Operational-Risk Definition, Classification and Event Types - Article

Introduction

Operational risk exists in almost every banking activity.

A loan may be properly sanctioned, an investment may be financially sound and a foreign-exchange deal may be within market limits, yet the bank can still suffer loss because:

• an employee commits fraud;

• a transaction is entered incorrectly;

• a computer system fails;

• customer documents are incomplete;

• a cyberattack occurs;

• a vendor fails;

• a branch is damaged by a natural disaster; or

• an internal process does not work as intended.

The Basel Framework currently defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk. RBI uses the same definition.

For syllabus accuracy, the current IIBF 2026 BFM syllabus places Operational Risk in Module D, although the supplied course input identifies Module B. The syllabus specifically covers the definition of operational risk, its framework, identification process and assessment.

The most important conceptual distinction is:

Process, People, Systems and External Events explain where operational risk originates.

Operational-risk event types classify how the loss event actually occurs.

These two classifications should not be confused.

Learning Objectives

After studying this topic, you should be able to:

• define operational risk correctly;

• identify its four broad sources;

• understand why operational risk is different from credit and market risk;

• distinguish risk causes from loss-event types;

• explain the seven Level 1 operational-risk event categories;

• understand the treatment of legal, cyber and technology risks;

• distinguish operational risk from strategic and reputational risk; and

• avoid common CAIIB classification traps.

Definition of Operational Risk

The regulatory definition can be broken into four elements:

Operational Risk = Failure of Processes + People + Systems + External Events

This does not mean every operational loss has only one cause.

A single incident may involve several factors.

For example, an employee may make an incorrect payment because:

• maker-checker controls were weak;

• system validation was inadequate; and

• the employee failed to verify account details.

The event therefore involves both people and process weaknesses, possibly supported by a system weakness.

Four Broad Sources of Operational Risk

1. People Risk

People-related operational risk arises from human behaviour, capability or misconduct.

Examples include:

• employee error;

• internal fraud;

• unauthorised transactions;

• inadequate training;

• negligence;

• improper supervision;

• staff shortages;

• failure to follow procedures; and

• misconduct.

People risk does not always involve dishonesty.

An employee may act honestly but make a costly mistake because of:

• inadequate knowledge;

• excessive workload;

• poor instructions; or

• weak control.

Banking Example

An employee enters ₹10,00,000 instead of ₹1,00,000 in a payment instruction.

The immediate cause may be human error, while absence of an effective maker-checker or system validation control may be an underlying process weakness.

2. Process Risk

Process risk arises when an internal procedure is:

• poorly designed;

• incomplete;

• incorrectly performed;

• not followed;

• inadequately controlled; or

• unsuitable for the activity.

Examples include:

• incorrect transaction processing;

• incomplete loan documentation;

• reconciliation failure;

• missed regulatory reporting;

• wrong calculation;

• failure to monitor collateral;

• settlement errors; and

• ineffective internal controls.

Processes are central to operational risk because banking involves very large volumes of repetitive transactions.

A small weakness repeated across thousands of transactions can create substantial loss.

3. Systems Risk

Systems risk arises from failure or weakness in:

• hardware;

• software;

• networks;

• databases;

• telecommunications;

• interfaces;

• access controls; or

• other technology infrastructure.

Examples include:

• core banking system failure;

• payment application outage;

• software defect;

• incorrect system configuration;

• data corruption;

• failed interface;

• unavailable network; and

• system-generated processing error.

Technology risk is increasingly important because banking operations depend heavily on digital systems.

However, technology risk is part of operational risk; it is not automatically a completely separate primary risk category for this definition.

4. External-Event Risk

Operational losses can also arise from events outside the bank's direct control.

Examples include:

• natural disasters;

• floods;

• fire;

• terrorism;

• vandalism;

• external fraud;

• cyberattacks;

• power disruption; and

• failure of an important external service provider.

A bank may not be able to prevent every external event, but it can reduce the impact through:

• controls;

• redundancy;

• insurance;

• business continuity;

• disaster recovery; and

• operational resilience.

