Operational risk
The risk of loss from fraud, inadequate documentation, improper execution or similar internal failures — one of the named risks of derivatives trading, distinct from market, credit, liquidity and legal risk.
In plain language
Not every loss in derivatives trading comes from the market moving against you. Some losses come from the trading process itself going wrong.
A trade can be booked incorrectly. A document can go unsigned. A control that should catch an error can fail to catch it.
The workbook calls this operational risk. It sits alongside counterparty risk, price risk, liquidity risk and legal or regulatory risk as one of five named risks of trading a leveraged instrument.
How it works
The workbook's own words, from its list of risks a derivatives participant must understand: "operational risk (fraud, inadequate documentation, improper execution, etc.)."
The workbook lists five risks together in one passage, each with its own one-line description:
| Risk | What it is |
|---|---|
| Counterparty risk | Default by the counterparty |
| Price risk | Loss on a position because of a price move |
| Liquidity risk | Inability to exit a position |
| Legal or regulatory risk | Enforceability of contracts |
| Operational risk | Fraud, inadequate documentation, improper execution, etc. |
A sample question in the same chapter tests the point directly: operational risks include losses due to "inadequate disaster planning." That single example shows the range the category covers — it is not only fraud by an individual, but also a firm-level failure to plan for disruption, which is exactly why the workbook returns to business continuity and Disaster Recovery Site arrangements elsewhere in the paper.
Because derivatives are leveraged instruments, the workbook pairs this list of risks with a suitability warning: derivatives trading "may not be an appropriate avenue for someone of limited resources, or having limited trading experience, or with low risk tolerance." Market participants are directed to read the Model Risk Disclosure Document issued by exchange members before trading, which sets out these risks in the document given at the time of signing the client agreement.
A worked example
A brokerage's dealing desk handles a client's order to buy 50 lots of a stock futures contract.
| What happens | Risk category |
|---|---|
| The stock price falls sharply after the trade, and the position shows a mark-to-market loss | Price risk, not operational risk |
| The client fails to pay the margin call and defaults | Counterparty risk, not operational risk |
| A dealer keys in 500 lots instead of 50 because of a typing error, and the order executes before anyone notices | Operational risk — improper execution |
| The client's account documentation was never completed, so the firm cannot establish the agreed terms when a dispute arises | Operational risk — inadequate documentation |
| The firm's primary trading system goes down with no backup plan in place, and positions cannot be managed during a volatile session | Operational risk — inadequate disaster planning, the workbook's own sample-question example |
The fat-finger order, the missing documentation and the absent disaster plan are all losses that have nothing to do with which way the market moved — they are losses from the trading process itself, which is precisely what distinguishes operational risk from the other four risks in the workbook's list.
Why NISM asks about it
Chapter 1 (Basics of Derivatives), section 1.7 (Various risks faced by the participants in derivatives), lists operational risk alongside counterparty, price, liquidity and legal/regulatory risk, and a sample question at the end of the chapter tests it directly with "inadequate disaster planning" as the correct answer among the options given. Expect a matching question pairing a described loss with the correct risk category from this five-item list.
Common exam traps
- Operational risk is about the trading process, not the market or the counterparty. Fraud, documentation gaps and execution errors are all internal failures, distinct from price risk (market movement) and counterparty risk (the other side defaulting).
- "Inadequate disaster planning" is the workbook's own example of operational risk — a firm-level continuity failure counts, not only an individual's error.
- This is one of five named risks in the same passage — counterparty, price, liquidity, legal/regulatory and operational. A question may ask which of the five a described scenario belongs to, so know all five, not just this one.
- Do not confuse this narrow list with the wider, informal use of "operational risk" in banking or elsewhere — this page teaches the specific five-risk framework the workbook sets out for derivatives participants.
- The Model Risk Disclosure Document is where these risks are formally disclosed to a client — it is the compliance artefact tied to this list, not a separate risk category itself.
Where this is taught
- Series IV · Chapter 6: Trading Mechanism in Exchange Traded IRDintroduced here
- Series XXI-B · Chapter 17: Riskintroduced here
- Series VIII · Chapter 1: Basics of Derivativesintroduced here
- Series V-D · Chapter 13: Basics of Derivativesintroduced here
Related terms
- Legal or regulatory riskThe risk that a contract cannot be enforced — one of the five named risks of derivatives trading, described in this workbook simply as "enforceability of contracts."
- Disaster Recovery SiteA backup trading site an exchange activates to restore normal operations after an outage — the fallback that IRRA exists to cover for when both the primary platform and this site are disrupted.
- Regulatory RiskThe risk that laws and regulations change unfavourably — raising costs or altering competition — and hurt investment returns. The workbook treats it as a part of legal risk.
- Risk frameworkThe risk structure a portfolio manager sets at the strategic level, in line with the investment objective — it names the risks, ranks them, decides how each will be treated, and is monitored and modified continuously.
- M-SOCA Security Operations Centre built for the cyber security needs of smaller market intermediaries — cheaper and more accessible than building a full SOC, and mandatory for portfolio managers except the smallest.
- Cyber Security RiskThe risk that an AIF's or its service providers' systems are breached, corrupted or disrupted — governed by SEBI's Cyber Security and Cyber Resilience Framework, which all AIFs had to comply with by 31 August 2025.