FRM Exam Part II · Risk Mitigation

Operational Risk Mitigation Strategies for FRM Part II

Updated 11 October 2026 · Fact-checked

Operational risk mitigation means choosing how to treat each risk: avoid it, accept it, reduce it with controls, or transfer it through insurance or contracts. You choose by comparing residual risk with risk appetite, then checking that the cost of the treatment is justified by the expected loss it removes.

Understand Operational Risk Mitigation Strategies

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk in this definition and excludes strategic and reputational risk. You cannot remove it entirely, so firms treat it risk by risk.

There are four standard treatment options. Avoid: stop the activity or exit the product, market or vendor that creates the risk. Accept: keep the risk and fund any loss from earnings or capital, usually with monitoring. Reduce: lower the frequency or severity with controls, such as segregation of duties, automation, reconciliations, backups and training. Transfer: shift the financial impact to another party through insurance, outsourcing contracts with indemnities, or hedging-type arrangements.

The choice starts with inherent risk, which is the risk before controls. Controls reduce it to residual risk. Management compares residual risk with risk appetite, the amount and type of risk the board is willing to take, and with risk tolerance or limits, the maximum deviation allowed. If residual risk is within appetite, the firm accepts and monitors it. If it is above appetite, the firm adds controls, transfers part of it, or avoids the activity.

Cost-benefit analysis decides between options that all work. The benefit of a treatment is the reduction in expected loss (frequency × severity) plus any reduction in capital or tail exposure. The cost includes the price of the control or premium and any lost revenue. Pick the option with the best net benefit that brings risk inside appetite.

Two points matter in exams. First, transfer does not remove the risk. Insurance leaves behind counterparty risk (the insurer may not pay), basis risk (the policy may not match the loss), coverage gaps and exclusions, and deductibles. Reputational damage is not transferred. Second, controls can fail, so reducing risk creates a need to monitor control effectiveness. Outsourcing moves the activity, not the accountability.

Key formulas to remember

Expected operational loss: Expected loss = frequency × average severity; Use annual frequency and average loss per event in the same currency.
Net benefit of a treatment: Net benefit = reduction in expected loss − annual cost of treatment; Choose the option with the highest net benefit that also keeps residual risk within appetite. Add capital savings or lost revenue if the question gives them.
Residual risk: Residual risk = inherent risk after the effect of controls; Compare residual risk with risk appetite, not inherent risk.
Benefit-cost ratio: Benefit-cost ratio = reduction in expected loss ÷ cost of treatment; A ratio above 1 means the treatment pays for itself on expected loss alone. Risk appetite can still require action when the ratio is below 1.
Decision rule: Residual within appetite → accept and monitor; above appetite → reduce, transfer or avoid; A rule of thumb. Avoid is usually chosen when no affordable treatment brings risk within appetite.

How to solve Operational Risk Mitigation Strategies questions

Use this sequence for any question on choosing or evaluating an operational risk treatment.

1Identify the risk and its inherent level: how often it happens and how large the loss could be, including tail events.
2List existing controls and estimate the residual risk after them.
3Compare residual risk with the stated risk appetite or limit. If it is inside, the answer is usually accept and monitor.
4If it is outside, list the options: reduce, transfer, avoid. Note what each one leaves behind (control failure, insurer credit risk, basis risk, lost revenue).
5Quantify each option: expected loss removed, cost, and net benefit. Compute the residual risk after each option.
6Reject any option that does not bring risk inside appetite, however cheap. Among the rest, pick the best net benefit.
7State the monitoring needed: key risk indicators, control testing and review of the decision.

Quickest way: Appetite first, then cost

When to use it: Use this on scenario MCQs where four treatments are offered and time is short.

Check whether residual risk already sits inside appetite. If yes, the answer is accept with monitoring.
Eliminate options that do not meet appetite or that ignore a leftover risk, such as treating insurance as full removal.
If numbers are given, compute net benefit = loss reduction − cost for each remaining option.
Choose the highest net benefit. If the activity has no strategic value and risk stays high, pick avoid.

