8.5 Aged Breaks — The Audit and Risk Flag
An aged break is a reconciliation difference that is still open past the firm’s time limit, commonly 5 or 10 business days. It is reported in aging buckets and escalated to more senior owners as it gets older. A break that cannot be recovered is written off under delegated authority and becomes a loss event. Basel classifies those into seven event types, and they can feed operational risk capital.
Why it matters: The older a break gets, the more it matters to auditors and regulators.
Summary: An aged break is a reconciliation difference still open past the firm’s threshold, commonly 5 or 10 business days; it is reported in aging buckets and escalated to more senior owners as it ages. A break that cannot be recovered is written off under delegated authority and becomes a loss event, which Basel’s seven event types classify and which can feed operational risk capital.
- Each root cause has a normal life span: a timing break older than its settlement cycle plus a day is misclassified.
- Aging buckets give every break an owner; $100,000 or more moves up a level, and client money breaks get no aging at all.
- Write-offs need exhausted investigation, documented recovery attempts and delegated, maker-checker approval.
- Basel’s standardized approach multiplies a size-based BIC by an internal loss multiplier: €1.77 billion of BIC becomes €1.59 or €2.08 billion depending on loss history.
- Kerviel’s 75 alerts, each explained away separately, preceded a €4.9 billion loss.
A break is any item that fails to match between two records (Part 8.2: The Six Reconciliation Types). Age is counted in business days from the day a break was raised, and an aged break is one still open past the firm’s threshold, commonly 5 or 10 days. Firms report open breaks in aging buckets, because unexplained breaks get harder to explain as statements roll over and claims go stale.
Each of the five root causes of Part 8.2: The Six Reconciliation Types has a normal life span: a timing difference clears within its settlement cycle (one business day for US securities on T+1), a data error when the reference data is fixed, a counterparty error when the claim is paid, a system problem when its incident ticket closes. A real discrepancy has none: it escalates the day it is recognized. A break that outlives its class is misclassified, so a “timing” break older than its cycle plus a day is not timing.
| Age (business days) | Owner | Required action |
|---|---|---|
| 0–2 | Preparer | Investigate; assign a root cause |
| 3–5 | Team lead | Chase or fix; no “timing” label survives |
| 6–10 | Head of operations | Aged-break KRI (Part 8.4: STP Rate, Tolerance, and Matching); claim or provision |
| 11–30 | Controller and operational risk | Risk committee; prepare recovery or write-off |
| Over 30 | CFO and risk committee | Decide write-off or recovery |
A write-off closes a break by accepting the difference as the firm’s own loss. Allow it only when the investigation is exhausted, recovery attempts are documented and someone with delegated authority approves it maker-checker. Every write-off becomes a loss event in the operational loss database; a break caught before money was lost is a near miss, logged too because it shows where a control almost failed.
Loss events are sorted into the Basel Committee’s seven event types: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management (“failed transaction processing or process management”), where most reconciliation write-offs land. A recovery reduces a loss only once received: “Receivables do not count as recoveries” (OPE25.25).
Basel III‘s standardized approach sets capital as a business indicator component (BIC), a size measure built from income, times an internal loss multiplier (ILM). The BIC applies 12% to the first €1 billion of the business indicator, 15% up to €30 billion and 18% above; the loss component is 15 times average annual losses of €20,000 or more over ten years; ILM = ln(e − 1 + (loss component ÷ BIC)0.8). For a business indicator of €12 billion, BIC = 1 × 12% + 11 × 15% = €1.77 billion. With €80 million of average losses, ILM = ln(e − 1 + (1.2 ÷ 1.77)0.8) = 0.897 and capital = 1.77 × 0.897 = €1.59 billion; with €200 million, ILM = 1.177 and capital = €2.08 billion. The EU (from January 2025) and UK (from January 2027) set the ILM to 1, and the US re-proposal of March 2026 drops it (Part 8.8).
