Operational risk: types, examples and how to manage it
Most of what goes wrong in a business is not a market crash or a bad strategy. It is a payment sent to the wrong account, a key person leaving, a server that will not restart, a supplier that misses a delivery. That is operational risk — and it is the part of risk management every organisation can actually control.
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. That is the Basel Committee’s definition, used well beyond banking. It includes legal risk but excludes strategic and reputational risk. Typical operational risks are fraud, human error, IT failures and cyber attacks, supplier failure, health and safety incidents and disruption from fire, flood or power loss. It is managed by identifying risks by process, assessing them and their controls, logging incidents and losses, tracking key risk indicators and testing resilience.
Track operational risks where the work happensRisk Samurai gives each team the same scales and a shared register for process, people, system and supplier risks, with owners, controls and review dates.
Get early accessWhat is operational risk?
The most widely used definition comes from the Basel Committee on Banking Supervision, which introduced operational risk as a capital category for banks in the Basel II framework:
Operational risk is “the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events”. The definition includes legal risk but excludes strategic and reputational risk.
Although written for banks, the definition works for any organisation, and it is the sense in which most risk frameworks use the term. In plain language: operational risk is everything that can go wrong in running the business, as opposed to choosing what business to be in.
For most small and mid-sized companies, operational risks make up the majority of the risk register. They are also the risks where managers have the most direct control, which is why a well-run operational risk process pays back quickly.
What operational risk is not
| Risk category | Example | Operational? |
|---|---|---|
| Strategic | Entering a market that turns out to be too small | No — a choice, not a failure of execution |
| Market | Exchange rates move against unhedged import costs | No — though a failure to execute an agreed hedge is |
| Credit | A large customer cannot pay its invoices | No — though extending credit without the required check is |
| Reputational | Negative press coverage | Excluded as a category, but often a consequence of an operational event |
| Legal | A fine for breaching data protection law | Yes — included in the Basel definition |
The boundaries matter less outside banking than the habit of asking “what failed?”. When the answer is a process, a person, a system or an outside event, you are looking at operational risk. In an enterprise risk management programme it is usually one category alongside strategic, financial, compliance and technology risks.
The four causes of operational risk
The definition itself gives the most practical way to classify operational risks: by cause.
| Cause | What fails | Typical risks |
|---|---|---|
| People | Errors, misconduct, capacity, skills, key-person dependency | Data entry errors; internal fraud; loss of a key person; unsafe working; insufficient staff at peak |
| Processes | Design and execution of how work is done | Missing approval step; unreconciled accounts; poor change control; contracts signed without review |
| Systems | IT, data and technology | Outages; failed migrations; cyber attacks; corrupted or lost data; spreadsheet errors |
| External events | Things outside the organisation | Supplier failure; fire, flood, storm; power and telecoms outages; external fraud; pandemics |
The seven Basel event types
Banks classify operational losses into seven event types, set out in Basel II. The categories are useful outside banking as a checklist when identifying risks or classifying incidents.
| Event type | Examples in an ordinary business |
|---|---|
| 1. Internal fraud | Employee diverts payments, falsifies expenses, steals stock |
| 2. External fraud | Fake supplier bank details, card fraud, account takeover, cheque fraud |
| 3. Employment practices and workplace safety | Discrimination or unfair dismissal claims, workplace injuries |
| 4. Clients, products and business practices | Mis-selling, breach of consumer law, data misuse, defective products |
| 5. Damage to physical assets | Fire, flood, storm, vandalism at premises or warehouses |
| 6. Business disruption and system failures | IT outages, telecoms or power failure, software defects |
| 7. Execution, delivery and process management | Order errors, missed deadlines, supplier disputes, data entry mistakes, incomplete documentation |
Operational risk examples
Operational risk looks different in each sector, but the patterns repeat. A few examples written the way they should appear in a register — cause, event, consequence:
- Online retail: because the order platform runs on one payment provider, an outage at that provider stops checkout, losing a day’s revenue at peak season.
- Professional services: because client deliverables are reviewed by one partner, a missed review lets an error reach a client, leading to a negligence claim.
- Manufacturing: because a critical machine has no maintenance contract, a breakdown halts a production line for two weeks.
- SaaS: because production changes are deployed without a rollback plan, a faulty release corrupts customer data and breaches service levels.
- Any business: because bank detail changes are accepted by email, a fraudster redirects a supplier payment of £40,000.
Our industry risk benchmarks show which operational risks companies in each sector most often disclose in their annual reports.
How to manage operational risk
Operational risk management follows the standard risk process — identify, assess, treat, monitor — with a few techniques that suit day-to-day operations particularly well.
- Map your key processes. List the ten to twenty processes that deliver your products and keep the business running: order to cash, procure to pay, payroll, hiring, IT change, customer service. Operational risks are easiest to find process by process.
- Identify risks in each process. Walk through each step with the people who do the work and ask what could fail, using the four causes and seven event types as prompts. Write each risk as cause → event → consequence.
- Assess inherent risk, controls and residual risk. Score likelihood and impact before controls, list the controls that exist, judge whether they work and score again. See inherent vs residual risk.
- Treat risks above appetite. Common treatments: add or automate controls (segregation of duties, approval limits, reconciliations), reduce dependency (second supplier, cross-training), transfer (insurance) or redesign the process.
- Log incidents and losses. Every error, near miss and loss, however small, goes into an incident log and is linked to the relevant risk.
