Operational Risk

Basel's wording is the one most firms adopt. It sees losses arising from four places: failed processes, people who err or defraud, broken systems, and events outside the firm such as floods, cyber attacks or theft. Legal risk, meaning fines, settlements and litigation costs, is counted in. Strategic and reputational risk are excluded from the regulatory measure, although firms watch both. The category is huge, stretching from a keying error to a major cyber breach. Firms identify and measure it with loss data, scenario analysis, risk and control self-assessments and key risk indicators. Banks hold regulatory capital against it. Unlike market or credit risk, nobody takes it on for a return, so past loss data, not forecast profit, shows where prevention spending belongs.

On salary day, the payments system at a bank goes down. Thousands of transfers fail, staff handle complaints by hand, and the bank pays compensation and a fine. The event involves a failed system, delayed manual processes and legal costs. Risk managers record the loss, trace its cause to an untested software update and tighten the change process.