Know these first
- L2.3.04: The three lines model
- L2.3.05: Risk appetite frameworks
- L2.4.01: The risk management cycle
- L2.4.07: Risk reporting
By the end you will be able to
- 1Map a bank's own risk categories to the seven Basel event types, and say why banks keep both.
- 2Assign the tasks of an operational risk framework to the first, second and third lines and to the board.
- 3Describe the yearly cycle (appetite, RCSA, KRIs, loss data, scenarios, reporting) and how each tool feeds the others.
- 4Read a bank's operational risk profile against its appetite.
Why it matters
Before the October 2025 payments outage, RiskAtoms Bank's tools had all seen something. The platform availability indicator went red in August. The RCSA rated failed IT change as a High inherent risk. In September a control test found 11 critical patches overdue, three of them on payments servers. Afterwards the loss data recorded £18.4m. Each tool worked; the question is whether they talked to each other in time. That is what a framework is for.
Core explanation
One framework, many tools
An operational risk management framework is the bank's answer to five questions: what risks it has (a taxonomy), who does what (the three lines), how much risk it accepts (appetite), which tools it uses (RCSA, indicators, loss data, scenarios), and who hears about it (reporting). The Basel Committee's Principles for the Sound Management of Operational Risk, revised in March 2021, set out twelve principles that supervisors check against:
| # | Principle | Where |
|---|---|---|
| 1 | Culture: the board leads a strong risk management culture, implemented by senior management | L2.3.08: Risk culture and incentives |
| 2 | Framework: a documented ORMF, integrated into overall risk management | This lesson |
| 3 | The board approves and regularly reviews the framework | L2.3.02: The board and its risk committee |
| 4 | The board approves an operational risk appetite and tolerance statement | This lesson |
| 5 | Senior management develops a clear governance structure, for the board to approve | L2.3.03: The CRO and the risk function |
| 6 | Risk is identified and assessed in all material products, activities, processes and systems | L3.7.04: Controls: design, testing and assurance |
| 7 | Change is managed through a comprehensive, resourced process | L3.7.09: Technology and change risk |
| 8 | The risk profile is monitored and reported at all levels | L3.7.05: Key risk indicators in practice |
| 9 | A strong control environment, with mitigation or transfer where it fits | L3.7.04: Controls: design, testing and assurance |
| 10 | A robust ICT risk management programme | L3.7.08: Cyber risk |
| 11 | Business continuity plans | L3.7.16: Business continuity and crisis management |
| 12 | Public disclosure of the approach and exposure | L3.7.07: Measuring frequency and severity |
The taxonomy: the bank's categories and the Basel types
The seven event types say what happened (L3.7.01: What operational risk is). Banks manage risk by who owns it and which controls hold it back, so they keep a taxonomy of their own. RiskAtoms Bank has eleven categories, each mapped to the event types its losses are reported under. The table shows the ten years of net losses (£m) in each cell the mapping allows; a dot marks an allowed cell with no losses yet.
| Category | IF | EF | EPWS | CPBP | DPA | BDSF | EDPM | Total |
|---|---|---|---|---|---|---|---|---|
| Cyber and information security | – | 8.1 | – | · | – | 0.4 | – | 8.5 |
| Technology and change | – | – | – | – | – | 21.5 | · | 21.5 |
| Third party and outsourcing | – | – | – | – | – | 3.0 | 1.7 | 4.8 |
| Fraud | 8.8 | 8.7 | – | – | – | – | – | 17.5 |
| Financial crime | – | – | – | 28.1 | – | – | – | 28.1 |
| Conduct | – | – | – | 128.6 | – | – | – | 128.6 |
| Legal and regulatory compliance | – | – | – | 1.7 | – | – | · | 1.7 |
| Model | – | – | – | · | – | – | 10.7 | 10.7 |
| Transaction processing and execution | – | – | – | – | – | – | 10.2 | 10.2 |
| People | – | – | 8.1 | – | – | – | – | 8.1 |
| Physical assets and premises | – | – | – | – | 0.9 | – | – | 0.9 |
| All | 240.5 |
Columns: IF internal fraud; EF external fraud; EPWS employment and safety; CPBP clients and products; DPA physical assets; BDSF disruption and systems; EDPM execution and process.
