Chapter 3 - Operational Risk

Question 1

What is operational risk defined as?

Answer 1

The risk of loss arising from inadequate or failed internal processes, people, and systems, or from external events

This definition includes legal risk but excludes strategic and reputational risk.

Question 2

What are the areas covered by the Basel Committee on Banking Supervision (BCBS) guidance on operational risk management?

Answer 2

• Fundamental Principles
• Governance
• Risk management environment
• Information and Communications Technology (ICT)
• Business continuity planning (BCP)
• Role of disclosure

(Should be 9 categories?)

Question 3

What are the 2 Fundamendal Principles for Operational Risk Management?

Answer 3

Principle 1:
* The board should take the lead in establishing a strong risk management culture, implemented by senior management

Principle 2:
* Banks should develop, implement, and maintain an operational risk management framework that is fully integrated into the bank’s overall risk management processes.

Implemented by senior management.

Question 4

What are the 3 Governance Principles for Operational Risk Management?

Answer 4

Board of Directors:
Principle 3:
* The board of directors should approve and periodically review the operational
risk management framework, and ensure that senior management implements the policies,
processes, and systems of the operational risk management framework effectively at all
decision levels.
Principle 4:
* The board of directors should approve and periodically review a risk appetite
and tolerance statement for operational risk that articulates the nature, type, and levels of
operational risk the bank is willing to assume.

Senior Management
Principle 5:
* Senior management should develop, for approval by the board of directors, a clear,
effective, and robust governance structure with well-defined, transparent, and consistent
lines of responsibility.

Question 5

What are the 4 Risk Management Environment Operational Risk Management Principles?

Answer 5

identification and assessment
Principle 6:
Senior management should ensure the comprehensive identification and
assessment of the operational risk inherent in all material products, activities, processes, and
systems, to make sure the inherent risks and incentives are well understood.
Principle 7:
Senior management should ensure that the bank’s change management process
is comprehensive, appropriately resourced, and adequately articulated between the relevant
lines of defence.

monitoring and reporting
Principle 8:
Senior management should implement a process to regularly monitor operational
risk profiles and material operational exposures. Appropriate reporting mechanisms should
be in place at the board of directors, senior management, and business unit levels, to support
proactive management of operational risk.

control and mitigation
Principle 9:
Banks should have a strong control environment that utilises policies, processes
and systems, appropriate internal controls, and appropriate risk mitigation and/or transfer
strategies.

Question 6

What is the Operational Risk Management Principle for ICT?

Answer 6

Principle 10:
Banks should implement a robust ICT risk management programme in alignment
with their operational risk management framework.

Question 7

What is the Operational Risk Management Principle for Business Continuity Planning (BCP)?

Answer 7

Principle 11:
Banks should have business continuity plans in place to ensure their ability to
operate on an ongoing basis and limit losses in the event of a severe business disruption.
Business continuity plans should be linked to the bank’s operational risk management
framework.

Question 8

What is the Operational Risk Management Principle for the Role of Disclosure?

Answer 8

Principle 12:
A bank’s public disclosures should allow stakeholders to assess its approach to
operational risk management and its operational risk exposure.

Question 9

The risk management three lines of defence model.

Answer 9

1. Management team
2. Independent corporate operational risk function
3. Independent assurance function to verify and validate the ORMF (e.g. internal/external audit)

Question 10

What is the responsibility of the management team in the first line of defence?

Answer 10

Identifying, assessing, monitoring, and managing inherent operational risks

Question 11

What does the second line of defence in risk management provide?

Answer 11

An independent view of the business units’…
1. Risk identification and assessment processes
2. Key operational risks
3. Risk and control effectiveness
4. Compliance with risk tolerances.

Challenges on the implementation of…
1. Risk management tools
2. Processes
3. Measuring activities
4. Reporting systems

Question 12

What does the third line of defence in risk management provide?

