Operational risk in Islamic finance can arise from a variety of sources. The document identifies six main categories of operational risk: 1) Shariah non-compliance risk, 2) people risk, 3) technology risk, 4) fiduciary risk, 5) legal risk, and 6) reputational risk. It also discusses the nature of operational risks as either internally or externally inflicted, the impacts as direct or indirect, and the degree of expectancy as expected or unexpected losses. Proper identification and management of operational risks are important for Islamic financial institutions.

1. RISK MANAGEMENT
IN
ISLAMIC FINANCE
Mahyuddin Khalid

2. Operational Risk
Content
Definition Of Operational
Risk
Scope Of Operational Risk
Identification Of Operational
Risk
Operational Risk In Islamic
Financial Contracts
Learning Outcome
• To know the meaning of
operational risk
• To identify the 5 groups of
operational risk
• To know the types of Islamic
financial contracts
2

3. Definition
 Basel II defines operational risk as
 “risk of loss resulting from inadequate or failed internal processes,
people or system or from external events.”
 This definition limits operational risks into two subsets which
are risks that occur from internal system mistakes and risks that
occur from external events (both due to the system itself as well
as personal human errors)
 The IFSB has expanded on the prior definition of operational
risks by adding two more subsets which are:
 Risks that occur due to an Islamic bank’s noncompliance with Shariah
principles
 Risks that occur due to the Islamic bank’s failure in fulfilling its fiduciary
obligations.
3

4. Operational Risk in Islamic Banks
 Scope of operational risk;
 Shariah Non-Compliance Risk
 People’s Risk
 Technology Risk
 Fiduciary Risk
 Legal Risk
 Reputational Risk
 Given the newness of Islamic banks, operational risk in terms of
person risk can be acute in these institutions.
 Operational risk in this respect particularly arises as the banks
may not have enough qualified professionals (capacity and
capability) to conduct the Islamic financial operations.
4

5.  However, Islamic banks is also exposed to shariah risk which
falls under operational risk
 Shariah risk is the possibility of risk which causes loss to IFI in
the event of non compliance
 E.g. if transaction is non shariah-compliant, the income generated from
the transaction must be forgone. Thus the institution suffers loss of
income, loss of opportunity and also reputational risk.
 E.g. legal cost arising from non-shariah compliant transaction; being
sued due to non shariah compliance
 Shariah risk may also arise from the lacking of shariah
competency which results in non-shariah compliance, loss of
income and loss of opportunity.
5

6. Scope Of Operational Risk
1. SHARIAH NON-COMPLIANCE RISK
 IFSB states that Shariah compliance risk in an Islamic bank occurs
when an Islamic bank fails or does not comply with the various
Shariah principle provisions and standards set by the Shariah
board where the Islamic bank operates.
 For the Islamic bank, compliance with various Shariah principles is
strictly required for every Islamic bank.
 Noncompliance with Shariah principles means that an Islamic
bank will enter a transaction that is prohibited by the Islamic
Shariah. . Any violations over Shariah principles can cause the
contract entered to be void.
6

7. Scope Of Operational Risk
2. PEOPLE RISK
 People risk is a type of operational risk arising from
incompetence or fraud, which exposes Islamic banks to potential
losses. This includes human errors, lack of expertise and fraud.
 In the other word, inadequately trained staff or incapable
personnel will expose Islamic banks unnecessarily to operational
risk.
 Skilled staffs of Islamic banks will ensure that the products are
efficient as well as Shariah compliant. Unskilled staffs can cause
the product to be, either illegitimate according to Shariah or
inefficient.
7

8. Scope Of Operational Risk
3. TECHNOLOGY RISK
 In an advanced financial industry, an Islamic bank’s operations are
very much dependent on its technological system.
 It is often that a success of an Islamic bank’s business is
determined by the ability to capitalise the use of an information
technology in different ways. An inability to keep up with the
advanced use of an information technology could cause an
Islamic bank fall behind its competitors.
 Every Islamic bank must be committed to an ongoing process of
upgrading, enhancing and testing its technology to effectively
meet sophisticated client requirements, market and regulatory
changes and evolving internal needs for information and
knowledge management.
8

