Operational Risk, Internal Control and Resilience

Introduction and context

Banks transform deposits into loans, execute payments, safeguard assets, provide financial advice, and operate increasingly complex digital platforms. These activities create value, but they also expose institutions to losses caused by inadequate processes, human error, technology failure, fraud, legal disputes, and external disruption. Such losses are not merely technical problems. A failed payment system can damage liquidity, customer confidence, regulatory standing and the bank’s franchise value.

Operational risk management therefore forms part of strategic banking management. It seeks not to eliminate every error—which would be impossible and uneconomic—but to identify material exposures, reduce their likelihood and impact, detect failures promptly, respond effectively, and learn from incidents. Internal control provides the day-to-day discipline, while resilience ensures that critical services continue or recover within acceptable limits.

This chapter explains the principal sources of operational risk, risk-control self-assessment (RCSA), key risk indicators (KRIs), loss-event analysis, the Three Lines Model, COSO internal control, business continuity, disaster recovery and outsourcing controls.

Learning objectives

By the end of this chapter, the reader should be able to:

1. Classify operational risks arising from people, processes, systems and external events.
2. Distinguish inherent risk, residual risk, controls, control deficiencies and risk appetite.
3. Apply RCSA, KRIs and loss-event analysis in a banking unit.
4. Explain the Three Lines Model and COSO Internal Control—Integrated Framework.
5. Design practical continuity, disaster-recovery and third-party-risk controls.
6. Evaluate ethical, governance, regulatory and technological implications of operational risk decisions.

1. The nature of operational risk

A widely used regulatory definition describes operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. This definition includes legal risk, such as litigation, unenforceable contracts and regulatory penalties, but generally excludes strategic and reputational risk as primary categories. In practice, operational incidents may nevertheless produce strategic and reputational consequences.

Operational risk differs from credit and market risk in several ways. Credit risk concerns a counterparty’s failure to perform; market risk concerns adverse movements in prices, rates or foreign exchange; operational risk concerns how the institution performs its activities. It is present in every product, location and process, and it can arise whether markets are rising or falling.

Four primary sources

These categories overlap. For example, a phishing attack is an external event that exploits a people weakness and may cause a system compromise. Classification should therefore support analysis rather than become an artificial exercise.

Inherent and residual risk

Inherent risk is the exposure before considering controls. Residual risk is the exposure remaining after controls operate. A simple conceptual relationship is:

This is not a universally additive numerical law. It is a management representation: risk is multidimensional, and control effectiveness cannot always be measured in the same units as probability and impact. Where a bank uses numerical scoring, it must define its scale consistently.

A common scoring approach is:

Here, likelihood and impact are ordinal scores, often from 1 to 5. The result is a prioritisation aid, not an objective monetary loss estimate. It assumes that the bank has defined the scoring scales and accepts multiplication as a useful approximation. A score of 20 may result from high likelihood and moderate impact or moderate likelihood and high impact; management should examine both dimensions rather than rely on the total alone.

Risk appetite states the amount and type of risk the bank is willing to accept in pursuit of its objectives. Tolerance limits translate appetite into operational boundaries, such as maximum outage duration, unresolved high-risk findings, failed reconciliations or privileged-access exceptions.

2. Internal control as a management system

Internal control is a process, effected by the board, management and employees, designed to provide reasonable—not absolute—assurance regarding achievement of objectives. The objectives normally concern operations, reporting and compliance.

Controls can be classified by timing and purpose:

• Preventive controls stop an undesirable event, such as segregation of duties or transaction limits.
• Detective controls identify an event after it occurs, such as reconciliations, exception reports and fraud monitoring.
• Corrective controls restore conditions or prevent recurrence, such as account reversal, patching and disciplinary action.
• Directive controls encourage desired behaviour, such as policies, training and management instructions.

A strong control environment is more than a collection of checklists. It includes ethical leadership, competent staff, clear authority, independent challenge, reliable information and accountability for remediation.

COSO Internal Control—Integrated Framework

The COSO framework commonly identifies five mutually reinforcing components:

1. Control environment: integrity, ethical values, competence, board oversight, structure and accountability.
2. Risk assessment: identification and analysis of risks to objectives, including fraud and change-related risks.
3. Control activities: approvals, authorisations, verifications, reconciliations, segregation of duties, access controls and physical safeguards.
4. Information and communication: obtaining reliable information and communicating it internally and externally at the right time.
5. Monitoring activities: ongoing and separate evaluations, reporting deficiencies and tracking corrective action.

