Definitions and examples to support understanding of the cause and impact categories
“Our strategic priority was to create a common point of reference for operational risk taxonomies, laying the foundations which allow industry debate and consistent industry sharing of insights and data going forward."
Simon Wills, Executive Director, ORX
Using data from our member firms as the key input, we've developed reference cause and impact categories to level 2. The Cause and Impact Taxonomy provides definitions and examples to support understanding of the cause and impact categories, while the guidance helps you better understand how to use it.
Data remains in the driving seat
In our full report on the Event Type Taxonomy, we discussed that many organisations have divergent taxonomies even though they are often evolved from the Basel Event Types. This is particularly true for the more contemporary risks (such as information security, third party and cyber). Similarly, we saw the same pattern with the cause and impact categories collected in 2020.
The causes are often based on the original Basel definition of operational risk (people, process, systems and external). And, there is a core set of financial impacts observed, which is often aligned to regulatory and accounting standards. However, organisations have also evolved these categories over time, reflecting changes in their risk profile, businesses, and regulatory environment.
Top-level observations from the data
A continued link to Basel
The data shows a clear link with the Basel definition of operational risk (considering people, process, system, and external factors). The majority of the cause categories contain these four categories, with some of the taxonomies that were shared containing an augmented number of level 1 categories.
Impact categories have evolved beyond financial
Whereas there is a relatively clear set of common financial impacts, driven by regulatory and accounting standards, only a small percentage of our member organisations who shared their data exclusively use financial categories. There is a diverse set of non-financial impacts along two leading dimensions
- Impact channel – i.e. how the organisation is impacted (e.g. its reputation is tarnished)
- Stakeholder group – i.e. who is impacted by the operational risk event (e.g. customers of the member)
To help you get the most from our updated reference taxonomy, we’ve also created guidance and supporting documentation.
The guidance is free for ORX members and Lite subscribers and is available to purchase
The guidance includes examples and provides more detail about the taxonomies and how you can use them. It gives you detail on each level 1 risk, explains how to use flags and risk themes to add further context and insights to your data, provides information and definitions for specific cause categories and more.
New guidance added in 2023
In 2022, we ran a survey with our members to see how they're using the taxonomy and identify where we could provide further support to our community. Based on this survey, we've republished the Cause and Impact Taxonomy with additional guidance on:
- Mis-selling
- Malice
- Third party failure
Want to access the ORX Cause and Impact Operational Risk Reference Taxonomy?
If your firm has purchased the taxonomy or is an ORX member or ORX Lite subscriber, you can log in or register to access this resource.
Not a member or Lite subscriber? You can download a free version of the taxonomy or purchase the full taxonomy and guidance.
Steve Bishop
Research and Information Director, ORX
