Operational risk

Roles that need it

• Operational Risk Analyst
• Compliance Officer
• Internal Auditor
• Risk Advisory Consultant
• Cybersecurity GRC Consultant

Skills it belongs to

• Internal controls and risk oversight
• Risk judgment and escalation instinct
• Operational resilience and ICT risk rules (DORA and equivalents)

Related concepts

• RCSA (risk and control self-assessment)A risk and control self-assessment is the periodic exercise in which a business unit identifies its operational risks, rates inherent risk, assesses how well its controls work and derives the residual risk. Results are challenged by the second line and lead to actions where residual risk exceeds appetite.
• Key risk indicator (KRI)A key risk indicator is a metric that signals rising exposure to a risk before losses occur, such as failed trades, system downtime or staff turnover. Each KRI has thresholds (often green, amber and red) linked to escalation and to the risk appetite.
• Operational loss eventAn operational loss event is an incident from a process, people, system or external failure that causes a financial loss, a near miss or a gain. Banks record each event with dates, amounts, recoveries and an event type in a loss database used for analysis and capital.
• Scenario analysis (operational risk)Scenario analysis asks experts to describe severe but plausible events, such as a major cyber attack or a rogue employee, and estimate their frequency and loss. It complements internal loss data for rare, large risks and feeds capital planning and resilience work.
• Operational risk capital (business indicator approach)Under CRR3, banks calculate operational risk capital with a single standardised method based on the business indicator, a measure of income and size, replacing earlier approaches including internal models. The EU sets the internal loss multiplier to one.

Sources

• Revisions to the principles for the sound management of operational risk, BIS (external site) accessed 31 Oct 2026
• Regulation (EU) No 575/2013 (Capital Requirements Regulation), EUR-Lex (external site) accessed 31 Oct 2026

Updated 31 Oct 2026.