OR 3 – Risk Identification

A risk that nobody has named cannot be measured, owned or reduced. The threats that hurt firms most are frequently the ones that were ignored, that arose as an unintended side effect of some decision, or that simply could not have been foreseen with reasonable effort. An ignored risk carries no controls and no mitigation, so when it materialises the firm meets it unprepared. This is why the completeness of the identification exercise sets the ceiling on how ready an organisation can be for adverse events: everything that follows in the risk management cycle works only on the risks that identification has put on the table.

Operational risk management is usually described as a framework of four linked steps, and identification is the first of them:

Once a risk has been identified, the firm has two broad choices. It can accept the risk as part of its strategy, treating occasional losses as a cost of doing business, or it can mitigate it. Either way, the decision should weigh what the controls would cost against the loss they are expected to prevent. Removing every operational risk is rarely cost-effective, so identification goes hand in hand with deciding which risks matter enough to act on, and how much residual exposure the firm is willing to live with given its business needs.

Identification as a two-direction exercise

The scope of identification is first set from the top. The board and the executive team frame the exercise, which then cascades to business units (where the firm is organised that way), to departments and finally to the individual processes where work is actually done. A second exercise runs in the opposite direction, with business lines and divisions examining their own activities and reporting what they find. Neither view is complete alone. Senior leaders see strategic threats that a process owner would never consider, while staff close to the work see weaknesses that never reach the boardroom. Putting the two together gives a fuller operational risk profile of the firm. Practitioners often call this combination a reconciliation of the two views, although it is really a consolidation: the aim is to merge two partial pictures into one, not to make two competing numbers agree.

Granularity matters as well. A firm-wide session and a single-team session will rank risks differently and will also surface different kinds of risk: cyberattacks and regulatory change in one, a spreadsheet only one person understands in the other. Aggregating results by risk theme or by line of activity lets recurring patterns and clusters of weakness emerge. More advanced firms also study crossover effects, where operational failures feed into credit, liquidity or market risk and those risks in turn raise operational losses.

Top-down identification starts from the firm’s strategic objectives and asks which operational failures could derail them. Picture a digital bank whose stated goal is to grow fast and win share in its home market. Any operational risk that could slow that growth, or reverse it, deserves to be treated as potentially disastrous and placed near the top of the risk management agenda. Seen this way, enterprise-level risk identification is a core ingredient of operational resilience and of a business model that can last.

The main output of a top-down exercise is a ranking. Participants are senior risk owners: the heads of IT, legal and compliance, members of the executive committee and the heads of the business lines. The sessions work best as structured brainstorming workshops, helped along by aids such as listing exposures and vulnerabilities, a risk wheel, and causal analysis of how a failure would hit impacts and expected revenues.

How often senior management should run it

At executive level, the exercise is usually held two to four times a year, depending on how quickly the business is growing and how fast its activities generate new risks. A firm expanding in an innovative market needs to look again more often than a stable firm in a mature, well-understood market, and technology-heavy businesses or start-ups with unproven models may need an even tighter and more robust cycle. More advanced firms go further and run forward-looking scenarios, and the top-down results can feed both the scenario identification process and the risk and control self-assessment (RCSA) carried out lower down.

What bottom-up identification adds

Bottom-up identification happens locally, inside a department or around a single process, usually as an RCSA workshop or an interactive scenario-building session in which the people who run the activity reflect together on its risks and controls. Returning to the digital bank, the top-down view might name a cyberattack as a major threat. The bottom-up view then makes that concrete: the unit that offers credit cards to small businesses examines how its online application system could be hacked and what would happen if it were.

The single most important difference is location. Top-down identification sits with senior leadership; bottom-up identification sits with the staff of the firm’s departments, including people with no management role at all.

Every financial firm is exposed through the things it depends on most: its key clients, its main distribution channels, its core systems, its principal revenue sources and the regulators it reports to. Large internal projects and critical third parties belong on the same list, and the operational risks created by projects and by outsourcing now attract particular attention from operational risk managers. Exposure is what turns a failure into a large impact. If something goes wrong in an activity the firm leans on heavily, the damage scales with that dependence.

Vulnerabilities are the weak links. They include outdated products or processes, systems that are overdue for maintenance or testing, teams that resist risk management, and non-core activities that nobody monitors. On its own a vulnerability may cause only small, contained trouble. The danger arises when a vulnerability lines up with a large exposure, because that combination can produce very severe losses and, in the worst case, the failure of the business.

