vaayaa Inclusive Education
Finance risk assessment

Retail and Commercial Banking Operations Risk Assessment: Process, Fraud and Technology Controls

A worked example of how a bank operations team identifies, scores and controls risks in retail and commercial banking, from handover errors and payment fraud to outages, supplier dependency and conduct duties.

Updated November 2026 8 hazards assessed Review every 6 months Highest risk: Critical to Medium
See the Retail and Commercial Banking Operations course

Executive summary

This assessment shows how the operations team of a retail and commercial bank can find, rate and control the risks that most affect customers, money and trust. Eight risks were chosen because they are plausible in daily branch, payments, lending and servicing work. Handover error, payment fraud, system outage and data breach carry the highest natural scores, while staffing, supplier dependency, conduct and branch safety are also material. Each risk is scored before controls and again after existing and added controls. Most risks fall to Medium or Low once added controls are in place, but fraud and cyber exposure stay at Medium because the impact on customers remains serious. The first actions are a handover acknowledgement routine, call back checks on payee changes, multi-factor sign in and a restore test. The bank is a teaching example, so every score illustrates method, not a real organization.

Focus area
Retail and commercial banking operations
Setting
Operations function of a mid-sized retail and commercial bank serving personal and business customers
Method
Five by five likelihood and impact risk register

Scope

This assessment covers day to day banking operations for retail and commercial customers, including account opening, payments, lending administration, cash handling, customer servicing and the systems and suppliers that support them. It looks at risks to accurate processing, customer money, data, service continuity, staff safety and legal duties. It does not cover investment advice, trading or the credit decision on any real loan. Jurisdiction, size, product set and technology are assumptions made for teaching and are labeled as such.

Context

The bank runs branch and digital channels for personal customers and a relationship team for business clients. Operations staff process payments, maintain customer records, administer loans and resolve queries through a core banking platform, a payments gateway and a case management tool. Some card processing, document scanning and call centre work is provided by outside suppliers. Each risk is scored before controls to show its natural level, then again after the existing controls and the additional controls that should be added.

Objectives, assets and stakeholders

The objective is to process banking work accurately and on time, protect customer money and records, meet conduct and legal duties, keep services running during disruption and maintain the trust of customers and regulators. The assets in scope are customer accounts and balances, payment systems, the core banking platform, loan files, personal and business data, branch premises and cash, and the reputation of the bank. Stakeholders include customers, business clients, operations and branch staff, the technology and security teams, suppliers, the board, supervisors and the wider public. Clear roles matter. Every risk has one owner role, the operations manager keeps the register current, and the risk committee reviews it each quarter and whenever a trigger is met.

Risk matrix: before and after controls

Each cell shows hazard numbers placed by likelihood and impact. Compare the two grids to see how controls move each hazard.

Before controls

Inherent risk

Risk before controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely Likelihood 4, impact 3, score 12, high: H01 H05 Likelihood 4, impact 4, score 16, high: H02 Likelihood 4, impact 5, score 20, critical: H06
3 Possible Likelihood 3, impact 4, score 12, high: H04 Likelihood 3, impact 5, score 15, high: H03
2 Unlikely Likelihood 2, impact 4, score 8, medium: H08 Likelihood 2, impact 5, score 10, high: H07
1 Rare

After controls

Residual risk

Risk after controls: rows are likelihood from almost certain to rare, columns are impact from insignificant to catastrophic. Cells list hazard numbers.
1
Insignificant		 2
Minor		 3
Moderate		 4
Major		 5
Catastrophic
5 Almost certain
4 Likely
3 Possible Likelihood 3, impact 2, score 6, medium: H05
2 Unlikely Likelihood 2, impact 3, score 6, medium: H01 H03 H04 Likelihood 2, impact 4, score 8, medium: H02 H06
1 Rare Likelihood 1, impact 3, score 3, low: H08 Likelihood 1, impact 4, score 4, low: H07
  • Low 1 to 4
  • Medium 5 to 9
  • High 10 to 16
  • Critical 17 to 25

Hazard register

A summary first, then the detail for each hazard.

