Operational risk in banks

The Basel Committee defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. The definition includes legal risk and leaves out strategic and reputational risk, as the Wikipedia entry explains.

Losses are sorted into seven event types: internal fraud; external fraud, including theft and hacking; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management. Unlike credit and market risk, operational risk does not come with revenue, and a bank cannot diversify it away.

The Basel III reform replaced the earlier approaches with one standardized approach, mandatory for internationally active banks from January 1, 2022, according to the BIS summary. Its business indicator is a proxy from the income statement with three parts, each averaged over three years: interest, leases and dividends; services; and the financial component. Marginal coefficients of 12, 15 and 18 percent rise with the size of the bank.

An internal loss multiplier adjusts the result for the bank's own history. Its loss component is 15 times the average annual operational losses of the previous ten years, so a bank needs clean loss data reaching back a decade. In the EU the approach came with CRR III, covered on Basel III for banks in Germany.

BTR 4 of the current MaRisk asks every institution for a uniform definition of operational risk that staff understand. Material operational risks are identified and assessed at least once a year. Losses are recorded, significant losses are analyzed without delay, and losses from the same event are aggregated. The processes also cover near misses and boundary events, such as losses with a credit or market risk link.

The assessment uses both history and potential events, and the bank decides whether to remove a cause or to mitigate it, for example through insurance, fallback procedures, a change in business activity or emergency management. That last point links operational risk to business continuity management.

A payment file sent twice, a fraudulent loan application, a misselling claim from clients, a fire in a branch, a failed software release that stops online banking, a rogue trading loss. Each falls into one of the seven Basel event types, and many of them start in IT, which is why cybersecurity and ICT incident reporting sit close to the operational risk function.

Operational risk management looks at the probability and size of losses. Operational resilience asks whether the bank keeps delivering its critical services when something fails. The Basel Committee published its principles for operational resilience on March 31, 2021, building on its revised principles for the sound management of operational risk.

For two reasons. MaRisk requires it to understand where losses come from, and the standardized capital approach uses ten years of losses in the internal loss multiplier. A loss database with clear event types and amounts also feeds the scenarios in the ICAAP.