D is correct. The gross loss should not include internal or external expenditures to enhance the business after the operational risk losses: upgrades, improvements, risk assessment initiatives, etc.

A is incorrect. The loss reporting threshold is the minimum amount that an operational loss would need to be before it is reported. The Basel committee set this amount at EUR 20,000. In practice, many firms apply lower reporting thresholds. Increasing the loss reporting threshold would decrease the overall value of the operational loss the bank reports.

B is incorrect. Each operational incident has four important dates:
• Date of occurrence: when the event first happened
• Date of discovery: when it is first identified
• Date of reporting: when it enters the reporting database
• Date of accounting: when the financial impact enters the general ledger

Regarding the difference between discovery and reporting dates: Organizations typically include a maximum allowed time for reporting incidents in their incident data collection policy. Best practice dictates a risk-based approach that will not waste resources by rushing to report immaterial events. Usually, material incidents must be reported within a few working days, while minor incidents can simply be included in periodic summary reporting.

Regarding the difference between discovery and accounting/settlement dates: The date of settlement is the date when all the effects of an operational incident have been accounted for and recorded in the general ledger. Such effects can materialize over very long periods, especially for events with regulatory and legal implications that can take years to settle.