SmartSuite for the Operational Risk Manager
The Operational Risk Manager manages the risks arising from people, processes, systems and external events for a department, function or business unit. They run RCSAs, evaluate the controls that mitigate operational risk, capture loss events and coordinate remediation with the business.
What you own
The Operational Risk Manager manages the risks arising from people, processes, systems and external events for a department, function or business unit.
- Maintain the operational risk register for their business unit or function
- Run risk and control self-assessments (RCSA) with process owners
- Capture and analyze operational loss events and near misses
- Evaluate the design and effectiveness of controls that mitigate operational risk
- Monitor key risk indicators and escalate breaches
- Coordinate remediation with business teams and track closure
- Report operational risk posture to the risk function and business leadership
At a glance
The GRC processes this role owns, touches and depends on.
Owns
accountable for the process
Touches
contributes or approves
Depends on
consumes its output
How the GRC processes connect
Three lines of defense set the frame; the chain shows where each process hands off to the next. Colors follow the role: navy is owned, blue is touched, gray is depended on.
Reporting lines
Who this role reports to, who reports to them, and the peers they work with most.
Reports to
Direct reports
Works closely with
How SmartSuite supports this role
Lead
Risk management. Provides department-level dashboards and automated reviews for localized risk review, with the unit's risks linked to the enterprise register.
Compliance management. Runs RCSA cycles with scored controls and evidence so control evaluation is structured and repeatable.
Operational resilience. Links operational risks to the business services and continuity plans they threaten.
Issues and actions. Coordinates remediation with business teams through assigned tasks, due dates and closure validation.
Reporting. Produces business-unit risk reports and KRI trends for the risk function and local leadership.
Products this role uses most
Industry reference
The Basel Committee's Principles for the Sound Management of Operational Risk (2021) define the discipline: risk and control self-assessments, loss event collection, key risk indicators and a three-lines structure. The Basel III standardized approach ties operational risk capital to loss history, which makes the loss database a regulated record. COSO ERM supplies the enterprise view.
Outside banking the same tools apply without the capital charge. Insurers model operational risk under Solvency II; healthcare providers track patient-safety and operational events through accreditation standards; public bodies use OMB Circular A-123; technology firms manage ICT operational risk under DORA when they serve EU financial entities.
Related roles
Explore Further
Guides and definitions from the GRC Knowledge Center and the What-is glossary, chosen for this role.
Frequently asked questions
What is the Operational Risk Manager accountable for?
The Operational Risk Manager manages the risks arising from people, processes, systems and external events for a department, function or business unit. They maintain the unit's operational risk register, run risk and control self-assessments with process owners, capture and analyze loss events and near misses, evaluate the controls that mitigate operational risk, monitor key risk indicators and escalate breaches, coordinate remediation with the business and report operational risk posture to the risk function and local leadership.
How does SmartSuite help an Operational Risk Manager review risk at department level?
SmartSuite provides department-level dashboards and automated reviews for localized risk review, with the unit's risks linked to the enterprise register in Enterprise Risk Management (ERM). The Operational Risk Manager works in a view of their own unit's risks, reviews run on a schedule rather than when someone remembers, and a change to a unit risk is visible to the Enterprise Risk Director without a separate upload. Incident Management captures the loss events and near misses that feed the register.
How does SmartSuite run RCSA cycles with process owners?
Risk and Control Self-Assessment (RCSA) runs RCSA cycles with scored controls and evidence, so control evaluation is structured and repeatable. Each cycle asks the Control Owner to score the controls that mitigate their risks and attach the evidence, the Operational Risk Manager reviews the scores against the register, and the results compare period to period. The Internal Controls Manager sees the same control scores, so the self-assessment and the controls view agree.
How are operational risks linked to continuity plans and remediation?
Operational risks are linked to the business services and continuity plans they threaten, so a risk to a process shows which services depend on it and which plan would be invoked. Business Impact Analysis (BIA) supplies the service view, and the Business Continuity Manager sees the same link from the resilience side. Remediation is coordinated with business teams through assigned tasks, due dates and closure validation in Issues Management, so a risk that needs a fix becomes tracked work.
How does this role report to the risk function and local leadership?
SmartSuite produces business-unit risk reports and KRI trends for the risk function and local leadership from the register, RCSA results and loss events as they stand. The Operational Risk Manager can show the Enterprise Risk Director or Chief Risk Officer the unit's top risks, which KRIs have breached and what remediation is open, and give the Chief Operating Officer the same view for the business. The Risk Analyst maintains the data the report reads.
What does a business unit need to get started with operational risk in SmartSuite?
A business unit needs its current risk register, the list of controls that mitigate those risks with their owners and any loss event history it holds. New customers can start with SmartSuite Onboarding, a guided four-week program around one or two priority workflows; for a business unit the first workflow is the RCSA cycle, which sets the baseline. Loss events are logged as they occur and KRIs are added where the unit already measures them, with the enterprise link in place from the start.
How does SmartSuite fit the Basel model of operational risk management?
The Basel Committee's principles describe the tools the Operational Risk Manager uses: risk and control self-assessments, loss event collection, key risk indicators and a three-lines structure, and those are the records SmartSuite holds. The loss event history matters because the Basel III standardized approach ties capital to it, which makes the database a regulated record; outside banking the same tools apply without the capital charge, from Solvency II to OMB Circular A-123 and DORA.
See SmartSuite for your role
Start a free trial, or book a demo and we will walk through your role's workflows in SmartSuite.