If a break outlives its root cause’s normal life span, reclassify it and escalate one level. If a break of $100,000 or more is open 10 business days, report it to operational risk as a red KRI that day. Write off only within delegated authority after documented recovery attempts, recording the Basel event type. Never age client money or custody breaks. Calibrate thresholds to your volumes.
Closing alerts one at a time. Jérôme Kerviel’s unauthorized positions at Société Générale reached nearly €50 billion by January 2008, hidden behind several hundred fictitious trades he deleted and replaced before they were checked. His activity triggered 75 alerts, each closed with a plausible answer and none read together; unwinding the positions cost €4.9 billion (Société Générale). Link every break and alert to the trader or book behind it, and send the third unexplained item on one book to operational risk however small.
What is an aged break in reconciliation?
A difference still unresolved past the firm’s threshold, usually 5 or 10 business days after it was raised. Breaks are reported in aging buckets, each with a more senior owner, because evidence goes stale and counterparties stop accepting old claims.
When can a firm write off a reconciliation break?
Only after the investigation is exhausted, recovery attempts are documented and someone with delegated authority approves it under maker-checker. It is booked as a loss and logged as a loss event. Client money and custody shortfalls are funded, never written off.
What are the seven Basel operational risk event types?
Internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management. Most reconciliation losses fall in the last; unauthorized trading counts as internal fraud.
Aged breaks are reported in aging buckets with escalating owners, and each root cause has a normal life span that a break must not outlive. Write-offs require exhausted investigation, documented recovery attempts and delegated maker-checker approval, and each becomes a loss event classified by Basel’s seven event types, which can raise capital through the internal loss multiplier where supervisors use it.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. Under Basel’s standardized approach, what is the business indicator component (BIC) of a bank whose business indicator is €12 billion?
- €1.80 billion
- €1.77 billion
- €1.44 billion
- €2.16 billion
Reveal Answer
Answer: B. The marginal coefficients are 12% on the first €1 billion and 15% from €1 billion to €30 billion: 1 × 12% + 11 × 15% = €1.77 billion.
2. A break on a US security settling T+1 is labeled “timing” and has been open for six business days. What should happen?
- Move it to suspense until the counterparty sends its monthly statement
- Leave it in the queue, since timing breaks need no action until they clear
- Reclassify and escalate it; timing breaks clear within the cycle
- Write it off under the preparer’s authority once it passes five days
Reveal Answer
Answer: C. A timing difference should clear within its settlement cycle plus a day; a break that outlives its root cause’s life span is misclassified and must be escalated.
3. Into which Basel Level 1 event type do most reconciliation write-offs fall?
- Execution, delivery and process management
- Employment practices and workplace safety
- Clients, products and business practices
- Business disruption and system failures
Reveal Answer
Answer: A. Basel defines execution, delivery and process management as losses from failed transaction processing or process management, which is where most reconciliation losses arise.
4. A firm sent a $142,000 payment twice and has requested a recall that has not yet arrived. How is it recorded in the operational loss data?
- As a near miss, because a recall has been requested
- Not at all, until the recall either succeeds or fails
- As a zero loss, net of the recovery expected later
- As a $142,000 loss until the money comes back
Reveal Answer
Answer: D. Basel’s loss-data rules count recoveries only once payment is received; receivables do not count as recoveries.
5. Worked problem: Open breaks total $2.4m and 91.1% of the value is older than five days. What value is aged?
Reveal Answer
Answer: 0.911 × $2.4m = $2.186m.
6. Worked problem: Breaks of $100,000 or more move up a level. A break of $85,000 and one of $120,000 are both aged. Which escalates?
Reveal Answer
Answer: Only the $120,000 break moves up a level.
8.6 Operational Resilience — Beyond BCP/DR
Operational resilience asks a different question from old disaster planning. It doesn’t just ask whether systems can be restored. It asks whether the services clients depend on keep running through a disruption. In the UK, the PRA (SS1/21) and the FCA (PS21/3) required firms to be able to stay within impact tolerances by March 31, 2025. The EU’s DORA has applied since January 17, 2025.
Why it matters: The test is whether customers keep being served, not whether the servers come back.
