Operational Risk Management (CORM Syllabus)
This domain tests how operational risk is defined, governed, measured, and controlled in a financial firm under the CORM syllabus. It probes the Basel definition and its boundary, the risk-management cycle, three lines of defense, RCSA, KRIs, loss data, scenario analysis, and regulatory capital.
Definition and boundary
Basel II defines operational risk as 'the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.' It includes legal risk but excludes strategic and reputational risk. Do not treat it as a residual 'anything not credit or market' category; both are testable.
Governance and the management cycle
The board sets risk appetite; the three lines of defense separate execution, oversight, and audit. The cycle is identify, assess, control, monitor, and report. RCSA maps processes to risks and controls, rates controls, and derives residual risk. KRIs are leading indicators with thresholds; loss data capture actual and near-miss events; scenario analysis fills data gaps in the tail.
Capital
Under Basel II, approaches were BIA, TSA/SA, and AMA. The Basel III final reforms replaced these with the Standardised Measurement Approach (SMA), combining Business Indicator and Internal Loss Multiplier.
Worked example
A payments firm maps outbound wires. RCSA flags a manual callback control. KRI 'callback exceptions per 1,000 wires' breaches its threshold, and two loss events occur: a £120k fraudulent payment and a near miss. A scenario workshop estimates a 1-in-20-year loss of £2m. The firm adds dual approval and automated sanctions screening, updates the KRI threshold, and reports residual risk to the operational risk committee. Reasoning: the control weakness drives residual risk; the KRI is a leading signal; loss data calibrate frequency and severity; the scenario captures tail risk; SMA capital uses business indicator and losses.
Traps
Calling operational risk 'everything except credit and market' is too broad. Legal risk is in; strategic and reputational risk are out. Inherent risk is before controls, residual after. A KRI breach is not a loss event. Ignoring near misses and external data weakens the picture. Assuming AMA remains available is outdated.