How do banks classify operational loss events for reporting?

Question

AcadiFi · Accepted Answer

Basel II/III defines seven operational risk event type categories, each with a precise scope and a set of Level-2 sub-categories...

Unlock with Scholar — $19/month

Get full access to all Q&A answers, practice question explanations, and progress tracking.

Start 7-Day Free Trial Compare Plans

No credit card required for free trial

The seven event types: (1) Internal Fraud — unauthorized trading, insider theft; (2) External Fraud — cyber theft, counterfeit payments; (3) Employment Practices and Workplace Safety — discrimination claims, workers' comp; (4) Clients, Products, and Business Practices — mis-selling, market manipulation, AML failures; (5) Damage to Physical Assets — natural disasters, vandalism; (6) Business Disruption and System Failures — IT outages, power failures; (7) Execution, Delivery, and Process Management — settlement errors, vendor failures, documentation errors.

Classification rules: apply the root cause principle — classify based on what fundamentally failed, not the surface symptom. A wire fraud where an external party obtained credentials through a phishing attack is External Fraud (Type 2), but if an employee knowingly transferred funds to a fake vendor, it becomes Internal Fraud (Type 1). A data breach caused by an unpatched system is Business Disruption/System Failures (Type 6), while the same breach caused by an employee selling data is Internal Fraud (Type 1).

```mermaid
flowchart TD
  A[Loss Event] --> B{Root Cause?}
  B -->|Employee| C[Internal Fraud]
  B -->|Outsider| D[External Fraud]
  B -->|System| E[Business Disruption]
  B -->|Process| F[EDPM]
```

Ambiguous events: use a tie-breaker hierarchy (Internal Fraud trumps other categories when an employee is involved), document rationale, and maintain a classification review committee. At Lumen Trust Bank, ambiguous events receive dual coding with a primary and secondary category to preserve information.

Reporting thresholds: banks typically collect all losses above $10,000 for internal analysis, while losses above $100,000 are required for ORX and other external data consortia. Near-misses (prevented losses) are also tracked separately to enrich scenario analysis inputs.

How do banks classify operational loss events for reporting?

Master Part II with our FRM Course

Related Questions

Practice Questions