Topic Operational Risk
The operational risk program, built one template at a time.
ERMF, RCSA, KRIs, issues management, loss tracking, third-party risk — the operational risk stack practitioners actually use. Aligned with COSO ERM, ISO 31000, FFIEC IT, and FRB SR 21-3.
◆ COSO ERM · ISO 31000 · FFIEC IT · FRB SR 21-3 · Basel
◆ What you'll find here
The core risk program — without the consulting markup.
◆ 01
ERMF, RCSA, KRIs
The three core building blocks of every operational risk program. Inventory the risks, self-assess the controls, monitor the indicators. Mapped to COSO ERM and FRB SR 21-3.
◆ 02
Issues & loss tracking
Track MRAs, audit findings, and operational losses with severity scoring, owners, and remediation timelines. Built for teams that need to show progress to regulators and bank partners.
◆ 03
Third-party & vendor risk
Vendor inventory and tiering, due diligence, contract review, ongoing monitoring and exit planning, designed around the 2023 interagency guidance on third-party relationships.
◆ Operational risk templates
Tools for the operational risk team.
Excel-native templates with editable workbooks and PDF guides. Buy once, tailor to your program, deploy in days.
Enterprise Risk Management Framework (ERMF)
Complete ERM documentation: risk appetite, 3 Lines of Defense, committee charter, and board reporting.
RCSA (Risk & Control Self-Assessment)
141 fintech risks with mapped controls, a 97-question self-assessment, control testing plan, challenge log and a one-page Board Summary.
KRI Library (152 Key Risk Indicators)
152 KRIs — including 20 emerging-risk KRIs for AI-enabled fraud, scams and AI governance — with thresholds, owners and a calculating dashboard.
Issues Management Tracker & Template
End-to-end issues tracking and remediation management for risk and compliance teams.
Loss Monitoring & Event Tracking Kit
Operational loss and near-miss tracking for fintechs — with automatic escalation tiers, bank-partner notice flags and a dashboard that calculates itself.
Financial Risk Management Kit
Credit, liquidity, customer funds, payments losses, capital, interest rate and concentration risk for fintechs — with stress scenarios and a board-ready risk appetite statement.
Contingency Funding Plan — Banks
Examiner-ready contingency funding plan for chartered banks built to the 2023 Interagency Addendum.
Contingency Funding Plan — Fintechs
Contingency funding plan for sponsor-bank fintechs — FBO reconciliation, runway-based triggers, post-Synapse stress scenarios.
Third-Party Risk Management (TPRM) Kit
Tier every vendor with one documented rule, run due diligence and AI vendor reviews, find contract gaps against the 2023 Interagency Guidance, and track SOC reports, issues, concentration and exits. Excel workbook, guide, Word policy and offboarding checklist.
Fintech Customer AUP Kit
Acceptable Use Policy framework for fintech compliance teams evaluating high-risk customers and merchants.
268+
Operational risk articles
10
Templates · Excel + PDF
US
COSO · ISO 31000 · FFIEC · Basel
◆ Latest analysis
From the journal.
Compliance Strategy
The Fed Is Restructuring How It Supervises Banks. What Bowman's Five-Region Overhaul Means for Community Banks and Their Exams.
Federal Reserve Vice Chair for Supervision Michelle Bowman announced a five-region supervision restructuring, alongside the Community Bank Leverage Ratio cut to 8% that took effect July 1. Here's what changes, what stays the same, and what community bank compliance teams should actually do.
Third-Party Risk
The EBA Just Finalized Its Third-Party Risk Guidelines for Non-ICT Services. If You Thought DORA Covered Your EU TPRM Program, Here's What You Missed.
EBA/GL/2026/09, finalized September 18, 2026, establishes binding third-party risk management requirements for non-ICT arrangements at EU banks and investment firms — the services DORA deliberately excludes. Facilities management, HR outsourcing, legal services, and dozens of other non-technology relationships now fall under a tiered, risk-proportionate framework with two years to comply.
Compliance Strategy
The OCC Just Made Recovery Planning Optional for $100 Billion Banks. Here's What Still Exists Under Safety and Soundness.
On May 1, 2026, the OCC's Appendix E recovery planning guidelines were officially gone for $100B+ banks. Comptroller Gould called them 'prescriptive' and 'conjectural.' But safety and soundness authority doesn't rescind. Here's what large-bank operational risk teams actually need to maintain — and what they can safely restructure.
Operational Risk
The OCC Just Hit American Express With a $350 Million AML Fine. $13 Billion in Suspected Trade-Based Money Laundering. Here's What Every Bank's BSA Officer Needs to See.
On October 8, 2026, the OCC assessed a $350 million civil money penalty against American Express National Bank for BSA/AML program failures tied to $13 billion in suspected trade-based money laundering activity spanning 2014 to 2025. The Federal Reserve issued a parallel consent cease-and-desist order against the holding company. Here's what the enforcement action reveals about AML program adequacy.
Compliance Strategy
FINRA Launched a Sweep on Worst-Of Structured Notes in May. Here's What Every Broker-Dealer Needs to Check Before the Letter Arrives.
FINRA's May 2026 targeted sweep covers how broker-dealers supervise customer concentrations in non-principal-protected worst-of structured notes under Reg BI. Whether or not you received a letter, here's the self-assessment every firm that sells these products should run now.
Compliance Strategy
The SEC's 54-Year No-Deny Rule Is Gone. Here's What Your Enforcement Response Playbook Needs Now.
SEC Rule 202.5(e) — the clause requiring settling parties to stay quiet about SEC allegations — was rescinded effective May 21, 2026. Companies can now publicly dispute findings while settling. Here's what that changes, what it doesn't, and what your enforcement response protocol needs to address before the next investigation lands.