The great strength of this method is that it is specific to the business. A line manager needs no risk vocabulary to answer “what do we depend on most?” and “where are we weakest?”, so everyone in the room can contribute.

A risk wheel is a circle of risk themes, such as labour market, technology, regulation, natural events, reputation and business continuity, arranged around risk management at the centre. It is a brainstorming prompt rather than a model, and many versions exist. The tool came from enterprise risk management in non-financial sectors, but risk managers in banks and insurers have found it useful because it pushes discussion beyond the usual categories. The circular layout has a particular advantage: when themes sit next to each other on a wheel, participants naturally start asking how one could set off another, which brings chains of causes and effects into view.

Two causal chains read from the wheel

Consider first a tightening labour market. Rising salaries elsewhere reduce the number of applicants for certain roles, which leaves teams short of staff and lowers their effectiveness. Short-staffed teams then delay or cut the scope of projects and change programmes. If one of those delayed projects is an IT upgrade, the risk attached to technology rises, a systems disruption becomes more likely, business continuity is hit, and a continuity incident can end in reputational damage.

The second chain starts with natural events such as tornadoes, floods or a pandemic. These can disrupt the supply chain, and a supply problem can turn into a business continuity incident. One credit card company lost four days of business after a power cut hit the city where its data center was located. A disruption of that length then spills over into reputation.

Causal links of this kind should shape priorities. When mitigation targets risks that trigger other risks, it stops a domino effect before it starts, so effort spent at the start of a chain protects everything downstream. The principle is the same as in medicine: treat the cause rather than the symptoms.

Interest in emerging risk identification has grown sharply over the last ten years, as the environment became more volatile, new technologies arrived, cyberthreats accelerated with digitalisation, and shocks such as COVID-19 and the war in Ukraine strengthened the sense that large events are hard to predict. For genuine surprises, some of which will always remain, the consensus answer is general preparedness and resilience. For risks that can be anticipated, it helps to separate two kinds.

Horizon scanning is the standard method for finding both. For the rising category, a firm can draw on published surveys that ask risk and business professionals which risks they expect to dominate the coming year. Widely used sources include the World Economic Forum’s Global Risks Report, risk.net’s yearly Top Operational Risks survey of senior practitioners, ORX’s annual Operational Risk Horizon report, and top-10 lists from service firms such as the big 4 audit firms. Such lists serve well as benchmarks or checklists, but nothing on a global opinion survey is likely to surprise anyone, so the list has to be translated into the firm’s own exposures and vulnerabilities and scaled to its activities before it becomes risk identification.

PESTLE as a structure for scanning

PESTLE gives horizon scanning a structure by splitting the operating environment into six components, each of which can be scanned in turn:

Trying to track every change in the environment would be wasteful. A firm should instead concentrate its monitoring on four things: changes that bear on its mission and strategy; developments that could threaten its long-term plans; emerging shifts that could alter its business exposure or its value drivers; and threats that ought to be built into scenario analysis and contingency planning.

Research, analytics and emerging risk committees

Tracking academic research and early trends relevant to the business model (a rival technology, say, or a promising innovation) is valuable but seldom done outside the largest institutions, and machine learning and big data screening for operational risk are not yet widespread. Some larger multinational firms rely on human expertise instead, forming emerging risk committees on particular themes with an expert from each region or country. Members meet quarterly to share trends, rumours of change and news. These committees are most common for compliance, and given the size of the sector’s regulatory fines, compliance monitoring is well developed in heavily regulated countries.

Bottom-up tools stay close to how an activity actually runs. The three main ones are desk-level analysis of losses and failure patterns, process mapping, and RCSA. Past incidents, at the firm or at its peers, are a natural source of information about what can go wrong. Event analysis helps at every level but is most reliable in stable markets, where the past is a better guide to the future, and it counts as bottom-up because incident data can be examined down to a single trading desk.

Internal losses

A firm’s own losses show where operational risk is concentrated. In banks, losses typically land in the back offices, with financial markets activities most affected, then retail, then the IT department. Transaction volumes and the size of money flows are major drivers. Repeated internal losses can point to a weak internal control system. If the controls are sound, recurring losses may simply reflect normal exposure, and then they belong in the budget and in product pricing. A loss that comes as a surprise is different: it is new information, and new information is exactly what identification needs.

