Skip to content

FRM Exam Part II · Introduction to Operational Risk and Resilience

Operational Risk Management Framework and Tools Explained

Updated 11 October 2026 · Fact-checked

The operational risk management framework is a repeating cycle: identify, assess, control, monitor and report. Its core tools are RCSA, key risk indicators, loss data collection, scenario analysis and controls. To answer exam questions, match the tool to the job: RCSA is forward-looking and qualitative, KRIs give early warning, and loss data records what has already happened.

Understand Operational Risk Management Framework and Tools

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk and excludes strategic and reputational risk. A framework gives a bank a repeatable way to find these risks, judge them, reduce them and watch them.

The framework works as a cycle. First you identify risks, using process maps, taxonomies and new-product reviews. Then you assess them for likelihood and impact. Next you control or mitigate them through controls, insurance or exiting an activity. Then you monitor with indicators and loss data. Finally you report to management and the board. The cycle repeats because the business and the threats change.

Each tool has a different time view. Loss data collection is backward-looking: it records actual events, with amounts, dates, causes and recoveries. RCSA (risk and control self-assessment) is forward-looking: business units list their risks and controls, then rate inherent risk, control effectiveness and residual risk. Key risk indicators (KRIs) are metrics that signal a change in risk exposure or control health, for example staff turnover, system downtime, failed trades or overdue reconciliations. They have thresholds that trigger escalation.

Scenario analysis is also forward-looking. Experts build plausible but severe events, such as a major cyber attack or a rogue trader, and estimate frequency and loss. It covers rare, high-impact events that internal loss data lacks. RCSA reviews many routine risks across units; scenario analysis digs into a few severe ones and gives numbers.

Controls sit beneath all of this. Preventive controls stop an event, such as access limits. Detective controls find it, such as reconciliations. Corrective controls limit damage, such as backup recovery. The three lines of defense tie it together: the business owns risk, the risk function oversees it and internal audit gives independent assurance.

Key formulas to remember

Residual risk
Residual risk = Inherent risk − Effect of controls
Conceptual, not numerical. Used in RCSA: rate risk before controls, rate control effectiveness, then rate what remains.
Risk rating score (typical RCSA)
Score = Likelihood rating × Impact rating
Many banks use this on 1-5 scales. It is a common practice, not a Basel rule.
Framework cycle
Identify → Assess → Control/Mitigate → Monitor → Report
Know the order and which tool supports each stage.
Tool time view
Loss data = past; RCSA, KRIs, scenarios = forward-looking
KRIs are leading indicators; loss events are lagging.

How to solve Operational Risk Management Framework and Tools questions

Use this method for any question on operational risk tools, whether it is a definition, a case or a tool-selection question.

  1. 1Read the scenario and find the stage of the cycle: identify, assess, control, monitor or report.
  2. 2Decide whether the need is backward-looking (what happened), current (control health) or forward-looking (what could happen).
  3. 3Match the tool: loss data for history, RCSA for routine risks and controls, KRIs for early warning, scenario analysis for rare severe events.
  4. 4Check who performs it: business units own RCSA and first-line controls; the risk function challenges and aggregates.
  5. 5If numbers are given, apply the stated formula, such as likelihood × impact, and read the rating bands.
  6. 6Eliminate options that mix up the tools, for example calling a KRI a loss record, or that overstate what a tool can do.
  7. 7Confirm the answer fits the Basel definition of operational risk.

Quickest way: Tool-matching shortcut

When to use it: Use it for tool-selection and definition MCQs when time is short.

  1. Ask: past, present or future?
  2. Past: loss data. Present control health or early warning: KRI. Future routine risks: RCSA. Future severe rare events: scenario analysis.
  3. Check for the word self: RCSA is performed by the business unit itself.
  4. Pick the option that matches both the purpose and the owner.

Common mistakes in Operational Risk Management Framework and Tools

  • Saying RCSA and scenario analysis are the same thing

    Both are forward-looking and use expert judgment.

    Fix: RCSA covers many routine risks and controls in a unit. Scenario analysis builds a few severe, rare events and estimates frequency and loss.

  • Treating KRIs as lagging measures

    Students confuse them with loss data.

    Fix: KRIs are usually leading. They signal rising risk before losses occur, and thresholds trigger escalation.

  • Confusing inherent and residual risk

    The terms sound alike.

    Fix: Inherent risk is before controls. Residual risk is after controls. Weak controls leave residual close to inherent.

  • Relying on internal loss data alone for tail risk

    Data feels objective.

    Fix: Severe events are rare, so internal data is thin. Supplement it with external data and scenario analysis.

  • Including reputational or strategic risk in the Basel definition

    Everyday usage of operational risk is broad.

    Fix: Basel includes legal risk but excludes strategic and reputational risk.

Worked examples

Example 1

A bank wants an early warning that its payments processing is deteriorating before customers are affected. Which tool fits best: (A) loss data collection, (B) key risk indicators, (C) external audit report, (D) annual scenario workshop?

Show the solution
  1. The need is early warning, so it is a leading, ongoing signal.
  2. Loss data records events after they happen, so it is lagging.
  3. An audit report is periodic and independent assurance, not a continuous signal.
  4. A scenario workshop is annual and about severe hypotheticals.
  5. KRIs such as failed payment rate or system downtime, with thresholds, give timely warning.

Answer: B: key risk indicators.

Example 2

In an RCSA, a process has a likelihood rating of 4 and an impact rating of 5, both on 1-5 scales. Controls are judged to reduce the score by 40%. Using score = likelihood × impact, what is the residual score?

Show the solution
  1. Inherent score = 4 × 5 = 20.
  2. Controls reduce it by 40%, so the reduction = 0.40 × 20 = 8.
  3. Residual score = 20 − 8 = 12.
  4. Check: 20 × 0.60 = 12.

Answer: Residual score = 12 (inherent 20). This 40% reduction is an assumption given in the question, not a standard.

Exam tips

  • Tool-matching questions are common. Identify past, present or future first.
  • Know the owner of each tool: the business runs RCSA and first-line controls; the second line challenges.
  • Watch for options that say loss data alone is sufficient. It never captures rare severe events well.
  • Remember preventive, detective and corrective control types and give an example of each.
  • Tie the framework to Basel's definition: includes legal risk, excludes strategic and reputational risk.

Practice questions from Introduction to Operational Risk and Resilience

Operational Risk Management Framework and Tools in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational Risk Management Framework and Tools: frequently asked questions

What is RCSA in operational risk?

Risk and control self-assessment is a process where business units identify their own risks and controls. They rate inherent risk, control effectiveness and residual risk. The risk function then reviews and challenges the results.

What are examples of key risk indicators?

Examples include staff turnover, system downtime, number of failed trades, overdue reconciliations and unresolved audit findings. Each has thresholds that trigger escalation when breached.

What is the difference between RCSA and scenario analysis?

RCSA reviews many routine risks and the controls over them, usually by rating likelihood and impact. Scenario analysis takes a few severe, rare events and estimates their frequency and loss. Scenario analysis supports tail risk and capital work.

Why is loss data not enough on its own?

It only shows events that already happened, and severe losses are rare. Internal data is therefore thin in the tail. Banks add external data and scenarios to fill the gap.