A payment sent to a criminal's account can involve several failures: a forged instruction, a weak callback procedure, and an employee who overrides a warning. Operational risk management identifies that chain, assigns responsibility, and reduces the chance and impact of another loss.
The Basel definition covers losses caused by inadequate or failed processes, people, systems, or external events. Legal risk is included. Strategic and reputational risk are excluded from that definition, although a firm's wider management framework should address them. A failed acquisition strategy is strategic risk. A penalty for mishandling customers is an operational loss. Customer flight after the penalty is a reputational consequence.
An operational risk management framework connects governance, identification, assessment, controls, monitoring, reporting, and remediation. It defines a common vocabulary, loss-reporting standards, escalation thresholds, owners, and independent challenge. It should cover existing operations and changes such as acquisitions, new products, and technology deployments. A policy document without operating controls and evidence of follow-up is incomplete.
Operational risk exists in every revenue-producing activity, but the failures themselves do not provide a compensating risk premium. Investment in controls can improve efficiency as well as reduce losses.
Common mistakes
- Reducing operational risk to capital absorption. Controls, prevention, incident response, and recovery are all part of the framework.
- Classifying by a famous firm's name. A mis-selling loss and an employee safety claim at the same bank belong to different event categories.
- Making the second line the risk owner. Independent challenge does not relieve the business of control responsibilities.
Bottom line
- Operational risk covers processes, people, systems, and external events; legal risk is included.
- Event, cause, and impact taxonomies answer different questions.
- The business owns controls, the second line challenges, and internal audit assures.
- Appetite combines financial, service, conduct, and control measures.
Exam shortcut
Identify the event first, then separate its causes from its consequences. For governance questions, assign operating work to the first line, challenge to the second, and assurance to the third. For a resilience question, follow the full service through recovery and backlog clearance before comparing it with the disruption tolerance.
The full lesson (about 2,591 words, 17 min read) adds 2 worked examples, all 6 common mistakes, a self-check, free in the app.
Learning objectives
- 1
- 2
- 3
- 4
- 5
- 6
- 7
- 8
- 9
- 10
- 11
- 12
- 13
- 14
- 15
- 16
- 17
- 18
- 19
- 20
- 21
- 22
- 23
- 24
Browse all free FRM Part II lessons or jump into free FRM Part II practice questions.