Operational risk arises when supplier failure disrupts service delivery, revenue, or customer outcomes. This risk is often underestimated for non-technology suppliers that support critical business functions.
Common operational risk scenarios include:
- Over-reliance on a single supplier or delivery location.
- Poor visibility of supplier business continuity arrangements.
- Unclear responsibilities during service degradation or outage.
- Misalignment between service levels and business impact.
Controls that improve operational resilience:
- Supplier criticality definitions based on business impact rather than spend.
- Documented recovery expectations for critical suppliers.
- Escalation paths agreed before incidents occur.
- Periodic review of dependency assumptions as services evolve.
Operational risk management should focus on realistic failure scenarios rather than theoretical availability commitments.