Operational risk · RiskAtoms Academy

By the end you will be able to

1State the Basel definition of operational risk, and what it includes and leaves out.
2Classify operational losses using the seven Basel event types and the eight business lines.
3Place cyber incidents in the event types, according to what the attack did.
4Explain why rare, large losses matter more than frequent, small ones.

Why it matters

In 1995 Barings, a London bank more than two centuries old, was brought down by one trader in Singapore. No market crash and no borrower default: just one person, weak controls and hidden losses. That is operational risk.

Core explanation

When how you work goes wrong

Market and credit risk come from what a firm holds. Operational risk comes from how it works. The Basel Committee defines it as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk (fines, lawsuits) and excludes strategic and reputational risk, which have their own place on the map (L2.2.07: Strategic, reputational and model risk).

Every firm faces it, whatever it holds. A bank with no loans and no trading would still have staff who make mistakes, systems that crash, and buildings that can flood. Losses land on the balance sheet only after the event, as a write-off, a refund or a provision for a fine.

ExploreThe four sources in the definition

Click a source to see what goes wrong there.

People

Honest mistakes, deliberate fraud, staff who break rules to hit targets, and the loss of key people. Rogue traders and mis-selling scandals both start here.

The Basel event types. To collect loss data that can be compared across banks, the Basel Committee sorts every operational loss into one of seven event types, by what happened:

Event type	What it covers	Example
Internal fraud	Fraud, theft or unauthorised activity involving at least one insider.	A trader hides losses with fake trades.
External fraud	Fraud, theft or hacking by outsiders.	Card fraud; criminals hack into payment systems.
Employment practices and workplace safety	Breaches of employment, health or safety law, or discrimination claims.	A staff discrimination claim; an injury at work.
Clients, products and business practices	Failing a duty to clients, or the nature or design of a product.	Mis-selling; market manipulation; data privacy breaches.
Damage to physical assets	Loss or damage from natural disasters or other events.	A flood, fire, earthquake or terrorist attack on premises.
Business disruption and system failures	Disruption of business or failure of systems.	An IT outage; a failed software update; a power cut.
Execution, delivery and process management	Failed transaction processing or process management, and disputes with counterparties and suppliers.	A payment sent twice; a trade keyed with the wrong amount; missing documents.

It also records where the loss happened, in one of eight business lines: corporate finance, trading and sales, retail banking, commercial banking, payment and settlement, agency services, asset management, retail brokerage. Together they form a grid of 56 cells, and every operational loss a bank records lands in one.

ClassifyOperational loss events, the Basel way

1 / 8

A trader in Example Bank's markets division hides growing losses by booking fictitious trades that appear to offset them.

Event type

Business line

Where does cyber fit? There is no eighth box for cyber risk. A cyber incident is a cause, and it is filed by what it did. Money stolen by hackers is external fraud. An outage is business disruption. Customer data leaked, with fines and compensation, falls under clients, products and business practices. An insider selling data is internal fraud. That is why firms also track cyber as a theme across the grid.

ExploreOne attack, four possible boxes

Click an outcome to see where the loss is filed.

Money stolen

External fraud. In 2016 hackers used Bangladesh Bank's payment messages to steal $81 million.

Where this goes next

M3.6: Operational and non-financial risk covers loss data, scenario analysis, cyber, third-party risk and operational resilience in depth. The capital rules for operational risk are in M4.4: Counterparty, operational and large exposures.

The formal version

Frequency and severity

Operational losses come in two shapes. Some are frequent and small: card fraud, payment errors. Others are rare and huge: rogue trading, a major fine. Risk managers describe each with its frequency and its severity, and the expected annual loss is shown in full:

\text{expected annual loss} = \text{events per year} \times \text{average loss per event}

At Example Bank plc	Frequency	Severity	Expected annual loss
Card fraud	4,000 a year	£800	£3.2m
Rogue trading	once in 50 years	£1bn	£20m

The rogue trading loss has a 2% chance in any year, yet its expected loss is 6.25 times that of card fraud. Card fraud is a predictable cost, priced into the business. The rare, huge loss is what can sink a firm, and it is what operational risk capital is for. These figures are illustrative.

