Operational, Compliance and Conduct Risk

Introduction and context

Enterprise risk management (ERM) is concerned not only with market prices, credit quality and liquidity, but also with the way an organisation performs its work. Operational, compliance and conduct risks arise from failures in people, processes, systems, external events, law, culture and judgement. They are especially important in financial institutions because a small process failure can affect thousands of customers, generate regulatory sanctions, damage trust and create secondary liquidity or capital consequences.

Operational risk is commonly defined in banking practice as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. This definition includes legal risk but generally excludes strategic and reputational risk as primary categories, although those risks may result from operational failures. Compliance risk is the risk of legal or regulatory sanction, financial loss or reputational damage resulting from failure to comply with applicable laws, rules, standards or internal requirements. Conduct risk concerns behaviour that produces unfair customer outcomes, market abuse, conflicts of interest, unsuitable advice, misleading communication or other breaches of expected standards.

These categories overlap but are not identical. A defective customer-identification process is an operational weakness; failure to comply with anti-money-laundering requirements is a compliance exposure; deliberately ignoring suspicious transactions may also indicate misconduct and an unhealthy culture. Effective ERM therefore analyses the causal chain rather than placing every event in a single silo.

Learning objectives

By the end of this chapter, a student should be able to:

1. Distinguish operational, compliance and conduct risk and explain their interdependence.
2. Assess people, process, systems, legal, fraud and customer-outcome exposures.
3. Use loss-event data, risk-control self-assessments (RCSAs), scenario analysis and control testing.
4. Interpret key risk indicators (KRIs), compliance-monitoring results and remediation evidence.
5. Design proportionate internal controls and governance responses.
6. Evaluate limitations, ethical issues and emerging technology risks.

A causal model of non-financial risk

A useful assessment begins with five linked elements:

Cause → Event → Control response → Impact → Remediation.

Causes include inadequate training, unclear accountability, poor incentives, obsolete technology, weak segregation of duties, third-party dependency or external disruption. The event is the occurrence itself: a payment error, data breach, bribery incident, market-manipulation episode or missed filing. Controls may prevent, detect or correct the event. Impacts include direct loss, customer harm, regulatory action, litigation, operational interruption and reputational effects. Remediation addresses both the immediate failure and the underlying cause.

Figure: A causal model for analysing operational, compliance and conduct events.

The model prevents a common error: treating a control failure as the risk itself. Risk is the possibility of an adverse outcome; a control changes the likelihood or severity of that outcome. A control that exists on paper but is not performed, evidenced or independently tested should not be treated as fully effective.

Risk taxonomy and important exposures

People risk

People risk includes insufficient competence, excessive workload, inappropriate incentives, key-person dependency, weak supervision, collusion and misconduct. Assessment should consider recruitment, training, access rights, succession, disciplinary arrangements, performance measures and speak-up mechanisms. Human error is not always an individual failure; repeated errors may reveal unrealistic targets or an unintuitive process.

Process and legal risk

Process risk arises from ambiguity, manual re-keying, poor hand-offs, incomplete documentation, inadequate change management and ineffective reconciliation. Legal risk includes unenforceable contracts, privacy violations, deficient disclosures, employment claims, intellectual-property disputes and failure to meet record-retention duties. Legal review should occur before product launch, material outsourcing and significant contract changes—not only after an incident.

Systems and third-party risk

Systems exposures include availability failure, cyberattack, data corruption, access abuse, interface errors, algorithmic defects and inadequate recovery capability. Third parties can introduce concentration risk, fourth-party dependencies, cross-border legal issues and limited audit access. Due diligence, contractual controls, service-level measures, incident notification, resilience testing and exit plans are essential.

Fraud risk

Fraud may be internal, external or collusive. A fraud-risk assessment examines motive or pressure, opportunity and rationalisation, often called the fraud triangle. Controls include segregation of duties, dual approval, independent reconciliations, transaction monitoring, protected reporting channels, background checks and investigation protocols. Controls must be designed against realistic methods, not merely historical incidents.

