Operational risk management tools, controls and mitigation
Operational risk management tools, controls and mitigation
This domain tests the control vocabulary and the practical design of controls that avoid, reduce, transfer or accept operational risk.
Control classifications
- Preventive controls stop the event: maker-checker, four-eyes principle, segregation of duties, access restriction, authorisation limits, dual custody, staff screening and training.
- Detective controls find the event after it occurs: reconciliation, exception reports, surprise cash counts, concurrent audit, KRI breach alerts.
- Corrective controls contain and recover: incident management, insurance claims, customer redress.
Mitigation options
Risk can be avoided (exit the activity), reduced (controls), transferred (insurance, outsourcing) or accepted (within appetite, with monitoring). Insurance is a loss mitigant, not a control: it pays after the event and never prevents recurrence, and its recognition in capital calculations is limited. Outsourcing transfers the activity, never the accountability.
Governance and tooling
Business lines own their risks (first line); risk and compliance oversee (second line); internal audit gives independent assurance (third line). Controls sit in a risk and control matrix, are tested on a stated cycle, and results update the risk register and heat map.
Worked example
Outward cheque clearing: a maker captures the instrument, a checker verifies it against the physical cheque, and a separate reconciliation team matches the clearing-house file with the general ledger. Maker-checker is preventive; reconciliation is detective. Testing finds the checker routinely approves without viewing images, so control effectiveness drops and residual risk rises. The right fix is a system rule blocking approval without image viewing, which is a preventive design change, not more training.
Traps
- Calling insurance a preventive control.
- Assuming outsourcing discharges the bank's regulatory responsibility.
- Treating a detective control as though it prevents loss.
- Claiming a control is effective without documented testing evidence.
- Adding controls without checking whether they create new operational risk or delay.