Answer 12

Provides a completely independent view of the effectiveness of the bank’s ORMF

Typically reports to the board

Function:
1. Reviews the design and implementation of the ORMF and governance processes
2. Reviews validation processes to ensure that they are consistent with the bank’s
policies
3. Ensuring that risk quantification systems are robust, i.e. by validating that inputs,
assumptions, and methodologies are correct, and that risk quantification accurately
reflects the bank’s risk profile
4. Ensuring that management responds appropriately to findings raised and regularly
reports on pending and closed issues

Question 13

What is operational resilience?

Answer 13

The ability of a bank to continue to deliver critical operations during and after disruption

This includes identifying threats and recovering from disruptive events.

Question 14

What are the 7 BCBS Principles of Operational Resilience?

Answer 14

1. Governance
2. Operational risk management
3. Business continuity planning and testing
4. Mapping interconnections and interdependencies
5. Third-party dependency management
6. Incident management
7. ICT, including cyber security

Explain Each (page 83)

Question 15

Examples of Risk Transfer

Answer 15

• Insurance (including fidelity bond insurance, liability insurance, property insurance, etc.)
• Alternative Risk Transfer (including derivative instruments, catastrophe bonds, etc.)

Question 16

What is a catastrophe bond?

Answer 16

A financial instrument used to transfer operational risk, including cyber risk exposures, to capital markets

Catastrophe bonds can insure against various operational risk losses such as fraud, unauthorized activity, and compliance issues.

Question 17

What are the three approaches defined by the Basel II Framework for calculating regulatory capital requirements for operational risk?

Answer 17

• Basic indicator approach (BIA)
• Standardised approach (SA)
• Advanced measurement approaches (AMAs)

Question 18

How is capital for operational risk calculated under the Basic Indicator Approach (BIA)?

Answer 18

As a fixed percentage of the average positive annual gross income over the previous three years, excluding years with negative gross income

This approach is the simplest of the three defined by Basel II.

Question 19

What is the Standardised Approach (SA) in the context of operational risk?

Answer 19

An approach where banks’ operating activities are divided into eight business lines, and operational risk is measured as a percentage of the annual gross income for each line

Negative gross income can offset positive gross income at the discretion of local regulators.

Question 20

List the eight business lines defined under the Standardised Approach (SA).

Answer 20

• Corporate finance
• Trading and sales
• Retail banking
• Commercial banking
• Payment and settlement
• Agency services
• Asset management
• Retail brokerage

Question 21

What is the difference between the Alternative Standardised Approach (ASA) and the Standardised Approach (SA)

Answer 21

ASA is the same as for SA except for two business lines:
1. Retail banking
2. Commercial banking

Gross loans and advances are multipled by a fixed factor “m” for these business lines, instead of gross income.

Same betas as SA.

Question 22

What does the Advanced Measurement Approach (AMA) allow banks to do?

Answer 22

Calculate regulatory capital using a risk measure generated by the bank’s own internal operational risk management system

This approach requires regulatory approval and must meet predefined criteria.

Question 23

What types of operational risk losses must be modeled under the Advanced Measurement Approach (AMA)?

Answer 23

• Internal fraud
• External fraud
• Employment practices and workplace safety
• Clients, products, and business practices
• Damage to physical assets
• Business disruption and system failures
• Execution, delivery, and process management

Question 24

What are the two underlying assumptions for the New Standardised Approach (2023)

Answer 24

1. That banks’ operational risk increases at an increasing rate with size
2. That banks which have experienced higher operational risk losses in the past are more likely to do so in the future.

