Operational Risk
Domain focus
Operational risk covers loss from failed processes, people, systems or external events, plus legal risk. The exam tests RCSA, loss data, KRIs, business continuity, outsourcing, technology risk under RMiT, and the capital approach.
Core rules
- BNM's operational risk guidance requires a board-approved framework, an independent operational risk function, and use of RCSA, loss-event databases, KRIs and scenario analysis.
- Business continuity management requires a business impact analysis, recovery time objectives (RTO), recovery point objectives (RPO) and tested plans.
- Material outsourcing does not transfer regulatory responsibility; the bank needs due diligence, exit plans, access to records and board oversight.
- RMiT sets expectations for cyber resilience, incident reporting and third-party technology risk.
- Under the Basic Indicator Approach, the capital charge is 15% of average annual gross income over the previous three years.
Worked example
Gross income is RM1,200m, RM1,350m and RM1,500m. Average = RM1,350m. Capital charge = 15% × 1,350 = RM202.5m. Operational risk RWA = 202.5m × 12.5 = RM2,531m. If one year had a negative gross income, the BIA treatment must follow BNM's rules rather than simply averaging three numbers.
Traps
Do not include strategic or reputational risk as operational risk losses. Do not confuse RTO with RPO. Do not say outsourcing transfers risk. Do not report only large losses - near misses matter. Do not use the wrong gross-income denominator.