Operational-Risk Governance, Organisation and Framework - Article

Introduction

Operational risk exists throughout a bank because every banking activity depends on:

• people;

• processes;

• systems;

• technology;

• third parties; and

• external events.

Managing this risk therefore requires more than individual controls at branch or department level. A bank needs an organisation-wide system that clearly defines:

• who owns operational risk;

• who monitors and challenges it;

• who approves the risk framework;

• how risk is identified and assessed;

• how limits and risk appetite are monitored;

• how incidents are reported and escalated; and

• who independently checks whether the system works.

This structure is generally called the Operational Risk Management Framework (ORMF).

The Basel Committee's current operational-risk guidance, published in consolidated form in 2026, requires banks to develop, implement and maintain an ORMF fully integrated with their overall risk-management processes. It also emphasises Board oversight, senior-management implementation and the three-lines-of-defence approach.

RBI's April 30, 2024 Guidance Note on Operational Risk Management and Operational Resilience similarly strengthened the framework for regulated entities and aligned its approach with Basel principles. RBI describes the guidance through three broad pillars: Prepare and Protect, Build Resilience, and Learn and Adapt.

For CAIIB, the central governance principle is:

Business owns the risk, independent risk management provides challenge and oversight, and internal audit provides independent assurance.

Learning Objectives

After studying this topic, you should be able to:

• explain the Operational Risk Management Framework;

• understand the role of the Board and senior management;

• explain the three lines of defence;

• identify responsibilities of business units and operational-risk functions;

• understand risk appetite and tolerance;

• explain the importance of operational-risk culture;

• understand reporting, escalation and independent assurance; and

• distinguish governance responsibility from day-to-day risk ownership.

What Is an Operational Risk Management Framework?

An ORMF is the bank's structured system for managing operational risk across its:

• products;

• services;

• activities;

• processes;

• systems;

• legal entities; and

• business units.

The framework should be proportionate to the bank's:

• size;

• nature of business;

• complexity;

• operational-risk profile; and

• organisational structure.

Basel specifically states that the ORMF should be integrated across all levels of the bank, including business units and new business initiatives.

A sound ORMF normally covers:

1. governance;

2. risk culture;

3. operational-risk appetite and tolerance;

4. identification and assessment;

5. monitoring;

6. reporting;

7. controls and mitigation;

8. loss-event management;

9. new-product and change management;

10. ICT and third-party risks;

11. business continuity and resilience; and

12. independent review.

Operational-Risk Governance Structure

A typical governance structure can be understood as:

Board of Directors

↓

Board/Risk Management Committee

↓

Senior Management

↓

Business Units + Independent Operational-Risk Function

↓

Internal Audit

RBI's operational-risk guidance has historically illustrated a similar structure, with the Board setting overall risk policy and strategy, a Risk Management Committee overseeing integrated risk, and separate credit, market and operational-risk functions supporting risk management.

The exact names of committees may differ between banks.

The important principle is clear responsibility and independence, not the title of a committee.

Role of the Board of Directors

The Board has ultimate oversight responsibility for operational-risk management.

Basel states that the Board should approve and periodically review the ORMF and ensure that senior management effectively implements it throughout the organisation.

Important Board responsibilities include:

• establishing a strong risk-management culture;

• approving the ORMF;

• approving operational-risk appetite and tolerance;

• understanding material operational risks;

• ensuring adequate organisational structure;

• reviewing material risk exposures and events;

• monitoring breaches of risk appetite or limits;

• ensuring adequate resources;

• overseeing major control weaknesses;

• ensuring independent audit coverage; and

• periodically reviewing whether the framework remains appropriate.

The Board should also consider changes in:

• business volumes;

• technology;

• regulations;

• products;

• outsourcing;

• external threats; and

• the control environment.

Board Oversight Does Not Mean Day-to-Day Management

The Board should not personally manage every operational incident.

Its role is to:

Set direction → Approve boundaries → Review performance → Hold management accountable

Day-to-day implementation remains a management responsibility.

Operational-Risk Appetite and Tolerance

Operational-risk appetite describes the nature and amount of operational risk the bank is willing to accept in pursuing its objectives.

Operational-risk tolerance converts that broad appetite into more specific boundaries or indicators.

Basel requires the Board to approve and periodically review an operational-risk appetite and tolerance statement that is understandable, forward-looking and capable of supporting risk monitoring.