Question 25

Requirements to Qualify for AMA

Answer 25

**Qualitative Criteria** 1. Management and board oversight of operational risk management 2. Sound operational risk systems in place 3. Sufficient resources and control functions to understand and use this approach 4. Independent operational risk function to design and implement a suitable operational risk management framework 5. Internal operational risk system integrated with day-to-day risk management processes. Outputs must be used for reporting, analysis, and capital allocation 6. A suitable approach for allocating operational risk capital to key business lines, and incentives in place to improve operational risk management throughout the firm 7. Regular reporting of operational risk exposures and losses to management and the board 8. Well-documented operational risk system and a process to ensure compliance with internal policies and controls 9. Regular reviews by internal and external auditors of activities of business units and the independent operational risk function. **Quantitative Criteria** 1. The approach used to measure operational risk must capture potentially severe “tail” loss events and must meet a soundness standard comparable to an internal-ratingsbased approach for credit risk (i.e. measure losses over a one year holding period and 99,9th percentile confidence interval) 2. The bank must have rigorous model-development procedures and independent model validation 3. The bank should calculate operational risk capital as the sum of expected losses and unexpected losses unless it can be shown that expected losses are allowed for appropriately in internal processes (e.g. accounting provisions, budgets) 4. The bank’s risk measurement must be sufficiently granular to capture the key drivers of operational risk, particularly in the tail of the distribution 5. The bank must demonstrate that correlation assumptions between different risk types are appropriate 6. Strict requirements on the quality, relevance, and credibility of internal and external loss data.

Question 26

What is the purpose of business continuity and disaster recovery plans in operational risk management?

Answer 26

To ensure banks can continue operations or recover in a timely manner following a disruption ## Footnote These plans have gained importance since the pandemic, emphasizing remote work capabilities.

Question 27

What are the BCBS principles behind business continuity planning?

Answer 27

1. Board and senior management responsibility 2. Major operational disruptions 3. Reocvery objectives 4. Communications 5. Cross-border communications 6. Testing 7. Business continuity management reviews by financial authorities

Question 28

Define conduct risk.

Answer 28

The risk of actions taken by a financial institution that lead to customer detriment, market instability, or hindered competition ## Footnote Effective management of conduct risk is crucial to mitigate regulatory action and reputational damage.

Question 29

What are some key controls that banks should establish to manage conduct risk?

Answer 29

* Formal complaints procedure * Whistle-blowing procedure * Transaction monitoring systems * Restrictions on personal account dealing * Chinese walls between divisions

Question 30

Fill in the blank: The capital requirement under the new standardised approach is determined by multiplying the business indicator component (BIC) by the _______.

Answer 30

internal loss multiplier (ILM)

Question 31

What is a key challenge for banks using Advanced Measurement Approaches (AMAs)?

Answer 31

Excessive variability in risk-weighted assets, making it difficult for stakeholders to trust reported numbers ## Footnote Different internal methodologies can complicate comparisons of capital ratios across banks.

Question 32

What is the Financial Sector Regulation Act of 2017?

Answer 32

Legislation that empowers the FSCA to set conduct standards for financial institutions in South Africa ## Footnote This act is part of a broader regulatory framework for the financial services industry.

Question 33

What are the expected outcomes of treating customers fairly according to the FSCA?

Answer 33

1. TCF is central to the bank’s culture 2. Products are suitably designed for targeted customers 3. Clear information is provided to customers 4. Advice provided is suitable to customers' needs 5. Financial products perform as expected 6. No unreasonable barriers post-sale

Question 34

What is the purpose of the draft Conduct of Financial Institutions (CoFI) Bill?

Answer 34

To consolidate conduct requirements for financial institutions into a single bill ## Footnote The CoFI Bill aims to simplify regulations and ensure compliance across the industry. Part of the Twin Peaks Regulatory model

Question 35

What is the definition of outsourcing in a banking context?

Answer 35

Using a service provider to perform a business activity or function on behalf of the bank ## Footnote Outsourcing can involve third parties or affiliates within a corporate group.

Question 36

What are some operational risks associated with outsourcing?

Answer 36

1. Reduced management control 2. Altered risk profile of the bank 3. Increased complexity of relationships

Question 37

What should a bank's outsourcing policy include?

Answer 37

1. Identification and assessment of risks (board-approved outsourcing policy) 2. Due diligence processes for service providers 3. Valid legal contracts 4. Monitoring processes 5. Contingency and business continuity plans 6. Outsourcing plan (including risk assessments) 7. Administrative measures and reporting 8. Notify regulator of outsourcing, and demonstrte the steps followed to verify the service provider's performance levels

Question 38

What I are the key risks and issues associated with machine learning algorithms?

