Introduction to operational risk
Operational risk is the domain examiners use to test whether you can define, classify and distinguish loss events from other risk types. Questions typically ask you to place a scenario in the right Basel category, identify the failed control, and explain why the loss is not credit or market risk.
The regulatory definition
Basel defines operational risk as "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events". Three points follow directly from that wording:
- Legal risk is included. Litigation, regulatory fines and contractual disputes sit inside operational risk.
- Strategic and reputational risk are excluded from the definition, although events often damage reputation as a secondary consequence.
- The definition is about loss, so unbudgeted remediation and compensation counts; the routine cost of running a control is a cost of doing business, not an operational loss.
Four root causes
People (error, fraud, key-person dependency), process (manual steps, handoffs, unclear ownership), systems (legacy, outage, cyber) and external events (disaster, supplier failure, regulatory change). Most real events have more than one.
Seven Basel event types
Internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failure; execution, delivery and process management. The last is usually the largest by count in industry loss data, which is why it is worth memorising precisely.
Worked example
A clerk transposes two digits in a payment instruction, so USD 3m goes to the wrong beneficiary and the firm pays USD 40,000 to recover it. Classification: execution, delivery and process management (keying error, no second check). Reasoning: the counterparty was not in default, so no credit risk arises; there was no exposure to price movement, so no market risk. Root causes are the manual keying step and a missing four-eyes check; the mitigation is automated validation of the BIC/IBAN. The recovery cost forms part of the loss.
Traps that cost marks
- Quoting the definition and omitting legal risk.
- Treating a near miss as "no event" - near misses feed scenario analysis and KRIs.
- Assuming low-frequency/high-severity events dominate; most firms see high-frequency/low-severity losses plus a thin tail.
- Treating mis-selling as a separate risk type - it is both operational and conduct risk.