CISI Operational Risk key terms

The risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk under the Basel definition.

The internationally adopted wording that frames operational risk as losses from failed processes, people, systems or external events, expressly including legal risk while excluding strategic and reputational risk. It anchors capital rules and internal taxonomies.

The risk of loss from unenforceable contracts, lawsuits, adverse judgments, regulatory fines or private settlements. It sits inside the Basel operational risk definition rather than being treated as a separate risk type.

The risk that adverse stakeholder perception damages franchise value, customer flows or funding access. Basel excludes it from operational risk capital, though firms often monitor it alongside conduct and operational events.

The risk of loss from poor business decisions, flawed strategy execution or failure to adapt to market change. It is excluded from the Basel operational risk definition and usually governed separately from operational risk.

An integrated firm-wide approach to identifying, assessing, aggregating and managing all risk types against a common appetite, capital and governance framework. Operational risk sits within it rather than being managed in isolation.

A board-approved written declaration of the amount and type of risk the firm is willing to accept in pursuit of its objectives, expressed through qualitative principles and quantitative limits or tolerances.

The quantified expression of appetite: specific thresholds or ranges for a given risk metric that the firm will not exceed without escalation. Tolerances make an appetite statement operationally measurable and monitorable.

A governance structure in which business units own and manage risk, a independent risk and compliance function oversees it, and internal audit provides independent assurance to the board and its committees.

Independent, objective evaluation of whether risk management, controls and governance are designed and operating effectively. It reports to the audit committee and sits outside the first and second lines.

The amount of regulatory or economic capital held against unexpected operational losses. Under Basel it is calculated by standardised or advanced approaches and must cover loss experience and business mix.

The simplest Basel operational risk capital method: a fixed percentage of a single indicator, typically gross income averaged over three years, applied without regard to the firm's actual loss history.

A Basel capital method that splits the firm into business lines, applies a regulator-set beta factor to each line's gross income and sums the results, giving a more risk-sensitive charge than the basic indicator approach.

A Basel approach allowing firms to model their own operational risk capital from internal loss data, scenario analysis, business environment factors and controls, subject to supervisory approval and qualitative standards.

A modelling technique that estimates frequency and severity distributions from internal and external loss data, then combines them to derive an aggregate loss distribution and a chosen percentile as capital.

The average loss a process or portfolio is anticipated to generate over a period, typically covered through pricing or provisions rather than capital. Unexpected loss beyond that level is what capital addresses.

The portion of potential loss above the expected average that arises from volatility in frequency or severity. It is the primary focus of operational risk capital and stress testing.

A structured exercise in which business owners identify risks in their processes, rate likelihood and impact, and assess whether existing controls adequately mitigate them. Outputs feed the risk register and capital models.

A maintained log of identified risks, each with an owner, cause, consequence, inherent and residual ratings, linked controls and action plans. It is the central record supporting monitoring and reporting.

The level of risk that exists before any controls are applied, reflecting the nature and scale of the activity. Comparing it with residual risk shows how much protection controls actually provide.

The risk remaining after existing controls have been applied, taking account of their design and tested effectiveness. It is the figure compared against appetite and used in decision-making.

A forward-looking metric that signals rising or falling exposure in a process, such as failed trades, staff turnover or system downtime, with thresholds triggering escalation to management.

A structured workshop technique in which experts imagine plausible severe events, estimate their likelihood and impact, and use the results for capital, stress testing and control improvement.

Evaluating how a portfolio, process or firm performs under specified extreme but plausible conditions, including combined operational and market shocks, to test resilience and capital adequacy.

An actual incident that causes or could have caused loss through failed processes, people, systems or external events, such as fraud, processing error, system outage or regulatory breach.

An incident that did not cause loss or harm but could have done so under slightly different circumstances. Recording near misses reveals control weaknesses before real losses occur.

Structured records of operational risk events capturing date, business line, event type, gross loss, recoveries and root cause. Internal loss data drives modelling, reporting and control prioritisation.

Loss information from other firms, consortia or public sources used to supplement sparse internal experience, calibrate severity tails and test whether similar exposures exist internally.

A disciplined investigation to identify the underlying process, behavioural or system failure that produced an event, rather than stopping at the immediate trigger, so that remediation prevents recurrence.

The structured set of preventive, detective and corrective controls, with owners, documentation and testing, designed to keep risk within appetite across processes and systems.

A control designed to stop an error, fraud or failure occurring in the first place, such as segregation of duties, system access restrictions, mandatory approvals or automated validation checks.

A control that identifies problems after they occur, such as reconciliation, exception reporting, surveillance or independent review, enabling timely correction and loss limitation.

Planned examination of whether a control is designed appropriately and operates consistently, using samples, reperformance or observation, with results rated and reported to risk committees.

A documented, owned and dated set of steps to fix a control weakness or risk breach, tracked to completion and validated, with escalation if deadlines slip.

Action taken to reduce the likelihood or impact of a risk, through improved controls, process redesign, limits, diversification or partial transfer, rather than simply accepting the exposure.

Shifting some or all of a risk's financial consequences to another party, typically through insurance, outsourcing or contractual indemnities, while the underlying activity and reputational exposure usually remain.

A contract in which an insurer covers specified operational losses, such as fraud, cyber or professional liability, in exchange for premiums. Cover limits, exclusions and claims timing must be assessed.

Documented arrangements for maintaining or restoring critical operations within agreed recovery objectives after a disruption, covering people, premises, technology, data and communications.

The maximum acceptable period for restoring a process or system after disruption, set from the harm caused by outage. It drives continuity design and testing priorities.

The ability of a firm to prevent, adapt to, respond to and recover from operational disruptions, and to learn from them, so that critical services to customers and markets continue.

The governance, decision-making and communication arrangements activated for severe disruptions, including escalation to a crisis team, stakeholder messaging and coordination with regulators.

The risk that firm behaviour, whether deliberate or careless, delivers unfair customer outcomes or damages market integrity, leading to redress, fines and reputational harm.

A regulatory principle requiring firms to deliver outcomes consistent with fair treatment across product design, sales, servicing and complaints, with evidence of monitoring and remediation.

A customer whose circumstances, such as health, capability, bereavement or financial distress, make them especially susceptible to harm, requiring additional care and adjusted processes.

The exposure created when a third party performs a process for the firm, including service failure, data loss, concentration, loss of control and contractual or exit difficulties.

The lifecycle process of due diligence, contracting, ongoing monitoring and exit planning for suppliers and partners whose failure could harm the firm's operations or customers.

An outsourcing arrangement whose failure would materially impair the firm's ability to meet obligations or provide critical services, triggering enhanced regulatory notification, oversight and exit planning.