Bank Operational Risk Framework Owned by a Central Team
A mid-sized bank has an operational risk framework approved by the board. The board risk appetite statement contains 12 metrics, including 'losses from external fraud below €2m per year'. Business units submit monthly risk reports, but all risk assessments are performed by a central operational risk team of five people. The business unit heads sign off the reports without discussion. Risk owners in the register are recorded as 'Operational Risk Department'. Treatment plans are tracked in a spreadsheet that is not linked to business objectives or budgets. Internal audit finds that near misses are rarely recorded, and the framework has not been evaluated since implementation three years ago. The board asks whether the framework is effective and where to focus improvement.
1. Which framework components are weakest, and what is the likely consequence?
Read the worked answer
The weakest components are leadership and commitment, integration, implementation, evaluation and improvement.
The board has approved an appetite statement, but business unit heads sign off without discussion, so leadership is formal rather than active. Integration is weak because assessments are performed centrally and treatment plans are disconnected from objectives and budgets. Implementation is weak because near misses are not recorded; the organization is managing known losses rather than learning from precursors. Evaluation has not occurred for three years, so no one knows whether the framework is achieving its purpose.
The likely consequence is that risk information is second-hand and incomplete. The central team cannot see front-line process failures, and business units do not own their risks. Treatment plans may be tracked but not resourced, so they remain paper commitments. The board may believe it has oversight because it receives monthly reports, while the most useful risk information - near misses and control weaknesses - is missing.
2. Explain why recording the Operational Risk Department as risk owner is inconsistent with ISO 31000.
Read the worked answer
In ISO 31000, the risk owner is the person or role with accountability and authority to manage a risk. The operational risk department is a facilitator and adviser; it does not run the business processes where fraud, processing errors or IT failures arise. Recording it as owner concentrates accountability in a central team that cannot change front-line controls, staffing or incentives.
This inconsistency has practical effects. Business unit managers may feel no obligation to identify or treat risk because the register says it belongs elsewhere. Treatment decisions may be made without knowledge of local constraints, and residual risk may be accepted by people who do not bear the consequences. It also weakens the principle of inclusive risk management.
The register should name business process owners or accountable executives as risk owners, with the central team recorded as facilitator or action owner where appropriate. Risk owners should have delegated acceptance limits and be visible in performance discussions.
3. Propose a practical approach to evaluate and improve the framework.
Read the worked answer
The bank should evaluate the framework against its stated purpose and agreed criteria, not simply ask whether it exists. Practical steps include: define evaluation questions (coverage, timeliness, quality of assessments, treatment effectiveness, near-miss reporting, linkage to objectives); sample risk assessments against source evidence; interview business unit heads and front-line staff; compare treatment plans with budgets and completion evidence; and test whether escalation and appetite metrics are used in decisions.
The evaluation should report strengths and gaps to the board. Improvement priorities should then be sequenced. First, move risk assessment into business units with central support and training. Second, assign risk owners with authority at the right level. Third, link treatment plans to budgets and objectives. Fourth, introduce near-miss reporting and review triggers. Fifth, set an annual framework evaluation cycle with progress tracking. This is consistent with ISO 31000's emphasis on monitoring, review and continual improvement, and it gives the board evidence rather than assurance by assertion.