9. Scope Of Operational Risk
 4. FIDUCIARY RISK
 Fiduciary risk is tightly related with the Islamic bank’s function as
intermediator (3rd party) between the owners of excess funds and
debtors lacking in them.
 Fund owners entrust their funds to the Islamic bank to be managed as
well as possible by channelling these funds to other parties lacking
funds for their enterprises.
 An Islamic bank’s inability to choose profitable investment
opportunities will contribute to a high instability of the income received
by the Islamic bank.
 Under those conditions, the Islamic bank will be unable to fulfil its
responsibilities to the current account holder when the depositor wants
to withdraw funds from it.
 If this happens, this risk could spread to reputation risk for the Islamic
bank. Fiduciary risk can be prevented through improvements in
financing policy such as better selection processes before channelling
financing.
9

10. Scope Of Operational Risk
5. LEGAL RISK
 Legal risk can happen when the Islamic bank or its employees
commit acts that violate the law; this generates sanctions on the
bank that it must fulfil.
 It can also happen when the Islamic bank is involved in a legal
case due to some misinterpretation of the laws and regulations
involved.
 Additionally, legal risk can also happen due to changes in the law
and other regulations. With these in mind, it is important for the
Islamic bank to retain law experts of its own among its staff.
10

11. Scope Of Operational Risk
6. REPUTATIONAL RISK
 This risk does not only have the potential to cause loss for the
bank in question, but also the banking industry in general.
 This risk can also increase the risk of customer fund withdrawal,
shareholder capital withdrawal and liquidity risk.
 This risk can be mitigated by regular supervision, the
standardization of Shariah banking’s operational procedures,
independent evaluation by each Islamic bank, and the like.
11

12. Identification Of Operational Risks
Generally, operational risk is divided
into 5 groups
Nature of risk
Internally inflicted
Externally inflicted
Impact of the risk
Direct
Indirect
Degree of
Expectancy
Expected
Unexpected
Frequency and
Severity
High frequency /
low severity
Low frequency /
high severity
Hazard, Event &
Consequence Type
12

13. 1. Nature Of The Risk
INTERNAL
• It is caused by fraud, misappropriation of property or
circumvention of regulations, law, or company policy
• While in an Islamic bank, the bank’s failure to comply
with Shariah principles in various banking products
and the bank management’s inability to fulfil its
fiduciary responsibility
• Tightened controls and management of the personnel
that can help prevent some employee errors and
internal fraud, and also an improved
telecommunication network which can help prevent
some technological failures.
EXTERNAL
• It is caused by external fraud, theft, computer hacking,
regulatory regime change, and other factors which are
beyond the control of an Islamic bank
• It includes fraud done by outside parties (debtors or
depositors), hacker attacks on the bank’s information
system, abrupt changes in the regulatory regime, and
others.
• The Islamic bank can better prevent some external
factors by constructing a tighter and more
comprehensive system to handle it
13

14. 2. Impacts of the Risk
Impacts of the Risk
Direct Risk
Indirect
Risk
14

15. Direct Risk
Direct risks are all types of risks that will directly affect the
Islamic bank when a risk event occurs.
Loss type Contents
Write-downs Direct reduction in the value of assets due to theft, fraud,
unauthorized activity, or market and credit losses arising as a
result of operational events.
Legal liability Judgements, settlements, and other legal costs.
Regulatory and compliance Taxation penalties, fines, or the direct cost of any other
penalties, such as license revocations.
Loss of or damage to assets Direct reductions in the value of physical assets, including
certificates, due to an accident, such as neglect, accident, fire
and earthquake.
15

16. Indirect Risk
The indirect effects of operational risk are usually tightly
related with opportunity costs occurring from loss-causing
operational risk events.
For example, when a human error or system error occurs in
a transaction, the bank will need to expend some amount
to replace the loss experienced or to repair the system.
Those costs are the indirect effects of operational risks on
an Islamic bank. As such, in many operational risk events,
the occurrence of operational risk can cause a double
negative effect to the Islamic bank.
16

17. 3. Degree of expectancy
Degree of expectancy
Expected loss
Unexpected loss
17

18. Expected loss
Expected loss is the sort of loss that occurs regularly
enough that both the frequency as well as the severity can
be predicted by the Islamic bank.
Thus, expected loss is one that can be anticipated
beforehand, even if it does not always occur.
As for expected loss, the bank usually sets a provision for
every type of operation risk event that is predictable and
occurs regularly.
18

