Not every loss comes from bad loans or market falls. A rogue trader, a failed system upgrade, a fire in a data centre, a cyber attack, a mis-sold product or a spreadsheet error can all cause severe losses. The Basel Committee defines operational risk as "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events". It includes legal risk but excludes strategic and reputational risk — though operational failures often damage reputation badly.
What you will learn
- Define operational risk and its main causes
- Classify losses using the Basel event types
- Estimate operational losses from frequency and severity
- Describe the tools used to manage operational and model risk
Causes: people, processes, systems and external events
| Cause | Examples |
|---|---|
| People | Errors, fraud, inadequate training, key-person dependence |
| Processes | Poorly designed procedures, missing controls, manual workarounds |
| Systems | IT failures, outages, data corruption, cyber attacks |
| External events | Natural disasters, pandemics, supplier failures, external fraud |
Basel event types
Banks classify operational losses into seven categories:
- Internal fraud — unauthorised activity, theft or fraud by staff.
- External fraud — theft, forgery, hacking by outsiders.
- Employment practices and workplace safety — discrimination, injury claims.
- Clients, products and business practices — mis-selling, breaches of fiduciary duty, market manipulation.
- Damage to physical assets — fire, flood, earthquake, terrorism.
- Business disruption and system failures — IT outages, utility failures.
- Execution, delivery and process management — data entry errors, failed transactions, documentation errors.
Large historical losses have been concentrated in internal fraud (unauthorised trading) and in clients, products and business practices (mis-selling and conduct fines).
Frequency and severity
Operational losses typically follow a pattern of many small losses (processing errors, card fraud) and rare, very large losses (major fraud, conduct fines, catastrophic outages).
Worked example: expected operational losses
A payments business records about 10 processing errors a year, each costing 50,000 on average — an expected loss of 500,000 a year. It also estimates a 2% annual chance of a major system failure costing 20,000,000 — an expected loss of 400,000, but a single event large enough to threaten profitability (illustrative figures).
The frequent losses are managed through process improvements and budgeted as a cost. The rare, severe event requires resilience investment, business continuity planning and possibly insurance — expected-loss figures alone understate its importance.
Managing operational risk
- Risk and control self-assessment (RCSA): business units identify risks and evaluate their controls.
- Key risk indicators (KRIs): metrics such as failed transactions, system downtime, staff turnover, overdue reconciliations and audit findings, with thresholds that trigger action.
- Loss data collection: recording internal losses and near misses, and studying external events.
- Scenario analysis: expert assessment of severe but plausible events.
- Controls: segregation of duties, dual authorisation, reconciliations, access management, mandatory leave for staff in sensitive roles.
- Business continuity and operational resilience: backup sites, recovery time objectives, tested plans to keep critical services running — reflected in the Basel Committee’s Principles for Operational Resilience (2021).
- Third-party risk management: due diligence and monitoring of outsourcing providers.
- Insurance: cover for fraud, cyber, property damage and liability, where available.
These activities sit within the organisation’s enterprise risk management framework and the three lines model, guided by internal control frameworks such as COSO.
Cyber risk
Cyber risk has become one of the most significant operational risks for financial institutions, covering data theft, ransomware, fraud and service outages — see cybersecurity in finance.
Model risk
Model risk is the risk of loss from decisions based on incorrect or misused models — credit scoring, valuation, pricing, capital and financial planning models. Causes include errors in data, formulas or code, unrealistic assumptions, and using a model outside its intended purpose. Supervisory guidance on model risk management emphasises:
- Model inventory and clear ownership.
- Independent validation before use and periodically after.
- Documentation of purpose, assumptions and limitations.
- Ongoing monitoring of performance and change control.
Spreadsheet models deserve the same discipline — see financial modelling best practices. Machine learning models add challenges around explainability and bias — see AI in finance.
Capital for operational risk
Under the revised Basel III framework, banks calculate operational risk capital using a standardised approach based on a business indicator derived from financial statement items, adjusted by the bank’s historical losses where national supervisors apply that adjustment. The approach replaced earlier options, including internal models, because model-based estimates varied too widely between banks.
Common mistakes
- Treating operational risk as only an IT or compliance issue.
- Collecting loss data but not acting on root causes.
- Focusing on frequent small losses while neglecting rare catastrophic events.
- Allowing one person to initiate, approve and record transactions.
- Using critical models or spreadsheets without independent review.
Key terms
- Operational risk — loss from failed processes, people and systems, or external events.
- RCSA — risk and control self-assessment by business units.
- Key risk indicator — a metric that signals rising risk.
- Model risk — loss from incorrect or misused models.
- Operational resilience — the ability to deliver critical operations through disruption.
Frequently asked questions
Is reputational risk part of operational risk?
Under the Basel definition, no, but operational failures are a leading cause of reputational damage, so they are managed together in practice.
Can operational risk be eliminated?
No. It can be reduced through controls and resilience, and some losses transferred through insurance, but any organisation with people and systems carries it.
What is a near miss?
An event that could have caused a loss but did not. Recording near misses helps fix weaknesses before losses occur.
Key takeaways
- Operational risk arises from people, processes, systems and external events, including legal risk.
- Basel classifies losses into seven event types; losses combine many small and a few very large events.
- RCSA, KRIs, loss data, scenarios, controls and resilience planning manage the risk.
- Model risk is managed through inventories, independent validation, documentation and monitoring.