0%

#

## Welcome

## Lessons Learned: Lifecycle, Events & Challenge (ERMTP – Basic)

Welcome to Lessons Learned: Lifecycle, Events & Challenge (ERMTP – Basic).

This course provides a walkthrough of the Lessons Learned Lifecycle, including Event Identification, Event Analysis, Report Development, Independent Challenge and Publication & Sharing.

If you are accessing the course from a personal device directly over the Internet (outside of the Citi network), some links may not work if they link to content within Citi’s network. This will not impact your ability to complete the course.

Scroll down to continue.

## Course Navigation Tips

The Home button at the end of each topic takes you to the Home page.

The Menu button provides access to the individual topics.

The Resources button provides a list of useful links.

The Switch Language button lets you switch to a different language.

The Close button ends your training session and closes the course window.

## Citi’s Enterprise Risk Management Training Program

## Why This?

Citi’s culture and values are at the heart of how business is conducted. A strong risk and control environment is a key enabler of Citi’s culture of excellence.

This basic course is part of Citi’s Enterprise Risk Management Training Program (ERMTP). ERMTP is a series of courses which will build your understanding of your risk and control responsibilities.

## Why Now?

Citi has a standard framework for managing risk. As part of Citi's Enterprise Risk Management Framework (ERMF) supporting capabilities, we are committed to equipping employees with knowledge to carry out day-to-day risk and control responsibilities.

## Why Us?

Managing risk is everyone’s job at Citi. We are all risk managers. Risk is inherent to Citi’s business and cannot be avoided. Everyone must be vigilant and manage risk with consistency, and accountability including compliance with applicable laws and regulations.

The Enterprise Risk Management Framework (ERMF) is Citi’s standard for managing risk.

Everyone is responsible for escalating risks and concerns, and Citi provides an environment where this can be done without fear of retribution.

It is your responsibility to understand your role as it relates to managing risk, taking complete ownership of your actions, and supporting Citi in identifying and managing risk every day.

## Introduction

After completing this course, you will be able to:

- Explain the objectives of Lessons Learned.
- Identify the key stages of the Lessons Learned Lifecycle.
- Explain how Qualifying Events (Events) are analyzed, documented, and challenged.
- Describe the Root Cause Analysis process.
- Describe the process for publication and sharing of the Lessons Learned Report.

This course is divided into seven topics and an end-of-course assessment. After completing the training content, you must score 80% or higher in the assessment to receive credit for this course.

## Welcome

Are you already familiar with Lessons Learned Lifecycle?

If so, this training includes an opportunity for you to demonstrate your knowledge by completing a test out. Successful completion of the test out will allow you to take an accelerated path through the training by skipping the training content to receive credit for the course.

To continue to the test out, select the Take the Test Out button.

If you prefer to skip the test out and go straight to the content, select the Start the Course button.

## Lessons Learned Lifecycle

In 2013, the Federal Reserve Board (FRB) required large banks to establish a program to minimize the impact of reoccurring adverse Events. Citi responded by creating the Global Lessons Learned Program.

This topic explains the objectives of the Global Lessons Learned Program and identifies the six key steps of the Lessons Learned Lifecycle.

Scroll down to continue.

## About the Lessons Learned Lifecycle

Citi’s Global Lessons Learned Program, codified in the Lessons Learned Policy and Procedure, establishes a framework for identifying risk exposures and ensuring that Citi enhances its control environment to prevent similar occurrences. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on significant risk events.

The Lessons Learned Lifecycle has six steps.

To proceed, select the step for a brief overview.

### 1. Event Identification

In Lessons Learned, Events refer to material losses or other adverse impacts resulting from ineffective or failed processes, people or systems. A Qualifying Event is defined as an Event for a Risk Category which meets or exceeds a pre-determined threshold as specified in the Global Lessons Learned Central Procedure.

Businesses review Events applicable to their process and control environment to identify opportunities to reduce adverse impact(s) from Event(s) and reduce the risk of reoccurrence. Businesses and Independent Risk Management may identify Events below the threshold or where no threshold has been established, if they believe that a Lessons Learned report of such Event would be beneficial.

go to next button

### 2. Event Assignment

Qualifying Events are assigned in the Lessons Learned Tool to the relevant Business to perform the Lessons Learned analysis.

go to next button

### 3. Event Analysis

Businesses analyze Qualifying Events to gain a clear understanding of the root cause(s) and take action to reasonably prevent a similar Event from reoccurring.

go to next button

### 4. Report Development

Businesses document the analysis of Qualifying Events in a Lessons Learned Report that is comprehensive, accurate and timely. The report must include a description of the event, its impact(s), root cause(s), contributing factors and remediation/corrective actions.

