Operational Risk Management Flashcards

A financial institution is implementing the 'Three Lines of Defense' model for operational risk governance. Which of the following correctly describes the primary responsibility of the Second Line of Defense?

Answer: Developing the risk management framework and overseeing its implementation by the first line.

The Second Line of Defense (e.g., Risk Management and Compliance functions) is responsible for providing oversight and expertise. This includes developing the risk management frameworks, policies, and tools, and monitoring the First Line's adherence to them. The First Line owns the risk, the Third Line (Internal Audit) provides independent assurance, and the board/senior management establishes risk appetite.

A manufacturing company's risk management team facilitates quarterly meetings where business unit managers identify potential operational failures in their processes and assess the adequacy of existing controls. This collaborative activity is a core component of which operational risk management tool?

Answer: Risk and Control Self-Assessment (RCSA)

A Risk and Control Self-Assessment (RCSA) is a process where management and staff of a business unit collaboratively identify and evaluate risks and associated controls within their own operations. This proactive approach empowers the business lines to take ownership of their risk environment. Scenario Analysis models potential future events, RCA investigates past incidents, and BIA focuses on the consequences of a disruption.

According to the Basel II framework, operational risk events are categorized into seven distinct types. A significant loss resulting from a power grid failure that halts a bank's data center operations would be classified under which event type?

Answer: Business Disruption and System Failures

The Basel II framework defines 'Business Disruption and System Failures' as losses arising from the disruption of business or system failures. This category explicitly includes utility outages, telecommunications problems, and hardware/software failures. The other categories relate to fraud, process errors, or misconduct in business dealings.

A risk architect is designing a monitoring dashboard for the operational risk of a customer service center. They want to include a forward-looking metric that can provide an early warning of potential increases in customer complaints. Which of the following would be the MOST effective Key Risk Indicator (KRI)?

Answer: Percentage of new hires who have not completed product training.

A Key Risk Indicator (KRI) should be a leading or predictive indicator of potential future risk events. A high percentage of untrained new hires is a leading indicator of potential future errors and customer complaints. The number of complaints and the CSAT score are lagging indicators, as they measure events that have already occurred. Average call handle time is a performance metric (KPI) that doesn't directly indicate rising risk.

An online retailer suffers a major data breach where customer credit card information is stolen by an external hacking group. Within the Basel operational risk event typology, this loss event would be classified as:

Answer: External Fraud

The Basel framework defines 'External Fraud' as losses due to acts by a third party intended to defraud, misappropriate property, or circumvent the law. This category includes events like theft of information and hacking damage. Internal Fraud involves employees, Business Disruption relates to system failures, and Damage to Physical Assets involves events like natural disasters.

Which statement best describes the primary difference between a Key Performance Indicator (KPI) and a Key Risk Indicator (KRI) in the context of operational risk management?

Answer: KPIs measure historical performance against objectives, while KRIs are forward-looking and signal potential future problems.

The fundamental difference is their time orientation and purpose. KPIs are generally backward-looking (lagging), measuring how well an organization has performed against its strategic goals. KRIs are forward-looking (leading) indicators used as an early warning system to signal increasing risk exposure before a loss event occurs.