An operational risk assessment asks what could go wrong in the way a business runs: its people, processes, systems, suppliers and the events outside its control. This free operational risk assessment checklist is for risk managers, operations directors, compliance leads and business unit heads who run a risk and control self-assessment (RCSA) once or twice a year. One run covers one business or business unit for one period. It sets the scope, the scoring scales and the risk appetite, builds a process inventory, identifies risks process by process, scores inherent risk, assesses the controls, scores residual risk and sets key risk indicators. A treatment phase appears only when a residual risk is above appetite. The accountable executive signs the assessment off before it is reported, and every action leaves with an owner and a date. Banks and other firms that follow the Basel Committee’s principles get three extra tasks on event types, loss data and board reporting.
The Basel Committee on Banking Supervision defines operational risk as the risk of loss from inadequate or failed internal processes, people and systems, or from external events. The definition comes from banking, but it fits any organisation that runs on processes: a logistics company, a care provider or a software business. An operational risk assessment works through those sources one process at a time. For each risk it asks how likely the failure is, how much harm it would do and how well the controls you already have would stop it.
In a risk and control self-assessment the people who run each process identify and score the risks, and a risk function challenges the results. That is what separates it from an operational audit, where an independent auditor tests how well the processes have performed. The two feed each other. Audit findings are an input to the assessment, and the assessment tells audit where to look next.
Covers: the process inventory, risk identification, inherent and residual scoring, control effectiveness, key risk indicators and treatment plans.
Cadence: once or twice a year, and again after a major change.
Output: a scored risk register, KRIs with thresholds and an action plan the accountable executive has signed off.
Covers: whether processes achieve what they are meant to, whether controls are followed, and gaps in efficiency and compliance.
Cadence: set by the audit plan, often a function at a time.
Output: an audit report with rated findings and agreed recommendations.
Covers: a single subject, such as a vendor risk assessment, a fire risk assessment or a business continuity exercise.
Cadence: set by the topic, the law or the vendor’s tier.
Output: a rating and actions that feed the operational risk register.
Seven phases run in every assessment. Phase 7 appears only when a residual risk is above your appetite. Three tasks for banks and other firms that follow the Basel Committee’s principles appear only when the first task says so.
The answers on the first task decide whether the Basel tasks appear. Agree the scales and the appetite before anyone scores a risk, or every workshop will use its own.
Work through the sources in the Basel definition for each process: people, processes, systems and external events, with suppliers and outsourcing as a separate prompt.
Shown only when a residual risk is above appetite. Every such risk leaves this phase with a plan or a signed acceptance.
The sign-off holds the rest of this phase until the accountable executive has approved the assessment.
Banks classify operational risk events into seven Level 1 categories, set out in Annex 9 of the Basel II framework that the Basel Committee on Banking Supervision published in June 2006. The categories work in any organisation as a check that the register has no blind spots. If a whole row has no risk against it, ask whether that is true or whether nobody looked. The definitions are summarised from Annex 9; the examples in the last column are ours, written for a business outside banking.
| Event type | What it covers (Basel definition, summarised) | Examples outside a bank |
|---|---|---|
| Internal fraud | Acts intended to defraud, misappropriate property or get round regulations, the law or company policy, involving at least one internal party | Theft of stock by staff, invoices from a fake supplier, inflated expense claims |
| External fraud | The same kinds of act by a third party, including systems security events such as hacking | Payment diversion fraud, goods stolen in transit, a hijacked customer account |
| Employment practices and workplace safety | Acts inconsistent with employment, health or safety laws or agreements, personal injury claims and discrimination | A warehouse injury claim, a dispute over pay, a discrimination complaint |
| Clients, products and business practices | An unintentional or negligent failure to meet a professional obligation to specific clients, or a flaw in the nature or design of a product | A breach of customer privacy, aggressive selling, a product defect |
| Damage to physical assets | Loss of or damage to physical assets from natural disaster or other events | A flooded depot, a fire, vandalised vehicles |
| Business disruption and system failures | Disruption of the business or failure of systems: hardware, software, telecommunications and utilities | A warehouse management system outage, a power cut, a network failure |
| Execution, delivery and process management | Failed transaction processing or process management, and failures in dealings with trade counterparties and vendors | A delivery address keyed in wrongly, a missed mandatory filing, a subcontractor that does not deliver |
The Basel definition includes legal risk but excludes strategic and reputational risk. That is how the Basel Committee’s 2021 Principles for the sound management of operational risk put it. If you leave reputation out of the definition, keep it in the impact scale, so a failure that would lose customers still scores high. The same Principles list the tools this checklist uses: self-assessments of risks and controls, business process mapping, event data, control monitoring and assurance, metrics such as key risk indicators, scenario analysis, and comparisons between them. ISO 31000:2018, the international guideline on risk management, describes the same cycle of identifying, analysing, evaluating, treating, monitoring and communicating risk. It is guidance, not a standard you can be certified against.
