The definition and what it excludes

The Basel definition

Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events. It includes legal risk but excludes strategic and reputational risk.

The definition reads through its four causes, and that is how it becomes useful.

The two exclusions, and why they matter

Strategic risk — picking the wrong market, botching an acquisition — is excluded because it stems from a deliberate decision, not an execution failure.

Reputational risk is excluded as a cause, but appears as a consequence in any impact assessment. The nuance is methodological: you do not manage "reputational risk", you manage operational events for which reputation is one of the impacts.

What makes this risk particular

Three characteristics distinguish it from credit and market risk:

1. It is not deliberately taken. You choose to grant a loan; you do not choose to suffer an outage.
2. It does not diversify. Adding business lines adds operational risks instead of offsetting them.
3. Its distribution is skewed. Many frequent small losses, and a few extreme ones that dominate the total. That is why the historical mean is a poor estimator, and why scenario analysis is justified.

The link with continuity

Operational risk and business continuity look at the same object from two angles. The first asks "what is the likelihood and expected cost?"; the second asks "if it happens, how do we hold?".

Both share the same process map, the same extreme scenarios and often the same people. Siloing them produces twice the work for half the result.