Compliance and conduct risk

Compliance programmes translate laws and regulatory expectations into obligations, owners, procedures, training, monitoring and escalation. Conduct risk requires attention to outcomes, not simply rule compliance. A technically permissible product can still create unfair outcomes if disclosures are incomprehensible, sales incentives reward unsuitable volume or complaint handling is obstructive.

A conduct assessment asks:

• Was the customer treated fairly and provided with material information?
• Were conflicts identified, managed and disclosed?
• Did incentives encourage excessive risk or sales pressure?
• Were vulnerable customers accommodated?
• Were complaints analysed for systemic patterns?
• Could the institution explain and evidence its decisions?

The control environment and the three lines model

The control environment consists of board oversight, risk appetite, ethical culture, competent staff, clear authority and accountability. The traditional three-lines model is useful when applied flexibly:

1. First line: business and operational management owns risks and operates controls.
2. Second line: risk and compliance set frameworks, challenge decisions, advise and monitor.
3. Third line: internal audit provides independent, risk-based assurance to the board or audit committee.

The model does not transfer ownership from the first line to compliance. Nor does internal audit operate management controls. The board remains responsible for understanding significant exposures and ensuring that incentives, resources and escalation arrangements support sound risk management.

Controls can be preventive, detective or corrective; manual, automated or hybrid; and entity-level or transaction-level. A strong control description identifies the risk, control owner, frequency, evidence, population, threshold, escalation route and testing method. For example, “payments are reviewed” is weak. “A system blocks payments above the approved limit; an independent manager reviews exception reports daily; unresolved exceptions are escalated within one business day” is testable.

Risk assessment methods

Loss-event data

A loss database records event date, business line, event type, gross loss, recoveries, dates of recognition and settlement, root cause, control failure, customer impact and remediation. Gross loss is the amount before recoveries; net loss is gross loss less eligible recoveries. Data should be normalised for inflation, business volume, acquisitions and changes in reporting thresholds.

A basic expected-loss estimate is:

where EL is expected loss over a specified period, N is the number of exposure opportunities, p is the probability of an event per opportunity, and L is the conditional average loss given an event. The units of EL are currency when L is currency. This simple model assumes comparable opportunities and a stable average probability and severity; it is not a forecast of the actual loss in every period. If event counts and severities vary materially, a frequency–severity model is more appropriate:

where N is the random number of events and Sᵢ is the severity of event i. Estimation requires sufficient, relevant data and careful treatment of truncation, dependence and extreme events.

Illustrative calculation. A bank processes 200,000 comparable payments monthly. The observed monthly error probability is 0.0002 per payment, and the average conditional loss is $600. Then:

EL = 200,000 × 0.0002 × $600 = $24,000 per month. This is an expected-value estimate, not a guarantee; one major cyber event could exceed it many times over.

Near misses should be recorded. Their absence may indicate either excellent performance or weak reporting. Data governance should therefore monitor reporting incentives and compare internal data with complaints, audit findings, insurance claims, legal matters and external intelligence.

Risk-control self-assessments

An RCSA is a structured management assessment of inherent risk, controls and residual risk. Inherent risk is the exposure before considering controls; residual risk is the exposure after considering control effects. Ratings should be anchored to defined scales. A four-level scale might distinguish low, moderate, high and severe consequences, but labels alone are insufficient. The institution should define financial, customer, legal, operational and reputational dimensions and explain how they are combined.

A useful RCSA record includes process maps, risk statements, causes, consequences, control attributes, control performance, KRIs, issues, risk owner, target date and acceptance authority. Workshops should include subject-matter experts, compliance and technology personnel where relevant, and should be challenged by an independent second line. RCSAs are vulnerable to optimism bias, rating inflation and “check-box” participation; evidence and challenge are therefore central.

Scenario analysis

Scenario analysis explores severe but plausible events, including events absent from historical data. A scenario should specify initiating conditions, propagation paths, control assumptions, duration, customer and legal effects, management actions and recovery constraints. Examples include a ransomware attack during a payment peak, a widespread mis-selling issue, failure of a critical cloud provider or collusive employee fraud.

Scenarios should not be presented as precise predictions. Their value lies in revealing dependencies, decision points, data needs, insurance limitations and recovery priorities. Reverse stress testing asks what combination of failures would make the organisation unable to meet a critical objective, and then examines whether that combination is plausible.

