Introduction
Operational risk used to live in the back office. Today it sits at the intersection of technology, regulation, and people, and a single control failure can cascade into regulatory sanctions, capital hits, and reputational damage that takes years to repair.
The numbers make this concrete. The FBI's 2024 IC3 report documents cyber-enabled losses exceeding $16 billion across U.S. institutions — a 33% year-over-year increase. Globally, the EBA's 2025 EU-wide stress test projects €54.8 billion in operational risk losses across 64 European banks under the adverse scenario, a 61 basis-point CET1 capital impact. The trend is consistent: operational risk losses are accelerating.
Meanwhile, banks are struggling to find qualified professionals to manage these risks. Three significant regulatory developments — Basel's December 2025 third-party risk principles, the OCC's updated heightened standards guidance, and new Federal Reserve operational resilience expectations — landed within a compressed window. The skill sets required to implement them are in short supply.
That gap between regulatory demand and available talent is what this article addresses — what modern ORM requires in 2026 and how banks can hire the professionals to execute it.
TL;DR
- Operational risk covers losses from failed people, processes, systems, and external events — now expanded to include DORA compliance, AI governance, and third-party risk rules.
- The 5-step ORM cycle (identify, assess, mitigate, implement controls, monitor) remains the core framework, now layered with continuous KRI monitoring.
- 44% of banks cite talent and skills shortages as the top barrier to effective AI risk management, per Deloitte's 2025 EMEA survey.
- The roles most in demand: Operational Risk Managers, Third-Party Risk Specialists, Model Risk Analysts, and Compliance Officers with ORM scope.
- Specialized recruiters fill these roles faster — and with stronger candidate fit — than generalist firms or internal sourcing alone.
What Is Operational Risk Management in Banking — and Why 2026 Is Different
The Core Definition
ORM is the systematic process of identifying, assessing, mitigating, and monitoring losses arising from four sources:
- People — human error, internal fraud, training gaps (example: a loan officer bypassing approval controls)
- Processes — workflow failures, control breakdowns (example: a payment processing error that credits the wrong account)
- Systems — IT failures, cyberattacks, software outages (example: a core banking platform outage that locks out ATMs)
- External Events — natural disasters, vendor failures, regulatory changes (example: a cloud provider outage disrupting mobile banking)
ORM explicitly excludes strategic, financial, and market risk — the domain of Enterprise Risk Management (ERM). The distinction matters for staffing: ORM professionals need different skills than credit or market risk analysts.
What Changed in 2026
Three major regulatory deadlines converged in rapid succession:
| Regulation | Effective Date | Primary Requirement |
|---|---|---|
| EU DORA | January 17, 2025 | ICT risk integrated into ORM; incident reporting; third-party ICT oversight |
| UK PRA SS1/21 | March 31, 2025 | Impact tolerances for important business services; full implementation required |
| Basel Third-Party Risk Principles | December 10, 2025 | Continuous vendor oversight; concentration risk monitoring (12 principles) |
For U.S. banks with EU or UK exposure, these three regimes now overlap simultaneously. Managing all three at once is a staffing problem as much as a compliance one — it requires headcount with multi-jurisdiction knowledge that most existing teams don't have.
AI and Model Risk as a New ORM Category
AI has created a risk category that barely existed five years ago: model bias, model drift, and unintended automated decisions. The EU AI Act's Annex III provisions apply to high-risk AI systems — including credit scoring, fraud detection, and creditworthiness assessment tools — from August 2, 2026.
The governance gap is measurable. Deloitte's 2025 EMEA Model Risk Management Survey found:
- 78% of banks now deploy AI/ML models
- Only 23% have fully mature AI model governance
The Fed, OCC, and FDIC widened this pressure point further by jointly issuing revised model risk management guidance on April 17, 2026, superseding SR 11-7 with expanded AI/ML provisions.
Traditional vs. Modern ORM
| Traditional ORM | Modern ORM |
|---|---|
| Manual spreadsheet-based reviews | Integrated GRC platforms with real-time dashboards |
| Post-incident analysis | Continuous KRI monitoring with escalation triggers |
| Annual RCSA cycles | Ongoing control testing and automated alerting |
| Siloed risk reporting | Board-level risk dashboards with KRI thresholds |
The skills that made someone effective in traditional ORM — manual review, periodic reporting, siloed ownership — are largely insufficient for modern programs. Banks hiring for ORM in 2026 are looking for professionals who can operate GRC platforms, interpret model outputs, and navigate cross-border regulatory obligations at the same time.
The Top Operational Risks Banks Face in 2026
Cybersecurity and Technology Risk
Banks are high-value targets: vast data stores, 24/7 digital operations, and deep dependencies on third-party cloud infrastructure. According to the Verizon 2025 Data Breach Investigations Report, system intrusion surged to 53% of financial services breach patterns (up from 36% in the prior year), while the human element remains involved in approximately 60% of breaches.
