Inflated Inventory, Undisclosed Loan: Credit or Operational Loss?
A corporate relationship manager approved a HKD 30 million overdraft for a trading company. The borrower's owner supplied inventory statements that later proved inflated; the company defaulted and the bank lost HKD 18 million. Credit classified the whole amount as a credit loss. An internal investigation found the relationship manager had an undisclosed personal loan from the borrower's owner and had skipped the mandatory stock verification. The bank's operational risk loss data includes the event only if operational risk confirms the boundary. The credit risk team argues the loss is a credit loss because the borrower defaulted; the operational risk team argues it is operational because of the relationship manager's conduct. The bank uses the standardised approach for operational risk capital, and the annual loss data submission is due in four weeks. The relationship manager has resigned; the borrower's owner is untraceable.
1. How should the loss be classified at the credit/operational risk boundary, and what amount should be recorded as operational risk loss?
Read the worked answer
Start from the boundary principle: a loss caused by customer default is credit risk, but a loss caused by internal fraud, misconduct or a control override is operational risk. Here both are present. The borrower's inflated inventory is customer fraud; the relationship manager's undisclosed personal loan and skipped stock verification are internal conduct and control failures that materially affected the credit decision. The operational risk event should be recorded as internal fraud, with a conduct dimension, because the bank's own control failure changed the outcome.
Amount: avoid double counting. If proper verification would have shown the inventory was inflated and the overdraft would not have been granted, the operational loss is the full HKD 18 million. If the credit would still have been granted at a lower amount, record only the incremental loss, supported by a documented counterfactual. Credit and operational risk must agree the number and record it once. Record gross loss, with recoveries tracked separately.
2. What should the bank do about recoveries, insurance and the loss data submission?
Read the worked answer
Recoveries: pursue the borrower's owner and any collateral, but do not wait to record the loss. Record the gross HKD 18 million when discovered, then reduce it as recoveries are received. Insurance: check the fidelity guarantee or internal fraud policy; notify the insurer promptly and preserve evidence, since late notification can void cover. Do not net insurance proceeds against the loss data unless the bank's policy explicitly permits it; supervisory loss data normally wants gross loss and separate recovery.
Submission: include the event in the annual loss data with event type, date, amount, business line and a short description; reconcile with credit's records so the same amount is not submitted as both credit and operational loss. If the four-week deadline is tight, submit the known amount and flag the recovery estimate. Retain the root-cause analysis, counterfactual and insurer correspondence for supervisory review. The loss data should also feed the bank's scenario analysis and control remediation, not just the regulatory return.
3. What control and conduct lessons should be escalated?
Read the worked answer
Control lessons: mandatory stock verification must be independent and evidence-based, not a checkbox the relationship manager can skip; conflict-of-interest and outside-employment/loan declarations must capture personal loans from clients; delegated lending authority needs supervisory review and exception reporting; overrides should be logged and sampled. Conduct lessons: the undisclosed loan is both a fraud and a culture signal - staff may not recognise personal financial entanglement with clients as a reportable conflict.
The bank should refer the matter to law enforcement, consider regulatory notification, review other credits approved by the same relationship manager, and examine whether incentive pressures encouraged the shortcut. The issue should be tracked to closure with a control test, not just a training email. Operational risk should also check whether the same verification control is designed the same way in other lending units, because a single confirmed override often indicates a broader design weakness rather than one bad employee.