Capturing operational risk impacts of coronavirus

  • 7 August 2020

How should the financial services industry capture operational risk losses from coronavirus?

Updated August 2020

We've updated our draft guidance on how to capture the operational risk impacts of coronavirus (Covid-19) following further discussions with our members. The new version includes advice specific to insurance members and advice on how to use the ORX Reference Taxonomy to classify coronavirus-related events. Read on for more information and the updates.

Initial guidance from ORX

Since we were set up in 2002, ORX has led the way in setting the standards for capturing and reporting operational risk losses. Our Operational Risk Reporting Standards are freely available and are an important resource for many financial organisations to support data collection and reporting.

Because of our expertise in this area, our community of risk professionals are naturally looking to us for guidance on how to capture operational and non-financial risks due to the coronavirus pandemic. This is a critical question for many financial institutions, and one which needs answering quickly.

In this article, I set out the updated initial guidance we have provided to members of ORX on how to capture losses caused by the coronavirus pandemic, including which specific impacts to include and exclude and breaking it down into the different types of impacts – on operations, logistics and people.

Working with our members to produce guidance

Our main standards were created in collaboration with the ORX Definitions Working Group (DWG), a group made up of expert representatives from our member firms who specialise in data categorisation. The situation we find ourselves in regarding coronavirus is so unique and urgent, that we agreed we would share guidance as soon as we were able to. As a result, I'm pleased to be able to share with you our initial thoughts on how firms can capture operational risk losses due to the coronavirus (Covid-19) pandemic within their loss data.

Towards the end of May, we updated the guidance we published in April, providing more guidance and specific examples for the insurance industry. Our aim in doing this is to provide consistency across the industry and within individual organisations. This guidance will help operational risk teams make informed and reliable judgements on how coronavirus has impacted their firm and lay the foundation for future benchmarking and lessons learnt.

Our guidance

While this guidance is for our members who submit their loss data to ORX, and in return access reporting and a global dataset, I believe it can be used as a foundation by all financial institutions on how to collect operational risk losses that relate to the 2020 coronavirus pandemic.

It's important to note that there are a range of views and opinions about how best to capture some aspects of the impacts of the coronavirus pandemic, reflecting variation in practice across firms and jurisdictions. However, in this article, we have brought together the DWG’s common thinking on this topic. Where possible, we also intend to align with reporting guidelines on coronavirus impacts created by other industry groups.

General approach

Our basic approach is for firms to ask themselves:

Would the impact have been experienced without the pandemic?” If the answer is “no”, then include the impact in operational risk reporting.

So, the impact should be included if:

  1. The cost has arisen as a result of the coronavirus pandemic
  2. It was an unexpected cost, i.e. wasn’t planned for, budgeted for, or part of any strategic plan that was in place before the pandemic
  3. It was not a goodwill payment / cost incurred (e.g. ex-gratia payments etc)

This approach is simple to apply and captures the range of immediate impacts and costs that firms have incurred. It will provide a good range of impacts for future pandemic analysis and scenarios.

What are we asking our members to report to ORX?

When submitting loss data to our databases, we are currently asking our members to consider these costs:

Impacts of operations

  • Working from home – one-off costs of additional work-at-home equipment (e.g. laptops) and services (e.g. increased VPN capacity) required specifically as a result of the pandemic. Only include equipment purchased that was essential for maintaining operations that would otherwise have been disrupted by the pandemic. Include costs of equipment that was not already budgeted for and accounted for as part of any existing IT upgrade plan. The full equipment cost should be used as the loss amount.
  • Cleaning costs – cleaning costs clearly attributable to the pandemic, such as the cost of deep cleaning buildings where staff have tested positive for coronavirus.
  • Protective equipment – for example, plastic screens in branches, face masks, gloves required to maintain operations during the pandemic.
  • Building costs – immediate additional costs of building closure caused by the pandemic (for example, additional security costs).
  • Cost of establishing a pandemic command centre – only include costs over and above existing business continuity planning/control spend, e.g. providing food and accommodation for staff during the pandemic period.

