Operational risk events, loss data and incident management
Loss data and incident management is where operational risk becomes evidence-based. The exam tests what to capture, how to classify and net losses, and how incidents are escalated and closed.
Collecting loss data
Set a threshold (commonly £5,000–£25,000 depending on the firm) and capture every event above it. Minimum fields: unique reference, discovery and occurrence dates, business line, Basel event type, cause, description, gross loss, recoveries, insurance recovery, net loss, and linked risk and control. Capture near misses too - they are free lessons and feed scenario analysis.
Classifying
Use the seven Basel event types mapped to the eight business lines. Misclassification distorts capital, KRIs and board reporting. Legal costs and regulatory fines arising from an event belong to that event, not to a separate "legal" bucket.
Incident management lifecycle
Detect → log → classify → assess severity → escalate → contain → remediate → root cause analysis → close → lessons learned. Good practice separates the incident from the loss: an incident may produce no loss, and a loss may be discovered long after the incident closes.
Worked example
A failed batch payment causes a £500,000 loss. The firm recovers £50,000 from a third party and receives £300,000 from its insurance policy. Gross loss is £500,000; net loss is £150,000. Reasoning: report both. Reporting only £150,000 hides the scale of the event, distorts external loss databases and understates the Internal Loss Multiplier under the Standardised Approach. Also record the recovery lag, because insurance proceeds may arrive in a later financial year.
Reporting and escalation
Severity matrices drive escalation: major incidents reach the CRO and board within hours. Regulatory notification applies where rules require it, such as the operational resilience requirements and, in the EU, DORA major ICT incident reporting.
Traps that cost marks
- Recording only the net loss.
- Treating a near miss or a no-loss incident as out of scope.
- Using the event type as the cause - "process error" is a category, not a root cause.
- Writing root causes that name an individual rather than a control failure.