Answer 38

* Complexity of models is much greater, making it more difficult to identify model risks * Many algorithms have a “black-box” approach and model results cannot be easily explained (if at all). This makes machine learning algorithms less transparent and less interpretable * These models are typically built using specialised software and this requires significant computing power to develop and implement * These algorithms can amplify bias, in particular if the data that the model were trained on are biased, but can also introduce unintended bias against certain groups of people. * AI / ML models also typically use a large number of inputs, relative to more traditional models. This can result in models being much more complex than necessary, resulting in spurious accuracy or overfitting of training data. * Banks also need to ensure that their data governance structures are suitable to ensure that the quality and quantity of data is sufficient for the effective training of machine learning models.

Question 39

What is Benford's Law?

Answer 39

A statistical principle stating smaller digits occur more frequently than larger digits in naturally occurring datasets ## Footnote This law can be used to detect anomalies in transaction data.

Question 40

What is the importance of a risk management framework for AI/ML models?

Answer 40

To manage complexities and unintended consequences of machine learning algorithms ## Footnote Such frameworks help ensure that models are used appropriately and effectively.

Question 41

What constitutes fraud in a banking context?

Answer 41

Intentional deceptive behavior aimed at unlawful gain, often monetary ## Footnote Examples include accounting fraud, credit card fraud, and money laundering.

Question 42

What is the trade-off in fraud detection models?

Answer 42

Between model sensitivity and customer experience ## Footnote More sensitive models may lead to increased false positives, affecting customer satisfaction.

Question 43

What is the role of digital analysis in fraud detection?

Answer 43

To identify anomalies in transaction data based on statistical principles like Benford's Law ## Footnote This approach helps detect potential fraudulent activities.

Question 44

What are some IT risks faced by banks?

Answer 44

["System failures leading to data loss", "Undetected software errors", "Increased complexity of data systems"]

Question 45

What should an IT risk management framework include?

Answer 45

["Policies and procedures for managing IT risks", "Processes for detecting and limiting risks", "Regular independent reviews", "Roles and responsibilities for managing IT risk", "Ongoing monitoring and risk metrics"]

Question 46

What is the first step in IT risk management?

Answer 46

Identify and prioritise IT assets in terms of criticality to business operations.

Question 47

What should banks assess regarding IT risks?

Answer 47

Identify and assess the likelihood and impact of current and emerging IT risks.

Question 48

What practices should be implemented to mitigate IT risks?

Answer 48

Implement appropriate practices and controls to mitigate risks according to IT asset criticality and bank’s risk tolerance.

Question 49

What is necessary for ongoing IT risk management?

Answer 49

Establish ongoing monitoring and risk metrics for IT risks and establish a risk register.

Question 50

What people management procedures should banks establish?

Answer 50

Screening of employees, vendors, and contractors, and providing appropriate training.

Question 51

Why are dedicated IT resources important in banks?

Answer 51

To ensure all business units are covered and not exposing other divisions to risk.

Question 52

What should an IT services framework include?

Answer 52

Governance, processes and procedures for change management, software release management, incident management, and capacity management.

Question 53

What oversight should be included in the bank's ERMF?

Answer 53

Oversight of IT risk management.

Question 54

What is the purpose of a centralized IT risk governance forum?

Answer 54

To address IT risks and design a governance framework for new IT systems integration.

Question 55

What must banks do to protect sensitive information?

Answer 55

Define, document, and implement solutions to protect sensitive information, including customer records.

Question 56

What measures should be implemented for online transactions?

Answer 56

Use second-factor authentication or one-time PINs to verify identity or approve transactions.

Question 57

What should a bank's IT project management framework include?

Answer 57

Governance structures, stakeholder engagement, risk management, change control, cost, and benefit realization.

Question 58

What should be included in a bank's business continuity plan?

Answer 58

Procedures and policies for recovery and resumption of IT systems after a disruption.

Question 59

What is a recommended approach for data backup?

Answer 59

Use cloud computing or storage solutions for efficient data backups.

Question 60

What should banks ensure when outsourcing IT services?

Answer 60

That relevant regulatory requirements regarding outsourcing of material business activities are met.

Question 61

What is the role of the bank's internal control functions?

