Charta is on Google Play: practise on the go. Get the app
Charta

Show the various ways firms deal with operational risk exposures and weigh them against each other.

FRM® Part II · Operational Risk and Resilience · Risk Mitigation · FRM2.ORR.5.a

The idea

Firms have four basic responses to an operational risk exposure. They can avoid it by not entering or by leaving the activity. They can reduce it by improving controls and processes. They can transfer it through insurance, outsourcing or contractual indemnities. Or they can accept it and fund the expected losses from earnings, provisions or capital. No response removes risk completely, so each is weighed on cost against benefit, the residual risk left, and the firm's risk appetite. Reduction and acceptance suit frequent, small losses, while transfer or avoidance suits rare, severe ones. Transfer shifts the financial consequence but usually not accountability. It can also add new risks such as vendor failure or an insurer that does not pay. The exam tests matching the response to the loss profile and recognising the residual risk that remains.

Formulas

Net annual benefit of a control

net benefit = ΔEL − C

ΔEL
the fall in annual expected loss, frequency × severity before less after the control
C
the annual cost of the control

Subtract the cost from the reduction in expected loss, not from the whole baseline. Among mutually exclusive controls choose the highest net benefit, not the largest reduction.

A practice question

From the question bank, with the reason each wrong option is wrong.

A bank concludes that the operational risks of a proposed business line exceed its risk appetite and decides not to enter that business. Which response to operational risk is this?

  1. Avoidance - correct
  2. ReductionWhy not: Reduction means keeping the activity and adding controls; here the activity is dropped altogether.
  3. TransferWhy not: Transfer shifts the financial consequence to a third party through insurance or contracts; nothing is shifted here.
  4. AcceptanceWhy not: Acceptance means retaining the risk and funding losses; the bank is declining the risk instead.

Choosing not to undertake an activity so the exposure never arises is avoidance. Reduction, transfer and acceptance all leave the firm in the activity.

A harder one

A firm's main data centre is exposed to a fire that would cause a very large loss, but fire is expected only once in several decades. Which approach is typically the most efficient for this exposure?

  1. Spend whatever is needed on controls until the probability of fire is zeroWhy not: Controls cannot reduce this probability to zero and costs rise steeply for each extra reduction.
  2. Insure losses above a retention the firm can absorb, alongside continuity planning - correct
  3. Self-insure the whole exposure by provisioning annually from earningsWhy not: The loss is too large and uncertain to be absorbed from annual earnings without threatening solvency.
  4. Stop all activities that depend on the data centreWhy not: Avoidance of every dependent activity is disproportionate when transfer and planning can address the severity.

For a low-frequency, high-severity event, transfer of the tail through insurance (above an affordable retention) plus recovery planning gives the best cost to benefit trade-off.

The hardest tier

A firm expects 0.8 loss events per year with an average loss of USD 2.5 million. A control costing USD 0.7 million per year would cut event frequency by 50% and leave severity unchanged. The net annual benefit of the control is closest to:

  1. USD 0.30 million - correct
  2. USD 1.00 million per yearWhy not: Ignores the cost of the control: only the expected loss reduction of 0.8 x 2.5 x 50% is counted.
  3. USD 1.30 millionWhy not: Subtracts the cost from the full baseline expected loss of 2.0 instead of from the reduction in expected loss.
  4. USD 1.70 millionWhy not: Adds the control cost to the expected loss reduction instead of subtracting it.

Baseline expected loss = 0.8 x 2.5 = 2.0. The control halves it, a reduction of 1.0. Net benefit = 1.0 - 0.7 = 0.3 million per year, so the control passes the cost to benefit test.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Mitigation