Risk Mitigation: formula sheet

Key formulas

Expected operational loss

Expected loss = frequency × average severity

Use annual frequency and average loss per event in the same currency.

Net benefit of a treatment

Net benefit = reduction in expected loss − annual cost of treatment

Choose the option with the highest net benefit that also keeps residual risk within appetite. Add capital savings or lost revenue if the question gives them.

Residual risk

Residual risk = inherent risk after the effect of controls

Compare residual risk with risk appetite, not inherent risk.

Benefit-cost ratio

Benefit-cost ratio = reduction in expected loss ÷ cost of treatment

A ratio above 1 means the treatment pays for itself on expected loss alone. Risk appetite can still require action when the ratio is below 1.

Decision rule

Residual within appetite → accept and monitor; above appetite → reduce, transfer or avoid

A rule of thumb. Avoid is usually chosen when no affordable treatment brings risk within appetite.

Residual risk

Residual risk = Inherent risk − effect of controls

Conceptual, not a precise calculation. Used in RCSA to rate risk after controls.

COSO components

Control environment, Risk assessment, Control activities, Information and communication, Monitoring activities

Five components of the Internal Control Integrated Framework. Control environment is the foundation.

Control timing

Preventive (before) → Detective (during or after) → Corrective (after detection)

Classify by when the control acts relative to the event.

Three lines of defense

1st: business owns risk and controls; 2nd: risk and compliance oversee; 3rd: internal audit gives independent assurance

Ownership and independence are the tested points.

Control effectiveness test

Effective control = adequate design AND consistent operation

Both must hold. Failing either means the control is ineffective.

Loss retained by the bank (single loss, no coinsurance)

Retained = min(Loss, D) + max(0, Loss − (D + L))

D = deductible. L = limit, which is the maximum the insurer pays, applied after the deductible. If your policy states the limit as an overall cap on the loss, check the wording.

Insurer payout (single loss)

Payout = min(max(Loss − D, 0), L)

Pays nothing below the deductible, then pays the excess up to the limit.

Payout with coinsurance share c borne by the insured

Payout = (1 − c) × min(max(Loss − D, 0), L)

Use when the question gives a percentage the bank keeps.

Basel AMA insurance recognition cap

Insurance mitigation ≤ 20% of total operational risk capital charge

Applied under the old AMA. Not available as a capital reducer under the SMA.

Net operational risk capital after insurance (AMA)

Net capital = Capital before insurance − recognised mitigation

Recognised mitigation = the smaller of the modelled benefit and the 20% cap.

Accountability rule

Outsourcing the activity ≠ outsourcing the accountability

The firm and its board remain responsible for risk, compliance and outcomes.

Availability from an SLA

Availability % = (Total time − Downtime) ÷ Total time × 100

Use the same period in numerator and denominator, for example minutes in a month.

Concentration share

Provider share = Value of critical services at one provider ÷ Total value of critical services

A high share signals concentration. Firms set internal limits and triggers.

Herfindahl-Hirschman Index (HHI)

HHI = Σ (share of provider i)²

Shares as decimals. Higher means more concentrated. Equal split across n providers gives 1 ÷ n.

Service credit

Credit = contractual % of fee, set by the SLA tier breached

Credits compensate the fee, not the full business loss. They are no substitute for resilience.

RTO (recovery time objective)

RTO ≥ actual time needed to restore the service

Target for restoration time. If tested recovery time exceeds RTO, the plan fails its objective.

RPO (recovery point objective)

Maximum data loss = time between last good backup/replica and the failure; must be ≤ RPO

Backup or replication frequency must be at least as frequent as RPO. Near-zero RPO needs continuous replication.

Impact tolerance test

Time to restore the critical operation ≤ impact tolerance

Tolerance is set from the harm to customers, markets and the firm, not from what IT can achieve. It is normally longer than or equal to the RTO of its supporting systems plus dependencies.

