Operational Risk Maturity · COBAC Operational Risk Regulation
Your operational risk set-up, measured against the COBAC regulation and turned into a costed action plan.
10 themes, a 5-level scale. And the action that moves each level to the next.
The framework’s 10 themes, already written from L1 to L5. One company, one business unit, or 300 at once.
Operational Risk Maturity · COBAC Operational Risk Regulation
10 themes, 5-level scale.
Nordhavn Industries
53 / 100
They measure their maturity with Datamensio
An example
This could be your situation.
Take one company as an example: three sites, three spreadsheets, no shared answer.
Nobody can consolidate.
Nordhavn Industries, 2,400 people in Hamburg, Lyon and Porto. A client asks where the group stands. Each site answers in its own spreadsheet, with its own scales.
Three weeks, a single base.
One COBAC Regulation on operational risk management for CEMAC credit institutions assessment launched across all three sites at once, from the managers’ interview notes. The framework was already written, its 10 themes and levels L1 to L5 too.
Two costs avoided before being committed.
A score of 53 out of 100, with the gap concentrated on three themes. The AI companion spotted that two actions duplicated those of another audit. The committee report took one sentence to request.
What it saved them
- 3sites measured on the same base, instead of three questionnaires to reconcile
- 2duplicate actions caught before the spend
- 1committee report, with no manual rework
These figures are an example. They could be yours.
The standard imposes processes. Datamensio says where you stand.
01
The framework is already written
Themes, questions and levels L1 to L5, all written. You do not start from an empty spreadsheet.
02
The score lands the same day
Online, by self-assessment link or in interview. Theme by theme, comparable over time.
03
The gap becomes a costed plan
Every step up carries its action. The AI prioritises on expected effect, not on the order of the standard.
04
Progress can be demonstrated
Campaign after campaign, against your target and against your own past. That is what your board asks for.
The maturity scale
One level, the next, and the action that links the two.
This mechanism, a level, the level above, and the action that bridges the two, is what turns a finding into a trajectory.
Are operational incidents collected, classified and used systematically?
- N1
No organised collection. Incidents are known to the teams involved and are not consolidated.
- N2
A database exists and a reporting threshold is defined, but reporting depends on the branches and departments most engaged. Losses are not reconciled against accounting records.
- N3
Collection covers all business lines, incidents are classified against a common taxonomy, and losses are reconciled against expense accounts.
- N4
Every significant incident triggers a root cause analysis and a tracked action, with closure verified. The database feeds into the review of the risk map.
- N5
Loss history is used to calibrate indicators, tolerance thresholds and the capital requirement, with a documented record of revisions.
Action to move from level 2 to level 3
Appoint an operational risk correspondent in each department and branch, roll out the event taxonomy and the reporting threshold, and put the reconciliation of losses against accounting records on the agenda of the quarterly risk committee.
« With Datamensio, we meet our objectives far more efficiently. The ERDF inspection services and our supervising ministry particularly appreciated an approach that gives them reliable data. »
Director, CCI 94CCI Île-de-France
« We believe this is the most suitable solution to scale our transformation project and measure impact according to our needs. »
Maja SucekChief Operating Officer, Interreg Danube
Rarely on its own
Frameworks combine. Put several together to cover your business, or have the AI write yours.
Take your first measurementon COBAC.
What this framework covers
Operational risk is defined as the risk of loss resulting from inadequate or failed procedures, people, internal systems, or from external events. Legal risk is included. The COBAC prudential framework derives precise obligations for CEMAC credit institutions from this: identification and mapping of risks by business line, collection and historisation of incidents and losses, business continuity and IT backup arrangements, oversight of outsourcing, involvement of the governing body, and a capital requirement for operational risk.
In practice, this set-up is hard to steer because it runs across the whole institution. The branch network, card payments, information systems, compliance and human resources each produce part of the material, rarely at the same pace and rarely using the same vocabulary. Three questions come up repeatedly. Is the incident database genuinely fed by the business lines, or reconstructed at year end by the risk department? Is the risk map reconciled against observed losses, or does it live a life of its own in a binder? Are continuity plans tested, and are the lessons from those tests tracked through to closure?
