Skip to content

FRM Exam Part I · Operational Risk

Operational Risk Case Studies and Mitigation for FRM Part I

Updated 11 October 2026 · Fact-checked

Operational risk case studies show how weak controls, fraud, poor oversight and flawed models cause large losses. Mitigation uses controls, segregation of duties, limits, reconciliations, business continuity and insurance. To answer exam questions, find the root cause, name the control that failed, then pick the fix that targets it.

Understand Operational Risk Case Studies and Mitigation

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk but excludes strategic and reputational risk. Case studies matter because the same few failures repeat.

The classic rogue trading cases are Barings (1995), Société Générale (2008), Allied Irish Banks and UBS (2011). The common causes are weak segregation of duties, poor supervision, fictitious or hidden trades, and ignored warning signs. At Barings, one person controlled both trading and back-office settlement and used a hidden error account. At Société Générale, a trader entered fictitious offsetting hedges and knew how the control team checked positions. In both cases, managers accepted unusual profits without enough challenge.

Other events teach different lessons. Model risk is the risk of loss from using a wrong or misused model, as in the London Whale case at JPMorgan (2012), where a flawed VaR model change and weak review understated risk. Cyber risk and business disruption involve systems failures, data breaches and outages. External fraud, legal and conduct losses (for example mis-selling and benchmark manipulation) are often large and arrive years after the behaviour.

Mitigation has layers. Prevent with segregation of duties, access controls, limits, mandatory leave and independent valuation. Detect with reconciliations, exception reports, whistleblowing channels and internal audit. Respond with business continuity plans and incident management. Transfer with insurance, which covers only some losses.

Insurance has limits. It has deductibles, caps, exclusions, and payment delays. There is also moral hazard (the insured takes less care) and adverse selection. Basel's advanced approach allowed insurance to reduce capital only within a limit and only if the insurer was suitably rated and the cover was robust. Insurance does not fix culture, and it does not cover reputational damage. Hence controls and culture come first.

Key formulas to remember

Net loss after insurance
Net loss = Gross loss − Insurance recovery (after deductible, up to the policy limit)
Recovery = min(max(Loss − Deductible, 0), Policy limit), assuming a simple policy with no co-insurance.
Operational risk categories (Basel event types)
Internal fraud; External fraud; Employment practices and workplace safety; Clients, products and business practices; Damage to physical assets; Business disruption and system failures; Execution, delivery and process management
Match each case to one category; Barings and Société Générale are internal fraud.
Control layers
Prevent → Detect → Respond → Transfer
Use this order to match a failure to the right mitigation.
Expected value of an insured loss
Expected net loss = Σ (probability × net loss after recovery)
Use it to compare retained loss with and without insurance.

How to solve Operational Risk Case Studies and Mitigation questions

Use this method for any case-study or mitigation question.

  1. 1Read the scenario and identify what actually went wrong: fraud, process error, system failure, model flaw or external event.
  2. 2Classify it into the Basel event-type category.
  3. 3Identify the control that failed: segregation of duties, supervision, reconciliation, independent valuation, access or culture.
  4. 4Match the mitigation to that failure. Prefer fixes that address the root cause over insurance.
  5. 5If insurance is involved, compute recovery: subtract the deductible, then cap at the limit.
  6. 6Check conditions and limits: exclusions, moral hazard, insurer credit quality, and that insurance cannot cover reputational loss.
  7. 7Eliminate options that overstate what insurance or one control can do, then choose the best answer.

Quickest way: Failure-to-fix matching

When to use it: For conceptual MCQs on case lessons and mitigation, when you have under a minute.

  1. Underline the failure in the stem (for example, one person did both trading and settlement).
  2. Name the broken control in one phrase.
  3. Choose the option that restores that control, not the generic or expensive one.
  4. For insurance arithmetic, do (loss − deductible), then apply the limit.

Common mistakes in Operational Risk Case Studies and Mitigation

  • Thinking insurance removes operational risk.

    Insurance sounds like full risk transfer.

    Fix: Remember deductibles, limits, exclusions, delays and moral hazard. Insurance supplements controls; it does not replace them.

  • Applying the policy limit before the deductible.

    Students rush the arithmetic.

    Fix: Subtract the deductible first, then cap at the limit.

  • Labelling rogue trading as market risk.

    The loss shows up on a trading book.

    Fix: The cause was unauthorized activity and control failure, so it is internal fraud (operational risk). Market moves only sized the loss.

  • Treating reputational damage as part of Basel operational risk.

    Case losses often include reputational effects.

    Fix: The Basel definition includes legal risk but excludes strategic and reputational risk.

  • Naming a single cause for a case.

    Cases are summarized as one trader's fault.

    Fix: Cite the combination: weak segregation, poor oversight, ignored red flags and a culture that rewarded profit.

  • Treating model risk as only a coding error.

    Model failures sound technical.

    Fix: Model risk also covers misuse, wrong assumptions, weak validation and weak governance over changes.

Worked examples

Example 1

A bank has an operational risk insurance policy with a deductible of $2 million and a policy limit of $15 million. A fraud causes a gross loss of $20 million. What is the bank's net loss, assuming no other recoveries?

Show the solution
  1. Loss above the deductible = 20 − 2 = $18 million.
  2. Cap at the policy limit: min(18, 15) = $15 million recovery.
  3. Net loss = 20 − 15 = $5 million.

Answer: $5 million

Example 2

A trader at a bank books fictitious offsetting trades to hide losses. He previously worked in the middle office and knows when and how confirmations are checked. Which mitigation most directly addresses the root control weakness? (A) Buying more insurance (B) Independent confirmation of trades with counterparties and mandatory consecutive leave (C) Increasing the trader's bonus deferral only (D) Reducing the VaR confidence level

Show the solution
  1. The failure is internal fraud enabled by concealed trades and a trader who understood the checks.
  2. Insurance (A) transfers some loss but does not stop the fraud.
  3. Bonus deferral (C) helps incentives but does not detect fake trades.
  4. Lowering the VaR confidence level (D) reduces reported risk and fixes nothing.
  5. Independent counterparty confirmation detects fictitious trades, and mandatory leave interrupts the concealment routine.

Answer: (B)

Exam tips

  • Know the cases by category: Barings and Société Générale are internal fraud; London Whale is model risk and governance; cyber events are systems and external fraud.
  • Expect questions asking which control would have prevented a case. Choose segregation of duties, independent confirmation or supervision over insurance.
  • For insurance arithmetic, write: loss − deductible, then cap at limit, then net loss.
  • Watch for absolute words like 'eliminates' or 'fully covers'. They usually signal a wrong option.
  • Remember that culture and tone from the top appear in nearly every case lesson.

Practice questions from Operational Risk

Operational Risk Case Studies and Mitigation in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational Risk Case Studies and Mitigation: frequently asked questions

What are the main lessons from Barings and Société Générale?

Both show the danger of weak segregation of duties, poor supervision and ignored warning signs. Unusual profits or large cash and margin demands should trigger challenge. Independent confirmation and strong back-office control reduce the risk.

Can insurance cover all operational risk losses?

No. Policies have deductibles, limits and exclusions, and payment can be slow. Reputational and strategic losses are generally not covered. Insurance can also create moral hazard, so it works alongside controls.

How is model risk linked to operational risk?

Model risk is loss from wrong or misused models, and it often arises from weak validation, governance and change control. The London Whale case is a common example. It is treated as a risk to manage through independent review and model inventory.

How should I study cyber and fraud for FRM Part I?

Focus on classification, the failed control and the matching mitigation. Know prevent, detect, respond and transfer layers. Practise short scenario questions rather than memorising long case histories.