IIBF Operational Risk Management key terms

The risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. Under Basel it includes legal risk but excludes strategic and reputational risk.

Losses from unenforceable contracts, lawsuits, adverse judgments, fines, or penalties. Basel's operational risk definition explicitly includes it, unlike strategic and reputational risk.

The portion of operational loss beyond the expected average, estimated from the tail of the loss distribution. It is the main reason banks hold operational risk capital.

The average loss a bank anticipates from a given risk over a period, typically priced into products and covered by provisions rather than capital.

The regulatory or economic buffer held against unexpected operational losses, computed under approaches such as BIA, SA, or AMA under Basel II/III.

The simplest Basel capital method: operational risk capital equals a fixed percentage (historically 15%) of average annual gross income over three years.

A Basel method dividing activities into business lines, each with a beta factor applied to gross income, summing to the capital charge. Under Basel III revisions, internal loss experience adjusts the calculation.

The process of allocating a bank's activities and gross income to regulatory categories such as corporate finance, trading, retail banking, and payment services for capital calculation.

Net interest income plus net non-interest income, used as the exposure indicator in Basel operational risk capital formulas. It is defined to exclude realised gains from banking-book sales and extraordinary items.

A governance model: business units own and manage risk first; risk and compliance functions oversee independently; internal audit provides assurance to the board.

The amount and type of risk a bank is willing to accept in pursuit of its objectives, expressed through qualitative statements and quantitative limits and tolerances.

The maximum deviation from risk appetite a bank will accept for a specific risk category, often expressed as a limit or threshold that triggers escalation.

A structured exercise in which business units identify processes, inherent risks, and controls, then rate residual risk and flag gaps requiring action.

The level of risk present in an activity before any controls are applied. It helps assess whether controls are proportionate to the exposure.

The risk remaining after existing controls are taken into account. It is compared against risk appetite to decide whether further mitigation is needed.

A forward-looking metric that signals rising or falling risk exposure, such as staff attrition, failed logins, or reconciliation breaks, with defined thresholds for escalation.

The systematic capture of internal and external operational loss events with amounts, causes, and business lines, feeding capital models, RCSA, and scenario analysis.

An incident that could have caused loss but did not, or caused only minor impact. Capturing near misses reveals control weaknesses before real losses occur.

A forward-looking technique where experts estimate the frequency and severity of plausible but rare loss events, complementing historical loss data in capital and risk assessment.

Evaluating how portfolios, processes, or capital hold up under severe but plausible scenarios, including operational disruptions, fraud surges, or system outages.

An advanced measurement method modelling frequency and severity of losses separately, then combining them to estimate the aggregate loss distribution and required capital.

A control that stops an error or fraud before it occurs, such as segregation of duties, maker-checker authorisation, access restriction, or dual custody.

A control that identifies problems after they occur, such as reconciliations, exception reports, surveillance alerts, or periodic audits, enabling correction and escalation.

A control requiring one person to initiate a transaction and a different authorised person to approve it, reducing error and single-person fraud.

Splitting incompatible tasks, such as initiating, approving, recording, and reconciling a transaction, among different staff so no one person controls the full process.

Requiring two authorised persons to jointly access or control an asset, such as cash, keys, or cryptographic material, so neither can act alone.

Periodic examination of whether a control is designed properly and operating effectively, through sample checks, walkthroughs, or re-performance, with results reported to management.

Comparing two independent records, such as bank statements and ledger balances, to identify and resolve differences. It is a core detective control in operations.

The risk of loss from intentional deception by internal staff, customers, or third parties, including misappropriation, forgery, cyber fraud, and loan or card fraud.

A proactive supervisory and internal stance that anticipates fraud and misconduct through monitoring, staff rotation, surprise checks, and early warning signals rather than reacting after loss.

A warning signal suggesting possible fraud or control weakness, such as unusual transaction patterns, lifestyle inconsistent with income, or reluctance to take leave.

Mandatory periodic movement of staff between roles so that concealment of irregularities by one person becomes harder and handover reveals discrepancies.

A protected channel through which employees or others report suspected fraud, misconduct, or unethical behaviour to an independent function without fear of retaliation.

The risk of loss from attacks or failures affecting confidentiality, integrity, or availability of information systems, including hacking, malware, ransomware, and data breaches.

A social-engineering attack using deceptive emails, messages, or sites to trick users into revealing credentials or executing malicious actions.

Malicious software that encrypts or locks data and demands payment for restoration, often accompanied by data theft and extortion threats.

Access control requiring two or more independent verification factors, such as a password plus a one-time code or biometric, reducing credential-theft risk.

Documented procedures and resources enabling critical operations to continue or resume within defined timeframes after a disruption.

A study identifying critical processes, their dependencies, and the financial and regulatory consequences of disruption over time, used to set recovery priorities and objectives.

The maximum acceptable time to restore a process or system after disruption. It drives backup, staffing, and site decisions in continuity planning.

The maximum acceptable amount of data loss, measured in time, that a process can tolerate. It determines backup frequency and replication design.

The risk that a third party fails to deliver services to agreed standards, or that dependency, data, or concentration issues arise from delegating activities.

Exposure to loss from over-reliance on a single counterparty, vendor, system, or geography, where one failure disrupts many activities at once.

Risk arising from subcontractors and suppliers used by a bank's direct vendors, which the bank does not contract with but on which its services ultimately depend.

A contract clause defining measurable service standards, responsibilities, reporting, and remedies between a bank and its vendor or internal provider.

Loss or harm from human behaviour and workforce conditions, including error, insufficient skills, key-person dependency, misconduct, and inadequate staffing.

Dependency on a small number of individuals whose departure or unavailability would disrupt a critical process, mitigated by succession planning and documentation.

The risk that staff behaviour or business practices harm customers, markets, or the bank's reputation, leading to mis-selling, unfair treatment, redress, and penalties.

The risk of legal or regulatory sanctions, financial loss, or reputational damage from failure to comply with laws, regulations, and internal standards.

The process of logging, classifying, escalating, and resolving operational, fraud, or cyber incidents, then analysing root causes to prevent recurrence.

A structured investigation to identify the underlying process, control, or behavioural failures that produced an incident, rather than just its immediate symptom.

An independent function reporting to the board or audit committee that provides assurance on the effectiveness of risk management, controls, and governance.