Current Basel guidance emphasises that operational risk is inherent in banking products, activities, processes and systems and requires banks to identify both internal and external threats.

Why Operational Risk Is Peculiar

Operational risk differs from many other banking risks.

It Exists Everywhere

Credit risk is strongly associated with lending and counterparty exposure.

Market risk is strongly associated with changes in market prices and rates.

Operational risk can arise in almost every activity, including:

• deposits;

• loans;

• payments;

• treasury;

• trade finance;

• customer service;

• human resources;

• IT;

• compliance; and

• outsourcing.

It Can Arise Without Taking a Deliberate Financial Position

A bank generally accepts credit risk because it decides to lend.

It accepts market risk when it takes market positions.

Operational risk may arise simply because the bank is conducting normal business.

Frequency and Severity Can Differ Greatly

Some operational events are:

• frequent but low-value; while others are

• rare but extremely severe.

Examples:

Frequent, low-impact: routine processing errors.

Rare, high-impact: major cyberattack or destruction of an important operating facility.

Both types require management attention, but controls may differ.

Cause, Event and Effect

A useful way to analyse operational risk is:

Cause → Event → Effect

Cause

Why did the event occur?

Examples:

• inadequate training;

• weak access control;

• defective process;

• outdated software.

Event

What actually happened?

Examples:

• unauthorised payment;

• data breach;

• system outage;

• incorrect settlement.

Effect

What was the consequence?

Examples:

• financial loss;

• customer compensation;

• legal penalty;

• business interruption.

These terms should not be mixed.

Regulatory Operational-Risk Event Types

For systematic loss-data classification, RBI's 2023 Master Direction on Minimum Capital Requirements for Operational Risk contains a detailed event taxonomy.

At Level 1, there are seven major operational-risk loss-event categories.

These categories describe loss events, not simply underlying causes.

Event Type 1: Internal Fraud

Internal fraud involves deliberate acts intended to:

• defraud;

• misappropriate property; or

• circumvent laws, regulations or company policy,

where at least one internal party is involved.

RBI examples include:

• unauthorised transactions;

• intentional non-reporting;

• deliberate mismarking;

• theft;

• embezzlement;

• asset misappropriation;

• forgery;

• bribes; and

• certain insider-trading activities.

Example

A treasury dealer deliberately conceals unauthorised trading positions.

This is not merely a normal market loss.

The intentional unauthorised activity creates an operational-risk event classified as internal fraud.

Event Type 2: External Fraud

External fraud involves intentional fraud, misappropriation or unlawful action by a third party.

Examples include:

• robbery;

• forgery;

• account takeover;

• hacking-related loss; and

• theft of information involving monetary loss.

Cyber Risk and External Fraud

A cyber incident must be classified according to what actually happens.

For example:

Hacker steals customer funds → External Fraud

But:

Cyberattack causes prolonged system outage → Business Disruption/System Failure may also be relevant to the event analysis.

Therefore, “cyber risk” should not automatically be treated as one single Level 1 event category.

Event Type 3: Employment Practices and Workplace Safety

This category covers losses arising from acts inconsistent with:

• employment requirements;

• health and safety obligations;

• workplace agreements; or

• discrimination requirements.

RBI examples include:

• employment disputes;

• compensation issues;

• workplace injury;

• employee safety matters; and

• discrimination claims.

This category is sometimes overlooked because students associate operational risk only with banking transactions.

Operational risk is broader than transaction processing.

Event Type 4: Clients, Products and Business Practices

This category includes losses caused by:

• failure to meet professional obligations to customers;

• inappropriate business practices; or

• defects in the nature or design of a product.

RBI examples include:

• suitability failures;

• disclosure violations;

• KYC-related failures;

• privacy breaches;

• aggressive selling;

• misuse of confidential information;

• improper market practices;

• money laundering-related failures;

• product defects; and

• certain model errors.

Example

A bank sells an unsuitable financial product without providing required disclosures and later has to compensate customers.

The loss may fall under Clients, Products and Business Practices.

Event Type 5: Damage to Physical Assets

This category includes loss or damage to physical assets caused by:

• natural disasters; or

• other external events.

