Top 5 Operational Risk Scenarios in Finance (CISI Guide)

Table of Contents

• • 1. Internal Fraud (The Rogue Trader)
• • 2. External Fraud (Cyber Attacks)
• • 3. Execution, Delivery, and Process Management
• • 4. Damage to Physical Assets
• • 5. Clients, Products, and Business Practice
• • Conclusion

Operational Risk is defined by the Basel Committee as “the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events.”

For candidates taking the CISI Operational Risk exam, memorizing definitions is not enough; you must classify the loss event, identify the failed control and select a proportionate response. The five examples below are not the complete loss-event taxonomy. Employment Practices and Workplace Safety, and Business Disruption and System Failures are two other categories that must still be revised.

A useful rule for ambiguous cases is to classify the event that produced the loss, not only its root cause. A ransomware intrusion may begin as external fraud, for example, while the resulting outage may also create a business-disruption incident.

1. Internal Fraud (The Rogue Trader)

Internal fraud occurs when an employee intentionally bypasses controls for personal gain or to hide losses.

• Example: Nick Leeson at Barings Bank or Kweku Adoboli at UBS.
• Mitigation: Strict segregation of duties, mandatory block leave (making it hard to hide ongoing fraud), and rigorous reconciliation processes.
• Early warning indicator: Unreconciled positions, repeated limit overrides, cancelled confirmations or unusual profit patterns concentrated under one employee.

2. External Fraud (Cyber Attacks)

This involves third parties attempting to steal data or funds.

• Example: Ransomware attacks shutting down bank servers or phishing campaigns stealing client credentials.
• Mitigation: Multi-factor authentication (MFA), robust firewall configurations, and continuous employee cybersecurity training.
• Early warning indicator: Spikes in failed logins, impossible-travel alerts, privilege escalation or a sudden rise in blocked outbound traffic.

3. Execution, Delivery, and Process Management

These are ‘fat finger’ errors or systemic failures in processing transactions.

• Example: A trader accidentally typing an extra zero on a sell order, causing a flash crash.
• Mitigation: Automated trade limit checks, straight-through processing (STP) to reduce manual entry, and robust four-eye checks for large transactions.
• Early warning indicator: Manual overrides, amended settlements, unmatched trades or an increasing exception queue near cut-off times.

4. Damage to Physical Assets

Losses resulting from physical destruction of property.

• Example: A fire, flood, or earthquake destroying a primary data center.
• Mitigation: Comprehensive Business Continuity Planning (BCP) and off-site data replication/disaster recovery sites.
• Early warning indicator: Overdue recovery tests, failed backups, unresolved generator faults or recovery times that exceed the approved objective.

5. Clients, Products, and Business Practice

Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients.

• Example: Mis-selling high-risk derivatives to retail pensioners, resulting in massive regulatory fines.
• Mitigation: Strict Know Your Customer (KYC) protocols, suitability checks, and ethical sales training.
• Early warning indicator: Concentrated sales to vulnerable clients, suitability overrides, repeated complaints or high cancellation and remediation rates.

Conclusion

For each practice question, write four short answers: the loss-event category, the failed control, one preventive control and one indicator that would give earlier warning. This exposes the difference between knowing a definition and applying it to an incident.