Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It encompasses fraud, human error, system failures, legal and compliance breaches, and disruptions such as cyber-attacks or natural disasters, but excludes strategic and reputational risk in its narrow Basel definition. Managing it relies on controls, monitoring, capital allocation and resilience planning.
Overview
- Operational risk gained formal prominence with Basel II’s capital treatment and remains central to financial-institution governance. Firms quantify it through loss-event data, scenario analysis and key risk indicators, and mitigate it through internal controls, segregation of duties, business continuity and resilience programmes. It increasingly overlaps with cyber and third-party risk.
Key aspects
- Loss categories: process, people, systems and external events.
- Quantification via loss data, scenarios and key risk indicators.
- Internal controls, segregation of duties and audit.
- Regulatory capital treatment under Basel frameworks.
- Operational resilience and business continuity planning.
Applications
- Regulatory capital and risk reporting in banks.
- Control design and assurance across business processes.
- Cyber, fraud and third-party risk management.
- Resilience and continuity planning for critical services.