Explain why new products, fresh business initiatives and mergers or acquisitions can create operational risk, and how firms can curb that exposure.
The idea
New products, new business initiatives and mergers or acquisitions raise operational risk because the firm is doing something unfamiliar. Processes, systems, valuation models, legal documentation and staff skills are untested, volumes are small at first then grow, and commercial pressure pushes timelines. Acquisitions add integration risks such as incompatible systems, data migration errors, loss of key staff, clashing cultures and control standards, and legacy problems missed in due diligence. The main defence for products is a new product approval process in which operations, technology, risk, legal, compliance and finance sign off, often with conditions such as volume limits, pilots and a post-implementation review. For acquisitions the defences are operational due diligence, a detailed integration plan, phased migration with reconciliation and rollback, and retention of key people. The exam point is that risk is highest at launch and sign-off cannot sit with sales alone.
A practice question
Which process is the primary tool for controlling the operational risk of launching a new product?
- The annual risk and control self-assessment of existing productsWhy not: Annual assessments cover existing activities and would come after the product is already live.
- A single sign-off by the head of the sponsoring businessWhy not: Business sponsors have a commercial interest, so approval needs independent functions.
- A new product approval process with sign-off from operations, risk, legal, compliance and technology - correct
- Daily profit and loss attribution once the product is tradingWhy not: P&L attribution explains results after launch; it does not check readiness beforehand.
New product approval brings the functions that must book, value, settle, report and control the product to confirm readiness before launch, usually with conditions and a later review.
A harder one
A trading desk wants to launch a complex derivative product by a sales deadline although the booking system is not ready and valuation would be done on a spreadsheet with manual entry. Which approach best controls the risk?
- Launch fully now and review the controls at year-endWhy not: Waiting for year-end leaves the weakest period uncontrolled while volume can build.
- Approve only with volume limits and compensating controls plus a later review, or delay - correct
- Let the head of the desk accept the operational risk aloneWhy not: The sponsor has a conflict of interest, and operations and risk functions must agree readiness.
- Apply lighter scrutiny because the desk has launched similar products before and knows the processWhy not: Spreadsheet and manual booking are new features here, so familiarity with similar products does not remove the need for scrutiny.
Conditional approval with limits and compensating controls caps exposure while processes are immature, and a later review checks whether the conditions were met. Without those the launch should wait.
The hardest tier
A merged bank plans to migrate 2 million accounts from the acquired bank's platform to its own. Which plan best limits operational risk?
- Migrate everything in one weekend to shorten the period of dual operation, with reconciliation afterwardsWhy not: A single cut-over with checks only afterwards leaves no chance to find defects on a small population first.
- Migrate all data as it stands without cleansing so that fidelity with the old system is preservedWhy not: Migrating known data-quality defects loads them into the new platform where they are harder to find.
- Migrate in phased waves after rehearsals, reconcile balances at each wave and keep a tested rollback option - correct
- Delegate migration to a vendor under a fixed-price contract and accept their completion certificateWhy not: A contract moves some cost but the bank remains accountable for customer balances and needs its own reconciliation.
Phased waves limit the number of accounts exposed to any defect, rehearsals expose problems before they matter, balance reconciliation proves completeness and a rollback plan limits the damage if something fails.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Risk Mitigation
- Show the various ways firms deal with operational risk exposures and weigh them against each other.
- Contrast the kinds of internal control and illustrate each kind with examples.
- Describe automating controls, designing internal controls and testing them, noting the risks and difficulties in each and how to make them work better.
- Outline techniques for raising the quality of operational processes and lowering the chance of human mistakes.
- Identify the approaches a firm ought to adopt to reduce the damage when an operational risk event occurs, and describe them.
- Describe how operational risks are transferred and how reputational risk is handled, and judge how well these work across differing circumstances.