Examples of operational-risk boundaries may relate to:

• fraud losses;

• system downtime;

• transaction errors;

• unresolved audit observations;

• cyber incidents;

• third-party failures;

• customer complaints;

• control breaches; or

• other material risk indicators.

The exact metrics depend on the bank.

Zero Risk Is Not Practical

A bank cannot normally eliminate every operational-risk event.

For example, eliminating all payment-processing risk would require stopping payments entirely.

The practical objective is:

Accept necessary operational risk within defined boundaries while maintaining effective controls and resilience.

Role of Senior Management

Senior management converts the Board-approved framework into operational reality.

Basel assigns senior management responsibility for implementing and maintaining policies, processes and systems for managing operational risk throughout material products, activities, processes and systems.

Senior-management responsibilities include:

• developing the governance structure;

• assigning authority and accountability;

• implementing the ORMF;

• translating risk appetite into operating controls;

• ensuring adequate staffing and expertise;

• establishing operational-risk policies;

• ensuring risk identification and assessment;

• implementing monitoring and reporting;

• ensuring issues are tracked to closure;

• escalating major breaches;

• supporting risk culture and training; and

• ensuring business units comply with the framework.

Senior management should also ensure that material operational-risk issues are not allowed to remain unresolved indefinitely.

Issue Resolution

An effective framework should identify:

• the issue;

• risk owner;

• corrective action;

• responsible person;

• target date;

• current status; and

• escalation requirement.

Basel specifically expects robust challenge mechanisms and processes to report, track and escalate issues when necessary.

Three Lines of Defence

The three-lines model is one of the most important organisational concepts in operational-risk management.

First Line — Business and Operational Management

The first line consists of business and operational units that create and manage risk through their daily activities.

Examples include:

• branches;

• treasury;

• credit operations;

• payments;

• trade finance;

• customer service;

• IT operations; and

• other business functions.

The first line should:

• identify risks in its activities;

• operate controls;

• comply with policies;

• maintain procedures;

• report incidents;

• monitor control performance;

• correct weaknesses; and

• remain accountable for the risk it creates.

The principle is:

Risk ownership remains with the business.

A separate risk department does not remove that responsibility.

Second Line — Independent Risk Management and Control Functions

The second line provides independent:

• oversight;

• challenge;

• framework design;

• monitoring; and

• reporting.

The operational-risk function may:

• develop risk policies and taxonomy;

• facilitate risk assessments;

• monitor Key Risk Indicators;

• analyse operational loss data;

• challenge business assessments;

• aggregate risk information;

• monitor appetite breaches;

• report to senior management;

• support scenario analysis; and

• provide specialist advice.

The second line should have sufficient independence and authority to challenge the first line.

It should not simply accept business-unit assessments without review.

Third Line — Internal Audit

Internal audit provides independent assurance regarding whether:

• the ORMF is properly designed;

• policies are being followed;

• first- and second-line controls are effective;

• material risks are appropriately identified;

• reporting is reliable; and

• governance arrangements are working.

Internal audit should remain sufficiently independent from operational-risk management.

Its role is to review the system, not operate the system.

Basel requires the ORMF to be implemented by the first line, reviewed and challenged by the second line, and independently reviewed by the third line.

RBI's operational-risk capital disclosure framework also requires banks to describe their operational-risk management structure and organisation, measurement system, reporting framework and risk mitigation.

Three Lines Compared

Operational-Risk Management Committee

Banks may establish an Operational Risk Management Committee or equivalent executive governance forum depending on their structure.

Its responsibilities may include:

• reviewing material operational-risk exposures;

• examining significant loss events;

• monitoring appetite and tolerance;

• reviewing KRIs;

• monitoring major control weaknesses;

• reviewing corrective actions;

• considering new or emerging risks;

• escalating important matters; and

• recommending changes to policies or controls.

The committee supports governance but does not replace:

• Board oversight;

• senior-management accountability; or

• individual business risk ownership.

Role of the Operational-Risk Function

A central operational-risk function helps ensure a consistent bank-wide approach.

Its responsibilities may include:

Framework Development

Develop:

• policies;

• procedures;

• common terminology;

• risk taxonomy;

• assessment methodology; and

• reporting standards.

Risk Assessment Support

Support tools such as:

• Risk and Control Self-Assessment;

• Key Risk Indicators;

• scenario analysis;

• loss-data analysis; and

• root-cause analysis.