6 of the eleven categories feed more than one type. Cyber is the clearest case: stolen money is external fraud, a system taken down is business disruption, a data breach fine is clients, products and business practices. The bank's 91 cyber losses (£8.5m) so far sit in only two of its three columns; the data breach cell is empty, which is exactly why a scenario covers it (L3.7.06: Scenario analysis). The mapping lets the bank report by event type to supervisors and by category to the people who own the risks.
Who does what: the three lines in operational risk
L2.3.04: The three lines model set out the three lines in general. In operational risk the 2021 principles name them directly. The first line is business unit management: it identifies and manages the risks in its activities, runs the controls, records events and reports its residual risks. The second line is a functionally independent corporate operational risk function: it sets the policies and tools, challenges how the first line uses them and forms its own view of the risk profile. The third line, internal audit, gives the board independent assurance that the framework is designed and working well. The board approves the framework and the appetite.
Sort itWhose job is it?
Each task is part of RiskAtoms Bank's operational risk framework.
Record the October payments outage in the loss database, with its dates, costs and root cause.
Run the call-back to a known number before a payee's bank details are changed.
Challenge the payments team's rating of its change control as 'effective'.
Set the taxonomy, the loss data policy and the rules for KRI thresholds.
Review whether the whole framework, including the second line's challenge, is working, and report to the audit committee.
Approve the operational risk appetite and tolerance statement.
The yearly cycle
The tools run on a calendar: the RCSA once a year and after big changes, indicators every month, events as they happen, scenario workshops once a year, reports every quarter and the appetite once a year. The point is that each feeds the next.
ExploreHow the tools feed each other
Click a step to see what it does at RiskAtoms Bank and what it passes on.
Appetite
The board sets how much operational loss and which ratings it will accept. RiskAtoms Bank's illustrative statement: net losses below £30m a year, never above £50m; no more than 3 key risks rated High after controls; overdue actions below 10%. Everything below is measured against it.
Illustrative dataRiskAtoms Bank plc's operational risk book
The same £67bn bank as Modules 3.5 and 3.6, at 31 December 2025, in pounds: ten years of internal loss events of £10,000 or more (2016–2025), an RCSA of 17 key risks and 29 controls, ten key risk indicators over 24 months, seven workshop scenarios and five important business services. Every event, person, supplier and figure is made up for teaching; none is any bank's data. The same book runs through every lesson in Module 3.7, so the figures agree.
The appetite figures in this lesson are an illustrative extra for teaching. They are not in the book; they only read its losses, ratings, indicators and actions.
Try it
Setting an appetite is a judgement. Move the appetite and tolerance for annual net losses and see how the bank's ten years would have been reported. What level makes the board pay attention in the right years, without crying wolf?
Try itSet the bank's loss appetite
The appetite and tolerance are illustrative, not part of the book; the losses are the book's, by year booked. Set an appetite low enough to be breached most years and it stops meaning anything; set it above every year but 2018 and the board learns nothing from 2019 or 2023. The tolerance is never set below the appetite here.
Worked example
The December 2025 risk profile report
The head of operational risk presents the year-end report to the board risk committee. Each section reads one tool against the appetite. Decide what you would flag before you open each step.
Five sections, one profile
Step 1 of 5- 1
Losses
102 operational losses booked in 2025, £29.3m net: 98% of the £30m appetite. Two events made most of it: the payments outage (£18.4m) and the email-compromise fraud (£5.1m). Over ten years the bank was above appetite in 3 years and beyond tolerance in 1 (2018, the redress provision). Status: within, with almost no headroom.