19. 3. Frequency and Severity
High Frequency/Low
Severity
Low Frequency/Low
Severity
High Frequency / High Severity
Low Frequency / Low Severity
19

20. High Frequency/Low Severity • Operational risk within that category is easy to identify and are
usually already anticipated by the Islamic bank’s management.
• On a different note, unexpected loss falls under the category of
low frequency and higher severity because the majority of loss
that is unpredictable previously happened on a low frequency
and yet with a high impact to the bank.
• Events that are high frequency/low severity can have a major
impact for the Islamic bank.
• Even if the amount of loss per event is small, if those losses are
ignored, the accumulated loss suffered by the bank can easily
pile up.
High Frequency / High Severity • But according to other practitioners and researchers, events
fall under the category of high frequency and high severity are
almost impossible in a particular field of business, because most
people would avoid entering an industry where the risk of
experiencing large losses exist and can happen frequently too,
the potential to create any sort of profit in the business is then
low.
20

21. Low Frequency /Low Severity • Generally not relevant with operational risk management that the
Islamic bank needs to face.
Low Frequency/High Severity • Events that are low frequency/high severity are events of
unexpected loss that happen very rarely, but if they ever occur, the
damages suffered from the event by the Islamic bank are very big
and in several cases, can even cause an Islamic bank’s bankruptcy.
• Because the effect is so large, the Islamic bank should also pay
attention to all events in the category of low frequency/high
severity.
21

22. 4. Hazard, Events and Consequence Type
The definition of hazard is a condition or character, both in
terms of physical traits or those of behaviour and character
that influences the probability of a dangerous event’s
occurrence.
Event is everything that can cause the occurrence of loss to
an Islamic bank.
The relationship between the hazard, event, and
consequences is a relationship of cause and effect. The
event is the effect of the presence of a hazard and the
cause of consequences or loss. It can be concluded that
both hazard and event are the causes of loss.
22

23. HAZARDS EVENTS CONSEQUENCES
• Inadequate employee
management
• Obsolete computer
• Inexperienced personnel
• Large transaction volumes
• Diversity and cultural
differences
• Unfavourable climate
• Conditions or geographical
conditions
• Internal fraud (e.g.,
Unauthorized trading, theft)
• External fraud (e.g., Credit
card fraud)
• Diversity/ discrimination
events
• Improper business and
market practices
• System failure
• Failed/ inaccurate reporting
• Natural disasters
• Write downs
• Loss of recourse
• Restitution
• Legal liability
• Regulatory and
(e.g., Fines, penalties, and
taxation)
• Loss of or damage to
physical assets
• Other
Causes
23

24. Measures To Manage Operational Risk
Effective and efficient organisation with a well-defined
structure and competent personnel.
 Clear policy/ procedures and make the staff aware
 define lines of authority and responsibility
 Clear standard procedures and accounting guidelines
 Well designed and maintained records and reports
Develop and implement adequate systems and controls to
ensure compliance with shariah principles, laws and
regulations.
Develop and implement appropriate mechanisms to
safeguard the interest of all fund providers.
24

25. Other Preventive Techniques
Audit
Segregation
of duties
Compulsory
annual leave
Know your
client
Reconciliation
25

26. Operational Risk in Islamic Financial Contracts
Murabahah
Salam
Istisna’
Ijarah
Syirkah
26

27. Murabahah Contract
•Islamic bank provides money to the debtor through murabahah contract, the exchange happens in between money and money, not money and goods.’
•Any additional mark-up is considered as usury.
•Islamic bank must own the asset that will be sold through murabahah contract.
Shariah Compliance Risk
•People risk on the side of the Islamic bank occurs whenever the employee responsible does not have the competence to purchase the good needed by the
potential debtor (buyer), and causes the goods bought to be inadequate for the debtor’s purposes.
•On the side of the debtor (buyer), people risk occurs when the debtor cancels his or her promise to buy the asset from the Islamic bank.
Fiduciary Risk
•Islamic bank is unable to present a good or asset that is in accordance with the specifications that have been requested by the potential debtor.
•If this happens, the potential debtor can decide to cancel his or her previous promise to buy from the bank.
People Risk
•This occurs whenever there is incongruence between syariah principles and the legal regulations covering the Islamic banking industry in a country.
Legal Risk
27

