Managing Operational Risk

Managing Operational Risk

Structures operational risk assessment with loss event classification, Risk and Control Self-Assessment (RCSA), and Key Risk Indicator (KRI) monitoring for enterprise operational risk programs.

When To Use

• Building or refreshing an operational risk framework aligned to Basel II/III categories
• Conducting periodic RCSA cycles across business units
• Classifying and analyzing internal loss events or near-misses
• Designing or recalibrating KRI dashboards and escalation thresholds
• Preparing operational risk reporting for board, risk committee, or regulators
• Evaluating residual risk after control changes or process redesigns

Inputs To Gather

• Loss event data: Internal loss history with dates, amounts, business lines, and Basel event-type classifications (internal fraud, external fraud, employment practices, clients/products, damage to physical assets, business disruption, execution/delivery/process management) [VERIFY: confirm whether the organization uses standard Basel categories or a proprietary taxonomy]
• RCSA inventory: Current risk register with inherent risk ratings, control descriptions, control effectiveness scores, and residual risk ratings
• KRI definitions: Existing indicator catalog with metric definitions, data sources, collection frequency, and threshold levels (green/amber/red)
• Organizational context: Business line structure, material processes, outsourcing arrangements, and recent change events (system migrations, restructurings, product launches)
• Appetite and tolerance statements: Board-approved operational risk appetite, tolerance limits, and any regulatory capital requirements [VERIFY: check if the firm is subject to standardized approach, basic indicator approach, or AMA/SMA for op-risk capital]
• Prior audit/exam findings: Internal audit reports, regulatory examination results, and open remediation items related to operational risk

Workflow

1. Scope and segment — Define assessment boundaries by business line, legal entity, or process. Map each segment to Basel Level 1 and Level 2 event-type categories. Confirm which risk appetite statements apply.

2. Classify loss events — For each reported loss or near-miss:

   • Assign Basel event-type category and sub-category
   • Record gross loss, recoveries, and net loss
   • Tag root cause (people, process, systems, external)
   • Flag boundary events with credit, market, or insurance risk
   • Note whether the event is above the reporting threshold [VERIFY: threshold amount varies by institution]

3. Conduct RCSA — For each in-scope process or risk:

   • Identify inherent risk using frequency x severity matrix (e.g., 5x5 scale)
   • Document key controls with type (preventive/detective), owner, and automation level
   • Assess control design adequacy and operating effectiveness
   • Calculate residual risk rating; compare to risk appetite
   • Flag any residual risk that exceeds tolerance as requiring action plan

4. Define and calibrate KRIs — For each material risk:

   • Select leading indicators (predictive) and lagging indicators (outcome-based)
   • Set thresholds: green (within appetite), amber (approaching tolerance), red (breach)
   • Specify data source, collection frequency, and responsible owner
   • Back-test thresholds against historical loss data where available
   • Document escalation path for amber and red breaches

5. Aggregate and report — Compile findings into a management report:

   • Executive summary with top risks, emerging risks, and trend direction
   • Loss event summary by category with period-over-period comparison
   • RCSA heat map showing residual risk concentrations
   • KRI dashboard with current status, trend arrows, and breach count
   • Action item tracker with owners, due dates, and status
   • Capital impact summary if applicable [VERIFY: confirm capital methodology in use]

6. Review and challenge — Present to risk committee or designated governance body. Document challenges raised, decisions taken, and any appetite recalibrations agreed.

Output

A structured operational risk management report containing:

• Loss event register with Basel classification, root-cause tags, and net loss figures
• RCSA summary matrix showing inherent risk, control effectiveness, and residual risk per process/business line
• KRI scorecard with current values, threshold status, trends, and escalation notes
• Heat map visualizing residual risk by business line and event category
• Action plan log for risks exceeding tolerance, with owners and deadlines
• Narrative commentary on risk trends, emerging threats (e.g., cyber, third-party, conduct), and recommended mitigations

Quality Checks

• Every loss event is assigned exactly one Basel Level 1 event-type category — no unclassified items remain
• RCSA residual risk ratings are mathematically consistent with inherent risk minus documented control effectiveness; no residual rating exceeds inherent rating
• KRI thresholds are calibrated against actual loss experience or documented expert judgment — not set arbitrarily
• All risks rated above appetite have a corresponding action plan with an identified owner and target date
• Boundary events (overlapping credit/market/op-risk) are clearly flagged and allocation methodology is stated [VERIFY: confirm boundary-event treatment policy]
• Report period, data cut-off date, and any known data gaps are explicitly disclosed
• Terminology is consistent with the organization's risk taxonomy and any applicable regulatory framework (Basel, COSO, ISO 31000)