10.3 Non-Financial Risks: Operational, Strategic, and Reputational

SEC Certification Examination Phase 1 General

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Corporate Structure & Capital Stock

1.1 Philippine Corporate Formation and Capital Structure 1.2 Common and Preferred Shares 1.3 Stockholder Rights and Corporate Actions 1.4 Corporate Debt and Fixed Income Instruments

2 Chapter 2: Financial Markets and Securities Products

2.1 Money Market and Capital Market Instruments 2.2 Collective Investment Schemes and Funds 2.3 Philippine Stock Exchange (PSE) Structure and Trading 2.4 Real Estate Investment Trusts (REITs) and Asset-Backed Securities

3 Chapter 3: Macroeconomic Principles and Monetary Policy

3.1 Gross Domestic Product, Inflation, and Business Cycles 3.2 Monetary Policy and the Bangko Sentral ng Pilipinas (BSP) 3.3 Fiscal Policy, National Debt, and Foreign Exchange 3.4 Philippine Financial Regulatory Architecture

4 Chapter 4: Financial Mathematics and Valuation Concepts

4.1 Time Value of Money and Interest Calculations 4.2 Bond Valuation and Yield Concepts 4.3 Equity Valuation Metrics and Financial Ratios 4.4 Investment Return, Risk Metrics, and Portfolio Principles

5 Chapter 5: The Securities Regulation Code (SRC) & Securities Registration

5.1 Legislative Framework and SEC Regulatory Powers 5.2 Definition and Scope of Securities 5.3 Mandatory Registration of Securities 5.4 Exempt Securities and Exempt Transactions

6 Chapter 6: Market Intermediaries & Trading Conduct

6.1 Registration of Brokers, Dealers, Associated Persons, and Salesmen 6.2 Duties and Ethical Standards of Market Professionals 6.3 Supervision and Compliance Organization 6.4 Books, Records, and Customer Account Handling

7 Chapter 7: Market Manipulation, Insider Trading & Public Disclosures

7.1 Prohibited Acts and Market Manipulation 7.2 Insider Trading and Unlawful Disclosures 7.3 Tender Offer Rules, Proxy Solicitation, and Periodic Reports

8 Chapter 8: Principles of Corporate Governance & Board Oversight

8.1 Evolution and Governance Framework in the Philippines 8.2 Board Composition, Roles, and Fiduciary Duties 8.3 Independent Directors and Term Limits 8.4 Board Committees and Special Responsibilities

9 Chapter 9: Internal Controls, Disclosure & Shareholder Rights

9.1 Internal Control System and Internal Audit Function 9.2 Related Party Transactions (RPT) Policy and Governance 9.3 Corporate Transparency and Timely Disclosure 9.4 Rights of Shareholders and Stakeholder Engagement

10 Chapter 10: Risk Concepts and Categories

10.1 Risk, Uncertainty, and Objectives 10.2 Financial Risks: Market, Credit, and Liquidity 10.3 Non-Financial Risks: Operational, Strategic, and Reputational

11 Chapter 11: Risk Management Process

11.1 Risk Management: Coordinated Direction and Control 11.2 Risk Identification 11.3 Risk Analysis and Evaluation

12 Chapter 12: Risk Treatment and Hedging

12.1 Risk Treatment, Mitigation, Monitoring, and Review 12.2 Hedging: Purpose and Exposure Identification 12.3 Hedging Strategies and Instruments 12.4 Integrated Risk Scenarios and Review

13 Chapter 13: AML Legal Framework & Institutional Governance

13.1 Anti-Money Laundering Act of 2001 (AMLA) and Amendments 13.2 Anti-Money Laundering Council (AMLC) Powers and Structure 13.3 Money Laundering Offenses and the Three Stages 13.4 Compliance Framework and Money Laundering Prevention Program (MLPP)

14 Chapter 14: Customer Due Diligence, Reporting & Record Keeping

14.1 Customer Due Diligence (CDD) and Know-Your-Customer (KYC) 14.2 Politically Exposed Persons (PEPs) and High-Risk Relationships 14.3 Covered and Suspicious Transaction Reporting 14.4 Record Keeping, Freezing of Assets, and Penalties

10.3 Non-Financial Risks: Operational, Strategic, and Reputational

Key Takeaways Explain This Topic AI

Operational risk arises from inadequate or failed processes, people, systems, or external events.

Strategic risk concerns flawed choices, failed implementation, or failure to adapt to the business environment.

Reputational risk is adverse stakeholder perception that can reduce clients, funding, market access, or regulatory confidence.

Legal, compliance, conduct, cyber, outsourcing, and business-continuity exposures commonly sit within or cut across operational risk.

