Charta is on Google Play: practise on the go. Get the app
Charta

Lay out what an operational risk management framework consists of and judge which kinds of risk belong inside its remit.

FRM® Part II · Operational Risk and Resilience · Introduction to Operational Risk and Resilience · FRM2.ORR.1.a

The idea

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. The Basel definition includes legal risk and excludes strategic and reputational risk, although those can follow from an operational failure. An operational risk management framework is the set of linked components that identify, assess, control, monitor and report that risk. Its parts are governance with a three-lines-of-defence structure, a board-approved risk appetite, risk and control self-assessments, loss data collection, key risk indicators, scenario analysis, reporting and, where required, capital. The business owns the risk, an independent second line challenges it, and internal audit gives assurance. A common error is to put credit or market losses inside the remit just because a loss occurred. Only the operational cause belongs here. Expect boundary and independence questions.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which statement matches the Basel definition of operational risk used in an operational risk management framework?

  1. Loss from failed internal processes, people or systems, or from external events, including legal risk - correct
  2. The risk of loss from adverse movements in the market value of trading and banking book positions heldWhy not: Describes market risk, not operational risk.
  3. The risk of loss because a borrower or counterparty fails to meet its contractual obligations in fullWhy not: Describes credit risk, which has its own framework.
  4. The risk of loss from an inability to fund cash and collateral obligations as they fall dueWhy not: Describes liquidity risk, a separate risk type.

The Basel definition is cause-based: failed processes, people, systems or external events, and it includes legal risk. Market, credit and liquidity risk are defined by the source of the loss, not by its cause.

A harder one

A bank is deciding which items belong in the remit of its operational risk framework under the Basel definition. Which of the following would NOT normally be included?

  1. A settlement paid to retail customers after a lawsuit over a mis-sold productWhy not: Legal risk is explicitly included in the Basel definition.
  2. A loss from a fraudulent funds transfer made by an employee of the bankWhy not: Internal fraud is a core operational risk event.
  3. A loss from a decision to enter a new market that proved unprofitable - correct
  4. A loss from a prolonged power failure that halted the trading systemsWhy not: System and utility failure is an operational event type.

Basel excludes strategic and reputational risk from the definition, while legal risk, fraud and system failures are included. A bad strategic decision is a business risk, not an operational failure.

The hardest tier

A bank lists five items from last quarter: (i) a trader's hidden unauthorised positions that lost money; (ii) a performing loan that defaulted after the borrower's business failed; (iii) a regulatory fine for anti-money-laundering control failures; (iv) a fall in the share price after a sector downgrade; (v) a loss from a cloud outage that stopped payments. Which items fall inside the operational risk remit?

  1. (i), (ii) and (v)Why not: Treats an ordinary borrower default as operational; it is credit risk.
  2. (i), (iii) and (v) - correct
  3. (i), (iii), (iv) and (v)Why not: Counts a share price fall caused by a sector downgrade, which is market and not an operational cause.
  4. (ii), (iii) and (iv)Why not: Misses the fraud and outage, and includes credit and market events.

Unauthorised trading, a fine for control failures (legal and compliance) and a system outage are operational. A default is credit risk and a sector-driven price move is market risk.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Introduction to Operational Risk and Resilience