Businesses submit a draft report to an Independent Challenger within the Lessons Learned Tool (LLT).

go to next button

### 5. Independent Challenge

Independent Risk Management is required to challenge the report.

The designated Independent Challenger must concur with the report’s findings root cause(s), remediation/corrective actions, readability, and completeness.

go to next button

### 6. Publication and Sharing

After Independent Challenge review is completed, the report is “published” and shared with other Citi businesses, Independent Risk Management, and regulators.

Publication of Lessons Learned reports enables other Citi businesses to conduct a Read Across review to determine if they have a similar risk exposure. If this determination confirms existence of similar risk exposure, businesses are required to open Issues as defined in the Global Issue Management Standard to mitigate the risk.

Thematic analysis of published reports is performed to identify overarching themes and assess if further risk mitigation is required.

Publication of the Lessons Learned Report and completion of Read Across and Thematic analysis concludes the Lessons Learned process.

return to this button

1. Event Identification
2. Event Assignment
3. Event Analysis
4. Report Development
5. Independent Challenge
6. Publication and Sharing

## Coming Next

You’ve now seen an overview of the Lessons Learned Lifecycle. Next, we’ll begin our deeper dive into the steps by first focusing on how Qualifying Events are identified and assigned to the business units.

## Event Identification & Event Assignment

The Lessons Learned Lifecycle starts by identifying Qualifying Events that meet specific criteria. Once identified, these Events are assigned to relevant businesses to initiate the Lessons Learned process.

The Lesson Learned Framework specifies the timeline for complete analysis and disposition of Qualifying Events. Separately, Businesses also must ensure that any Events subject to Escalation Policy requirements are escalated with a sense of urgency and adhere to the timelines prescribed in it.

This topic describes how Qualifying Events are identified and assigned to the business.

Scroll down to continue.

## Qualifying Event Identification Process

How are qualifying events identified?

Qualifying Event identification involves both First (1LOD) and Second (2LOD) Lines of Defense.

- 2LOD: LL RCSMEs in Independent Risk Management establish the criteria and thresholds necessary to identify Qualifying Events for their risk category.
- 1LOD: Businesses review the Events applicable to their process, and control environment, and identify the Qualifying Events that meet or exceed the established thresholds.

## Event Identification Information Sources

Businesses identify Qualifying Events by reviewing various sources:

- Loss Capture System (LCS) for internal Operational Risk Events.
- Industry Event System (IES) for external Events from ORX and SAS datasets.
- Issue and Corrective Action Plan System (iCAPS) for Compliance risk-tagged Issues.
- Fraud Events submitted as “Cases of Interest.”

## Event Identification in Action

Now that you know what the Lessons Learned Policy and Procedure say about Qualifying Event identification, let’s see what it looks like in action.

To proceed, select each scene to reveal the scenario.

Duplicate Debit Posting
What Was the Response?

### Duplicate Debit Posting

FX Operations received notice that a client account had a duplicate debit posting for their Foreign Exchange (FX) deal for $64 Million.

go to next button

### What Was the Response?

FX Operations reversed the error with the full funds returned to the client’s account on the same day. The error was classified as a Near-Miss, due to the immediate return of the funds.

The Event’s Risk Category is in Processing Risk, where the qualifying threshold is currently $50 Million and greater for the Near-Miss Category. FX Operations determined that the Near-Miss was a Qualifying Event for Lessons Learned.

go to next button

## Event Assignment Process

The Qualifying Event was triggered from the Lessons Learned Tool (LLT), and a communication sent from the LLT to relevant Business Risk & Control and Independent Risk Management contacts informing them of the assignment.

## Assignment to the Business

Qualifying Events are assigned to the Business responsible for the failed, inadequate or missing controls that led to the Event.

In certain operational risk scenarios, the Unit that Bears the Loss (UTBL) and the Unit Responsible for the Control (URC) may not be the same. In these situations, the URC is responsible for performing the Lessons Learned process.

## Event Assignment Process

The business and Independent Risk Management can now appoint individuals to the key Lessons Learned Lifecycle roles. In our case they choose Abdi, Dannielle and Naomi and enter their names into the LLT.

To proceed, select each role to learn more.