Worked example

Classifying Société Générale's 2008 loss

In January 2008 Société Générale announced a loss of €4.9 billion from unwinding large unauthorised positions built by one trader, Jérôme Kerviel. Work through how its risk team would file it.

One loss, filed step by step

Step 1 of 5

1
Is it operational risk at all?
The money was lost when markets moved against the positions, which sounds like market risk. But the positions should never have existed: they were unauthorised and hidden. Under Basel, losses from failed controls over trading are operational risk, even when a market move turns them into cash.

Regulatory lens

Capital: Basel II (2004) introduced the first capital charge for operational risk. Basel III's standardised approach (2017) replaced the earlier methods: capital grows with the size of the business and, where supervisors allow, with the bank's own past losses.
Management: the Basel Committee's Principles for the Sound Management of Operational Risk and its Principles for Operational Resilience (both 2021) set out what supervisors expect.
Resilience and cyber: the UK requires firms to keep important business services within set tolerances for disruption, and the EU's Digital Operational Resilience Act (DORA) has applied to banks, insurers and other financial firms since January 2025.
Insurers: Solvency II adds an operational risk charge to the capital requirement.

The standardised approach is calculated in M4.4: Counterparty, operational and large exposures.

Sparks

SparkThe bank that sold for £1

Nick Leeson, a trader at Barings in Singapore, hid losses on futures in an error account numbered 88888. By February 1995 they had reached about £827 million, more than the bank's capital. Barings collapsed and was bought by ING for £1. Leeson ran both the trading and the settlement of his own trades: a textbook failure to separate duties.

SparkNot every cell is equal

Industry loss data show that most operational loss events are small execution errors and external frauds, while most of the money is lost in a few huge events, often fines for how clients were treated. Counting events and counting pounds tell two different stories.

Key takeaways

Operational risk: loss from failed processes, people and systems, or external events. It includes legal risk and excludes strategic and reputational risk.
Basel sorts losses into 7 event types and 8 business lines, so loss data can be compared.
Cyber is a cause, not a box: file it by what the attack did (fraud, outage, data breach).
Losses from unauthorised trading are operational risk even though markets moved.
Frequent small losses are a cost of business; rare large ones drive capital and can sink a firm.

Reaction

Check what stuck

Glossary

Operational risk: The risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. It includes legal risk but excludes strategic and reputational risk (Basel Committee).
Legal risk: The risk of loss from lawsuits, fines, penalties or contracts that cannot be enforced.
Conduct risk: The risk that a firm's behaviour harms customers or markets, such as mis-selling or market manipulation.
Cyber risk: Risk from attacks on, or failures of, a firm's information systems and data, deliberate or accidental.
Third-party risk: Risk from relying on outside suppliers, such as cloud providers, payment processors or outsourcers.
Event type: One of the seven Basel categories used to classify an operational loss by what happened.
Business line: One of the eight Basel categories used to record where in a bank an operational loss happened.
Frequency: How often a type of loss happens, for example events per year.
Severity: How large a loss is when it happens.
Operational resilience: A firm's ability to keep delivering its important services through a disruption, and to recover quickly.
Key risk indicator: Key risk indicator: a measure that warns of rising operational risk, such as failed trades or staff turnover.

Deep Dives & Origins

Deep Dives

Leeson, Rogue Trader (Little, Brown, 1996), the story from the inside. Beginner.
Hull, Risk Management and Financial Institutions (Wiley), the chapter on operational risk. Intermediate.
Girling, Operational Risk Management: A Complete Guide for Banking and Fintech, 2nd edition (Wiley, 2022). Intermediate.

Origins

BCBS, International Convergence of Capital Measurement and Capital Standards: A Revised Framework (Basel II), June 2006: the definition of operational risk, Annex 8 (mapping of business lines) and Annex 9 (loss event type classification).
BCBS, Basel III: Finalising post-crisis reforms, December 2017 (standardised approach).
BCBS, Revisions to the Principles for the Sound Management of Operational Risk, March 2021.
BCBS, Principles for Operational Resilience, March 2021.
Regulation (EU) 2022/2554 on digital operational resilience for the financial sector (DORA).
Société Générale, General Inspection Department, “Mission Green” summary report, May 2008.

Watch this lesson

Video version

Prefer to watch? The same lesson as a 10-minute video will sit here, made from this page's script.