RISK MANAGEMENT MODULE D QUIZ 2

A sound risk culture encourages staff to report incidents and near misses promptly, understand their control responsibilities, challenge unsafe practices and escalate issues without concealment. Management should respond constructively and reinforce accountability.

Operational risk should be considered throughout the lifecycle of a product, service, process or technology change—before launch and as it evolves. Early assessment helps identify fraud, security, processing, vendor, customer and continuity risks before exposure becomes embedded.

Consistent data standards improve comparability, aggregation and analysis across time and business units. Without common definitions and rules, apparent changes in loss trends may reflect inconsistent recording rather than real changes in risk.

Opportunity costs and indirect impacts may be relevant for management analysis, but their inclusion in formal loss data depends on the bank’s defined methodology and applicable reporting standards. The bank should distinguish realised direct losses from estimated missed income and record them consistently.

Operational risk appetite articulates the level and types of operational risk the bank is willing to accept in pursuit of its objectives. It should inform limits, thresholds, escalation, control investment and decisions to accept, mitigate, transfer or avoid risk; it does not mean the bank can eliminate every risk.

High residual risk should lead to an accountable, time-bound remediation plan addressing both the control weakness and its underlying causes. Management should assign an owner, milestones and evidence of completion, and monitor whether the residual risk falls to an acceptable level.

A KPI primarily measures performance against business objectives, while a KRI signals exposure to risk or a change in risk conditions. Some metrics can serve both purposes, but their interpretation, thresholds and escalation use should be clear.

Remote access should be limited to authorised users and managed devices, protected with strong authentication such as multifactor authentication where appropriate, encrypted connections, least-privilege permissions, monitoring and timely revocation. Controls should be aligned with the bank’s security architecture and threat profile.

A DDoS attack overwhelms a service or its supporting infrastructure with traffic from multiple sources, impairing availability. Mitigations may include upstream filtering, rate limiting, scrubbing services, resilient architecture and incident coordination.

ISO/IEC 27001 specifies requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), including risk assessment and treatment. Certification, where obtained, is not a guarantee that no incident will occur; controls must remain appropriate and effective.

Outsourcing does not remove the bank’s accountability for managing risks and meeting applicable regulatory obligations. The bank should conduct due diligence, define contractual security and service expectations, monitor performance, plan for incidents and continuity, and address exit or transition arrangements.

Audit trails record relevant system activities, transactions and changes, supporting accountability, incident investigation, fraud detection and control testing. They should be protected from unauthorised alteration and retained in line with the bank’s policies and applicable requirements.

Business continuity planning focuses on maintaining or restoring critical business services within acceptable timeframes during disruption. Disaster recovery planning focuses more specifically on recovery of technology, systems and infrastructure. The plans should be coordinated and tested together.

Disaster recovery planning establishes how IT systems, infrastructure and data are recovered after a disruptive event. It supports business continuity and should be based on business impact analysis, defined recovery objectives, tested backups and regular exercises.

Recovery Time Objective (RTO) is the target time within which a system or service should be restored after disruption. It is not the amount of data loss tolerated; that is addressed by the Recovery Point Objective (RPO).

Recovery Point Objective (RPO) specifies the maximum targeted period of data loss measured in time, based on the last recoverable data point. An RPO of 15 minutes means recovery arrangements aim to limit data loss to roughly the most recent 15 minutes, subject to the design and actual incident.

Physical climate risk arises from acute events such as floods and cyclones, and chronic changes such as rising temperatures or sea levels. These can affect bank operations, borrowers’ repayment capacity, insurance costs and collateral values, creating financial risk for the bank.

Transition risk arises from changes associated with moving toward a lower-carbon economy, including policy, legal, technology and market changes. These can weaken borrower cash flows and asset values, increasing credit and other financial risks for banks.

Green finance channels capital toward activities that provide environmental benefits, such as renewable energy, energy efficiency or climate-resilient infrastructure, subject to appropriate eligibility criteria and safeguards. A credible approach requires assessment of use of proceeds and avoidance of unsupported environmental claims.

The board and senior management should set the tone, approve or oversee risk appetite and policy, ensure clear accountability, receive meaningful risk reporting and challenge material weaknesses. They need not manage each incident personally, but must ensure the framework is effective and appropriately resourced.