Both direct and indirect losses must be reported. Direct losses refer to the immediate financial impact following an operational risk event. This could include costs associated with remediation efforts, financial consequences arising from erroneous transactions, or compensation paid to clients. On the other hand, indirect losses are more challenging to identify as they represent the subsequent consequences stemming from an operational risk event. These could include reputational damage, loss of business, or increased regulatory scrutiny, which may not have immediate financial implications but can significantly affect the firm’s operations and profitability in the long run. Therefore, both types of losses are crucial to capture a comprehensive picture of the operational risk landscape and inform effective risk management strategies.

Choice A is incorrect. While it is true that the Basel Committee has set a minimum threshold for loss reporting at €20,000 ($22,000), setting reporting thresholds at zero is not considered best practice. This could lead to an overload of information and make it difficult for firms to identify significant operational risk events. Furthermore, business units do need to estimate a loss before deciding to report incidents as this helps in prioritizing and managing risks effectively.

Choice B is incorrect. The BCBS guidelines do not dictate that firms must report any incidents causing them both financial losses and non-financial impacts. While both types of impacts are important, the guidelines primarily focus on financial losses as these can be quantified and measured more accurately.

Choice D is incorrect. Grouped losses are not distinct operational risk events connected through a common loss amount. Instead, they refer to multiple losses arising from the same root cause or event type which are grouped together for reporting purposes.