Operational Risk and Resilience: FRM® Part II
It is 20% of the 2026 Part II exam. 99 learning outcomes across 24 learning modules.
Introduction to Operational Risk and Resilience
- Lay out what an operational risk management framework consists of and judge which kinds of risk belong inside its remit.
- Set out the seven event-type categories of Basel II and give sample operational risk events that fit under each one.
- Account for the typical features of operational risk exposures and loss events, and for the management difficulties those features create.
- Define operational resilience, list the components of a resilience framework, and outline what regulators expect of firms in this area.
Risk Governance
- Explain what Basel expects from banks regarding how their operational risk management framework is governed.
- Characterise the part played by the board and by its various committees in governing operational risk, and set their roles side by side.
- Outline the three lines of defense approach to governing operational risk and contrast what each line is responsible for.
- Show what good practice and supervisory expectations look like when setting an operational risk appetite and fostering a robust risk culture.
Risk Identification
- Review the top-down and bottom-up methods and instruments available for spotting operational risks.
- Characterise good practice for pinpointing extreme operational risk events.
- Use an operational risk taxonomy and illustrate the different ways operational risks can be classified in such taxonomies.
- Work with the Basel operational risk taxonomy by applying and describing its Level 1, Level 2 and Level 3 categories.
Risk Measurement and Assessment
- Explain how operational loss data should best be gathered and loss incidents reported, including what supervisors expect.
- Set out how operational risk is assessed, covering risk control self-assessments (RCSAs), scales for rating likelihood, and heatmaps.
- Tell apart KRIs (key risk indicators), KPIs (key performance indicators) and KCIs (key control indicators) by what each one measures.
- Show how quantitative factor-based models gauge operational risk, and how the Swiss cheese model and bowtie tool get applied.
- Using given probability assumptions, work out operational risk exposures with a fault tree model.
- Outline how economic capital for operational risk can be sized, covering where each method is applied and its shortcomings.
- Set out the steps that secure strong operational resilience and the ways to test the resilience of a firm's important business services.
Risk Mitigation
- Show the various ways firms deal with operational risk exposures and weigh them against each other.
- Contrast the kinds of internal control and illustrate each kind with examples.
- Describe automating controls, designing internal controls and testing them, noting the risks and difficulties in each and how to make them work better.
- Outline techniques for raising the quality of operational processes and lowering the chance of human mistakes.
- Explain why new products, fresh business initiatives and mergers or acquisitions can create operational risk, and how firms can curb that exposure.
- Identify the approaches a firm ought to adopt to reduce the damage when an operational risk event occurs, and describe them.
- Describe how operational risks are transferred and how reputational risk is handled, and judge how well these work across differing circumstances.
Risk Reporting
- Pinpoint what the various organizational committees are responsible for, and show how risk reports ought to be built for each committee or business function.
- Lay out what goes into an operational risk report and set out good practice in reporting such risk.
- Outline the obstacles to reporting operational risk, including the nature of operational loss data, and show how they can be overcome.
- Show how exposures should best be reported to regulators and other outside stakeholders.
Integrated Risk Management
- Explain how an ERM (enterprise risk management) framework draws on risk governance, risk appetite and risk culture.
- Account for the Basel treatment of regulatory capital and economic capital requirements and show how the two differ.
- Outline the building blocks of a robust stress-testing framework within financial institutions, plus recommended practices for conducting stress tests.
- Account for the difficulties and factors to weigh when building and putting into use models that stress-test operational risk.
Cyber-resilience: Range of practices
- State what cyber-resilience means and set recent regulatory initiatives on it side by side.
- Characterise present-day banking and supervisory approaches to overseeing a cyber-risk management framework, including the division of duties.
- Account for the ways of supervising cyber-resilience, the approaches to testing and responding to incidents, and the metrics for cybersecurity and resilience.
- Account for and judge how different kinds of institutions currently share cybersecurity information with one another.
- Characterise how risks from interconnected third-party service providers are governed in practice.
Case Study: Cyberthreats and Information Security Risks
- Cite examples of cyber threats and of risks to information security, then summarise how cyber risk is best managed and which frameworks guide that work.
- Outline what the Equifax case study teaches.
Sound Management of Risks related to Money Laundering and Financing of Terrorism
- Explain the Basel committee's recommended approach to evaluating, controlling, reducing and monitoring ML/FT (money laundering and terrorist financing) risks.
- Outline the recommended ways a bank should accept, identify and verify its customers.
- Account for how ML/FT risks should be managed across a banking group and across borders.
Case Study: Financial Crime and Fraud
- Lay out the parts of a control framework aimed at managing the risks of financial fraud and of money laundering.
- Sum up what regulators found in the USAA case study and set out the lessons drawn from it.
Guidance on Managing Outsourcing Risk
- Account for how outsourcing to third-party service providers gives rise to risk, and set out the features of an effective outsourcing risk management program.
- Explain the due diligence a financial institution needs to run before and while engaging outside service providers.
- Set out the subjects and clauses that a contract with a third-party service provider should cover.
Case Study: Third-Party Risk Management
- Account for how using third parties creates risks and characterise a third-party risk management framework that works well.
- Outline what can be learned from the case studies presented.
Case Study: Investor Protection and Compliance Risks in Investment Activities
- Sum up the key rules meant to safeguard investors in financial instruments, among them MiFID, MiFID II and Dodd-Frank.
- Outline what the case studies on breaches of investor protection or compliance rules teach.
Supervisory Guidance on Model Risk Management
- Set out what model risk is and show how it can arise when a model is put into use.
