HKIB ECF-Operational Risk Core key terms

The risk of loss from inadequate or failed internal processes, people, systems, or from external events. It excludes strategic and reputational risk but includes legal risk.

The internationally adopted wording that treats operational risk as losses from process, people, system and external-event failures, explicitly including legal risk while excluding strategic and reputational risk.

Loss arising from contracts that cannot be enforced, lawsuits, regulatory penalties, or adverse court rulings. Under the Basel definition it sits inside operational risk rather than beside it.

The exposure to fines, sanctions, or loss of licence from failing to follow laws, regulations, or internal conduct standards. Many banks treat it as a sub-category of operational risk.

A structured hierarchy of loss types, such as internal fraud, external fraud, employment practices, client mishandling, physical damage, system failure, and execution errors, used to classify incidents consistently.

A workshop-based process in which business owners identify their risks, rate likelihood and impact, and judge whether existing controls reduce exposure to an acceptable level.

A quantitative measure, such as failed trades, system downtime, or staff turnover, tracked against thresholds to give early warning that an operational risk is rising.

The systematic capture of internal loss events and near misses with amounts, causes, and business lines, used to calibrate models, size capital, and identify control gaps.

Loss information drawn from other institutions, public reports, or pooled industry consortia, helping a bank learn from events it has not itself suffered.

An incident that could have caused a loss but did not, either by luck or because a control caught it. Recording near misses reveals weaknesses before real damage occurs.

The level of risk left after existing controls are applied. It is compared with risk appetite to decide whether further mitigation is required.

The exposure that would exist if no controls were in place. Assessing it separately from residual risk shows how much protection the control framework actually provides.

The degree to which a designed control actually prevents, detects, or corrects the risk it targets in practice, tested through evidence rather than assumed from documentation.

A control that is essential to keeping a material risk within appetite, so that its failure would directly expose the bank to significant loss or regulatory criticism.

Planned checks, through sampling, re-performance, or observation, that confirm a control operates as described and produces reliable evidence over a defined period.

A governance structure where business units own and manage risk, a risk and compliance function oversees it, and internal audit provides independent assurance to the board.

The second-line team that sets operational risk policy, aggregates risk information, challenges business assessments, and reports the consolidated profile to senior management.

The senior executive accountable for the bank's enterprise-wide risk framework, including operational risk, with sufficient independence to challenge business lines.

A board sub-committee that approves risk appetite, reviews the top operational risks and material incidents, and oversees whether management is addressing weaknesses.

The amount and type of risk the board is willing to accept in pursuit of strategy, usually expressed through qualitative statements and quantitative tolerances for specific risks.

The concrete, measurable limit that translates a broader risk appetite statement into thresholds, such as a maximum number of failed settlements per month.

A living inventory of identified risks, each with an owner, cause, potential impact, existing controls, and current rating, used to track and prioritise treatment.

The named individual accountable for managing a specific risk and its controls, including monitoring indicators and escalating when exposure moves outside appetite.

A forward-looking exercise that imagines plausible severe events, estimates their likelihood and impact, and tests whether controls and capital would withstand them.

Applying extreme but plausible conditions to a portfolio or process to see how losses, liquidity, and controls behave beyond normal operating experience.

The amount of regulatory or economic capital set aside to absorb unexpected operational losses, calculated under approaches such as the standardised or basic indicator method.

Preparedness that lets critical operations keep running or recover quickly after disruption, covering alternate sites, systems, staff, and supplier arrangements.

A study identifying critical business functions, their dependencies, and the maximum tolerable downtime, which sets the recovery objectives for continuity planning.

The maximum acceptable time to restore a process or system after disruption. It drives investment in backup capability and is validated through testing.

The technical arrangements, such as backup data centres and failover systems, that restore IT services after a failure or outage.

Exposure arising when a third party performs activities for the bank, including service failure, data loss, concentration on one vendor, and weakened oversight.

The process of due diligence, contracting, monitoring, and exit planning applied to vendors and service providers so their failures do not damage the bank.

A contract clause defining measurable service standards, such as uptime or processing time, plus remedies when the provider misses them.

Exposure that builds up because too much activity, data, or dependency sits with one counterparty, system, or geography, so a single failure has outsized effect.

Loss caused by staff acting dishonestly, such as theft, unauthorised trading, or collusion with outsiders, often hidden by circumventing segregation of duties.

Loss caused by outsiders, including forgery, card skimming, cyber intrusion, and fraudulent loan applications, often exploiting weak authentication controls.

The chance of loss from attacks or failures affecting information systems, including data breaches, ransomware, and unauthorised access to customer accounts.

Exposure from technology failure, obsolescence, or change, covering outages, processing errors, inadequate capacity, and poorly managed system upgrades.

The danger that a new system, product, or process introduces errors, outages, or control gaps because testing, approval, or rollback planning was inadequate.

Splitting tasks so no single person can initiate, authorise, record, and reconcile a transaction, reducing both error and the opportunity for concealment.

Loss from failed transaction processing, documentation errors, missed deadlines, or data entry mistakes in day-to-day operations and settlement.

The chance that a transaction fails to settle as expected, leaving the bank exposed to counterparty default, funding gaps, or market moves before completion.