Lab Test: Operational and non-financial risk · RiskAtoms Academy

How it works

Eight problems from the people who run a bank's operational risk: the loss data analyst, the risk partner who challenges the business, cyber, scenarios, modelling, capital, resilience and the reporting team. They follow one new bank, Tarrowby Bank plc, and most need more than one lesson. Answer each part (the unit is shown beside the box; £, %, commas and a minus sign are fine), press Check, then step through the worked solution. Numeric answers are marked right within a small tolerance, so round sensibly as you go; counts, scores and days must be exact. Keep a calculator handy.

Illustrative dataTarrowby Bank plc, a new bank for the Lab Test

The lessons use RiskAtoms Bank's operational risk book. These problems apply the same rules and methods to a new, smaller bank: Tarrowby Bank plc, invented, with a £30bn balance sheet. Its loss records, controls, indicators, scenario, fits, business indicator, services, recovery options and cases are all made up and kept hand-sized; amounts in £ millions unless stated. It buys from some of the same invented suppliers as RiskAtoms Bank (Cirrovane Cloud, Quillmoor Systems, Velmarra Payments, Wrenhallow Telecom). The residual rating rule is the module's teaching rule, not an industry standard.

Problem 1Filing a year of losses

L3.7.01 · L3.7.03

Operational risk analyst, Tarrowby Bank plc

Tarrowby Bank plc (invented) is a UK retail and commercial bank with a £30bn balance sheet, under half the size of RiskAtoms Bank. It records every loss of £10,000 gross or more; its regulatory data set keeps those of £20,000 gross or more, dated by the accounting date, net of recoveries received. These records were entered during 2025 and January 2026 (£ thousands):

£ thousands
Record	Occurred	Discovered	Accounted	Gross	Recovered
T1 An attacker uses a phished staff mailbox to send false payment instructions; the bank pays out a corporate client's money and recalls part of it.	18 Apr 2025	22 Apr 2025	30 May 2025	1,850	450
T2 A broker ring falsified incomes on nine buy-to-let mortgages; the loans defaulted and the losses are already in credit impairments.	12 Jun 2023	3 Feb 2025	31 Mar 2025	1,240	–
T3 An FX forward is booked the wrong way round; the position is closed at a loss when the error is found.	3 Mar 2025	6 Mar 2025	6 Mar 2025	310	–
T4 A flood damages a branch; the repairs are booked in January, and the insurer pays part.	2 Dec 2024	2 Dec 2024	20 Jan 2025	520	380
T5 An employment tribunal awards a dismissed employee compensation for unfair dismissal.	14 Sep 2023	1 Feb 2024	10 Sep 2025	85	–
T6 A supplier invoice is paid twice; the second payment is recalled in full three days later.	8 Jul 2025	9 Jul 2025	11 Jul 2025	640	640
T7 Card details skimmed at one cash machine; customers refunded.	19 Aug 2025	25 Aug 2025	1 Sep 2025	14	–
T8 A £2.3m CHAPS payment keyed to the wrong beneficiary is stopped by the second-person check (potential loss £2,300k).	2 Oct 2025	2 Oct 2025	2 Oct 2025	0	–
T9 Overdraft fees wrongly charged from 2022 to 2024 are found in November 2025; the redress provision is booked in January 2026.	4 Jan 2022	20 Nov 2025	15 Jan 2026	2,600	–

Over the ten accounting years 2016–2025 the regulatory data set holds 412 events with £118.0m of net losses. The three largest: a redress provision for mortgage arrears charges (2019) £42.0m, a core banking outage (2021) £8.6m and an AML fine (2023) £5.4m.