Common mistakes in Operational Risk Mitigation Strategies

Treating insurance as eliminating the risk.
The financial loss moves, so it feels like the risk has gone.
Fix: Say transfer leaves insurer credit risk, basis risk, exclusions, deductibles and reputational impact. Operational failure itself still happens.
Choosing the cheapest option without checking risk appetite.
Cost-benefit looks like the whole decision.
Fix: Appetite is a constraint. Cost-benefit picks among options that already meet it.
Comparing inherent risk with appetite.
Students forget that controls already exist.
Fix: Always compare residual risk, after current controls, with appetite.
Assuming outsourcing transfers accountability.
A contract with a vendor seems to move responsibility.
Fix: The firm keeps responsibility to customers and regulators. Outsourcing needs due diligence, SLAs and monitoring.
Choosing avoid for every large risk.
It sounds safest.
Fix: Avoid gives up revenue and may push risk elsewhere. Use it when no affordable option meets appetite or the activity has little value.
Ignoring that accepted risks still need monitoring.
Accept is read as doing nothing.
Fix: Accept is a deliberate decision with ownership, indicators, loss provisioning and periodic review.

Worked examples

Example 1

A bank's payments process has a payment-fraud risk with an expected 4 events a year and an average loss of $50,000 per event. A new automated screening control costs $60,000 a year and would cut frequency to 1.5 events a year, with severity unchanged. Insurance with the same cost would cover only losses above $200,000, and no single event reaches that level. Which option has the better net benefit?

Show the solution

Current expected loss = 4 × $50,000 = $200,000 a year.
Expected loss with the control = 1.5 × $50,000 = $75,000.
Reduction = $200,000 − $75,000 = $125,000.
Net benefit of the control = $125,000 − $60,000 = $65,000. Benefit-cost ratio = 125,000 ÷ 60,000 ≈ 2.08.
Insurance pays only above $200,000 and no event reaches that, so its expected recovery is $0. Net benefit = $0 − $60,000 = −$60,000.

Answer: Choose the screening control. Its net benefit is $65,000 a year, whereas the insurance has a net benefit of −$60,000.

Example 2

A firm's risk appetite caps expected annual loss from a settlement process at $300,000. Current expected loss is $450,000. Option A: add controls costing $90,000 a year, cutting expected loss by $200,000. Option B: stop the activity, losing $500,000 of annual net revenue, cutting expected loss to zero. Option C: accept and monitor. Which option should the firm choose?

Show the solution

Option C leaves expected loss at $450,000, which is above the $300,000 cap. It breaches appetite, so reject it.
Option A gives residual expected loss = $450,000 − $200,000 = $250,000, which is within appetite.
Net benefit of A = $200,000 − $90,000 = $110,000.
Option B meets appetite, but its net effect = $450,000 loss avoided − $500,000 revenue lost = −$50,000.
A and B both meet appetite. A has the higher net benefit.

Answer: Choose Option A. It brings expected loss to $250,000, inside appetite, with a net benefit of $110,000, while avoiding the activity costs more than it saves.

Exam tips

Read for the appetite statement first. Most scenario questions are decided by whether residual risk is inside it.
When an option involves insurance, look for the hidden leftover risk: counterparty risk, basis risk, exclusions or deductibles.
In numeric questions, compute net benefit as expected loss reduction minus cost, and check appetite before picking the highest number.
Match the verb to the option: avoid means exit, accept means retain and monitor, reduce means controls, transfer means insurance or contract.
Be careful with words like always and eliminates. Mitigation options rarely remove risk fully.

Practice questions from Risk Mitigation

Operational Risk Mitigation Strategies in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational Risk Mitigation Strategies: frequently asked questions

What are the four operational risk treatment options?

They are avoid, accept, reduce and transfer. Avoid stops the activity, accept retains the risk with monitoring, reduce uses controls to lower frequency or severity, and transfer shifts the financial impact through insurance or contracts.

How does a firm choose between avoid, accept and transfer?

It compares residual risk with risk appetite. If residual risk is inside appetite, it accepts and monitors. If not, it considers reducing or transferring, and avoids the activity when no affordable option brings risk within appetite. Cost-benefit analysis ranks the options that qualify.

Does insurance remove operational risk?

No. It transfers part of the financial loss but leaves the risk event itself. Residual issues include insurer credit risk, basis risk, coverage gaps, deductibles and reputational damage.

What is the difference between risk appetite and risk tolerance?

Risk appetite is the level and type of risk the board is willing to take to pursue its objectives. Risk tolerance or limits set the maximum acceptable deviation, often as quantified thresholds used to trigger action.