Answer 61

To independently review and ensure compliance of the bank's IT activities with policies and regulations.

Question 62

What is cybercrime?

Answer 62

A malicious attack on or using a computer or computer network.

Question 63

What are common objectives of cybercriminals targeting banks?

Answer 63

* Impersonating people to defraud banks * Holding individuals or institutions to ransom * Selling data to criminal third parties.

Question 64

What types of attacks do cybercriminals use against banks?

Answer 64

* Data theft * Malicious programs * Denial-of-service attacks.

Question 65

What measures should banks implement to combat cybercrime?

Answer 65

* Establish firewalls * Ensure secure password protection * Monitor network activity * Keep software security patches updated.

Question 66

What is phishing in the context of cybercrime?

Answer 66

A social engineering tactic to trick individuals into providing security information.

Question 67

What should banks do to enhance employee awareness of cybercrime?

Answer 67

* Establish reporting systems for suspected phishing * Implement minimum password standards * Provide regular cybersecurity training.

Question 68

What is the importance of a social media policy for banks?

Answer 68

To manage risks related to bank security and employee behavior on social media.

Question 69

How can banks mitigate losses from cybercrime?

Answer 69

By investing in cybersecurity and cooperating with other banks to share vulnerabilities.

Question 70

What is the role of insurance in cyber risk management?

Answer 70

To provide coverage against cybercrime and business disruption, but not a substitute for risk management.

Question 71

What unique challenges do cyber risks present to banks?

Answer 71

* Persistent campaigns by sophisticated attackers * Interconnectedness creating multiple attack vectors * Potential ineffectiveness of traditional risk management.

Question 72

What are the key principles of cyber resilience according to BIS guidance?

Answer 72

* Governance * Identification * Protection * Detection * Response and recovery * Testing * Situational awareness * Learning and evolving.

Question 73

What should the governance framework for cyber resilience include?

Answer 73

A strategy defining risk tolerance, risk identification, mitigation, and management.

Question 74

What is the purpose of identifying functions and assets in cyber resilience?

Answer 74

To perform risk assessments and prioritize cyber resilience efforts.

Question 75

What protective controls should banks implement?

Answer 75

* Encryption * Authentication * Access control * Cyber risk management in change processes.

Question 76

What is the importance of continuous monitoring in cyber resilience?

Answer 76

To detect anomalous activities and vulnerabilities in real-time.

Question 77

What should banks do immediately after detecting a cyber attack?

Answer 77

Contain the attack and initiate recovery efforts.

Question 78

What types of testing should banks conduct for cyber resilience?

Answer 78

* Vulnerability assessments * Scenario-based testing * Penetration tests * Red team tests.

Question 79

What is the significance of situational awareness in cyber resilience?

Answer 79

To identify cyber threats that could materially affect the bank's operations.

Question 80

How can banks learn from cyber events?

Answer 80

By identifying key lessons from past incidents and monitoring technological developments.

Question 81

What does the Reserve Bank’s Guidance Note G4/2017 address?

Answer 81

The adequacy of banks' cyber resilience policies, processes, and practices.

Question 82

What important points should be included in an IT risk management framework?

Answer 82

Defined roles and responsibilities for managing IT risk, including the board, senior management, and the IT risk management team ## Footnote Additional points include policies and procedures for managing IT risks, processes for detecting risks, independent reviews, identification of critical IT assets, assessment of IT risks, implementation of controls, ongoing monitoring, and people management procedures.

Question 83

What policies should be in place to manage IT risks?

Answer 83

Policies, standards, and procedures for managing IT risks and protecting IT assets ## Footnote This includes clear guidelines on how to handle various IT risk scenarios.

Question 84

What processes should be implemented to control major IT risks?

Answer 84

Processes for detecting, controlling, and limiting major risks in a manner proportional to the level of risk ## Footnote This ensures that the response to risks is appropriate to the severity of the threat.

Question 85

What is essential for the ongoing assessment of IT risks?

Answer 85

Independent reviews and regular updates to take into account developments in the IT risk landscape ## Footnote This helps organizations stay current with emerging risks and management practices.

