Operational Risk Management: Employee Training Guide

Operational Risk Management

Employee Training Material: Identifying, Reporting, and mitigating Operational Risks

What is Operational Risk?

Operational Risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events.<br><br>It exists in all banking activities and includes:<br>• Actual financial loss<br>• Potential or expected loss<br>• Regulatory and reputational impact<br><br><strong>Remember: Absence of financial loss does not mean absence of risk.</strong>

The ORM Framework Pillars

<strong>Risk Identification:</strong> Detecting operational risk events, near-misses, control failures, and emerging risks.

<strong>Risk Measurement:</strong> Quantifying risks using loss data, potential losses, and aggregating similar events.

<strong>Risk Monitoring:</strong> Ongoing oversight through Key Risk Indicators (KRIs), trend analysis, and reporting.

<strong>Risk Control & Mitigation:</strong> Implementing preventive, detective, and corrective controls to reduce frequency and impact.

Understanding Events & Near-Misses

<strong>Operational Risk Event:</strong><br>Any incident caused by people, processes, systems, or external factors resulting in loss or disruption.<br><em>Examples: Information entry errors, system downtime, compliance breaches.</em><br><br><strong>Near-Miss Event:</strong><br>An incident that did not result in loss but could have.<br><em>Examples: Reporting errors corrected before submission, blocked unauthorized access.</em>

Event Classifications

Internal & External Fraud

Employment Practices & Workplace Safety

Clients, Products & Business Practices

Damage to Physical Assets

Business Disruption & System Failures

Execution, Delivery & Process Management

Reporting Thresholds & Zero Tolerance

<strong>Financial Threshold:</strong><br>Any event involving actual or potential loss of <span style="color:#d9534f; font-weight:bold;">RUB 20,000 (or INR equivalent)</span> or more must be reported.<br><br><strong>Zero-Tolerance (Immediate Reporting):</strong><br>Report immediately regardless of amount:<br>• Fraud (Actual/Attempted)<br>• Regulatory Non-Compliance<br>• Data Breaches<br>• Control Failures enabling fraud

Event Reporting Workflow

<div style="margin-bottom:20px;"><strong style="color:#00BFFF;">Stage 1: Immediate (T)</strong><br>Notification, containment, and sharing basic details.</div><div style="margin-bottom:20px;"><strong style="color:#00BFFF;">Stage 2: Initial Assessment (T+2)</strong><br>Detailed description, categorization, and preliminary root cause.</div><div style="margin-bottom:20px;"><strong style="color:#00BFFF;">Stage 3: Investigation (T+5)</strong><br>Root Cause Analysis (RCA), impact assessment, and corrective action plan.</div><div><strong style="color:#00BFFF;">Stage 4: Closure</strong><br>Implementation of actions and validation by Risk Management.</div>

Key Risk Indicators (KRIs) are tools for prevention, not fault-finding.

Early Warning System

Roles & Responsibilities

<strong>First Line: Business Units</strong><br>Own and manage operational risks. Identify, report, and implement corrective actions.

<strong>Second Line: Risk Management Dept</strong><br>Validate events, monitor KRIs, maintain loss database, and escalate material risks.

<strong>Third Line: Internal Audit</strong><br>Provide independent assurance and review the effectiveness of controls.

Key Takeaways & Culture

• <strong>Ownership:</strong> ORM is everyone's responsibility.<br><br>• <strong>Timeliness:</strong> Report incidents and near-misses early.<br><br>• <strong>Integrity:</strong> Data must be accurate and retained for 10 years.<br><br>• <strong>Protection:</strong> Strong reporting protects the Bank and its employees.