Operational Risk Management Beyond the Risk Register

Most Indian organisations have an operational risk register. Many have a good one: a heat map, a taxonomy that maps to Basel or ISO 31000, risk owners, control descriptions, residual ratings. It satisfies the auditor, it satisfies the board's Risk Management Committee, and it satisfies the RBI or SEBI inspection when it comes.

What it frequently does not do is change what happens at the point where risk is actually created and absorbed: the employee making a judgement call under time pressure with incomplete information. That gap, between the register on the intranet and the behaviour on the ground, is where operational losses come from. Closing it is not a documentation exercise. It is a training and culture exercise.

Why isn’t a risk register enough to manage operational risk?

Because a register is a point-in-time inventory, while operational risk changes every time a process, system, vendor or person changes.

A risk register is a point-in-time inventory. It captures what a group of people believed, on the day of the workshop, about what could go wrong and how well it was controlled. That is genuinely useful. But operational risk does not hold still for the review cycle. Processes change, a system gets patched, a vendor is swapped, a key person leaves and takes undocumented knowledge with them, volumes spike during a festival season. Each of those quietly alters the risk picture, and the register does not know.

The Reserve Bank of India's guidance on operational risk management and operational resilience makes this explicit: operational risk is inherent in all products, activities, processes and systems, and managing it is a continuous activity, not a periodic filing. The Basel Committee's revised Principles for the Sound Management of Operational Risk say the same thing in different words: the control environment has to be embedded in day-to-day operations, owned by the first line of defence, not delegated to a risk team that visits once a quarter.

The uncomfortable implication is that the people best placed to see operational risk changing in real time are not on the Risk Management Committee. They are the branch operations executive, the plant supervisor, the claims processor, the IT helpdesk analyst. If they are not trained to recognise risk and are not given a frictionless way to report it, the register will always be describing a world that no longer exists.

Where does the operational risk register fail in practice?

In practice, four gaps recur across manufacturing, BFSI, IT/ITeS and services organisations in India.

1. Near-misses are never captured

A near-miss is a loss event that did not happen this time. A payment that was almost released to the wrong beneficiary and caught at the last second. A machine guard that was bypassed for a week without incident. A phishing email that one person nearly clicked. Near-misses are the richest early-warning data an organisation has, and most Indian companies capture almost none of them, because there is no easy channel, no cultural permission, and a quiet fear that reporting one invites blame. The result is that the organisation only learns from the losses that actually crystallise, which is the most expensive way to learn.

2. Controls are documented but not lived

The register lists a control. The control exists on paper. Whether it is actually performed, performed correctly, and still relevant is a separate question that the register rarely answers. Maker-checker becomes two people clicking approve without looking. A reconciliation is done but exceptions are carried forward for months. A control designed for a manual process survives long after the process was automated, protecting against a risk that no longer exists while a new risk goes uncovered.

3. Risk sits in a silo

Operational risk is treated as the risk function's property. The first line, the people who own the process, see risk management as something done to them, not by them. So they route around it. When ownership does not sit with the process owner, the register becomes a compliance artefact rather than a management tool.

4. New and emerging risks arrive faster than the review cycle

Third-party and outsourcing dependencies, cloud concentration, AI in decisioning, deepfake-enabled social engineering, climate disruption to physical operations. These do not wait for the annual risk workshop. An organisation that only updates its view of risk once or twice a year is structurally behind on exactly the risks that are moving fastest.

How do you turn a risk register into lived risk awareness?

Make near-miss reporting easy and safe, push risk ownership into the first line, train for the risk in each role, and test whether controls survive real working pressure.

Make near-miss reporting easy, safe and visible

The single highest-return change most organisations can make is to build a genuine near-miss and operational-incident reporting channel, and then protect the people who use it. Easy means it takes less than two minutes and does not require finding the right form. Safe means a just-culture stance: the default response to an honest report is curiosity about the system, not punishment of the person. Visible means employees see that reports lead to change. Nothing kills a reporting culture faster than a black hole where submissions disappear and nothing improves.

Push risk ownership into the first line

The three-lines model only works when the first line actually owns its risk. That means the process owner, not the risk team, identifies the risks in their process, confirms the controls, and flags when something changes. The risk function's job shifts from owning the register to enabling and challenging the people who do. This is a training question as much as a governance one: first-line staff and their managers need to understand what operational risk is, in the specific language of their own work, before they can own it.

Train for the risk in the role, not the risk in the abstract

A generic operational-risk e-learning module that talks about taxonomies and heat maps will wash over a branch executive or a production supervisor. What lands is role-based, scenario-driven training built around the decisions those people actually make. For a payments processor: the beneficiary-verification steps that get skipped under volume pressure. For a plant supervisor: the permit-to-work and lockout discipline that erodes when a line is behind schedule. For a relationship manager: the KYC and override red flags. When training is anchored in the person's own workflow, they start seeing risk where they previously saw routine.

Test whether controls survive contact with reality

Periodically check not whether a control is documented, but whether it works as intended when the people performing it are busy, distracted or under pressure. Walk the process. Ask the person doing the maker-checker whether they actually re-key the details or just glance and approve. This is where a static register and lived awareness diverge most sharply, and where operational losses are quietly incubating.

A risk register tells you what you thought was true at the last review. A reporting culture tells you what is true today.

What do RBI, SEBI and the Companies Act expect on operational risk?

Demonstrable, continuous risk management: regulated financial entities must show operational resilience, and company boards must show that risk management is a living process, not a document.

The direction of Indian regulation is unambiguous. The RBI's guidance on operational risk management and operational resilience expects regulated entities to move beyond documentation toward demonstrable resilience: mapping critical operations, understanding interconnections and third-party dependencies, and being able to continue delivering through disruption. For listed companies, the board's Risk Management Committee under SEBI LODR is expected to look at operational and emerging risks, not just financial ones, and to be able to show that risk management is a living process. Under the Companies Act, 2013, the board’s report must include a statement on the development and implementation of a risk management policy (section 134(3)(n)), and the audit committee must evaluate the company’s internal financial controls and risk management systems (section 177(4)(vii)).

In every one of those expectations, the load-bearing element is not the register itself. It is evidence that risk is understood and acted on by the people running the operation. That evidence comes from a trained, alert workforce and a reporting culture, not from a well-formatted spreadsheet. Operational resilience and business continuity are two sides of the same coin here; if this is a live concern, our note on why your BCP document is not a business continuity plan covers the companion failure mode.

Where should an organisation start?

An organisation does not need to rebuild its risk framework to close the gap. It needs to do three things in parallel. First, stand up a near-miss and operational-incident reporting channel that is genuinely easy and genuinely safe, and be seen to act on what comes in. Second, give the first line role-based operational risk training so people can recognise the risks embedded in their own daily work and understand why the controls exist. Third, change the cadence of the risk conversation from an annual event to a continuous one, with the register updated by the people closest to the risk rather than by the risk team in isolation.

Structured, scenario-based operational risk management training is the mechanism that makes the first two possible, and our operational risk training hub sets out the options by role. It turns an abstract framework into recognition and habit at the point of work, and it gives the board the evidence of embedded risk awareness that regulators increasingly ask to see. For the broader picture of how a trained workforce underpins every control an organisation relies on, our overview on compliance training as a competitive edge makes the wider case.

The register is not the problem. Treating it as the finish line is. Operational risk is managed on the floor, in the branch and on the night shift, or it is not managed at all.