A control must address the actual cause: training cannot repair weak system access, and insurance cannot restore all lost trust.

Last updated: October 2026

10.3 Non-Financial Risks: Operational, Strategic, and Reputational

Not every threat reaches a firm first through a price, interest rate, or default. Non-financial risk covers exposures generated by operations, decisions, behavior, law, technology, and stakeholder confidence. These events can still produce large financial losses, but the immediate source is not a market variable or obligor's credit quality.

Operational risk

Operational risk is the risk of loss or harm from inadequate or failed internal processes, people, systems, or external events. The categories are a diagnostic checklist:

People : error, inadequate training, misconduct, fraud, unauthorized trading, or insufficient staffing.

Process : poor design, missing approvals, inaccurate reconciliation, weak documentation, or a failed handoff.

Systems : hardware or software failure, faulty interfaces, cyber intrusion, data corruption, or inadequate access control.

External events : disaster, utility failure, vendor outage, civil disruption, or other events outside direct control.

Examples in a securities firm include a wrong order entry, failure to segregate customer assets, an unreconciled break, a cyberattack, or an outage at an outsourced service provider. Controls include segregation of duties, maker-checker approval, access management, reconciliations, exception reports, change control, staff competency, incident response, vendor oversight, backups, and tested continuity plans.

Strategic risk

Strategic risk arises from adverse or poorly informed business decisions, ineffective implementation, or failure to respond to changes in the environment. Launching a product without understanding demand, concentrating on a declining client segment, acquiring incompatible technology, or ignoring a regulatory change can impair objectives even if day-to-day processing is flawless.

Strategic risk is managed through disciplined planning, reliable information, scenario analysis, clear ownership, budget and capability review, performance indicators, challenge by the board, and periodic reassessment. It cannot be eliminated because every strategy involves choices under uncertainty. The aim is to take informed risk consistent with capacity, law, and stakeholder obligations.

Reputational risk

Reputational risk is the possibility that adverse perceptions among clients, investors, employees, regulators, counterparties, or the public will impair objectives. Consequences can include withdrawals, lost mandates, higher funding cost, reduced market access, staff attrition, closer supervision, and weakened franchise value.

Reputation is often a secondary consequence . A cyber breach is operational; failure to disclose it honestly can trigger conduct and compliance concerns; public reaction creates reputational damage; client departures then cause financial loss. Calling the whole sequence “reputation risk” can hide the controllable root cause. Management should identify the triggering event and then plan communication and remediation.

Legal, compliance, and conduct risk

Legal risk concerns unenforceable contracts, litigation, or adverse legal outcomes. Compliance risk concerns violation of laws, rules, regulatory conditions, or internal policies designed to implement them. Conduct risk concerns behavior that produces unfair outcomes, market abuse, conflicts, unsuitable selling, misuse of information, or other harm.

These categories overlap operational and reputational risk but deserve explicit attention. A trade may be operationally processed exactly as instructed yet still be unlawful insider trading. A sales script may be consistently followed yet mislead clients. Process consistency does not prove legal or ethical correctness.

Emerging and cross-cutting exposures

Cyber risk combines people, process, system, and external threat. Outsourcing transfers performance of an activity, not accountability for the regulated obligation. Model risk arises when a model is conceptually wrong, fed poor data, misused, or applied outside its limits. Business-continuity risk concerns the ability to sustain critical operations through disruption and recover within defined objectives.

Root cause and control matching

Failure Weak response Better-targeted control

Excessive user privileges General ethics seminar only Least privilege, access approval, logging, and periodic review

Repeated settlement error Insurance alone Process redesign, validation, reconciliation, and escalation

Misleading product claims Faster sales targets Product governance, review, suitability, supervision, and consequence management

Critical vendor outage Contract disclaimer only Due diligence, service levels, resilience testing, alternatives, and exit plan

Exam method

Identify the initial failure before its consequences. A system crash is operational even if it causes market loss. A bad expansion decision is strategic even if it later causes liquidity strain. Public distrust is reputational, but look for the operational, compliance, conduct, or strategic event that produced it. Then select a control that changes likelihood or consequence at the correct point in the chain.

Indicators and Escalation

Non-financial risk often appears first through operational evidence rather than a market price. Repeated settlement breaks, access-control exceptions, unresolved complaints, employee turnover in a control function, stale policies, or failed business-continuity tests can be leading indicators. Losses, sanctions, and adverse publicity are lagging indicators. A sound assessment records the event taxonomy, root cause, affected process, legal or contractual obligation, financial and customer impact, and responsible owner. Strategic and reputational consequences may emerge from an operational failure, but labeling every consequence “reputational risk” obscures the control failure that actually requires treatment.