COSO also uses principles within these components. For example, control activities should be selected in response to risks, technology controls should be designed appropriately, and deficiencies should be communicated to responsible parties. COSO is not a checklist that guarantees safety; it is a framework for judging whether controls are designed and operating as part of a coherent system.

3. Risk governance and the Three Lines Model

The Three Lines Model clarifies responsibilities without creating three independent risk departments.

First line—management and operations. Business and process owners identify risks, operate controls, follow procedures, monitor performance and remediate weaknesses. A teller supervisor, payments manager or lending operations head is accountable for risks arising in the activity they manage.

Second line—risk, compliance and specialist oversight. These functions develop policies, advise the first line, challenge risk assessments, monitor limits, aggregate information and report significant issues. They should have sufficient independence and access to information.

Third line—internal audit. Internal audit provides independent, objective assurance and advice on governance, risk management and control. It should not own operational controls or make management decisions, because doing so would impair independence.

The board and senior management remain accountable for governance. External auditors, supervisors and other external parties provide additional assurance but are not substitutes for the bank’s own lines of responsibility.

A practical failure occurs when a second-line function performs the first line’s control operation and then claims to have independently challenged it. Responsibilities, reporting lines and escalation criteria should therefore be documented in a responsibility matrix.

4. Risk-control self-assessment

RCSA is a structured process through which managers and relevant specialists identify risks, assess their significance, evaluate controls and agree actions. It should be evidence-based and connected to business objectives.

A robust RCSA normally follows these steps:

1. Define the process, product, objective and risk boundary.
2. Map activities and identify failure scenarios.
3. Assess inherent likelihood and impact.
4. Identify key preventive, detective and corrective controls.
5. Test or evaluate control design and operating effectiveness.
6. Assess residual risk against appetite and tolerance.
7. Record owners, due dates, action plans and escalation.
8. Reassess after significant change or a material incident.

A risk statement should be specific. “Technology risk” is too broad. “A corrupted payment file may be released without detection because the interface lacks independent validation” identifies the event, cause and consequence more usefully.

Control design asks whether a control, if performed correctly, could address the risk. Operating effectiveness asks whether it actually operated consistently during the relevant period. A beautifully designed approval control is ineffective if staff routinely bypass it.

Worked RCSA example

A bank’s retail-payment process has an inherent likelihood score of 4 and an impact score of 5. Its inherent score is therefore:

The bank introduces dual authorisation, automated duplicate-payment detection and daily reconciliation. The residual likelihood is assessed at 2 and residual impact at 4, giving:

The figures indicate a lower priority relative to the original exposure, but they do not prove that the risk is acceptable. Management must compare 8 with the bank’s risk appetite, verify evidence that the controls operate, and consider whether a low-probability event could still produce unacceptable systemic or customer consequences.

5. Key risk indicators

A KRI is a metric that signals increasing exposure, weakening controls or emerging operational stress. KRIs differ from key performance indicators (KPIs): a KPI measures achievement or output, whereas a KRI warns about risk conditions. One measure may serve both purposes depending on its use.

Useful KRI characteristics include:

• a clear link to a defined risk;
• a reliable data source and named owner;
• a baseline and meaningful threshold;
• a reporting frequency appropriate to the risk;
• green, amber and red escalation levels;
• a documented response when a threshold is breached.

Examples include payment-processing downtime, unresolved access violations, failed reconciliations, overdue recovery tests, phishing-report rates, staff turnover in critical teams, complaints about erroneous fees, and the age of high-risk audit findings.

Thresholds must be calibrated. A threshold set so high that breaches are rare may hide deterioration; one set too low may produce alert fatigue. KRIs should be reviewed after incidents and material changes. A favourable metric can also be misleading: zero reported incidents may reflect weak reporting culture rather than zero exposure.

6. Loss-event analysis

A loss event is an occurrence that produces, or could produce, an operational loss. Banks should record actual loss, recovered amount, indirect cost where measurable, business interruption, legal consequences and near misses. Near misses are valuable because a control or coincidence may have prevented a financial loss.

A useful event record includes:

• date, location, process and product;
• event type and causal factors;
• gross loss, recovery and net loss;
• affected customers and data;
• control failures;
• immediate containment;
• root-cause analysis;
• accountable owner and remediation date.

