A rising tide of operational risk: new directions for management control research on core and novel risks

Abstract Operational risks are risks that may lead to operational losses through operational disruptions, caused by employee errors, failures, or breakdowns of internal processes and external events, or inadequate procedures to identify, prevent, or manage operational risks. Operational risks were once treated as a residual category in risk management. That time is over, as a rising tide of operational risks emerges from recent global developments, including geopolitical instability, energy insecurity, digital interdependence, and regulatory uncertainty. We conceptualise two forms of change to operational risks: (1) amplified core operational risks , risks that have always existed but whose scale, speed, and mechanisms are being transformed and (2) structurally novel operational risks , introducing organisations to entirely new sets of operational risks enabled only by new systemic and technological conditions. The two categories differ not only in their nature but in the control logic they require: preventive and detective approaches for amplified core risks, and resilience and recovery for structurally novel ones. The five papers in this Special Issue address amplified core operational risks and together demonstrate that operational risk management cannot be reduced to a single tool, technique, or organisational function. We close with a forward-looking research agenda on structurally novel operational risks.