KRIs and compliance monitoring

KRIs are indicators that provide timely information about changing exposure. Examples include privileged-access exceptions, unresolved reconciliation breaks, system downtime, overdue mandatory training, complaint volumes, suspicious-transaction alerts, policy breaches, staff turnover in control functions and third-party incidents. A KRI requires a defined owner, data source, frequency, threshold, tolerance and response. Thresholds should be calibrated to risk appetite rather than selected merely because they are easy to measure.

Compliance monitoring tests whether obligations and controls operate in practice. Techniques include sample testing, surveillance, thematic reviews, branch visits, mystery shopping, transaction analytics, regulatory-return validation and complaint analysis. Sampling must be appropriate to the population and risk; a small convenience sample cannot support a broad conclusion. Findings should distinguish isolated error from systemic weakness and identify accountable owners and deadlines.

Worked application: Meridian Bank’s instant-payments failure

The following is a fictional illustrative case.

Background. Meridian Bank introduced instant payments through a new mobile application. The launch connected an internal ledger to a third-party fraud-screening service. The product team was rewarded for rapid growth, while the screening service contract permitted only limited audit access.

Problem. During a holiday weekend, the screening interface intermittently timed out. The application treated a timeout as a low-risk response rather than suspending the payment. Reconciliation staff discovered a backlog two days later. Customers reported unauthorised transfers, and regulators requested information about authentication, customer reimbursement and outsourcing oversight.

Analysis. The incident combined systems, process, third-party, conduct and compliance risks. The immediate control failed because the exception path was permissive. Contributing causes included inadequate resilience testing, unclear ownership between technology and fraud operations, growth incentives, insufficient weekend staffing and an incomplete customer-outcome assessment. Loss-event data alone would have understated the risk because the interface was new and the event had no meaningful historical frequency.

The RCSA had rated the process “moderate” because it counted successful authentication as the principal control. Scenario analysis should have asked: “What happens when the fraud service is unavailable during peak volume?” It would have exposed the need for fail-safe processing, manual capacity and a tested fallback.

Approach. Meridian immediately suspended high-risk transactions when screening was unavailable, contacted affected customers, preserved evidence and notified relevant authorities. It performed an independent root-cause review, reimbursed eligible customers under applicable rules, reconciled all transactions and increased fraud-operations staffing. Longer-term measures included:

• a fail-safe interface that prevents release when a mandatory control is unavailable;
• independent testing of application programming interfaces and recovery arrangements;
• explicit service-level, audit and incident-notification clauses;
• daily exception dashboards with senior escalation;
• customer-outcome testing and clearer authentication communications;
• revised incentives that include loss, complaint and control-quality measures; and
• internal-audit validation after remediation.

Outcome. The direct losses were contained, but management recognised that reimbursement alone did not restore trust or demonstrate effective governance. The board required quarterly reporting on third-party resilience, exception aging, customer harm and remediation effectiveness.

Learning points. First, availability and integrity controls are conduct controls when their failure can harm customers. Second, outsourcing transfers activity, not accountability. Third, a control’s failure mode must be tested, not merely its normal operation. Fourth, incentives and staffing are part of the control environment. Finally, remediation is incomplete until independent evidence shows that the revised process works over time.

Governance, ethics and regulatory judgement

Compliance is more than avoiding fines. It protects market integrity, customer autonomy and the legitimacy of financial institutions. Ethical governance requires considering affected stakeholders who cannot negotiate contract terms or evaluate complex products. A narrow cost-benefit calculation may undervalue dignity, privacy, financial inclusion and unequal vulnerability.

Boards should receive information that is decision-useful rather than a large inventory of red, amber and green ratings. Reporting should show trends, root causes, overdue actions, repeat findings, risk acceptances, customer outcomes and areas where data quality is weak. Risk acceptance must be explicit, time-bound, owned by an authorised person and supported by compensating controls where possible.

Regulatory obligations vary by jurisdiction, but common themes include anti-money laundering and counter-terrorist financing, sanctions, privacy and data protection, consumer protection, market conduct, outsourcing, operational resilience, record keeping and whistleblower protection. Organisations must map obligations to processes and controls, monitor regulatory change and retain evidence of decisions. Legal advice is important but cannot substitute for operational ownership.