External losses

Losses suffered by other firms are a common source of ideas for both identification and assessment. Consortium data from ORX (the Operational Risk data eXchange, the industry’s largest operational risk data consortium) and other providers are useful inputs. Good practice is to follow every large incident reported by a peer and ask: could this happen to us? If yes, the firm reviews its processes and controls to cut the chance of a similar loss.

Near misses

A near miss is an event that could have caused an operational loss but did not, either through luck or through some intervention outside the normal controls. Leaving a phone on a café table and finding it still there an hour later is a near miss; so is parking in a restricted zone and not being fined. In a bank, an operator might type a payment amount with too many zeros, only for the payment to be rejected because the account number was also wrong. Near misses are often called lessons for free, because they expose a gap in the controls and show what could happen without any actual damage.

Collecting them depends on culture. Staff report near misses only where mistakes can be admitted without unfair blame; elsewhere it is tempting to stay quiet since in the end no harm was done. In aviation, energy and emergency health care, where safety means lives, most reported incidents are near misses and are used to improve controls. Many financial institutions keep an events database and review the major losses and near misses in operational risk committee meetings held monthly or quarterly, checking for changes in the risk profile and in control adequacy.

In a risk and control self-assessment, an organisation, business line or department rates the likelihood and impact of its own operational risks, usually in workshops facilitated by the second line of defence (the firm-wide risk function) with the first line (the business units). The largest institutions sometimes use questionnaires instead to save time.

The output is a self-assessment of the unit’s main inherent risks, the key controls that mitigate them and how effective those controls are. Together these indicate residual risk, meaning the risk that remains once the current control environment is taken into account. RCSA is formally an assessment tool, but firms often use it to identify risks too, so identification and assessment merge into one step. This reflects how intertwined the framework is. It is hard to name a risk without discussing how important it is, and hard to rate a risk without considering the controls already in place.

RCSA has become a standard instrument in the operational risk toolbox and is one of the main methods firms use to identify and assess operational risk, apart from the quantification work required for Basel Pillar 1 and Pillar 2 capital modelling and stress testing.

Choosing who to interview

The people in the room largely determine the quality of what comes out. Two groups stand out when conducting risk interviews. The first is the longest-serving employees, sometimes there since the firm was founded, who remember what happened, what used to happen and why things are done as they are. The second is recent hires, especially those from a different firm or, better still, a different industry, who are still surprised by local habits. Comparing practices across firms, good or bad, reveals strengths and weaknesses that insiders no longer see. Some chief risk officers capture this in an amazement report, which records what new employees notice during their first six weeks, before habit dulls their surprise.

Frequency and trigger events

RCSAs are typically run once a year. Mature firms also update them after each trigger event, meaning any significant and relevant change in the risk environment. Often the trigger is an incident at a peer that changes how a risk is seen, such as a cyberattack, the failure of a third-party vendor, a rogue trading loss or a misconduct fine. Wider shifts, such as crises or wars, should also prompt a review of the key RCSAs. Some organisations run RCSAs every quarter, but too much frequency carries its own risk: the exercise can become box-ticking, with units copying last quarter’s findings forward without really questioning them.

Getting the granularity right

If the exercise is pitched too low in the organisation, it yields a scattered list of small daily risks and inefficiencies of little value when they occur sporadically. Too close to the grains of sand, one misses the beach: the bigger risks and their interactions are lost.

Process mapping lays out a process one step at a time and asks, at each step, what could go wrong. It is a standard bottom-up approach for identifying both risks and controls and is well developed in IT, operations and project management, though it can be applied more loosely, with less detail, almost anywhere. A practical shortcut is to work backwards from the controls: list the checks that already exist, infer which risk each one is meant to address, and look for steps with no check at all or with several checks aimed at the same risk. This reveals where risks are under-controlled and where they are over-controlled.

The level of detail again decides whether the exercise pays off. A map that is too fine takes far too long and turns up mainly minor issues; one that is too coarse tells the firm nothing useful. The right level is usually one where every mapped step is a meaningful action, with the key controls and checks shown at each stage; the analyst then names the risk each control mitigates and asks what could go wrong at each step.

Identifying stress scenarios follows naturally from everyday risk identification and forms the first step of scenario analysis, which is central to operational risk management and to capital assessment. The scenarios that matter here are extremely damaging events that are rare, either by nature or by design.

