0%
 

Welcome

Course Navigation Tips

The Home button at the end of each topic takes you to the Home page.

The Menu button provides access to the individual topics.

The Resources button provides a list of useful links.

The Switch Language button lets you switch to a different language.

The Close button ends your training session and closes the course window.

Citi’s Enterprise Risk Management Training Program

Why This?

Citi’s culture and values are at the heart of how business is conducted. A strong risk and control environment is a key enabler of Citi’s culture of excellence.

This basic course is part of Citi’s Enterprise Risk Management Training Program (ERMTP). ERMTP is a series of courses which will build your understanding of your risk and control responsibilities.

Why Now?

Citi has a standard framework for managing risk. As part of Citi's Enterprise Risk Management Framework (ERMF) supporting capabilities, we are committed to equipping employees with knowledge to carry out day-to-day risk and control responsibilities. 

Why Us?

Managing risk is everyone’s job at Citi. We are all risk managers. Risk is inherent to Citi’s business and cannot be avoided. Everyone must be vigilant and manage risk with consistency, and accountability including compliance with applicable laws and regulations. 

The Enterprise Risk Management Framework (ERMF) is Citi’s standard for managing risk.

Everyone is responsible for escalating risks and concerns, and Citi provides an environment where this can be done without fear of retribution.

It is your responsibility to understand your role as it relates to managing risk, taking complete ownership of your actions, and supporting Citi in identifying and managing risk every day.

Introduction

After completing this course, you will be able to:

  • Explain the objectives of Lessons Learned.
  • Identify the key stages of the Lessons Learned Lifecycle.
  • Explain how Qualifying Events (Events) are analyzed, documented, and challenged.
  • Describe the Root Cause Analysis process.
  • Describe the process for publication and sharing of the Lessons Learned Report.

This course is divided into seven topics and an end-of-course assessment. After completing the training content, you must score 80% or higher in the assessment to receive credit for this course.

Welcome

Are you already familiar with Lessons Learned Lifecycle?

If so, this training includes an opportunity for you to demonstrate your knowledge by completing a test out. Successful completion of the test out will allow you to take an accelerated path through the training by skipping the training content to receive credit for the course.

To continue to the test out, select the Take the Test Out button.

If you prefer to skip the test out and go straight to the content, select the Start the Course button.

Lessons Learned Lifecycle

About the Lessons Learned Lifecycle

Citi’s Global Lessons Learned Program, codified in the Lessons Learned Policy and Procedure, establishes a framework for identifying risk exposures and ensuring that Citi enhances its control environment to prevent similar occurrences. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on significant risk events.

The Lessons Learned Lifecycle has six steps.

To proceed, select the step for a brief overview.

1. Event Identification

In Lessons Learned, Events refer to material losses or other adverse impacts resulting from ineffective or failed processes, people or systems. A Qualifying Event is defined as an Event for a Risk Category which meets or exceeds a pre-determined threshold as specified in the Global Lessons Learned Central Procedure.

Businesses review Events applicable to their process and control environment to identify opportunities to reduce adverse impact(s) from Event(s) and reduce the risk of reoccurrence. Businesses and Independent Risk Management may identify Events below the threshold or where no threshold has been established, if they believe that a Lessons Learned report of such Event would be beneficial.

go to next button

2. Event Assignment

Qualifying Events are assigned in the Lessons Learned Tool to the relevant Business to perform the Lessons Learned analysis.

go to next button

3. Event Analysis

Businesses analyze Qualifying Events to gain a clear understanding of the root cause(s) and take action to reasonably prevent a similar Event from reoccurring.

go to next button

4. Report Development

Businesses document the analysis of Qualifying Events in a Lessons Learned Report that is comprehensive, accurate and timely. The report must include a description of the event, its impact(s), root cause(s), contributing factors and remediation/corrective actions.

Businesses submit a draft report to an Independent Challenger within the Lessons Learned Tool (LLT).

go to next button

5. Independent Challenge

Independent Risk Management is required to challenge the report.

The designated Independent Challenger must concur with the report’s findings root cause(s), remediation/corrective actions, readability, and completeness.

go to next button

6. Publication and Sharing

After Independent Challenge review is completed, the report is “published” and shared with other Citi businesses, Independent Risk Management, and regulators.

