CORES CORES Operational Risk Reporting & Communication 2 — Questions and Answers
Question 1: Which of the following best describes 'risk aggregation' in operational risk reporting?
- Combining risk data from across business units and risk types to provide an enterprise-wide view (Correct answer)
- Adding up all financial losses in a given quarter
- Grouping risks only by regulatory category for filing purposes
- Averaging individual risk scores to produce a single firm score
Correct answer: Combining risk data from across business units and risk types to provide an enterprise-wide view
Risk aggregation consolidates risk data from all business lines and risk categories to provide senior management and the board with a holistic enterprise-wide risk picture.
Question 2: What is the risk of reporting only losses above a specific threshold (i.e., applying a collection threshold)?
- High-frequency, low-severity events that signal systemic issues may be missed (Correct answer)
- Regulatory capital calculations will be overstated
- The board will receive too much data
- KRIs will be calibrated too conservatively
Correct answer: High-frequency, low-severity events that signal systemic issues may be missed
Threshold-based collection can exclude small but frequent losses that, in aggregate, indicate deeper systemic control failures or deteriorating risk culture.
Question 3: When designing an operational risk report for the audit committee, what level of detail is most appropriate?
- Summarized findings with key themes, control gaps, and management responses rather than transaction-level detail (Correct answer)
- Full transaction logs and raw data exports
- Only positive outcomes to maintain board confidence
- Detailed coding of every individual risk event
Correct answer: Summarized findings with key themes, control gaps, and management responses rather than transaction-level detail
Audit committees require summarized, theme-based reporting that highlights control gaps and management actions, enabling oversight without overwhelming with operational granularity.
Question 4: An operational risk report shows a sudden spike in KRI readings for a payment processing unit. The most appropriate immediate action is to:
- Escalate the anomaly to risk management and the relevant business line for root cause investigation (Correct answer)
- Discard the data as likely a system error
- Wait for the next scheduled report before taking action
- Report it directly to regulators without internal review
Correct answer: Escalate the anomaly to risk management and the relevant business line for root cause investigation
A KRI spike is an early warning signal that requires immediate escalation and root cause investigation to determine whether it signals a real control deterioration.
Question 5: Which element is essential for making operational risk reports 'actionable'?
- Recommendations or suggested actions tied to each identified risk or control gap (Correct answer)
- Lengthy narrative descriptions of industry trends
- Historical benchmarks from 10+ years ago
- Technical jargon that demonstrates analytical rigor
Correct answer: Recommendations or suggested actions tied to each identified risk or control gap
Actionable reports pair each finding with specific recommendations, enabling business lines and management to take concrete steps to address identified risks or gaps.
Question 6: In the context of operational risk reporting, what is meant by 'forward-looking indicators'?
- Metrics that signal potential future risk deterioration before losses occur (Correct answer)
- Projections of next quarter's financial revenue
- Lagging indicators based on completed loss events
- Audit scores from the prior year's examination
Correct answer: Metrics that signal potential future risk deterioration before losses occur
Forward-looking indicators (a subset of KRIs) detect emerging risk trends or control weaknesses before they materialize into actual loss events, enabling proactive intervention.
CORES CORES Operational Risk Reporting & Communication 2
Which of the following best describes 'risk aggregation' in operational risk reporting?