Examples include:

• flood;

• cyclone;

• earthquake;

• fire from an external event;

• terrorism; and

• vandalism.

RBI's classification includes natural-disaster losses and specified human losses from external sources.

The event may also trigger business-continuity problems, showing how one incident can have several operational consequences.

Event Type 6: Business Disruption and System Failures

This category covers losses caused by interruption of business operations or system failure.

RBI examples include failures involving:

• hardware;

• software;

• telecommunications; and

• utility outages or disruption.

Banking Example

A payment-processing application becomes unavailable for several hours.

Transactions cannot be processed and the bank incurs customer compensation and operational costs.

This is a classic Business Disruption and System Failures event.

Event Type 7: Execution, Delivery and Process Management

This is an especially important banking category because it covers failures in routine transaction and process execution.

RBI examples include:

• data-entry error;

• missed deadline;

• transaction-processing error;

• accounting error;

• delivery failure;

• collateral-management failure;

• incorrect reporting;

• missing legal documents;

• incorrect customer records;

• counterparty-processing problems; and

• vendor disputes or outsourcing-related failures.

Example

A bank receives loan security documents but fails to complete the required charge-creation process.

The borrower later defaults and the security cannot be effectively enforced.

The underlying credit exposure is a credit risk, but the documentation/process failure itself is operational in nature.

Legal Risk

The regulatory definition of operational risk includes legal risk.

Legal risk can include losses arising from matters such as:

• fines;

• penalties;

• supervisory actions;

• litigation; and

• private settlements.

However, legal risk is not necessarily a separate eighth Level 1 loss-event category.

The underlying event is classified according to its nature.

For example:

• customer compensation for mis-selling may fall under Clients, Products and Business Practices;

• loss from incomplete legal documentation may fall under Execution, Delivery and Process Management.

Strategic and Reputational Risk

Both Basel and RBI expressly exclude strategic risk and reputational risk from the formal operational-risk definition.

This distinction is important.

Strategic Risk

Strategic risk can arise from poor business decisions or failure to respond appropriately to changes in the business environment.

Reputational Risk

Reputational risk arises from negative perceptions that damage confidence in the bank.

An operational incident may cause reputational damage, but reputational risk itself is excluded from the formal operational-risk definition.

Operational Risk at the Boundary with Credit and Market Risk

A single incident can involve more than one risk category.

Operational Risk and Credit Risk

Suppose fraud occurs in a loan account and produces a credit loss.

RBI's 2023 operational-risk capital directions specify that operational events related to credit risk and already accounted for in credit RWA should not also be included in the operational-loss dataset under that framework.

The underlying cause may still be operational, even though the loss receives credit-risk treatment for the specified capital purpose.

Operational Risk and Market Risk

RBI states that operational-risk losses related to market risk should be included in the operational-loss dataset under its framework.

Examples given by RBI include:

• fat-finger errors;

• algorithm failures;

• unauthorised trading;

• trading-limit breaches; and

• unauthorised remote access for settlement.

Example

A bond price falls because interest rates rise.

That is market risk.

A dealer accidentally enters a transaction for ₹100 crore instead of ₹10 crore.

That error is operational risk, even though the resulting financial loss occurs in a market transaction.

Loss Events and Near Misses

Not every control failure produces an actual financial loss.

Consider:

• an incorrect payment instruction is entered;

• maker-checker control detects it;

• the transaction is stopped before payment.

The bank has experienced a near miss.

Near misses are useful because they reveal:

• control weaknesses;

• potential future losses; and

• areas requiring corrective action.

Current Basel operational-risk guidance encourages comprehensive event datasets that may include internal loss events, near misses and, where feasible, relevant external operational-risk event data.

Therefore, effective operational-risk management should learn not only from realised losses but also from incidents that almost caused a loss.

Importance of a Common Risk Taxonomy

A bank should classify operational risks consistently.

Without a common taxonomy:

• similar events may receive different labels;

• loss data become unreliable;

• trends become difficult to identify;

• responsibility may be unclear; and

• risk reporting becomes inconsistent.

