Outline how causal relationships are identified, and the roles that education, Risk and Control Self-Assessment (RCSA) and Key Risk Indicators (KRIs) play in understanding and managing operational risks.
The idea
Understanding why losses occur matters as much as measuring them. Causal analysis looks for factors that drive losses, such as trade volume, staff turnover or system changes, using statistical analysis of loss history. Correlation alone does not prove cause, so the mechanism must be understood and tested. Education makes staff aware of operational risk and encourages them to report losses and near misses, which builds the data and culture on which everything else depends. Risk and Control Self-Assessment (RCSA) has business unit managers identify and score their own risks and controls, typically by likelihood and impact. It is subjective and a snapshot in time. Key Risk Indicators (KRIs) are measurable metrics, such as failed trades, staff turnover, system downtime or overtime hours, tracked regularly with thresholds that trigger escalation. A good KRI leads losses rather than reflecting them. The two tools complement each other: self-assessment gives breadth, indicators give timely warning.
A practice question
Which of the following is the best example of a key risk indicator (KRI) for settlement operations?
- The annual gross income of the settlement unitWhy not: A financial size measure, not an indicator of rising operational risk.
- The bank's share priceWhy not: A market measure unrelated to the control environment of a process.
- The number of trades still unconfirmed after five days, reported weekly - correct
- The 99.9 percent one-year loss from the AMA modelWhy not: A model output used for capital; it is not a regularly monitored early-warning metric.
A KRI is a measurable metric, ideally leading losses, such as unconfirmed trades, failed trades, staff turnover or overtime, monitored against thresholds.
A harder one
What is the main contribution of operational risk education within a bank?
- It replaces RCSA and KRIs, since informed staff no longer need formal assessmentsWhy not: Education complements, and does not replace, formal assessment and monitoring.
- It automatically reduces regulatory capital under the standardized approachesWhy not: Standardized capital depends on gross income and betas, not on training.
- It makes operational risk the sole responsibility of the risk departmentWhy not: Operational risk is owned by the business units; education spreads responsibility.
- Staff understand the risks and controls and report losses and near misses, supporting data collection and a risk-aware culture - correct
Education builds awareness and reporting behaviour, which feeds loss data, RCSA and KRIs.
The hardest tier
A unit's annual RCSA rated its settlement process low risk. Over the following quarter its KRIs deteriorate: failed trades up 60 percent, staff turnover at a record and overtime hours rising. The best response is:
- Rely on the RCSA, since managers know their processes best, and wait for the next annual cycleWhy not: The RCSA is a point-in-time judgement; ignoring newer evidence leaves risk unmanaged.
- Dismiss the KRIs as noise, because indicators are not actual lossesWhy not: KRIs exist to give timely warning before losses appear.
- Treat the KRI breaches as a warning that the RCSA is out of date, escalate, and reassess the unit's risks and controls - correct
- Discard the RCSA programme and rely only on KRIs in futureWhy not: The two tools complement each other; RCSA gives breadth and context that KRIs cannot.
KRIs are monitored frequently and have thresholds that trigger escalation. A conflict with an older RCSA signals that the self-assessment needs updating.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Operational Risk
- Outline the types of operational risk, with an account of how each type can arise.
- Contrast three ways of arriving at regulatory capital for operational risk: the advanced measurement approach, the standardized approach and the basic indicator approach.
- Explain why the Basel Committee introduced the standardized measurement approach and describe what it involves.
- Explain how Monte Carlo simulation builds a loss distribution out of a suitable loss frequency distribution and loss severity distribution.
- Outline the data problems commonly seen that make estimates of loss frequency and severity distributions inaccurate or biased.
- Outline using scenario analysis as a substitute when there is little data to work with.
- Outline how operational risk capital is allocated across business units.
- Explain how operational risk can be measured with the power law.
- Explain the link between insuring against operational risk and the moral hazard and adverse selection problems that insurance companies face.