All organisations bear operational risk in order to achieve their objectives. For organisations motivated by profit, operational profit is the return required by the capital owners for bearing the operational risk associated with the production process. Hence operational risk is of primary concern to internal stakeholders—including the capital owners of the business, management who control operational risk, and employees who are part of the operational production process—and external parties such as creditors, customers, and regulators who are impacted by operational risk failures.

As it is such a fundamental risk, most organisations are very conscious of operational risk, and many of them are very good at managing and mitigating operational risk. Despite this, however, the field of operational risk assessment is still relatively new, particularly when it comes to its inclusion in capital frameworks. The global banking industry has developed regulatory capital frameworks for operational risk that have been used for the last five to 10 years, and some countries are currently following suit with respect to equivalent insurance regulatory capital standards. But outside of these two industries, there is relatively little operational risk assessment activity from regulators, industry bodies, or individual companies.

This report investigates existing operational risk assessment frameworks around the world, as well as current methods and emerging practice in this area.