Operational Risk
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events — including fraud, technology failures, legal violations, cyber attacks, natural disasters, and human error. It is distinct from market risk and credit risk and is explicitly addressed in the Basel framework for bank capital requirements.
Key takeaways
- Basel III defines operational risk as the 'risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.'
- It encompasses a wide range of risk types: execution errors, system outages, fraud, regulatory fines, and business disruption.
- Banks must hold regulatory capital against operational risk under the Basel Standardized or Advanced Measurement Approaches.
- Hedge funds face operational risk primarily through trade processing errors, technology failures, and compliance failures.
- Operational risk events can trigger reputational damage that exceeds the direct financial loss, as seen in high-profile trading scandals.
Explanation
Operational risk is the 'other risks' category in financial institution risk management — the residual after market risk (losses from price moves) and credit risk (losses from counterparty default) have been accounted for. The Basel Committee on Banking Supervision formalized operational risk measurement as a distinct capital requirement under Basel II (2004), recognizing that some of the most catastrophic institutional losses in history — Barings Bank ($1.3B, 1995), Société Générale ($7.2B, 2008), UBS ($2.3B, 2011) — resulted not from bad market positions per se, but from operational failures: unauthorized trading, inadequate controls, and governance breakdowns.
Operational risk events are typically categorized into seven event types under the Basel framework: internal fraud (unauthorized trading, misappropriation); external fraud (cyberattacks, third-party theft); employment practices and workplace safety; clients, products, and business practices (mis-selling, fiduciary failures); damage to physical assets; business disruption and system failures; and execution, delivery, and process management (settlement errors, data entry mistakes). Each category requires different controls and measurement approaches.
For banks, regulatory capital for operational risk under Basel III is calculated using the Standardized Approach, which uses a Business Indicator Component (BIC, a measure of business volume) adjusted by an Internal Loss Multiplier that reflects the institution's own historical operational loss experience. This replaces the more complex Advanced Measurement Approaches of Basel II, which allowed banks to use internal models — an approach that proved inconsistent across institutions and difficult to audit.
For hedge funds, operational risk manifests differently than in banks. The primary operational risk categories include: trade processing errors (incorrect strike prices, wrong-side trades, settlement failures); technology failures (system outages that prevent execution during market-moving events); prime brokerage counterparty risk (the operational risk that a prime broker experiences, disrupting the fund's operations); valuation errors (marking positions incorrectly, particularly for Level 2 and Level 3 assets); and regulatory compliance failures (late filings, missing disclosures). The due diligence process conducted by institutional investors in a hedge fund specifically examines operational risk controls: segregation of duties, independent fund administration, third-party audit quality, disaster recovery procedures, and cybersecurity protocols.
Concentration risk and operational risk intersect when a fund relies on a single prime broker or custodian. The Lehman Brothers bankruptcy in 2008 demonstrated this vividly: hedge funds with assets held by Lehman's prime brokerage in the U.K. found their assets frozen in administration proceedings, unable to trade or meet margin calls with other counterparties for months — a catastrophic operational event caused by concentration of operational dependencies in a single failed institution.
Example
A hedge fund executes what it believes to be a sell order for 10,000 shares of a technology company at $150. Due to a keystroke error in the OMS (Order Management System), the trader accidentally enters a buy order for 100,000 shares — 10 times the intended quantity — at market. By the time the error is identified 12 minutes later, the stock price has moved to $153 as the large buy order created temporary demand pressure. The fund must sell the erroneous 100,000 shares immediately, incurring: (1) direct loss of approximately $300,000 (average sell price of $151 versus $153 purchase price × 100,000 shares) plus (2) estimated market impact cost of $45,000 from the large sell order pushing the price lower. Additionally, the fund is now long the intended 10,000 shares at an average cost of $153 instead of the planned sell execution at $150 — an additional $30,000 in opportunity cost. Total operational risk loss: $375,000, plus potential regulatory reporting obligations if the error qualifies as a significant operational incident under prime brokerage agreements.
Related terms
Basel Iii Concentration Risk Counterparty Risk Credit Risk Custodian Default Delivery Hedge Fund Historical Simulation Var Long Hedge Margin Market Impact