Event Owner
Report Author
Independent Challenger

### Event Owner

Abdi is the Event Owner (1LOD) accountable for managing risk associated with the Qualifying Event.

go to next button

### Report Author

Dannielle is the Report Author (1LOD). She will conduct Event Analysis, including Root Cause Analysis for the Event, and document the Lessons Learned Report (LLR).

go to next button

### Independent Challenger

Naomi is the Independent Challenger (2LOD). Naomi will provide credible challenge against Dannielle’s Event analysis, root cause(s), remediation/corrective actions and the overall accuracy and completeness of the LLR.

go to next button

## What do you think?

In our scenario, who would you appoint to complete the event analysis?

Select the best response from the three options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Abdi, the Event Owner
Abdi, the Event Owner
Dannielle, the Report Author
Dannielle, the Report Author
Naomi, the Independent Challenger
Naomi, the Independent Challenger
Submit

That answer is correct.

The Report Author, in our case Dannielle, conducts the Event Analysis including the Root Cause Analysis and develops the remediation/corrective actions for the LLR. That’s the subject of our next topic.

That answer is not correct.

The Report Author, in our case Dannielle, conducts the Event Analysis including the Root Cause Analysis and develops the remediation/corrective actions for the LLR. That’s the subject of our next topic.

That answer is not correct.

The Report Author, in our case Dannielle, conducts the Event Analysis including the Root Cause Analysis and develops the remediation/corrective actions for the LLR. That’s the subject of our next topic.

That answer is correct.

The Report Author, in our case Dannielle, conducts the Event Analysis including the Root Cause Analysis and develops the remediation/corrective actions for the LLR. That’s the subject of our next topic.

That answer is not correct.

The Report Author, in our case Dannielle, conducts the Event Analysis including the Root Cause Analysis and develops the remediation/corrective actions for the LLR. That’s the subject of our next topic.

## Coming Next

You’ll recall that after the Qualifying Event is assigned, businesses proceed to Event Analysis. This leads on to Report Development and Independent Challenge. These are the steps we'll cover next.

## Event Analysis, Report Development & Independent Challenge

Now that the Qualifying Event has been identified and assigned to the business, Dannielle, our Report Author, can begin her analysis and develop a comprehensive LLR. This report will then be challenged by Naomi, our Independent Challenger, to ensure its completeness, accuracy, and comprehensiveness.

This topic explains how Qualifying Events are analyzed, documented, and challenged.

Scroll down to continue.

## About Event Analysis

Report Authors analyze Event details to identify the fundamental underlying root cause(s) and implement effective solutions to prevent reoccurrence.

To proceed, select each question to reveal the scope of the analysis.

What happened?

What happened?

- What were the contributing factors and their impact?
- What was the adverse financial and non-financial impact?
- What controls could have prevented it?
- What are the remaining risk exposures?

How did it happen?

How did it happen?

- When did the Event take place?
- How and when was the Event escalated?

Why did it happen?

Why did it happen?

- Why did the Event occur?
- What was the root cause(s)?

What did we already know?

What did we already know?

- Was the risk identified in prior assessments?
- Did available metrics warn of the risk?
- Were better indicators available?

## Root Cause Analysis Process

Report Authors follow the Root Cause Analysis process to identify fundamental causes that must be addressed to reasonably prevent a similar Event from reoccurring.

To proceed, select each area to learn more about the Root Cause Analysis process.

Root Cause Analysis Process Steps
Gathering Information
The ‘Five Whys’

### Root Cause Analysis Process Steps

Root Cause Analysis is the process used to diagnose the fundamental underlying driver(s) of an Event. Below are the steps taken to perform Root Cause Analysis.

1. Gather data: Collect relevant information.
2. Identify causes: Use the Five Whys to find contributing factors.
3. Finalize root cause(s): Determine the fundamental reasons behind the Event.
4. Map to root cause taxonomy: Categorize using

- Level 1: broad and general causes such as human or process errors.
- Level 2: deeper dive into systemic underlying issues such as inadequate training or procedures.

5. Document in LLT: Record findings.

go to next button

### Gathering Information

Collect information and data to develop a comprehensive understanding of the Event, enabling an evidence-based Root Cause Analysis for accurate and effective root cause identification.

go to next button

### The ‘Five Whys’

The 'Five Whys' is a problem-solving method that helps uncover the root cause of an Event.