28. Salam Contract
•This occurs when the price of the subject commodity of the salam contract cannot be paid in advance, or if there is a delay in payment.
•Under those conditions, neither the seller nor the buyer has the capability to enter into a sale contract (selling debt with debt).
Syariah Compliance Risk
•This can occur when the seller defaults in delivering the subject commodity of the contract at the agreed-upon time, or the commodity that is
delivered does not fulfil the specifications requested in the contract.
•The Islamic bank can minimize this risk by asking the seller to set a certain quality management standard to be used in the process.
Fiduciary Risk
•This can occur when the commodity that is sent is of a lesser quality or of a quality that is not the same as agreed in the contract.
•Fiduciary risk also happens when the price set is the original price and not the discount price.
People Risk
•This occurs if the legal framework of the Islamic banking in the jurisdiction of the bank’s operational area does not allow the Islamic bank to
involve itself directly in the real sector.
Legal Risk
28

29. Istisna’ Contract
•This can occur when the istisna’ contract is used as hilah (ruse) to enter transactions that are effectively usury-based.
•This can happen when the party acting as the buyer placing the order is the contractor himself.
Shariah Compliance Risk
•This can occur when a breach of contract occurs, where the Islamic bank is unable to finish the task within the allotted time frame.
•This usually happens when the subcontractor experiences a delay in finishing the manufacture or contraction of the request object.
Fiduciary Risk
•This can occur when the subcontractor fails to fulfil the quality standard specified by the customer in the istisna’ contract.
People Risk
•Islamic bank usually acts as the contractor responsible in finishing the construction of the asset ordered by the debtor and identify whether there
are any rules or regulations that allow the Islamic bank to act as a contractor in an istisna’ contract.
Legal Risk
•The accounting information system used by the Islamic bank does not accommodate the particular characteristics of an istisna’ contract.
Technology Risk
29

30. Ijarah Contract
•If the Islamic bank set penalties for any delay of the debtor’s in paying the lease, then the act is not shariah compliant. Any delay of the debtor in
paying lease would then cause the debtor to incur additional debt that the debtor owes to the Islamic bank. If the Islamic bank requires
additional payment of funds for the penalty, then that addition is usury.
Syariah Compliance Risk
•For any delayed lease payment, the Islamic bank, as lessor is not allowed to set penalty in the form of additional cost charged to the lessee.
Fiduciary Risk
•This can occur when the Islamic bank (as the lessor) is unable to maintain the asset leased asset is the responsibility of the Islamic bank as lessor.
•Failure in asset maintenance causing the Islamic bank to fail in “sending” the benefit to the debtor.
People Risk
•This can occur when the existing legal framework does not allow Islamic banks to own assets for lease.
•Islamic bank will have to own the asset, or at least lay claim to the rights to utilize the asset that will be leased.
Legal Risk
30

31. Syirkah Contract
•The profit-sharing calculation used by the Islamic bank is based on expected profit instead of actual profit.
•According to shariah principles, the profit that can be divided and shares is only actual profit, not expected profit.
Syariah Compliance Risk
•People risk occurs when an officer from the Islamic bank is unable to assess risk adequately and the debtor managing the business is not
competent enough in doing so.
Fiduciary Risk
•The Islamic bank’s position in the syirkah contract is usually as the passive partner, not actively involved in the management of the financed
business.
•Misconduct can thus happen when the Islamic bank is negligent in monitoring the management of the financed business activity.
People Risk
•This can occur when there are regulations set by the banking authority responsible for the Islamic banking industry that prohibits the bank’s
involvement in the real sector.
•In a syirkah contract, the Islamic bank gains ownership in the financed business.
Legal Risk
31

32. Conclusion
Operational risk is tightly connected with the bank’s daily
business.
It means that this kind of risk cannot be separated from the
bank’s activities which is it will always be present along
with bank’s operations.
There are many cases of operational risk that occur very
rarely, but when they do, the loss caused is very significant.
Other than that, there are also many ways to prevent it to
happen and how to manage it well.
32

33. Mahyuddin Khalid
End of Chapter
33