What are the components and factors of operational risk management?
Operational risk management involves identifying, assessing, monitoring, and controlling risks arising from people, processes, systems, and external events.
The four cause factors of operational risk are:
Process
Risks arising from failures in internal processes and procedures:
- Inadequate or inappropriate guidelines, policies, and procedures.
- Inadequate or failure of communication between departments.
- Erroneous data entry and inadequate reconciliation.
- Poor customer or legal documentation.
- Inadequate security controls.
- Breach of regulatory and statutory requirements.
- Inadequate change management processes.
- Inadequate backup and contingency plans.
People
Risks arising from human behaviour and workforce management:
- Breach of internal guidelines, policies, and procedures.
- Breach of delegated authority.
- Criminal acts by internal parties — fraud, theft, embezzlement.
- Inadequate segregation of duties and dual controls.
- Inexperienced or inadequately trained staff.
- Staff oversight — errors due to negligence or inattention.
- Unclear roles and responsibilities leading to accountability gaps.
- High staff turnover causing knowledge loss and process gaps.
System
Risks arising from technology and infrastructure failures:
- Inadequate hardware, network, or server maintenance.
- Software failures and system downtime.
- Cybersecurity breaches and unauthorised system access.
- Telecommunication failures disrupting operations.
External Events
Risks arising from factors outside the bank’s control:
- Criminal acts by external parties — robbery, forgery, hacking.
- Vendor misperformance or failure of third-party service providers.
- Man-made disasters — terrorism, vandalism, fire.
- Natural disasters — floods, earthquakes, cyclones.
- Political, legislative, or regulatory changes affecting operations.