Technology, data and artificial intelligence

Automation can reduce manual error and improve monitoring, but it can also scale an error rapidly. Artificial-intelligence systems introduce risks involving biased outcomes, opaque decisions, data leakage, model drift, adversarial manipulation and unclear accountability. Governance should cover permitted use, data provenance, validation, human review, access control, audit trails, vendor terms, incident response and periodic performance testing.

An automated alert system should be evaluated not only by detection volume but also by false positives, false negatives, disparate customer effects, investigation quality and escalation time. Human review must be meaningful: reviewers need authority, competence and sufficient information to challenge the output. Generative AI should not receive confidential information without approved safeguards, and its outputs should not be treated as authoritative without verification.

Limitations and good practice

No framework eliminates non-financial risk. Historical data may be sparse, inconsistent or biased toward detected events. Scenario estimates depend on assumptions; RCSAs may reflect groupthink; KRIs can be gamed; controls can create new risks through complexity; and independent assurance itself may be limited by skills or access. Correlation between indicators does not establish causation.

Good practice is therefore iterative:

1. Define risk appetite and critical services in outcome terms.
2. Map processes, dependencies, obligations and vulnerable stakeholders.
3. Maintain reliable event, complaint, near-miss and control data.
4. Combine quantitative evidence with expert judgement and severe-plausible scenarios.
5. Design controls with clear ownership, evidence and failure responses.
6. Test operating effectiveness, including exceptions and third parties.
7. Escalate promptly and investigate root causes rather than symptoms.
8. Track remediation to independently verified closure.
9. Review incentives, culture and customer outcomes regularly.
10. Learn from incidents, near misses, regulatory findings and external events.

Chapter Summary

Operational risk arises from failed or inadequate people, processes, systems and external-event responses. Compliance risk concerns failure to meet legal, regulatory and internal obligations, while conduct risk focuses on behaviour and outcomes that harm customers or market integrity. The categories overlap and should be analysed through causal chains rather than isolated taxonomies.

Loss-event data supports evidence-based assessment but must be supplemented by near misses, RCSAs, scenario analysis, KRIs, compliance monitoring and independent assurance. Expected-loss calculations are useful for planning but cannot represent extreme or novel events adequately. Controls must be specific, evidenced, proportionate and tested under failure conditions. The three lines model clarifies responsibilities without transferring risk ownership away from management. Strong governance integrates culture, incentives, outsourcing, technology, customer outcomes and ethical judgement. Effective remediation addresses root causes and is not complete until independently validated.

Key Terms

Operational risk: Risk of loss from inadequate or failed people, processes, systems or external events.

Compliance risk: Risk arising from failure to meet applicable laws, rules, standards or internal requirements.

Conduct risk: Risk that behaviour produces unfair customer, market or stakeholder outcomes.

Risk-control self-assessment (RCSA): Structured assessment of risks, controls and residual exposure by management.

Inherent risk: Exposure before considering controls.

Residual risk: Exposure remaining after controls are considered.

Key risk indicator (KRI): Measure providing information about changing risk exposure.

Loss event: An occurrence that produces, or could produce, an operational loss or harmful outcome.

Near miss: An event that did not cause material harm but could have done so.

Preventive control: Control designed to stop an event before it occurs.

Detective control: Control designed to identify an event or exception after occurrence.

Corrective control: Control designed to restore conditions or reduce consequences after an event.

Fraud triangle: Pressure or incentive, opportunity and rationalisation as interacting fraud conditions.

Scenario analysis: Structured exploration of severe but plausible events and consequences.

Control owner: Person accountable for designing, operating and evidencing a control.

Conduct outcome: Actual effect of an institution’s behaviour on customers or markets.

Three lines model: Allocation of management, risk/compliance and internal-audit responsibilities.

Operational resilience: Ability to deliver important services through disruption within tolerated limits.

Root-cause analysis: Investigation of underlying conditions rather than only immediate errors.

Risk acceptance: Explicit authorised decision to retain a defined exposure.