What the Basel Committee says about scenario analysis

The Basel Committee’s guidance on operational risk, the Revised Principles for the Sound Management of Operational Risk (RPSMOR) and the Principles for Operational Resilience, both issued in March 2021, defines scenario analysis as a method for identifying, analysing and measuring a range of scenarios, including events of low probability and high severity, some of which could produce severe operational risk losses. The guidance frames it as an exercise in identifying extreme events through workshops and brainstorming, fed by every source covered so far: incident data from inside and outside the firm, self-assessment results, analysis of incident causes and risk cascades, and an understanding of how risks and controls sit within key processes.

The resilience guidance connects operational risk scenarios with the scenarios a firm needs for business continuity, so that disruption to critical business services is kept to a minimum in both likelihood and extent. Banks are expected to write business continuity plans (BCP) that look forward and rest on scenario analyses, with matching impact assessments and recovery procedures, in a sequence of steps:

The two recovery targets answer different questions. The RTO sets how quickly a service must be running again after a disruption, while the RPO sets how much data the firm can afford to lose, expressed as the point in time to which data must be restored. So the Basel Committee asks banks to add to their operational risk scenarios explicit thought about unexpected events that could seriously disrupt the business.

Regulators expect scenario analysis to give repeatable results, in its numbers and its narratives, so consistency and control of behavioural bias are the central challenges. Firms must keep subjectivity low by grounding assumptions in empirical evidence, explaining the rationale for every scenario, and documenting assumptions and process thoroughly.

Preparation: the preparation pack and the participants

Before the workshops, the organisers assemble a preparation pack of material that will later support selection and assessment. Some facilitators hold it back during generation to keep brainstorming uninfluenced, but circulating it before the first meeting is more common. A typical pack holds RCSA results and key risk indicator scores; loss data from inside the firm (large past incidents and near misses included) and from outside it; audit findings and any issue logbooks; known vulnerabilities, open issues and concentrated exposures; and anything else that helps assess risk and exposure.

Participants should be senior managers from the corporate and business functions who understand the risks in their areas. Outside experts are advisable though uncommon, and an external view helps counter two biases:

People and firms alike struggle to imagine their own weaknesses causing large losses, and the lesson arrives painfully when a lucky streak ends.

Generation: building the long list

The generation phase opens the workshop and aims for the longest possible list of candidate scenarios. Facilitators, usually operational risk professionals, start each discussion, coordinate debate and build consensus. Warm-up questions help: what worries you most about the business over the next 1 to 3 years, and why? Which recent near losses still concern you? The facilitator then takes one idea at a time, invites everyone to refine it, and when ideas dry up, groups the narratives by risk or consequence type, which often sparks more scenarios.

Selection: from long list to assessable list

In selection, scenarios are merged, eliminated or added so that the list can be properly assessed. Scenarios with one internal impact but different external causes are typically consolidated: damage to physical assets from a building fault, extreme weather, unrest or terrorism has the same effect on the firm, so it becomes one scenario with several causes. Firms under the newer resilience rules can reuse such scenarios to set or test continuity planning parameters.

Scenarios that look negligible after a quick evaluation can be dropped, as can any whose owner convincingly shows that the maximum likely loss would be absorbed by normal operating margin without serious disruption. If the head of human resources shows that every key employee is identified and each key role has an alternate and a succession plan, the key person risk scenario will probably go.

As a final check, a firm can compare its list with an industry list to see whether it has missed a relevant scenario or risk driver. ORX and ORIC (Operational Risk Consortium for Insurance Companies) supply ready-made lists to members. The comparison should come only after generation is complete, never before, so that the external list does not bias the firm’s own thinking.

Writing down a risk well is harder than it looks, and the essential discipline is to keep three things apart: the cause, the risk event and the impact. In finance, the Basel Committee defines operational risk as the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It classifies the risk in a two-level regulatory taxonomy, with a third level of examples. Operational risk exists in every sector, and in non-financial firms it makes up a large part of total risk, because those firms do not take credit, market or actuarial risk as their business model in the way banks and insurers do.

Other industries, other conventions

The ISO 31000 risk management standard and the Institute of Risk Management describe each risk as a trio, a single cause with a single event and a single impact, written to a fixed pattern:

An example: the risk of a fine from the regulator (impact) due to breaching regulations (event) caused by slow implementation of changes a new rule requires (cause). Financial firms have largely not adopted this format, probably because their operational risks usually have several causes and several impacts, which a one-to-one sentence cannot capture.