- Pick out the elements that together make a model risk management process effective.
- Account for good practice in building and implementing models.
- Outline what a strong model validation process includes and the difficulties that can undermine effective validation.
Case Study: Model Risk and Model Validation
- Define what a model is, then characterise how model risk can come to affect a financial institution.
- Explain the purpose of the function that manages model risk, and recommended methods for managing model risk and validating models.
- Outline the lessons from the three model risk case studies.
Stress Testing Banks
- Trace the development of stress testing, and compare the earlier stress tests run by the European Banking Authority (EBA), CCAR and SCAP in terms of methodology.
- Account for the difficulties of building stress test scenarios, notably keeping risk factors coherent when they are modeled.
- Account for the difficulties of projecting a bank's revenues, losses and balance sheet across the horizon of a stress test.
Risk Capital Attribution and Risk-Adjusted Performance Measurement
- Separate risk capital, economic capital and regulatory capital from one another, and explain why and by which techniques economic capital is used to apportion risk capital.
- Explain how the RAROC (risk-adjusted return on capital) approach works and how capital budgeting draws on it.
- For a project, a loan or a portfolio of loans, compute RAROC and interpret it, then rank business unit results using it.
- Account for the problems of using RAROC to measure performance, among them selecting a time horizon, measuring default probability and picking a confidence level.
- Work out the hurdle rate and use it to reach business decisions through RAROC.
- Work out the adjusted RAROC of a project in order to decide whether it is viable.
- Account for the difficulties of modeling diversification benefits, in particular summing up a firm's risk capital and spreading economic capital among its business lines.
- Account for good practice when rolling out a RAROC-based method for allocating economic capital.
Range of practices and issues in economic capital frameworks
- Describe the difficulties met in implementing an economic capital framework when defining and computing risk measures, aggregating risk, validating models, modeling dependency in credit risk, evaluating counterparty credit risk, and assessing interest rate risk in the banking book.
- Set out what the Bank for International Settlements (BIS) recommends supervisors weigh in order to put internal risk measures such as economic capital, which were not built for regulation, to good use.
- Explain how adopting an economic capital framework helps and changes outcomes in four areas: managing the credit portfolio, pricing for risk, analysing how profitable customers are, and shaping management incentives.
- Outline good practice in governing an economic capital framework and judge the main concerns that arise.
Capital Planning at Large Bank Holding Companies: Supervisory Expectations and Range of Current Practice
- Describe the Capital Plan Rule of the Federal Reserve and the seven principles that define an effective capital adequacy process at BHCs (bank holding companies) it applies to.
- Describe what strong capital adequacy practice at a BHC looks like across risk identification, internal controls with model review and validation, governance, capital policy and contingency planning, stress testing, loss and revenue estimation, and RWA and balance sheet impact.
Capital Regulation Before the Global Financial Crisis
- Account for why the Basel regulations were introduced, including the main risk exposures they target, and for why they were revised over the years.
- Explain how Basel I's original guidelines arrive at risk-weighted assets and at the capital a bank must hold.
- Outline what the 1995 and 1996 amendments brought in, namely rules on netting credit exposures and ways to compute market risk capital for trading book assets.
- Set out what Basel II changed, including its three pillars.
- Contrast how Basel II derives credit risk capital under the standardized approach, under the foundation IRB approach and under the advanced IRB approach.
- Work out Basel II credit risk capital with the internal ratings-based (IRB) approach.
- Contrast how Basel II's basic indicator approach, standardized approach and AMA (advanced measurement approach) each produce a charge for operational risk.
- Give a summary of what the Solvency II framework requires of insurance companies in terms of capital.
Solvency, Liquidity, and Other Regulation After the Global Financial Crisis
- Explain the Basel 2.5 stressed VaR measure, work out its value, and then determine the market risk capital charge.
- Explain the steps that produce the incremental risk capital charge on trading book positions held by a bank.
- Outline the comprehensive risk (CR) capital charge that applies to portfolios of positions exposed to default correlation.
- Under Basel III, define Tier 1 and Tier 2 capital with their components, and calculate where suitable the required Tier 1 equity capital, the total Tier 1 capital and the total capital.
- Explain why the capital conservation buffer and countercyclical buffer were created, calculate both, and note how G-SIBs (globally systemically important banks) are treated differently.
- Explain and calculate the liquidity-risk ratios of Basel III, namely the required leverage ratio, LCR (liquidity coverage ratio) and NSFR (net stable funding ratio).
- Set out how contingent convertible bonds (CoCos) work and why banks have an incentive to issue them.
- Give examples of reforms in law and regulation that followed the 2007-2009 financial crisis.
High-level summary of Basel III reforms
- Account for why the Basel III framework needed revising, and for what the December 2017 reforms aimed to do and the effects they had.
- Summarise how the December 2017 revisions changed Basel III for credit risk (standardized and IRB approaches), the CVA risk framework, operational risk and the leverage ratio.
- Outline the revised output floor brought in by the Basel III reforms and the approaches available for computing it.
Basel III: Finalising post-crisis reforms
- Describe the components of the new standardized method for operational risk capital, namely the loss component, the internal loss multiplier and the business indicator, and compute a bank's requirement with it.
- Contrast the SMA with the AMA and other earlier capital methods for operational risk, noting what changed from one to the next.
- Describe the general and specific Basel Committee criteria for how operational loss data should be identified, collected and treated.
See how well you know Operational Risk and Resilience already: the free diagnostic covers every topic.
Start free →