Review Questions

Short Answer Questions

1. Distinguish operational risk, compliance risk and conduct risk.
2. What information should a loss-event database contain?
3. Explain the difference between inherent and residual risk.
4. Give two examples of preventive controls and two examples of detective controls.
5. Why should near misses be recorded?

Long Answer Questions

1. Critically evaluate the usefulness and limitations of RCSAs in a large financial institution.
2. Explain how the three lines model should operate in relation to operational and compliance risk.
3. Discuss how incentives, culture and customer outcomes affect conduct risk.
4. Compare loss-event analysis with scenario analysis as tools for assessing severe operational exposures.
5. Design a governance framework for managing critical third-party technology providers.

Analytical / Application Questions

1. A payment process has 100,000 monthly opportunities, an event probability of 0.0003 per opportunity and a conditional average loss of $400. Calculate expected monthly loss and explain why the estimate may not describe actual monthly outcomes.
2. A compliance KRI is below its formal threshold, but complaints and near misses are rising. Explain how management should investigate and decide whether to escalate.
3. Design a response to an AI-based customer-screening system that produces materially different false-positive rates across customer groups. Address immediate controls, customer impact, validation, governance and remediation.

Multiple Choice Questions with Answers

Question 1

Which statement best distinguishes residual risk from inherent risk?

A. Residual risk is measured before any controls are designed.

B. Residual risk is the exposure remaining after controls are considered.

C. Residual risk is always lower than zero.

D. Residual risk refers only to reputational damage.

Correct Answer: B. Residual risk is the exposure remaining after controls are considered.

Question 2

A bank processes 50,000 transactions, with an event probability of 0.0004 per transaction and a conditional loss of $250. What is the expected loss?

A. $500

B. $2,000

C. $5,000

D. $50,000

Correct Answer: B. $2,000

Question 3

Which is the strongest reason to include near misses in operational-risk data?

A. They always produce accounting losses.

B. They replace the need for scenario analysis.

C. They reveal weaknesses before material harm occurs.

D. They prove that controls are ineffective.

Correct Answer: C. They reveal weaknesses before material harm occurs.

Question 4

Which activity is primarily a second-line responsibility?

A. Executing daily payment approvals

B. Owning the business process risk

C. Setting compliance guidance and challenging management

D. Providing independent internal-audit assurance

Correct Answer: C. Setting compliance guidance and challenging management

Question 5

Which control response is most appropriate when a mandatory fraud-screening service is unavailable?

A. Release all transactions without screening.

B. Ignore the outage if the system is usually reliable.

C. Use a tested fail-safe or approved manual fallback.

D. Delete the affected transactions.

Correct Answer: C. Use a tested fail-safe or approved manual fallback.

Question 6

What is a central limitation of historical loss data?

A. It can never record event causes.

B. It may omit novel or severe events not previously observed.

C. It automatically exaggerates every loss.

D. It makes scenario analysis unnecessary.

Correct Answer: B. It may omit novel or severe events not previously observed.

Question 7

Which question most directly assesses conduct risk?

A. Is the server room sufficiently ventilated?

B. Was the customer outcome fair and adequately explained?

C. How many computers were purchased?

D. Was the annual budget approved on time?

Correct Answer: B. Was the customer outcome fair and adequately explained?

Question 8

In the fraud triangle, which combination is correct?

A. Pressure, opportunity and rationalisation

B. Liquidity, duration and convexity

C. Strategy, diversification and hedging

D. Revenue, expense and capital

Correct Answer: A. Pressure, opportunity and rationalisation

Question 9

Why is outsourcing not a transfer of accountability?

A. Third parties cannot perform operational activities.

B. The institution remains responsible for oversight and outcomes.

C. Contracts eliminate all third-party risk.

D. Regulators supervise only vendors, not institutions.

Correct Answer: B. The institution remains responsible for oversight and outcomes.

Question 10

Which feature makes a control description most testable?

A. It uses broad language such as 'management monitors'.

B. It identifies owner, frequency, evidence and escalation criteria.

C. It avoids specifying exceptions.

D. It relies solely on employee judgement.

Correct Answer: B. It identifies owner, frequency, evidence and escalation criteria.