Summary of hazards with scores before and after controls
No.HazardBeforeAfterOwner
H01 Handover failure and human processing error 12 High 6 Medium Operations manager
H02 Payment fraud and financial leakage 16 High 8 Medium Head of payments operations
H03 Core system outage and data loss 15 High 6 Medium Head of technology services
H04 Outsourced supplier failure or dependency 12 High 6 Medium Supplier management lead
H05 Staffing capacity shortfall and service backlog 12 High 6 Medium Operations manager
H06 Customer data breach and cyber intrusion 20 Critical 8 Medium Information security manager
H07 Lending and conduct breach 10 High 4 Low Compliance manager
H08 Branch security and staff safety during cash handling 8 Medium 3 Low Head of physical security
H01

Handover failure and human processing error

People Before 12 After 6

Work passed between shifts, teams or staff is incomplete or unclear, and manual keying or checks miss details, so payments, account changes or loan records are wrong.

Who or what is affected: Customers, operations staff and downstream teams

Causes

Staff turnover, peak workload and unwritten local procedures that differ between teams.

Consequences

Customer harm, incorrect balances, complaints and remediation cost.

Existing controls

  • A shift handover checklist is completed for open cases.
  • Four eyes check applies to account changes above a set value.

Control gaps

Checklists are not used consistently and sampling covers only a small share of the work.

Additional controls

  • Prevent: Standardize handover templates and require the receiving person to acknowledge open items.
  • Detect: Sample processed items each week and log error types for trend review.
Likelihood 4 x impact 3 before; 2 x 3 after Owner: Operations manager Target: Within 45 days Early warning: Open cases carried across more than two shifts without acknowledgement.
H02

Payment fraud and financial leakage

Financial Before 16 After 8

Account takeover, altered payee details, duplicate or misdirected payments and fee errors move or lose customer and bank funds before anyone notices.

Who or what is affected: Customers, the bank and payment partners

Causes

Phishing and social engineering, weak customer verification and rules that allow instant transfers.

Consequences

Direct loss, customer compensation, regulatory attention and loss of trust.

Existing controls

  • Payee changes require a one time passcode sent to the registered device.
  • Payments above a limit need a second authorizer.

Control gaps

Payee checks rely on customer prompts and fraud rules are not reviewed against recent losses.

Additional controls

  • Prevent: Hold new payees for a cooling off period and verify high value changes by call back to a known number.
  • Respond: Freeze suspect payments and contact the receiving bank through the agreed fraud channel the same hour.
Likelihood 4 x impact 4 before; 2 x 4 after Owner: Head of payments operations Target: Within 30 days Early warning: A cluster of new payees added and paid within a single day on one account.
H03

Core system outage and data loss

Technology and data Before 15 After 6

The core banking platform, payments gateway or document store fails or loses records, so transactions stop, balances are wrong or customer files cannot be recovered.

Who or what is affected: Customers, branch and call centre staff, auditors

Causes

Hardware failure, a failed software release, or loss of power or network.

Consequences

Service interruption, lost transactions, reconciliation work and delayed regulatory reporting.

Existing controls

  • The core system runs with a secondary site and nightly backups.
  • Change requests are tested in a separate environment before release.

Control gaps

Restore tests cover only a few systems and alert thresholds are still set at defaults.

Additional controls

  • Recover: Test restoring the core platform from backup each quarter and record the time taken.
  • Detect: Monitor transaction queues and response times with alerts to the on duty technology team.
Likelihood 3 x impact 5 before; 2 x 3 after Owner: Head of technology services Target: Within 60 days Early warning: Batch jobs that finish later than their usual window on two consecutive nights.
H04

Outsourced supplier failure or dependency

Supplier Before 12 After 6

A card processor, document scanning firm or call centre partner fails, changes terms or cannot meet service levels, and the bank cannot keep serving customers without it.

Who or what is affected: Customers, operations staff, supplier staff and regulators

Causes

Single source contracts, cost pressure and limited audit rights over subcontractors.

Consequences

Service outage, customer complaints, data exposure and forced contract change.

Existing controls

  • Contracts include service levels and monthly performance reports.
  • A named relationship manager reviews each supplier quarterly.

Control gaps

Exit plans are written but never rehearsed, and subcontractor use is not visible.

Additional controls

  • Prevent: Require exit and transition plans in every material supplier contract and test them.
  • Detect: Track supplier service levels weekly and escalate misses against agreed thresholds.
Likelihood 3 x impact 4 before; 2 x 3 after Owner: Supplier management lead Target: Within 90 days Early warning: Supplier service level misses in two consecutive weeks.
H05

Staffing capacity shortfall and service backlog

Operational Before 12 After 6

Absence, vacancies or a surge in demand leave queues unworked, so customer requests, loan files and payments wait longer than promised and errors rise under pressure.

Who or what is affected: Customers, operations staff and business clients

Causes

Vacancies, seasonal peaks, absence and new product launches.

