Charta is on Google Play: practise on the go. Get the app
Charta

Describe how operational risks are transferred and how reputational risk is handled, and judge how well these work across differing circumstances.

FRM® Part II · Operational Risk and Resilience · Risk Mitigation · FRM2.ORR.5.g

The idea

Operational risk can be transferred through insurance, outsourcing and contracts, captive insurers and some capital-market instruments. For an insurance policy, the firm retains losses up to the deductible, the insurer pays above it up to the limit, and the firm retains anything above the limit. Let the excess be the loss above the deductible, floored at zero. Excess = max(Loss − Deductible, 0). The insurer then pays the excess, capped at the limit. Payout = min(Excess, Limit). Insurance works best for rare, severe, well-defined losses. It works poorly for frequent small losses, which fall inside the deductible. Limits to effectiveness include exclusions, basis risk where the cover does not match the actual loss, delays in payment, the insurer's credit quality, and moral hazard. Fines and lost franchise value are often uninsurable. Reputational risk arises mainly as a consequence of other failures, so it is managed by preventing those events, sound conduct and culture, and a fast, honest crisis response rather than by transferring it. The exam asks whether a transfer actually works in the stated circumstances.

Formulas

Insurer's payout with a deductible and a limit

payout = min(max(L − D, 0), M)

L
the loss
D
the deductible, retained by the firm
M
the policy limit on what the insurer pays

The firm retains L minus the payout: the deductible plus anything above the limit. Frequent losses below the deductible are never paid.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which approach is generally the most effective way to manage reputational risk?

  1. Buy insurance that fully covers the brand value and any loss of customers that follows an incidentWhy not: Brand and franchise value are generally not insurable in full and cover would not restore trust.
  2. Wait for media attention to fade before respondingWhy not: Delays let others shape the story and typically increase the damage.
  3. Prevent the underlying failures through sound conduct and controls and respond fast and openly - correct
  4. Hold regulatory capital equal to the estimated brand valueWhy not: Capital absorbs loss but does not prevent reputational damage or restore customer confidence.

Reputational damage usually follows other events such as misconduct, outages or breaches. The best protection is to prevent them, and to respond quickly and honestly if they occur.

A harder one

A firm suffers a loss of USD 14 million. Its policy has a deductible of USD 2 million and a limit of USD 9 million on what the insurer pays after the deductible. The amount of the loss retained by the firm is closest to:

  1. USD 2 millionWhy not: Counts only the deductible and forgets that the loss above the limit is also retained.
  2. USD 7 millionWhy not: Adds the deductible a second time to the amount above the limit: 14 - 9 + 2.
  3. USD 9 millionWhy not: Reports the insurer's payout rather than the retained amount.
  4. USD 5 million - correct

Insurer payout = min(14 - 2, 9) = 9 million. Retained = 14 - 9 = 5 million (the 2 million deductible plus the 3 million above the limit).

The hardest tier

A firm suffers fraud losses of about USD 0.4 million a year in many small incidents. An insurer offers cover with a USD 0.5 million deductible per loss. What is the likely outcome?

  1. The policy would cover these frequent losses in full, removing the need to improve controlsWhy not: Each loss is below the deductible so the firm would still bear it, and insurance does not replace controls.
  2. The deductible is irrelevant because insurers pay from the first dollar of any lossWhy not: Deductibles do apply per loss; they are the part retained before the insurer pays.
  3. The cover would be eligible only if the firm had no controls, because of moral hazardWhy not: Insurers expect adequate controls; the problem is the structure, not an absence of controls.
  4. The policy would rarely pay out, so the firm would retain almost all losses and still pay the premium - correct

With each incident far smaller than the deductible, the policy would almost never respond. For high-frequency low-severity losses the efficient answer is controls and acceptance, with insurance kept for rare large events.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Risk Mitigation