Threat types banks must actively manage:
- Phishing and business email compromise
- Ransomware targeting core banking systems
- Distributed denial-of-service attacks
- Advanced persistent threats targeting payment infrastructure
NYDFS Cybersecurity Regulation and similar state-level rules impose specific technical and governance obligations on top of federal requirements.
Fraud and Financial Crimes
Generative AI has expanded the fraud attack surface significantly. The FBI's December 2024 Public Service Announcement warned explicitly that criminals are using AI-generated text, deepfake audio, and synthetic identities to facilitate financial fraud. Customers increasingly cannot distinguish legitimate bank communications from AI-generated scams.
Internal misconduct remains a persistent loss category. Unauthorized trading and approval bypasses fall under Basel Category 1 (Internal Fraud) — and enforcement confirms the consequences. FinCEN assessed a record $1.3 billion penalty against TD Bank in October 2024 for BSA/AML failures, the largest depository institution penalty in U.S. Treasury history.
Third-Party and Vendor Risk
Third-party involvement in financial services breaches has doubled to 30% year-over-year per Verizon's 2025 DBIR. Basel's December 2025 principles (BCBS d605) now require:
- Continuous oversight of all third-party arrangements (not just traditional outsourcing)
- Concentration risk identification when dependence on a single vendor creates systemic exposure
- Documented business continuity and exit strategies for critical arrangements
A single cloud provider outage can simultaneously disable mobile banking, ATMs, and back-office processing — concentration risk that most banks underestimated until recently.
Regulatory Compliance and Process Risk
The regulatory surface keeps expanding: AML, BSA, Basel Accords, DORA, NIST CSF 2.0, state-level rules, and now the EU AI Act. Non-compliance costs dwarf ORM program investment. Beyond TD Bank, the FCA fined Monzo approximately £21 million in 2025 for inadequate anti-financial crime systems.
Process execution failures are a separate — and often underestimated — exposure category:
- Payment errors and data entry mistakes generate direct financial losses
- Workflow gaps drive customer churn that compounds over quarters
- Control weaknesses surface in loss event databases months after the original failure
These incidents rarely trigger headlines. They show up in audit findings and ORM dashboards, and by then the cost of remediation typically exceeds what a functioning control would have cost to maintain.
How Banks Manage Operational Risk: The 5-Step ORM Framework
The Five Steps
- Risk Identification — Process mapping, loss data review, and scenario workshops to surface potential failure points across people, processes, systems, and external events.
- Risk Assessment — Rate each identified risk by likelihood and impact; document in a risk register with named owners and inherent/residual risk ratings.
- Risk Mitigation — Choose a response strategy for each risk: transfer (insurance), avoid (exit the activity), accept (within appetite), or mitigate (implement controls).
- Control Implementation — Design preventive controls first (stopping losses before they occur), then detective controls (identifying losses when they do). Document each control formally, with assigned owners and recurring test schedules.
- Monitoring — Track KRIs continuously with defined thresholds. When a KRI breaches a threshold, escalation triggers should activate automatically — not wait for a quarterly review.
The Three Lines of Defense
The Basel Committee explicitly endorses a three-lines structure for ORM governance:
- First Line — Business units own and manage their operational risks day-to-day
- Second Line — The independent ORM function (CORF) sets policy, monitors, and challenges
- Third Line — Internal Audit provides independent assurance that controls are working
This model only functions when each line is properly staffed. An understaffed second line cannot effectively challenge the first line, and an overstretched internal audit function cannot provide genuine independence. In practice, governance gaps in this model almost always trace back to staffing gaps — not policy failures.
The RCSA as the ORM Starting Point
The Risk and Control Self-Assessment is where most bank ORM programs begin each cycle. Business units evaluate their own processes and rate the effectiveness of existing controls — creating the risk register that drives assessment, mitigation decisions, and monitoring priorities.
The Basel Committee identifies four primary ORM tools that a well-run RCSA should feed into:
- Loss event data — historical internal loss records that reveal where controls have already failed
- Scenario analysis — structured exercises that stress-test low-frequency, high-impact events
- Business environment indicators — external signals (regulatory changes, market stress) that shift risk exposure
- RCSA outputs — the self-assessed control ratings that anchor the risk register
When the RCSA process is under-resourced, self-assessments skew optimistic — and the second and third lines rarely have the bandwidth to catch it.
The ORM Talent Gap: Why the Right People Make or Break Your Program
The Evidence for a Real Shortage
The Deloitte 2025 EMEA survey of 87 banks found that 44% cite talent and skills shortages as the top barrier to effective AI risk management. This is specific to one ORM sub-domain — model and AI risk — but the pattern generalizes. Multiple industry sources consistently flag severe shortages in ICT risk, model validation, and AI governance roles within bank ORM teams.
