escalation triggers.
  • Scenario analysis for low-frequency, high-severity events.
  • Checklists, bow-tie analysis, and change-risk review before new products or systems go live.

Assessment

Risk is scored on likelihood and impact, typically on 1 to 5 scales, and plotted on a heat map. It is assessed inherent (before controls) and residual (after controls). Residual risk is compared against the approved risk appetite and any excess is escalated to the Risk Management Committee of the Board.

Measurement

Measurement combines the regulatory capital approach (BIA or TSA) with internal metrics: loss frequency and severity, expected loss, KRI trends, and scenario-derived capital add-ons. Internal loss data must be complete above a set collection threshold; external data must be scaled for bank size and business mix before use.

Worked example

Cash handling at a busy branch: inherent likelihood 3, impact 4, score 12 (high). Controls are dual custody of cash, daily surprise checks and independent reconciliation. Control testing shows only partial effectiveness, so residual likelihood falls to 2 while impact stays 4, giving residual score 8 (medium). The branch appetite is medium or below, so the risk is accepted but tracked through a KRI on cash differences above ₹10,000.

Traps

  • Ignoring near misses; they are free lessons and must be captured.
  • Reporting only residual scores and losing visibility of inherent exposure.
  • Choosing KRIs that measure the past (losses) instead of forward-looking drivers.
  • Using external loss data without scaling for size and business mix.
  • Letting the risk function score risks alone, without business ownership.