Current Basel guidance specifically recommends a common operational-risk taxonomy covering matters such as event types, causes, materiality and business units. It may also identify exposures relating to legal, conduct, model and ICT or cyber risks.

The taxonomy therefore helps convert individual incidents into useful management information.

Practical Banking Application

Consider three incidents.

Incident A

An employee deliberately diverts customer money.

Source: People Event Type: Internal Fraud

Incident B

A server unexpectedly fails and online transactions stop.

Source: Systems Event Type: Business Disruption and System Failures

Incident C

An employee enters incorrect beneficiary details because the process lacks proper verification.

Sources: People + Process Event Type: Execution, Delivery and Process Management

These examples show why source and event type are different concepts.

The source explains the underlying origin.

The event category describes what happened.

CAIIB Exam Focus

Remember these high-value concepts:

• Operational risk arises from processes, people, systems or external events.

• Operational risk exists across almost all banking activities.

• Legal risk is included in operational risk.

• Strategic risk is excluded.

• Reputational risk is excluded.

• People/process/system/external-event classification describes broad sources or causes.

• RBI's loss-event taxonomy contains seven major Level 1 categories.

• Internal fraud requires involvement of at least one internal party.

• External fraud is committed by a third party.

• Cyber incidents should be classified according to the nature of the event and loss.

• System outage falls under Business Disruption and System Failures.

• Processing and documentation errors generally fall under Execution, Delivery and Process Management.

• Mis-selling and professional-obligation failures may fall under Clients, Products and Business Practices.

• Natural-disaster damage falls under Damage to Physical Assets.

• Workplace and discrimination events are also operational-risk events.

• One incident may involve several underlying causes.

• Cause, event and financial effect should be distinguished.

• An operational incident can interact with credit or market risk.

• Near misses are useful for identifying control weaknesses even without realised loss.

• A common taxonomy improves consistent identification and reporting.

Common Exam Traps

Trap 1: “Operational risk means only employee fraud.”

Incorrect. Fraud is only one part of operational risk. Process, system and external-event failures are also included.

Trap 2: “People, processes, systems and external events are the seven Basel event types.”

Incorrect. They describe broad sources of operational risk. The regulatory event taxonomy uses separate loss-event categories.

Trap 3: “Legal risk is excluded from operational risk.”

Incorrect. Legal risk is expressly included.

Trap 4: “Reputational risk is included because an operational failure may damage reputation.”

Incorrect. Reputational consequences may arise from an operational event, but reputational risk is excluded from the formal definition.

Trap 5: “Strategic risk is a type of operational risk.”

Incorrect under the regulatory definition.

Trap 6: “Every cyber incident is automatically external fraud.”

Incorrect. Classification depends on what occurs. A hacking-related theft may be external fraud, while a system outage may fall under business disruption and system failure.

Trap 7: “A processing mistake in a loan account is purely credit risk.”

Incorrect. The borrower exposure may involve credit risk, while a documentation or processing failure may be operational in origin.

Trap 8: “A transaction must produce financial loss before the bank should examine the control weakness.”

Incorrect. Near misses can reveal important operational-risk weaknesses.

Trap 9: “Operational risk occurs only in back-office operations.”

Incorrect. It can arise in front office, branches, IT, treasury, credit, payments, compliance and outsourced activities.

Trap 10: “Damage caused by a flood is not operational risk because the bank did not cause the event.”

Incorrect. External events are expressly included in the operational-risk definition.

Memory Technique

For the four sources, remember P–P–S–E:

P — PeopleP — ProcessesS — SystemsE — External Events

For the seven loss-event categories, remember the sequence:

Fraud inside → Fraud outside → Employees → Customers → Assets → Systems → Processes

This represents:

1. Internal Fraud

2. External Fraud

3. Employment Practices and Workplace Safety

4. Clients, Products and Business Practices

5. Damage to Physical Assets

6. Business Disruption and System Failures

7. Execution, Delivery and Process Management

The easiest exam check is:

“Am I being asked about the cause of the risk or the type of event that occurred?”