The risk of loss when people, processes, systems or outside events let an organisation down.
Operational risk is the risk of loss caused by inadequate or failed internal processes, people and systems, or by external events. It includes legal risk. It can arise in any business line, product or channel, which is why organisations treat it as a risk category in its own right.
Someone inside or outside the organisation deliberately gets around a control.
Systems or data are compromised, taking services offline or exposing information.
A core platform fails, or a change to a system goes wrong.
A site, a supplier or a team is unavailable and critical activities stall.
A payment run, a calculation or a model produces the wrong answer.
Roles are unclear, or controls are not working the way people assume.
A supplier or service provider cannot deliver what the organisation relies on.
Natural hazards, criminal acts, geopolitical events, or a utility or market infrastructure disruption.
Regulators treat operational risk as a prudential risk category. They expect institutions to identify, measure, manage, monitor and control it. ADOX works with organisations in financial services, banking, asset management, logistics, technology and security, where this expectation is part of daily life.
The idea took shape as a distinct discipline after major failures in the 1990s, and the Basel framework later set it out formally. Strategic and reputational risk are generally treated as outside the Basel definition, but they become operational losses when an operational failure sets them off.
Operational risk describes what can go wrong. Business continuity is how an organisation keeps its critical activities running when something does, and operational resilience is the wider ability to deliver critical services through disruption. ADOX develops its consulting and training in adherence to ISO 22301, UAE NCEMA 7000 and the BCI Good Practice Guidelines (GPG 7.0). See ADOX’s approach on the Operational Resilience page.
Map where processes, people, systems and suppliers could fail.
Judge how likely each failure is and how much it would hurt.
Put in place the controls and safeguards that reduce the risk.
Track indicators and incidents so changes are seen early.
Exercise the arrangements, so the response is proven rather than assumed.
Testing is where plans meet reality. ADOX designs business continuity exercises and incident response and crisis management simulations around an organisation’s own risks.
We aim to reply to your enquiry within 2 hours.
Further reading: Risk Officer