Which term describes the potential for losses caused by inadequate systems or controls, human error or mismanagement and natural disasters?

• A. Policy
• B. Probability
• C. Operational risk
• D. Risk

Answer: (C)

Operational risk is the potential for losses that arise from weaknesses in how an organization operates: inadequate systems or controls, human error or mismanagement, and external events like natural disasters. These factors all point to failures in processes, people, or technology that can disrupt daily operations and lead to financial or other losses.

A policy is simply a formal rule or guideline, not a description of loss potential. Probability is a measure of how likely an event is, not the type of risk itself. Risk is the broad umbrella term for exposure to loss, but the description specifically targets losses from process and control failures, which is what operational risk captures. For example, a data center outage caused by outdated hardware and missing controls is a classic operational risk scenario.