- Monitor with indicators. Track a handful of key risk indicators per area with thresholds that trigger action.
- Review and report. Owners update their risks on the cycle your risk management plan sets; leadership reviews the top risks and the incident trend.
Operational risk tools: RCSA, loss data, KRIs and scenarios
| Tool | What it is | Lean version for an SME |
|---|---|---|
| Risk and control self-assessment (RCSA) | Process owners periodically assess their own risks and whether controls are designed and working | A two-hour annual workshop per process; owners confirm key controls quarterly |
| Incident and loss event log | Record of operational failures, near misses and their cost | A simple log: date, what happened, cost, related risk, action |
| Key risk indicators (KRIs) | Metrics that warn a risk is increasing | Five to ten indicators, e.g. overdue reconciliations, staff turnover, failed backups, open critical vulnerabilities |
| Scenario analysis | Structured “what if” assessment of severe but plausible events | Two or three scenarios a year discussed by leadership, such as loss of the main site or a month-long supplier outage |
| Control testing | Checking that controls operate as described | Sample-check a few key controls each quarter: was every payment over the limit approved by two people? |
Incident data is the most underrated of these. A year of honest logging shows where risks really materialise, which controls fail and whether your likelihood scores were realistic.
Operational risk vs operational resilience
Operational risk management works risk by risk: reduce the chance and impact of each thing that could go wrong. Operational resilience starts from the opposite end. It assumes disruption will happen and asks whether your most important services can stay within tolerable limits when it does.
In practice the two meet in the business impact analysis: the BIA tells you which services matter most and how long they can be down; operational risk management works on the risks that could push them beyond that.
Operational risk regulation
- Banks: the Basel framework requires capital for operational risk. The final Basel III reforms replaced the previous approaches, including the advanced measurement approach, with a single standardised approach based on business size and historical losses; national regulators implement it on their own timetables.
- Australia: APRA CPS 230 Operational Risk Management, in force since 1 July 2025, applies to banks, insurers and superannuation trustees. It requires operational risk management, business continuity for critical operations with tolerance levels, and management of material service providers.
- United Kingdom: FCA and PRA operational resilience rules require firms to identify important business services, set impact tolerances and, since 31 March 2025, be able to remain within them in severe but plausible scenarios.
- Everyone else: there is rarely a specific rule, but health and safety, data protection and consumer laws all impose duties that operational failures can breach — which is why legal risk sits inside the definition.
Operational risk register example
| ID | Cause | Risk | Key controls | Residual | KRI |
|---|---|---|---|---|---|
| OR-01 | External fraud | Supplier bank details changed via spoofed email; payment diverted | Call-back to known number; two approvers above £5k | 2×4 = 8 | Bank detail changes not verified by call-back |
| OR-02 | Systems | Warehouse system outage stops dispatch for more than 24 hours | Vendor SLA; nightly backups | 3×5 = 15 | Days since last successful restore test |
| OR-03 | People | Only one person can run month-end close; absence delays reporting and covenant tests | Partial checklist | 3×4 = 12 | Number of processes with a single trained person |
| OR-04 | Process | Price changes entered manually; error sells products below cost | Second-person check on bulk changes | 2×3 = 6 | Pricing errors found per month |
| OR-05 | External event | Single courier fails at peak; parcels delayed for a week | Account with a second courier | 2×3 = 6 | Courier on-time rate |
Start from our risk register template if you want these columns ready-made.
Common mistakes
- Treating operational risk as an IT topic. Systems are one of four causes. People and process failures are at least as common.
- Assessing controls on paper only. A control that exists in a procedure but is skipped under pressure does not reduce risk.
- Not logging small incidents. Near misses are free lessons; without them, you only learn from expensive failures.
- Risks owned by the risk coordinator. Operational risks should be owned by the managers who run the processes.
- Ignoring key-person dependency. In small businesses it is often the largest operational risk and the cheapest to reduce.
Frequently asked questions
What is operational risk in simple terms?
Operational risk is the chance of losing money, customers or time because something in the day-to-day running of the business goes wrong: a process fails, people make mistakes or act dishonestly, systems break, or an outside event such as a flood or a supplier collapse disrupts operations.
What are the four types of operational risk?
Operational risk is usually grouped by its four causes: people (error, fraud, loss of key staff), processes (poor design, missing controls), systems (IT failure, cyber attacks, data problems) and external events (natural disasters, supplier failure, power or telecoms outages).
What are some examples of operational risks?
Common examples are a payment made to a fraudster after a fake change of bank details, a ransomware attack that stops order processing, a key engineer leaving with undocumented knowledge, a critical supplier failing to deliver, an error in a pricing spreadsheet, a workplace injury and a fire or flood at a site.
What is not considered operational risk?
Under the Basel definition, strategic risk (choosing the wrong strategy) and reputational risk are excluded, although operational failures often cause reputational damage. Credit risk and market risk are separate categories in financial institutions. Legal risk is included.
What is the difference between operational risk and operational resilience?
Operational risk management tries to prevent and reduce losses from individual risks. Operational resilience assumes some disruption will happen and focuses on keeping the most important services within tolerable limits when it does. Regulators in the UK and Australia now expect both.
Operational risk, owned by the people who run operations
In Risk Samurai, process and system owners keep their risks, controls, incidents and indicators in one register, and leadership sees the whole picture without chasing spreadsheets. AI drafts the first version of your register so you start with something to refine.
Get early access