Risk Management in Banking and Insurance · Operational Risk and Off-Balance Sheet Risk

Operational Risk in Banking: Meaning, Sources and Types

Updated 11 October 2026 · Fact-checked

Under Basel norms, operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk. To solve questions, identify the cause (people, process, system, external), then map the loss to one of the seven event types.

Understand Operational Risk: Meaning, Sources and Types

Every bank runs on people, procedures and technology. When any of these fails, the bank can lose money even if no borrower defaults and no market price moves. That loss is operational risk.

The Basel Committee defines it as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. The definition includes legal risk, such as fines, penalties and settlements. It excludes strategic risk and reputational risk. Reputational damage may follow an operational loss, but it is not counted inside the definition.

Think of four sources. People: fraud, errors, lack of skill, breach of authority. Processes: weak controls, poor procedures, wrong documentation, failed reconciliation. Systems: software failure, hardware breakdown, cyber attack, poor data quality. External events: theft, natural disaster, vendor failure, regulatory change, outside fraud.

Basel classifies losses into seven event types. This lets banks collect loss data in a common format and compare it. The seven are: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management.

Operational risk is hard to measure because losses are infrequent but can be very large. It is present in every activity of the bank, so it is managed through controls, culture and loss data, not only through capital.

Key rules to remember

Basel definition: Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Four sources (causes): People + Processes + Systems + External events; Use these as the cause lens for any scenario.
Seven Basel event types: 1 Internal fraud; 2 External fraud; 3 Employment practices and workplace safety; 4 Clients, products and business practices; 5 Damage to physical assets; 6 Business disruption and system failures; 7 Execution, delivery and process management; Use these as the loss-classification lens.

How to solve Operational Risk: Meaning, Sources and Types questions

Use this method for any question that asks you to define, explain or classify operational risk.

1Start with the Basel definition in one sentence, naming processes, people, systems and external events.
2Mention that legal risk is included and strategic and reputational risk are excluded.
3Read the scenario and find what actually failed: a person, a process, a system or an outside event.
4Match the loss to one of the seven event types. Ask: who caused it, and what kind of loss is it?
5Where several types fit, choose the one that best describes the root cause and say why.
6Add a short consequence: financial loss, penalty, customer harm or disruption.
7Close with one control or mitigation, such as segregation of duties, access control or a business continuity plan.

Quickest way: Cause first, then event type

When to use it: Use for MCQs and case-scenario questions where you must classify a loss quickly.

Underline the failure in the scenario.
Ask: insider or outsider? Insider intentional is internal fraud; outsider intentional is external fraud.
If it is unintentional error in processing, settlement or documentation, choose execution, delivery and process management.
If it is mis-selling, breach of fiduciary duty or client suitability, choose clients, products and business practices.
If it is system or utility outage, choose business disruption and system failures; if physical damage from fire or flood, choose damage to physical assets.
Staff discrimination, safety or compensation claims point to employment practices and workplace safety.

Common mistakes in Operational Risk: Meaning, Sources and Types

Saying operational risk includes reputational and strategic risk.
Students assume it covers every non-financial risk.
Fix: Remember the Basel definition includes legal risk but excludes strategic and reputational risk.
Classifying a clerk's data-entry error as internal fraud.
Both involve an employee.
Fix: Fraud needs intent to defraud or misappropriate. An unintentional error is execution, delivery and process management.
Treating a cyber attack by hackers as internal fraud or a system failure only.
Technology is involved, so students think of systems.
Fix: An attack by outsiders is external fraud. Say that weak system security was the contributing cause.
Listing only the event types and ignoring the four sources.
Students memorise the seven-item list alone.
Fix: Answer in two layers: source (people, process, systems, external) and then event type.
Placing mis-selling of products under external fraud.
The customer is an outsider and is harmed.
Fix: Mis-selling by the bank's staff or product design falls under clients, products and business practices.

Worked examples

Example 1

A branch officer of an Indian bank approves a loan using forged documents and diverts part of the money to a relative. Identify the source of the operational risk and the Basel event type, and suggest two controls.

Show the solution

The failure is by a person, an employee of the bank. So the source is people.
The act is intentional misappropriation and breach of bank policy by an insider.
This matches internal fraud.
Controls: segregation of duties between sanction and disbursement, and independent verification of documents with rotation and surprise audits.

Answer: Source: people. Event type: internal fraud. Controls: segregation of duties and independent verification with rotation and surprise audits.

Example 2

A bank's core banking system is down for a full day because of a data centre power failure. Customers cannot transact and the bank pays compensation. Classify the event and explain the source and the consequences.

Show the solution

The failure is in technology infrastructure, so the source is systems, with an external trigger in the power supply.
The loss is due to an outage that disrupts service, so the event type is business disruption and system failures.
Consequences: compensation paid, lost fee income, possible regulatory attention and customer dissatisfaction. Only the direct losses are operational loss; loss of reputation is outside the Basel definition.
Mitigation: backup power, a disaster recovery site and a tested business continuity plan.

Answer: Source: systems (with an external trigger). Event type: business disruption and system failures. Mitigation: backup power, disaster recovery site and a tested business continuity plan.

Exam tips

Write the Basel definition almost word for word. Examiners reward the exact elements: processes, people, systems, external events, and legal risk included.
In case scenarios, name both the source and the event type. One word each is enough for an MCQ; add a reason in descriptive answers.
Learn the seven event types in order with a keyword each: internal fraud, external fraud, employment, clients and products, physical assets, disruption and systems, execution and process.
Expect trick options that place reputational or strategic risk inside operational risk. Reject them.
Give Indian examples such as a branch fraud, a UPI or core banking outage, or a cyber attack to make answers concrete.

Practice questions from Operational Risk and Off-Balance Sheet Risk

Operational Risk: Meaning, Sources and Types: frequently asked questions

What is operational risk in banking?

It is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Examples are employee fraud, system outages and processing errors.

What are the seven Basel event types of operational risk?

They are internal fraud, external fraud, employment practices and workplace safety, clients, products and business practices, damage to physical assets, business disruption and system failures, and execution, delivery and process management.

Is reputational risk part of operational risk?

No. The Basel definition includes legal risk but excludes strategic and reputational risk. Reputational damage may follow an operational loss, but it is treated separately.

How is a data-entry error different from internal fraud?

Internal fraud involves intentional wrongdoing by an insider. A data-entry error is unintentional and falls under execution, delivery and process management.