Operational risk can be defined as the "risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events."It includes legal risk, but excludes business, strategic, and reputational risk.

That is a deliberately broad definition, and it includes everything from anti-money laundering risk and cyber risk to risks of terrorist attacks and rogue trading. The outbreaks of rogue trading in the 1990s helped persuade regulators to include operational risk in bank capital calculations. Looking beyond the banking industry, we might include many corporate disasters under the operational risk umbrella. These include physical operational mishaps and corporate governance scandals, such as the crisis at energy giant Enron in 2001. The management of operational risk is the primary day-to-day concern for many risk managers outside the financial industry, often through insurance strategies.