Operational Risk

What Is Operational Risk?

Operational risk is the chance that a business loses money or suffers disruption because something inside its operations goes wrong. The cause might be a human mistake, a faulty internal control, a software outage, a cyberattack, a supplier failure, or an external event such as a fire or flood. Unlike market risk, which comes from price movements, and credit risk, which comes from borrowers failing to repay, operational risk arises from how an organization actually runs its day-to-day work.

How It Arises

Operational risk is usually grouped into a few broad sources:

• People: errors, fraud, or misconduct by employees
• Processes: poorly designed or poorly followed procedures
• Systems: technology failures, data errors, or security breaches
• External events: natural disasters, legal actions, or disruptions caused by third parties

Financial firms, especially banks, have long treated operational risk as a distinct category that needs its own measurement and oversight. Large losses have occurred from events such as unauthorized trading, payment errors, and failures in record-keeping, showing that these risks can be as damaging as market or credit losses.

Why It Matters to Investors

Operational problems can hurt a company's earnings, reputation, and share price, sometimes suddenly. Investors often look at how a company describes its risk factors, its history of internal control issues, and its disclosures about cyber incidents or regulatory fines. A company with weak controls may face higher costs, lawsuits, or regulatory penalties that are not visible in its headline revenue figures. Because these risks are hard to predict, they are often reviewed through annual reports and filings rather than through simple financial ratios.