Control risk

This is the risk that an unexpected loss occurs due to both the lack of an appropriate
control or the effectiveness of an appropriate control and may be split into two main
categories:
Ω Inherent risk is the risk of a particular business activity, irrespective of related
internal controls. Complex business areas only understood by a few key people
contain higher inherent risk such as exotic derivatives trading.
Ω Control risk is the risk that a financial loss or misstatement would not be
prevented or detected and corrected on a timely basis by the internal control
framework.
Inherent risk and control risk are mixed together in many banks but it useful to
make the distinction because it enables an operational risk manager to assess the
degree of investment required in the internal control systems. This assessment of
the relative operational risk of two different business may result in one being more
inherently risky than the other and may require a higher level of internal control.
Optimal control means that unexpected losses can happen but their frequency and
severity are significantly reduced. 380