Operational Risk in Administrative Processes
Operational Risk in Administrative Processes
This domain focuses on losses from people, process, systems and external events in administrative work: procurement, travel and expenses, records, payroll, facilities, vendor management and company secretarial administration. The exam tests process mapping, key risk indicators, near-miss capture and third-party risk.
Core rules
- Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It is not limited to 'back office'; it includes legal, regulatory and reputational consequences of administrative failure.
- Map the process end to end, note hand-offs and manual workarounds, then identify failure points. A control that depends on one person’s memory is fragile.
- Use KRIs such as duplicate-payment rate, invoice-cycle time, records-retrieval time, exception volumes and staff turnover in key roles. Set thresholds and assign an owner.
- Capture near misses; they are free lessons. Outsourcing transfers activity, not accountability.
Worked example
A travel-expense process uses a spreadsheet and paper receipts. Staff can submit the same receipt twice, and approval is by email. The risk is duplicate reimbursement and lost documentation. The redesign introduces an online claim form with receipt matching, a sequential approval workflow, and a monthly exception report of claims paid within 24 hours of submission. The KRI is the number of duplicate claims detected. Reasoning: the process fix removes the manual workaround and creates an audit trail; the KRI tests whether the new control is working.
Traps
- Treating operational risk as only clerical error and ignoring process design.
- Listing risks without identifying the process step where they arise.
- Assuming outsourcing removes accountability.
- Ignoring near misses because no loss occurred.