Introduction to Operational Risk and Resilience: formula sheet

Key formulas

Basel definition of operational risk

Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events

Includes legal risk. Excludes strategic and reputational risk.

Four causes

Processes | People | Systems | External events

Use these four labels to classify any scenario.

Scope rule

In scope: legal risk, fraud, errors, outages, cyber events. Out of scope: strategic risk, reputational risk

Reputational harm may follow a loss but is not part of the regulatory definition.

Operational risk definition (Basel)

Loss from inadequate or failed internal processes, people and systems, or from external events

Includes legal risk. Excludes strategic and reputational risk.

Seven event types

Internal fraud | External fraud | Employment practices and workplace safety | Clients, products and business practices | Damage to physical assets | Business disruption and system failures | Execution, delivery and process management

Memorise all seven in this form. Each loss is mapped by root cause.

Eight business lines

Corporate finance | Trading and sales | Retail banking | Commercial banking | Payment and settlement | Agency services | Asset management | Retail brokerage

Used to record where the loss arose. One loss maps to one business line and one event type.

Loss grid

Number of cells = 8 business lines × 7 event types = 56

Each cell holds frequency and severity data for that combination.

First line

Business units = own and manage operational risk and controls

Day-to-day identification, assessment, control and reporting.

Second line

Independent risk function = framework design, oversight, challenge, monitoring and reporting

Must be independent of business lines. It does not own the business risks.

Third line

Internal audit = independent assurance on framework and controls

Reports to the board or audit committee. Reviews first and second lines.

Board responsibility

Board = approve framework + set risk appetite and tolerance + periodic review

Oversight, not daily management.

Risk appetite breach logic

Actual risk metric > limit or tolerance → escalate

Appetite is expressed through measurable limits and indicators.

Residual risk

Residual risk = Inherent risk − Effect of controls

Conceptual, not numerical. Used in RCSA: rate risk before controls, rate control effectiveness, then rate what remains.

Risk rating score (typical RCSA)

Score = Likelihood rating × Impact rating

Many banks use this on 1-5 scales. It is a common practice, not a Basel rule.

Framework cycle

Identify → Assess → Control/Mitigate → Monitor → Report

Know the order and which tool supports each stage.

Tool time view

Loss data = past; RCSA, KRIs, scenarios = forward-looking

KRIs are leading indicators; loss events are lagging.

Operational resilience definition

Resilience = deliver critical operations through disruption, within impact tolerance

The test is delivery of the service, not avoidance of the event.

Impact tolerance vs risk appetite

Impact tolerance = maximum tolerable harm after disruption; Risk appetite = risk accepted before events

Tolerance assumes the failure has happened. Appetite looks at likelihood and loss beforehand.

Resilience cycle

Identify critical operations → set tolerances → map dependencies → continuity and controls → test with scenarios → remediate

Good for ordering questions about the sequence.

Recovery time test

Actual recovery time ≤ impact tolerance time

If recovery exceeds tolerance, the firm has a resilience gap to fix.

Basic Indicator Approach (Basel II)

K(BIA) = 15% × average of annual gross income over the last 3 years, counting only years with positive gross income

Divide by the number of positive years, not by 3. Negative or zero years are left out of both numerator and denominator.

Standardised Approach, TSA (Basel II)

K(TSA) = average over 3 years of max[Σ(GI of line i × βi), 0]

Betas: corporate finance 18%, trading and sales 18%, payment and settlement 18%, commercial banking 15%, agency services 15%, retail banking 12%, asset management 12%, retail brokerage 12%. Negative lines can offset positive lines within a year, but the yearly total is floored at zero.

Business Indicator (BI)

BI = ILDC + SC + FC, each averaged over 3 years

BI is the average of the three annual figures and is measured in EUR.

Interest, leases and dividend component

ILDC = min[ |interest income − interest expense| , 2.25% × interest-earning assets ] + dividend income

The cap on net interest stops a large balance sheet from inflating the figure.