Two contextual factors weigh on institutions in the zone. First, supervisory scrutiny of information systems security and outsourcing is intensifying: dependence on service providers and on regional card payment platforms shifts part of the risk outside the institution, without shifting the responsibility. Second, a common confusion needs clearing up: operational risk is not internal control. Internal control provides the control arrangements, operational risk measures the residual exposure and turns it into losses and capital.
A compliance audit ends with a binary finding: the requirement is met, or it is not. The maturity assessment answers a different question. At what level of control does each component of the set-up sit, and what specific action moves it to the next level. The gap between the score obtained and the target generates the action plan, which the AI groups into a prioritised roadmap. Comparing entities within the group and against previous assessments makes progress legible to the governing body.
The framework is ready to use in Datamensio. It adapts to your institution: the AI adjusts the themes, questions and maturity levels using the CMMI method, or builds a variant from your own procedures, your risk map and your internal control reports.
Reference standard: COBAC Regulation on operational risk management for CEMAC credit institutions
The themes assessed
Governance of the set-up
Operational risk management policy approved by the governing body, roles of the risk function, permanent control and internal audit, risk committee, risk appetite and tolerance thresholds.
Risk mapping
Breakdown by business line and process, identification of risk events, scoring by frequency and impact, factoring in control arrangements, update frequency.
Incident and loss collection
Reporting procedure, collection threshold, escalation timeframes, event classification, accounting reconciliation of losses, historisation and use of the database.
Control arrangements and action plans
First and second-line controls, corrective actions arising from incidents and audit missions, action owners, deadline tracking and closure.
Indicators and monitoring
Key risk indicators, alert thresholds, periodic dashboard, escalation to executive management and the governing body, consistency between indicators and the risk map.
Business continuity and IT backup
Business impact analysis, continuity plan and backup plan, fallback site, backups, testing programme, use of test findings.
Information systems security and card payments
Access and authorisation management, logging, handling of security incidents, card and digital channel fraud, transaction monitoring.
Outsourcing and service providers
Inventory of outsourced activities, prior risk analysis, contractual clauses and service levels, audit rights, provider oversight and reversibility.
Legal risk and personnel security
Tracking of litigation and associated provisions, contractual compliance, branch and cash transport security, internal fraud prevention.
Capital and prudential reporting
Method for calculating the operational risk capital requirement, quality of source data, alignment with the internal control report and the statements submitted to COBAC.
A short version of the framework is available for the online self-assessment.
Frequently asked questions
Does this assessment count as compliance with the COBAC regulation?
No. Datamensio measures the maturity of your set-up and prepares the dialogue with the supervisor. Verifying compliance is a matter for COBAC and your control bodies. The assessment helps identify gaps before they are flagged.
What is the difference between this assessment and a compliance audit?
An audit ends with a binary finding on each requirement. The assessment places each practice on a maturity scale and shows the action that moves it up a level. The two complement each other: the assessment prepares, the audit validates.
How long does the assessment take?
The short version is completed in a single session by the operational risk manager. The full version, run collaboratively, takes one to two weeks, with most of the time spent gathering input from business departments, information systems and internal control.
Can the framework be adapted to our institution?
Yes. Themes, questions and levels can all be modified. The AI can also build a variant from your procedures, your risk map and your internal control reports. The framework is yours.
How can several subsidiaries of a regional group be compared?
Each entity carries out its assessment against the same framework. Scores by theme can be compared across business units and against previous assessments. A cross-entity roadmap consolidates subsidiary action plans without duplicating shared actions.
Does answering require technical expertise?
The questions concern management practices, not technical configuration. A risk or internal control manager can answer them. Questions on continuity and information systems security are assigned to the relevant correspondent in collaborative mode.
How does this framework fit with internal control and ICAAP?
Internal control provides the control arrangements, operational risk measures the residual exposure, ICAAP draws the capital consequences from it. The three assessments share part of the material and converge in a common roadmap.
Where is the data hosted?
In France, with OVH, backed up with Scaleway. No transfer outside the European Union. The AI models used can be selected, including from European providers.