Unit
- Operational risk defined: The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. This definition, established by the Basel Committee, excludes strategic and reputational risk but includes legal risk.
- Key characteristics: Operational risk is inherent in all business activities and cannot be fully eliminated. It differs from market and credit risk as it is not taken for profit but must be managed to minimize losses.
- Types of operational risk events: Internal fraud, external fraud, employment practices, clients/products/business practices, damage to physical assets, business disruption/system failures, and execution/delivery/process management. These seven categories form the standard taxonomy.
- Why it matters: Operational risk losses have historically exceeded market risk losses in many firms. High-profile failures like rogue trading and data breaches highlight the need for dedicated management.
- Regulatory origins: Basel II first mandated operational risk capital charges in 2004. Since then, regulations have expanded to include risk management frameworks, reporting, and stress testing under Basel III.
- Interaction with other risks: Operational risk events can trigger credit defaults or market losses. For example, a system outage may prevent trade settlement, creating counterparty risk.
- Common misconceptions: Operational risk is not just back-office risk. It affects front-office functions, IT, legal, compliance, and even executive decision-making.
- Organizational impact: Effective operational risk management improves operational efficiency, reduces regulatory capital charges, and protects brand reputation. It is now a board-level concern.
- Operational risk appetite: Firms define their tolerance for operational risk exposure through a formal risk appetite statement. This statement sets limits for acceptable losses, aligns with strategic objectives, and is reviewed by the board. It guides resource allocation for controls, insurance, and mitigation efforts across all business lines.
- Risk control self-assessment: RCSA is a structured process where business units identify and evaluate operational risks and controls. It assigns inherent risk ratings, control effectiveness scores, and residual risk levels. Regular RCSA cycles help organizations proactively address weaknesses before losses materialize and support capital allocation decisions.
- Key risk indicators: KRIs are quantitative metrics that monitor operational risk exposure in real time. Examples include transaction error rates, system downtime, staff turnover, and near-miss incidents. Thresholds trigger management action when exceeded, enabling early warning and trend analysis to prevent escalation into significant losses.
- Loss data collection: Internal loss data is systematically captured through a centralized database. Each event is recorded with details such as date, amount, business line, event type, and root cause. This data feeds quantitative models for capital calculation, supports scenario analysis, and enables benchmarking against industry loss data sets.
Regulatory Requirement
Regulation: Basel Committee on Banking Supervision
The Basel framework requires banks to hold regulatory capital for operational risk under the Standardized Approach or Advanced Measurement Approaches. Institutions must also implement a risk management framework with board oversight, independent risk function, and regular stress testing.
Quick Revision
- Operational risk arises from people, processes, systems, or external events.
- It is managed, not eliminated, and requires a dedicated framework.
- Seven event types categorize operational risk losses.
- Regulatory capital is mandatory under Basel standards.