Operational Risk: formula sheet

Key formulas

Basel definition of operational risk

Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events

Includes legal risk. Excludes strategic and reputational risk.

Seven Basel event types

1 Internal fraud | 2 External fraud | 3 Employment practices and workplace safety | 4 Clients, products and business practices | 5 Damage to physical assets | 6 Business disruption and system failures | 7 Execution, delivery and process management

Memorise the names. Questions give a scenario and ask for the category.

Four causes in the definition

Processes + People + Systems + External events

A loss from any of these four sources is operational.

Three lines of defense

1st line = own and manage risk | 2nd line = oversee, challenge, frame | 3rd line = independent assurance

Internal audit is always the third line. The risk function must stay independent of the business it oversees.

Board vs management

Board = approves framework and risk appetite | Senior management = implements and resources it

Board approves and oversees. It does not run day-to-day controls.

Risk appetite vs tolerance

Appetite = amount and type of risk accepted | Tolerance = acceptable deviation, set through limits, KRIs and triggers

Appetite is broad and strategic. Tolerance is operational and measurable.

Core framework tools

Identify and assess: RCSA, loss data, scenario analysis, KRIs | Respond: control, mitigate, transfer, avoid, accept

Remember them as the toolkit behind the Basel identification and assessment principle.

Residual risk

Residual risk = Inherent risk − Effect of controls

A conceptual relationship, not a precise calculation. Rated qualitatively or on a scale in RCSA.

Expected annual loss for a risk

Expected annual loss = Frequency per year × Average severity

Used in scenario analysis and risk ranking. Assumes the frequency and severity estimates are for the same event type.

Tool orientation

Loss data = backward-looking; RCSA, scenarios, KRIs = forward-looking

The most tested distinction. Loss data is objective but weak on rare events; scenarios cover the tail but are subjective.

KRI versus KPI

KRI = signals rising risk; KPI = signals performance against target

A KRI should have thresholds that trigger escalation.

Basic indicator approach

K(BIA) = α × [Σ(GI₁…ₙ) ÷ n], α = 15%

GI is annual gross income. Include only years where GI is positive; n is the number of those years, out of the previous three.

Standardized approach

K(TSA) = {Σ over years 1–3 of max[Σ(GI × β), 0]} ÷ 3

β = 12%, 15% or 18% depending on the business line. Yearly total floored at zero in Basel II.

Beta factors by business line

18%: corporate finance, trading and sales, payment and settlement; 15%: commercial banking, agency services; 12%: retail banking, asset management, retail brokerage

Eight business lines in total. Learn the 18% group first.

SMA capital

K(SMA) = BIC × ILM

For banks in the larger size bucket. BIC comes from the business indicator with increasing marginal coefficients. ILM reflects average historical loss relative to BIC.

Risk-weighted assets equivalent

RWA = 12.5 × operational risk capital

Capital is converted to RWA by multiplying by 12.5 (1 ÷ 8%).

Poisson frequency

P(N = n) = e^(-λ) × λ^n ÷ n!

Mean and variance both equal λ. P(N = 0) = e^(-λ).

Aggregate loss

S = X1 + X2 + ... + XN

Assumes severities are i.i.d. and independent of N.

Expected aggregate loss

E[S] = E[N] × E[X]

Holds when N is independent of the i.i.d. severities.

Variance of aggregate loss

Var(S) = E[N] × Var(X) + Var(N) × (E[X])²

For Poisson frequency this simplifies to Var(S) = λ × E[X²], where E[X²] = Var(X) + (E[X])².

Lognormal severity mean

E[X] = exp(μ + σ²/2)

μ and σ are the mean and standard deviation of ln X, not of X. The median is exp(μ).

Operational VaR

VaR(α) = the α-quantile of S

Basel AMA used α = 99.9% over one year.

Unexpected loss

UL = VaR(α) − E[S]

Capital is intended to cover UL.

