operatiivrisk

Operatiivrisk, commonly referred to as operational risk, is the risk of loss resulting from inadequate or failed internal processes, people, systems, or from external events. It encompasses a broad range of potential causes and is distinct from market, credit, and liquidity risk, though it can interact with them. Operational risk can affect financial results, regulatory compliance, business continuity, and reputation.

Sources of operatiivrisk include process failures, human error or fraud, technology outages and cybersecurity incidents, failed or inadequate internal controls, and external events such as natural disasters, supply chain disruptions, or legal and regulatory changes. Third-party dependencies and outsourcing arrangements can also introduce operational risk, as can organizational culture and governance weaknesses.

Measurement and management of operatiivrisk employ a mix of approaches. In traditional banking and insurance, Basel II/III frameworks describe methods such as the Basic Indicator Approach, Standardized Approach, and Advanced Measurement Approaches to quantify risk or allocate capital. Practically, organizations use risk and control self-assessments, incident databases, key risk indicators, and scenario analysis to identify, assess, and mitigate risks. Effective management includes control design, monitoring, remediation, business continuity planning, and disaster recovery, as well as ongoing training and caution around outsourcing and third parties.

Governance and culture are central to controlling operatiivrisk. Senior leadership and boards establish risk appetite, approve policies, and oversee independent risk management functions and internal audit. Regulatory expectations emphasize robust governance, continuous monitoring, incident reporting, and adequate capital or reserves to absorb potential losses.

See also: risk management, internal controls, business continuity.