The consequences of understaffed ORM teams are concrete:
- RCSAs get delayed or superficially completed
- KRI breaches go unnoticed until after the threshold has been exceeded for weeks
- Continuous monitoring requirements under DORA and Basel III become aspirational rather than operational
- Third-party oversight programs exist on paper but not in practice
- High turnover creates institutional knowledge loss that takes months to rebuild
Why ORM Hiring Is Harder Than General Finance Recruiting
The required skill set has expanded well beyond traditional risk backgrounds. Banks now need candidates who combine:
- ICT risk and DORA compliance knowledge
- AI governance and model validation experience
- Multi-jurisdiction regulatory fluency (Basel, NIST CSF, EU AI Act, AML/BSA)
- Hands-on GRC platform experience
- The ability to communicate technical risk findings to boards and business unit leaders
Candidates who bridge quantitative risk assessment and regulatory interpretation are scarce. Broad-based generalist recruiters typically lack the market relationships and screening depth to identify them; their pipelines are built for volume, not regulated-function precision.
Firms like Wayoh, which specialize in compliance, risk, and legal hiring for U.S. banking markets, maintain active networks of pre-qualified candidates in these disciplines. Working from established relationships rather than keyword searches, shortlist timelines for hard-to-fill ORM roles compress faster than going to market cold. Wayoh also supports interim placements for ORM functions, which is useful when a bank needs coverage during a permanent search, a remediation project, or a regulatory deadline.
Hiring ORM Professionals in 2026: Roles, Skills, and What to Look For
Key Roles in Demand
| Role | Core Responsibility | Why It's Urgent in 2026 |
|---|---|---|
| Operational Risk Manager | Owns RCSA, loss event tracking, risk reporting | Central to every ORM program; hardest to backfill |
| Third-Party / Vendor Risk Specialist | Ongoing vendor oversight per Basel d605 and DORA | Third-party breach involvement doubled to 30% |
| Model Risk Analyst | AI and quantitative model validation | Joint U.S. guidance (April 2026) + EU AI Act deadline |
| Compliance Officer (ORM scope) | Bridges regulatory obligations and internal control design | Regulatory volume at record levels |
| CRO / VP of Operational Risk | Sets risk appetite; leads board-level reporting | Senior ORM leadership gaps at mid-size banks |
Related roles Wayoh regularly places — BSA Officers, Chief Compliance Officers, AML specialists, Enterprise Risk Managers, and internal audit leads — round out the three-lines structure that effective ORM programs depend on.
What to Look For in Candidates
Start with regulatory fluency and hands-on program experience:
- Regulatory knowledge: Basel Accords, DORA, AML/BSA, NIST CSF, and now the EU AI Act
- Demonstrated RCSA design and KRI framework experience (not just participation)
- Ability to translate risk findings for non-technical stakeholders and board members
- GRC platform experience (hands-on, not just familiarity)
Certifications — FRM, CRISC, CRCM — are useful signals but not substitutes for demonstrated program-building experience. A candidate who built a vendor risk program from scratch will outperform one who only participated in it, regardless of credentials.
Technical skills are table stakes. The behavioral indicators that separate good hires from great ones are harder to screen on paper:
- Proactively surfaces issues rather than waiting to be directed
- Comfortable operating within a three-lines structure and escalating appropriately
- Can hold a productive conversation with both a CTO and a business line manager about the same control gap
Wayoh screens for these dimensions through direct conversations and reference checks, not just credential review, when matching candidates to banking clients.
Frequently Asked Questions
How do banks manage operational risk?
Banks use a continuous cycle of risk identification, assessment, mitigation, control implementation, and monitoring — governed through a Three Lines of Defense structure. The RCSA process and KRI dashboards drive day-to-day oversight, with escalation to senior management and the board when thresholds are breached.
What is the operational risk management framework for banks?
A bank's ORM framework includes a risk taxonomy, RCSA program, loss event database, KRI monitoring system, scenario analysis process, and structured reporting to senior management and the board. All components should align to Basel Committee principles and applicable regulatory regimes such as DORA or Basel III.
What are the 5 steps of operational risk management?
The five steps are:
- Risk identification
- Risk assessment
- Risk mitigation (transfer, avoid, accept, or mitigate)
- Control implementation
- Ongoing monitoring
Mature programs add continuous KRI tracking with automated alerting and scenario analysis to stress-test controls before incidents occur.
What are the top operational risks for banks?
The primary categories are cybersecurity threats, internal and external fraud, third-party and vendor failures, regulatory non-compliance, and process/system execution failures. AI and model risk has emerged as a sixth major category in 2026, as banks scale AI deployments and regulators tighten governance requirements around model oversight.
What is the risk management policy of a bank?
A bank's risk management policy defines its risk appetite, the scope of risks covered, governance structure with named roles and accountabilities, approved mitigation strategies, and reporting obligations. The board typically reviews and approves the policy annually, with updates triggered by material regulatory changes.
Is legal part of risk management?
Legal risk overlaps directly with operational and compliance risk. Under Basel definitions, exposure to litigation, regulatory sanctions, and contract failures are all operational risk sub-categories. Most banks embed legal and compliance functions within or alongside their ORM teams for this reason.