Single-loss approximation

VaR(α) ≈ F⁻¹(1 − (1 − α) ÷ λ)

F is the severity CDF. It is an approximation for heavy-tailed severity and high α, with Poisson frequency. It is not exact.

Net loss after insurance

Net loss = Gross loss − Insurance recovery (after deductible, up to the policy limit)

Recovery = min(max(Loss − Deductible, 0), Policy limit), assuming a simple policy with no co-insurance.

Operational risk categories (Basel event types)

Internal fraud; External fraud; Employment practices and workplace safety; Clients, products and business practices; Damage to physical assets; Business disruption and system failures; Execution, delivery and process management

Match each case to one category; Barings and Société Générale are internal fraud.

Control layers

Prevent → Detect → Respond → Transfer

Use this order to match a failure to the right mitigation.

Expected value of an insured loss

Expected net loss = Σ (probability × net loss after recovery)

Use it to compare retained loss with and without insurance.

Quick revision

• Operational risk is loss from inadequate or failed processes, people, systems, or external events.
• Basel's definition includes legal risk but excludes strategic and reputational risk.
• Know the Basel event types, such as internal fraud, external fraud, and damage to physical assets.
• Three lines of defense: business units, independent risk function, internal audit.
• Risk appetite and tolerance are set by the board and shape limits and indicators.
• Key risk indicators are forward-looking signals; loss data is backward-looking.
• Risk and control self-assessments rely on business judgment and can be biased.
• Capital approaches move from simple formulas to more risk-sensitive measures; know the inputs of each.
• Expected loss for a period = expected frequency × expected severity.
• Frequency is usually modeled with a count distribution and severity with a fat-tailed one.
• Capital is based on a high percentile of the aggregate loss distribution, less expected loss where the rules allow.
• In case studies, find the control failure first, then match the mitigation.

Common mistakes

• Including reputational and strategic risk in the Basel definition. Fix: Remember legal risk is in, strategic and reputational risk are out.
• Classifying a rogue trader loss as market risk. Fix: Look at the root cause. Unauthorised, concealed trading is internal fraud.
• Putting the operational risk management function in the first line. Fix: It is the independent second line. The first line is the business and its support functions, which own the risk.
• Saying internal audit owns or manages operational risk controls. Fix: Audit gives independent assurance as the third line. It does not own risk or design day-to-day controls.
• Treating KRIs and KPIs as the same thing. Fix: Ask what the metric signals. A KRI warns about rising risk and has escalation triggers. A KPI tracks performance against a target.
• Calling loss event data forward-looking. Fix: Loss data is historical. It is objective but thin on rare, severe events, so scenarios and external data supplement it.
• Dividing by three when one year has negative gross income under BIA. Fix: Exclude non-positive years from both numerator and denominator.
• Using 15% for every business line under the standardized approach. Fix: Look up each line's beta: 12%, 15% or 18%.
• Using Var(S) = λ × Var(X) for a Poisson frequency. Fix: Use λ × E[X²], which equals λ × (Var(X) + (E[X])²). The general form is E[N] × Var(X) + Var(N) × (E[X])².
• Treating μ in a lognormal as the mean loss. Fix: μ and σ describe ln X. The mean loss is exp(μ + σ²/2) and the median is exp(μ).

Exam tips

• Learn the seven names in order and attach one example to each. Questions give a scenario, not the label.
• Always classify by root cause, not by where the loss appears in the accounts.
• Memorise the inclusion and exclusion: legal risk in, strategic and reputational risk out.
• Watch for distractors that are really market or credit events dressed up as operational ones.
• Expect the paper to be 100 multiple-choice questions in 4 hours. This topic usually needs only a quick classification, so do not spend long on it.
• Learn each function's verb: first line owns, second line challenges and designs, third line assures, board approves, management implements.
• When a question stresses independence or reporting to the audit committee, the answer is usually internal audit.
• Questions on Basel principles are usually conceptual. Match the scenario to the theme, such as culture, appetite or reporting, instead of recalling principle numbers.