Independent Challenge

Ask whether:

• important risks have been omitted;

• control effectiveness is overstated;

• residual risk is acceptable;

• corrective action is adequate; and

• risk appetite is being respected.

Aggregation

Individual departments may see only their own risks.

The central function provides an enterprise-wide view of:

• common control weaknesses;

• major incidents;

• emerging trends;

• technology dependency;

• vendor concentration; and

• other cross-business risks.

Operational-Risk Culture

A strong framework fails if employees believe risk management is only the risk department's responsibility.

Basel therefore places risk-management culture as its first operational-risk principle. The Board should lead the culture and senior management should implement it.

A sound operational-risk culture includes:

• clear accountability;

• ethical behaviour;

• open reporting of incidents;

• timely escalation;

• proper training;

• willingness to challenge;

• learning from mistakes; and

• no tolerance for hiding material control failures.

Importance of Incentives

Employee incentives should not encourage staff to bypass controls merely to achieve:

• sales targets;

• transaction volumes;

• faster turnaround;

• revenue objectives; or

• cost savings.

A badly designed incentive structure can increase operational risk even where written controls appear strong.

Policy and Documentation

The ORMF should be supported by clear policies.

Policies should explain:

• operational-risk definition;

• governance responsibilities;

• risk appetite and tolerance;

• risk identification;

• assessment methodology;

• incident reporting;

• loss-data collection;

• escalation;

• controls;

• monitoring;

• reporting;

• risk mitigation;

• new-product approval; and

• independent review.

Basel requires ORMF policies to be reviewed and revised where changes in the bank's business or external environment materially affect its operational-risk profile.

Policies should therefore be living controls, not documents reviewed only for formal compliance.

Integration with Overall Risk Management

Operational risk should not be managed in isolation.

It can interact with:

• credit risk;

• market risk;

• liquidity risk;

• compliance risk;

• technology risk;

• third-party risk; and

• business continuity.

Example

A system error may create an unauthorised foreign-exchange exposure.

The initial cause is operational.

The resulting position may create market risk.

A large loss may then create liquidity implications.

Integrated risk management therefore requires different risk functions to share important information rather than operate as isolated silos.

RBI's risk-management structures have long emphasised integrated oversight through the Risk Management Committee while retaining specialised management of major individual risk types.

New Products, Systems and Change Management

Operational risk often increases when a bank introduces:

• a new product;

• new technology;

• a major system change;

• a new outsourcing arrangement;

• a new distribution channel; or

• entry into a new market.

The risk framework should therefore require assessment before material changes are implemented.

Questions may include:

• Are processes clearly designed?

• Are staff trained?

• Are systems tested?

• Are access controls adequate?

• Are legal and compliance requirements understood?

• Are vendors capable?

• Are contingency arrangements available?

• Can transactions be reconciled?

• Can failures be detected?

Basel specifically requires the ORMF to extend to new products, activities, processes and systems.

Operational-Risk Reporting

Good governance requires useful information.

Reports may include:

• operational losses;

• major incidents;

• near misses;

• emerging risks;

• KRIs;

• risk-appetite breaches;

• control failures;

• overdue corrective actions;

• cyber or technology events;

• third-party failures; and

• root-cause analysis.

Basel's current principles state that reporting should support proactive management and should include material internal events, breaches, emerging risks and relevant external developments.

Escalation

Not every incident needs Board attention.

However, escalation rules should define which events require reporting to:

• business management;

• risk management;

• senior management;

• Board committees; or

• the Board.

A serious incident reported too late is a governance failure even if it was ultimately recorded correctly.

Internal Controls and Risk Mitigation

The framework should maintain a strong control environment.

Examples include:

• segregation of duties;

• maker-checker controls;

• authorisation limits;

• access controls;

• reconciliation;

• transaction verification;

• physical controls;

• exception monitoring;

• insurance;

• business continuity; and

• contingency arrangements.

Basel's operational-risk principles require a strong control environment supported by appropriate controls and risk-mitigation or risk-transfer strategies.

The objective is not to add controls endlessly.

Controls should address identified risks and be proportionate to:

• likelihood;

• severity;

• business importance; and

• control cost.

Operational Risk and Operational Resilience

Operational-risk management aims to identify and manage operational threats.

Operational resilience focuses on the bank's ability to continue delivering critical operations through disruption.

The concepts are related but not identical.

Basel states that effective operational-risk management and operational resilience reinforce each other by reducing the frequency and impact of operational-risk events.

