A focused course, tailored for you
The Regional Bank Operational Risk Workpaper Playbook
Build credit, market, operational, and third-party risk workpapers an internal audit reviewer signs off on the first pass.
The reviewer comments you got on the last cycle were not about the risk. They were about how the workpaper was assembled.
$199 one-time
Tailored to your situation. Access within 24 hours. 30-day money-back.
Includes a hand-built implementation playbook delivered alongside course access, generated for your specific situation.
Why this course
A Risk Management Specialist at a large US regional bank produces workpapers across credit, market, operational, third-party, model, and BSA-AML lines. Each line has its own reviewer, its own sampling expectation, and its own evidence standard. When internal audit, the OCC examiner team, or a second-line reviewer returns a workpaper with rework comments, the comments cluster in predictable places. Control rationale too thin. Sample size not justified against the population. Residual rating not tied to the inherent score on the heat map. Issue language that does not survive aggregation into the enterprise risk report. The technical risk knowledge is already in the seat. What is missing is the assembly grammar that makes a workpaper close on the first pass.
What you walk away with
- A first-pass-clean workpaper standard across the six risk lines you cover.
- Sample-size methodology with a written rationale a reviewer accepts.
- Residual-to-inherent rating linkage that ties back to the heat map.
- Issue write-ups that survive aggregation into the enterprise risk report.
- An evidence trail that maps cleanly to OCC heightened-standards expectations.
The 12 modules
Module 1. The Workpaper That Closes First Pass
What a reviewer is actually looking for when they open a credit or operational risk workpaper. The order of evidence. The level of detail in the control rationale. Where reviewers stop reading and write rework comments. A line-by-line walk-through of a clean workpaper and a returned workpaper, with the differences flagged.
Module 2. Risk Taxonomy Aligned to FFIEC and OCC
How your bank's risk taxonomy maps to FFIEC categories and the OCC heightened-standards risk types. Where the boundaries between categories sit, and where they get muddied. Where second-line reviewers expect explicit cross-references. How to write taxonomy entries that hold up under examiner scrutiny without dragging in noise from adjacent risk categories.
Module 3. Credit Risk Workpaper Standards
Sampling, control rationale, and exception write-ups for the credit risk review cycle. Concentration testing. Underwriting compliance sampling. Risk-rating accuracy reviews. The specific evidence reviewers want for past-due, classified, and special-mention exposures. How to document a control test for a CCAR-relevant portfolio without overreaching.
Module 4. Operational Risk and Resilience
Loss event taxonomy. Scenario analysis write-ups. Resilience testing evidence under the interagency sound-practices regime. How to write a control rationale for a third-party-supported critical operation. How to link operational loss data to the residual rating on the operational risk heat map so the aggregation is defensible.
Module 5. Third-Party Risk Assessments
OCC third-party risk management bulletin expectations. Inherent-risk scoring of vendors. The depth of due diligence expected for critical vs non-critical providers. Subcontractor concentration. How to write a third-party risk assessment that survives the first-line objection and the second-line challenge in the same cycle.
Module 6. Market Risk Attestations
Limit framework attestations. VaR backtesting documentation. Stress scenario write-ups. How to document a market risk control test that ties to the trading book limits without re-litigating the limits themselves. What a reviewer reads first when a market risk attestation lands on their desk.
Module 7. Model Risk Management Linkage
How risk specialist workpapers interact with the SR 11-7 model governance regime. When a risk write-up needs to cite a model validation memo. When the risk write-up itself becomes a model input. How to write the cross-reference so neither the model risk team nor the second-line reviewer asks for rework.
Module 8. BSA-AML Risk Write-Ups
Inherent-risk scoring of customers, products, and geographies. SAR support documentation that does not overstate. CTR exception write-ups. How to draft a BSA-AML risk assessment section that holds up under the FinCEN, the OCC, and the internal audit lens at the same time without contradiction.
Module 9. Sample-Size Methodology
The written rationale a reviewer wants to see for a sample of N out of a population of M. Statistical and judgemental sampling. Tolerable deviation rates. How to document the methodology once and reference it across cycles so you are not rebuilding the rationale every time. The three sample-size objections reviewers raise most and how to pre-empt them.
Module 10. Residual-to-Inherent Linkage on the Heat Map
Why residual ratings get returned. How to walk from inherent score, through control effectiveness rating, to residual position on the heat map in a way the enterprise risk committee accepts. The two-column write-up that closes the linkage. Common gaps where the heat map and the workpaper drift apart.
Module 11. Issue Write-Ups That Survive Aggregation
How issues written at the workpaper level get rolled up into the enterprise risk report. The language that survives aggregation and the language that gets rewritten by second line. Root cause framing. Action-owner specificity. Target-date defensibility. How to write an issue once and not have to rewrite it three layers up.
