Operational risk covers the losses that come from failed processes, people, systems and external events. Basel frameworks, RBI guidelines and ISO 31000 all expect it to be managed day to day, not only recorded in a register once a year.
Our course gives managers practical tools to identify, assess and mitigate operational risk. The guide below looks at what goes beyond the risk register.
Quick answer
RBI's 2024 Guidance Note expects banks and NBFCs to manage operational risk through three lines of defence and to train staff at all levels in a way that fits their role. Under the Companies Act, the Board's report must cover the risk management policy, and under SEBI LODR, the top 1,000 listed companies must have a Risk Management Committee.
The course
What the law requires
RBI Guidance Note on Operational Risk Management and Operational Resilience (30 April 2024)
The RBI Guidance Note (RBI/2024-25/31) applies to all commercial banks, primary (urban), state and central co-operative banks, the All India Financial Institutions and all NBFCs including housing finance companies. It replaces the 2005 Guidance Note on Management of Operational Risk and is based on the Basel Committee's March 2021 principles on sound management of operational risk and on operational resilience. It sets 17 principles covering governance, the risk management environment, operational resilience and learning from disruptions. RBI describes the approach as principle-based and proportionate, and says the tools it describes are indicative.
On people and training, paragraph 3.3 says each line of defence should have clearly defined roles, be adequately resourced and be "continuously and adequately trained". Principle 1 asks the Board and senior management to ensure staff receive appropriate risk management and ethics training, and paragraph 4.5 says senior management should make operational risk training available at all levels, reflecting each person's seniority, role and responsibilities, with ethics training included.
Other principles cover a Board-approved risk appetite and tolerance statement (Principle 4), identification and assessment tools such as self-assessments, operational risk event data, metrics and scenario analysis (Principle 6), change management (Principle 7), monitoring and reporting (Principle 8), internal controls (Principle 9), mapping of critical operations and third-party dependencies (Principles 10 and 11), business continuity (Principle 12), incident management (Principle 13), ICT and cyber security (Principle 14) and lessons learned (Principles 16 and 17). The Board should approve criteria for critical operations and impact tolerances for each critical operation, reviewing them at least annually.
For IT-related risk specifically, the RBI Master Direction on IT Governance (paragraph 4(c)) requires the enterprise-wide or operational risk management policy to include periodic assessment of IT-related risks.
Companies Act, 2013: sections 134(3)(n), 177(4)(vii) and Schedule IV
Under section 134(3)(n) of the Companies Act, 2013, the Board's report must include a statement on the development and implementation of a risk management policy, including identification of any elements of risk that the Board thinks may threaten the existence of the company. For listed companies, section 134(5)(e) requires the directors' responsibility statement to confirm that internal financial controls are laid down, adequate and operating effectively.
Section 177(4)(vii) makes "evaluation of internal financial controls and risk management systems" part of the Audit Committee's terms of reference. Schedule IV (Code for Independent Directors) asks independent directors to satisfy themselves that financial controls and systems of risk management are robust and defensible.
SEBI LODR Regulations, 2015: Regulation 21 (Risk Management Committee)
Regulation 21 of the SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015 applies to the top 1,000 listed entities and to high value debt listed entities. The Board must constitute a Risk Management Committee of at least three members, a majority of them directors and including at least one independent director, chaired by a director. It must meet at least twice a year with no more than 210 days between meetings.
The committee's role, set out in Part D of Schedule II, includes formulating a detailed risk management policy covering a framework for identifying internal and external risks (expressly including financial, operational, sectoral, ESG, information and cyber security risks), mitigation measures and internal controls, and a business continuity plan. The committee must monitor the policy's implementation and review it at least once every two years. Under Regulation 21(4), the functions delegated to it must specifically cover cyber security.
Who must be trained and how often
No law or regulation sets a fixed frequency for operational risk training. RBI's Guidance Note expects training to be continuous and available at all levels, matched to role, so first-line business managers, second-line risk and compliance staff and third-line auditors each need content suited to their responsibilities.
Common practice, not law, is to train managers and risk champions when they take up the role and refresh annually, often timed around the RCSA cycle, with a separate briefing for Board and Risk Management Committee members.
| Audience | Focus | Source of the expectation |
|---|---|---|
| First line: business and operations managers | Identifying and assessing risks, operating controls, reporting incidents and near misses | RBI Guidance Note paras 3.3 and 4.5 |
| Second line: risk and compliance | Independent challenge, KRIs, loss data, risk appetite monitoring | RBI Guidance Note para 3.3 |
| Third line: internal audit | Independent review of the operational risk framework | RBI Guidance Note para 3.3; Companies Act s.177(4)(vii) |
| Board, Audit Committee, Risk Management Committee | Risk appetite, critical operations, impact tolerance, oversight | RBI Principles 1, 3 and 4; LODR Reg. 21; Companies Act Sch. IV |
Penalties and consequences
The RBI Guidance Note does not contain a penalty schedule, and LODR Regulation 21 does not set its own penalty. The table lists what each source requires and, where the source states it, the consequence of default.