Publication of Lessons Learned reports enables other Citi businesses to conduct a Read Across review to determine if they have a similar risk exposure. If this determination confirms existence of similar risk exposure, businesses are required to open Issues as defined in the Global Issue Management Standard to mitigate the risk.

Thematic analysis of published reports is performed to identify overarching themes and assess if further risk mitigation is required.

Publication of the Lessons Learned Report and completion of Read Across and Thematic analysis concludes the Lessons Learned process.

return to this button

1. Event Identification
2. Event Assignment
3. Event Analysis
4. Report Development
5. Independent Challenge
6. Publication and Sharing

Coming Next

You’ve now seen an overview of the Lessons Learned Lifecycle. Next, we’ll begin our deeper dive into the steps by first focusing on how Qualifying Events are identified and assigned to the business units.

Event Identification & Event Assignment

Qualifying Event Identification Process

How are qualifying events identified?

Qualifying Event identification involves both First (1LOD) and Second (2LOD) Lines of Defense.

  • 2LOD: LL RCSMEs in Independent Risk Management establish the criteria and thresholds necessary to identify Qualifying Events for their risk category.
  • 1LOD: Businesses review the Events applicable to their process, and control environment, and identify the Qualifying Events that meet or exceed the established thresholds.

Event Identification Information Sources

Businesses identify Qualifying Events by reviewing various sources:

  • Loss Capture System (LCS) for internal Operational Risk Events.
  • Industry Event System (IES) for external Events from ORX and SAS datasets.
  • Issue and Corrective Action Plan System (iCAPS) for Compliance risk-tagged Issues.
  • Fraud Events submitted as “Cases of Interest.”

Event Identification in Action

Now that you know what the Lessons Learned Policy and Procedure say about Qualifying Event identification, let’s see what it looks like in action.

To proceed, select each scene to reveal the scenario.

Duplicate Debit Posting
What Was the Response?

Duplicate Debit Posting

FX Operations received notice that a client account had a duplicate debit posting for their Foreign Exchange (FX) deal for $64 Million.

go to next button

What Was the Response?

FX Operations reversed the error with the full funds returned to the client’s account on the same day. The error was classified as a Near-Miss, due to the immediate return of the funds.

The Event’s Risk Category is in Processing Risk, where the qualifying threshold is currently $50 Million and greater for the Near-Miss Category. FX Operations determined that the Near-Miss was a Qualifying Event for Lessons Learned.

go to next button

Event Assignment Process

The Qualifying Event was triggered from the Lessons Learned Tool (LLT), and a communication sent from the LLT to relevant Business Risk & Control and Independent Risk Management contacts informing them of the assignment.

Assignment to the Business

Qualifying Events are assigned to the Business responsible for the failed, inadequate or missing controls that led to the Event.

In certain operational risk scenarios, the Unit that Bears the Loss (UTBL) and the Unit Responsible for the Control (URC) may not be the same. In these situations, the URC is responsible for performing the Lessons Learned process.

Event Assignment Process

The business and Independent Risk Management can now appoint individuals to the key Lessons Learned Lifecycle roles. In our case they choose Abdi, Dannielle and Naomi and enter their names into the LLT.

To proceed, select each role to learn more.

Event Owner
Report Author
Independent Challenger

Event Owner

Abdi is the Event Owner (1LOD) accountable for managing risk associated with the Qualifying Event.

go to next button

Report Author

Dannielle is the Report Author (1LOD). She will conduct Event Analysis, including Root Cause Analysis for the Event, and document the Lessons Learned Report (LLR).

go to next button

Independent Challenger

Naomi is the Independent Challenger (2LOD). Naomi will provide credible challenge against Dannielle’s Event analysis, root cause(s), remediation/corrective actions and the overall accuracy and completeness of the LLR.

go to next button

What do you think?

In our scenario, who would you appoint to complete the event analysis?

Select the best response from the three options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Coming Next

You’ll recall that after the Qualifying Event is assigned, businesses proceed to Event Analysis. This leads on to Report Development and Independent Challenge. These are the steps we'll cover next.

Event Analysis, Report Development & Independent Challenge

About Event Analysis

Report Authors analyze Event details to identify the fundamental underlying root cause(s) and implement effective solutions to prevent reoccurrence.

To proceed, select each question to reveal the scope of the analysis.

What happened?

What happened?

  • What were the contributing factors and their impact?
  • What was the adverse financial and non-financial impact?
  • What controls could have prevented it?
  • What are the remaining risk exposures?
How did it happen?

