Defining operational risk

Above we discussed defining operational risk so we will not duplicate the various
ways of defining it. IBM prefers the wide definition but the methodology can accommodate
any definition.
When defining operational risk it is also important to differentiate between risk
and exposure. Exposure to operational risk occurs in all operations/activities all the
time. The size of the unexpected loss can, however, be mitigated by strong internal
controls. A measure of exposure might be the number of transactions or people. The
operational risk is the magnitude and likelihood of a loss as measured by the value
and probability of a loss on the transactions being processed. Exposure can only be
eliminated if no business is done. Risk can be limited by investing in process, people
and technology.