Operational Risk Framework Flashcards

What is the 'three lines of defense' model in operational risk governance?

Answer: A governance framework where business units (1st line) own risk, risk management functions (2nd line) oversee it, and internal audit (3rd line) independently assesses it

The three lines model clearly delineates ownership: 1st line manages and owns risk daily, 2nd line sets policy and monitors, 3rd line (internal audit) provides independent assurance.

What is a 'model risk' and why is it considered an operational risk?

Answer: The risk that a mathematical model used in pricing or risk measurement is incorrect or misapplied, leading to wrong decisions or misstated risk

Model risk is an operational risk because flawed models (incorrect assumptions, coding errors, improper use) represent a failure of internal processes, potentially causing significant financial loss or regulatory penalties.

Under Basel II/III, the 'boundary' between the banking book and trading book matters primarily for which risk type?

Answer: Market risk — trading book positions are subject to market risk capital while banking book positions are subject to credit risk capital

The banking book / trading book boundary determines whether positions are marked-to-market (trading book → market risk capital) or accrual-accounted (banking book → credit risk capital), a key source of regulatory arbitrage.

What is 'reputational risk' in the context of financial risk management?

Answer: The risk of loss resulting from negative public perception damaging a firm's business relationships, revenue, or funding access, often triggered by an operational or conduct failure

Reputational risk is not directly capitalized under Basel but is a major concern because an operational failure (scandal, data breach) can trigger depositor runs, client attrition, and higher funding costs.

Which of the following is an example of 'execution, delivery, and process management' as an operational risk event type?

Answer: A back-office employee entering the wrong counterparty on a trade ticket causing a settlement fail

Execution errors such as trade entry mistakes, settlement failures, and data-entry errors in the processing chain fall under the Basel event type 'Execution, Delivery and Process Management.'

What is 'concentration risk' in the context of operational risk?

Answer: Over-reliance on a single vendor, system, process, or person such that its failure could cause outsized operational disruption

Operational concentration risk arises when a single point of failure — one critical system, one outsourcing partner, one key-person dependency — can knock out a core business function.