Operational Risk
What the exam tests
Operational risk tests the definition, event types, control assessment, loss data, and mitigation. Questions often ask you to distinguish inherent risk from residual risk and to classify an incident correctly.
Core rules and concepts
- Operational risk is loss from inadequate or failed internal processes, people, systems, or external events. It includes legal risk but excludes strategic and reputational risk under the Basel definition.
- Basel event types include internal fraud, external fraud, employment practices, clients and business practices, damage to physical assets, business disruption and system failures, and execution, delivery, and process management.
- RCSA identifies risks, assesses likelihood and impact, evaluates controls, and produces residual risk.
- Loss data collection captures frequency and severity; high-frequency, low-severity events differ from low-frequency, high-severity events.
- KRIs provide early warning, such as failed trades, system downtime, or staff turnover.
- Insurance can transfer some operational risk but does not replace controls.
Worked example
An RCSA rates the risk of unauthorized trading as likelihood 4 and impact 4 on a 5-point scale, giving an inherent score of 16, which is high. A mandatory dual authorization control and daily limit reconciliation reduce likelihood to 2 while impact remains 4, giving residual risk 8, which is medium. The reasoning is that controls change the likelihood of the event, not the severity if it occurs. Management should monitor the KRI and test the control rather than close the risk because residual is medium.
Traps that cost marks
Do not classify strategic or reputational risk as operational risk under Basel. Do not score controls as risks. Do not confuse inherent and residual risk. Do not assume insurance eliminates operational risk. Do not ignore near misses and external loss data. Do not treat a low residual score as proof that the control works without testing.