Outline the types of operational risk, with an account of how each type can arise.
The idea
Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. The Basel definition includes legal risk but excludes strategic and reputational risk. Basel groups losses into seven event types. Internal fraud involves at least one insider acting to defraud or evade rules, such as unauthorized trading. External fraud is committed by outsiders, such as forgery or hacking. Employment practices and workplace safety covers discrimination claims and health and safety breaches. Clients, products and business practices covers improper or negligent dealings with clients, such as mis-selling or money laundering failures. Damage to physical assets covers disasters and vandalism. Business disruption and system failures covers outages of hardware, software and utilities. Execution, delivery and process management covers errors in processing, documentation, settlement and vendor management. Classify by cause: intent and insider involvement decide the fraud type, while honest mistakes belong in execution or in clients and products.
A practice question
Which statement best captures the Basel definition of operational risk?
- The risk of loss from inadequate or failed internal processes, people and systems, or from external events, including legal risk - correct
- The risk of loss from adverse movements in market prices, including strategic and reputational damageWhy not: Confuses operational risk with market risk and wrongly includes strategic and reputational risk, which Basel excludes.
- The risk that a counterparty fails to meet its contractual obligations, together with settlement lossesWhy not: Describes credit risk, not operational risk.
- The risk of loss from external events only, such as natural disasters, outside fraud and regulatory changeWhy not: Omits losses from internal processes, people and systems, which are the main causes in the definition.
Basel defines operational risk as loss from inadequate or failed internal processes, people and systems, or from external events. Legal risk is included; strategic and reputational risk are excluded.
A harder one
A bank's advisers recommend complex structured notes to retail clients who do not understand them. Nobody intended to deceive, but regulators order compensation of USD 40 million. The best Basel event type for this loss is:
- Internal fraudWhy not: No intent to defraud was involved, and internal fraud requires a deliberate act by an insider.
- Execution, delivery and process managementWhy not: Confuses a failure of suitability duties to clients with a processing or settlement mistake.
- Clients, products and business practices - correct
- Employment practices and workplace safetyWhy not: This type concerns the treatment of staff, not the treatment of clients.
Negligent failure to meet a professional obligation to clients (suitability, mis-selling) falls under clients, products and business practices. Without intent to deceive it is not fraud.
The hardest tier
A bank pays USD 30 million in fines for weak anti-money-laundering controls and, after adverse publicity, loses USD 50 million of annual revenue as clients leave. Under the Basel definition, the two effects are treated as follows:
- Both are operational risk losses because both stem from the same control failureWhy not: Basel explicitly excludes reputational risk, so lost business from bad publicity is not an operational loss.
- Neither counts, because fines are legal risk and legal risk is excludedWhy not: The Basel definition includes legal risk, including fines and settlements.
- The lost revenue counts and the fines are excluded as regulatory mattersWhy not: Reverses the treatment: fines and penalties are included, reputational revenue loss is not.
- The fines are operational risk losses (clients, products and business practices); the lost revenue is reputational and excluded - correct
Basel includes legal risk (fines, penalties, settlements) but excludes strategic and reputational risk. The fines are an operational loss; the revenue lost through damaged reputation is not.
In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.
Start free →More in Operational Risk
- Contrast three ways of arriving at regulatory capital for operational risk: the advanced measurement approach, the standardized approach and the basic indicator approach.
- Explain why the Basel Committee introduced the standardized measurement approach and describe what it involves.
- Explain how Monte Carlo simulation builds a loss distribution out of a suitable loss frequency distribution and loss severity distribution.
- Outline the data problems commonly seen that make estimates of loss frequency and severity distributions inaccurate or biased.
- Outline using scenario analysis as a substitute when there is little data to work with.
- Outline how causal relationships are identified, and the roles that education, Risk and Control Self-Assessment (RCSA) and Key Risk Indicators (KRIs) play in understanding and managing operational risks.
- Outline how operational risk capital is allocated across business units.
- Explain how operational risk can be measured with the power law.
- Explain the link between insuring against operational risk and the moral hazard and adverse selection problems that insurance companies face.