Operational Risk

An operational risk is an adverse event or outcome, which occurs as a consequence of a organisation's activity.

Operational risk is the broad discipline focusing on the risks arising from the people, systems and processes through which a company operates. It can also include other classes of risk, such as fraud, legal risks, physical or environmental risks.

A widely used definition of operational risk is the one contained in the Basel II regulations. This definition states that operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events.

Operational risk management differs from other types of risk, because it is not used to generate profit (e.g. credit risk is exploited by lending institutions to create profit, market risk is exploited by traders and fund managers, and insurance risk is exploited by insurers). They all however manage operational risk to keep losses within their risk appetite - the amount of risk they are prepared to accept in pursuit of their objectives. What this means in practical terms is that organisations accept that their people, processes and systems are imperfect, and that losses will arise from errors and ineffective operations. The size of the loss they are prepared to accept, because the cost of correcting the errors or improving the systems is disproportionate to the benefit they will receive, determines their appetite for operational risk.

Determining appetite for operational risk is a discipline which is still in its infancy. Some of the issues and considerations around this process are outlined in this Sound Practice paper published by the Institute for Operational Risk in December 2009.