Â
This lesson examines the specific control activities and processes designed to mitigate operational risk, a key component of a bank’s risk profile.
3.1 Understanding Operational Risk
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. It is a key risk category under the Basel framework and a major focus of internal controls. Sources include human error, system failures, fraud, legal risks, and external disruptions. Effective controls must address each of these areas.
3.2 Control Activities: The “How” of Internal Control
Control activities are the policies, procedures, and mechanisms that help ensure management directives to mitigate risks are carried out. Key examples include:
-
Segregation of Duties:Â A fundamental control requiring that no single individual has conflicting responsibilities that could conceal errors or fraud. This ensures a system of checks and balances.
-
Authorisations and Approvals:Â Ensuring transactions are executed only with proper management approval.
-
Reconciliations:Â Regularly comparing and matching records to identify discrepancies (e.g., account reconciliations).
-
Physical Controls:Â Security over assets, including vaults, access controls, and IT security.
-
Performance Reviews:Â Comparing actual performance to budgets, forecasts, and prior periods.
3.3 Risk and Control Self-Assessment (RCSA)
RCSA is a process used by operational managers (the 1st Line) to identify, assess, and prioritise operational risks and the controls that mitigate them. It is a crucial tool for embedding risk management into business operations. This process leads to self-assessment of key controls and the identification of control gaps.
3.4 Key Risk Indicators (KRIs)
KRIs are metrics used to monitor the level of operational risk. Examples include staff turnover rates, system downtime, the number of failed trades, or the volume of operational losses. These indicators provide early warning signals of control weaknesses. Banks use these as part of their monitoring systems to ensure adherence to their risk appetite. Effective management of operational risk requires continuous monitoring, as operational losses can arise from many unpredictable sources.