Module 12. Evidence Trail Under Heightened Standards
The OCC heightened-standards expectation for evidence retention, traceability, and second-line independence. How your workpaper file should index. What the examiner pulls first when they sample your line. The five evidence gaps that show up most in heightened-standards reviews and the specific artefacts that close them.
How this addresses your situation
Specific modules that map to what you said you are dealing with.
Workpaper returned with rework comments on control rationale: modules 1, 3, 4, 5.
Sample size questioned by second line or internal audit: module 9.
Residual rating contested at the enterprise risk committee: modules 10, 11.
OCC examiner sampling your line for heightened-standards review: modules 1, 2, 12.
What you get with this course
- 12 written modules in the Art of Service learning environment.
- Downloadable workpaper templates for credit, market, operational, third-party, model, and BSA-AML lines.
- A residual-to-inherent linkage worksheet keyed to a standard heat map.
- A sample-size methodology write-up keyed to common bank populations.
- Issue write-up template with root cause, action owner, and target date fields.
- Hand-built implementation playbook tailored to the specific risk lines and reviewer cadence in your seat.
- 30-day money-back guarantee on the course.
What you will have in hand by Day 1, Week 1, Month 1
Within 24 hours: course access provisioned and the hand-built implementation playbook delivered alongside it.
Week 1: modules 1-4. Workpaper standard and risk taxonomy alignment.
Week 2: modules 5-8. Third-party, market, model, BSA-AML write-ups.
Week 3: modules 9-12. Sampling, residual-to-inherent linkage, issue aggregation, evidence trail.
Before and after
Before
Workpapers come back with rework comments cycle after cycle. The risk content is right but the assembly grammar is wrong. Sample size rationale gets questioned. Residual ratings drift from the heat map. Issue write-ups get rewritten when they roll up into the enterprise risk report.
After
Workpapers close on the first pass. Sample-size methodology is written once and referenced. Residual rating ties cleanly to inherent score on the heat map. Issue language survives aggregation. Examiner sampling under heightened standards finds an evidence trail that indexes the way they expect.
What happens if you do not address this
Rework cycles compound. Each returned workpaper costs a reviewer cycle and a specialist cycle. When the OCC examiner team samples a line that has a pattern of rework, the finding becomes a heightened-standards observation rather than a workpaper note. The fix at that point is expensive across the second and third lines.
Who it is for
You are a Risk Management Specialist inside a large US regional bank with significant retail, commercial, and treasury lines. You sit under second-line risk leadership and you support cycles that feed internal audit, the enterprise risk committee, and the OCC. Your work touches credit risk, operational risk and resilience, third-party risk, market risk, and the model risk function. You are expected to produce workpapers and risk write-ups that hold up under heightened-standards review without rework loops.
Who this is NOT for. Not for credit officers writing underwriting memos. Not for relationship managers. Not for treasury front-office staff. Not for staff at non-bank fintechs without a chartered supervisory regime. Not for compliance officers whose primary remit is consumer regulation rather than enterprise risk.
How it arrives
Text-based course in the Art of Service learning environment, plus downloadable templates and worked examples for every module, plus the hand-built implementation playbook delivered alongside course access.
Time investment. Approximately three to four hours per week across three weeks. Modules are designed to be read against an open workpaper rather than in the abstract.
Why $199 is the right number
Internal training tends to cover the bank's policy but not the reviewer grammar. External GARP and PRMIA programmes cover risk theory but not workpaper assembly. The Big Four risk advisory engagements deliver assembly grammar but at a price point that is not available to an individual specialist. This course closes that gap at 199 USD with a hand-built implementation playbook keyed to your specific risk lines.
FAQ
Does this assume a specific risk management system?
No. The workpaper grammar applies whether your bank runs Archer, MetricStream, IBM OpenPages, ServiceNow IRM, or a homegrown SharePoint-based system. The templates are tool-agnostic.
Will this cover consumer compliance lines?
Briefly, where consumer compliance findings intersect with operational risk write-ups. The primary focus is enterprise risk lines, not Reg Z or Reg E specifically.
Is the implementation playbook generic?
No. It is hand-built against the specific risk lines you cover and the reviewer cadence you sit under. The course is text. The playbook is bespoke.
How is the course delivered?
Written modules in the Art of Service learning environment, plus downloadable templates and worked examples, plus the hand-built implementation playbook delivered alongside course access.
30-day money-back guarantee. If after a week of working through the materials this is not what you needed, reply to the receipt email and a full refund is processed. No questions, no forms.
Within 24 hours your account in the learning environment is provisioned and the tailored implementation playbook is delivered alongside it.
