What Makes a Risk Operational?
Operational risk is present in the ordinary work of an organization: processing transactions, maintaining records, protecting information, serving customers, and relying on people and systems. A loss may be large or small, immediate or delayed. Its size alone does not determine whether the underlying risk is operational.
The definition is commonly summarized by four source categories: processes, people, systems, and external events. For example, an incomplete approval procedure is a process weakness; an employee entering an incorrect amount is a people-related source; a software configuration error is a system source; and a supplier’s outage is an external event that can disrupt operations.
These sources can overlap. A poorly designed procedure may make an employee’s mistake more likely, or an external cyberattack may expose weaknesses in internal systems. Classification should capture the operational mechanism that matters for the question being asked, rather than forcing every incident into a single simplistic label.
Classifying an Incident by Its Source
To classify an incident, identify what failed or what event disrupted operations. Then check whether that source is a process, people, system, or external-event exposure. The loss’s form—such as an expense, a customer refund, or a missed revenue opportunity—describes a consequence, not necessarily the risk category.
State what happened in concrete terms, such as “a payment was sent twice” or “a service provider’s outage delayed claim processing.”
Ask whether a process, a person, a system, or an external event caused or contributed to the incident.
Record the financial or service effect separately. A refund, legal expense, or reputational impact does not by itself establish the source category.
Name the operational source and give a brief reason. If several sources contributed, say so rather than implying that only one was involved.
This method follows directly from the definition: an incident is operational because of the process, people, system, or external-event source from which the potential loss arises. Therefore, a financial consequence does not automatically make the source a financial risk, and a reputational consequence does not automatically make the source a reputational risk. Consequences can be recorded alongside the operational classification.
Some regulatory formulations explicitly include legal risk within operational risk and exclude strategic and reputational risk from that definition. Enterprise taxonomies may organize these subjects differently. For a classification exercise, use the stated definition and conventions, and do not assume that every consequence or adjacent category has the same status in every framework.
Why the Loss Calculation Does Not Define the Category
A simple loss calculation can help describe an incident’s size, but it does not tell us what caused it. For a hypothetical event, suppose the recorded gross loss consists of distinct customer remediation, response, and repair costs. If each dollar is counted in exactly one component, adding the components gives the total gross loss. If a recovery is then received and the question asks for net loss, subtract that recovery once.
Here \(R\) is a recovery attributable to the incident. The addition is appropriate only when the listed components do not overlap; subtracting a recovery is appropriate only when the requested measure is net of that recovery. These accounting choices describe the loss measure. The operational classification still depends on the source of the incident.
Worked Classifications
Worked Example: Duplicate Claim Payments After a System Change
A hypothetical insurer changes its claim-processing software. A configuration error causes 18 claims to be paid twice, with each duplicate payment equal to $420. The insurer spends $6,800 correcting the configuration and $2,400 contacting affected customers and reconciling their accounts. Classify the incident and calculate the stated gross loss. Treat the three costs as distinct, and assume no recovery.
Method. First identify the event and source; then total the specified, non-overlapping loss components.
Step 1: Classify the source. The immediate cause is an incorrect software configuration. This is a system-related operational incident. The change and testing procedures may also be relevant process contributors, but the facts do not establish that they failed, so they should not be asserted as causes.
Step 2: Calculate duplicate payments. There are 18 duplicate payments of $420 each:
Step 3: Add the distinct costs. The gross loss includes $7,560 in duplicate payments, $6,800 in correction costs, and $2,400 in customer reconciliation:
Check. The two response-related amounts total $6,800 + $2,400 = $9,200; adding the $7,560 in duplicate payments gives $16,760. With no recovery, the stated net amount would also be $16,760.
Common mistake avoided. Calling this a financial risk simply because money was paid out confuses the consequence with the source. The classification is system-related operational risk; the amount is the incident’s calculated loss.
Worked Example: Employee Fraud and a Failed Approval Control
In a hypothetical business unit, an employee submits 12 unauthorized transfers of $3,250 each. A required independent approval was not performed. An investigation costs $4,500, and $7,000 of the transferred funds is recovered. Classify the incident and calculate gross and net loss, treating the transfer amount and investigation cost as distinct loss components.
Method. Identify both the person-related conduct and the process-control failure. Calculate the amount transferred, add the investigation cost for gross loss, and subtract the recovery for net loss.
