Framework

Operational Risk Framework™

Manage the risk of loss arising from day-to-day operations through RCSA, loss data, KRIs and control testing.

Overview

Operational risk is the risk of loss from inadequate or failed processes, people, systems and external events. This framework operationalises identification, control and monitoring across the first line.

Business problem

Process failures, errors and disruptions recur because risks and controls are not systematically assessed, losses are not captured, and early-warning indicators are missing.

Purpose

Manage the risk of loss arising from day-to-day operations through RCSA, loss data, KRIs and control testing.

Who it's for
  • CROs
  • Operational-risk teams
  • COOs
  • Process owners
Components
  • Process & risk taxonomy
  • Risk & control self-assessment (RCSA)
  • Loss-event database
  • Operational KRIs
  • Scenario analysis
  • Control testing
Governance Structure
  • First-line process owners run risk-and-control self-assessment; the second-line operational-risk team oversees and challenges; internal audit assures.
Maturity Levels (shared spine)
L1

Fragile

Maturity level 1 of the shared Outliers risk spine — Fragile.

L2

Functional

Maturity level 2 of the shared Outliers risk spine — Functional.

L3

Disciplined

Maturity level 3 of the shared Outliers risk spine — Disciplined.

L4

Strategic

Maturity level 4 of the shared Outliers risk spine — Strategic.

L5

Resilient

Maturity level 5 of the shared Outliers risk spine — Resilient.

Roadmap
Step 01
  • Define the process and risk taxonomy
Step 02
  • Run RCSA across critical processes
Step 03
  • Stand up loss-event capture
Step 04
  • Design operational KRIs
Step 05
  • Test key controls and remediate
Deliverables
  • Operational risk register
  • Loss event register
  • RCSA workpapers
  • Operational KRI pack
Policies & documents
  • Operational risk policy
  • RCSA standard
  • Loss-data policy
  • Control testing standard
Metrics & KRIs
  • Loss events (count & value)
  • RCSA completion %
  • Open critical control issues
  • Operational KRIs in breach
Board oversight questions
  • What are our largest operational loss exposures?
  • Are key controls tested and effective?
  • What do our operational KRIs tell us about emerging stress?
  • How quickly do we close control gaps?

Across the ecosystem

Knowledge graph · 6 relations

operationalised by
ResourceRisk & Control Self-Assessment (RCSA) TemplateResourceLoss Event Register
prioritises (inverse)