Advice specific for insurers:
Claims payments on contracts with pandemic exclusions

Some insurers have come under pressure from regulators, governments and consumer groups to make claims payments on policies that have pandemic exclusions. This situation is continuously evolving and will review this regular, but for the moment this is our guidance to our insurance members:

  • If there is a court judgement or regulatory instruction to pay out on the claim, this is reportable as an operational risk loss, as this would be an example of a retroactive change in the law.
  • If the firm decides to make an ex gratia payment or make an out-of-court settlement with a customer, the payment is only reportable if there is an underlying operational risk event (for example if the contract is defective).

Impacts on logistics

  • Costs of cancelled travel or events – losses due to cancellations caused by the pandemic are reportable.

Impacts on people

  • Consultants – one-off costs of additional work-at-home equipment (e.g. laptops) and services (e.g. increased VPN capacity) required specifically as a result of the pandemic. Only include equipment purchased that was essential for maintaining operations that would otherwise have been disrupted by the pandemic. Include costs of equipment that was not already budgeted for and accounted for as part of any existing IT upgrade plan. The full equipment cost should be used as the loss amount.
  • Special payments – for example, one time add-to-pay, or top-up for employees that are required to go to the office, but only that are directly a result of pandemic.
  • Cost of providing additional mental health support for staff – immediate costs to support staff during the pandemic crisis period would be reportable as these are a direct impact of the pandemic.

What are we asking our members to exclude?

Here are some of the things that we are asking our members not to include in their loss data reported to ORX:

  • Fee waivers and mortgage holidays – these are considered to be a goodwill gesture to customers, and the costs of administering these programmes would also not be reportable unless there are additional costs due to the pandemic, such as hiring external staff to process high volumes of transactions.
  • Reduced revenue – if a firm generates less revenue due to the economic downturn caused by the pandemic, then this is a longer-term change in the operating environment and would represent an opportunity cost.
  • Staff wages – continuing to pay staff that are not working because the firm has made a decision to shut a branch, and staff are unable to work at home.
  • Sick pay and health premiums – sick pay costs would be considered a cost of doing business.

ORX Reference Taxonomy and coronavirus

Last year, ORX published the ORX Reference Taxonomy for level 1 and level 2 risks. If you use this Reference Taxonomy to classify coronavirus related events, it would result in a similar approach as advocated for the Basel Event types where the pandemic is a cause of a number of risk events resulting in multiple impacts (the Reference Taxonomy is based on the cause-event-impact bow tie model).

Treating the pandemic as a cause, events arising would be classified in the Reference Taxonomy under a number of categories such as failures in business continuity planning, transaction processing & execution errors, physical security and safety concerns and fraud. The Reference Taxonomy methodology approach would also advocate grouping these events using a ‘pandemic flag’ to allow collective analysis and reporting.

Subsequent waves of infection

There may be subsequent waves of virus infection sometime after the initial coronavirus impact. As the pandemic impacts are experienced at different times in different regions, it is suggested that subsequent impacts from potential future waves are aggregated as part of the same loss event. For this reason, ORX is not proposing an ‘end date’ for this coronavirus pandemic, although this can be kept under review.

When do costs associated with the pandemic become costs of doing business in a new operating environment?

General principle

Costs to enable the firm to restore operations following the impact of the coronavirus pandemic are reportable as operational risk losses.*

Ongoing, expected costs required after the pandemic lockdown period to maintain operations are not reportable. For example, if these ongoing costs are incorporated as items in post-pandemic budgets in response to measures mandated by public health agencies, then they would be seen as preventative measures and therefore not reportable to ORX. We created a decision tree for our members to help them decide if a cost is reportable or not.

*See BCBS 196, section 85 (b) “The following specific items should be included in gross loss computation…Costs incurred as a consequence of the event that should include external expenses with a direct link to the operational risk event …and costs of repair or replacement, to restore the position that was prevailing before the operational risk event.”

Download the full guidance

ORX coronavirus event capture guidance August 2020

This is the full guidance that we have provided to our membership on how to capture the operational risk impacts of coronavirus.

Access an unrivalled global dataset of operational risk losses

With ORX Membership you can access an extensive database of operational risk losses from around the world, take part in research studies, collaborate with other financial institutions and more.

Find out more about ORX Membership


Explore all our resources on coronavirus and its impact on operational risk.

Coronavirus resources