New on FinoLib · Volume III: Finance Encyclopedia
New on FinoLib, my finance education website: I have published an article called Aged Breaks and Operational Resilience in Reconciliation, from Volume III: Finance Encyclopedia. Here is what the article explains, written as a short expert briefing; the full piece, with every worked example, is one click away.
8.5 Aged Breaks — The Audit and Risk Flag
The idea in plain words
An aged break is a reconciliation difference that is still open past the firm’s time limit, commonly 5 or 10 business days. It is reported in aging buckets and escalated to more senior owners as it gets older. A break that cannot be recovered is written off under delegated authority and becomes a loss event. Basel classifies those into seven event types, and they can feed operational risk capital.
Key points
■Each root cause has a normal life span: a timing break older than its settlement cycle plus a day is misclassified.
■Aging buckets give every break an owner; $100,000 or more moves up a level, and client money breaks get no aging at all.
■Write-offs need exhausted investigation, documented recovery attempts and delegated, maker-checker approval.
A closer look
A break is any item that fails to match between two records (Part 8.2: The Six Reconciliation Types). Age is counted in business days from the day a break was raised, and an aged break is one still open past the firm’s threshold, commonly 5 or 10 days. Firms report open breaks in aging buckets, because unexplained breaks get harder to explain as statements roll over and claims go stale.
Decision rule
If a break outlives its root cause’s normal life span, reclassify it and escalate one level. If a break of $100,000 or more is open 10 business days, report it to operational risk as a red KRI that day. Write off only within delegated authority after documented recovery attempts, recording the Basel event type. Never age client money or custody breaks. Calibrate thresholds to your volumes.
The costliest mistake
Closing alerts one at a time. Jérôme Kerviel’s unauthorized positions at Société Générale reached nearly €50 billion by January 2008, hidden behind several hundred fictitious trades he deleted and replaced before they were checked. His activity triggered 75 alerts, each closed with a plausible answer and none read together; unwinding the positions cost €4.9 billion (Société Générale). Link every break and alert to the trader or book behind it, and send the third unexplained item on one book to operational risk however small.
Recap
Aged breaks are reported in aging buckets with escalating owners, and each root cause has a normal life span that a break must not outlive. Write-offs require exhausted investigation, documented recovery attempts and delegated maker-checker approval, and each becomes a loss event classified by Basel’s seven event types, which can raise capital through the internal loss multiplier where supervisors use it.
8.6 Operational Resilience — Beyond BCP/DR
The idea in plain words
Operational resilience asks a different question from old disaster planning. It doesn’t just ask whether systems can be restored. It asks whether the services clients depend on keep running through a disruption. In the UK, the PRA (SS1/21) and the FCA (PS21/3) required firms to be able to stay within impact tolerances by March 31, 2025. The EU’s DORA has applied since January 17, 2025.
Key points
■BCP and DR start from assets and recovery times; operational resilience starts from client harm.
■Since the March 2025 deadline, UK firms must evidence a current self-assessment: services, tolerances, mapping, tests, lessons and dated fixes.
■DORA requires an initial major-incident notice within 4 hours of classification and no later than 24 hours after detection.
A closer look
Business continuity planning (BCP) keeps a firm operating through a disruption; disaster recovery (DR) restores systems and data within a recovery time objective (RTO) per system. Both start from assets. Operational resilience starts from the client: the ability to prevent, adapt to, respond to, recover from and learn from disruption so the services that matter keep running.
Decision rule
If the only evidence that a service stays within tolerance is a provider’s assurance or a desk-top exercise, treat the tolerance as unproven: run a simulated or live test that includes the provider, and log the gap as a vulnerability with a dated fix. Measure to the last client served.
The costliest mistake
Treating disaster recovery as resilience. A payments system restored in 6 hours looks safe against a 24-hour tolerance, but the backlog takes another 24 hours to clear, so clients wait 30 hours and the tolerance is breached while every system shows “recovered” (Part 8.7: Important Business Services and Impact Tolerances). Measure disruption from the client’s side until the backlog is cleared and reconciled.
What the full article covers
In the full article I take you through these sections:
■8.5 Aged Breaks — The Audit and Risk Flag
■8.6 Operational Resilience — Beyond BCP/DR
It includes a look under the hood at the mechanics, a clear decision rule, the one mistake that costs people the most, a recap, a reveal-on-click quiz and the official sources behind every figure.
Volume III: Finance Encyclopedia
Read the full article on FinoLib
The complete article, Aged Breaks and Operational Resilience in Reconciliation, with every worked example, diagram, quiz and source, is free to read in Volume III, Finance Encyclopedia on finolib.com.
Explore the Finance Education Series: Vol. II — Capital Markets · Vol. I — Global Economy · Vol. III — Finance Encyclopedia · Vol. IV — Finance Careers · Vol. V — Personal Finance