- Identify the problem: Start with a specific problem statement.
- Ask “Why?”: Ask why the problem happened?
- Repeat: Continually ask “Why?” to drill down further
- Root cause: Typically, after five rounds of questioning, you’ll find the fundamental reason behind the problem. Although fewer or more than five whys may be needed to identify the root cause.

go to next button

## What’s your advice?

Before our Report Author, Dannielle, begins the Event Analysis, what would be the best advice you could offer

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Focus on classifying necessary adjustments in local business practices by addressing the Event's symptoms.
Focus on classifying necessary adjustments in local business practices by addressing the Event's symptoms.
Concentrate on the most serious symptoms to help pinpoint the departments and individuals responsible for the Event.
Concentrate on the most serious symptoms to help pinpoint the departments and individuals responsible for the Event.
Focus on the Event’s underlying causes and ascertain the required corrective actions to address those root causes.
Focus on the Event’s underlying causes and ascertain the required corrective actions to address those root causes.
Focus primarily on how to inform risk policy development and how to develop a risk averse culture.
Focus primarily on how to inform risk policy development and how to develop a risk averse culture.
Submit

That answer is correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

That answer is not correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

That answer is not correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

That answer is not correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

That answer is correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

That answer is not correct.

Dannielle’s analysis should aim to address the Event’s underlying causes, inform corrective actions, and reduce the likelihood of that Event reoccurring.

## Event Analysis in Action: What Happened?

Let’s now see how Dannielle puts Event Analysis to work by first investigating what happened and how.

To proceed, select the arrow on the right to step through Dannielle’s analysis.

### What happened?

In our opening episode, the client’s account had a duplicate debit posting for their Foreign Exchange (FX) transaction. As part of FX Operations’ BAU standard settlement arrangement, FX Operations debits the client’s account for payment for the FX Transaction.

FX Operations did not identify that the client already funded a separate Citi account to be used to fund that FX transaction.

### What were the contributing factors and their impact?

Dannielle discovered that the FX Operations Team hadn’t followed the client’s special non-BAU settlement arrangement for funding the transaction from the separate Citi account.

This resulted in duplicate debits from the client’s account: one debit made by the client funding the other Citi account, and another debit made by FX Operations to fund the FX transaction.

### What were the controllable factors?

Dannielle’s analysis reveals the client had a non-BAU settlement arrangement which was not followed by FX Operations. The Maker/Checker control failed to identify the non-BAU client specific settlement arrangement and ensure that the correct account is debited to fund this transaction.

### How did it happen?

To complete the first phase of her analysis, Dannielle delves into the Event identification details to explore how and when the Event took place and when it was escalated.

## Event Analysis in Action: Why Did It Happen?

With the first phase of her analysis complete, Dannielle now turns to why the Event happened and uses the “Five Whys” to drill down and uncover the root causes:

Primary Problem Statement:
FX Operations incorrectly debited the client’s account rather than the account previously set up to fund the FX transaction.

- Why 1: FX Operations had not preset the client’s special funding arrangement within the payment system which would have prevented the debit to the incorrect account.
- Why 2: FX Operations were not aware of the special funding arrangement.
- Why 3: FX Operations did not check for the special funding arrangements before debiting the client’s account.
- Why 4: The FX Operations procedure does not require checking for the special funding arrangements; therefore, FX Operations were not trained to check for special instructions.
- Why 5: Special funding arrangements are very uncommon and were not considered.

## Event Analysis in Action: What Should We Do?

Now that Dannielle understands what happened and why, she focuses on remediation actions. What can the FX Operations team do to reasonably prevent this Event from happening again? Let’s see what Dannielle identified.

What corrective action is needed?

To avoid similar issues in the future, Dannielle recommends the following corrective action plan.

- FX Operations to review and enhance procedures for handling special non-BAU arrangements.
- Training to be provided on the procedure enhancements.

## Event Analysis in Action: What Lessons Did We Learn?

With Dannielle’s Root Cause Analysis now complete, the lessons learned become clear:

Operating procedures should be reviewed on a regular basis to ensure completeness. Non-standard or uncommon processes need to be included in operating procedures.

Dannielle is now almost ready to begin her LLR.

## Lessons Learned Report Development

Following her Event Analysis, Dannielle has everything she needs to begin documenting the formal LL Report in the LLT.

Dannielle needs to be sure that her report clearly explains the root causes, the contributing and controllable factors, corrective actions, and lessons learned. Formal Lessons Learned reports are shared with key Citi stakeholders and regulators, and they must be written clearly, and comprehensively.

To proceed, select each area to find out what Dannielle’s LLR will include.

