Operational Risk Management for Australian ADIs: APS 115 Capital, Loss Data, and the Three Lines Model

Operational risk remains the fastest-growing capital charge for Australian banks. From cyber incidents and system outages to conduct failures and process errors, APRA expects ADIs to quantify these risks, hold capital against them, and embed robust governance across the organisation. This guide covers the key pillar: APS 115 Capital Adequacy: Operational Risk, along with the internal loss data requirements and the three lines of defence model that underpins it all.

What Is APS 115?

APS 115 is APRA's prudential standard requiring ADIs to hold regulatory capital specifically for operational risk. It sits within the broader capital adequacy framework (APS 110) and mandates that every ADI calculate an operational risk capital charge using an approved approach. The standard aligns with the Basel III finalisation reforms, which replaced the previous basic indicator and advanced measurement approaches with a single Standardised Measurement Approach (SMA).

The core principle: the more complex an ADI's operations and the larger its historical losses, the more capital it must hold. This creates a direct financial incentive to manage operational risk effectively.

The Standardised Measurement Approach (SMA)

Under APS 115, the operational risk capital requirement is driven by two inputs:

1. Business Indicator Component (BIC) -- a size-based proxy derived from the income statement
2. Internal Loss Multiplier (ILM) -- an adjustment based on an ADI's actual loss history

The formula is: ORC = BIC x ILM, where the BIC increases with the scale of the ADI and the ILM adjusts up or down based on whether actual losses exceed or fall below what the BIC alone would suggest.

Business Indicator Calculation

The Business Indicator (BI) is the sum of three components, each calculated from three-year averages of financial statement items:

The BI is then mapped to marginal coefficients across three buckets. Larger ADIs face higher marginal rates, reflecting APRA's view that operational risk scales super-linearly with institutional size and complexity.

Internal Loss Data Requirements

APRA requires ADIs to maintain a comprehensive internal loss data collection framework. This is not optional -- loss data quality directly affects the capital charge via the Internal Loss Multiplier. Key requirements include:

• Minimum threshold: All operational risk losses above AUD 20,000 must be captured
• Data fields: Gross loss amount, recoveries (insurance and other), date of event, date of discovery, date of accounting impact
• Mapping: Every loss event must be classified to one of the seven Basel loss event categories
• History: At least 5 years of quality loss data, with 10 years preferred for SMA calculation
• Validation: Independent review of loss data completeness and accuracy, at least annually
• Grouping: Related loss events stemming from a common cause must be grouped and treated as a single event

The Seven Basel Loss Event Categories

Every operational risk loss must be mapped to one of these categories. Understanding them helps ADIs design controls and allocate capital accurately:

For Australian ADIs, Category 4 (Clients, Products & Business Practices) has historically generated the largest losses by dollar value, driven by the Royal Commission remediation programs and ongoing conduct risk issues. Category 2 (External Fraud) continues to grow as cyber threats escalate.

The Three Lines of Defence Model

APRA expects all ADIs to operate a clear three lines model for operational risk governance. CPS 220 (Risk Management) and CPG 220 set the foundation, but APS 115 relies on it for capital adequacy purposes:

First Line: Business Units

• Own and manage operational risks within their activities
• Implement controls and maintain risk and control self-assessments (RCSAs)
• Report loss events promptly and accurately
• Escalate breaches and near-misses to second line
• Maintain process documentation and key risk indicators (KRIs)

Second Line: Risk and Compliance Functions

• Design and maintain the operational risk management framework (ORMF)
• Set policies, methodologies, and risk appetite for operational risk
• Challenge first-line risk assessments and control effectiveness
• Aggregate and report operational risk exposures to the Board
• Oversee loss data quality and capital calculation integrity
• Monitor regulatory change and translate into framework updates

Third Line: Internal Audit

• Independently assure the effectiveness of both first and second lines
• Test the ORMF design and operating effectiveness
• Validate loss data collection processes
• Report findings directly to the Board Audit Committee
• Follow up on remediation of identified deficiencies

Board and Senior Management Responsibilities

Under CPS 220 and APS 115, the Board must:

• Approve the ORMF and ensure it is adequate for the ADI's risk profile
• Set operational risk appetite with quantitative and qualitative measures
• Receive regular reporting on operational risk exposures, loss trends, and capital adequacy
• Ensure adequate resourcing of the second and third lines
• Hold senior management accountable via the Financial Accountability Regime (FAR) for operational risk outcomes

Senior management must implement the Board-approved framework, ensure loss data completeness, and maintain an operational risk culture where reporting failures and near-misses is encouraged rather than penalised.

APRA Enforcement: Recent Examples

APRA has demonstrated willingness to act on operational risk failures:

• Medibank (2024): APRA imposed a $250 million capital adjustment following the 2022 cyber breach, citing deficiencies in information security governance under CPS 234. The adjustment was only lifted after independent verification of remediation.
• Optus/telco sector (2023-24): While not an ADI, APRA used the incident to publicly warn regulated entities about concentration risk in critical service providers -- directly relevant to APS 115 loss scenario analysis.
• Major bank conduct remediation (2018-2025): Billions in remediation costs from fee-for-no-service and mis-selling (Category 4 losses) fundamentally reshaped operational risk capital requirements across the sector.
• CBA AUSTRAC (2018): The $700 million penalty for AML/CTF failures remains the largest operational risk loss event in Australian banking history, classified under Category 4.

Practical Steps for ADI Compliance

1. Audit your loss data: Confirm capture thresholds, completeness across all Basel categories, and data quality validation processes
2. Review BI calculation: Ensure the three-year averages feeding the Business Indicator are accurate and reconciled to audited financials
3. Stress-test the ILM: Model how changes in loss experience affect your capital charge -- this quantifies the ROI of risk reduction
4. Strengthen first-line ownership: Ensure business units have trained risk champions and that RCSA processes are meaningful, not tick-box
5. Upgrade loss event reporting: Implement real-time capture with automatic escalation triggers and root cause analysis workflows
6. Align with CPS 230: Operational risk capital, business continuity, and critical operations management are now deeply interconnected

This article is for informational purposes only and does not constitute legal or compliance advice. Consult qualified professionals for your specific obligations. GoComply's AI scanner covers 125 rules across 38 regulations with 110 knowledge base sources.