Identification, Quantification and Monitoring of Operational Risk

Rajat Baijal

The Basel Committee defined operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. This definition includes legal risk, but excludes strategic and reputational risk.”¹¹ BCBS, 2011, “Principles for the Sound Management of Operational Risk”, June. As a practice, operational risk has evolved significantly since that definition was first articulated. From being the “elephant in the room”, operational risk has truly transformed to become a key agenda item at board meetings evoking particular interest from regulators and executive management alike.

By its very nature, operational risk is ingrained within the DNA of financial services firms. As a concept, it is also deemed extremely difficult to quantify, especially compared to credit and market risk. This is due primarily to limited historical data and subjectivity around the impact/frequency assessment. This chapter aims to address some of the challenges around robust identification and assessment of operational risk.

Specifically, the chapter will focus on:

• • the risk and control self-assessment (RCSA) process to effectively identify