Operational Risk Management
What is Operational Risk Management?
Operational risk management is the practice of identifying, assessing and controlling the risk of loss from failed or inadequate internal processes, people and systems, or from external events.
Updated November 2026 · 5 min read
Some of the most damaging events an organization can face have nothing to do with markets or strategy. A payment is sent to the wrong account, a software update takes down a customer platform, a trader hides losses, a flood closes a data center or a supplier ships faulty parts. These are operational risks: losses that come from how the organization runs day to day. Operational risk management is the discipline of understanding where these failures could happen, how serious they would be and which controls will prevent or limit them. It focuses on the risks that come from running the business, rather than from the choices about which business to be in.
The term became formalized in banking, where the Basel II capital framework of 2004 defined operational risk and required banks to hold capital against it. The approach has since spread well beyond financial services, as organizations in every sector depend on complex processes, technology and third parties. For risk, operations, IT and finance teams, operational risk management provides a structured way to reduce the frequency and cost of the everyday failures that can add up to serious losses.
Definition of Operational Risk Management
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events, a definition set by the Basel Committee on Banking Supervision. It includes legal risk but excludes strategic and reputational risk. Operational risk management is the framework, processes and tools used to identify, measure, monitor and control this risk.
It is one of the main risk types covered by enterprise risk management and is closely linked to operational resilience, which focuses on continuing to deliver important services through disruption.
Categories of Operational Risk
The Basel framework groups operational loss events into seven categories, which many organizations outside banking also use. Using a common taxonomy makes it easier to compare losses across business units and with industry data.
Internal fraud and external fraud cover theft, deception and unauthorized activity by employees or outsiders.
Employment practices and workplace safety cover issues such as discrimination claims and workplace injuries.
Clients, products and business practices cover failures to meet obligations to customers, such as mis-selling or privacy breaches.
Damage to physical assets covers losses from natural disasters, fire and vandalism.
Business disruption and system failures cover outages of technology and utilities.
Execution, delivery and process management covers errors in processing transactions and managing processes, such as data entry mistakes and missed deadlines.
Core Operational Risk Tools
Risk and control self-assessments ask business teams to identify their risks and rate how well their controls work, often through RCSA workshops.
Loss event data records actual losses and near misses, so patterns and root causes can be analyzed.
Key risk indicators provide early warning that risk is rising, such as increasing system downtime or staff turnover in a critical team.
Scenario analysis explores rare but severe events that the organization has not yet experienced. Scenarios help estimate potential losses that historical data alone would not show.
Importance of Operational Risk Management in Risk and Compliance
Operational risk management reduces losses. Most organizations suffer frequent small operational losses and occasional large ones, and better controls reduce both. Small losses also reveal weaknesses that could lead to much larger ones.
It protects customers. Many operational failures, such as outages, processing errors and data breaches, directly harm customers and erode trust.
It also meets regulatory expectations. Banks, insurers and other regulated firms must show regulators that they identify, measure and control operational risk.
Operational Risk Management and Financial Management
Banks must hold regulatory capital against operational risk, and under the Basel III framework the amount can depend partly on the bank's history of operational losses.
Tracking loss events by category shows where operational failures cost the most, guiding where to invest in controls and automation.
Comparing the cost of controls with expected losses helps decide which risks to reduce and which to accept.
Insurance, such as cyber, property and fidelity cover, transfers part of the financial impact of operational events.
Common Challenges
Loss data is often incomplete, since small losses and near misses are not always reported. A culture that treats reporting as learning, not blame, encourages more complete data.
Self-assessments can become optimistic, with teams rating their own controls as effective without evidence. Independent challenge from the risk function and internal audit helps keep ratings realistic.
Operational risk teams may struggle to keep pace with rapid changes in technology, processes and third parties.
How to Implement Operational Risk Management
Implementing operational risk management involves defining a taxonomy, assessing risks and controls with business teams, collecting loss data, monitoring indicators and reporting to leadership.
Ownership should sit with the business teams that run the processes, supported by a central risk function that sets standards and challenges results. This balance keeps responsibility with the people who can act while keeping methods consistent.
Building the Framework
Adopt an operational risk taxonomy, often based on the Basel event categories, and adapt it to the organization's processes.
Map key processes and run assessments to identify their main risks and controls, recording results in the risk register.
Set up a simple process for reporting loss events and near misses, with thresholds that make reporting practical. Including near misses gives a fuller picture, since many large losses are preceded by smaller warning signs.
Monitoring and Improving
Define key risk indicators for the most significant risks, with thresholds that trigger review or escalation.
Analyze significant loss events for root causes and track corrective actions to completion. Share lessons across business units, since the same weakness often exists in several places.
Report operational risk exposure, losses and indicator trends to leadership and the board, and use scenario analysis to test preparedness for severe events.
Examples of Operational Risk Management in Risk and Compliance
The examples below show operational risk management in practice.
Both use illustrative figures. The first uses loss data to target controls, and the second uses indicators to prevent an outage.
In each, structured operational risk management reduced losses.
Targeting Controls With Loss Data
A retail bank analyzes two years of operational loss data and finds that payment processing errors account for about 45% of its losses by value.
Root cause analysis shows that most errors come from manual re-keying between two systems.
The bank automates the interface between the systems, and losses from payment errors fall by about 70% the following year.
Using Indicators to Prevent an Outage
An online retailer tracks key risk indicators for its checkout platform, including the number of emergency changes and unresolved high-priority incidents.
Ahead of its peak season, both indicators rise above their thresholds, triggering a review.
The retailer freezes non-essential changes and adds capacity, and the platform handles record traffic without a significant outage.
Conclusion
Operational risk management is the practice of identifying, assessing and controlling the risk of loss from failed processes, people and systems or from external events. It uses tools such as self-assessments, loss data, key risk indicators and scenario analysis.
In risk and compliance, operational risk management reduces losses, protects customers and meets regulatory expectations. Adopting a clear taxonomy, keeping ownership with the business, collecting loss data, monitoring indicators, analyzing root causes and reporting to leadership help organizations reduce the cost and frequency of operational failures.
Related terms
Enterprise Risk Management (ERM)
Managing every kind of risk across the organization in one approach.
Operational Resilience
Keeping the most important services running through any disruption.
Risk and Control Self-Assessment (RCSA)
Business teams rating their own risks and how well their controls work.
Key Risk Indicators (KRIs)
Metrics with thresholds that warn when risk exposure is rising.