Relationship of terms

Operational resilience ⊃ BCP ⊃ DR

DR sits inside BCP, and BCP is one tool within a resilience framework. Treat this as a conceptual hierarchy.

CIA triad

Confidentiality + Integrity + Availability

Identify which property an attack or control affects. Ransomware mainly hits availability; data theft hits confidentiality; tampering hits integrity.

Control functions

Prevent → Detect → Respond → Recover

Classify every control into one of these. Backups are recover, not prevent.

NIST CSF functions

Identify, Protect, Detect, Respond, Recover (Govern added in version 2.0)

Use as a checklist for a complete programme.

Residual risk

Residual risk = Inherent risk − Risk reduced by controls

A conceptual relationship, not a precise calculation. Controls rarely remove risk fully.

Core access principles

Least privilege; segregation of duties; multi-factor authentication

Standard answers when a question asks how to limit insider or credential-based risk.

Quick revision

• Four responses to risk: avoid, reduce, transfer, accept.
• Mitigation lowers likelihood or impact; residual risk always remains.
• Preventive controls stop events; detective controls find them; corrective controls fix them.
• Three lines of defence: business ownership, independent risk and compliance oversight, internal audit assurance.
• Insurance transfers financial loss, not the underlying risk or reputational damage.
• Insurance gaps include deductibles, limits, exclusions, payout delays and insurer credit risk.
• Outsourcing moves the activity, not the accountability.
• Third-party risk needs due diligence, contract terms, ongoing monitoring and an exit strategy.
• Concentration in one provider is a risk in itself.
• Business continuity plans need regular testing to be credible.
• Operational resilience focuses on delivering critical services within an impact tolerance.
• Cyber defence is layered: access control, monitoring, patching, staff training, incident response and recovery.

Common mistakes

• Treating insurance as eliminating the risk. Fix: Say transfer leaves insurer credit risk, basis risk, exclusions, deductibles and reputational impact. Operational failure itself still happens.
• Choosing the cheapest option without checking risk appetite. Fix: Appetite is a constraint. Cost-benefit picks among options that already meet it.
• Calling a reconciliation a preventive control. Fix: A reconciliation finds breaks after transactions occur, so it is detective. Prevention stops the error before it is posted.
• Treating internal audit as part of the second line. Fix: Audit is the third line and reports independently to the board or audit committee. The second line is risk management and compliance.
• Applying the limit before the deductible, or treating the limit as the total loss covered including the deductible. Fix: Follow the question's wording. By default, deduct first, then cap the payout at the limit.
• Saying insurance fully removes operational risk. Fix: It transfers part of the loss only. Deductibles, limits, exclusions, basis risk and counterparty risk remain.
• Believing the firm transfers risk to the vendor Fix: Remember that regulatory accountability stays with the firm. A contract only allocates costs and duties.
• Treating due diligence as a one-time exercise Fix: Due diligence happens before onboarding and is refreshed through ongoing monitoring and periodic reviews.
• Treating BCP and DR as the same thing Fix: DR restores technology and data. BCP covers the whole business, including people, premises and suppliers.
• Mixing up RTO and RPO Fix: RTO is how long until service is back. RPO is how much data, measured in time, you can afford to lose.

Exam tips

• Read for the appetite statement first. Most scenario questions are decided by whether residual risk is inside it.
• When an option involves insurance, look for the hidden leftover risk: counterparty risk, basis risk, exclusions or deductibles.
• In numeric questions, compute net benefit as expected loss reduction minus cost, and check appetite before picking the highest number.
• Match the verb to the option: avoid means exit, accept means retain and monitor, reduce means controls, transfer means insurance or contract.
• Be careful with words like always and eliminates. Mitigation options rarely remove risk fully.
• Always classify by timing first. Many options differ only in preventive, detective or corrective wording.
• In three-lines questions, look for independence. The correct answer usually keeps risk oversight separate from the business.
• Match scenario wording to COSO components: tone at the top points to control environment, dashboards and reporting to information and communication.