Net loss may be represented as:

Gross loss is the amount before insurance, restitution or other recoveries; recoveries must be defined consistently. This simple identity does not capture non-financial harm, opportunity cost or uncertain future legal claims.

Trend analysis can reveal recurring weaknesses. If 40 incidents occur and 28 involve manual re-keying, management should investigate process design rather than merely retrain staff. Root-cause methods include the “five whys,” fault-tree analysis and structured causal diagrams. Blaming an individual without examining incentives, staffing, interfaces and supervision commonly produces superficial remediation.

7. Business continuity and disaster recovery

Business continuity management (BCM) enables critical services to continue at an acceptable level during disruption and to recover afterward. Disaster recovery (DR) is the technology-focused part of recovery, although modern resilience programs also cover people, premises, suppliers, data and communications.

A business impact analysis (BIA) identifies important services, dependencies and consequences of disruption. It supports two central recovery objectives:

• Recovery time objective (RTO): the maximum targeted time within which a service or system should be restored after disruption.
• Recovery point objective (RPO): the maximum targeted period of data loss measured in time. An RPO of 15 minutes means that, in the designed recovery state, the bank aims not to lose more than approximately 15 minutes of committed data.

RTO and RPO are targets, not guarantees. They should be approved by service owners and aligned with customer, legal, liquidity and market requirements. A critical payment service may require a much shorter RTO than an internal archive.

A continuity strategy may include alternate sites, redundant network paths, resilient power, backup processing, manual workarounds, cross-trained staff, reciprocal arrangements and crisis communications. Backup controls should address frequency, encryption, access restriction, integrity testing, geographic separation and restoration testing. A backup that cannot be restored is not an effective recovery control.

Testing should progress from document reviews and tabletop exercises to technical failover and full simulations. Results should produce tracked findings, not ceremonial sign-offs. Crisis governance must specify who declares an incident, who communicates with regulators and customers, who authorises exceptional processing and how decisions are recorded.

8. Outsourcing and third-party risk

Outsourcing transfers activities, not accountability. A bank remains responsible for complying with law, protecting customers and managing risks even when a cloud provider, payment processor, call centre or technology vendor performs the activity.

Third-party controls should cover the full lifecycle:

1. Classify the service’s criticality and data sensitivity.
2. Conduct due diligence on financial strength, competence, security, resilience, ownership and subcontractors.
3. Evaluate concentration risk and substitutability.
4. Negotiate contracts with service levels, audit rights, incident notification, data location and protection, business continuity, exit assistance and regulatory access.
5. Monitor performance, control reports, incidents, vulnerabilities and financial condition.
6. Test contingency and exit plans.
7. Terminate or remediate relationships that exceed risk appetite.

Important contract language should not be accepted uncritically. A service-level agreement may promise 99.9% availability, but the bank must understand measurement exclusions, maintenance windows, dependencies and remedies. A vendor’s assurance report is useful evidence, not proof that the bank’s specific configuration is safe.

9. Technology, cyber risk and artificial intelligence

Digital banking increases speed and reach but also creates dependencies on interfaces, application programming interfaces, identity systems, cloud infrastructure and data quality. Essential technology controls include secure development, change management, vulnerability management, encryption, privileged-access governance, multifactor authentication, logging, monitoring and tested recovery.

Artificial intelligence can assist in anomaly detection, complaint classification, forecasting operational workload and identifying unusual access patterns. It also introduces model, data, privacy, explainability, bias and third-party risks. Human oversight is especially important where automated decisions affect customer access, fraud accusations or regulatory reporting. A bank should maintain inventories of material AI uses, validate performance, control data, monitor drift and preserve an accountable decision maker.

Automation does not remove operational risk. It can amplify a configuration error across thousands of accounts. Consequently, deployment should include segregation of development and production access, controlled releases, rollback capability, independent testing and post-implementation monitoring.

10. Ethics, regulation and governance

Operational control is an ethical obligation because failures can harm depositors, borrowers, employees and communities. Staff should be able to report concerns without retaliation. Incentive systems should not reward transaction volume while ignoring errors, complaints or control breaches.

Regulators commonly expect sound governance, adequate capital and liquidity planning, incident reporting, protection of customer information, outsourcing oversight, operational resilience and effective internal audit. Requirements vary by jurisdiction, so banks must map controls to applicable legislation and supervisory guidance.

