The Basle Committee on Banking supervision has recently initiated work related to operational risk. Managing such risk is becoming an important feature of sound risk management practice in modern financial markets. The most important types of operational risk involve breakdowns in internal controls and corporate governance. Such breakdowns can lead to financial losses through error, fraud, or failure to perform in a timely manner or cause the interests of the bank to be compromised in some other way, for example, by its dealers, lending officers or other staff exceeding their authority or conducting business in an unethical or risky manner. Other aspects of operational risk include major failure of information technology systems or events such as major fires or other disasters.

A working group of the Basle Committee recently interviewed approximately thirty major banks from the different member countries on the management of operational risk. Several common themes emerged during these discussions:

• Awareness of operational risk among bank boards and senior management is increasing. Virtually all banks assign primary responsibility for managing operational risk to the business line head. Those banks that are developing measurement systems for operational risk often are also attempting to build some form of incentive for sound operational risk management practice by business managers. This incentive could take the form of a capital allocation for operational risk, inclusion of operational risk measurement into the performance evaluation process, or requiring business line management to present operational loss details and resultant corrective action directly to the bank's highest levels of management.
• While all banks surveyed have some framework for managing operational risk, many banks indicated that they were only in the early stages of developing an operational risk measurement and monitoring framework. Awareness of operational risk as a separate risk category has been relatively recent in most of the banks surveyed. Few banks currently measure and report this risk on a regular basis, although many track operational performance indicators, analyse loss experiences and monitor audit and supervisory ratings.
• Many banks have identified significant conceptual issues and data needs, which would need to be addressed in order to develop general measures of operational risk. Unlike market and perhaps credit risk, the risk factors are largely internal to the bank and a clear mathematical or statistical link between individual risk factors and the likelihood and size of operational loss does not exist. Experience with large losses is infrequent and many banks lack a time series of historical data on their own operational losses and their causes. While the industry is far from converging on a set of standard models, such as are increasingly available for market and credit risk measurement, the banks that have developed or are developing models rely on a surprisingly similar set of risk factors. Those factors include internal audit ratings or internal control self-assessments, operational indicators such as volume, turnover or rate of errors, loss experience, and income volatility.

Additional details from the interviews are discussed below under five categories: Management Oversight; Risk Measurement, Monitoring and Management Information Systems; Policies and Procedures; Internal Controls; and View of Possible Role for Supervisors.