How did it happen?

  • When did the Event take place?
  • How and when was the Event escalated?
Why did it happen?

Why did it happen?

  • Why did the Event occur?
  • What was the root cause(s)?
What did we already know?

What did we already know?

  • Was the risk identified in prior assessments?
  • Did available metrics warn of the risk?
  • Were better indicators available?

Root Cause Analysis Process

Report Authors follow the Root Cause Analysis process to identify fundamental causes that must be addressed to reasonably prevent a similar Event from reoccurring.

To proceed, select each area to learn more about the Root Cause Analysis process.

Root Cause Analysis Process Steps
Gathering Information
The ‘Five Whys’

Root Cause Analysis Process Steps

Root Cause Analysis is the process used to diagnose the fundamental underlying driver(s) of an Event. Below are the steps taken to perform Root Cause Analysis.

  1. Gather data: Collect relevant information.
  2. Identify causes: Use the Five Whys to find contributing factors.
  3. Finalize root cause(s): Determine the fundamental reasons behind the Event.
  4. Map to root cause taxonomy: Categorize using
    • Level 1: broad and general causes such as human or process errors.
    • Level 2: deeper dive into systemic underlying issues such as inadequate training or procedures.
  5. Document in LLT: Record findings.

go to next button

Gathering Information

Collect information and data to develop a comprehensive understanding of the Event, enabling an evidence-based Root Cause Analysis for accurate and effective root cause identification.

go to next button

The ‘Five Whys’

The 'Five Whys' is a problem-solving method that helps uncover the root cause of an Event.

  • Identify the problem: Start with a specific problem statement.
  • Ask “Why?”: Ask why the problem happened?
  • Repeat: Continually ask “Why?” to drill down further
  • Root cause: Typically, after five rounds of questioning, you’ll find the fundamental reason behind the problem. Although fewer or more than five whys may be needed to identify the root cause.

go to next button

What’s your advice?

Before our Report Author, Dannielle, begins the Event Analysis, what would be the best advice you could offer

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Event Analysis in Action: What Happened?

Let’s now see how Dannielle puts Event Analysis to work by first investigating what happened and how.

To proceed, select the arrow on the right to step through Dannielle’s analysis.

 

What happened?

In our opening episode, the client’s account had a duplicate debit posting for their Foreign Exchange (FX) transaction. As part of FX Operations’ BAU standard settlement arrangement, FX Operations debits the client’s account for payment for the FX Transaction.

FX Operations did not identify that the client already funded a separate Citi account to be used to fund that FX transaction.

 

What were the contributing factors and their impact?

Dannielle discovered that the FX Operations Team hadn’t followed the client’s special non-BAU settlement arrangement for funding the transaction from the separate Citi account.

This resulted in duplicate debits from the client’s account: one debit made by the client funding the other Citi account, and another debit made by FX Operations to fund the FX transaction.

 

What were the controllable factors?

Dannielle’s analysis reveals the client had a non-BAU settlement arrangement which was not followed by FX Operations. The Maker/Checker control failed to identify the non-BAU client specific settlement arrangement and ensure that the correct account is debited to fund this transaction.

 

How did it happen?

To complete the first phase of her analysis, Dannielle delves into the Event identification details to explore how and when the Event took place and when it was escalated.

 
 

Event Analysis in Action: Why Did It Happen?

With the first phase of her analysis complete, Dannielle now turns to why the Event happened and uses the “Five Whys” to drill down and uncover the root causes:

Primary Problem Statement:
FX Operations incorrectly debited the client’s account rather than the account previously set up to fund the FX transaction.

  • Why 1: FX Operations had not preset the client’s special funding arrangement within the payment system which would have prevented the debit to the incorrect account.
  • Why 2: FX Operations were not aware of the special funding arrangement.
  • Why 3: FX Operations did not check for the special funding arrangements before debiting the client’s account.
  • Why 4: The FX Operations procedure does not require checking for the special funding arrangements; therefore, FX Operations were not trained to check for special instructions.
  • Why 5: Special funding arrangements are very uncommon and were not considered.

Event Analysis in Action: What Should We Do?

Now that Dannielle understands what happened and why, she focuses on remediation actions. What can the FX Operations team do to reasonably prevent this Event from happening again? Let’s see what Dannielle identified.

What corrective action is needed?

To avoid similar issues in the future, Dannielle recommends the following corrective action plan.

