Charta is on Google Play: practise on the go. Get the app
Charta

Use an operational risk taxonomy and illustrate the different ways operational risks can be classified in such taxonomies.

FRM® Part II · Operational Risk and Resilience · Risk Identification · FRM2.ORR.3.c

The idea

An operational risk taxonomy is a structured, hierarchical list of defined risk categories. It lets risks, events, losses and controls be labelled the same way across the firm, so they can be aggregated and compared. Risks can be classified in several ways. One is by cause, such as people, processes, systems and external events. Another is by event type, meaning what actually happened, such as internal fraud. A third is by effect or impact, meaning the type of loss, such as legal liability, write-down or regulatory penalty. A fourth is by business line or process. A good taxonomy is mutually exclusive and collectively exhaustive, so each loss has one primary home, and it moves from broad to granular levels. The classic flaw is mixing causes, events and effects at the same level, which creates overlap and double counting. Loss data are usually classified by event type, with cause recorded as an attribute.

A practice question

From the question bank, with the reason each wrong option is wrong.

What is the main purpose of an operational risk taxonomy?

  1. To estimate the frequency and severity distributions of losses within each category, so that they can be used in a capital model and in reporting.Why not: Estimating severity is a measurement task; a taxonomy only organises and labels.
  2. To give a structured, hierarchical set of defined categories so risks, events and controls are labelled consistently firm-wide. - correct
  3. To set regulatory capital by assigning a fixed percentage to each category.Why not: A taxonomy does not set capital percentages; it is a classification structure.
  4. To replace risk self-assessments with a standard list of risks that does not need review.Why not: A taxonomy supports risk assessment but does not replace it, and it must be reviewed as the business changes.

A taxonomy gives the firm a common language: defined categories at several levels so that risks and losses are classified, aggregated and compared consistently. It measures and sets nothing by itself.

A harder one

A clerk keys in the wrong settlement amount, and the bank overpays by USD 2 million and recovers USD 1.5 million. Which cause, event and effect classification is correct?

  1. Cause: human error (people); event: data-entry error in settlement; effect: financial loss from the overpayment net of the recovery. - correct
  2. Cause: the overpayment; event: human error; effect: data-entry error.Why not: Mixes the dimensions: the overpayment is an outcome, and a data-entry error is an event rather than an effect.
  3. Cause: financial loss; event: overpayment; effect: human error.Why not: Reverses the causal chain, treating the loss as the cause and the human error as the effect.
  4. Cause: system failure; event: external fraud; effect: reputational damage.Why not: Nothing in the facts indicates a system failure, a third-party fraud or reputational harm.

The root cause is human error, the event is the data-entry mistake in settlement, and the effect is the financial loss, which is USD 0.5 million net of the USD 1.5 million recovered. Cause leads to event, which leads to effect.

The hardest tier

A firm's taxonomy has 400 Level 3 categories. Sixty percent have never recorded a loss, and loss mappers often disagree on where a loss belongs. Which response is best?

  1. Add more Level 3 categories so that each loss fits exactly one of them.Why not: More categories make data sparser and consistent mapping harder, which worsens both problems.
  2. Remove the Level 1 categories to shrink the taxonomy.Why not: Upper levels are what allow aggregation and reporting; removing them destroys comparability.
  3. Map each loss to every category that could apply, so that none is missed.Why not: Multiple mapping double-counts losses and breaks mutual exclusivity.
  4. Keep a stable, mutually exclusive upper level for aggregation and reporting, and consolidate Level 3 categories that are too fine to be mapped consistently. - correct

A usable taxonomy balances granularity with consistency. Excessive detail yields sparse data and inconsistent mapping, so the firm should keep a robust upper structure and consolidate the overly granular levels.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Identification