Lessons: L3.7.01: What operational risk is · L3.7.03: Loss data

(a)Which Basel event types do T1, T3, T4 and T5 go under?
AT1 internal fraud (a member of staff clicked the link); T3 execution, delivery and process management; T4 damage to physical assets; T5 clients, products and business practicesBT1 business disruption and system failures (it was a cyber attack); T3 internal fraud; T4 damage to physical assets; T5 employment practices and workplace safetyCT1 external fraud; T3 execution, delivery and process management; T4 damage to physical assets; T5 employment practices and workplace safetyDT1 external fraud; T3 not operational risk (it is a market loss); T4 business disruption and system failures; T5 clients, products and business practices
(b)How do T2 and T3 count?
AT2 is recorded and flagged as a credit-related boundary event but left out of operational losses; T3 is market-related and counts as an operational lossBBoth are left out: T2 belongs to credit risk and T3 to market riskCBoth count in full as operational losses, because a fraud or a failed process caused eachDT2 counts as external fraud; T3 is left out because the loss shows in the trading P&L
(c)What net loss goes into Tarrowby's 2025 loss data set? Answer in £k.
£k
(d)What share of the ten years' net losses do the three largest events make up? Answer in %.
%

Problem 2Who checks the controls, and how hard

L3.7.02 · L3.7.04

Operational risk partner to the payments business

T1 started with a changed payee. Tarrowby's RCSA rates the risk “payments to changed payee details” at likelihood 4 and impact 4 before controls. Its four key controls and their latest test results:

Control	Type	Nature	Design	Operating
C1 New or changed payees are held for 24 hours before the first payment	Preventive	Automated	Effective	Effective
C2 A call-back to a number already on file before payee bank details are changed	Preventive	Manual	Effective	Ineffective
C3 A next-morning report of payments to payees changed in the last 30 days, reviewed by a second person	Detective	Automated	Effective	Effective
C4 A monthly reconciliation of supplier statements to payments made	Detective	Manual	Partially effective	Effective

Use the module's teaching rule: each preventive control effective in both design and operation takes 1 off likelihood, each such detective control takes 1 off impact, never below 1. Scores of 1–4 are Low, 5–9 Medium, 10–16 High and 20–25 Very high. The call-back (C2) runs about 30 times a day; tests sample runs at random.

Lessons: L3.7.02: The operational risk framework · L3.7.04: Controls: design, testing and assurance

(a)The payments operations team rates C2 'effective' in its self-assessment. Who should challenge that rating, and who tells the audit committee whether that challenge itself works?
AInternal audit challenges it; the board risk committee gives the assuranceBThe operational risk function (second line) challenges it; internal audit (third line) gives the assuranceCThe head of payments operations challenges it; the operational risk function gives the assuranceDThe external auditor challenges it; the chief risk officer gives the assurance
(b)What is the risk's residual score (likelihood × impact)?
(c)The tester wants to be at least 95% sure that the sample shows one or more exceptions if 6% of call-backs are skipped. How many runs must they sample?
runs
(d)Last year's test sampled 20 runs and found no exceptions. If 6% of runs had been skipped all along, what was the chance of that clean sample? Answer in %.
%

Problem 3A phishing indicator and a cyber policy

L3.7.05 · L3.7.08

Cyber risk analyst

Each month Tarrowby sends staff a test phishing email and reports the share who click. The ten quiet months of January to October 2024 (%):

3.1, 2.8, 3.4, 2.9, 3.6, 3.0, 3.3, 4.1, 3.2, 3.5

Amber is set at the 90th percentile of those months, by linear interpolation (position h = 1 + (n − 1)p in the sorted list); red at 5.0%. A month is amber or red when its value reaches the threshold. The months that followed:

Month	Nov 2024	Dec 2024	Jan 2025	Feb 2025	Mar 2025	Apr 2025
Click rate, %	3.5	3.8	4.3	5.2	5.6	4.9

On 18 Apr 2025 came the email compromise fraud (T1 in Problem 1). Tarrowby's cyber model gives ransomware 0.2 incidents a year that get past its defences, each with three outcomes:

Ransomware outcome	Loss £m	Probability
Contained to a few machines, restored from backup	0.8	60%
Core banking down for days	12.0	30%
Backups encrypted too: weeks to rebuild	60.0	10%

Its cyber policy has a retention of £2m and a limit of £25m per event.