Services component

SC = max(other operating income, other operating expense) + max(fee income, fee expense)

Taking the larger side captures gross activity.

Financial component

FC = |net P&L trading book| + |net P&L banking book|

Absolute values: a trading loss still raises the indicator.

Business Indicator Component (BIC)

BI ≤ €1bn: BIC = 12% × BI | €1bn < BI ≤ €30bn: BIC = €120m + 15% × (BI − €1bn) | BI > €30bn: BIC = €4,470m + 18% × (BI − €30bn)

Marginal rates apply only to the part of BI inside each bucket. The 4,470m is 120m + 15% × 29,000m.

Loss component

LC = 15 × average annual operational risk losses over the previous 10 years

Uses net losses after recoveries, above the loss data threshold.

Internal Loss Multiplier

ILM = ln[ e − 1 + (LC ÷ BIC)^0.8 ]

If LC = BIC, ILM = 1. If LC > BIC, ILM > 1. If LC < BIC, ILM < 1. For banks in the lowest bucket (BI up to €1bn), ILM is set to 1.

SMA capital and RWA

Operational risk capital = BIC × ILM; RWA = 12.5 × capital

The 12.5 is the reciprocal of the 8% minimum ratio.

Quick revision

• Operational risk is loss from inadequate or failed processes, people and systems, or external events.
• The Basel definition includes legal risk but excludes strategic and reputational risk.
• Know the Basel event types and match each to a short example.
• Internal fraud involves staff; external fraud involves outsiders.
• First line owns and manages risk; second line oversees and challenges; third line gives independent assurance.
• Internal audit is the third line and does not manage day-to-day risk.
• Risk and control self-assessment, key risk indicators, loss data and scenario analysis are core tools.
• Loss data looks backward; scenario analysis looks forward but is judgmental.
• Operational resilience focuses on delivering critical services through disruption, not only on avoiding loss.
• Impact tolerance is the maximum disruption you can accept for a critical service.
• Operational risk capital is part of the Basel regulatory capital framework.
• In case questions, classify the event first, then pick the control or role.

Common mistakes

• Saying the Basel definition includes reputational risk Fix: Remember: legal risk in, strategic and reputational risk out.
• Excluding legal risk from the definition Fix: The Basel definition explicitly includes legal risk, such as fines and settlements.
• Classifying an employee's accidental error as internal fraud Fix: Fraud needs intent to deceive or misappropriate. Accidental errors belong to execution, delivery and process management.
• Putting mis-selling under execution, delivery and process management Fix: If the harm comes from improper product advice or suitability failures toward clients, use clients, products and business practices.
• Saying the risk function owns operational risk. Fix: The first line owns risk. The second line oversees and challenges.
• Thinking internal audit is part of the second line. Fix: Audit is the third line. It gives assurance on the first and second lines and reports to the board or audit committee.
• Saying RCSA and scenario analysis are the same thing Fix: RCSA covers many routine risks and controls in a unit. Scenario analysis builds a few severe, rare events and estimates frequency and loss.
• Treating KRIs as lagging measures Fix: KRIs are usually leading. They signal rising risk before losses occur, and thresholds trigger escalation.
• Treating impact tolerance as the same as risk appetite Fix: Appetite is about risk taken before events. Tolerance is the maximum disruption accepted once an event has happened.
• Defining critical operations by revenue only Fix: Define them by the harm their failure causes to customers, the firm's safety and soundness, or financial stability.

Exam tips

• Know the Basel wording well enough to spot options that add reputational or strategic risk.
• In case questions, classify by root cause, not by where the loss shows in the accounts.
• Expect scenarios built on the four causes: process, people, systems and external events.
• When asked to distinguish risks, state what drives the loss: price moves, borrower default, funding stress or internal failure.
• Expect short scenarios with four event types as options. Decide on intent and actor first.
• Watch for traps where the effect (outage, fine) differs from the root cause.
• Remember the Basel definition excludes strategic and reputational risk but includes legal risk.
• Know both lists by heart: seven event types and eight business lines.