CredLocker
Operational Risk & Resilience Track I Certification Exam Study Guide
This study guide provides a comprehensive overview of operational risk management and resilience, covering key concepts like the Three Lines of Defence model, RCSA, and KRI tooling. Learners will explore strategies for maintaining critical operations and establishing governance structures to navigate volatile, uncertain, complex, and ambiguous (VUCA) environments effectively.
MODULE 1 — New Module
Operational Risk is defined as the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events.
Operational Resilience focuses on the ability of an organization to absorb and adapt to shocks, ensuring continuity of critical operations.
Governance requires clear accountability from the Board and Senior Management, with established risk appetite statements that include both qualitative and quantitative elements.
The Three Lines of Defence model distinguishes between operational management, independent oversight functions, and internal audit to ensure robust assurance.
Risk and Control Self-Assessment (RCSA) measures the difference between inherent risk (before controls) and residual risk (after controls).
Key Risk Indicators (KRIs) serve as early warning systems, categorized into leading (predictive) and lagging (historical) metrics.
Critical operations are those activities that, if disrupted, would cause significant harm to the organization or its stakeholders.
Tolerance for disruption defines the maximum acceptable level of impact an organization is willing to endure during a crisis.
VUCA (Volatility, Uncertainty, Complexity, Ambiguity) serves as the modern framework for understanding the challenging environment in which firms must build resilience.
Effective risk culture is characterized by a speak-up environment, ensuring that operational risks and near-misses are escalated timely.
| Concept | Formula | Purpose |
|---|---|---|
| Residual Risk Calculation | Residual Risk = Inherent Risk - Impact of Control Effectiveness | To determine the level of risk remaining after current internal controls have been applied. |
Test your knowledge with these 10 practice questions. Select your answers and submit to see your score.
Match the term to its correct definition as used in the Operational Risk & Resilience Certification Manual: 'Leading Indicator'
A risk manager at PGP is asked by the CEO to define exactly how much downtime of the Terminal Operating System is acceptable before the impact becomes intolerable. The risk manager needs to reference the appropriate concept from the program's framework. Which concept should the risk manager invoke, and what does it require leadership to do?
During an RCSA review of gate operations at PGP, the second-line risk team notices that the first-line team has rated all controls as fully effective despite the absence of any recent testing records or incident linkage. What should the second-line team do FIRST?
Match the Critical Operation ID to the correct primary impact if that operation is disrupted at Pacific Gateway Ports.
Which of the following best defines 'Operational Resilience' as described in the Operational Risk & Resilience Certification Manual?
According to the manual, what distinguishes control design effectiveness from control operating effectiveness in the context of RCSA?
Pacific Gateway Ports Inc. is characterized by heavy third-party dependency, including reliance on shipping lines, railways, trucking companies, stevedores, technology vendors, and power providers.
Which of the following statements accurately describe the relationship between inherent risk and residual risk within the RCSA framework? (Select all that apply)
Match the certification track to its correct primary focus as described in the Operational Risk & Resilience Certification Program.
In the context of the RCSA framework described in the manual, what does the gap between inherent risk and residual risk indicate?