Industries with physical safety exposure, such as oil and gas, electricity and construction, speak of hazards, meaning uncertainty about adverse events. HAZOP, short for hazard and operability studies, and HACCP, short for hazard analysis and critical control points, are engineering techniques for finding them, rarely used in financial services, where physical risk is less central. For general strategy, the SWOT analysis popularised in the late 1960s lists strengths, weaknesses, opportunities and threats, with threats playing the role of risks or downside exposure and opportunities representing the upside.

Resources, drivers and constraints are not risks

Precision makes a risk easier to link to its causes and consequences, and so to assess and mitigate. Three common slips show why.

The type of process also shapes how often losses occur, which is why assessment has to dig down to the root cause instead of stopping at the label. Most firms accept that people and processes will inevitably make some errors. Compliance failures can be very costly: firms paid large penalties and fines after the mortgage crisis, including for failing to honour home appraisal requirements, during the Great Financial Crisis of 2007 to 2009.

To separate a risk from a broad theme, describe it as an adverse occurrence: an incident, an accident, an uncertain event. Asking “what could go wrong?” is a plain test that needs no jargon, and the more precisely the event is stated, the easier it is to assess and mitigate. Best practice in financial services is to categorise causes, risks, impacts and controls separately, describe the risks first, and connect them to their causes, impacts and controls during assessment. Each is organised in its own taxonomy, a structure of successive levels of detail, much as biologists classify plants and animals.

The Basel Committee on Banking Supervision (BCBS) provides the official operational risk taxonomy for banks. Level 1 holds the broadest event types, Level 2 splits each into more detailed categories, and Level 3 gives examples of activities that belong in each category. Only Levels 1 and 2 are regulatory categories; Level 3 is there to illustrate. The taxonomy was drawn up in the late 1990s while the Basel rules for operational risk were being prepared, and more than twenty years later it remains the official one. Regulated financial firms must report their operational risk to supervisors using it.

The same economy suits management practice: use the fewest categories that still carry meaning and leave finer detail to examples. How many risks a firm assesses, manages and reports must stay manageable, since excess detail degrades information, is hard to review and drains effort for little benefit.

Source: Bank for International Settlements, Operational Risk Loss Data Collection Exercise, 2002. Definitions restated; Level 2 counts derived from the published table.

Level 2 categories with Level 3 examples

Applying the taxonomy: the tests that separate neighbouring categories

Most classification questions turn on a few distinctions. Intent separates the two fraud categories and Clients, Products & Business Practices from Execution, Delivery & Process Management: deliberate wrongdoing points to fraud, while negligence towards a client points to CPBP. Who acted separates internal fraud (at least one insider) from external fraud (a third party alone). Insider trading shows how fine the line can be: done on the firm’s own account it sits under Improper Business or Market Practices in CPBP, while done by an employee for personal gain, not on the firm’s account, it is internal fraud.

Many firms build their own taxonomy, tailored to the nature, size and location of their business. A firm in a heavily regulated market such as the UK or the United States is likely to carry more compliance risk types, while one exposed to severe weather or sociopolitical instability adds more physical and disruption types, especially at the second level.

Why the Basel categories have aged

The Basel classification no longer fully matches current exposures. Over two decades, technology has changed how banks and insurers underwrite, serve clients and collect data, and value has moved from vaults to digital platforms, making cybercrime far bigger. New business models and wider international activity multiplied outsourcing, change and supply chain risk. The 2007 to 2009 crisis brought tighter rules on selling practices and customer information, now called conduct, and anti-money laundering and financial crime controls grew with international crime and regulatory sanctions. So internationally active institutions wanted a refreshed taxonomy.

The ORX reference taxonomy

ORX runs the biggest pooled database of operational loss events. It is owned by its members, about 100 of the largest banks and insurers worldwide (Citi being a notable exception), who report losses anonymously and share good practice. In 2019 ORX, supported by Oliver Wyman, published a reference taxonomy reflecting how its members saw risk changing. It stays close to Basel but makes visible changes: the text describes 14 Level 1 risk types against 7 for Basel, and several Level 2 risks are promoted to Level 1 because of their prominence: model risk, data management, business continuity, information security including cyber, statutory reporting and tax, and third-party failure. ORX did not yet use it for its own loss reporting at the time of writing.

