Operational Risk

Overview

Operational risk covers errors, outages, fraud, cyber incidents, vendor failures, capacity shortages, data problems, legal process failures, and physical disruption. It exists across routine work, change, growth, outsourcing, and emergency response.

Individual controls can appear effective while hidden dependencies create common failure. Manual workarounds, unclear ownership, excessive complexity, and weak change management often increase exposure before direct financial loss becomes visible.

Organizations should identify scenarios, assign owners, measure incidents and near misses, test controls, manage changes, and exercise continuity. Risk assessment should connect process steps with customer, financial, compliance, and service impacts rather than rely on broad labels. Loss databases should include causes, control failures, recoveries, and corrective-action effectiveness.

Operational risk is the possibility of loss from failed processes, people, systems, external events, or inadequate execution of business activities. Operational risk arises from how work actually happens, requiring scenario-based controls, ownership, incident learning, change discipline, and resilience.

For Operational Risk, the assessment should evaluate the possibility of loss from failed processes, people, systems, external events, or inadequate execution of business activities. The assessment record should separate observed evidence supporting the possibility of loss from failed processes, people, systems, external events, or inadequate execution of business activities from assumptions, state the time horizon and existing controls, and identify who owns any remaining exposure. Monitoring should test whether the conditions described in the possibility of loss from failed processes, people, systems, external events, or inadequate execution of business activities have changed enough to require a new rating, treatment, or approval.

Decision-makers should use findings about the possibility of loss from failed processes, people, systems, external events, or inadequate execution of business activities to select treatment, assign remediation, set review thresholds, and document why any residual exposure is accepted.