ORX Cause & Impact Operational Risk Reference Taxonomy

Are you an ORX Member? Log in here for the full taxonomy and guidance (check if your firm is a member)

Following the development of the ORX Event Type Taxonomy in 2019, it became clear to us that complementary cause and impact categories would support the understanding and use of the taxonomy. By covering the cause-event-impact ‘Bow Tie’ model, we could provide a more insightful view of how financial organisations can apply the operational risk taxonomy in practice.

So, applying a similar methodology to that used in our previous work, and again supported by Oliver Wyman, we've created the Cause and Impact Operational Risk Reference Taxonomy. This taxonomy consolidates the information collected from 50 financial services firms into a single view of causes and impacts.

The Cause and Impact Taxonomy is free to download, and we've also created guidance that you can purchase to help you use the taxonomy to its fullest advantage.

About the Cause & Impact Taxonomy

The cause and impact categories

Using data from our member firms (find out more about ORX Membership and which institutions are members) as the key input, we've developed reference cause and impact categories to level 2. The Cause and Impact Taxonomy provides definitions and examples to support understanding of the cause and impact categories, while the guidance helps you better understand how to use it.

Data remains in the driving seat

In our full report on the Event Type Taxonomy, we discussed that many organisations have divergent taxonomies even though they are often evolved from the Basel Event Types. This is particularly true for the more contemporary risks (such as information security, third party and cyber). Similarly, we saw the same pattern with the cause and impact categories collected in 2020.

The causes are often based on the original Basel definition of operational risk (people, process, systems and external). And, there is a core set of financial impacts observed, which is often aligned to regulatory and accounting standards. However, organisations have also evolved these categories over time, reflecting changes in their risk profile, businesses, and regulatory environment.

Top-level observations from the data

A continued link to Basel

The data shows a clear link with the Basel definition of operational risk (considering people, process, system, and external factors). The majority of the cause categories contain these four categories, with some of the taxonomies that were shared containing an augmented number of level 1 categories.

Impact categories have evolved beyond financial

Whereas there is a relatively clear set of common financial impacts, driven by regulatory and accounting standards, only a small percentage of our member organisations who shared their data exclusively use financial categories. There is a diverse set of non-financial impacts along two leading dimensions

• Impact channel – i.e. how the organisation is impacted (e.g. its reputation is tarnished)
• Stakeholder group –  i.e. who is impacted by the operational risk event (e.g. customers of the member)

Guidance available to help you use the ORX Reference Taxonomy 

Together, the Cause and Impact Taxonomy and the Event Type Taxonomy make up the ORX Operational Risk Reference Taxonomy. To help the operational risk community get the most from the ORX Reference Taxonomy, we've created guidance which is available to purchase alongside it.

The guidance includes examples and provides more detail about the taxonomies and how you can use them. It gives you detailed guidance on each level 1 risk, explains how to use flags and risk themes to add further context and insights to your data, provides information and definitions for specific cause categories and more.