Operational Risk and Resilience
Definition and taxonomy
Operational risk is loss from inadequate or failed internal processes, people, systems, or external events. It excludes strategic and reputational risk but includes legal risk. Basel's seven event types are internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management. Classifying an event correctly is a recurring exam task - mis-selling is clients/products, a rogue trader is internal fraud, a failed settlement is execution/delivery.
Measurement
Under the loss distribution approach, frequency (often Poisson) is convoluted with severity (often lognormal) to produce an aggregate loss distribution; operational VaR is a high quantile (e.g., 99.9%). Expected loss is a cost of doing business, not capital; capital covers unexpected loss. Dependence across units is modeled with copulas, and scenario analysis fills the tail where internal data are thin. The Basel standardised measurement approach combines a business indicator component with an internal loss multiplier.
Governance and resilience
Know the three lines of defence, RCSA, key risk indicators, risk appetite statements, and the resilience framework: identify important business services, set impact tolerances, and test severe-but-plausible scenarios. Third-party and outsourcing risk, cyber risk, and model risk sit inside this perimeter.
Traps
Insurance mitigates but rarely eliminates capital. Boundary disputes with credit and market risk are common. Severity distributions are heavy-tailed, so doubling the frequency parameter doubles expected loss but raises VaR by less than double.
Worked example
Poisson frequency lambda = 3 per year with mean severity $1m gives EL = $3m. An operational VaR at 99.9% will exceed $3m by the unexpected-loss cushion, and it scales roughly with the severity tail, not linearly with lambda.