LEARN. PRACTICE. GROW.Preserve the unit and denominator
Ten exceptions in one thousand operations represent one percent. Fifteen in three thousand represent half a percent. Count increased and rate decreased; both observations matter for remediation workload and exposure. Define whether you count operations, attempts, users, or control executions. Retries can increase attempts without adding business outcomes. If the definition changes, recalculate on a common basis or mark the series break. Do not automatically attribute a decline to better control. An indicator should answer the agreed management question with its definition and time window accessible to the people using its result.
Aggregate without hiding groups
Team A has ninety pass results out of one hundred; B has fifty out of one thousand. The simple mean of rates is 47.5%, but the combined per-observation rate is 140/1100, approximately 12.73%. Weighting depends on the chosen unit. Retain the team-level view too: a total can hide concentration in a critical service. The January 2013 BCBS 239 principles address risk-data integrity, completeness, and timeliness. They provide conceptual framing here; the calculations are original and establish neither compliance with every principle nor applicability to a specific institution.
Observe the journey that matters
An application log knows only requests reaching its collection point. If DNS fails earlier, the dashboard can remain green while clients cannot use the service. Add relevant journey observation, such as authorized regional probing, without assuming one probe represents all clients. Also check freshness: a favorable value sixty minutes old does not meet the fictional contract requiring less than fifteen minutes. Preserve the last state with its date and mark the present as unconfirmed. Delayed telemetry needs handling but does not alone prove business failure. Measurement scope belongs beside the number in the report.
Link events without multiplying losses
In the teaching set, APS and risk send the same twelve-thousand-euro e1. There is also a three-thousand-euro e2 and a near miss with fifty-thousand potential. Count each realized loss once and retain both e1 sources. An equal amount alone does not justify deduplicating distinct events; identity is explicitly confirmed in this case. Realized gross is fifteen thousand. Avoided potential remains separate for learning. The March 2021 BCBS operational principles support event and control analysis; this workshop’s simplified taxonomy replaces neither institutional recording policies nor reporting policies. The evidence trail remains available after aggregation.
Separate recovery, timing, and decision
The exercise’s original rule deducts only received recovery: four thousand received reduces fifteen thousand gross to eleven thousand observed net. Two thousand pending remains identified without anticipation. This is not a universal accounting rule. Recovery without a linked event raises an exception; conflicting versions require reconciliation. Keep occurrence, discovery, and cost recording as distinct dates to analyze detection. Likewise, temporary acceptance does not renew merely because no loss occurred. If the window expired and action remains pending, present exposure and options to the competent authority with limits, an owner, and the next review.
Produce a summary supporting a decision
In the following workshop, build a decision page containing the claim, evidence, excluded population, uncertainty, and action. Identify whether each number was observed, calculated, or assumed. Use the preceding lesson’s code to repeat calculations and change one assumption at a time, explaining its effect before execution. Program output constitutes neither independent assessment nor risk approval. Cases are fictional and do not describe BNP Paribas procedures. A participant workshop still needs to be conducted and observed. In actual work, the person preparing an indicator can recommend options without having authority to accept exposure.
OFICINA / WORKSHOP: 45 minutos / 45 minutes
Dados fictícios; sem avaliação bancária real / Fictional data; no real banking assessment.
0-8: Executar run.py --output evidence.json e identificar limites.
Run python3 run.py --output evidence.json and identify limits.
8-18: Expected=a,b,c,d; observed=a,b,b,c. Registar missing, duplicate e ação.
Record missing evidence, duplicate, and action.
18-28: Scheduled=100; pass=85; fail=5; unknown=10.
Explicar cobertura e denominador / Explain coverage and denominator.
28-38: e1=12000 repeated; e2=3000; near-miss potential=50000;
received recovery=4000; pending=2000.
Reconciliar bruto=15000 e líquido observado=11000.
Reconcile gross=15000 and observed net=11000.
38-45: Redigir em inglês / Write in English:
Claim / observed evidence / excluded population / uncertainty /
decision authority / owner / next update.
Não usar resultados como garantia estatística ou política contabilística.
Do not use outcomes as statistical assurance or accounting policy.
Example: the dashboard retains 99.9% at the backend during a regional DNS failure. Reporting explains who is not observed and assigns supplementary collection.
Common pitfalls
Averaging percentages without weights; counting the same event twice; anticipating recovery; using absence of loss as control evidence.
Related topics: Risk assessment and control effectiveness · Events, near misses, and response · Indicators, reporting, and acceptance
A useful aggregate retains definition, provenance, components, and limitations so decisions do not turn uncertainty into certainty.
Reference: Principles for effective risk data aggregation and risk reporting · BigSavant operational risk professional assessment2026.10