Lessons: L3.7.05: Key risk indicators in practice · L3.7.08: Cyber risk

(a)What is the amber threshold? Answer in %.
%
(b)With amber at that level and red at 5.0%, how many days before the fraud did the KRI's first red month end?
days
(c)What does the insurer expect to pay on ransomware in a year? Answer in £m.
£m
(d)In the worst outcome, how much of the £60m loss does Tarrowby keep? Answer in £m.
£m

Problem 4A cloud scenario, from workshop to numbers

L3.7.06 · L3.7.07

Scenario analysis lead

A workshop of Tarrowby's technology, payments and finance heads agrees a scenario: Cirrovane Cloud loses the region Tarrowby runs in for two days. Once in 20 years; typical loss £4m; severe loss £30m, the 1-in-100 outcome if it happens.

Read it as the module does: frequency Poisson with λ = 1/N; severity lognormal with median = the typical loss and 99th percentile = the severe loss (z_0.99 = 2.3263).

Lessons: L3.7.06: Scenario analysis · L3.7.07: Measuring frequency and severity

(a)What is the lognormal's σ?
(b)What is the mean loss if the outage happens? Answer in £m.
£m
(c)What is the expected annual loss from this scenario? Answer in £ thousands.
£k
(d)Tarrowby's plan runs 5 years. What is the chance of at least one such outage in that time? Answer in %.
%

Problem 5Counting and sizing the fraud losses

L3.7.07

Operational risk modeller

Tarrowby fits its fraud losses of £20,000 or more. External fraud: Poisson with λ = 16 a year, lognormal severity in pounds with μ = 10.8, σ = 1.3. Internal fraud: λ = 1.2 a year, μ = 12.2, σ = 1.5. The two are independent.

Lessons: L3.7.07: Measuring frequency and severity

(a)What is the chance of two or more internal frauds next year? Answer in %.
%
(b)What is the expected annual fraud loss, both types together? Answer in £m.
£m
(c)Simulating 20,000 years with these fits gives an expected annual loss of £2.55m and a 99.9% one-year loss of £24.2m, about 9 times larger. Why so many times?
AThe Poisson count's variance is many times its mean, so some years have dozens of extra fraudsBThe two fraud types are assumed to move together, so bad years add upCThe 1-in-1,000 year is set by one or two very large losses from the lognormal's long right tail, too rare to move the mean muchDThe 99.9% quantile includes the 15 times multiple of the loss component

Problem 6Capital under the standardised approach

L3.7.07 · L3.7.03

Capital analyst

Tarrowby's business indicator items, three-year averages in £m (net items already taken in absolute value year by year):

Item	£m
\|Interest income − interest expense\|	725
Interest-earning assets	28,000
Dividend income	4
Other operating income	25
Other operating expense	45
Fee and commission income	300
Fee and commission expense	90
\|Net P&L, trading book\|	30
\|Net P&L, banking book\|	12

Use the UK bucket thresholds (£880m and £26,000m, at 12%, 15% and 18%) and the loss data set from Problem 1: £118.0m of net losses over ten years.

Lessons: L3.7.07: Measuring frequency and severity · L3.7.03: Loss data

(a)What is the business indicator (BI)? Answer in £m.
£m
(b)What is the business indicator component (BIC)? Answer in £m.
£m
(c)What is the loss component (LC)? Answer in £m.
£m
(d)What is the internal loss multiplier (ILM) under the Basel formula?
(e)What is the operational risk capital under the Basel standard? Answer in £m.
£m
(f)The PRA sets the ILM to 1 from 1 January 2027. What does that mean for Tarrowby?
ACapital equals the BIC: its loss history no longer moves its capital, but it must still collect its loss dataBCapital equals the loss component: the UK uses losses in place of sizeCNothing changes: an ILM of 1 applies only to banks with a business indicator under £880mDCapital equals the BIC, and the bank no longer needs to collect losses below £1m

Problem 7The payments service, its suppliers and its recovery

L3.7.09 · L3.7.10 · L3.7.15 · L3.7.16

Operational resilience manager

Personal payments need four parts, all working. Outages a year and mean hours to restore (illustrative; failures independent, 8,760 hours a year):

Part	Run by	Outages a year	Mean hours
Payments platform	Tarrowby	3.0	2
Core banking	Quillmoor Systems	1.0	5
Cloud region	Cirrovane Cloud	0.4	10
Scheme gateway	Velmarra Payments	2.0	1

Tarrowby's important business services, their impact tolerances, and what each needs. Mobile and online banking fails over to a second Cirrovane region in 2 hours; nothing else can switch region yet.