Data minimisation, lawful processing, access limitation and retention controls are essential. A bank should not collect or expose more personal data than necessary merely because technology makes it possible. When an incident occurs, legal obligations may require rapid notification, customer remediation and preservation of evidence.

11. Illustrative case: disruption at Meridian Bank

Background. Meridian Bank, a fictional mid-sized bank, outsourced mobile-payment processing to a technology provider. The bank used a single production region and relied on daily rather than continuous transaction replication.

Problem. A software change introduced an interface defect. For six hours, some transactions were duplicated while others were delayed. Customer complaints increased, reconciliation exceptions exceeded the amber KRI threshold, and the provider’s initial report understated the affected population.

Analysis. The RCSA had identified interface failure but rated it moderate because management considered the provider’s availability percentage sufficient. It had not assessed data integrity separately from availability. The contract allowed service credits but required incident notification only after a broad outage, not after suspected transaction corruption. The recovery test had restored infrastructure but had not tested end-to-end reconciliation.

Approach. The bank froze further releases, activated its incident team, reconciled source and destination records, communicated transparently with affected customers and notified relevant authorities. It required the provider to preserve logs and perform an independent root-cause review. Corrective actions included dual approval for high-risk changes, automated idempotency checks, near-real-time replication, revised notification clauses, customer restitution, a separate data-integrity KRI and an end-to-end recovery exercise.

Outcome. Service was restored and duplicate debits were reversed. The board accepted a temporary reduction in the provider’s risk limit while remediation was completed. Internal audit later tested whether the actions operated in practice rather than relying on management representations.

Learning points. Availability is not the same as accuracy; outsourced activity remains the bank’s responsibility; incident data should challenge risk assessments; and resilience requires tested processes, reliable information and clear accountability.

12. Implementation principles and limitations

Effective programs share several practices: senior ownership; clear risk taxonomies; proportionate controls; reliable incident data; challenge without blame; integrated technology and business continuity planning; independent assurance; and disciplined remediation. Control inventories should identify purpose, owner, frequency, evidence and failure response. Management information should distinguish emerging risk from historical performance.

There are also limitations. Risk scores can create false precision. KRIs can be gamed or become stale. Historical losses may not predict novel cyber or geopolitical events. Audit findings may reflect sampling rather than the full population. Redundancy can introduce complexity and new failure modes. Excessive controls can slow service and encourage workarounds. Resilience investment therefore requires proportionality, scenario analysis and periodic reassessment.

A mature bank treats operational risk as a continuous learning cycle: define objectives, identify threats, design controls, monitor signals, respond to events, learn from evidence and improve the system.

Chapter Summary

Operational risk arises from failed or inadequate people, processes, systems and external-event controls. It is present throughout banking and can produce financial, customer, legal, regulatory and reputational consequences. Inherent risk describes exposure before controls; residual risk describes the remaining exposure after controls.

COSO organizes internal control around the control environment, risk assessment, control activities, information and communication, and monitoring. The Three Lines Model assigns operating responsibility to the first line, oversight and challenge to the second line, and independent assurance to internal audit. RCSA identifies and evaluates risks and controls; KRIs provide forward-looking signals; and loss-event analysis converts incidents and near misses into learning.

Business continuity and disaster recovery depend on business impact analysis, RTO, RPO, tested recovery arrangements and crisis governance. Outsourcing requires due diligence, strong contracts, monitoring, resilience and exit planning because accountability remains with the bank. Technology and AI can strengthen detection and efficiency, but they create additional data, cyber, model and concentration risks. Effective operational resilience is therefore a strategic capability grounded in ethical governance, evidence, accountability and continuous improvement.

Key Terms

Operational risk: Risk of loss from inadequate or failed processes, people, systems or external events.

Inherent risk: Exposure before controls are considered.

Residual risk: Exposure remaining after controls operate.

Risk appetite: Amount and type of risk an institution is willing to accept.

Risk tolerance: Permitted variation around a risk objective or limit.

Internal control: A process providing reasonable assurance over operations, reporting and compliance objectives.

Preventive control: A control intended to stop an unwanted event.

Detective control: A control intended to identify an event or exception.

Corrective control: A control intended to restore or improve conditions after failure.

RCSA: Risk-control self-assessment performed by management and relevant specialists.

KRI: Key risk indicator that signals changing exposure or control weakness.

