Operational Risk Capital and Resiliency
Operational-risk capital absorbs financial loss; resilience supports continued delivery of critical operations. A capital buffer cannot restore a failed payment service. Assess the loss-absorption decision and the recovery decision separately.
The method at a glance
| Concept | How it works | Watch for |
|---|---|---|
| Loss absorption | Consider severity, frequency, insurance limitations and available resources. | Calling a toy expected-loss estimate a Basel capital requirement. |
| Recovery capability | Test whether the service can recover within its tolerance. | Treating a large cash buffer as a tested recovery plan. |
| Residual risk | Track unresolved dependencies and repeat failed exercises. | Closing an incident solely because losses were reimbursed. |
01Loss absorption
How it works: Consider severity, frequency, insurance limitations and available resources.
Watch for: Calling a toy expected-loss estimate a Basel capital requirement.
02Recovery capability
How it works: Test whether the service can recover within its tolerance.
Watch for: Treating a large cash buffer as a tested recovery plan.
03Residual risk
How it works: Track unresolved dependencies and repeat failed exercises.
Watch for: Closing an incident solely because losses were reimbursed.
Original worked example
Financial coverage does not restore a service
An outage causes 2 million of financial loss against a hypothetical 10 million internal buffer. Service recovery takes eight hours against a two-hour disruption tolerance.
- STEP 1
The buffer exceeds this particular financial loss by 8 million.
- STEP 2
Service recovery exceeds tolerance by six hours.
- STEP 3
Treat the tolerance breach as a separate resilience failure requiring remediation.
The loss can be absorbed while the service still fails its resilience objective. Neither result alone proves the overall risk is acceptable.
Illustrative assumptions and calculations for learning. Not observed market data or an official exam item.
Apply the method and check its limits
Before you start: Loss absorption, business indicators and critical-service disruption tolerances.
Understand what the capital formula measures
Operational-risk capital = business indicator component × internal loss multiplier
In the Basel standardised framework, the business indicator component reflects business size through financial-statement inputs; the multiplier incorporates operational-loss experience, subject to the framework’s conditions and national discretions. Given a BIC of 10 million and ILM of 1.2, the product is 12 million. This supplied-input calculation does not establish a bank’s actual local regulatory requirement.
Evaluate restoration independently of capital adequacy
Capital can absorb a recognized loss while the service remains unavailable. A resilience assessment asks whether critical operations can be maintained or restored within tolerance. Evaluate dependency failures, restoration evidence and reconciled transaction processing separately from the balance-sheet buffer. A lower capital number is not proof of a stronger recovery process.
Expected loss is not a capital model
Multiplying an event rate by average severity gives a rough mean under restrictive assumptions. It says little about rare, very severe events, dependence or regulatory requirements. Keep illustrative loss budgeting separate from jurisdiction-specific capital rules. For resilience, test restoration of the business service, including reconciliation and outstanding transactions, rather than only restarting technology.
Work through the topic
Interpret operational-risk capital inputs and reconcile them with loss experience, then assess a separate question: whether critical operations can recover within their tolerance.
Keep the capital framework and its inputs explicit
The Basel standardised approach uses a business indicator component and an internal loss multiplier in its operational-risk capital framework. The business indicator reflects specified financial-statement components, while the loss-related component incorporates defined historical loss information under the framework. This is not a formula that multiplies any convenient revenue figure by an arbitrary loss percentage.
For a simplified arithmetic exercise, suppose the business indicator component has already been calculated as 120 million and the applicable internal loss multiplier is supplied as 1.10. The resulting capital amount is 132 million. The exercise tests multiplication and interpretation only. It does not establish that these supplied inputs are appropriate for a particular bank or jurisdiction.
