Operational, Compliance, and Legal Risk
Operational risk
Operational risk is loss from inadequate or failed internal processes, people, systems, or external events. It includes fraud, cyber, conduct, processing errors, and business disruption. Candidates should know the four drivers and the distinction from strategic and reputational risk. Loss data, risk and control self-assessments, key risk indicators, and scenario analysis are the core toolkit.
Compliance and legal risk
Compliance risk is loss from failing to comply with laws, regulations, and standards; legal risk covers unenforceable contracts, litigation, and regulatory sanction. Both require regulatory mapping, change management for new rules, training, monitoring, and breach escalation. A trap is assuming compliance equals ethical conduct; conduct risk can arise in fully compliant activity.
Traps to watch
- Near misses and external loss data are valuable; ignoring them understates risk.
- Cyber risk is operational but has systemic and third-party dimensions.
- Outsourcing transfers activity, not accountability, and requires oversight.
- Legal enforceability of netting and collateral depends on jurisdiction.
Worked example
A firm records 200 failed settlements in a year with an average loss of 5,000 each, giving 1 million of observed loss. Scenario analysis suggests a severe but plausible outage could cost 20 million. Capital and control investment should reflect both the frequent small losses and the plausible severe event, not just the historical average.