Change, complexity, complacency

One should also examine the sources that drive the headline categories of operational
risk. For example, one may view the drivers as falling broadly under the categories
of change, complexity, and complacency.
Change refers to such items as introducing new technology or new products, a
merger or acquisition, or moving from internal supply to outsourcing, etc. Complexity
refers to such items as complexity in products, process or technology. Complacency
refers to ineffective management of the business, particularly in key operational risk
areas such as fraud, unauthorized trading, privacy and confidentiality, payment and
settlement, model use, etc. Figure 12.10 illustrates how these underlying sources of
a risk connect to the headline operational risk categories.