CMA Final · Risk Management in Banking and Insurance

Operational Risk and Off-Balance Sheet Risk: formula sheet

Full chapter guide

Key formulas

Basel definition: Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Four sources (causes): People + Processes + Systems + External events; Use these as the cause lens for any scenario.
Seven Basel event types: 1 Internal fraud; 2 External fraud; 3 Employment practices and workplace safety; 4 Clients, products and business practices; 5 Damage to physical assets; 6 Business disruption and system failures; 7 Execution, delivery and process management; Use these as the loss-classification lens.
Residual risk (qualitative RCSA): Residual risk = Inherent risk − effect of controls; This is a concept, not an exact arithmetic formula. Rate inherent risk first, then adjust for control effectiveness.
Risk rating score (common scoring approach): Risk score = Likelihood score × Impact score; A usual scoring method in RCSA. The scales (such as 1 to 5) are set by each bank's policy.
Net loss from an event: Net loss = Gross loss − Recoveries; Loss databases usually record both gross loss and recoveries (such as insurance recoveries).
Framework cycle: Identify → Assess → Monitor → Control/Mitigate → Report; Use this as the skeleton for any descriptive answer.
Three lines of defence: 1st: business units own risk | 2nd: risk and compliance oversee | 3rd: internal audit assures; Do not mix up roles. Audit is independent of both of the other lines.
Basic Indicator Approach: K(BIA) = [Σ(GI₁ … GIₙ) × α] ÷ n, with α = 15%; GI is annual gross income, only for the previous three years in which it was positive. n is the number of those years. Years with zero or negative income are left out of both numerator and denominator.
Standardised Approach: K(TSA) = {Σ years 1-3 max[Σ(GI₁₋₈ × β₁₋₈), 0]} ÷ 3; Eight business lines. In any year, negative capital in one line can offset positive capital in another, but a negative yearly total is set to zero (and still counted in the divisor of 3).
Beta factors (Basel II): 18%: corporate finance, trading and sales, payment and settlement | 15%: commercial banking, agency services | 12%: retail banking, asset management, retail brokerage; Learn the three groups. This is the most tested fact in numericals.
Gross income: Gross income = Net interest income + Net non-interest income; Taken gross of provisions and operating expenses, and excluding realised profits from sale of securities in the banking book and extraordinary or insurance income.
Capital in risk-weighted terms: Operational risk RWA = Capital charge × 12.5; 12.5 is the reciprocal of the 8% minimum capital ratio used in Basel II.
Core test for an OBS item: OBS item = contingent obligation or right, no funding at inception, may become an on-balance sheet claim on a trigger event; Use this to decide whether an item belongs under OBS.
Credit-equivalent amount (link to capital): Credit-equivalent amount = Notional or face amount × Credit conversion factor (CCF); The CCF values are covered in the related topic. Do not quote percentages here unless the question gives them.
Risk-weighted exposure: Risk-weighted amount = Credit-equivalent amount × Risk weight of the counterparty; Used when a question asks for capital on an OBS item.
Credit equivalent amount (funded-style exposure): Credit equivalent = Notional amount × Credit conversion factor (CCF); Applied to non-market-related OBS items such as guarantees and undrawn commitments. Risk-weighted asset = credit equivalent × risk weight of the counterparty.
Current exposure on a derivative: Current exposure = max(Mark-to-market value, 0); The bank loses only if the contract has a positive value to it when the counterparty defaults. A negative value means no loss from default on that contract.
Potential exposure add-on: Credit equivalent of derivative = Current exposure + Potential future exposure add-on; Add-on is notional × a factor based on contract type and maturity. This is the current exposure method idea.
Net exposure with netting: Net exposure = max(Σ MTM values under a legally enforceable netting agreement, 0); Netting is allowed only where the agreement is legally enforceable. Without it, sum only the positive values.
Credit equivalent amount (non-market items): Credit equivalent amount = Notional amount × CCF; Used for guarantees, letters of credit, commitments and similar items.
Risk weighted asset: RWA = Credit equivalent amount × Risk weight of counterparty; Apply the risk weight of the counterparty, or of the eligible guarantor or collateral where credit risk mitigation applies.
Capital required: Capital required = RWA × Capital ratio; Use the ratio stated in the question, for example 9%.
Current exposure method: Credit equivalent amount = Replacement cost + (Notional × Add-on factor); Replacement cost = the greater of mark-to-market value and zero. A negative mark-to-market gives zero replacement cost, but the add-on still applies.
Typical RBI CCFs (non-market items): Direct credit substitutes (financial guarantees, acceptances): 100%. Transaction-related contingents (performance and bid guarantees): 50%. Short-term self-liquidating trade items (documentary credits secured by shipments): 20%. Commitments up to 1 year: 20%; over 1 year: 50%. Unconditionally cancellable commitments: 0%.; Learn the pattern: the more the item looks like a loan, the higher the CCF. Confirm against the table in your study material.
Add-on factors (illustrative pattern): Illustrative interest rate add-ons: residual maturity up to 1 year: 0%. Over 1 to 5 years: 0.5%. Over 5 years: 1.0%.; The add-on rises with residual maturity. Treat these figures as illustrative, not as the RBI table. Exchange rate and gold contracts carry higher add-ons. Always use the add-ons given in the question or in your study material.

