Is the Operational Risk exam suitable for beginners?

While it covers advanced concepts like Basel III and risk modelling, it is a Level 3 qualification and accessible for practitioners looking to formalise their knowledge.

How long should I study for the CISI Operational Risk exam?

Study time depends on prior experience. Work through all seven chapters, then use timed practice and answer explanations to find weak areas.

What are the core topics covered in the syllabus?

Key areas include the regulatory environment (Basel frameworks, FCA guidelines), risk identification and assessment, cyber risk, and enterprise risk management (ERM).

A retail bank based in France opens a new savings account for an individual who is a resident of France but holds US citizenship. The bank fails to identify the customer as a US person and does not report the account details to the US Treasury. Under which legislation is the bank primarily facing compliance risks?

Foreign Account Tax Compliance Act (FATCA)

A senior director at a UK-listed company suggests that in order to align her interests with the company's short-term quarterly targets, she should personally decide her remuneration outcome and base it solely on quarterly profits. Under the UK Corporate Governance Code updated in 2024, how should this suggestion be addressed?

It should be rejected because remuneration policies should promote long-term sustainable success and no director should be involved in deciding their own remuneration.

It should be approved since directors are encouraged to align their interests with shareholder quarterly returns.

It should be rejected because executive remuneration is determined solely by the shareholders, not the board.

It should be approved, provided she discloses her remuneration outcome at the general meeting.

A risk manager at a bank is analysing a portfolio of foreign exchange forward contracts. To quantitatively assess the severity of the credit risk, the manager calculates the current obligation outstanding and then uses statistical techniques within a Value at Risk (VaR) framework to calculate the likely maximum loss over the life of the contracts. What two elements is the manager combining to determine the overall credit exposure?

Current exposure and Potential future exposure

Market depth and Potential future exposure

Pre-settlement exposure and Direct exposure

Expected shortfall and Current exposure

What is the difference between Funding Liquidity Risk and Market Liquidity Risk?

Funding Liquidity Risk is lacking sufficient cash to fulfill transactions, whereas Market Liquidity Risk is the inability to close out a position because the market itself is illiquid.

What is Enterprise Risk Management (ERM)?

An integrated, firm-wide approach to managing all of an organization's interrelated risks to protect shareholder value.

What is the purpose of a Risk Register?

It serves as a central database of all identified risks, detailing their source, impact, likelihood, and the countermeasures used to mitigate them.

What is the primary role of the Chief Risk Officer (CRO)?

To ensure efficient and effective governance of significant risks, oversee ERM, and ensure regulatory compliance.

CISI Operational Risk Exam Guide: Everything You Need to Know

Q: What is the CISI Operational Risk exam format?

The Version 22 syllabus specifies 50 multiple-choice questions in 60 minutes. The public syllabus does not publish a pass mark; this course uses 70% as its practice target.

Table of Contents

• Understanding the Syllabus
• Key Focus Areas for the Exam
- 1. The Basel Frameworks
- 2. Risk Assessment and Mitigation
- 3. Cyber Security
• Preparation Strategies
- Start with the Official Workbook
- Practice with Realistic Mock Exams
- Utilise Flashcards for Key Terms
• Conclusion

CISI Operational Risk

Explore syllabus-aligned study tools, realistic practice and course-grounded AI support.

The CISI Operational Risk qualification is a pivotal certification for professionals navigating the complex landscape of risk management in modern financial services. From the principles of the Basel Committee to the nuances of cyber risk and internal governance, this exam tests your ability to identify, assess, and mitigate risks that could severely impact a firm’s operational stability.

In this guide, we will break down the syllabus, explore key topics, and provide actionable strategies to help you pass the exam on your first attempt.

Understanding the Syllabus

The current Edition 26 workbook supports Version 22 of the syllabus, used for exams from 20 September 2025 to 19 September 2027. The exam consists of 50 multiple-choice questions in 60 minutes. The public syllabus does not publish a pass mark; our course uses 70% as a practice target.