Regulatory lens
The Basel Committee's Revisions to the Principles for the Sound Management of Operational Risk (March 2021) are what supervisors check a framework against: the three lines of defence (paragraphs 9 to 12), the appetite and tolerance statement (Principle 4) and the tools in paragraph 35 (event management, loss data, self-assessments, control monitoring, metrics, scenario analysis and comparative analysis). Operational resilience, a close neighbour, is in L3.7.15: Operational resilience; how the loss data and the business indicator set capital is in L3.7.07: Measuring frequency and severity and M4.4: Counterparty, operational and large exposures.
Spark Atoms
Spark AtomPrinciples that were not followed
Spark AtomThe empty cell
Key takeaways
- A framework answers five questions: which risks (taxonomy), who does what (three lines), how much (appetite), with which tools, and who hears about it (reporting).
- Banks keep their own categories and map them to the seven Basel event types: 6 of RiskAtoms Bank's eleven feed more than one type.
- The first line owns risks and controls and records events; the second line sets the tools and challenges; internal audit assures the board; the board approves appetite.
- The tools feed each other: RCSA names the controls and KRIs, events test the RCSA, scenarios cover what the data has not shown, and reporting resets the appetite.
- In December 2025 the bank was within its loss appetite (98% used) but in breach on High residual risks (4 against 3) and overdue actions (25%).
Reaction
Check what stuck
Question 1 · objective 1
Why does RiskAtoms Bank keep its own risk categories instead of reporting only the seven Basel event types?
Question 2 · objective 2
Who should challenge the payments team's own rating of its change control as 'effective'?
Question 3 · objective 3
The bank's illustrative appetite is £30m of net operational losses booked in a year. In 2025 it booked £29.28m. What share of the appetite was used, in %?
Question 4 · objective 3
At 31 December 2025 the bank has 8 open control actions, of which 2 are past their due date. What share is overdue, in %?
Question 5 · objective 3
Which tool tells the bank about a severe event it has never suffered?
Glossary
- Operational risk management framework
- Operational risk management framework (ORMF): the policies, roles, tools and reports through which a bank identifies, assesses, controls, monitors and reports its operational risk.
- Risk taxonomy
- Risk taxonomy: the bank's own list of risk categories, used in every tool so that losses, controls, indicators and scenarios can be added up and compared.
- Corporate operational risk function
- Corporate operational risk function (CORF): the independent second-line team that sets the framework, challenges the business and forms its own view of the risk profile.
- Risk appetite
- Risk appetite: the amount and kinds of risk a firm is willing to take in pursuit of its goals. For operational risk it is usually set as limits on losses, ratings and indicators.
- Risk tolerance
- Risk tolerance: the outer limit the firm will not exceed, beyond the appetite. Here, an annual loss that must never be passed.
- Risk profile
- Risk profile: the firm's risk at a point in time, read from all the tools together: ratings, indicators, losses, actions and scenarios.
- RCSA
- Risk and control self-assessment (RCSA): each business area rates its risks before and after controls and assesses its controls, challenged by the second line.
- Key risk indicator
- Key risk indicator (KRI): a regularly measured number, with thresholds, that shows whether a risk is growing.
- Scenario analysis
- Scenario analysis: expert workshops that estimate rare, severe events the loss data has not yet shown, as a frequency and a loss.
- Event management
- Event management: recording, analysing and reporting an operational event from discovery to closure, including its root cause.
Deep Dives & Origins
Deep Dives
- Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, BIS, March 2021: the twelve principles, the three lines and the tools in paragraph 35. Intermediate.
- The Institute of Internal Auditors, The IIA's Three Lines Model: An Update of the Three Lines of Defense, 2020. Introductory.
Origins
- Basel Committee on Banking Supervision, Revisions to the Principles for the Sound Management of Operational Risk, Bank for International Settlements, 31 March 2021, paragraphs 9 to 12, 26 and 35.
- Basel Committee on Banking Supervision, publication page for the 2021 revisions (BCBS d515), BIS: the 2003 and 2011 versions and the 2014 review.
- The Institute of Internal Auditors, The IIA's Three Lines Model: An Update of the Three Lines of Defense, position paper, July 2020 (updated September 2024).
Watch this lesson
Video version
Prefer to watch? The same lesson as a 12-minute video will sit here, made from this page's script.