  • FX Operations to review and enhance procedures for handling special non-BAU arrangements.
  • Training to be provided on the procedure enhancements.

Event Analysis in Action: What Lessons Did We Learn?

With Dannielle’s Root Cause Analysis now complete, the lessons learned become clear:

Operating procedures should be reviewed on a regular basis to ensure completeness. Non-standard or uncommon processes need to be included in operating procedures.

Dannielle is now almost ready to begin her LLR.

Lessons Learned Report Development

Following her Event Analysis, Dannielle has everything she needs to begin documenting the formal LL Report in the LLT.

Dannielle needs to be sure that her report clearly explains the root causes, the contributing and controllable factors, corrective actions, and lessons learned. Formal Lessons Learned reports are shared with key Citi stakeholders and regulators, and they must be written clearly, and comprehensively.

To proceed, select each area to find out what Dannielle’s LLR will include.

Event Description
Impact
Control Environment
Corrective Actions
Lessons Learned

Event Description

  • What happened, when it occurred, and its duration.
  • How we became aware of the Event
  • The underlying root cause(s) of the Event
  • Any other factors involved
  • Whether this Event has occurred previously
  • Effectiveness of existing controls
  • Why these controls didn’t work

go to next button

Impact

Financial impacts

  • Direct losses
  • Reductions in future revenues due to actions taken

Non-financial impacts

  • Damage to Citi’s reputation
  • Inability to make future acquisitions
  • Service delivery failures

go to next button

Control Environment

Controllable Factors

Dannielle will document any missing, inadequate or failed controls that allowed the Event to occur.

go to next button

Corrective Actions

In her report, Dannielle must reference any completed and/or planned actions to mitigate the risk and reasonably reduce the likelihood of reoccurrence. Those planned actions must include raising or identifying existing iCAPS Issue(s) to address identified control gaps in line with Global Issue Management Standard requirements.

go to next button

Lessons Learned

In her conclusions, Dannielle will consider the broader lessons from the Event, including retrospective mitigating actions which could have helped prevent the Event (or similar root cause Events in the future).

go to next button

Report Development Process

Dannielle’s report development should follow the process steps outlined in the Lessons Learned Policy and the supporting Lessons Learned Central Procedure.

To proceed, select the arrow on the right for an overview of the Report Development process.

 

Draft Report

Dannielle’s draft report should be readable and easily understood by all relevant parties. She needs to use precise and understandable language and avoid undefined acronyms.

Dannielle must describe in the LLR what happened, how the event was detected, the Root Cause of the Event, and the remediation/corrective actions taken to reduce the likelihood of reoccurrence.

 

Approval

Abdi, Dannielle’s Direct Manager (and Event Owner), will review the draft report and help her make any necessary changes before approving the LLR within the LLT.

 

Timetable and Tracking

Dannielle’s report must be submitted for challenge within the designated timeframe.

The completed and challenged report must be published within the designated timeframe.

If a report exceeds the designated timeframe, it must be escalated to the respective In Business Senior Operational Risk Manager (SORM) for review and action.

Refer to the Global Lessons Learned Procedure for specific timeframe and escalation requirements.

 

Report Exclusion

Occasionally, businesses may have a reason for not executing a Lessons Learned review. In this case, the Report Author must document a Report Exclusion Request within the LLT explaining the reasons for not completing the analysis and documenting a report.

 
 

About Independent Challenge

Following Abdi’s approval, Dannielle’s LLR is ready for Independent Challenge.

In our case, Naomi, is the Independent Challenger for this Report. Naomi has the knowledge and subject matter expertise needed to effectively assess Dannielle’s findings and recommendations.

What’s your advice?

Before submitting her LLR for Independent Challenge, Dannielle wonders what criteria Naomi will use during her review. What’s your advice?

During her Independent Challenge review of Dannielle’s LLR, what will Naomi want to ensure and agree?

Select the best response from the three options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Independent Challenge Process

As Independent Challenger, Naomi provides credible challenge to Dannielle’s Report.

To proceed, select each step for an overview of the Independent Challenge process.

Select each image to learn more.

Review
Record
Approve
Escalate

Review

Root cause and remediation actions

Confirm agreement with the Event details and root cause(s) of the Event.

  • Confirm agreement that the remediation/corrective actions help reduce the risk of reoccurrence of the Event.