RBI's April 2024 guidance similarly combines operational-risk management with resilience through its three-pillar approach.

A sound framework therefore considers not only:

“How do we prevent failure?”

but also:

“If failure occurs, can critical banking operations continue or recover quickly?”

Practical Banking Application

Consider a bank launching a new digital lending platform.

The business unit wants rapid implementation to achieve growth targets.

A sound governance framework would involve:

First Line

The digital-lending business and IT teams identify:

• process risks;

• system risks;

• fraud risks;

• customer-data risks; and

• control requirements.

Second Line

Risk and control functions independently challenge:

• risk assessment;

• control design;

• fraud controls;

• data security;

• vendor risk; and

• residual risk.

Senior Management

Management ensures that:

• necessary resources are available;

• unacceptable risks are corrected;

• material issues are escalated; and

• implementation remains within risk appetite.

Board/Committee

Material strategic and risk matters are reviewed according to governance arrangements.

Third Line

Internal audit subsequently evaluates whether the system and controls operate effectively.

This demonstrates that operational-risk governance is shared but differentiated.

Every function has a role, but the roles are not interchangeable.

CAIIB Exam Focus

Remember these high-value concepts:

• The ORMF should be integrated into the bank's overall risk-management framework.

• The Board provides oversight and approves the ORMF.

• The Board approves and periodically reviews operational-risk appetite and tolerance.

• Senior management implements the Board-approved framework.

• Business units are the first line and own operational risk.

• Independent risk functions form the second line and provide challenge and oversight.

• Internal audit forms the third line and provides independent assurance.

• Internal audit should not routinely operate the risk-management process it later audits.

• A risk committee supports governance but does not remove Board responsibility.

• Risk culture is an essential part of operational-risk governance.

• Operational risk should be embedded in business decisions, not managed only after incidents.

• Material breaches require timely escalation.

• Operational-risk policies should be reviewed when the risk environment changes.

• New products, systems and material changes require operational-risk assessment.

• Operational-risk reporting should include events, trends, breaches and emerging risks.

• Operational risk interacts with credit, market, liquidity and other risks.

• Risk ownership and independent challenge should remain clearly separated.

• Operational resilience complements operational-risk management.

Common Exam Traps

Trap 1: “The operational-risk department owns all operational risk.”

Incorrect. Business and operational units own and manage the risks created by their activities. The risk function provides oversight and challenge.

Trap 2: “The Board manages individual operational incidents.”

Incorrect. The Board provides oversight, direction and risk-appetite approval. Day-to-day implementation belongs to management.

Trap 3: “Delegating operational-risk duties to a Board committee removes Board responsibility.”

Incorrect. Delegation supports governance but does not eliminate ultimate Board oversight.

Trap 4: “Internal audit is the second line of defence.”

Incorrect. Internal audit is normally the third line, providing independent assurance.

Trap 5: “The independent risk function is responsible for operating all first-line controls.”

Incorrect. Doing so can weaken independence and accountability.

Trap 6: “Operational-risk appetite means the bank is willing to accept every loss below a fixed monetary amount.”

Incorrect. Appetite and tolerance may include quantitative and qualitative boundaries and must reflect different types of operational risk.

Trap 7: “A good policy document itself proves effective operational-risk management.”

Incorrect. Policies must be implemented, monitored, challenged and periodically reviewed.

Trap 8: “Operational risk can be managed independently of other bank risks.”

Incorrect. Operational events can create credit, market, liquidity and other consequences.

Trap 9: “Risk governance begins only after an operational loss occurs.”

Incorrect. Identification, assessment, new-product review and preventive controls should operate before losses occur.

Trap 10: “Operational-risk management and operational resilience are identical.”

Incorrect. They are closely related but have different primary objectives: risk management controls operational threats, while resilience emphasises continued delivery and recovery of critical operations during disruption.

Memory Technique

Remember the three lines as O–C–A:

O — Own: First line owns and manages operational risk. C — Challenge: Second line monitors and challenges. A — Assure: Third line provides independent assurance.

For governance, remember B–M–B–R–A:

B — Board: Approves framework and appetite. M — Management: Implements the framework. B — Business: Owns the risk. R — Risk Function: Reviews and challenges. A — Audit: Independently assures.

The most important CAIIB principle is:

Operational-risk responsibility is shared across the bank, but accountability must remain clearly allocated.