Operatiivriske

Operatiivriske, often translated as operational risk, refers to the risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events. In many frameworks, it also encompasses aspects of legal and regulatory risk, depending on how the definition is applied within a given jurisdiction or standard.

Common sources of operatiivriske include errors in processing or data handling, fraud, and misconduct, failures in information technology or communications systems, and problems arising from changes in processes or technology. External events such as supply chain disruptions, vendor failures, cyber attacks, physical disasters, and other incidents beyond day-to-day control can also contribute. The risk is not purely financial and can affect operations, reputation, and compliance.

Measuring and managing operatiivriske involves identifying potential failure modes, assessing their likelihood and impact, and recording them in risk registers. Organizations use techniques such as scenario analysis, loss data collection, key risk indicators, and risk and control self-assessments. Regulatory and industry frameworks, such as Basel II/III in financial services and ISO 31000, guide governance structures, risk appetite, and reporting requirements.

Mitigation focuses on strong internal controls, governance, and process design. Key practices include segregation of duties, formal change management, resilience planning, incident reporting, cybersecurity measures, vendor risk management, training, and business continuity and disaster recovery planning. Effective management requires ongoing monitoring, assurance activities, and a culture that encourages early detection and reporting of weaknesses.