ORM Designation cheat sheet

Definition: operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events; it excludes strategic and reputational risk in the Basel definition, though reputational impact is often a consequence.

Four causal categories: people (fraud, error, key-person loss), process (documentation gaps, failed controls), systems (outages, data corruption, cyber intrusion), and external events (natural disaster, third-party failure, regulatory change).

Risk = likelihood × impact; a 5×5 matrix scoring both dimensions 1-5 yields scores from 1 to 25, usually banded low (1-6), medium (8-12), high (15-25).

Three lines model: first line owns and manages risk in the business; second line provides oversight, frameworks, and challenge; third line (internal audit) gives independent assurance to the board.

Inherent risk is assessed before controls; residual risk after controls; target risk is the level the firm is willing to accept, and the gap between residual and target drives remediation priority.

Key risk indicators (KRIs) are forward-looking metrics with defined thresholds (green/amber/red); a KRI breaching its red threshold triggers escalation, not necessarily a loss event.

Risk appetite is set by the board as a statement plus quantitative tolerances; risk capacity is the maximum risk the firm can bear before breaching capital or solvency constraints.

Loss event data collection captures date, business line, event type, gross loss, recoveries, and root cause; internal data is usually thin-tailed, so external consortium data and scenario analysis supplement it.

Bow-tie analysis links causes to a top event through preventive controls and links the event to consequences through mitigating controls; it exposes controls that serve both sides.

Control types: preventive (stops the event), detective (identifies after the fact), corrective (limits damage); a control is only credited in residual risk if it is designed and operating effectively.

RCSA (risk and control self-assessment) rates likelihood and impact per risk, maps controls, and produces a residual rating; it is a qualitative input that must be reconciled with loss data and KRIs.

Basel event-type taxonomy has seven categories: internal fraud, external fraud, employment practices and workplace safety, clients/products/business practices, damage to physical assets, business disruption and system failures, and execution/delivery/process management.

Basel business lines number eight: corporate finance, trading and sales, retail banking, commercial banking, payment and settlement, agency services, asset management, and retail brokerage.

Basic Indicator Approach uses a single indicator: average annual gross income over the prior three years multiplied by alpha (15%), excluding years with negative or zero gross income from both numerator and denominator.

Standardised Approach applies a beta per business line (18% corporate finance, 18% trading and sales, 12% retail banking, 15% commercial banking, 18% payment and settlement, 15% agency services, 12% asset management, 12% retail brokerage) to the three-year average gross income per line.

Advanced Measurement Approach permits internal models; under Basel III the AMA was removed from the framework effective 2023 and replaced by the new standardised approach with a business indicator and internal loss multiplier.

Business Indicator Component = business indicator × marginal coefficients (12% up to EUR 1bn, 15% on the next EUR 9bn, 18% above EUR 30bn); the Internal Loss Multiplier scales it by historical losses relative to the BI component.

Scenario analysis asks experts to estimate frequency and severity for plausible but rare events; output is fitted to a severity distribution (lognormal, Pareto) and combined with internal and external loss data via loss distribution approach.

Insurance mitigates operational risk only if the policy has a residual term of at least one year, a cancellation notice of at least 90 days, and the claim is paid within one year; the recognised amount is capped at 20% of the total operational risk capital charge.

Risk register entries require an owner, a cause statement, a consequence statement, existing controls, residual rating, and a review date; entries without an owner are treated as unmanaged.

Incident escalation tiers typically run from business-unit resolution (low) to operational risk committee (medium) to board risk committee (high/critical), with defined time limits per tier.

Root cause analysis techniques: 5 Whys for linear causation, fishbone (Ishikawa) for categorising causes across people/process/system/external, and fault tree for logic-gated failure paths.

Change risk: any new product, system, outsourced arrangement, or regulatory obligation requires a formal risk assessment before go-live; the assessment must cover conduct, data, and third-party concentration.

Concentration risk arises when exposure to a single third party, system, geography, or supplier cluster can produce correlated failures; the mitigation is substitutability and exit planning, not just contractual SLAs.

Near-miss and 'no-loss' events are recorded alongside actual losses because high-frequency near-misses are leading indicators of a rising severity distribution.

Reporting to the board should show losses against appetite, KRI status, top residual risks, open remediation with overdue flags, and trend direction; volume of incidents alone is not a risk measure.

Stress testing for operational risk applies severe-but-plausible scenarios (extended system outage, major internal fraud, sanctions breach) and tests whether capital and liquidity absorb the impact.

Outsourcing and cloud: the firm retains the regulatory responsibility regardless of contractual transfer; due diligence, audit rights, data residency, and subcontractor visibility are the control levers.

Three components of risk culture: tone at the top (board and senior management behaviour), accountability (clear ownership and consequences), and effective challenge (dissent is safe and acted upon).

Conduct risk is the risk that employee or firm behaviour harms customers or markets; it is managed through incentives, product governance, complaints analysis, and breach reporting, not only through policy.

Whistleblowing channels must be independent of line management, allow anonymous reporting, and be protected by non-retaliation policy; low report volume is a warning sign, not a success metric.

Audit findings are rated by severity and tracked to closure with named owners and dates; repeat findings indicate a control environment failure rather than an isolated lapse.

Model risk is a subset of operational risk: models used for pricing, capital, or decisioning require validation, ongoing performance monitoring, and documented limitations.

Human error is reduced by design (forcing functions, default settings, segregation of duties, four-eyes checks) more reliably than by training or exhortation alone.

Segregation of duties requires that no single person can initiate, authorise, record, and reconcile the same transaction; compensating controls are needed where headcount makes this impossible.

Fraud triangle: opportunity, pressure (incentive), and rationalisation; controls primarily attack opportunity, while incentive design and monitoring address pressure.

Business continuity: the recovery time objective is the maximum tolerable outage, the recovery point objective is the maximum tolerable data loss, and both must be tested, not merely documented.

Operational risk capital under the standardised approaches is a Pillar 1 charge; Pillar 2 requires the firm to hold additional capital for risks not fully captured, assessed through the internal capital adequacy process.

Operational risk-weighted assets = operational risk capital charge × 12.5, since the Basel minimum total capital ratio is 8% (1/0.08 = 12.5).

Gross income for the basic indicator approach is net interest income plus net non-interest income, measured before deduction of provisions and operating expenses, and excluding extraordinary or irregular items.

Loss distribution approach: aggregate loss = convolution of frequency (usually Poisson) and severity (lognormal or Pareto) distributions; capital is set at a high percentile (commonly 99.9%) of the aggregate loss distribution.

Expected loss is covered by pricing and provisions; unexpected loss is covered by capital; the tail beyond the chosen confidence level is the residual risk the firm accepts.

Recovery and resolution planning require the firm to identify critical shared services and demonstrate that operational continuity survives a stress or wind-down.

Regulatory expectations for operational resilience set impact tolerances for important business services and require scenario testing of severe-but-plausible disruption within a defined horizon.

Exam trap: the operational risk definition excludes strategic and reputational risk as standalone categories, but reputational consequences of operational failures are still assessed within the event's impact.

Exam trap: insurance reduces the capital charge only within the prescribed limits and only for policies meeting term, cancellation, and payout conditions; it does not remove the underlying risk from the register.