Event Description
Impact
Control Environment
Corrective Actions
Lessons Learned

### Event Description

- What happened, when it occurred, and its duration.
- How we became aware of the Event
- The underlying root cause(s) of the Event
- Any other factors involved
- Whether this Event has occurred previously
- Effectiveness of existing controls
- Why these controls didn’t work

go to next button

### Impact

Financial impacts

- Direct losses
- Reductions in future revenues due to actions taken

Non-financial impacts

- Damage to Citi’s reputation
- Inability to make future acquisitions
- Service delivery failures

go to next button

### Control Environment

Controllable Factors

Dannielle will document any missing, inadequate or failed controls that allowed the Event to occur.

go to next button

### Corrective Actions

In her report, Dannielle must reference any completed and/or planned actions to mitigate the risk and reasonably reduce the likelihood of reoccurrence. Those planned actions must include raising or identifying existing iCAPS Issue(s) to address identified control gaps in line with Global Issue Management Standard requirements.

go to next button

### Lessons Learned

In her conclusions, Dannielle will consider the broader lessons from the Event, including retrospective mitigating actions which could have helped prevent the Event (or similar root cause Events in the future).

go to next button

## Report Development Process

Dannielle’s report development should follow the process steps outlined in the Lessons Learned Policy and the supporting Lessons Learned Central Procedure.

To proceed, select the arrow on the right for an overview of the Report Development process.

### Draft Report

Dannielle’s draft report should be readable and easily understood by all relevant parties. She needs to use precise and understandable language and avoid undefined acronyms.

Dannielle must describe in the LLR what happened, how the event was detected, the Root Cause of the Event, and the remediation/corrective actions taken to reduce the likelihood of reoccurrence.

### Approval

Abdi, Dannielle’s Direct Manager (and Event Owner), will review the draft report and help her make any necessary changes before approving the LLR within the LLT.

### Timetable and Tracking

Dannielle’s report must be submitted for challenge within the designated timeframe.

The completed and challenged report must be published within the designated timeframe.

If a report exceeds the designated timeframe, it must be escalated to the respective In Business Senior Operational Risk Manager (SORM) for review and action.

Refer to the Global Lessons Learned Procedure for specific timeframe and escalation requirements.

### Report Exclusion

Occasionally, businesses may have a reason for not executing a Lessons Learned review. In this case, the Report Author must document a Report Exclusion Request within the LLT explaining the reasons for not completing the analysis and documenting a report.

## About Independent Challenge

Following Abdi’s approval, Dannielle’s LLR is ready for Independent Challenge.

In our case, Naomi, is the Independent Challenger for this Report. Naomi has the knowledge and subject matter expertise needed to effectively assess Dannielle’s findings and recommendations.

## What’s your advice?

Before submitting her LLR for Independent Challenge, Dannielle wonders what criteria Naomi will use during her review. What’s your advice?

During her Independent Challenge review of Dannielle’s LLR, what will Naomi want to ensure and agree?

Select the best response from the three options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Ensure the Report:

- Identifies all potential reasons for the Event happening.
- Explains how the business will oversee risk taking activities.
- Identifies those responsible for the Event occurring.

Ensure the Report:

- Identifies all potential reasons for the Event happening.
- Explains how the business will oversee risk taking activities.
- Identifies those responsible for the Event occurring.

Challenge the LLR and ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

Challenge the LLR and ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

Challenge the LLR and ensure:

- It includes recommendations for managing future operational processes.
- Explains how the business will encourage a safety culture.
- Provides details on how other businesses within the organization are impacted.

Challenge the LLR and ensure:

- It includes recommendations for managing future operational processes.
- Explains how the business will encourage a safety culture.
- Provides details on how other businesses within the organization are impacted.

Submit

That answer is correct.

As the designated Independent Challenger, Naomi has the requisite knowledge and subject matter expertise to effectively challenge Dannielle’s report to ensure its completeness, accuracy, and readability.

That answer is not correct.

As the designated Independent Challenger, Naomi has the requisite knowledge and subject matter expertise to effectively challenge Dannielle’s report to ensure its completeness, accuracy, and readability.

That answer is not correct.

As the designated Independent Challenger, Naomi has the requisite knowledge and subject matter expertise to effectively challenge Dannielle’s report to ensure its completeness, accuracy, and readability.

That answer is correct.

As the designated Independent Challenger, Naomi has the requisite knowledge and subject matter expertise to effectively challenge Dannielle’s report to ensure its completeness, accuracy, and readability.

That answer is not correct.

As the designated Independent Challenger, Naomi has the requisite knowledge and subject matter expertise to effectively challenge Dannielle’s report to ensure its completeness, accuracy, and readability.

## Independent Challenge Process

As Independent Challenger, Naomi provides credible challenge to Dannielle’s Report.

To proceed, select each step for an overview of the Independent Challenge process.

Select each image to learn more.

Review
Record
Approve
Escalate

### Review

Root cause and remediation actions

Confirm agreement with the Event details and root cause(s) of the Event.

