Skip to content

FRM Exam Part I · Operational Risk

Operational Risk Definition and Event-Type Categories

Updated 11 October 2026 · Fact-checked

Under Basel, operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk. Basel groups losses into seven event types. To answer questions, match the loss cause to one event type.

Understand Operational Risk Definition and Categories

Operational risk is the risk that something inside the firm breaks, or something outside hits it, and you lose money. A clerk keys in the wrong amount. A system goes down. A trader hides losses. A flood closes a data centre. None of these is a bet on prices or a borrower's failure. They are failures of how the business runs.

The Basel definition has three parts you must know. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk. It excludes strategic risk and reputational risk. Legal risk covers fines, penalties and punitive damages from supervisory action, as well as private settlements.

Basel sorts operational losses into seven event types. They are: (1) Internal fraud, (2) External fraud, (3) Employment practices and workplace safety, (4) Clients, products and business practices, (5) Damage to physical assets, (6) Business disruption and system failures, (7) Execution, delivery and process management. The test is who caused the loss and how. Insiders acting against the firm point to internal fraud. Outsiders point to external fraud. Mis-selling or breach of duty to clients points to category 4. Mistakes in processing trades or payments point to category 7.

Operational risk differs from market and credit risk in important ways. Market risk comes from price moves, and credit risk from a counterparty failing to pay. Both are usually taken on deliberately to earn a return. Operational risk is generally not rewarded: the firm takes it on as a by-product of doing business. It is also harder to measure, because data are scarce, losses are skewed with fat tails, and causes are varied. Large losses are rare but can be severe.

The boundaries can blur. A trader who exceeds limits and hides losses creates an operational event (internal fraud) that shows up as a market loss. A loan lost because documents were defective is often recorded as credit loss but has an operational cause. Exam questions usually ask you to look at the root cause.

Key formulas to remember

Basel definition of operational risk
Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events
Includes legal risk. Excludes strategic and reputational risk.
Seven Basel event types
1 Internal fraud | 2 External fraud | 3 Employment practices and workplace safety | 4 Clients, products and business practices | 5 Damage to physical assets | 6 Business disruption and system failures | 7 Execution, delivery and process management
Memorise the names. Questions give a scenario and ask for the category.
Four causes in the definition
Processes + People + Systems + External events
A loss from any of these four sources is operational.

How to solve Operational Risk Definition and Categories questions

Use this method for any question that asks you to define operational risk or classify an event.

  1. 1Read the scenario and find the root cause of the loss, not where it shows up in the accounts.
  2. 2Ask if the cause is a process, people, system or external event. If it is none of these, such as a price move or a borrower default, it is market or credit risk.
  3. 3Check the exclusions. If the item is strategic or reputational risk, it is not operational risk under Basel. Legal risk is included.
  4. 4Decide who acted. Insider acting against the firm is internal fraud. Outsider is external fraud.
  5. 5If the firm itself failed a client, think category 4. If staff were harmed or discriminated against, category 3. If a process slip happened in trade capture, settlement or documentation, category 7.
  6. 6Physical damage from fire, flood or terrorism is category 5. Outages and IT failures are category 6.
  7. 7Eliminate options that fit another category better and pick the single best match.

Quickest way: Who, what, where trick

When to use it: When you have under a minute per question and need to classify an event type.

  1. Who: insider against firm = 1, outsider = 2.
  2. What was damaged: people or staff rules = 3, clients = 4, physical assets = 5, systems or continuity = 6.
  3. If none of these and the loss came from a mistake in processing, pick 7.
  4. For definition questions, recall: processes, people, systems, external events; legal in; strategic and reputation out.

Common mistakes in Operational Risk Definition and Categories

  • Including reputational and strategic risk in the Basel definition.

    Everyday language treats any bad event as operational.

    Fix: Remember legal risk is in, strategic and reputational risk are out.

  • Classifying a rogue trader loss as market risk.

    The loss appears as a trading loss when positions move.

    Fix: Look at the root cause. Unauthorised, concealed trading is internal fraud.

  • Confusing category 4 with category 7.

    Both involve clients and processes.

    Fix: Category 4 is a failure of duty or product suitability, such as mis-selling. Category 7 is an error in processing, such as a wrong payment instruction.

  • Treating system failure as damage to physical assets.

    Hardware seems physical.

    Fix: Outages and IT failures are category 6. Category 5 is for damage from events like fire, flood or terrorism.

  • Saying operational risk is rewarded like market risk.

    Students assume all risks carry a premium.

    Fix: Operational risk is mostly a by-product of doing business and is not taken to earn a return.

Worked examples

Example 1

A bank employee in the treasury department secretly books fictitious trades to hide losses, and the bank loses ₹40,00,000 when positions are closed. Under Basel, which event type applies? A) External fraud B) Internal fraud C) Execution, delivery and process management D) Clients, products and business practices

Show the solution
  1. Find the root cause. The loss came from unauthorised, concealed trades booked by an employee.
  2. The actor is an insider acting against the firm's interests.
  3. Insider intentional misconduct is internal fraud, even though the loss shows up as a trading loss.
  4. External fraud needs an outsider. Category 7 is for unintentional processing errors. Category 4 concerns duties to clients.

Answer: B) Internal fraud

Example 2

Which of the following is included in the Basel definition of operational risk? A) Loss from a decline in the bank's brand value after negative press B) Loss from a failed corporate strategy C) A regulatory fine and legal settlement arising from a control failure D) Loss from a fall in equity prices on a trading book

Show the solution
  1. Recall the definition: failed processes, people, systems or external events, including legal risk.
  2. A is reputational risk, which is excluded.
  3. B is strategic risk, which is excluded.
  4. D is market risk because it comes from price movements.
  5. C is a legal-risk loss caused by a control failure, so it is included.

Answer: C) A regulatory fine and legal settlement arising from a control failure

Exam tips

  • Learn the seven names in order and attach one example to each. Questions give a scenario, not the label.
  • Always classify by root cause, not by where the loss appears in the accounts.
  • Memorise the inclusion and exclusion: legal risk in, strategic and reputational risk out.
  • Watch for distractors that are really market or credit events dressed up as operational ones.
  • Expect the paper to be 100 multiple-choice questions in 4 hours. This topic usually needs only a quick classification, so do not spend long on it.

Practice questions from Operational Risk

Operational Risk Definition and Categories in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

Operational Risk Definition and Categories: frequently asked questions

What is the Basel definition of operational risk?

It is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk. It excludes strategic and reputational risk.

What are the seven Basel operational risk event types?

Internal fraud, external fraud, employment practices and workplace safety, clients, products and business practices, damage to physical assets, business disruption and system failures, and execution, delivery and process management.

How is operational risk different from market risk and credit risk?

Market risk comes from price changes and credit risk from counterparty default. Both are usually taken to earn a return. Operational risk comes from failures in processes, people, systems or external events, and is generally not rewarded.

Is reputational risk part of operational risk?

Not under the Basel definition, which excludes it along with strategic risk. A reputational loss can follow an operational event, but it is not counted as operational risk loss.