FRM Exam Part II · Introduction to Operational Risk and Resilience

Definition and Scope of Operational Risk (Basel)

Updated 11 October 2026 · Fact-checked

Basel defines operational risk as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk. To answer a question, find the cause, match it to the category, then check what is in or out of scope.

Understand Definition and Scope of Operational Risk

Banks take market risk and credit risk on purpose, because they earn a return for them. Operational risk is different. Nobody chooses it for reward. It arises from simply running the business: processing trades, serving customers, using technology and depending on outside parties.

The Basel definition is a cause-based definition. Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. So you always ask: what failed? A process (wrong settlement procedure), people (fraud, error, poor training), systems (outage, software bug) or an external event (cyberattack by outsiders, natural disaster, third-party failure).

The Basel definition includes legal risk. This covers fines, penalties and settlements from supervisory action, as well as private settlements. It excludes strategic risk and reputational risk. Reputational damage can follow an operational loss, but it is not counted in the regulatory definition. The exclusions exist because these risks are very hard to measure and attribute to a specific event.

Compare with other risks. Market risk is loss from movements in prices and rates. Credit risk is loss because a borrower or counterparty fails to pay. Liquidity risk is inability to meet obligations or trade without large cost. Operational risk comes from failures in how the firm works, not from price moves or a counterparty's creditworthiness.

Boundaries are blurry. A trader who exceeds limits and hides losses creates an operational loss (unauthorised trading, internal fraud), though the money was lost in the market. A loan lost because documents were defective is a credit loss with an operational cause. Banks classify such events by their root cause and by the rules in their own taxonomy, so read the scenario carefully.

Key formulas to remember

Basel definition of operational risk: Operational risk = risk of loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Four causes: Processes | People | Systems | External events; Use these four labels to classify any scenario.
Scope rule: In scope: legal risk, fraud, errors, outages, cyber events. Out of scope: strategic risk, reputational risk; Reputational harm may follow a loss but is not part of the regulatory definition.

How to solve Definition and Scope of Operational Risk questions

Use this method for any question that asks you to define, classify or distinguish operational risk.

1Read the scenario and identify the loss or potential loss.
2Ask what actually failed first: a process, a person, a system or an external event.
3Check whether the loss came from a price move, a counterparty default or a funding problem. If so, it points to market, credit or liquidity risk.
4If a failure in internal controls or an outside event caused the loss, classify it as operational risk, even if the loss shows up in a trading or loan account.
5Check scope: legal risk is included; strategic and reputational risk are excluded.
6Match the answer to the exact Basel wording and eliminate options that add or drop elements.

Quickest way: Cause-first test

When to use it: Use it when the options look similar and time is short.

Underline the root cause in the question.
Label it: process, people, system or external.
If it is a price move or a borrower not paying, it is not operational.
If an option includes strategic or reputational risk in the definition, reject it.

Common mistakes in Definition and Scope of Operational Risk

Saying the Basel definition includes reputational risk
Reputational damage is a common result of operational failures, so it feels part of the definition.
Fix: Remember: legal risk in, strategic and reputational risk out.
Excluding legal risk from the definition
Students link legal matters to compliance rather than operations.
Fix: The Basel definition explicitly includes legal risk, such as fines and settlements.
Classifying rogue trading losses as market risk
The loss appears through market positions.
Fix: Classify by root cause. Unauthorised trading is internal fraud, an operational event, caused by people and control failures.
Treating a loan loss from defective documentation as pure credit risk
The loss is on a loan book.
Fix: Identify the cause. A documentation error is a process failure. Banks often record such events as operational with a credit link.
Listing only four causes as if they were four separate loss events
Causes and event types get confused.
Fix: Causes are people, processes, systems and external events. Event types (fraud, clients and products, damage to assets, and so on) are a separate taxonomy.

Worked examples

Example 1

A bank's payment system fails for six hours because of a software bug introduced in a recent update. Customers are compensated for late payments. Under the Basel definition, how is this loss classified?
A. Market risk
B. Credit risk
C. Operational risk caused by systems
D. Reputational risk

Show the solution

The loss is customer compensation after a system outage.
The root cause is a software bug, so a system failed.
No price movement or counterparty default is involved, so A and B are wrong.
Reputational risk is excluded from the Basel definition, so D is wrong.

Answer: C. It is operational risk caused by inadequate or failed systems.

Example 2

Which statement about the Basel definition of operational risk is correct?
A. It includes strategic risk but excludes legal risk
B. It includes legal risk but excludes strategic and reputational risk
C. It includes reputational risk but excludes external events
D. It covers only losses from people and processes

Show the solution

Recall the definition: failed processes, people, systems or external events.
Legal risk is explicitly included.
Strategic and reputational risk are explicitly excluded.
A reverses this. C wrongly includes reputational risk and drops external events. D drops systems and external events.

Answer: B. Legal risk is included; strategic and reputational risk are excluded.

Exam tips

Know the Basel wording well enough to spot options that add reputational or strategic risk.
In case questions, classify by root cause, not by where the loss shows in the accounts.
Expect scenarios built on the four causes: process, people, systems and external events.
When asked to distinguish risks, state what drives the loss: price moves, borrower default, funding stress or internal failure.

Practice questions from Introduction to Operational Risk and Resilience

Definition and Scope of Operational Risk in other exams

The same ground in other exams, if you are preparing for more than one or want another angle on it.

FRM Part IOperational Risk Capital: Basel Approaches

Definition and Scope of Operational Risk: frequently asked questions

What is the Basel definition of operational risk?

It is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk and excludes strategic and reputational risk.

What is the difference between operational risk and credit risk?

Credit risk arises when a borrower or counterparty fails to meet its obligations. Operational risk arises from failures in processes, people, systems or external events. Credit risk is taken deliberately for return; operational risk is a by-product of doing business.

Is cyber risk an operational risk?

Yes. A cyberattack is usually an external event that exploits weaknesses in systems, people or processes, so it falls within operational risk.

Why are reputational and strategic risk excluded?

They are difficult to measure and to link to specific events. Reputational harm often follows an operational loss, but it is treated separately from the regulatory definition.