FRM Exam Part II · Risk Governance

Regulatory Principles for Sound Operational Risk Management

Updated 11 October 2026 · Fact-checked

The Basel Committee sets principles for managing operational risk and for operational resilience. They cover board and senior management responsibility, a three-lines-of-defense structure, risk appetite, identification and assessment, change management, monitoring, controls, business continuity, disclosure and ICT. Supervisors expect the board to own the framework and the bank to survive severe disruption.

Understand Regulatory Principles for Sound Operational Risk Management

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel includes legal risk and excludes strategic and reputational risk. The Basel principles do not give a formula. They describe what good governance and practice look like, and supervisors judge banks against them.

The principles for sound management of operational risk are grouped by theme. Fundamental principles: operational risk management is part of a bank-wide culture, and the framework is embedded in overall risk management. Governance: the board approves and reviews the framework and risk appetite and tolerance statements. Senior management turns the board's strategy into policies, processes and systems. The three lines of defense are business line management, an independent corporate operational risk function, and independent review by audit or similar. Risk management environment: identify and assess risk using tools such as RCSA, loss event data, KRIs and scenario analysis; review new products, processes and systems before launch; monitor risk and report regularly to senior management and the board; maintain strong controls and mitigation. Resilience and disclosure: have business continuity plans, and disclose enough for stakeholders to assess the bank's approach.

The Basel principles for operational resilience build on this. Operational resilience is the ability to deliver critical operations through disruption, whatever the cause: cyber attack, pandemic, technology failure or third-party failure. The focus moves from preventing each event to limiting its impact on critical services. Banks identify critical operations, set tolerance for disruption, map the people, technology, processes, information and third parties that support them, and test with severe but plausible scenarios.

The resilience principles cover governance, operational risk management, business continuity planning and testing, mapping interconnections and dependencies, third-party dependency management, incident management, resilient ICT including cyber security, and the resilience of critical operations. Think of resilience as an outcome. Operational risk management is the framework that helps deliver it.

For the exam, link each principle to the role that owns it. The board sets appetite and approves the framework. Senior management implements it. The first line owns and manages risk day to day. The second line challenges and oversees. The third line provides independent assurance.

Key formulas to remember

Operational risk definition (Basel): Operational risk = loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Three lines of defense: 1st: business line management | 2nd: independent operational risk function | 3rd: independent review or audit; The second line challenges the first. The third line gives independent assurance on both.
Board vs senior management: Board: approves framework, appetite and tolerance | Senior management: implements and reports; A common trap is mixing these roles.
Operational resilience: Resilience = ability to deliver critical operations through disruption, within tolerance for disruption; Applies to any cause of disruption, not just cyber.
Resilience building blocks: Identify critical operations → set tolerance → map dependencies → test severe but plausible scenarios → manage incidents; Use as a checklist when judging answer options.

How to solve Regulatory Principles for Sound Operational Risk Management questions

Most questions give a short scenario about a bank and ask which principle is breached, who should act, or what a supervisor expects. Use this method.

1Read the last line first. Decide whether the question is about governance, risk identification, controls, continuity or resilience.
2Identify who acts in the scenario: board, senior management, first line, second line or third line.
3Match the action to the correct owner. Approving appetite is the board. Implementing policies is senior management. Independent challenge is the second line. Assurance is the third.
4Check whether the issue is prevention (operational risk management) or continuity of critical services (resilience).
5Eliminate options that make one function do another's job, such as audit owning day-to-day risk.
6Eliminate options that are too absolute, such as eliminating all operational risk or relying only on capital.
7Choose the option that is embedded, independent, forward-looking and tested.

Quickest way: Role-match and outcome check

When to use it: Use when time is short and the options describe who does what or what a supervisor expects.

Label the actor in the stem: board, management, 1st, 2nd or 3rd line.
Pick the option that gives that actor its standard role.
If the topic is disruption, prefer options about critical operations, tolerance and testing.
Discard options with words like always, eliminate or only.