Summary: Operational resilience asks whether the services clients depend on keep running through a disruption, not just whether systems can be restored. The UK regime, led by the PRA (SS1/21) with the FCA (PS21/3), required firms to be able to stay within impact tolerances by March 31, 2025; the EU’s DORA has applied since January 17, 2025.
- BCP and DR start from assets and recovery times; operational resilience starts from client harm.
- Since the March 2025 deadline, UK firms must evidence a current self-assessment: services, tolerances, mapping, tests, lessons and dated fixes.
- DORA requires an initial major-incident notice within 4 hours of classification and no later than 24 hours after detection.
- The UK designated four cloud providers as critical third parties in July 2026; the EU designated 19 critical ICT providers in November 2025.
- Designating a provider never moves responsibility away from the firm.
Business continuity planning (BCP) keeps a firm operating through a disruption; disaster recovery (DR) restores systems and data within a recovery time objective (RTO) per system. Both start from assets. Operational resilience starts from the client: the ability to prevent, adapt to, respond to, recover from and learn from disruption so the services that matter keep running.
The UK wrote the template, with the prudential regulator in the lead: on March 29, 2021, the Bank of England, the Prudential Regulation Authority (PRA) and the FCA published coordinated rules, the PRA’s Supervisory Statement SS1/21 (with PS6/21) and the FCA’s PS21/3. Firms had until March 31, 2022, to identify important business services and set impact tolerances (Part 8.7: Important Business Services and Impact Tolerances), and until March 31, 2025, to finish mapping and testing and be able to remain within those tolerances. That deadline has passed, so supervisors now ask for evidence: a written self-assessment (SYSC 15A.6.1R), kept for six years, justifying each service and tolerance and recording the mapping, the scenario tests, lessons learned and every vulnerability with its dated fix.
| Element | UK | EU | US |
|---|---|---|---|
| Instrument | PRA SS1/21; FCA PS21/3 | Digital Operational Resilience Act (DORA) | Interagency “Sound Practices” (2020), guidance for banks above $250 billion |
| Incident clock | Tell the regulator what it would expect notice of (Principle 11) | Major ICT incident: 4 hours after classification, at most 24 after detection | Banks: 36 hours; listed companies: Form 8-K four business days after judging an incident material |
| Provider oversight | Four critical third parties designated July 2026 | 19 critical ICT providers designated November 2025 | None direct |
HM Treasury designated the first UK critical third party (CTP) firms on July 10, 2026: Amazon Web Services EMEA, Google Cloud EMEA, Microsoft Ireland Operations and Oracle Corporation UK. Neither the UK nor the EU regime moves responsibility: the firm still owns its services and must test them with its providers (SYSC 15A.5.5G).
If the only evidence that a service stays within tolerance is a provider’s assurance or a desk-top exercise, treat the tolerance as unproven: run a simulated or live test that includes the provider, and log the gap as a vulnerability with a dated fix. Measure to the last client served.
Treating disaster recovery as resilience. A payments system restored in 6 hours looks safe against a 24-hour tolerance, but the backlog takes another 24 hours to clear, so clients wait 30 hours and the tolerance is breached while every system shows “recovered” (Part 8.7: Important Business Services and Impact Tolerances). Measure disruption from the client’s side until the backlog is cleared and reconciled.
Is UK operational resilience regulated by the PRA or the FCA?
Both, under coordinated rules of March 29, 2021: the PRA’s SS1/21 for banks, building societies and insurers, and the FCA’s PS21/3 for those firms and others such as payment firms. Each regulator supervises its own rules, so a dual-regulated bank meets both.
What is DORA?
The EU’s Digital Operational Resilience Act, applying since January 17, 2025, to banks, insurers, investment firms and other financial entities. It covers ICT risk management, incident reporting, resilience testing, third-party risk and information sharing, and oversees critical ICT providers directly.
What did UK firms have to achieve by March 31, 2025?
Complete mapping and scenario testing of their important business services and be able to stay within each impact tolerance in a severe but plausible disruption. Since then they must keep the written self-assessment current, review it at least yearly and fix each vulnerability found.
