Operational Risk Management Course

Lesson 1 • Defining Operational Risk

Covers the standard industry definition, boundary conditions, and common misconceptions. Anchors all subsequent analysis to a precise, shared vocabulary.

Lesson 2 • Sources and Drivers of Operational Risk

Examines people, process, systems, and external factors as the four primary risk drivers. Connects root-cause thinking to later identification and assessment techniques.

Lesson 3 • Operational Risk in the Enterprise Context

Positions operational risk within the broader enterprise risk management framework and governance hierarchy. Shows how operational risk interacts with strategic and reputational risk.

Lesson 4 • Historical Loss Events and Lessons Learned

Analyses landmark operational loss events to extract recurring failure patterns. Builds intuition for recognising high-impact scenarios before formal tools are introduced.

Lesson 1 • Three Lines of Defense Model

Explains roles and accountabilities across business units, risk functions, and internal audit. Clarifies how each line contributes to risk identification, oversight, and assurance.

Lesson 2 • Regulatory Reporting Obligations

Identifies compulsory disclosures, incident reporting timelines, and capital reporting requirements. Prepares students to design compliant reporting workflows.

Lesson 3 • Global Regulatory Expectations

Surveys international capital and sound-practices standards that define minimum operational risk requirements. Establishes the compliance baseline for programme design.

Lesson 4 • Policies, Standards, and Procedures

Describes the policy hierarchy from enterprise risk policy down to operational procedures. Teaches how to draft and maintain documents that satisfy regulatory and audit scrutiny.

Lesson 1 • Scenario Analysis and Brainstorming

Introduces structured brainstorming and scenario workshops to surface low-frequency, high-impact risks. Prepares students for the quantitative scenario work in later chapters.

Lesson 2 • Process Mapping for Risk Identification

Uses end-to-end process maps to locate failure points, handoff risks, and control gaps. Connects process analysis to the risk taxonomy introduced in Chapter 1.

Lesson 3 • Building and Maintaining a Risk Register

Consolidates all identification outputs into a structured risk register with ownership and review cycles. Establishes the living document that drives assessment and monitoring activities.

Lesson 4 • Risk and Control Self-Assessment

Teaches the design and facilitation of RCSA workshops to identify inherent risks and evaluate control effectiveness. Directly feeds the risk register built later in the course.

Lesson 1 • Qualitative Risk Scoring Methods

Covers likelihood and impact rating scales, scoring matrices, and calibration techniques to reduce subjectivity. Produces the heat map used in risk prioritisation.

Lesson 2 • Key Risk Indicators

Teaches the design of leading and lagging KRIs that signal emerging risk before losses materialise. Links KRI thresholds to risk appetite statements.

Lesson 3 • Scenario-Based Capital Estimation

Applies structured expert judgement to estimate tail losses for low-frequency, high-severity scenarios. Connects scenario outputs to regulatory capital calculations.

Lesson 4 • Risk Heat Maps and Prioritisation

Synthesises qualitative and quantitative outputs into visual heat maps for executive communication. Establishes a prioritisation framework that guides control investment decisions.

Lesson 1 • Control Cost-Benefit Analysis

Applies cost-benefit thinking to control investment decisions, balancing risk reduction against operational burden. Supports prioritisation of limited remediation resources.

Lesson 2 • Control Gaps and Remediation Planning

Teaches how to identify control deficiencies, rate their severity, and develop time-bound remediation plans. Links gap findings back to the risk register and heat map.

Lesson 3 • Control Typology and Classification

Distinguishes preventive, detective, and corrective controls and maps them to risk categories. Provides the classification language used in control inventories and audit documentation.

Lesson 4 • Control Testing Methodologies

Introduces walkthrough, sample-based, and continuous testing approaches for evaluating control performance. Connects testing results to residual risk reassessment.

Lesson 1 • Trend Analysis and Pattern Recognition

Uses loss data time series to detect emerging risk trends, seasonal patterns, and concentration risks. Connects analytical findings to KRI threshold reviews.

Lesson 2 • Data Quality and Validation

Introduces data quality dimensions, validation rules, and reconciliation processes to maintain a reliable loss database. Poor data quality directly undermines capital models and trend analysis.

Lesson 3 • Management and Board Risk Reporting

Teaches the design of risk reports tailored to management and board audiences, balancing detail with clarity. Covers report structure, visualisation, and escalation protocols.

Lesson 4 • Loss Event Root-Cause Analysis

Applies structured root-cause techniques to loss events to identify systemic failures beyond immediate causes. Outputs feed control remediation and process improvement initiatives.

Lesson 1 • Resilience Testing and Exercising

Introduces tabletop exercises, simulation drills, and live failover tests to validate resilience capabilities. Connects test findings to plan updates and control improvements.

Lesson 2 • Crisis Management and Communication

Establishes crisis management team structures, decision-making protocols, and internal and external communication plans. Prepares students to lead or support an organised crisis response.

Lesson 3 • Business Continuity Plan Development

Covers the structure, content, and ownership of business continuity plans for critical processes. Ensures plans are actionable, tested, and aligned to impact tolerances.

Lesson 4 • Business Impact Analysis

Teaches the structured assessment of disruption consequences across time horizons to determine recovery priorities. Outputs directly inform recovery time and point objectives.

Lesson 1 • Integrating Risk into Strategic Planning

Shows how operational risk insights inform strategic decisions, new product approvals, and M&A due diligence. Positions the risk function as a value-adding business partner.

Lesson 2 • Risk Appetite Framework Design

Teaches the construction of a comprehensive risk appetite framework linking board-level statements to operational metrics. Connects appetite to KRIs, limits, and escalation triggers.

Lesson 3 • Continuous Improvement and Programme Evolution

Establishes feedback loops, lessons-learned processes, and innovation adoption practices to keep the programme current. Prepares students to lead ongoing programme development.

Lesson 4 • Risk Culture and Behavioural Drivers

Examines how organisational culture, incentives, and leadership behaviour shape risk-taking. Provides tools to diagnose and strengthen risk culture across business lines.