Step 1: Classify the sources. The employee’s unauthorized actions are a people-related source. The missing independent approval is a process-control failure. Both are operational contributors; neither should be omitted merely because the other is more immediately visible.
Step 2: Calculate the transfers.
Step 3: Calculate gross loss. Before recognizing the recovery, the specified loss components are the transfers and investigation expense:
Step 4: Calculate net loss. Subtract the $7,000 recovery once:
Check. The unrecovered transfer amount is $39,000 − $7,000 = $32,000. Adding the $4,500 investigation cost gives $36,500, consistent with the net-loss calculation.
Common mistake avoided. Classifying the event only as “employee misconduct” misses the failed approval process. The calculation also avoids subtracting the recovery from gross loss when the question asks for gross loss.
Worked Example: External Provider Outage Delays Customer Payments
A hypothetical insurer relies on an outside payment provider. A provider outage delays 310 customer payments. The insurer incurs $12 per delayed payment in customer remediation and $2,280 in staff overtime. The provider later gives a $1,500 service credit. Classify the incident and calculate the specified gross and net economic impacts, assuming the costs are distinct and the credit is applied against the net amount.
Method. Classify the event by its source, calculate the remediation cost per affected payment, add the separate overtime cost, and then subtract the stated credit for net impact.
Step 1: Classify the source. The immediate disruption is an external event: the outside provider’s outage. It also impaired the insurer’s payment operations. The fact that customers experienced delayed payments describes an impact, not a different source.
Step 2: Calculate customer remediation.
Step 3: Calculate gross impact. Add the $2,280 overtime cost:
Step 4: Calculate net impact. Subtract the $1,500 credit under the stated assumption:
Check. The credit is less than the gross impact, so the resulting net amount is positive. This calculation does not mean that every accounting or regulatory loss measure treats a provider credit identically; it follows the assumptions given in this hypothetical.
Common mistake avoided. The insurer may recognize a financial effect, but that does not make the outage a market or credit event. The stated initiating source is the external provider’s operational disruption.
Common Classification Traps
- Using the loss account as the classification. A customer refund or legal expense may result from an operational event. The expense label does not establish the event’s source.
- Assuming only internal failures count. External events can give rise to operational risk when they disrupt or impair the organization’s operations.
- Blaming a person without checking the process. An employee’s error or misconduct may coexist with an inadequate procedure, missing review, or unclear responsibility.
- Assuming a technology incident is always only a system issue. A system failure is a system-related source, but the facts may also identify a process weakness or an external contributor.
- Using severity as the test. A minor processing error and a major service outage can both be operational. The classification is about the source, not a minimum dollar threshold.
- Counting every consequence as a separate cause. A delayed payment, customer complaint, and remediation expense may all arise from one incident. Describe each accurately without treating each consequence as a separate source.
Check Your Understanding
For each hypothetical situation, identify the operational source and calculate an amount when requested. Answers follow each question for checking.
- A claims clerk enters a policy number incorrectly, and a payment of $1,180 goes to the wrong customer. What is the primary operational source, and what is the stated erroneous payment amount? (Answer: People-related processing error; $1,180.)
- A hypothetical document system fails to retain 25 required files. Reconstructing each file costs $36, and staff spend an additional $540 on recovery work. Classify the source and calculate gross cost, assuming the amounts are distinct. (Answer: System-related operational incident; $25 × $36 + $540 = $1,440.)
- An outside mail vendor misses a regulatory mailing deadline for 80 customers. The organization spends $15 per customer on corrective notices. Identify the source and calculate the corrective-notice cost. (Answer: External-event operational incident; $80 × $15 = $1,200.)
- An employee bypasses a required second review and makes 9 unauthorized payments of $2,400 each. The organization incurs $1,700 in investigation cost and recovers $5,000. Identify the contributors and calculate net loss, assuming costs are distinct. (Answer: People-related and process-control contributors; gross loss $23,300, net loss $18,300.)
- A hypothetical scheduling-system defect causes 40 service appointments to be missed. Each customer receives $25 in remediation, staff overtime is $1,100, and a vendor credit of $300 is applied. Identify the source and calculate gross and net impact, assuming no overlap. (Answer: System-related operational incident; gross impact $2,100 and net impact $1,800.)