Service	Tolerance	Needs
Personal payments	24 h	Payments platform (on Cirrovane), core banking, scheme gateway
Business high-value payments (CHAPS)	6 h	Payments platform (on Cirrovane), scheme gateway
Mobile and online banking	12 h	App on Cirrovane, which fails over to a second region in 2 hours; core banking
Mortgage servicing	72 h	Servicing system on Cirrovane; telephony

Yearly spend on its main suppliers:

Supplier	What	£m a year
Cirrovane Cloud	Cloud hosting (one region, a second for the app)	9.0
Quillmoor Systems	Core banking software and support	6.5
Wrenhallow Telecom	Telephony and branch network	2.5
Velmarra Payments	Payment scheme gateway	2.0

Recovery options for the payments platform, which carries both payment services (hours; £m a year):

Option	RTO failure	RTO corruption	RPO failure	RPO corruption	Cost
R1 Nightly backup, rebuild on spare hardware	36	36	24.0	24	0.3
R2 Warm standby, snapshots every 4 hours	8	10	4.0	4	1.4
R3 Hot standby, continuous replication	1	36	0.1	24	3.6
R4 Hot standby plus immutable copies every 2 hours	1	5	0.1	2	4.2

Lessons: L3.7.09: Technology and change risk · L3.7.10: Third-party and outsourcing risk · L3.7.15: Operational resilience · L3.7.16: Business continuity and crisis management

(a)What is the expected availability of personal payments over a year? Answer in %.
%
(b)What share of Tarrowby's supplier spend goes to Cirrovane Cloud? Answer in %.
%
(c)Cirrovane loses Tarrowby's region for 30 hours. How many impact tolerances are breached?
services
(d)Which recovery option should Tarrowby choose for the payments platform, if both payment services must stay within tolerance after a failure and after corrupted data (ransomware)?
AR1: the cheapest, and a day-old backup is enough for paymentsBR2: warm standby keeps personal payments within 24 hours in both casesCR3: hot standby is back in an hourDR4: the only option within 6 hours both after a failure and after corruption

Problem 8Fraud alerts, redress, a lawsuit and a model

L3.7.11 · L3.7.12 · L3.7.13 · L3.7.14

Head of non-financial risk reporting

Fraud screen. One card-not-present payment in 5,000 is fraud. The screen flags 85% of frauds and 0.5% of genuine payments.
Redress. Tarrowby sold a travel insurance add-on with 240,000 current accounts, and has agreed to review the sales. It expects 25% of customers to complain, 55% of complaints to be upheld at £520 of redress on average, and each complaint, upheld or not, to cost £60 to handle.
A lawsuit. A former corporate client sues. Counsel's view: lose at trial (£9m) with probability 35%, settle (£4m) with probability 40% and win (nothing) with probability 25%. The amounts can be estimated reliably.
A model error. An arrears-fee spreadsheet overcharged 6,500 customers by £180 on average. Refunds add 8% a year simple interest, for 2.5 years on average.

Lessons: L3.7.11: Fraud and financial crime · L3.7.12: Conduct risk and customer outcomes · L3.7.13: Legal, compliance and regulatory risk · L3.7.14: Model risk: an introduction

(a)What share of the screen's alerts are fraud? Answer in %.
%
(b)What provision should Tarrowby book for the redress programme? Answer in £m.
£m
(c)What is the expected value of the lawsuit's outcome? Answer in £m.
£m
(d)What provision does Tarrowby book for the lawsuit under IAS 37? Answer in £m.
£m
(e)What does the model error cost in refunds and interest? Answer in £m.
£m

Score 0 / 340 of 8 problems checked

Back · L3.7.16

Business continuity and crisis management

Next module · L3.8.01

How insurers take risk