- Confirm agreement that the remediation/corrective actions help reduce the risk of reoccurrence of the Event.

Readability assessment

- Evaluate report for clarity and actionable language to help other stakeholders understand the risk factors that gave rise to the adverse Event and actions taken to address reoccurrence risk.

Collaboration

- Naomi will share feedback with Dannielle and discuss any comments and concerns.
- Dannielle will incorporate the agreed-upon changes into the final draft of the report to obtain Naomi’s approval of the final report.

go to next button

### Record

Naomi will need to document her challenges:

- Challenges relating to Operational Risk Events are recorded within the Independent Challenge Tool (ICT)
- Challenges relating to Non-Operational Risk Events are recorded onto the Independent Challenge template.

go to next button

### Approve

Naomi must agree with Dannielle’s conclusions on the root cause, contributing factors, controllable factors, and remediation plans to reduce the likelihood of a similar Event happening again.

go to next button

### Escalate

Should Dannielle and Naomi disagree on the final report’s language or actions, they must escalate the details of the disagreement to their respective next level of management for resolution.

go to next button

## Coming Next

After Naomi successfully completes her Independent Challenge, Dannielle’s LLR is marked as published in the LLT and is ready to be shared. This will be the focus of our next topic.

## Publication & Sharing

In this topic we turn to the process of publication and sharing. Published reports are shared with key Citi stakeholders and regulators. Businesses conduct read across review to determine whether they have similar risk exposure and would benefit from taking action to enhance their existing controls. Additionally, businesses perform thematic analysis of published reports to identify broader concerns and further control enhancement opportunities.

Scroll down to continue.

## Publication & Sharing Process

Now that Dannielle’s LLR has been granted final approval by Independent Challenger, Naomi, the report receives the published status within the LLT.

Let’s see what happens to Dannielle’s report next.

To proceed, select the arrow on the right for an overview of the Publication & Sharing process.

### Sharing

Published reports like Dannielle’s are collected, shared with other businesses, and Independent Risk Management, as well as presented at Business Risk and Control Committees (BRCCs) and other governance committees. The reports are also shared with OCC, FRB, and other regulators.

### Read Across

Businesses are required to perform a Read Across applicability review of reports published by other businesses and determine whether similar risk exposure exists in their business. If this determination confirms existence of similar risk exposure, businesses are required to open Issues to address the concern and mitigate the risk.

### Thematic Analysis

Businesses also perform thematic analyses on their own published reports to gain insights into overarching themes and/or trends within their business, to determine additional risk mitigation opportunities and enhancements needed for their current control environment. Publication of the Lessons Learned Report and completion of Read Across and Thematic analysis concludes the Lessons Learned process.

## Dannielle’s Winning Report!

During a Read Across review of Danielle’s published report, another Operations Team recognized that they too could have a similar risk as they leverage a maker-checker control to process client transactions, including bespoke instructions.

Following Dannielle’s LLR recommendations, they conducted a review of their standard arrangements to ensure their procedures were up to date and adequately cover bespoke arrangements with clients.

The win from Dannielle’s report was that another Business was able to identify a similar risk exposure and review their control environment before the same risk materialized in their business.

## Coming Next

Up next, there’s a summary of what you’ve learned.

## Summary

Now that we’ve completed our walkthrough of the Lessons Learned Lifecycle, here’s a review of the key takeaways from what you’ve learned.

Scroll down to continue.

## Key Takeaways

The Lessons Learned Program establishes a Citi-wide framework for identifying risk exposures and ensuring that Citi enhances its control environment with the aim to prevent similar occurrences. This framework is operationalized through the LL Lifecycle which includes identifying, analyzing, and reporting on Qualifying Events.

1. Identification: LL RCSMEs and businesses identify Qualifying Lessons Learned Events.
2. Assignment: Events are assigned in the Lessons Learned Tool to the businesses responsible for the control.
3. Analysis: Businesses analyze Events to understand root causes and implement mitigating actions.
4. Report Development: Report Authors create comprehensive reports with Event descriptions, impacts, root causes and remediation plans.
5. Independent Challenge: Independent Challengers review and concur with Reports.
6. Publication & Sharing:

- Published reports are shared with Independent Risk Management, Citi Businesses, and regulators.
- Businesses conduct Read Across reviews and perform quarterly thematic analyses.

## Coming Next

Next up, a 5-question assessment.

