Charta is on Google Play: practise on the go. Get the app
Charta

Review the top-down and bottom-up methods and instruments available for spotting operational risks.

FRM® Part II · Operational Risk and Resilience · Risk Identification · FRM2.ORR.3.a

The idea

Operational risks are found by two complementary routes. Top-down methods start from the institution as a whole and work downward. They include senior-management scenario workshops, firm-wide analysis of external loss data and industry benchmarks, review of aggregate loss and earnings volatility, and emerging-risk scanning. They are quick, strategic and good at tail events, but coarse and judgement-driven. Bottom-up methods start at process or business-unit level and work upward. They include risk and control self-assessment (RCSA), process mapping, internal loss and near-miss collection, key risk indicators (KRIs), audit findings and new-product reviews. They are detailed and actionable, but can miss risks that sit between units or have never occurred. Good practice combines both. The usual trap is treating one route as sufficient, or confusing identification (what could go wrong) with measurement (how large and how likely).

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement best describes a top-down approach to identifying operational risks?

  1. It starts from the firm-wide view, using management judgement, scenario workshops and external data to find major risk themes, then cascades them down. - correct
  2. It starts from detailed process maps in each business unit and aggregates the findings upward to the firm level.Why not: Describes the bottom-up approach, where identification starts at process level and works upward.
  3. It relies solely on statistical extrapolation of the firm's own internal loss history, fitted to a severity distribution, to estimate firm-wide exposure without expert judgement.Why not: Confuses top-down identification with a purely quantitative measurement exercise that ignores judgement and external data.
  4. It starts from the regulatory capital figure and allocates it to business lines in proportion to gross income.Why not: Confuses top-down risk identification with top-down capital allocation, which identifies no specific risks.

Top-down identification works from the whole institution downward: senior management, scenario workshops, external data and thematic reviews pick out the big risk themes, which are then cascaded to units. Process-level aggregation is bottom-up, and capital allocation is not an identification method.

A harder one

A bank has thorough RCSAs in every business line, yet it suffers a severe loss when a payment-processing vendor shared by five units fails. Which statement best identifies the weakness and the remedy?

  1. The units rated their controls too harshly; drop self-assessment altogether and rely on external loss data from other institutions alone to size the exposure.Why not: Misreads the problem: the gap is a cross-unit blind spot, not harsh scoring, and dropping bottom-up methods removes useful detail.
  2. The units had too few internal losses; the remedy is to wait until enough losses accumulate to model.Why not: Waiting for losses is reactive, while identification should be forward-looking; it also ignores the shared-vendor dependency.
  3. Unit-level assessments can miss risks that cut across units; add top-down scenario analysis of shared dependencies alongside the RCSAs. - correct
  4. Bottom-up methods are inherently unreliable; the remedy is to abandon them and use only top-down workshops.Why not: Overcorrects: the approaches are complementary, and top-down alone is coarse and judgement-dependent.

Bottom-up reviews see each unit separately, so a vendor serving five units can fall between them. Top-down scenario work looks at concentrations and shared dependencies. Good practice combines the two rather than discarding either.

The hardest tier

A bank is about to launch a new retail lending product with no operating history. Which approach to identifying its operational risks is most appropriate?

  1. Rely on the internal loss database, because actual recorded losses are the most objective and verifiable evidence of risk, and review the product once enough losses accumulate.Why not: A new product has no loss history, so the database cannot reveal its risks before launch.
  2. Map the end-to-end workflow, run an RCSA with the process owners, and cross-check against external events on similar products. - correct
  3. Wait for KRIs to breach thresholds after launch and investigate only then.Why not: KRIs need data and thresholds to exist; waiting for a breach is reactive and risks losses on a product that was never assessed.
  4. Use the firm's aggregate earnings volatility to estimate a loss figure for the product.Why not: Aggregate volatility is a coarse top-down measure; it neither identifies specific process risks nor relates to this product.

With no history, identification must be forward-looking: process mapping and an RCSA expose the product's specific risks, while external events on comparable products test for what the team has missed. Loss data and KRIs both depend on experience that does not yet exist.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Identification