Loss event: An occurrence producing or potentially producing operational loss.

COSO: Framework for integrated internal control and its components.

Three Lines Model: Governance model distinguishing operations, oversight and independent assurance.

Business continuity management: Capability to continue and recover critical services during disruption.

Disaster recovery: Restoration of technology and information services after disruption.

RTO: Target maximum time to restore a service.

RPO: Target maximum period of data loss measured in time.

Third-party risk: Risk arising from dependence on external providers.

Operational resilience: Ability to prevent, adapt to, respond to and recover from disruption while maintaining important services.

Review Questions

Short Answer Questions

1. What are the four primary sources of operational risk?
2. Distinguish inherent risk from residual risk.
3. What is the purpose of a KRI?
4. Define RTO and RPO.
5. Why does outsourcing not transfer accountability from a bank?

Long Answer Questions

1. Explain the five components of the COSO Internal Control—Integrated Framework and show how they reinforce one another.
2. Describe the Three Lines Model and explain how independence may be compromised when responsibilities are unclear.
3. Explain the RCSA process, including risk identification, control evaluation, scoring and remediation.
4. Discuss the design of a business continuity and disaster-recovery program for a critical payment service.
5. Evaluate the principal controls required when a bank outsources a cloud-based customer-data service.

Analytical / Application Questions

1. A bank has frequent reconciliation breaks after introducing automated payment interfaces. Design an RCSA entry, three KRIs, and a remediation plan.
2. A supplier reports 99.95% system availability, but customers experience duplicate transactions. Analyse why availability alone is an inadequate resilience measure and propose tests.
3. A phishing incident leads to unauthorised privileged access. Allocate responsibilities across the Three Lines Model and recommend preventive, detective and corrective controls.

Multiple Choice Questions with Answers

Question 1

Which item is an example of operational risk arising primarily from a process weakness?

A. A borrower defaults after a recession

B. A payment is released because required reconciliation was omitted

C. A bond price falls when interest rates rise

D. A foreign currency depreciates against the bank’s reporting currency

Correct Answer: B. A payment is released because required reconciliation was omitted

Question 2

What does residual risk represent?

A. Risk before any controls are considered

B. Risk transferred entirely to an insurer

C. Risk remaining after controls operate

D. Only the risk reported to the board

Correct Answer: C. Risk remaining after controls operate

Question 3

Which function is primarily responsible for operating controls in the Three Lines Model?

A. The first line of management and operations

B. The external auditor

C. The regulator

D. The third line, internal audit

Correct Answer: A. The first line of management and operations

Question 4

Which COSO component includes reconciliations, approvals and segregation of duties?

A. Control environment

B. Control activities

C. Information and communication

D. Monitoring activities

Correct Answer: B. Control activities

Question 5

A bank assigns likelihood 4 and impact 5 on a defined ordinal scale. Using risk score = likelihood × impact, what is the score?

A. 9

B. 15

C. 20

D. 25

Correct Answer: C. 20

Question 6

Which statement best describes a key risk indicator?

A. It measures only annual profit

B. It signals changing exposure or weakening controls

C. It replaces internal audit testing

D. It guarantees that no loss will occur

Correct Answer: B. It signals changing exposure or weakening controls

Question 7

An RPO of 15 minutes primarily describes:

A. The maximum targeted time to restore the service

B. The target frequency of staff training

C. The maximum targeted period of data loss

D. The time allowed for a vendor to answer a complaint

Correct Answer: C. The maximum targeted period of data loss

Question 8

Which is the strongest reason to test restoration of backups?

A. A backup is useful only if data can actually be restored

B. Testing eliminates all cyber risk

C. Testing removes the need for access controls

D. Testing guarantees that the RTO will always be met

Correct Answer: A. A backup is useful only if data can actually be restored

Question 9

Which statement about outsourcing is correct?

A. The supplier assumes all regulatory accountability

B. The bank remains accountable for managing risks in outsourced activities

C. A contract makes due diligence unnecessary

D. Outsourcing removes concentration risk

Correct Answer: B. The bank remains accountable for managing risks in outsourced activities

Question 10

Why should near misses be recorded in loss-event analysis?

A. They can reveal control weaknesses even when no financial loss occurred

B. They are always treated as actual losses

C. They replace business continuity testing

D. They prove that controls are ineffective in every case

Correct Answer: A. They can reveal control weaknesses even when no financial loss occurred