## Assessment

## Assessent Intro

##

Which statement describes the objective of Lessons Learned?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Aggregating key information to demonstrate the effectiveness of Activity Risk Controls and Monitoring (ARCMs).
Aggregating key information to demonstrate the effectiveness of Activity Risk Controls and Monitoring (ARCMs).
Promoting risk taking awareness, analysis and reporting across the business to reduce errors.
Promoting risk taking awareness, analysis and reporting across the business to reduce errors.
Establishing responsibility for Event detection, mitigation, and resolution to the Unit that Bears the Loss (UTBL).
Establishing responsibility for Event detection, mitigation, and resolution to the Unit that Bears the Loss (UTBL).
Identifying, analyzing, and reporting on Events to reduce their reoccurrence through improved controls or processes.
Identifying, analyzing, and reporting on Events to reduce their reoccurrence through improved controls or processes.
Submit

Citi’s Global Lessons Learned Program aims to learn from Qualifying Events, prevent similar occurrences and share insights across Citi business units. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on Events to enhance controls and reduce future risks.

Citi’s Global Lessons Learned Program aims to learn from Qualifying Events, prevent similar occurrences and share insights across Citi business units. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on Events to enhance controls and reduce future risks.

Citi’s Global Lessons Learned Program aims to learn from Qualifying Events, prevent similar occurrences and share insights across Citi business units. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on Events to enhance controls and reduce future risks.

That answer is correct.

Citi’s Global Lessons Learned Program aims to learn from Qualifying Events, prevent similar occurrences and share insights across Citi business units. The Lessons Learned Lifecycle operationalizes this by identifying, analyzing, and reporting on Events to enhance controls and reduce future risks.

That answer is not correct.

Refer to Lessons Learned Lifecycle, About the Lessons Learned Lifecycle for more information.

That answer is not correct.

Refer to Lessons Learned Lifecycle, About the Lessons Learned Lifecycle for more information.

##

The Lessons Learned Lifecycle begins with Event Identification, Event Assignment and Event Analysis. What are the next stages of the Lessons Learned Lifecycle?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Root Cause Analysis, Report Development, Escalation, Publication & Sharing.
Root Cause Analysis, Report Development, Escalation, Publication & Sharing.
Industry Event System, Independent Challenge, Event Analysis, Report Development.
Industry Event System, Independent Challenge, Event Analysis, Report Development.
Report Development, Independent Challenge, Publication & Sharing.
Report Development, Independent Challenge, Publication & Sharing.
Root Cause Analysis, Escalation, Publication & Sharing, Independent Challenge.
Root Cause Analysis, Escalation, Publication & Sharing, Independent Challenge.
Submit

Next stages of the Lessons Learned Lifecycle are Report Development, Independent Challenge, Publication & Sharing.

Next stages of the Lessons Learned Lifecycle are Report Development, Independent Challenge, Publication & Sharing.

Next stages of the Lessons Learned Lifecycle are Report Development, Independent Challenge, Publication & Sharing.

That answer is correct.

Next stages of the Lessons Learned Lifecycle are Report Development, Independent Challenge, Publication & Sharing.

That answer is not correct.

Refer to Lessons Learned Lifecycle, Lessons Learned Lifecycle Overview for more information.

That answer is not correct.

Refer to Lessons Learned Lifecycle, Lessons Learned Lifecycle Overview for more information.

##

What are the objectives of the Root Cause Analysis process used by Lessons Learned Report Authors?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Address underlying Event symptoms to help inform future identification, categorize mitigation actions, identify required changes in local business work practices.
Address underlying Event symptoms to help inform future identification, categorize mitigation actions, identify required changes in local business work practices.
Address underlying reasons for an Event, inform comprehensive corrective action plans and identify causes that must be addressed to prevent a similar Event from reoccurring.
Address underlying reasons for an Event, inform comprehensive corrective action plans and identify causes that must be addressed to prevent a similar Event from reoccurring.
Addresses underlying symptoms to help identify departments and individuals responsible for the Event.
Addresses underlying symptoms to help identify departments and individuals responsible for the Event.
Inform risk policy development and streamline processes and promote a risk awareness identification and analysis culture.
Inform risk policy development and streamline processes and promote a risk awareness identification and analysis culture.
Submit

Root Cause Analysis addresses underlying causes (not just symptoms), informs comprehensive corrective action plans, and identifies causes that must be addressed to prevent a similar Event from reoccurring.

Root Cause Analysis addresses underlying causes (not just symptoms), informs comprehensive corrective action plans, and identifies causes that must be addressed to prevent a similar Event from reoccurring.

Root Cause Analysis addresses underlying causes (not just symptoms), informs comprehensive corrective action plans, and identifies causes that must be addressed to prevent a similar Event from reoccurring.