Quick revision

Operational risk is loss from inadequate or failed internal processes, people, systems, or from external events.
Operational risk definitions in banking regulation typically include legal risk but exclude strategic and reputational risk.
Sources of operational risk: people, processes, systems and external events.
Management framework: identify, assess, control, monitor and report.
Capital approaches for operational risk range from simple to advanced; the advanced ones use more of the bank's own data.
Off-balance sheet items are contingent or commitment-type exposures not shown as assets or liabilities in the balance sheet.
Common examples: guarantees, letters of credit, undrawn loan commitments and derivative contracts.
Off-balance sheet items can carry credit, market, liquidity and operational risk.
Credit equivalent amount = notional amount × credit conversion factor.
Risk-weighted amount = credit equivalent amount × risk weight of the counterparty.
A higher credit conversion factor means the item is treated as closer to a funded exposure.
Always use the factors and approaches given in your prescribed material for the exam.

Common mistakes

Saying operational risk includes reputational and strategic risk. Fix: Remember the Basel definition includes legal risk but excludes strategic and reputational risk.
Classifying a clerk's data-entry error as internal fraud. Fix: Fraud needs intent to defraud or misappropriate. An unintentional error is execution, delivery and process management.
Treating internal audit as part of the second line, or as the owner of risk. Fix: Remember: business owns, risk and compliance oversee, audit assures independently.
Saying KRIs record losses that have already happened. Fix: KRIs are forward-looking early-warning indicators. Loss data records actual past events.
Dividing by 3 under BIA even when one year has negative income. Fix: Under BIA, drop non-positive years and divide by the number of positive years only.
Using the wrong beta for a business line, for example 15% for retail banking. Fix: Remember the groups: 18% for the three market and wholesale lines, 15% for commercial banking and agency, 12% for retail, asset management and retail brokerage.
Saying OBS items carry no risk because they are not on the balance sheet. Fix: State that the exposure is contingent, not absent. It can become a funded claim on a trigger event.
Treating the notional amount of a derivative as the amount at risk. Fix: Notional is only a reference amount. The exposure is the replacement cost or credit-equivalent amount.
Treating the notional amount of a derivative as the amount at risk. Fix: The loss on counterparty default is the replacement cost (positive MTM plus potential exposure), usually far below notional.
Saying OBS items carry no risk because they are not on the balance sheet. Fix: Say they are contingent liabilities that can turn into funded exposures and need capital and monitoring.

Exam tips

Write the Basel definition almost word for word. Examiners reward the exact elements: processes, people, systems, external events, and legal risk included.
In case scenarios, name both the source and the event type. One word each is enough for an MCQ; add a reason in descriptive answers.
Learn the seven event types in order with a keyword each: internal fraud, external fraud, employment, clients and products, physical assets, disruption and systems, execution and process.
Expect trick options that place reputational or strategic risk inside operational risk. Reject them.
Give Indian examples such as a branch fraud, a UPI or core banking outage, or a cyber attack to make answers concrete.
Learn the three lines of defence as a one-line role each. Case MCQs often test which line does what.
Keep the definition word-perfect, including that legal risk is included and strategic and reputational risk are excluded.
In descriptive answers, structure with the cycle: identify, assess, monitor, control, report. It gives clear headings and easy marks.