PART A · QUESTION 1
A type of error happens about 50 times a year, at about US$2,000 each. A second happens once in ten years, at about US$5m.
// EXAM HALL20 QUESTIONS · 30 MINUTES
Bank Operational Risk Analyst Practice Test
What goes wrong in a bank's own processes, one incident log, a control review where ratings and tests disagree, and the calls after it goes wrong.
BY MICHAEL SHANG · SIXTEEN YEARS IN COMMERCIAL BANKING · UPDATED
// THE SHORT ANSWER
A bank operational risk analyst practice test asks whether you can tell a control that works from one that is only rated as working. This paper has four parts: frequency, severity and the three lines; the incident log from one quarter's risk pack; a control review where the ratings and the tests disagree, set on an exhibit; and calls on root cause, workarounds, suppliers and resilience. Every question is original, and none comes from any bank's test. Sit it against a thirty-minute clock, or take it as practice.
BASIS Practitioner judgment from sixteen years in commercial banking, set out in How Bankers Think (Highbank Press, 2026). Every borrower on this site is a composite constructed for teaching, not a client. The market is mid-market commercial lending as practised in New Zealand and Australia; where a convention differs elsewhere, the page says so.
// HOW TO SIT IT
Answer below as practice, and each read opens as you go. Or sit it as a test: 30 minutes, with every read held back until you finish.
PART A
The measures
How often, how bad, and who owns it.
PART A · QUESTION 2
A payments team's error rate is 1 in 10,000, and it sends 2 million payments a year. Its manager says: 'That is 99.99% accurate.'
What do you ask?
PART A · QUESTION 3
The first line asks you, as operational risk, to write its control procedures, as you know the subject best.
What do you say?
PART B
The incident log
One quarter's incidents. You cannot take all of them to the committee.
EXHIBIT H · THE RISK PACK
One quarter's risk report for a mid-sized bank, three tables from the pack. Figures in US$m. The Lost and Grew columns cover the last 12 months. PD is the chance of default in a year; LGD is the share lost if it happens.
| US$m | PD | LGD | Lost | Grew | |
|---|---|---|---|---|---|
| Home loans | 6,000 | 0.4% | 15% | 2 | 4% |
| SME loans | 2,000 | 2.5% | 45% | 24 | 3% |
| Commercial property | 1,500 | 2.0% | 35% | 3 | 28% |
| Credit cards | 500 | 4.0% | 80% | 19 | 5% |
| Book | 10,000 | 48 |
| Details | Figure |
|---|---|
| Commercial property, against a limit of 15% of the book | 15.0% |
| Trading: one-day 99% value at risk, against a limit of 3.0 | 2.4 |
| Back-test: days in the last 250 with a loss above value at risk | 9 |
| Liquid assets 1,800; stressed 30-day outflow 1,500 | 120% |
| Share of deposits held by the ten largest depositors | 22% |
| Application scorecard, Gini: all customers | 0.71 |
| Application scorecard, Gini: new-to-bank, 18% of new loans | 0.38 |
| Item | What the log says |
|---|---|
| 1 | A payment batch of US$1.2m was sent twice. All recovered. The second such event in six months. |
| 2 | A leaver's system access stayed active for three months. No loss recorded. Access logs not yet checked. |
| 3 | The arrears report the board reads is built by hand, in a spreadsheet, by one person. |
| 4 | 400 letters went out with the wrong date. Corrected in a day. |
PART B · QUESTION 4
Exhibit H's incident log has four entries. You can take one to the risk committee, with a question about the control behind it.
Which one?
PART B · QUESTION 5
Exhibit H: a leaver's system access stayed active for three months. The log records no loss, and says the access logs have not yet been checked.
What comes first?
PART B · QUESTION 6
Exhibit H: the arrears report the board reads is built by hand, in a spreadsheet, by one person. It has been right every month so far, as far as anyone knows.
What is your first concern?
PART C
The control review
One division, seven questions. Read the owner's rating, then read the test.
EXHIBIT X · THE CONTROL REVIEW
One division's annual review. Each control's owner rates it; operational risk then tests a sample of some of them.
| Control | Rating | Test result |
|---|---|---|
| Payment limits checked | Green | 2 of 25 failed |
| Leavers' access removed | Green | 6 of 25 failed |
| Reconciliations signed by a second person | Green | Not tested |
| Supplier reviews | Amber | 0 of 10 failed |
| Number | US$m | |
|---|---|---|
| Losses under US$50,000 | 38 | 0.6 |
| Losses over US$50,000 | 2 | 3.4 |
| Near misses reported | 4 |
The division's appetite is US$3m of operational losses a year. It had 400 leavers this year.
PART C · QUESTION 7
From Exhibit X. Take the leaver control the owner rated Green.
What did the test find?
PART C · QUESTION 8
Exhibit X's test sampled 25 of the year's 400 leavers. Suppose the failure rate holds across them all.
About how many leavers kept access?
PART C · QUESTION 9
In Exhibit X, the reconciliation control is rated Green and has not been tested.
What do you ask?
PART C · QUESTION 10
Exhibit X shows 38 small losses totalling US$0.6m and 2 large ones totalling US$3.4m, against an appetite of US$3m.
What do the numbers say?
PART C · QUESTION 11
Exhibit X's team logged 40 losses and 4 near misses this year.
What does the ratio tell you?
PART C · QUESTION 12
In Exhibit X, the supplier control's owner rated it Amber, and it passed its test. The owner asks: 'Why am I the one being questioned, when everyone else is Green?'
What do you say?
PART C · QUESTION 13
The owner of Exhibit X's leaver control asks to retest it on a fresh sample from a team 'where people know the process'.
What do you do?
PART D
The calls
After something has gone wrong, and before the next thing does.
PART D · QUESTION 14
A team has reported no near misses in two years. Its manager presents this as a sign of good control, and its error rate on the ledger is about average.
Signal or noise?
PART D · QUESTION 15
A review finds loans repeatedly written at just under a branch's approval limit, with a second loan to a related company a few days later. Each file, read alone, follows policy.
Signal or noise?
PART D · QUESTION 16
A vendor that holds customer data sends a clean annual security certificate. Its service is now critical to onboarding. The business says: 'We have the certificate. Move on.'
What do you do?
PART D · QUESTION 17
An audit confirms all staff completed phishing training and that passwords rotate every 90 days. That week a staff member approves a fake login prompt, and an attacker gets in.
What does that show?
PART D · QUESTION 18
A clerk keyed the wrong amount into a US$900,000 payment. The incident report reads: 'Root cause: human error. Clerk retrained.'
What do you ask?
PART D · QUESTION 19
A process that was built as a temporary spreadsheet workaround during a system change is still running three years later, with no reported error. It moves US$40m a day.
What do you ask for?
PART D · QUESTION 20
The bank's stated tolerance for its payment service is four hours down. A failure at a supplier took it down for six. The supplier met its contract, which promises eight.
What do you raise?
0 OF 20 ANSWERED · 0 WITH THE SENIOR READ · 0 STANDS UP · 0 OFF THE LINE
// THE REST OF THE ROUND
Every question here is original; none is any bank's real test. Written for: Operational risk analyst.
- Operational risk analyst: the interview questions, against a two-minute clock.
- Situational judgement, for any seat.
- The assessment centre: a whole case in forty-five minutes.
// SUBSCRIBE
The Lab.
One case file and one question, in your inbox every Tuesday morning, New Zealand time. The senior banker's read opens only after you answer.
FREE WITH IT · 10-PAGE PDF
Case 01 of the interview case pack — Northmark Engineering, in full.
No spam. Unsubscribe anytime. Educational content only.