… giving structure to the Basel risk categories and addressing opportunities as well as risks

  Already have an ISMS? perhaps we can help you create a better one!

Taxonomies of risk and opportunity

Introduction — inspired by Basel

The Basel Accord is a global, voluntary regulatory framework for banks. It encourages risk management framed around three components: credit risk, market risk and operational risk. Whilst such a framework is banking-centric, it inspires generalisation to all types of business, and gives rise to the risk taxonomy described below. Moreover, this in turn inspires the creation of an opportunity taxonomy.

Basel generalisation

All businesses operate within a market and in trading, deal with money. Thus all businesses are exposed to market risks and trading risks. It just so happens that a bank’s market is the money market, and therefore a bank’s market risks are synonymous with its trading risks, see table 1.

Moreover, all businesses have products (or services) and are thereby exposed to product risks. The principal banking product is credit, and therefore its product risks are synonymous with its credit risks.

Basel risk category Generalised risk category
Credit risk Product risk
Market risk Market risk
Trading risk
Table 1: correspondence of Basel credit and market risk categories to generalised risk categories


There is another categorisation of risk, and that is the origin of the risk source: internal or external. Consider the risk “an organisation is not paid for work performed”. There are many reasons why it is not paid, e.g.:

  • its work was of poor quality or otherwise did not fulfil its contractual specifications;
  • it performed the work without a contract; and
  • it did not invoice the customer.

All these have one thing in common — they are all within the organisation’s control, i.e., the source of risk is internal.

Despite ensuring that all such internally sourced risks are properly mitigated, the organisation still might not be paid — just because the customer is just like that, i.e., the customer just does not pay their bills. The source of risk in this case is external.

Moreover, this is an example of what Basel refers to as a credit risk and in the general case it is a product risk because if it wasn’t for the sale of a product, the risk of non-payment would not have arisen.

Basel refers to the internally sourced risks as operational risks. Thus, since all the risk categories in Table 1 can have internal and external risk sources, there will be operational risks that are associated with product, market and trading risks.

If product risk arises just because the organisation sells a product, it follows that market risk arise because of the market in which the organisation operates, and trading risks arise because money (and other assets) change hands, which need not be because a product is sold or work is performed.

In like vein, there is one other category of risk, that that is simply the risks to which an organisation is exposed merely because it exists. We refer to these as existence risks, for example risks associated with fire and flood.

Risk taxonomy

Putting all this together generates the taxonomy shown in Figure 1.

  Primary risk category Definition: the risk of loss arising from… Associated operational risk: the inadequacy or failure of internal processes, people and systems that results in a risk of…
  Product risk … default by a creditor (which will usually be a customer). … doing work and not making a profit.  1 
MARKET RISK Trading risk … changes in trading positions when prices move adversely. … the organisation’s money and other assets not being worth as much as they ought.  2 
Market risk … the market refusing to buy what the organisation has to offer at the price it wishes to sell. … being unable to sell what the market wants.  3 
  Existence risk … the fact that the organisation exists  5  … spending money unnecessarily.  4 
Figure 1: A taxonomy of risk

The table shows that the Basel operational risk category comprises of five risk areas. Thus, this generalised risks taxonomy gives structure to the Basel risk categories.

Want to see some example risks in each category?

Opportunity taxonomy

We can proceed along similar lines to generate a taxonomy for opportunities, see Figure 2. In this case, there are three primary categories of opportunity: the first associated with the products and services that the organisation has to offer, and the second two being associated with general characteristics of all organisations: value and buying power. In each case, opportunities are facilitated either internally or externally. If the opportunity is created by the organisation, it is internally facilitated. If the opportunity is created by another organisation, it is externally facilitated.

Opportunity category Description
Product opportunity Project opportunity is the opportunity for gain resulting from the organisation having products (or services) to sell (products for sale. Having something to sell provides the organisation with the opportunity to create and reinforce its market presence. In turn, this leads to a variety of externally generated sales and marketing opportunities. Customers take an interest in what the organisation has for sale and buys what it has to offer.  There are also opportunities for R&D leading to new and improved products and services.
Treasury opportunity Treasury opportunity is the opportunity for gain resulting from making the best use of the money that the organisation has. Internally, it manages its cash flow, but in so doing it can take advantage of externally facilitated opportunities concerning credit facilities with suppliers, bank interest rates and other investment opportunities.
Corporate opportunity Corporate opportunity is the opportunity for gain resulting from being the type of business and market in which the organisation operates and how others perceive it as a corporate entity, for example, an organisation in which to invest.
Figure 2: A taxonomy of opportunity

Want to see some example opportunities in each category?