Operational and Technology Risk
Definition and scope
Operational risk is loss from inadequate or failed internal processes, people, systems, or from external events. It includes legal risk and, per Basel, excludes strategic and reputational risk. Cyber, fraud, third-party failure, processing error, model error and business interruption all sit inside it. Outsourcing transfers activity, never accountability.
Management toolkit
The classic four elements are RCSA (self-assessment of risks and controls), loss-event data (internal and external), KRIs with thresholds, and scenario analysis for tail events. These are supported by business continuity planning, third-party and concentration risk management, change management, access controls and model risk management. Basel's measurement approaches moved from the Basic Indicator Approach (15% of average gross income) and Standardised Approach to the Basel III Standardised Approach based on a business indicator.
Traps
- Classifying strategic or reputational losses as operational, or vice versa.
- Excluding near misses and "good catches" from the loss database.
- Assuming cloud or outsourcing arrangements remove the risk.
- Treating the risk register as the whole framework rather than one input.
- Assuming historical data captures low-frequency, high-severity events.
Rule of thumb: if a process produces a number used to make a decision, its failure is operational risk and the model needs validation; if the loss arises from a wrong strategic choice, it is strategic risk. For tail events, scenario analysis supplements data, because history rarely contains the event you most need to survive.