IIBF Operational Risk Management study plan
IIBF Operational Risk Management · Give each week a clear focus.
8 weeks · About 6 hours per week
Operational risk: definition, scope and regulatory context
Define operational risk using the Basel definition and distinguish it from credit and market risk with three original examples each
Map the four Basel event-type categories to at least two concrete bank scenarios per category
Explain the three Basel approaches (BIA, TSA, AMA) and state which Indian banks typically fall under each
Summarise the RBI guidance on operational risk management and capital charge in your own words
Your checkpoint
One-page definition-and-scope sheet: Basel definition, boundary tests versus credit/market risk, event-type table with 8 scenarios, and a 150-word note on the regulatory basis for operational risk capital in India
Operational risk identification, assessment and measurement
Apply at least four identification techniques (process mapping, RCSA workshops, loss-data review, scenario analysis) to a single bank process
Build a 5x5 risk heat map and place eight identified risks on it using likelihood and impact scores
Distinguish inherent risk, residual risk, expected loss and unexpected loss with worked numbers
Compute a simple economic-capital figure for one risk using a given loss distribution assumption
Your checkpoint
Completed RCSA worksheet for one process (e.g., outward remittances) with 10 risks, inherent and residual scores, control references, and a plotted heat map
Operational risk identification, assessment and measurement
Explain the purpose and structure of an operational risk loss database and the Basel minimum thresholds for including losses
Classify ten sample loss events by event type, business line and causal factor
Describe key risk indicators and draft five KRIs with thresholds and escalation triggers
Compare qualitative and quantitative measurement approaches and state when each is appropriate
Your checkpoint
Loss-event classification log of 10 events plus a KRI dashboard template with five indicators, green/amber/red thresholds and named owners
Operational risk management tools, controls and mitigation
Distinguish preventive, detective and corrective controls and assign each of 12 controls to the correct category
Design a control-testing plan specifying sample size, testing method and evidence for three key controls
Explain insurance, collateral, outsourcing and hedging as mitigation tools and state the limits of each under Basel
Draft a control self-assessment questionnaire for a branch cash-handling process
Your checkpoint
Control library extract of 12 controls with type, owner, test procedure and residual-risk effect, plus a 10-question control self-assessment for cash handling
Fraud risk, preventive vigilance and internal controls
Differentiate fraud types relevant to banks (internal, external, card, loan, cyber-enabled) with one real-world pattern each
Outline the red flags of a fraudulent loan application and a fictitious-account scheme
Describe preventive vigilance measures including segregation of duties, maker-checker, job rotation and whistle-blower channels
Explain the role of the fraud monitoring function, reporting to the board and fraud risk assessment
Your checkpoint
Fraud typology chart covering 8 fraud schemes, each with red flags, preventive control and detective control, plus a 200-word note on preventive vigilance in branch operations
Information technology, cyber security and digital banking risks
Map the main cyber threats facing banks (phishing, ransomware, account takeover, third-party compromise) to the controls that counter them
Explain RBI cyber security framework expectations for governance, incident response and cyber drills
Describe digital banking risks including mobile-channel fraud, API exposure and outsourcing of cloud services
Outline the data-protection and incident-reporting obligations a bank must meet after a breach
Your checkpoint
Cyber risk register of 10 threats with likelihood, impact, control and incident-response step, plus a one-page incident-response runbook for a suspected account-takeover event
Business continuity, outsourcing, people and compliance risk
Draft a business impact analysis for one critical function, identifying RTO, RPO and dependencies
Explain outsourcing risk including due diligence, contract clauses, exit strategy and concentration risk
Describe people risk drivers (key-person dependency, attrition, incentive misalignment) and compliance risk sources
Summarise the Three Lines of Defence model and assign responsibilities for each line
Your checkpoint
Business impact analysis table for two critical functions with RTO/RPO, plus a one-page outsourcing due-diligence checklist and a Three Lines of Defence responsibility matrix
Operational risk: definition, scope and regulatory context & Operational risk identification, assessment and measurement & Operational risk management tools, controls and mitigation & Fraud risk, preventive vigilance and internal controls & Information technology, cyber security and digital banking risks & Business continuity, outsourcing, people and compliance risk
Revise all six domains using your own notes and condense each into a one-page summary
Complete at least 100 practice questions and log every wrong answer with the underlying concept gap
Re-test the three weakest topics identified in the error log until accuracy exceeds 80 percent
Practise two timed full-length mock papers and review the rationale for every incorrect option
Your checkpoint
Consolidated revision pack: six one-page domain summaries, an error log with 25 or more entries and corrective notes, and mock-test scores with a written improvement plan
Milestones
Week 2: Can explain the Basel definition of operational risk, its boundary with credit and market risk, and complete an RCSA and heat map unaided within 45 minutes
Week 4: Can classify loss events by Basel event type, state the loss-data inclusion thresholds, and justify each control in the library as preventive, detective or corrective
Week 6: Can list the main fraud red flags and cyber threats from memory and match each to at least one preventive and one detective control
Week 8: Scores 80 percent or higher on two timed mock papers and can explain every logged error without referring back to the source material