Source: adapted from the ORX and Oliver Wyman summary report on the ORX Reference Taxonomy, 2019. Counts derived.

The published table lists 16 Level 1 headings, two more than the 14 in the text, so treat the exact count with care. The direction is what matters: types buried at Level 2 under Basel now stand alone.

How practice differs across firms

While building the ORX taxonomy, consultants reviewed the taxonomies of close to 60 ORX members and found wide variation. Many firms listed Level 2 risks that are really control failures (inadequate supervision, lack of training) or causes (lack of resources). Whether something counts as a risk, a cause or an impact usually comes down to judgment, because the chain of cause and impact can run into the external environment and end with the customer.

Newer risks are placed inconsistently. Cyber risk sits under external fraud, under IT risk, or as its own Level 1 risk. Conduct risk may be filed under compliance, business practices or culture, or stand alone. Third-party risk is usually stand-alone, sometimes under IT because much outsourcing is IT procurement, less often under Execution, Delivery & Process Management as Basel placed it, or spread across all categories as a Level 2 risk.

The bank’s focus on control failures probably reflects how much a large, complex group depends on internal control; the payments firm’s focus follows its main sources of exposure.

Classifying causes, impacts and controls alongside risks shows where management can actually act. Impacts are the outcomes a firm wants to avoid; they arise from risks, which arise from causes. Uncertainty can also bring good outcomes, so eliminating every risk would be neither sensible nor economic, but cutting off the downside while keeping the upside, much like holding a financial option, makes sense. A firm first acts on causes, then applies controls to the causes that remain, limiting both likelihood and impact. So causes and controls are the parts of the chain management can work on directly.

Taxonomies differ between firms partly because business models differ and partly for lack of a global reference, the gap ORX’s 2019 risk taxonomy aimed to fill. Shared taxonomies of causes, impacts and controls would help too.

Causes taxonomy

For causes, the natural starting point is the Basel definition, which names four sources of loss: people, processes, systems and external events, or PPSE. Most of the market uses these as Level 1 causes, though not every bank adds a Level 2 split, which gives real insight into why incidents happen. ORX followed its risk taxonomy with reference taxonomies of causes and impacts, again with Oliver Wyman’s support. Its causes taxonomy keeps the PPSE structure and breaks people failures into competence, performance and ethics; system failures into design, performance and testing; process failures into design and governance; and external events into political, regulatory, economic and physical parts of the environment.

Source: adapted from ORX. Rows reordered to follow the people, process, systems, external sequence; counts derived.

Impact taxonomy

Under the Basel definition operational risk is a risk of loss, direct or indirect. Early on, most institutions counted only financial losses. A few years on, firms added reputational damage, a non-financial impact now found in nearly all impact taxonomies, and after the great financial crisis (GFC) of 2007 to 2009 most added regulatory non-compliance and customer detriment. Firms where continuity is critical, for example trading platforms and online financial services, add service disruption, and with regulators focused on resilience it will likely become a separate category in most firms.

The ORX impact taxonomy is more detailed than general practice. Beside direct and indirect financial impacts, it captures non-financial impacts, the harm done to stakeholders, split by impact channel (often called impact types) and by stakeholder group.

Control categories

Classifying controls is the most settled part, because internal control is a mature practice and internal audit has given it structure. Four main categories are used, and ORX has said it is developing a finer reference classification of controls.

Causes, control failures and environmental change combine into many risks with a range of impacts, which an industry organises in taxonomies. A firm usually applies a subset of an industry taxonomy to build its own risk inventory, also called the risk universe or risk register, although the register strictly includes assessment too. The inventory is the taxonomy applied to the firm’s actual risks: a consistent list that can be filtered and sorted to understand exposure.

Stress scenarios show the two kinds of rarity again: an earthquake where none has occurred before is rare by nature, while a cyberattack that succeeds against a central data server is rare because of the preventive controls in the way. The register is kept as a spreadsheet or as a dataset within risk management software and reassessed by the departments that own the risks.

Why practice differs between large and small firms

The sophistication of operational risk management depends largely on size and complexity, which also drive regulatory scrutiny. International banks and insurers face higher standards because of the systemic risk they pose, and they generate far more operational risk than small local firms. Higher risk plus higher demands explains why the discipline is more developed in large institutions. Once the inventory exists, the next task is to analyse and assess its risks.