RISK MANAGEMENT MODULE D QUIZ 1

External loss data can provide information about rare but severe events that the bank has not experienced internally, such as major cyber incidents or large-scale processing failures. It should be assessed for relevance, scale and comparability rather than copied mechanically into the bank’s own risk estimates.

Root-cause analysis seeks to identify underlying causes and contributing factors rather than merely correcting individual errors. In this example, inadequate change testing and governance may be systemic causes; remediation should address those causes and verify that recurrence risk is reduced.

Scenario analysis considers plausible severe events, including events with limited internal loss history. It can help assess potential impact, control gaps and preparedness, and supports forward-looking risk assessment. Scenarios should be credible, documented and reviewed by knowledgeable stakeholders.

Patch management requires identifying, prioritising, testing and deploying security updates in a controlled and timely way. Where immediate patching is not possible, compensating controls and documented risk acceptance may be needed until remediation is completed.

Formal change management reduces the chance that untested or unauthorised changes cause outages, data errors or security weaknesses. Approval, testing, segregation of duties, controlled deployment and rollback arrangements help maintain service reliability and traceability.

Confidentiality protects information from unauthorised disclosure; integrity protects its accuracy and completeness against improper alteration; availability ensures authorised users can access systems and information when required. Preventing unauthorised changes to account balances is an integrity control.

The response should contain the incident to limit spread, notify the designated security/incident team, preserve relevant evidence and logs, assess affected systems and transactions, and follow recovery and communication procedures. Specific actions should be proportionate to the incident and the bank’s approved playbook.

Operational risk definition includes inadequate or failed internal processes, people and systems, or external events. Strategic and reputational risks are generally not included in this definition, although operational events can cause reputational damage.

Internal fraud involves acts intended to defraud, misappropriate property or circumvent regulations or bank policy, involving at least one internal party. The precise event classification should follow the bank’s adopted taxonomy and facts of the incident.

External fraud includes fraud by a third party, such as phishing, impersonation or other unauthorised attempts to obtain money or information. The bank may also face technology and conduct impacts, but the primary event described is external fraud.

A sound framework establishes governance and accountability, risk identification and assessment, controls, monitoring, reporting, escalation and mitigation. It should be embedded in business processes and supported by senior management and board oversight.

The first line consists of business and operational management that owns and manages risks arising from its activities and operates day-to-day controls. The risk/compliance functions provide oversight and challenge, while internal audit provides independent assurance.

RCSA helps business units identify operational risks in their activities, assess inherent risk, evaluate control design and effectiveness, and determine residual risk and remediation priorities. It is not a substitute for independent assurance or incident reporting.

Inherent risk is the level of risk before controls are considered. Residual risk is the risk remaining after accounting for the design and operating effectiveness of controls. The residual risk should be assessed against risk appetite and treated if unacceptable.

A control’s existence or documented design does not prove it operates effectively. Assessment should consider both design adequacy and operating effectiveness, using evidence such as testing, records, observation and exception data. An ineffective control may leave residual risk higher than expected.

High inherent risk combined with weak controls will generally lead to elevated residual risk and a high-priority risk zone under the bank’s scoring methodology. The exact colour or numeric rating depends on the bank’s approved matrix; action plans and escalation should follow that methodology.

A KRI is a measurable indicator that signals increasing exposure or changes in risk. Examples include failed transactions, unresolved exceptions, system downtime or overdue access reviews. A KRI can provide an early warning but does not itself prove that a loss has occurred.

KRI thresholds should be linked to defined monitoring, reporting and escalation procedures. A red-threshold breach should trigger investigation, timely escalation to accountable management, assessment of customer and operational impact, and corrective action under the bank’s framework.

Internal loss data supports analysis of loss frequency, severity, business-line and event-type patterns, root causes, control weaknesses and emerging trends. Consistent definitions and recording thresholds improve comparability over time and support risk decisions; data collection should follow the bank’s approved methodology and applicable requirements.

Near misses reveal control weaknesses and potential loss scenarios even when no financial loss occurs. Recording and analysing them helps the bank identify root causes and strengthen controls before a similar event causes actual harm. Recording criteria should be defined consistently.