By Dr Jimi M.V. Hinchliffe · JADEtc Academy
Stop adding a new top-level risk category every time a subject attracts regulatory attention. A good operational risk taxonomy should be MECE where it matters — and multidimensional where complexity demands it.
The taxonomy problem nobody seems to want to fix
For roughly two decades, operational risk management has struggled with a classification problem. The original Basel II event-type taxonomy provided a common language for loss events. Since then, cyber, conduct, people risk, third-party risk, operational resilience and now AI have all attracted regulatory and management attention. Some firms have responded by adding them to the same risk-category hierarchy. The result is sometimes a mixture of events, causes, impacts, exposures and management disciplines. These are not interchangeable.
1. Start with causes, events and impacts
A useful taxonomy distinguishes causes and drivers (why something goes wrong), risk events (what goes wrong) and impacts (what happens as a consequence). For example, inadequate testing or a supplier defect may cause a payment-processing outage, leading to customer harm, financial loss and remediation costs. Treating these as competing event types obscures analysis and accountability.
2. MECE: the basic test of a good event taxonomy
A primary event taxonomy should aim to be MECE — Mutually Exclusive, Collectively Exhaustive. Mutually exclusive categories support one consistent primary classification for an event, rather than competing overlapping labels. Collectively exhaustive categories should cover the relevant event population without routinely forcing incidents into inappropriate or miscellaneous buckets. MECE is an aspiration for the primary classification dimension; causes, impacts and thematic attributes may legitimately be multiple-valued. A single hierarchy should not be expected to answer every risk question.
3. The fashionable-risk trap
Cyber is a threat and technology domain capable of producing fraud, data breaches or disruption. People risk can describe causal factors, although some people-related events fall within established employment-practice categories. Conduct concerns behaviours and outcomes. Operational resilience is principally a capability and regulatory discipline. Third-party risk describes dependency-related exposures. AI is a technology and possible driver or amplifier of multiple event types. Each matters, but they are not all mutually exclusive kinds of operational risk event.
4. Why the EBA may be on the right track
The EBA’s August 2025 final draft RTS on operational risk loss taxonomy under CRR3 retains the seven Basel event-type families, adds more granular Level 2 categories and introduces cross-cutting attributes for relevant characteristics, including ICT/cyber and model-related dimensions. This offers a more useful way to analyse a cyber-related disruption without forcing “cyber” to compete with “business disruption” as the sole primary classification. Separately, the EBA’s August 2026 consultation on the operational risk management framework addresses governance and management of operational risk information. These are distinct EBA publications: the 2025 loss-taxonomy RTS should not be confused with the 2026 framework consultation, which closes on 31 December 2026. Nor should final draft RTS be misdescribed as already applicable final law.
5. AI is the next test of taxonomy discipline
An AI-assisted fraud attack, an erroneous AI model decision, an AI application exposing customer information and a failed third-party AI service can produce very different operational events. Grouping them all into a single “AI risk” event category conceals those differences. Better to classify the underlying event consistently and apply an AI-related attribute alongside other relevant dimensions such as cyber, model involvement and third-party dependency. An AI flag is our suggested internal analytical practice, not an assertion that the EBA has mandated a general AI attribute.
6. ORX provides a complementary model
The ORX Operational Risk Reference Taxonomy builds on the Basel foundations while separating event-type classification from cause-and-impact analysis, with additional flags and themes. The EBA and ORX approaches are not identical, but they support a useful design principle: stable event categories alongside richer, cross-cutting information. Firms should review the current ORX definitions and licence terms before mapping their internal data.
7. What a multidimensional ORM taxonomy needs
A modern framework should connect: (1) a stable primary event-type classification; (2) causes and risk drivers; (3) impacts, including customer harm and service disruption; (4) cross-cutting attributes such as cyber, AI, conduct and third-party involvement; and (5) business context, including entities, processes, products and important business services. This supports RCSAs, incident analysis, KRIs, scenarios, resilience testing, third-party assessments and management reporting without multiplying overlapping event categories.
8. Five questions before adding the next risk category
- Is this an event, a cause, an impact, an exposure or a management discipline?
- Could it apply across multiple existing event types?
- Would an attribute or flag be more analytically useful?
- Will the change improve consistency, aggregation and comparability?
- Does it improve risk decisions, or merely show attention to a fashionable topic?
Conclusion: evolve the taxonomy, do not keep reinventing it
The Basel event taxonomy was a valuable starting point, not a complete description of every risk management question. The EBA’s use of cross-cutting attributes and the ORX separation of event types, causes and impacts offer promising routes towards a more coherent framework. They do not resolve every boundary issue: even detailed Level 2 categories deserve scrutiny for overlap. AI will not be the last fashionable risk theme. A well-designed taxonomy should accommodate the next one without reinventing its core.
A practical example: one incident, several dimensions
| Dimension | Illustrative classification |
|---|---|
| Primary event | Business disruption / system failure, subject to the applicable definitions |
| Causes | Third-party software vulnerability; deficient testing or controls |
| Impacts | Payment delays, customer harm, financial loss |
| Cross-cutting themes | Cyber; AI involvement; third-party dependency |
| Business context | Payments process; important business service; supplier |
Illustrative only. Actual regulatory event classification depends on the event facts and the applicable taxonomy rules.
Sources and further reading
- EBA — RTS on operational risk losses (2025 final draft)
- EBA — ORM framework RTS consultation (2026)
- ORX — Operational Risk Reference Taxonomy
- Basel Committee — Basel II revised framework (2006)
Related JADEtc Academy Insights
ORM — Back to Basics: 10 Fundamentals · Selecting and Implementing a GRC System