Consequences

Missed service promises, complaints, rushed errors and staff burnout.

Existing controls

  • A weekly workforce plan compares forecast volumes with rostered staff.
  • Backlog reports are reviewed at the daily operations meeting.

Control gaps

Forecasts use past volume patterns and do not reflect new product demand.

Additional controls

  • Prevent: Cross train staff on two core queues and keep a trained relief pool for peak periods.
  • Respond: Activate overtime or temporary cover when backlog passes the agreed threshold for two days.
Likelihood 4 x impact 3 before; 3 x 2 after Owner: Operations manager Target: Within 60 days Early warning: Backlog age above the service promise for more than three working days.
H06

Customer data breach and cyber intrusion

Technology and data Before 20 After 8

Attackers or careless handling expose personal and business customer records, credentials or loan documents, leading to theft, misuse and loss of confidence.

Who or what is affected: Customers, business clients, staff and the bank

Causes

Phishing, reused passwords, unpatched systems and data copied to personal storage.

Consequences

Data loss, fraud against customers, regulator notice and compensation claims.

Existing controls

  • Access to customer records is limited by role and logged.
  • Staff complete security awareness training each year.

Control gaps

Logging covers the core platform but not the case management tool or shared drives.

Additional controls

  • Prevent: Enforce multi-factor sign in for all staff and block unmanaged devices from customer data.
  • Detect: Review access logs for unusual bulk downloads and alert the security team the same day.
Likelihood 4 x impact 5 before; 2 x 4 after Owner: Information security manager Target: Within 30 days Early warning: Repeated failed sign ins or bulk record exports outside working hours.
H07

Lending and conduct breach

Legal and compliance Before 10 After 4

Loan files, disclosures or fair treatment rules are not applied correctly, so customers receive wrong terms, are charged unfairly or are refused service without proper reason.

Who or what is affected: Customers, business clients, staff and regulators

Causes

Complex products, template drift and unclear ownership of customer outcomes.

Consequences

Redress payments, enforcement action and damage to reputation.

Existing controls

  • Product disclosures are checked against a template before issue.
  • Complaints are logged and reviewed each month.

Control gaps

Templates are updated late after rule changes and checklists are not tested.

Additional controls

  • Prevent: Build mandatory checks for disclosure and affordability fields into the case workflow.
  • Detect: Sample loan files each month against a conduct checklist and report exceptions.
Likelihood 2 x impact 5 before; 1 x 4 after Owner: Compliance manager Target: Within 60 days Early warning: Complaints about the same product or disclosure rising for two months.
H08

Branch security and staff safety during cash handling

Safety Before 8 After 3

Cash movements, lone working in branches or aggressive customers expose staff to threat or injury, and a robbery or assault can disrupt service and cause lasting harm.

Who or what is affected: Branch staff, cash carriers and customers

Causes

Cash on premises, late closing and tense disputes with customers.

Consequences

Injury, trauma, branch closure and staff absence.

Existing controls

  • Cash is held under dual control with time locks.
  • Lone working is limited to daytime hours.

Control gaps

Incident reports are filed late and near miss events are not recorded.

Additional controls

  • Prevent: Review branch layouts and cash limits each year and remove cash above the set threshold overnight.
  • Respond: Train staff to follow the duress and incident procedure and report every incident within the day.
Likelihood 2 x impact 4 before; 1 x 3 after Owner: Head of physical security Target: Within 30 days Early warning: Near miss reports involving customer aggression or repeat visits by the same person.

Rating method and evaluation

Each risk is rated on two five point scales. Likelihood runs from Rare to Almost certain and impact runs from Insignificant to Severe, covering customer harm, money lost, service time lost, legal exposure and damage to trust. Multiplying the two gives a score from 1 to 25, which falls into one of four bands: Low from 1 to 4, Medium from 5 to 9, High from 10 to 16 and Critical from 17 to 25. Low risks are accepted and watched, Medium risks need routine controls with a named owner, High risks need senior attention and a dated plan, and Critical risks need immediate action and board visibility. Inherent risk is the score before controls, and residual risk is the score after existing and added controls. A residual score can never be higher than the inherent score, and where the inherent score is 10 or more the residual must be lower. Ratings are challenged by the staff who do the work, by an independent second reviewer and by the compliance function, and any rating is reopened when an early warning indicator reaches its threshold or an incident occurs. Scores are a guide for ordering work, not a measurement.

