Operational risk: definition, scope and regulatory context
Operational risk: definition, scope and regulatory context
This domain tests the Basel definition of operational risk, exactly what it includes and excludes, the Indian regulatory expectations built on it, and the capital framework banks apply.
The definition and its boundaries
Basel II (2004) defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. The definition expressly includes legal risk and expressly excludes strategic and reputational risk. Regulatory guidance, aligned with the Basel Committee's Principles for the Sound Management of Operational Risk (2011, revised 2021), expects a board-approved framework, a stated risk appetite, clear three-lines-of-defence accountability, and a loss-event taxonomy of seven Basel event types: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management.
Capital treatment
Under RBI's Basel III capital regulations, banks compute operational risk capital under the Basic Indicator Approach (BIA) or, with RBI approval, the Standardised Approach. BIA charge = 15% of average annual gross income for the previous three years, counting only years with positive gross income. Gross income = net interest income + net non-interest income, excluding realised gains on sale of securities in the banking book, extraordinary or irregular items, and insurance income.
Worked example
Gross income: Year 1 ₹1,000 crore; Year 2 negative ₹300 crore; Year 3 ₹1,200 crore. The negative year is dropped. Average of positive years = ₹1,100 crore. Capital = 15% of 1,100 = ₹165 crore. The common wrong answer averages all three years (₹633 crore) and returns ₹95 crore; that is incorrect because negative-income years leave both numerator and denominator.
Traps
- Putting strategic or reputational risk inside the definition.
- Treating legal risk as sitting outside operational risk.
- Averaging three years without removing negative-income years.
- Mixing operational risk capital with credit and market risk capital.
- Assuming the Standardised Approach is available without regulator approval.