Operational Risk

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or external events.

The Basel definition identifies internal processes, people, systems, and external events as the main sources.

Basel explicitly includes legal risk within operational risk.

Strategic risk is excluded from the Basel definition of operational risk.

Reputational risk is excluded from the Basel definition, although operational incidents can cause reputational damage.

Incorrect transaction processing is an example of failure in an internal process.

Human errors, such as entering incorrect transaction details, are people-related operational risks.

A system crash affecting critical banking operations is a systems-related operational risk.

Natural disasters such as floods can damage branches or data centers and disrupt operations.

Before Basel II, operational risk was generally treated as a residual category rather than a separately defined risk category.

Basel II formally recognized operational risk as a separate category and introduced capital requirements for it.

Capital requirements help banks absorb potential losses arising from operational risk events.

The Barings Bank collapse highlighted weaknesses in internal controls and the failure to detect unauthorized trading.

The Enron scandal involved corporate fraud, weak governance, and regulatory failures.

The attacks demonstrated that external events can severely disrupt financial operations.

Cross-border operations increased interconnectedness and exposure to risks originating in different countries.

Deregulation increased the scope for complex and higher-risk activities when oversight and controls were insufficient.

Greater dependence on IT systems creates exposure to cyberattacks, software failures, and system outages.

ORM involves identifying risks, assessing them, mitigating them, monitoring them, and making decisions based on risk tolerance.

Risk identification focuses on recognizing potential operational threats and vulnerabilities.

Risk assessment evaluates the likelihood and potential impact of identified risks.

Risk mitigation involves implementing controls to reduce the likelihood or consequences of operational risks.

Continuous monitoring helps track changing risk levels and determine whether controls remain effective.

Basel II classified operational risk events into seven major event types.

Internal fraud covers fraudulent activities committed by employees, such as theft or bribery.

External fraud includes fraudulent activities carried out by external parties, including hacking and card fraud.

Damage to physical assets covers losses from physical destruction caused by events such as fires and natural disasters.

Business disruption and system failures include IT outages, software crashes, and similar disruptions.

Vendor risk arises when a bank depends on external vendors and those vendors create operational vulnerabilities.

Operational risk has diverse and unpredictable sources, including human errors, system failures, fraud, and external events.