Likelihood, impact and rating bands

Likelihood

  • 5 Almost certain: Expected to happen in most circumstances.
  • 4 Likely: Will probably happen in many circumstances.
  • 3 Possible: Could happen at some time.
  • 2 Unlikely: Not expected, but it could happen.
  • 1 Rare: Only in exceptional circumstances.

Impact

  • 1 Insignificant: No lasting effect. Handled within routine work.
  • 2 Minor: Small effect that is quickly corrected.
  • 3 Moderate: Noticeable effect that needs managed effort to correct.
  • 4 Major: Serious effect on people, delivery or reputation.
  • 5 Catastrophic: Severe or lasting effect that threatens the whole activity.

Bands (likelihood x impact)

  • Low (1 to 4): Accept and monitor.
  • Medium (5 to 9): Manage with routine controls.
  • High (10 to 16): Senior attention and a treatment plan.
  • Critical (17 to 25): Act first. Do not proceed until reduced.

Monitoring, escalation and review

Review this assessment every 6 months, and sooner when an indicator below reaches its threshold.

Early-warning indicators and escalation thresholds
Indicator to watchEscalate when
Open cases carried across more than two shifts without acknowledgement.Escalate to the operations manager when any case is carried for two shifts, and to the head of operations after three shifts.
New payees added and paid within one day on the same account.Escalate to the head of payments operations at once and hold further payments to that account until reviewed.
Batch jobs finishing late on two consecutive nights.Escalate to the head of technology services on the second night, and to the chief information officer if service is affected.
Supplier service level misses in consecutive weeks.Escalate to the supplier management lead after one miss, and to the executive sponsor after two consecutive weeks.
Complaints about the same product or disclosure rising for two months.Escalate to the compliance manager when the trend appears, and to the conduct committee if it continues for a further month.

Contingency arrangements

If a serious event occurs, such as a confirmed fraud, a major outage or a data breach, the duty manager stops affected payments, preserves logs and informs the operations manager and the head of technology services. The incident lead switches to the secondary site or manual procedures and records every decision. The information security team isolates affected accounts and restores data from the latest tested backup. Compliance and legal contacts are made through the head of operations as required in the relevant jurisdiction, and customers are told early, plainly and with what they can do next. Branch staff follow the duress procedure, and cash limits are applied at once.

Prioritized action plan

  1. Introduce handover acknowledgement and weekly sampling, owner operations manager, within 45 days.
  2. Hold new payees and verify high value changes by call back, owner head of payments operations, within 30 days.
  3. Enforce multi-factor sign in and extend access logging to case tools, owner information security manager, within 30 days.
  4. Run a restore test of the core platform and rehearse one supplier exit plan, owner head of technology services, within 60 days.
  5. Refresh loan disclosure templates and set a monthly conduct sample, owner compliance manager, within 60 days.

Conclusion

Dependable banking operations rest on steady habits: acknowledged handovers, call back checks on payee changes, role based access, tested recovery, managed suppliers, a workforce plan and a monthly conduct sample. The highest scores sit with handover error, payment fraud, technology failure and data breach, and each has actions that bring residual risk down. Treat the register as a living record, review it on the stated cycle and bring in qualified advice for any real regulatory, legal, security or credit question.

Assumptions and limitations

Assumptions

  • The bank is licensed, supervised and subject to banking rules in a jurisdiction that is not specified, so legal duties are described in general terms only.
  • Staff are trained for their roles and use managed devices and single sign on to the core banking platform.
  • Outsourced suppliers hold contracts with service levels, but their staff are not employees of the bank.

Limitations

  • The scores are examples for learning and do not describe any real bank, branch or customer base.
  • Banking, payments, data protection and conduct rules differ by country and change over time, so specialist review is needed.
  • This is educational content and is not financial, legal, security or regulatory advice.

Related frameworks to study

  • Three lines model of risk ownership
  • Operational resilience and business continuity planning
  • Hierarchy of controls
  • Internal control framework with control activities and monitoring

Finance Risk Assessment

China, India, United States, Indonesia, Pakistan, Nigeria, Brazil, Bangladesh, Russia, Japan, Mexico, Philippines, Vietnam, Egypt, Turkey, Germany, United Kingdom, France, Italy, Canada, South Korea, Australia, Spain.

For Learning Reference Only: This assessment demonstrates how risk assessment principles are applied in a practical setting, providing a useful reference for learning and understanding. Actual assessments may be adapted to suit specific site conditions and circumstances.

Keep learning

Study the subject behind this assessment.

Retail and Commercial Banking Operations course Read the best practices for this course

More Finance risk assessments

Hourly Active: 45,552 Learners