Jurisdictional choices and implementation affect the use of loss information and other requirements. Check the applicable rules and the exam’s stated assumptions before applying a formula. Do not infer an institution’s regulatory requirement from this example. Capital requirements, expected annual losses and a budget for control improvements are different quantities, even though all may be expressed in currency.
| Item | Value | Interpretation |
|---|---|---|
| Business indicator component | 120 million | Supplied framework input |
| Internal loss multiplier | 1.10 | Supplied applicable multiplier |
| Capital amount | 120 × 1.10 = 132 million | Result under these assumptions |
| Expected annual loss | Not supplied | Cannot be inferred from the capital result |
Original capital exercise with supplied, already determined inputs
- Business indicator component
- Value: 120 million
- Interpretation: Supplied framework input
- Internal loss multiplier
- Value: 1.10
- Interpretation: Supplied applicable multiplier
- Capital amount
- Value: 120 × 1.10 = 132 million
- Interpretation: Result under these assumptions
- Expected annual loss
- Value: Not supplied
- Interpretation: Cannot be inferred from the capital result
Inspect the loss data before interpreting a trend
Historical loss data need a consistent event perimeter, recognition convention and treatment of recoveries. A falling net-loss total can result from better prevention, a large recovery, a change in business scale or a reporting change. Those explanations have different implications for future risk. Reconcile gross events, recoveries, timing and material changes in the organization before drawing a conclusion.
Consider an original annual record with gross incident losses of 12 million and recognized recoveries of 3 million, giving an illustrative net amount of 9 million. The next year has gross losses of 15 million and recoveries of 8 million, giving net 7 million. Net losses fell while gross incident losses rose. This arithmetic does not determine regulatory data treatment, but it shows why one net figure cannot describe control performance.
Near misses and disruption indicators can reveal weaknesses even when realized financial loss is small. A payment failure recovered just before a deadline may expose a fragile process. Conversely, one large external event can dominate a year’s loss history. Combine event analysis, exposure changes and control evidence rather than treating every change in losses as a direct measure of management quality.
Test service recovery separately from capital adequacy
Capital can absorb specified financial consequences, but it cannot itself restore a critical operation. A resilience assessment specifies the operation, disruption tolerance, dependencies and evidence that service can be maintained or recovered. A recovery-time target for an individual system is an internal planning measure; the tolerated impact on a complete operation may involve additional capacity and integrity constraints.
In an original exercise, an operation tolerates at most two hours without its required service. The backup application starts after 45 minutes, but data reconciliation takes another 50 minutes and access restoration takes another 35 minutes sequentially. End-to-end restoration takes 130 minutes, exceeding the two-hour tolerance by 10 minutes. Reporting only the application’s 45-minute start time would conceal the failure.
Now suppose the restored service runs at 60% of the incoming transaction rate. Availability has improved, yet the backlog continues to grow. The plan needs a capacity response and a reconciliation method, as well as a technical restart. Record the observed constraint, owner and retest condition. Keep this evidence alongside capital analysis so that a favorable result in one dimension does not obscure a weakness in the other.
Does more operational-risk capital prove better resilience?
No. Capital addresses financial absorption under a framework. Resilience depends on the ability to continue or restore critical operations, including people, processes, systems and third parties. Test that capability directly.
Should a recovery reduce the need for remediation?
A recovery can reduce a financial consequence, but the initiating weakness may remain. Review whether recovery was repeatable, timely and dependent on another party’s cooperation. Remediation should address the failure mechanism, not just the final loss total.
Try a changed assumption
If BIC remains 10 million and the applicable ILM changes from 1.2 to 1, what changes?
Show answer and reasoning
The supplied-input capital calculation falls from 12 million to 10 million. Nothing in those numbers demonstrates that recovery time or service continuity improved.
Original learning check. No email or account needed.
Can insurance replace a recovery plan?
No. Coverage may have exclusions, deductibles and payment delays. Compensation after an event does not itself restore critical operations during it.
Sources and scope
Links checked 2026-10-10. GARP establishes exam scope; the technical references support the methods identified below. These are selected study notes and original examples, not complete curriculum coverage or official exam questions.
- GARP FRM study materials and 2026 learning objectives
Exam-domain scope and the official route to the annual learning objectives. This page does not certify coverage of every reading.
- Basel Committee: principles for operational resilience (2021)
Critical operations, dependencies, disruption tolerances and recovery testing.
- BIS: operational risk standardised approach
Business indicator component and internal loss multiplier in the Basel operational-risk capital framework. Jurisdictional implementation must be checked separately.
Prepared by MiloPrep editorial team. MiloPrep is independent of GARP. References do not imply endorsement or independent review of these notes.