Question 86

How should banks prioritize their IT assets?

Answer 86

Identification and prioritisation of IT assets in terms of criticality to business operations ## Footnote This ensures that essential systems receive the appropriate level of protection.

Question 87

What should banks assess regarding current and emerging IT risks?

Answer 87

The likelihood and impact of current and emerging IT risks identified and assessed ## Footnote This involves evaluating potential threats and their implications for the organization.

Question 88

What practices should banks implement to mitigate IT risks?

Answer 88

Implementation of appropriate practices and controls to mitigate risks in accordance with the criticality of the relevant IT asset and the bank’s risk tolerance ## Footnote This aligns risk management strategies with organizational priorities.

Question 89

What kind of monitoring should be conducted for IT risks?

Answer 89

Ongoing monitoring and risk metrics for IT risks and establishment of a risk register ## Footnote This helps in tracking risks and ensuring timely responses.

Question 90

What people management procedures should banks have?

Answer 90

People management procedures, including screening of employees, vendors, and contractors, and providing appropriate training ## Footnote This reduces risks associated with human factors in IT security.

Question 91

What is a key component of a conduct risk framework in banks?

Answer 91

A formal complaints procedure, where complaints are logged and reviewed as part of the conduct risk framework ## Footnote This allows for systematic handling of issues that may arise.

Question 92

What is necessary to support whistle-blowing in banks?

Answer 92

A whistle-blowing procedure and suitable protection mechanisms for whistle-blowers ## Footnote This encourages reporting of conduct risks without fear of retaliation.

Question 93

What should banks implement for transaction monitoring?

Answer 93

Suitable transaction monitoring systems in place ## Footnote This helps in identifying unusual patterns that could indicate conduct risks.

Question 94

What restrictions should banks impose to manage conduct risk?

Answer 94

Restrictions on personal account dealing ## Footnote This prevents conflicts of interest among employees.

Question 95

What is the impact of outsourcing on a bank's operational risk?

Answer 95

Banks are exposed to significant operational risk through their arrangements with external vendors when outsourcing material activities and functions ## Footnote This can lead to loss of direct control and increased risk exposure.

Question 96

How does the complexity of outsourcing relationships affect risk?

Answer 96

The risk increases as the number and complexity of outsourcing relationships increases ## Footnote More relationships can lead to greater potential for mismanagement and oversight issues.

Question 97

What should banks have to manage outsourcing risks effectively?

Answer 97

A board-approved outsourcing policy governing how they will identify, assess, manage, mitigate, and report on risks related to outsourcing arrangements ## Footnote This formalizes the approach to outsourcing and risk management.

Question 98

What is necessary for the selection of service providers in outsourcing?

Answer 98

Create suitable due diligence processes for selecting service providers ## Footnote This ensures that vendors meet the bank's risk and operational standards.

Question 99

What should banks ensure regarding contracts with third parties?

Answer 99

Ensure valid legal contracts are in place for outsourcing with third parties ## Footnote This protects the bank's interests and clarifies expectations.

Question 100

What monitoring processes should banks implement for outsourced functions?

Answer 100

Have suitable monitoring processes in place ## Footnote This allows banks to oversee the performance and compliance of outsourced activities.

Question 101

What plans should banks develop for continuity in outsourcing?

Answer 101

Develop viable contingency and business-continuity plans ## Footnote This prepares banks for potential disruptions in outsourced services.

Question 102

What must banks demonstrate to regulators regarding outsourcing?

Answer 102

Be able to demonstrate to the regulator the steps followed to verify a service provider’s performance levels ## Footnote This ensures transparency and accountability in outsourcing arrangements.

Question 103

What should banks notify regulators about concerning outsourcing?

Answer 103

Notify the regulator of such outsourcing ## Footnote This ensures that regulatory bodies are aware of the bank's outsourcing activities.

Question 104

Principle List

Answer 104

BCBS (9 principles from section 1)

Question 105

Common approaches to identifying fraud

Answer 105

* Statistical outliers * Classification using machine learning * Digital analysis (Benford’s law) * Duplication testing