The scoring scales, the appetite and the register sit in the first tasks of every run, so this half-year’s assessment scores risks the same way as the last one and the two can be compared. A recurring schedule starts the next assessment on its date and assigns it to the coordinator.
One answer in Phase 6 adds the treatment phase when a residual risk is above appetite, and an answer on the first task adds the Basel tasks for banks and financial firms. A business unit that is inside appetite gets a shorter checklist, and one that is not cannot skip the plan.
Management sign-off runs as an approval that holds the reporting tasks until the accountable executive decides, and a risk kept above appetite needs its own signed acceptance. Workshop notes, control tests and KRI reports sit on the tasks they support, and the activity history shows who scored what and when.
CheckFlow runs the assessment work, the evidence and the sign-offs. It is not a GRC platform and it does not calculate scores: the ratings are your team’s, recorded in the tables on each task. Each run’s progress and overdue tasks show on the Reports Grid, and a recurring checklist per business unit keeps the cycle going.
An assessment is only as good as its inputs. The Operational Audit Checklist tests how processes have performed, the Vendor Risk Assessment Checklist rates each critical supplier, the Fire Risk Assessment Checklist covers the premises and the Business Continuity Plan Testing Checklist proves the recovery plans the assessment relies on. EU financial entities will also want the DORA ICT Risk Management Checklist.
Describe the process in a sentence and the AI checklist generator drafts the phases and tasks for you.
It is a structured review of what could go wrong in the way an organisation runs: failures of people, processes and systems, and external events. Each risk is scored for likelihood and impact before controls (inherent risk), the controls are assessed, and the risk is scored again after them (residual risk). Residual risks are compared with the organisation’s risk appetite, and those above it get a treatment plan. The result is a scored risk register, key risk indicators and an action plan that management signs off.
An RCSA is an operational risk assessment carried out by the people who run each process rather than by auditors. Process owners identify the risks, score them and assess their own controls, and a risk function challenges the results for consistency. The Basel Committee’s principles describe self-assessments as evaluating inherent risk, the effectiveness of the control environment and residual risk, with enough detail for an independent reviewer to see how each rating was reached.
Inherent risk is the exposure before any control is counted: how likely the event is and how much harm it would do if nothing stopped it. Residual risk is what is left once the controls that actually work are taken into account. The gap between the two shows how much you depend on your controls, so the controls behind the largest gaps are the first ones to test.
Key risk indicators are metrics that warn early that a risk is growing, such as overtime in a team with a key-person dependency, failed system changes or late supplier deliveries. Each one needs a clear link to a risk, a data source, an owner and thresholds that trigger action. The Basel principles describe metrics like these as early warning information, monitored over time against agreed thresholds or limits.
A common pattern is a full assessment once or twice a year, refreshed sooner after a trigger: a major incident, a new product or system, a reorganisation, an acquisition or a new critical supplier. The Basel principles ask banks to monitor operational risk regularly, with reporting frequency that reflects the risks and how fast the operating environment changes, rather than setting one interval. Key risk indicators cover the time between assessments.
An operational audit is an independent review of how well processes and controls have performed, carried out by internal audit or someone outside the process. An operational risk assessment is forward-looking and owned by the business: process owners score what could go wrong and how well their controls would stop it. Use the Operational Audit Checklist for the audit and this checklist for the assessment, and feed each one’s findings into the other.
It sets out the types and levels of risk an organisation is willing to accept in pursuit of its objectives, decided in advance. For operational risk it usually names the categories that matter and the rating, loss or indicator level above which a risk must be treated or escalated. The Basel principles expect a bank’s board to approve and periodically review one. Without it, the residual ratings in an assessment have nothing to be compared with.
14-day free trial, no card required. The Business plan is $10 per user per month after the trial. Full details at checkflow.io/pricing.
14-day free trial, no credit cardFull refund in your first 30 daysUS or EU hosting
