LEARN. PRACTICE. GROW.Concept and mechanism
Operational risk can arise from processes, people, systems, or external events. A faulty batch can duplicate instructions, require remediation, and affect clients even while servers remain available. A useful description links cause, event, and consequences so controls and owners can be identified. In the Basel capital definition, legal risk is included while strategic and reputational risk are excluded; this does not mean ignoring reputational consequences of operational failure. This pathway addresses practical management and support decisions without calculating capital requirements. The March 2021 BCBS reference remains listed as current; the inspected 2026 consolidated chapter is a consultation draft and is not treated as a final standard.
Guided application
The IIA Three Lines Model was updated in July 2026. Operations retain ownership of assigned work and controls; specialist functions support, monitor, and challenge; internal audit provides independent assurance and advice without assuming management decisions. Team names are insufficient: clarify who executes, reviews, accepts deviations, and supplies evidence. A project manager can present options without authority to accept risk above a limit. That decision follows applicable delegation and should be recorded. Insurance or a contract can transfer part of a financial consequence but does not deliver service during failure or remove every responsibility and exposure.
Example: the schedule is approved, but the delegated committee has not accepted two control gaps. The manager presents options and impact without signing for the committee.
Common pitfalls
Review treated as ownership transfer; sponsor treated as universal authority; insurance treated as continuity; consultation draft treated as final rule.
Related topics: Risk assessment and control effectiveness · Events, near misses, and response · Indicators, reporting, and acceptance
Connect risk to service, owner, control, and decision authority.
Reference: Three Lines Model: Assurance and Advice in Support of Effective Governance · DR operational risk professional assessment2026.10