That answer is correct.

Root Cause Analysis addresses underlying causes (not just symptoms), informs comprehensive corrective action plans, and identifies causes that must be addressed to prevent a similar Event from reoccurring.

That answer is not correct.

Refer to Event Analysis, Report Development & Independent Challenge, About Event Analysis for more information.

That answer is not correct.

Refer to Event Analysis, Report Development & Independent Challenge, About Event Analysis for more information.

##

What is the purpose of Report Challenge?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

To ensure Lessons Learned Report (LLR):

- Identifies all potential reasons for the Event happening
- Explains how the business will oversee risk taking activities
- Identifies those responsible for the Event occurring

To ensure Lessons Learned Report (LLR):

- Identifies all potential reasons for the Event happening
- Explains how the business will oversee risk taking activities
- Identifies those responsible for the Event occurring

To ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

To ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

To ensure Lessons Learned Report (LLR):

- Includes recommendations for managing future operational processes
- Explains how the business will encourage a safety culture
- Provides the accounting entries to record the loss Event

To ensure Lessons Learned Report (LLR):

- Includes recommendations for managing future operational processes
- Explains how the business will encourage a safety culture
- Provides the accounting entries to record the loss Event

To ensure:

- The Report author referenced all updates to procedures and processes
- Whether or not a planning CAP was necessary to investigate the remediation
- Whether all Issues and CAPs were closed in a timely manner
- The amount of time taken to formulate the Root Cause

To ensure:

- The Report author referenced all updates to procedures and processes
- Whether or not a planning CAP was necessary to investigate the remediation
- Whether all Issues and CAPs were closed in a timely manner
- The amount of time taken to formulate the Root Cause

Submit

The purpose of Report Challenge is to ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

The purpose of Report Challenge is to ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

The purpose of Report Challenge is to ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

That answer is correct.

The purpose of Report Challenge is to ensure:

- The Root Cause is accurate and complete
- The Business’ remediation plan addresses the underlying root cause and reasonably reduces the risk of reoccurrence.
- The Report is comprehensive and understandable.

That answer is not correct.

Refer to Event Analysis, Report Development & Independent Challenge, Report Development Process for more information.

That answer is not correct.

Refer to Event Analysis, Report Development & Independent Challenge, Report Development Process for more information.

##

Following the Independent Challenge, Publication & Sharing of a Lessons Learned Report, what must the business do?

Select the best response from the four options and then select Submit.

Please use the Space key only when selecting a radio option with the keyboard. The Enter key is not fully supported. If the Enter key has been used to select a radio option, please use the Escape key. Then you will be able to use the Space key again to select a radio option.

Instigate a business and enterprise-wide Root Cause Analysis of similar Events.
Instigate a business and enterprise-wide root cause analysis of similar Events.
Report the Event to relevant regulatory authorities, identify the individuals responsible and take appropriate action.
Report the Event to relevant regulatory authorities, identify the individuals responsible and take appropriate action.
Document a risk mitigation program based on overarching themes or trends within their business.
Document a risk mitigation program based on overarching themes or trends within their business.
Perform a Read Across applicability review and thematic analysis.
Perform a Read Across applicability review and thematic analysis.
Submit

Businesses conduct a Read Across applicability review and determine whether similar potential risk exposure could exist in their business, or across to other business units. Quarterly thematic analysis helps identify overarching themes, trends, and additional risk mitigation opportunities.

Businesses conduct a Read Across applicability review and determine whether similar potential risk exposure could exist in their business, or across to other business units. Quarterly thematic analysis helps identify overarching themes, trends, and additional risk mitigation opportunities.

Businesses conduct a Read Across applicability review and determine whether similar potential risk exposure could exist in their business, or across to other business units. Quarterly thematic analysis helps identify overarching themes, trends, and additional risk mitigation opportunities.

That answer is correct.

Businesses conduct a Read Across applicability review and determine whether similar potential risk exposure could exist in their business, or across to other business units. Quarterly thematic analysis helps identify overarching themes, trends, and additional risk mitigation opportunities.

That answer is not correct.

Refer to Publication & Sharing, Publication & Sharing Process for more information.

That answer is not correct.

Refer to Publication & Sharing, Publication & Sharing Process for more information.

## Assessment Results

Retry Test
Retake Course
Review Content
Home

Welcome
Lessons Learned Lifecycle
Event Identification & Event Assignment
Event Analysis, Report Development & Independent Challenge
Publication & Sharing
Summary
Assessment

go to close menu button