| Source | Who it applies to | Requirement and stated consequence |
|---|---|---|
| Companies Act s.134(3)(n) and s.134(8) | All companies preparing a Board's report | Statement on risk management policy in the Board's report. Default under s.134: penalty of ₹3 lakh on the company and ₹50,000 on each officer in default |
| Companies Act s.177(4)(vii) | Companies required to have an Audit Committee | Audit Committee to evaluate internal financial controls and risk management systems |
| SEBI LODR Reg. 21 and Schedule II Part D | Top 1,000 listed entities and high value debt listed entities | Risk Management Committee; risk policy covering operational and cyber risk and a business continuity plan; policy review at least every two years |
| RBI Guidance Note 2024 | Banks, co-operative banks, AIFIs, all NBFCs incl. HFCs | Operational risk framework with three lines of defence; role-based training at all levels; Board-approved risk appetite and impact tolerances |
What good Operational Risk training covers
- What operational risk is: losses from failed processes, people, systems and external events, with Indian examples
- The three lines of defence and what each line is expected to do
- Risk identification tools: process mapping, risk and control self-assessment (RCSA) and scenario analysis
- Assessing likelihood and impact, and linking results to the Board-approved risk appetite
- Key risk indicators: choosing thresholds and escalating breaches
- Designing and testing controls, including change management for new products and systems
- Recording incidents, losses and near misses honestly, and why the data matters
- Third-party and outsourcing risk, and mapping dependencies for critical operations
- Links to business continuity, cyber security and fraud risk
- Ethics and risk culture, which RBI expects to be included in training
Our courses for this topic
| Course | Audience | Duration | Language | Format |
|---|---|---|---|---|
| Operational Risk Management | Management | 60 min | English | SCORM eLearning |
Laws & standards covered
- Basel II/III Operational Risk Framework
- RBI Operational Risk Guidelines
- ISO 31000 Risk Management
- SEBI Risk Management Circular
Who it's for
- Risk management teams
- Operations managers
- Internal auditors
- Finance and compliance professionals
Guides & insights
Frequently asked questions
Is the RBI Guidance Note on operational risk binding?
It is issued to banks, co-operative banks, AIFIs and NBFCs as guidance and describes its tools as indicative, to be applied proportionately. RBI says it should be read with its other instructions, which prevail if there is any inconsistency.
Does RBI expect operational risk training for all staff?
Paragraph 4.5 says senior management should ensure an appropriate level of operational risk training is available at all levels of the organisation, reflecting seniority, role and responsibilities, and including ethics training.
Does the Companies Act apply to non-financial companies?
Yes. Every company preparing a Board's report must include the risk management policy statement under section 134(3)(n), and Audit Committees must evaluate risk management systems under section 177(4)(vii). Neither section prescribes training, but staff who run controls need to understand the policy the Board reports on.
Which listed companies need a Risk Management Committee?
Under Regulation 21(5) of SEBI LODR, the top 1,000 listed entities and high value debt listed entities. The committee's role must cover operational and cyber security risks and a business continuity plan.
Who should take the Operational Risk Management course?
The [Operational Risk Management course](/courses/operational-risk-management) is aimed at risk teams, operations managers, internal auditors and finance and compliance professionals across the three lines of defence.
How does this relate to business continuity training?
RBI treats business continuity as part of operational resilience (Principle 12), and LODR requires the Risk Management Committee's policy to include a business continuity plan. See our [business continuity training guide](/training/business-continuity).
Which Operational Risk Training courses does Compliance at Workplace offer?
Operational Risk Management (60 min, for Management).
Which laws and standards does Operational Risk Training cover?
Basel II/III Operational Risk Framework; RBI Operational Risk Guidelines; ISO 31000 Risk Management; SEBI Risk Management Circular.
Who should take Operational Risk Training?
Risk management teams, Operations managers, Internal auditors, Finance and compliance professionals.
Can the Operational Risk Training be customised to our organisation?
Yes. Every course can be customised to your policies, branding and industry scenarios, and delivered on your LMS as SCORM or on our Compliance Central platform.
Sources
- RBI Guidance Note on Operational Risk Management and Operational Resilience, 30 April 2024
- Companies Act, 2013 (India Code)
- SEBI (Listing Obligations and Disclosure Requirements) Regulations, 2015, as amended to 14 July 2026
- RBI Master Direction on IT Governance, Risk, Controls and Assurance Practices, 7 November 2023
Last updated by the Compliance at Workplace Editorial Team.