FRM Exam Part II · Risk Measurement and Assessment

Operational Risk Identification and Taxonomy: Basel Event Types

Updated 11 October 2026 · Fact-checked

Operational risk is the risk of loss from inadequate or failed internal processes, people and systems, or from external events. Basel classifies losses into seven event types. To solve a question, find the cause of the loss, match it to one event type, then check it is not a market or credit loss.

Understand Operational Risk Identification and Taxonomy

Operational risk is defined by Basel as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. The definition includes legal risk. It excludes strategic risk and reputational risk. The exam often tests this boundary.

Think of it as a risk defined by cause. Market risk comes from price moves. Credit risk comes from a counterparty failing to pay. Operational risk comes from something breaking inside the firm or hitting it from outside: a wrong trade booking, a rogue trader, a server outage, a flood.

A taxonomy is a common classification so that losses are named and grouped the same way across the firm and across banks. Basel sets seven event types at the top level: internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; execution, delivery and process management.

The classification is by event, not by effect. Each event has a cause (process, people, systems, external), the event itself, and an effect (the loss). Basel also maps losses to eight business lines. A loss is placed on that grid of event type and business line. One event gets one primary event type, even if several causes contributed.

Identification is the first step of risk management. Common approaches look at the firm from different angles: loss event data (what has happened), risk and control self-assessments (what managers think could happen), scenario analysis (what could happen in severe cases), process mapping (where steps can fail) and key risk indicators (early warning signs).

Key formulas to remember

Basel definition: Operational risk = loss from inadequate or failed internal processes, people and systems, or from external events; Includes legal risk. Excludes strategic and reputational risk.
Seven Basel event types: 1 Internal fraud | 2 External fraud | 3 Employment practices and workplace safety | 4 Clients, products and business practices | 5 Damage to physical assets | 6 Business disruption and system failures | 7 Execution, delivery and process management; Memorise the order and the typical examples of each.
Causal chain: Cause → Event → Effect (loss); Classify by the event. The loss amount or accounting line is only the effect.
Internal vs external fraud: Internal fraud: at least one internal party involved | External fraud: third party only; Employee collusion with outsiders is internal fraud.

How to solve Operational Risk Identification and Taxonomy questions

Use this method for any scenario that asks you to classify or identify an operational risk event.

1Read the scenario and write down what actually happened, ignoring the dollar effect.
2Ask whether the loss came from a process, people, system or external cause. This confirms it is operational risk and not market or credit risk.
3Check the exclusions: strategic or reputational damage alone is not operational risk under Basel.
4Decide whether anyone inside the firm acted intentionally. If yes, internal fraud or unauthorised activity. If a third party only, external fraud.
5Look for the key signal word: discrimination or safety points to employment practices; mis-selling, suitability or fiduciary breach points to clients, products and business practices; fire, flood or terrorism points to damage to physical assets; outage or software failure points to business disruption and system failures; data entry, settlement or documentation error points to execution, delivery and process management.
6Pick one primary event type, and map the business line if asked.
7Match the answer to the question asked: a type, a cause, an identification tool or a difference from another risk.

Quickest way: Signal-word matching

When to use it: Use when the question lists four event types or tools and you have about one minute.

Underline the verb: stole, mis-sold, mis-keyed, crashed, flooded, discriminated.
Intentional insider act: internal fraud. Intentional outsider act: external fraud.
Error in processing, settlement or documentation: execution, delivery and process management.
Client harm from product or advice: clients, products and business practices.
Outage of IT or utilities: business disruption and system failures.
Eliminate any option that is really a price move or a borrower default.

Common mistakes in Operational Risk Identification and Taxonomy

Classifying an employee's mis-selling to clients as internal fraud.
The word 'employee' pulls you to internal fraud.
Fix: Internal fraud needs intent to defraud the firm or breach its rules for gain. Mis-selling or suitability failures go under clients, products and business practices.
Treating a data-entry error that causes a trading loss as market risk.
The loss shows up in the trading book P&L.
Fix: Classify by cause. A booking or keying error is execution, delivery and process management, even if the loss is a price loss.
Including reputational and strategic risk inside the Basel operational risk definition.
Real events often have reputational fallout.
Fix: Basel includes legal risk but excludes strategic and reputational risk. Reputational damage is a consequence, not a loss event type.
Placing a cyber attack by outside hackers under business disruption only.
The system is down, so disruption seems obvious.
Fix: Check the intent. Theft or hacking by outsiders is external fraud, including systems security. An outage with no theft or intent is business disruption and system failures.
Putting a workplace discrimination claim under clients, products and business practices.
It involves legal cost and a claim.
Fix: Claims about staff, pay, discrimination or safety belong to employment practices and workplace safety.
Assigning several event types to one loss.
Real events have multiple causes.
Fix: Choose the primary event type by the root event. Record contributing causes separately.

Worked examples

Example 1

A relationship manager at a global bank recommends a complex structured note to a retired client with a low risk profile, ignoring the suitability check. The client loses USD 400,000 and sues the bank. Which Basel event type applies?
A. Internal fraud
B. Clients, products and business practices
C. Execution, delivery and process management
D. External fraud

Show the solution

What happened: a product was sold to a client who it did not suit.
Cause: people and conduct failure, not a booking error.
Intent to defraud the bank: none stated, so not internal fraud. No third party acted against the bank, so not external fraud.
No processing or settlement error occurred, so not execution, delivery and process management.
Suitability and client-product failure is the classic case for clients, products and business practices.

Answer: B. Clients, products and business practices.

Example 2

A trader at a European bank enters a EUR 50 million bond purchase as a sale due to a keying mistake. Before it is corrected, the price moves and the bank loses EUR 1.2 million. Explain whether this is market risk or operational risk, and name the Basel event type.

Show the solution

The loss appears as a price move, which suggests market risk.
Ask the root cause: the position arose from a booking error, not a deliberate view.
A failed internal process or human error causing the loss meets the Basel operational risk definition.
There was no intent to defraud, so it is not internal fraud.
Processing and data-entry errors fall under execution, delivery and process management.
Record the EUR 1.2 million as an operational risk loss event. A risk manager would also note the price move as the way the loss was realised.

Answer: Operational risk. Event type: execution, delivery and process management. The market move only determined the size of the loss.

Exam tips

Expect short scenarios where you must pick one of the seven event types. Focus on the cause and any intent, not on the money amount.
Learn the boundary lines: internal vs external fraud, mis-selling vs process error, outage vs cyber theft.
Remember the definition includes legal risk and excludes strategic and reputational risk. This is a favourite distractor.
Know which identification tool fits which need: loss data looks back, RCSA and scenarios look forward, KRIs give early warning.
When two options both seem right, choose the one that matches the root event rather than the downstream effect.

Practice questions from Risk Measurement and Assessment

Operational Risk Identification and Taxonomy: frequently asked questions

What are the seven Basel operational risk event types?

They are internal fraud; external fraud; employment practices and workplace safety; clients, products and business practices; damage to physical assets; business disruption and system failures; and execution, delivery and process management. Each loss is assigned to one primary type.

How is operational risk different from market and credit risk?

Market risk comes from price movements and credit risk from a counterparty failing to pay. Operational risk comes from failed processes, people, systems or external events. A single loss can show up in the market book yet still be operational if a process failure caused it.

Does Basel operational risk include reputational risk?

No. The Basel definition includes legal risk but excludes strategic and reputational risk. Reputational damage is usually treated as a consequence of an operational event.

How do banks identify operational risk?

They combine several approaches: internal and external loss data, risk and control self-assessments, scenario analysis, process mapping and key risk indicators. Each shows a different view, so firms use them together.