Operational resilience measures disruption from the client’s side rather than by system recovery. The UK regime (PRA SS1/21 and FCA PS21/3) required firms to be able to stay within impact tolerances by March 31, 2025, DORA has applied in the EU since January 17, 2025, and critical third-party providers are now overseen directly without moving responsibility from the firm.
Six questions on this chapter. Decide on your answer first, then click “Reveal Answer.”
1. Who issued the UK’s operational resilience rules in March 2021?
- The FCA alone, in PS21/3, later adopted by the PRA
- HM Treasury, under the Financial Services and Markets Act 2023
- The PRA alone, with the FCA covering only payment firms
- The Bank of England, PRA and FCA jointly (SS1/21, PS21/3)
Reveal Answer
Answer: D. The rules were published as a coordinated package on March 29, 2021: the PRA’s SS1/21 (with PS6/21) and the FCA’s PS21/3.
2. What did UK firms have to achieve by March 31, 2025?
- Have their cloud providers designated as critical third parties
- Obtain board approval of a disaster recovery plan for each system
- Finish mapping and testing and be able to stay in tolerance
- Identify their important business services for the first time
Reveal Answer
Answer: C. Services and tolerances were due by March 31, 2022; by March 31, 2025, firms had to be able to remain within tolerance in a severe but plausible disruption.
3. Under DORA, a firm detects an ICT incident at 9:00 and classifies it as major at 15:00 the same day. What is the latest time for the initial notification?
- 19:00 the same day
- 13:00 the same day
- 9:00 the next day
- 15:00 the next day
Reveal Answer
Answer: A. The initial notice is due within 4 hours of classification (15:00 + 4 = 19:00) and no later than 24 hours after detection (9:00 next day); the earlier deadline applies.
4. A UK bank runs an important business service on a cloud provider designated as a critical third party in July 2026. What changes for the bank?
- The bank may drop the service from its scenario test plan
- No change in duty: it still owns and must test the service
- The regulators now supervise the service on the bank’s behalf
- The bank keeps responsibility only for data, not outages
Reveal Answer
Answer: B. The CTP regime adds direct oversight of the provider but does not move responsibility; SYSC 15A.5.5G expects firms to test with their third parties.
5. Worked problem: A service has a 4-hour impact tolerance. Arrivals are 3,000 an hour, capacity 3,500, and the outage lasts 1 hour. What is the total disruption?
Reveal Answer
Answer: Backlog = 3,000. Clearing rate = 500 an hour, so 6 hours. Total = 1 + 6 = 7 hours, above 4: tolerance breached.
6. Worked problem: What maximum outage would keep it within a 4-hour tolerance?
Reveal Answer
Answer: Total = outage × (1 + 3,000 ÷ 500) = 7 × outage ≤ 4, so at most 34 minutes.
- Basel Framework OPE25: Standardised approach — BIC coefficients, loss component, ILM, €20,000 threshold, recoveries rule, event-type Table 2
- Federal Reserve: Agencies request comment on capital proposals (March 19, 2026) — US Basel III re-proposal, comments due June 18, 2026
- FCA Handbook SYSC 15A.2, 15A.5 and 15A.6 — Remain within tolerance (15A.2.9R), scenario testing (15A.5.4R), third parties (15A.5.5G), self-assessment and six-year retention (15A.6)
- SEC cybersecurity disclosure rules (July 26, 2023) — Form 8-K Item 1.05 four business days
- EIOPA: Digital Operational Resilience Act (DORA) — Application from January 17, 2025; pillars
- Federal Reserve, FDIC, OCC: Sound Practices to Strengthen Operational Resilience (Oct 30, 2020) — US guidance, scope, no new rules
- FCA PS21/3: Building operational resilience (March 2021) — Coordinated UK rules; March 31, 2022, and March 31, 2025, deadlines; scope
- ESAs designate critical ICT third-party providers (Nov 18, 2025) — CTPP designation date; 19 providers per Morgan Lewis summary