Operational risk, fraud and internal controls over banking operations
What the exam tests
This domain tests identification and audit of operational risk and fraud controls across banking operations. Questions often involve reconciliations, maker-checker, access control, suspense accounts, outsourcing and loss events.
Core rules and concepts
- Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or external events. It includes legal risk but excludes strategic and reputational risk.
- The operational risk framework includes risk taxonomy, risk and control self-assessment, key risk indicators, loss event data, scenario analysis and reporting.
- Fraud controls include segregation of duties, maker-checker, dual custody, reconciliation, exception reports, whistleblowing and mandatory leave for sensitive roles.
- Suspense and clearing accounts must be reconciled promptly; aged items require investigation and escalation.
- Outsourcing and third-party arrangements require due diligence, contract safeguards, monitoring and exit plans.
Worked example
An auditor reviews a suspense account with 12 items aged over 90 days totalling RM4.3 million. Root cause analysis shows manual postings by branch staff without maker-checker, and reconciliations performed by the same officer who posts adjustments. The control is deficient in design and operation. The auditor traces items to source, assesses whether losses or fraud are possible, reviews access rights, and recommends independent reconciliation, aging escalation and restriction of adjustment rights.
Traps
- Treating operational risk as only fraud.
- Testing detective controls while ignoring preventive access controls.
- Accepting a reconciliation with unexplained aged items.
- Ignoring operational risk loss data and near misses.