Operational Risk Management
Definition and boundary
Basel defines operational risk as the risk of loss from inadequate or failed internal processes, people and systems, or external events. Legal risk is included; strategic and reputational risk are excluded. HKMA SPM OR-1 adopts this definition and requires a bank-wide ORM framework approved by the board. Conduct risk is usually managed within the ORM framework because many conduct failures are process or people failures. Classify losses using the seven Basel event types: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management. Classification drives root-cause analysis and capital, so do not label every loss "process error".
Governance and three lines
- The board sets risk appetite and approves the framework.
- Senior management implements it.
- First-line business units own and manage risk.
- The second-line OR function designs the framework, challenges, aggregates and reports.
- Third-line internal audit gives independent assurance.
A common exam trap is placing risk ownership in the second line: the OR function does not own business risk.
ORM cycle and tools
Identify, assess, monitor, control or mitigate, and report. RCSA maps processes to risks and controls; KRIs are forward-looking thresholds with escalation actions; internal and external loss data show actual experience; scenario analysis addresses tail events; BEICF adds qualitative judgement. Capture near misses and root causes. Insurance and outsourcing can mitigate but do not transfer accountability.
Capital
Legacy Basel approaches are Basic Indicator, Standardised and Advanced Measurement. The current Basel standardised approach uses a Business Indicator and business-indicator component; HKMA applies it through the Banking (Capital) Rules. Insurance recognition is limited.
Worked example
A bank estimates a three-day online banking outage occurs once in 10 years (annual frequency 0.10) with severity HK$80m. Expected annual scenario loss = 0.10 × HK$80m = HK$8m. Risk appetite for this scenario is HK$5m, so it breaches. If improved patch management cuts frequency to once in 20 years, expected loss = 0.05 × HK$80m = HK$4m, inside appetite. The HK$8m is not the capital add-on; capital addresses unexpected or tail loss.
Traps that cost marks
- Treating strategic or reputational risk as operational risk.
- Omitting legal risk.
- Ignoring near misses.
- Assuming insurance automatically reduces capital.
- Relying on loss data alone.
- Misclassifying credit-related operational losses as pure credit risk.