1 1
£40.89 GBP
£40.89 GBP
Sale Sold out
Free UK Shipping

Freshly Printed - allow 7 days lead

Managing Operational Risk in a Changing World

"Penny Cagan has written the operational risk book the industry has been waiting for: authoritative, experience-rich, and unflinchingly relevant. Drawing on nearly four decades in the field, she brings a rare combination of clarity, judgment and lived insight to a discipline that is evolving faster than ever. Whether she is unpacking the complexities of RCSA design and execution or setting today’s challenges against the backdrop of pandemics, climate shocks and geopolitical instability, Penny shows practitioners not just what operational risk is, but how to manage it in the real world.

What sets this book apart is Penny’s voice: practical, calm, and deeply informed. She bridges frameworks with reality, data with judgment, and emerging risks with the human behaviors that sit beneath them. My own assessment of this manuscript is simple — there is nothing else on the market that blends technical depth, contemporary relevance, and practitioner wisdom in the way Penny has achieved here.

For operational risk professionals, regulators, students, and senior leaders, this is essential reading. Penny has captured the past, present, and future of the discipline in a way that is both accessible and profound. This book will elevate how firms think about risk — and how they prepare for the world that is coming." — Lewis O’Sullivan, Publishing Consultant; Former Publisher, Risk Books

“Penny Cagan has been an early pioneer and recognized thought leader in operational risk management. Over four decades, she has made significant contributions in the field of risk management in executive, consulting, and academic roles. With this new book, Penny is once again defining how companies can effectively manage the many facets of operational risk. In the current age of disruption, her wisdom and guidance are more important than ever.” — James Lam, President, James Lam & Associates, Author of Enterprise Risk Management and Implementing Enterprise Risk Management

“I’ve been enjoying Penny’s writings on Operational Risk for 20+ years. In this book she provides a refreshingly personal & practical view of Operational Risk management, reflecting her decades of hands-on experience.” — Michael Grimwade, Managing Director Operational Risk, ICBC Standard Bank.

"The operational risk case studies and lessons you will learn about in this book and the frameworks you will gain to address them have never been more pertinent.  What a valuable time to read this book. If you want to up your measurement and management of operational risk, read this book." — Tanya Beder, Chairman & CEO, SBCC Group Inc.

"I have known Penny for many years, and have been delighted to have her as one of our Industry Advisors, engaging with our global COO community. She has a wonderful intellectual inquisitiveness and a considered, thoughtful approach. This has been hugely beneficial to our membership, who have gained valuable insights from Penny’s contributions on many complex subjects. This book provides a very useful insight and is a valuable resource for those seeking to delve deeper into and understand the key challenges within operational risk today." — Maurice Evlyn-Bufton, CEO, Armstrong-Wolfe

"Penny Cagan is a thought leader on operational risk management. She made her first mark in the space over 20 years ago as she transformed and upgraded our fledgling first “external database” of global operational risk events into an indispensable industry-leading risk management tool. Since then, her many corporate operational risk roles and experiences have broaden her perspectives and views on the subject, further confirming her place as a force for continued advancement of the discipline. Now she has gathered those experiences and lessons learned -- both broad and detailed – and penned a formidable new book, which is destined to take its place as a masterclass on the subject." — Douglas G. Hoffman, Author of Managing Operational Risk

"Penny Cagan has created the Bible in best practices for people managing Operational Risk (OR) in financial institutions. Penny covers both the history of managing OR with a look to the future in evolving approaches to managing OR, as well as the new risks on the horizon, such as AI. Both new entrants and seasoned professionals in the field will find Penny’s insights invaluable." —Dan Mudge, former president Netrisk, fomer head of risk management at Bankers Trust, Managing Director, Promontory

“In these times of heightened uncertainty throughout the world, this thoughtful book is relevant to readers from students to CEOs who are seeking to manage organizations in a more thoughtful way." — Charles A Fishkin, Author, board member, adviser, and former risk director at the US Securities and Exchange Commission

Penny Cagan (Author)

9781394421619, Wiley

Hardback, published 21 April 2026

352 pages
25.6 x 18.5 x 3 cm, 0.68 kg

Practitioner manual to operational risk blending contemporary challenges with case studies 

Managing Operational Risk in a Changing World is both a practitioner's manual and a classroom text that blends nearly 40 years of frontline experience with emerging themes that define today's risk landscape, from climate change and ESG to AI, DE&I, cyber threats, and pandemics. Unlike existing titles that focus on defining operational risk or recounting its history, this book is organized around contemporary challenges, showing how frameworks and methodologies can be applied in practice.  

The book contains interviews with industry veterans, from Barings to Silicon Valley Bank, who share their perspective and strategy for managing operational risk. In Managing Operational Risk in a Changing World, readers will find insights on: 

  • Recent regulations focused on managing emerging risks, such as the Digital Operational Resilience Act (DORA) 
  • Firewalls, intrusion detection systems, and encryption as critical elements in a robust approach to cyber risk management 
  • Data governance and data controls—checking and cleaning up erroneous data, and performing independent reviews 
  • Operational risks associated with geopolitical events, including people, processes, technology, and external factors 

The operational risk discipline is in flux, with regulators raising expectations and new risks constantly surfacing. Managing Operational Risk in a Changing World is required reading for all OpRisk professionals, academics, and students seeking to stay ahead of the curve. 

