ORM Designation flashcards

33 cards. Read the term and the definition here. The deck at the top of this page is optional.

Operational risk definition

The risk of loss from inadequate or failed internal processes, people, and systems, or from external events. The Basel definition excludes strategic and reputational risk as standalone categories.

Four causes of operational risk

People, process, systems, and external events. Every loss event should be mapped to at least one of these to direct remediation at the true source rather than the symptom.

Three lines model

First line owns and manages risk in the business. Second line sets frameworks and challenges. Third line, internal audit, gives independent assurance to the board.

Inherent versus residual risk

Inherent risk is assessed before controls are applied. Residual risk is what remains after crediting controls that are designed and operating effectively.

Risk appetite versus capacity

Appetite is the level of risk the board is willing to accept, expressed as statements and tolerances. Capacity is the maximum risk the firm can bear before breaching capital constraints.

Key risk indicator

A forward-looking metric with defined green, amber, and red thresholds that signals rising risk exposure. A red breach triggers escalation even before any loss occurs.

RCSA purpose

A risk and control self-assessment rates likelihood and impact, maps controls to risks, and produces a residual rating. It must be reconciled with loss data and indicators.

Bow-tie analysis

A diagram linking causes to a top event through preventive controls, and the event to consequences through mitigating controls. It reveals controls protecting both sides.

Basel seven event types

Internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, damage to physical assets, business disruption and system failures, execution delivery and process management.

Basel eight business lines

Corporate finance, trading and sales, retail banking, commercial banking, payment and settlement, agency services, asset management, and retail brokerage. Used to map losses and apply betas.

Basic Indicator Approach formula

Capital equals average annual gross income over the prior three years multiplied by alpha, set at 15%. Years with negative or zero gross income are excluded from the average.

Standardised Approach betas

Beta factors applied to three-year average gross income per business line: 18% corporate finance, trading and sales, and payment and settlement; 15% commercial banking and agency services; 12% retail banking, asset management, retail brokerage.

Gross income definition

Net interest income plus net non-interest income, before deducting provisions and operating expenses, excluding extraordinary or irregular items and income from insurance.

Loss distribution approach

Aggregate loss is modelled by combining a frequency distribution, usually Poisson, with a severity distribution such as lognormal or Pareto. Capital is a high percentile of aggregate loss.

Expected versus unexpected loss

Expected loss is the average annual loss, covered by pricing and provisions. Unexpected loss is volatility around that average, covered by regulatory and economic capital.

Scenario analysis role

Experts estimate frequency and severity for plausible but rare events that internal data cannot capture. Outputs feed capital models and validate whether loss data is representative.

Insurance recognition conditions

To reduce the operational risk capital charge, a policy needs a residual term of at least one year, 90 days cancellation notice, and payout within one year, capped at 20% of the charge.

Operational risk-weighted assets

The operational risk capital charge multiplied by 12.5, derived from the 8% minimum total capital ratio. Used to feed the charge into total risk-weighted assets.

Internal Loss Multiplier

Under the Basel III standardised approach, a factor scaling the Business Indicator Component by comparing historical losses with the component. Higher losses increase the capital requirement.

Risk register minimum fields

Each entry needs an owner, cause, consequence, existing controls, residual rating, and review date. An entry without a named owner is treated as unmanaged.

Root cause analysis tools

5 Whys traces linear causation. Fishbone categorises causes across people, process, system, and external. Fault tree maps logic-gated failure paths for complex events.

Near-miss reporting value

Events with no loss are recorded because high-frequency near-misses are leading indicators of a rising severity distribution, revealing control weaknesses before real damage occurs.

Concentration risk mitigation

Exposure to a single supplier, system, or geography can cause correlated failures. Mitigation is substitutability and tested exit plans, not only contractual service levels.

Outsourcing accountability

The firm retains regulatory responsibility regardless of contractual transfer. Due diligence, audit rights, data residency, and subcontractor visibility are the key control levers.

Three risk culture components

Tone at the top from board and senior management behaviour, clear accountability with consequences, and effective challenge where dissent is safe and acted upon.

Segregation of duties rule

No single person may initiate, authorise, record, and reconcile the same transaction. Where headcount prevents this, documented compensating controls and monitoring are required.

Fraud triangle

Opportunity, pressure or incentive, and rationalisation. Controls mainly reduce opportunity through segregation and approvals, while incentive design and monitoring address pressure.

Recovery time versus point

The recovery time objective is the maximum tolerable service outage. The recovery point objective is the maximum tolerable data loss. Both require tested evidence, not documentation alone.

Conduct risk management

The risk that firm or employee behaviour harms customers or markets. Managed through incentives, product governance, complaints analysis, and breach reporting, not policy alone.

Model risk as operational risk

Models used for pricing, capital, or decisioning require independent validation, ongoing performance monitoring, and documented limitations. Failures are operational loss events.

Operational resilience tolerances

Impact tolerances define how much disruption an important business service can absorb. Firms must test severe-but-plausible scenarios against those tolerances within a set horizon.

Whistleblowing channel design

Channels must be independent of line management, permit anonymous reporting, and be backed by non-retaliation policy. Low report volume is a warning sign, not success.

Repeat audit findings

Findings recurring after a prior closure indicate a control environment failure rather than an isolated lapse. They warrant escalation to the board risk committee and root cause review.