The 2026 Operational Risk Management II

Identify key risks and controls through the crc framework, assess adequacy and effectiveness, and manage control issues from identification to testing, action plans, and cia sign-off.

Identify roles and responsibilities in CRSA management, from the CSA owner and department head to risk officers, workshop participants, and the CRSA facilitator, detailing workshop organization, documentation, and control assessment.

Explore in depth the control and risk assessment framework, focusing on CSA assays to estimate exposures, identify control weaknesses, and monitor actions to embed operational risk management across the organization.

Explore a self-assessment template for control risk assessment and control effectiveness testing, detailing testing scripts, frequency, and sample sizes, and how CSA enables first line of defense to assess controls.

Explore control issue management, actively handling known control gaps within risk appetite. Follow a six-step process with owners and risk officers to classify, take action, and close or accept issues.

Explore the CIM template for control issue management, detailing department, issue name, description, sources, risk and rating, ownership, dates, status, and smart action plans to close gaps.

Identify and assess risk and controls to plan actions that minimize residual risk. Operational risk officers oversee CRC and Siim tools; control issue owners monitor actions to closure or acceptant.

Explore three core operational risk management tools: loss event database, key indicators (kaixi), and the new product approval process, and learn how to identify, assess, and manage operational risks.

Learn how loss event database management supports operational risk by collecting, validating, measuring, monitoring, and reporting loss events, enabling rapid recording, escalation, and continuous improvement.

Explore the lost events data framework, including internal and external sources, data quality, and reporting processes, to improve operational risk assessment and scenario analysis.

Explore the four-step LED escalation process for operational losses, detailing identification, escalation records, investigation, and action implementation by the operational risk officer and head of department.

Apply a standard template to capture the last operational loss event, detailing department, event name, reference id, notification date, status, description, source, classification, category, amount, and action plan.

Explore key risk indicators (KRI) that reveal an organization's risk position with monthly data like complaints, overdue receivables, or incidents. Use red, amber, green thresholds to trigger reviews and action.

Assessors own key risk indicators, identify them, set thresholds, and monitor monthly to trigger timely interventions, while KRIs should be measurable, classifiable, collectable, predictable, and simple.

Learn to design and validate key risk indicators that align with governance, strategy, and risk appetite, using leading and lagging metrics, exposure indicators, and bow-tie analysis.

Explore the standard KRI template, detailing division and department names, KRI description, thresholds, measurement units, monitoring frequency, and required department concurrence before risk management approval.

Explore scenario analysis as a forward-looking tool to test organizational resilience against operational risks, using stress testing and reverse stress testing to uncover data gaps and strengthen controls.

analyze how the five-step new product approval process governs product sponsorship, operating model risk assessment, approval and launch, and post-implementation reviews to manage operational, regulatory, and reputational risks.

Explore three operational risk tools—loss event database management, key indicators (Kairis), and the new product approval process—along with reporting, escalation, and analysis timelines.

Introduce Basel II and its three pillars—minimum capital, supervisory review, and market discipline—and trace Basel I through Basel III updates to global capital requirements.

Operational risk management is an ongoing process that adapts to new threats such as cyber crime and covid-19. Ongoing monitoring fosters a positive risk culture, transparency, and regulatory compliance.

Basle apart aims to make capital allocation more risk sensitive and to empower the resource officer who champions operational risk management in the first line of defense using available tools.

Review orm tools to assess key controls and residual risk, test adequacy, and activate the control issue management process when gaps arise. Monitor resolution and update key indicators for improvement.

Build a risk management culture by ensuring senior management supports risk discussion top-down and bottom-up, fostering a no blame culture, training staff to learn from failures and to minimize consequences.