Charta is on Google Play: practise on the go. Get the app
Charta

Set out the seven event-type categories of Basel II and give sample operational risk events that fit under each one.

FRM® Part II · Operational Risk and Resilience · Introduction to Operational Risk and Resilience · FRM2.ORR.1.b

The idea

Basel II sorts operational losses into seven event types by cause. Internal fraud covers intentional acts by staff such as theft, bribery or hidden unauthorised trading. External fraud covers third-party acts such as forgery, robbery and hacking. Employment practices and workplace safety covers discrimination, compensation claims and health and safety breaches. Clients, products and business practices covers mis-selling, suitability, fiduciary breaches, market manipulation and privacy breaches. Damage to physical assets covers natural disasters, terrorism and vandalism. Business disruption and system failures covers hardware, software, telecom and utility failures. Execution, delivery and process management covers data-entry errors, missed deadlines, failed settlement, vendor disputes and documentation mistakes. Classify by the root cause and by intent. Deliberate acts by staff are internal fraud, and honest errors are process failures.

A practice question

From the question bank, with the reason each wrong option is wrong.

Which list gives the seven Basel II operational risk event types?

  1. Internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; market risk events; strategic risk eventsWhy not: Replaces two real categories with market and strategic risk, which are not event types.
  2. Fraud (internal and external combined); employment practices; clients, products and business practices; damage to physical assets; system failures; execution and delivery; reputational eventsWhy not: Merges the two fraud categories and adds reputational events, which Basel II excludes.
  3. Internal fraud; external fraud; credit events; liquidity events; damage to physical assets; business disruption; execution, delivery and process managementWhy not: Mixes in credit and liquidity events, which belong to other risk types.
  4. Internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management - correct

The seven categories are internal fraud, external fraud, employment practices and workplace safety, clients products and business practices, damage to physical assets, business disruption and system failures, and execution delivery and process management.

A harder one

A bank settles discrimination claims from employees and pays compensation to staff injured because of unsafe working conditions. Under Basel II these losses fall under:

  1. Internal fraudWhy not: No intentional wrongdoing for gain by staff is involved; the bank was the defendant.
  2. Damage to physical assetsWhy not: The injured people are staff, not buildings or equipment.
  3. Employment practices and workplace safety - correct
  4. Clients, products and business practicesWhy not: The claimants are employees, not clients.

Discrimination, compensation claims and health and safety breaches are the sample events for employment practices and workplace safety.

The hardest tier

Last year, one trader deliberately booked offsetting fictitious trades to hide limit breaches, and a different trader inadvertently keyed a notional ten times too large, causing a loss. How should the two events be classified?

  1. Execution, delivery and process management for the hidden breaches; internal fraud for the keying errorWhy not: Swaps the categories: intent decides, and the hidden trades were deliberate.
  2. Execution, delivery and process management for both, because both are trade processing failuresWhy not: Ignores intent: deliberate concealment is fraud, not a process failure.
  3. Internal fraud for both, because both events involved an employee and a trading lossWhy not: Ignores that the keying error was an honest mistake without intent.
  4. Internal fraud for the hidden breaches; execution, delivery and process management for the keying error - correct

Intentional unauthorised activity or mismarking is internal fraud; an inadvertent data-entry error is execution, delivery and process management. Intent and root cause drive the choice.

In the app: 6 practice questions on this outcome, spaced review that brings it back before you forget it.

Start free →

More in Introduction to Operational Risk and Resilience