What Is Operational Risk?

Operational risk summarizes the uncertainties and hazards a company faces when it attempts to do its day-to-day business activities within a given field or industry. A type of business risk, it can result from breakdowns in internal procedures, people and systems—as opposed to problems incurred from external forces, such as political or economic events, or inherent to the entire market or market segment, known as systematic risk.

Operational risk can also be classified as a variety of unsystematic risk, which is unique to a specific company or industry.

• Operational risk summarizes the chances and uncertainties a company faces in the course of conducting its daily business activities, procedures, and systems.
• Operational risk is heavily dependent on the human factor: mistakes or failures due to actions or decisions made by a company's employees.
• Companies assess operational risk by identifying key risk indicators (KRIs) and collecting data against these metrics.
• A type of business risk, operational risk is distinct from systematic risk and financial risk.
• Companies can manage operational risk by anticipating risks before they arise, perform cost/benefit analysis, avoid unnecessary risk, and delegate strategic planning to upper management.

Causes of Operational Risk

Operational risk is usually caused by four different avenues: people, processes, systems, or external events. For many aspects of operational risk, companies must simply try to mitigate the risk within each category as best as possible with the understanding that some operational risk will likely always be present.

People

Operational risk caused by people can arise due to employee deficiencies or employee shortages. For example, a company may not have staff that has the knowledge needed to tackle a specific problem. On the other hand, a company may not have an appropriate quantity of employees on hand to properly address peak season or the busier times of the year.

To mitigate these types of risks, companies can simply look to markets to hire staff. However, this introduces new people-centric operational risks such as identifying the appropriate candidates to hire, training staff, and ensuring employee retention remains high. As each of these aspects is resource and time-intensive, operational risks caused by people are heavily tied to financial repercussions.

Processes

Every company has its own processes. More complex manufacturing companies (i.e. a vehicle manufacturer) will have different processes compared to a service-only law firm. In either case, all companies have steps that must be performed in sequential order or else detrimental outcomes are possible.

In many cases, especially with companies that have experienced high turnover, companies may not have fully built out their processes or documented all steps. In addition, some processes are also at risk of being taken advantage of through collusion and failed internal controls to put the company at risk of losing money through theft.

Systems

Companies more and more are relying on software and systems to operate their business. Operational risk includes the chance that these systems are outdated, inadequate, or not property set up. There are also performance considerations, as operational risk includes the chance that one company's systems are not as efficient as a competitor's.

There are operational risks relating to the technical aspects of a system. Systems may have bugs or technical deficiencies leading to more exposure to cybercrime. Systems also have capacity constraints, and a company may be increasing its risk by putting to heavy of a load of expectations on what their systems can do.

External Events

In many cases, operational risk occurs from outside the company. This can be anything from natural disasters that impede the shipping process of a company to political changes that restrict how the company can operate. Some of these types of risk may be classified on their own (i.e. geopolitical risk). Others are simply a nature of business such as a third-party defaulting on a contract agreement.