Common mistakes in Regulatory Principles for Sound Operational Risk Management

Treating the business line as a customer of the risk function rather than the owner of risk
Students assume the risk department manages operational risk.
Fix: Remember the first line owns and manages its risks. The second line sets standards and challenges.
Giving the board the job of implementing controls
Both board and senior management sound like governance.
Fix: The board approves and reviews the framework and appetite. Senior management implements it.
Saying operational resilience means preventing all disruptions
Resilience sounds like strong risk control.
Fix: Resilience assumes disruption will happen and aims to keep critical operations within tolerance for disruption.
Including reputational and strategic risk in the Basel definition
These risks feel operational in daily life.
Fix: Basel's definition includes legal risk but excludes strategic and reputational risk.
Ignoring third parties when mapping dependencies
Students focus on the bank's own systems.
Fix: Mapping must include third-party and outsourced providers that support critical operations.
Treating business continuity plans as sufficient without testing
A written plan looks complete.
Fix: Plans must be tested against severe but plausible scenarios and updated using the results.

Worked examples

Example 1

A bank's internal audit function also runs the monthly risk and control self-assessments for the trading desk and sets the desk's operational risk limits. Which Basel-style governance concern is most relevant? A) The board has approved the risk appetite. B) Internal audit's independence as third line is compromised. C) The first line is correctly owning its risks. D) The bank has too many KRIs.

Show the solution

The question is about governance and the three lines.
Running RCSAs and setting limits are first line and second line activities.
Internal audit is the third line and must stay independent to give assurance.
Doing management tasks and then auditing them is a conflict.
Option A, C and D do not describe the problem in the scenario.

Answer: B. Internal audit is performing first and second line tasks, which compromises its independence.

Example 2

A bank identifies its payments service as a critical operation. It has a strong prevention-focused control set but has never tested how long it could run through a major outage of its cloud provider. Which expectation is most directly unmet? A) Setting a higher capital buffer. B) Testing against severe but plausible scenarios, including third-party failure, within a defined tolerance for disruption. C) Eliminating all cloud use. D) Disclosing all incidents publicly in real time.

Show the solution

The issue is continuity of a critical operation, so this is resilience.
Resilience requires a tolerance for disruption and mapped dependencies, including third parties.
It also requires testing with severe but plausible scenarios.
The bank has never tested a cloud provider outage, so testing is the gap.
Option A is a capital response, not a resilience one. Option C is absolute and not required. Option D is not a Basel expectation.

Answer: B. The bank must test the payments service against severe but plausible scenarios, including third-party failure, against its tolerance for disruption.

Exam tips

Match roles precisely: board approves, senior management implements, first line owns, second line challenges, third line assures.
Spot the keyword resilience or critical operations and think tolerance, mapping and testing.
Reject options that promise to eliminate risk or rely on capital alone.
Remember the Basel definition includes legal risk but excludes strategic and reputational risk.
Expect scenarios involving cyber events, outsourcing and new product launches. Link them to the relevant principle.

Practice questions from Risk Governance

Regulatory Principles for Sound Operational Risk Management: frequently asked questions

What are the Basel principles for sound management of operational risk?

They are supervisory principles on governance, the risk management environment and disclosure. They cover board and senior management roles, the three lines of defense, risk appetite, identification and assessment, change management, monitoring, controls, business continuity and disclosure.

What is the difference between operational risk management and operational resilience?

Operational risk management aims to identify, assess and control risks. Operational resilience focuses on delivering critical operations through disruption within a set tolerance. Resilience accepts that some disruptions will occur.

Who is responsible for operational risk under the Basel principles?

The board approves and reviews the framework and appetite. Senior management implements it. The business lines own and manage risk day to day, while independent functions provide challenge and assurance.

Does Basel give a formula for these principles?

No. They are qualitative principles. Capital for operational risk is covered separately, so keep that topic distinct from governance principles.