Readability assessment

  • Evaluate report for clarity and actionable language to help other stakeholders understand the risk factors that gave rise to the adverse Event and actions taken to address reoccurrence risk.

Collaboration

  • Naomi will share feedback with Dannielle and discuss any comments and concerns.
  • Dannielle will incorporate the agreed-upon changes into the final draft of the report to obtain Naomi’s approval of the final report.

go to next button

Record

Naomi will need to document her challenges:

  • Challenges relating to Operational Risk Events are recorded within the Independent Challenge Tool (ICT)
  • Challenges relating to Non-Operational Risk Events are recorded onto the Independent Challenge template.

go to next button

Approve

Naomi must agree with Dannielle’s conclusions on the root cause, contributing factors, controllable factors, and remediation plans to reduce the likelihood of a similar Event happening again.

go to next button

Escalate

Should Dannielle and Naomi disagree on the final report’s language or actions, they must escalate the details of the disagreement to their respective next level of management for resolution.

go to next button

Coming Next

After Naomi successfully completes her Independent Challenge, Dannielle’s LLR is marked as published in the LLT and is ready to be shared. This will be the focus of our next topic.

Publication & Sharing

Publication & Sharing Process

Now that Dannielle’s LLR has been granted final approval by Independent Challenger, Naomi, the report receives the published status within the LLT.

Let’s see what happens to Dannielle’s report next.

To proceed, select the arrow on the right for an overview of the Publication & Sharing process.

 

Sharing

Published reports like Dannielle’s are collected, shared with other businesses, and Independent Risk Management, as well as presented at Business Risk and Control Committees (BRCCs) and other governance committees. The reports are also shared with OCC, FRB, and other regulators.

 

Read Across

Businesses are required to perform a Read Across applicability review of reports published by other businesses and determine whether similar risk exposure exists in their business. If this determination confirms existence of similar risk exposure, businesses are required to open Issues to address the concern and mitigate the risk.

 

Thematic Analysis

Businesses also perform thematic analyses on their own published reports to gain insights into overarching themes and/or trends within their business, to determine additional risk mitigation opportunities and enhancements needed for their current control environment. Publication of the Lessons Learned Report and completion of Read Across and Thematic analysis concludes the Lessons Learned process.

 
 

Dannielle’s Winning Report!

During a Read Across review of Danielle’s published report, another Operations Team recognized that they too could have a similar risk as they leverage a maker-checker control to process client transactions, including bespoke instructions.

Following Dannielle’s LLR recommendations, they conducted a review of their standard arrangements to ensure their procedures were up to date and adequately cover bespoke arrangements with clients.

The win from Dannielle’s report was that another Business was able to identify a similar risk exposure and review their control environment before the same risk materialized in their business.

Coming Next

Up next, there’s a summary of what you’ve learned.

Summary

Key Takeaways

The Lessons Learned Program establishes a Citi-wide framework for identifying risk exposures and ensuring that Citi enhances its control environment with the aim to prevent similar occurrences. This framework is operationalized through the LL Lifecycle which includes identifying, analyzing, and reporting on Qualifying Events.

  1. Identification: LL RCSMEs and businesses identify Qualifying Lessons Learned Events.
  2. Assignment: Events are assigned in the Lessons Learned Tool to the businesses responsible for the control.
  3. Analysis: Businesses analyze Events to understand root causes and implement mitigating actions.
  4. Report Development: Report Authors create comprehensive reports with Event descriptions, impacts, root causes and remediation plans.
  5. Independent Challenge: Independent Challengers review and concur with Reports.
  6. Publication & Sharing:
    • Published reports are shared with Independent Risk Management, Citi Businesses, and regulators.
    • Businesses conduct Read Across reviews and perform quarterly thematic analyses.

Coming Next

Next up, a 5-question assessment.

Assessment

Which statement describes the objective of Lessons Learned?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

The Lessons Learned Lifecycle begins with Event Identification, Event Assignment and Event Analysis. What are the next stages of the Lessons Learned Lifecycle?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

What are the objectives of the Root Cause Analysis process used by Lessons Learned Report Authors?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

What is the purpose of Report Challenge?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Following the Independent Challenge, Publication & Sharing of a Lessons Learned Report, what must the business do?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Home

Welcome
Lessons Learned Lifecycle
Event Identification & Event Assignment
Event Analysis, Report Development & Independent Challenge
Publication & Sharing
Summary
Assessment

go to close menu button

 

go to close button