The syllabus has seven elements, in the same order as the workbook chapters, with nominal allocations of 3, 7, 20, 4, 5, 7 and 4 questions:

Risk Basics
Other Major Risks
The Nature of Operational Risk
The Causes and Impacts of Operational Risk
Operational Risks Arising in the Trade Cycle
The Support and Control Functions
Operational Risk in the Regulatory Environment

Key Focus Areas for the Exam

1. The Basel Frameworks

The regulatory element covers the Basel Committee on Banking Supervision (BCBS). Understand the evolution from Basel I to Basel III and the three pillars:

Pillar 1: Minimum Capital Requirements
Pillar 2: Supervisory Review Process
Pillar 3: Market Discipline

Keep the historical Basel II Basic Indicator, Standardised and Advanced Measurement Approaches distinct from the later Basel III standardised approach (SA). The current workbook presents the latter using the Business Indicator Component (BIC) and Internal Loss Multiplier (ILM).

2. Risk Assessment and Mitigation

You will be tested on the tools used to identify and assess operational risk. Familiarize yourself with:

Risk Registers: Central databases of all identified risks.
Key Risk Indicators (KRIs): Metrics used to signal changes in the risk profile.
Scenario Analysis: Evaluating the impact of extreme but plausible events.

Interactive preview

Free CISI Operational Risk Practice Questions & Exam Preview

Try 15 CISI Operational Risk practice questions from The Nature of Operational Risk

Practice CISI Operational Risk exam questions with answers and explanations. The full course includes 5 mock exams and chapter study tools.

Exam Preview

The Nature of Operational Risk

Question 1 of 15

An international bank is drafting its new operational risk policy to define risk appetite and establish boundaries between operational, market, and credit risk. The Chief Risk Officer proposes that the policy only be signed off by the heads of each division to ensure local buy-in. According to best practices in operational risk management, what is the primary flaw in this approach?

1 / 15

Flashcards

Card 1 of 10Element 1: Risk Basics

Question

How does the Basel Committee on Banking Supervision (BCBS) formally define Operational Risk?

Tap to reveal answer

Focus Learn

Key Examinable Areas5

Distinguish likelihood from consequence in a risk definition.
Classify credit, market, liquidity and operational risk in practical scenarios.
Explain what Invesco, PPI, LIBOR, HSBC, Bank of Bangladesh and other named events show about controls.
State ERM's four practical aims and its firm-wide scope.
Explain why common definitions, data and culture matter to ERM.

Common Pitfalls to Avoid3

Exam Traps3

Key Numbers3

Chapter 1: Risk Basics

Risk is the possibility of an adverse consequence, not the certainty that an event will occur. A firm therefore considers both the likelihood of an event and what it would lose if the event happened. In financial services, the four broad categories are credit, market, liquidity and operational risk. Credit concerns a borrower or counterparty failing to meet an obligation. Market risk concerns adverse changes in financial-instrument values. Liquidity has an asset side (a position cannot be sold promptly at a reasonable price) and a funding side (the firm cannot meet payments when due). Operational risk concerns losses from inadequate or failed processes, people, systems or external events. One incident can engage several categories, so identify the actual cause and consequence before choosi…

Unlock all Focus Learn

Open every chapter’s key areas, pitfalls, exam traps and key numbers.

3. Cyber Security

As cyber threats become more sophisticated, regulators are placing greater emphasis on IT security and data protection. You should understand the principles of the General Data Protection Regulation (GDPR), the role of the Chief Information Security Officer (CISO), and common cyber threats like phishing, ransomware, and DDoS attacks.

Preparation Strategies

Start with the Official Workbook

The CISI Edition 26 workbook is the primary study source for the current Version 22 syllabus. Read it alongside the learning objectives, noting key definitions, controls, regulatory bodies and the BIC × ILM relationship.

Practice with Realistic Mock Exams

Use timed practice to identify weak areas and get comfortable with the question format. The course has four original 50-question mocks and a fifth mixed review paper drawn from those questions.

Utilise Flashcards for Key Terms

Operational risk involves a lot of terminology and acronyms (e.g., KRI, RCSA, BCBS). Flashcards are an excellent tool for rapid recall and spaced repetition. Ensure you are familiar with all definitions, as the exam often uses precise language.

Conclusion

Passing the CISI Operational Risk exam requires a solid understanding of both the theoretical frameworks and the practical applications of risk management. By dedicating sufficient time to study, utilizing mock exams, and focusing on the core syllabus areas, you will be well on your way to achieving this valuable certification.

Search courses