Acknowledgments xiii

Introduction to Operational Risk Book 1

Operational Risk at a Crossroads 1

Chapter 1

The History and Importance of Operational Risk 3
The Definition of Operational Risk 3
The Impact of the Barings PLC Unauthorized Trading Event 5
The Introduction of Basel II and Operational Risk Capital Adequacy 5
The Language of Operational Risk 8
Basel III Endgame 9
Significant Unauthorized Trading Events 11

Chapter 2

Managing Operational Risk in the New World Order 19
Managing Through the Great Challenges of Our Time 19
Managing Operational Risks Associated with Geopolitical Events 21
Communicating Operational Risks 27
Interview with Industry Veteran on Managing Operational Risk and Compliance: Mike Silva 28

Chapter 3

Building the Team for Today and Tomorrow Across the Lines of Defense 33
Managing Operational Risk Across the Lines of Defense 33
General vs. Specialist Roles 36
The Composition of Operational Risk Teams 37
Interview with Industry Veteran on First-Line Risk Management: Aarona Chou 38

Chapter 4

Making It Real: Developing a Framework for the Real World 43
The Operational Risk Framework Is Only as Effective as Its Implementation 44
Elements of the Framework 46
Governance 46
Policies and Procedures 47
Risk Appetite 48
Key Risk Indicators 49
Loss Data 50
Risk and Control Assessment 51
Scenario Analysis 52
Issue Management 53
Monitoring and Reporting 54
Culture and Awareness 55

Chapter 5

Managing Operational risk appetite and Key Risk Indicators 59
Definitions 60
Considerations When Managing Risk Appetite 60
Risk Appetite Framework 62
Integration with Operational Risk Program Components 66
Key Risk Indicators 67

Chapter 6

Developing and Deploying Risk Assessments 73
Risk and Control Self-Assessment Overview 73
Governance: Defined Roles and Responsibilities 75
Communication Plan 78
Leveling Up: Determining Risk Assessment Units 79
The Perspective: Top Down and Bottom Up 81
Technology Enablement 84
Methodology: Rating Risks and Controls 86
Process Mapping 93
The Trigger-based Approach 94
Remediation 96
Reporting on the Results 98

Chapter 7

Internal and External Loss Data 103
Types of Loss Data 105
Roles and Responsibilities 106
Framework and Methodology 107
Internal Loss Data 108
Stage 1: Identify 109
Stage 2: Assess 113
Stage 3: Mitigate 116
Stage 4: Monitor 116
Stage 5: Report 117
External Data 118
Citibank Revlon Bond Case Study 120

Chapter 8

Setting Up the Guardrails: Operational Risk Governance 123
Risk Culture 124
Training 127
Conduct Risk 127
Policies and Frameworks 131
Governance 134
Risk Committees 135
Interview with Industry Veteran: Maureen Day 138
Wells Fargo Pays USD $7.57 Billion in Penalties and Redress Over Retail Customer Violations 141

Chapter 9

The Fourth Line: Managing Regulatory Risks 151
The Regulatory Climate 151
Managing Regulatory Relationships 155
Tracking Regulatory Changes 158
Regulatory Expectations 159
The Four Lines of Defense Model 160
Seeking Help 161
Confidential Supervisory Information 162
Interview with Industry Veteran on Managing Regulatory Risk: Tom Balogh 164

Chapter 10

It Could Happen Here: On Developing Scenarios 169
The Scenario Program 172
The Scenario Framework 172
Governance and Framework 172
Preparation 175
Facilitation 176
Scenario Workshop 178
Reporting and Alignment 179
Scenario Examples 182
Interview with Industry Veteran on the Use of Scenarios: Evan Sekeris 184

Chapter 11

Know Your Process: Managing Execution Risks 191
Managing Through the Operational Risk Framework 194
Governance 195
Policies and Procedures 195
Risk Appetite and Key Risk Indicators 196
Loss Data, Incidents, Escalations, and Issue Management 198
Risk and Control Assessment 199
Scenario Analysis 202
Monitoring and Reporting 204
Culture and Awareness 204
Payments 205
Boeing Case Study 206
Citigroup Fat Finger Case Study Courtesy of IBM 209

Chapter 12

Managing Change, and Product and Service Risk 215
Change Management 215
Lifecycle 218
Change Initiative Risk Assessment 221
Roles and Responsibilities 223
Waterfall vs. Agile 223
Success Criteria 224
Products and Services Change Initiatives 225
U.S. Regulatory Guidance 227

Chapter 13

Managing Data Risk, AI, and Machine Learning 235
Data Risk Management Framework 237
Governance and Policies and Procedures 240
Risk Appetite and Key Risk Indicators 241
Loss Data 242
Risk and Control Assessments and Maturity Assessment 243
Scenario Analysis 244
Monitoring and Reporting 246
Cultural Awareness 246
AI and Machine Learning 246
Data Is Foundational to AI and Machine Learning 248
AI-Specific Operational Risks 249
Using AI to Manage Risk 250
Interview with Industry Veteran on Data and Machine Learning: Jae Kang 252

Chapter 14

Managing Cyber Risk 257
A Tale of Two Attacks 258
Cyber Frameworks 259
Aligning NIST to an Operational Risk Framework 267
Strong Cyber Practices 270
Interview with Industry Veteran: Alicja Cade 271
United Healthcare Case Study Courtesy of IBM 276

Chapter 15

Managing Third-Party Risk 281
Third-Party Risk Management Framework 282
Planning (Including Governance) 283
Due Diligence and Third-Party Selection 286
Contract Negotiation 288
Ongoing Monitoring 289
Termination 290
Interview with Industry Veteran: Jeannie Pumphrey 293

Chapter 16

Managing Fraud 297
Managing Internal and External Fraud 298
Fraud Risk Management Frameworks 301
JPMorgan London Whale Case from O.R.X: An Example of internal Fraud 308
Garda World Robbery Case Study from ORX. Example of an External Fraud 312

Chapter 17

Managing Business Resilience  317
Resilence Framework  319
Managing Claimate Risk  326

Index   331

Subject Areas: Business & management [KJ]
View full details