Operational risk has become one of the most important areas in risk management, with events like cyberattacks, rogue trading, and pandemic disruptions highlighting its significance.

Basel Definition

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events. This includes legal risk but excludes strategic and reputational risk.

The Seven Loss Event Types

  1. Internal Fraud: Unauthorized trading, theft, intentional misreporting
  2. External Fraud: Cybercrime, robbery, forgery
  3. Employment Practices: Discrimination claims, workplace safety violations
  4. Clients, Products & Business Practices: Mis-selling, money laundering, market manipulation
  5. Damage to Physical Assets: Natural disasters, terrorism, vandalism
  6. Business Disruption & System Failures: IT outages, software failures, utility disruptions
  7. Execution, Delivery & Process Management: Data entry errors, failed settlements

Risk Assessment Tools

  • RCSA (Risk and Control Self-Assessment): Business units assess their own risks
  • KRIs (Key Risk Indicators): Forward-looking metrics providing early warnings
  • Scenario Analysis: Expert-driven assessment of extreme but plausible events
  • Loss Data Collection: Systematic recording of operational losses

Capital Approaches

Under Basel III.1, the new Standardized Approach replaces all previous approaches:

  • Business Indicator Component (BIC) — based on size and complexity
  • Internal Loss Multiplier (ILM) — based on historical losses
  • Replaces BIA, TSA, and AMA

Emerging Operational Risks

Cyber Risk

The top operational risk concern for financial institutions:

  • Data breaches, ransomware, DDoS attacks
  • Sophisticated threat actors (state-sponsored, criminal)
  • Interconnected systems amplifying impact

Operational Resilience

Moving beyond traditional BCP/DR:

  • Focus on critical business services
  • Set impact tolerances
  • Test ability to operate through disruption

Third-Party Risk

Outsourcing doesn't transfer risk:

  • Due diligence, monitoring, exit planning
  • Cloud concentration risk
  • Fourth-party risks (vendors of vendors)

Practice operational risk questions to prepare for this high-weight FRM topic!