What it means
Financial risk gets most of the attention because it is easy to quantify, but operational failures cause a large share of real-world business damage. A payment system that goes down for a day, a key employee who leaves with client relationships, or a warehouse fire will all hit the accounts without any change in interest rates or customer credit quality.
Operational risk is the label for that whole family of exposures. The standard framing breaks operational risk into four sources: people, processes, systems and external events.
People risks cover error, fraud and key-person dependency; process risks cover weak controls and undocumented handoffs; system risks cover outages, data loss and cyber incidents; and external events cover suppliers, weather, regulation and infrastructure. Sorting an incident into one of these buckets usually points straight at the fix.
Operational risk is managed rather than eliminated, because removing it entirely would cost more than the risk itself. The usual approach is a register that records each risk with an estimated likelihood and impact, an owner, and the controls in place.
Reviewing that register regularly is what turns it from a compliance document into a management tool. Quantifying operational risk is harder than quantifying market risk because the events are rare and the data is thin.
The practical approach is to estimate an expected annual loss as likelihood multiplied by impact, then compare that with the cost of controls. Where a control costs less than the loss it prevents, it usually pays for itself.
The most common blind spot is concentration. Businesses often discover only after an incident that one supplier, one system or one person sat behind a large share of their revenue.
Mapping single points of failure is frequently more useful than refining probability estimates.
In practice
Real-world examples
Example 1
A payroll bureau discovers that one long-serving administrator is the only person who knows how to run the year-end process. It documents the procedure and cross-trains two colleagues, removing a key-person risk that no insurance policy would have covered.
Example 2
A food manufacturer sources a critical preservative from a single overseas supplier. After a port strike halts shipments for three weeks, it qualifies a second supplier even though the alternative costs 6% more.
Example 3
A law firm suffers a phishing incident in which an invoice is paid to a fraudulent account. It introduces a rule that any change to supplier bank details must be confirmed by phone to a previously known number.
Think of it
Operational risk is like driving a car. Market risk is the weather outside, but operational risk is the engine stalling, a flat tyre, or the driver falling asleep at the wheel.
Formula
Calculation
Expected Annual Loss = Probability of Event in a Year x Financial Impact per Event
Net Benefit of a Control = Reduction in Expected Annual Loss - Annual Cost of the Control
An online retailer estimates that a serious outage of its order platform has a 5% chance of occurring in any given year, and that such an outage would cost $2,000,000 in lost sales, refunds and recovery work.
Expected annual loss = 0.05 x $2,000,000 = $100,000.
The retailer is quoted $40,000 a year for a standby environment and automated failover, which its engineers believe would cut the probability to 1%.
New expected annual loss = 0.01 x $2,000,000 = $20,000.
Reduction in expected loss = $100,000 - $20,000 = $80,000.
Net benefit = $80,000 - $40,000 = $40,000 a year.
The control is worth buying, because it removes $80,000 of expected loss for $40,000 of cost.Case study
Seen in the real world
Aldercroft Utilities is a fictional water treatment contractor presented here as an illustrative example. Its risk register listed twenty-eight items, most of them scored on gut feel, and the board reviewed it once a year in about ten minutes.
After a control panel failure shut a treatment site for nine days and cost roughly $1,300,000 in penalties and emergency hire, the board asked for the register to be rebuilt. Each risk was given an estimated probability, a financial impact and a named owner, and the list was ranked by expected annual loss rather than by department.
The ranking showed that three risks accounted for more than half the total expected loss, and all three related to ageing control equipment at two sites. Aldercroft redirected part of its maintenance budget to those sites, added remote monitoring, and cut its total estimated expected annual loss by about 45% in eighteen months.
Watch out
Common mistakes
- Treating the risk register as a compliance exercise. A register that is written once and never reviewed gives false comfort without changing any behaviour.
- Focusing only on high-impact, low-likelihood disasters. Frequent small failures such as data entry errors often cost more in aggregate than the dramatic scenarios.
- Assuming insurance transfers the risk. Insurance covers some financial loss but not reputational damage, regulatory action or the management time consumed by an incident.
Questions
People also ask
Is operational risk the same as business risk?
No, business risk covers strategic and market exposures such as demand falling, while operational risk covers failures in how the business runs.
Can operational risk be reduced to zero?
No, and trying would be uneconomic, so the goal is to reduce it to a level the organisation accepts at a cost it can justify.
Who should own operational risk?
Ownership sits with the manager of the activity concerned, with oversight from finance or a risk function, because the person closest to the process controls the outcome.