Assess, Control, Monitor & Respond
The Operational Risk Framework is based on the following four-step process:
1. Assess the risks in the business
o Inventory the processes, technology and other business assets
o Determine the risk profile
o Assess the inherent risk for each process
2. Implement controls to mitigate those risks
o Inventory the existing controls
o Determine if the controls adequately address the risk or if modifications or additional controls are necessary
o Assess the residual risk of each process based on these controls
3. Monitor the performance of those controls
o Implement periodic testing and reporting to identify deficiencies in controls
4. Respond to instances where the controls are deficient
o Implement procedures to limit losses caused by control failures
o Create a process of continuous improvement that adjusts controls based on changes to the risk environment