New technologies and risk disciplines attract attention, but resilience, AI and third-party risk management all rest on the fundamentals of effective operational risk management.
The original reflects on ORM’s development from the Basel II era and the contributions of early practitioners and professional bodies. Its message is that new frameworks will remain fragile if firms neglect the foundational disciplines.
1. Clarify risk appetite, tolerance and capacity
Define coherent appetite and tolerance, both qualitatively and quantitatively, at inherent and residual levels; understand capacity.
2. Get the taxonomy right
Use mutually exclusive and collectively exhaustive categories, distinguishing risks from causes, impacts and control failures.
3. Put risk identification first
Combine bottom-up RCSAs, process reviews and incidents with top-down scenarios, emerging risk reviews and management horizon scanning.
4. Understand inherent and residual exposure
Know both the exposure before controls and the remaining exposure after controls to guide appetite and investment decisions.
5. Train people in frameworks and tools
Reinforce the practical use of RCSAs, incident management, KRIs and scenarios through continuing training.
6. Clarify roles across the Three Lines
Specify responsibilities, accountabilities, segregation, independent challenge and interfaces using tools such as RACIs.
7. Assess control design and effectiveness
Review the mix and independence of preventive, detective, directive and corrective controls before testing operating effectiveness.
8. Track risk drivers and key controls
Use forward-looking KRIs tied to risk drivers and KCIs monitoring critical control health rather than promising perfect prediction.
9. Learn from incidents
Use bow-tie analysis and the Five Whys to find root causes and improve preventive controls, not merely record lessons.
10. Use GRC technology to support ORM
Connect risk data and workflows with modern GRC systems, while recognising that software cannot replace a coherent risk framework.
Read more
Original LinkedIn article — full discussion ↗
Selecting and Implementing a GRC System: 12 Golden Rules and Pitfalls
For a fuller treatment of the fundamentals, see Integrated Operational Risk Management (Wiley, 2025) by Jimi Hinchliffe and Andrew Sheen.
Editorial summary of the author’s original October 2025 LinkedIn publication, not a new research paper.