Operational Risk, Model Risk & Conduct Risk - Interview-Ready Explanation for MBA Students
Before a risk event, everything looks routine: a loan is approved, a customer signs digitally, a branch releases gold-loan cash, a model generates a score. After the event, the same routine is seen differently - as a broken process, a bad model, or behaviour that harmed customers and triggered the regulator.
- Operational risk is the risk of loss from failed people, processes, systems or external events.
- Model risk arises when decisions depend on a model that is wrong, stale, biased, poorly implemented or misused.
- Conduct risk is the risk that a firm's behaviour creates poor outcomes for customers, markets or the firm.
- The simplest distinction: execution broke = operational risk; decision engine misled = model risk; behaviour was unfair = conduct risk.
- Controls must cover the full chain: governance, ownership, preventive controls, monitoring, escalation, remediation and independent assurance.
- In interviews, do not define these as only "fraud" or only "compliance" - show the failure mechanism and the customer/regulatory impact.
Big Picture: One Event, Three Risk Lenses
Risk managers do not ask only, "What loss happened?" They ask, "What failed?" Operational, model and conduct risk are three lenses for diagnosing the failure mechanism behind losses, regulatory action and customer harm.
The Core Idea: Diagnose the Failure Mechanism
These three risks often overlap, especially in banks, NBFCs, fintechs and brokerages. A loan default spike may involve an operational issue in documentation, a model issue in credit scoring, and a conduct issue if customers were mis-sold products.
The clean interview answer is to separate them by source of failure, not by department name.
Operational Risk: When Execution Breaks
Operational risk is the day-to-day risk of running the business. It includes failed processes, human error, technology outages, cyber incidents, internal fraud, external fraud, vendor failures, documentation gaps and natural disasters.
In a lending business, examples include wrong lien marking on collateral, poor KYC documentation, payment reconciliation failures, duplicate disbursement, system downtime and branch-level cash-handling weaknesses. Notice the common thread: the business model may be sound, but the operating machinery failed.
When an Indian NBFC faces supervisory action over loan-process weaknesses, the issue is not only "compliance". It is operational risk because documentation, checks, branch execution, monitoring and escalation did not work reliably enough. The strategic so what: in regulated finance, process quality is part of the product.
Model Risk: When the Decision Engine Misleads
Model risk appears when a firm uses quantitative, statistical, machine-learning or rules-based models to make decisions - and those models are wrong, poorly governed or used outside their intended purpose.
Common model-risk examples include a credit-score model trained on outdated borrower behaviour, a fraud model that misses a new fraud pattern, a pricing model with a coding error, a stress-test model with unrealistic assumptions, or an AI chatbot that produces unverified financial guidance.
Conduct Risk: When Behaviour Creates Harm
Conduct risk is about how the firm behaves toward customers, counterparties, employees and the market. It becomes visible in mis-selling, hidden charges, unsuitable products, aggressive recovery behaviour, biased advice, market manipulation, weak disclosure or incentive systems that reward the wrong behaviour.
The key point: conduct risk can exist even if a transaction is technically legal and operationally smooth. If the customer did not understand the product, was pressured, or was steered into an unsuitable choice, the firm still has a conduct problem.
Definitions You Can Say in One Breath
Basel Committee on Banking Supervision: Operational risk is "the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events."
Federal Reserve SR 11-7: Model risk is "the potential for adverse consequences from decisions based on incorrect or misused model outputs and reports."
Conduct risk: Risk that a firm's behaviour leads to poor outcomes for customers, markets or the firm.
How to Control These Risks: The Three Lines View
A strong risk answer should move from definition to control design. In financial services, the practical governance structure is usually the three lines model: business owns the risk, risk/compliance challenges it, and internal audit independently assures it.
Metrics and KRIs to Track
There is no universal "good" risk number across firms because risk appetite differs by product, regulator, scale and customer mix. In interviews, say the right standard: a metric is strong when it is within board-approved appetite, better than peer/regulatory benchmarks where available, and improving over time.
Worked Example: How Model Risk Turns into Financial Loss
Assume an NBFC uses a credit model for a loan portfolio with exposure at default of ₹100 crore. The model estimates probability of default at 2% and loss given default at 50%.
Expected credit loss = PD x LGD x EAD = 2% x 50% x ₹100 crore = ₹1 crore.
After validation, the team finds the model was trained on older borrower behaviour and the realistic PD is 3.5%.
Revised expected credit loss = 3.5% x 50% x ₹100 crore = ₹1.75 crore.
The model-risk gap is ₹0.75 crore. The lesson is not just mathematical. If pricing, provisioning, collection capacity and capital planning used the old model, the firm was making business decisions on a misleading engine.
Case Study: IIFL Finance Gold Loans and the Cost of Process Risk
In 2024, RBI restrictions on IIFL Finance's gold-loan business showed how operational and conduct weaknesses can become a business-model shock.
Situation: IIFL Finance had a large gold-loan business, a category where frontline execution matters deeply: collateral assessment, loan-to-value checks, documentation, cash handling, auction processes, customer communication and regulatory compliance all happen close to the branch.
The move by the regulator: In March 2024, the Reserve Bank of India directed IIFL Finance to stop sanctioning or disbursing gold loans after supervisory concerns in the gold-loan portfolio. The company then undertook remedial actions and the RBI later lifted the restrictions in September 2024.
Why this is a strong risk case: The primary driver was supervisory concern over lending-process and compliance weaknesses. Supporting drivers included the operational complexity of branch-led secured lending, the need for reliable collateral valuation, disciplined documentation, customer-facing fairness and strong central monitoring.
The memorable takeaway: risk controls are not paperwork in financial services; they are a condition for the right to operate.
How AI Changes Operational, Model & Conduct Risk
AI does not replace these risk categories. It makes them faster, broader and harder to see unless governance improves.
For 2026 interviews, the best answer is not "AI increases efficiency." It is: AI improves monitoring, but it also creates new model-risk and conduct-risk obligations around explainability, validation, human oversight and customer fairness.
Interview Relevance
"Explain operational risk, model risk and conduct risk. How would you identify and control them in a bank, NBFC or fintech? Give an Indian example."
If the interviewer gives a scenario, classify it in this order: process failure, model failure, behaviour/customer-outcome failure. Then say which controls would have prevented, detected and corrected it.
Common Mistake
The most common mistake is treating all three as the same thing - usually calling everything "compliance risk" or "fraud". That costs candidates because it shows they cannot diagnose root cause. One-line fix: name what failed - execution, model or behaviour - and then map the control to that failure.
What to Revise Next
Now that you can diagnose financial-services risk events, revise The Indian Derivatives Market: Structure, Regulation & Retail Reality. It will help you connect risk governance to trading products, market infrastructure, SEBI regulation and the real behaviour of retail participants.