Operational Risk Framework Flashcards

What is 'scenario analysis' used for in operational risk capital modeling?

Answer: Using expert judgment to estimate the frequency and severity of rare but plausible extreme operational loss events not in the historical data

Scenario analysis supplements internal loss data by capturing low-frequency/high-severity events (e.g., a major cyber attack or rogue trader) that haven't occurred recently but could happen.

What does the Basel Standardized Approach (TSA) for operational risk use to differentiate capital across business lines?

Answer: Different beta factors (12–18%) applied to gross income by business line

TSA assigns beta factors ranging from 12% to 18% to eight defined business lines (retail banking, trading, asset management, etc.) and multiplies each by its gross income.

Which of the following best describes the 'Advanced Measurement Approach' (AMA) for operational risk under Basel II?

Answer: An internal model approach where banks use quantitative models combining internal loss data, external data, scenario analysis, and business environment factors to estimate operational risk capital

The AMA allowed sophisticated banks to build bespoke models for operational risk capital, incorporating all four data elements, subject to regulatory approval — it was replaced by the Standardized Measurement Approach in Basel IV.

What is 'cyber risk' classified as under the operational risk framework?

Answer: Operational risk under the 'systems failures' or 'external events' category

Cyber attacks (data breaches, ransomware, DDoS) fall within the Basel operational risk definition under 'systems failures' or 'external events,' and are increasingly the largest operational risk concern for banks.

What is 'business continuity planning' (BCP) in the context of operational risk?

Answer: A documented framework ensuring critical business functions can continue or recover quickly after a disruptive operational risk event

BCP includes disaster recovery plans, backup systems, alternate operating sites, and communication protocols to minimize downtime and loss when a disruption (fire, flood, cyberattack) occurs.

In operational risk, what is the 'frequency-severity' framework?

Answer: A model that separates operational losses into how often they occur and how large they are, then combines these distributions to estimate total loss

Operational risk capital models separately model loss frequency (using Poisson distributions) and loss severity (using lognormal or Pareto), then convolve them via Monte Carlo to produce a loss distribution.