These sound practice guidance papers are designed to assist companies implement the various components that make up a robust risk management framework as illustrated below.

The papers that have been issued to date can be found by either clicking on the relevant box below or by selecting from the list of published papers shown at the bottom of the page. This will provide a description of its contents, with access to the full papers only available to members of the IOR by logging on to the members area and then selecting the appropriate SPG paper as noted above.

Coverage of the Operational Risk Framework
EnvironmentExternal and internal
DriversBusiness strategy and objectives
(Spans the Toolkit)


Appetite / Tolerance




Loss Events Internal

Loss Events External

Risk & Control Assessment

Key Risk Indicators



Embedding Operational Risk Framework


Being Developed


  • With appropriate modification there is potential for wider application beyond Financial Services e.g. Events and near misses rather than losses or tolerance rather than appetite may be more relevant for other sectors;
  • Current coverage is subject to ongoing development. It is anticipated that other areas will be explored and added over time.

Published Papers

We are delighted to announce the publication of the revised SPG’s on Risk Culture, Risk Appetite and Embedding an Operational Risk Management Framework.

Simon Ashby, Professor of Financial Services at Vlerick Business School is the author of the new revised SPG’s he gives us an introduction in the video below.

Thanks to Sword GRC for supporting the publication of these documents.

Guide Catalogue



View ‘Risk Culture’ Guide

View ‘Operational Risk
Appetite and Tolerance’

View ‘Embedding Operational
Risk Management’ Guide

View ‘Risk and Control
Self Assessment’ Guide

View ‘Operational Risk
Categorisation’ Guide

View ‘Operational Risk
Governance’ Guide

View ‘Operational Loss
Events’ Guide

View ‘Scenario Analysis,
Stress and Reverse
Stress Testing’ Guide

View ‘Operational Key
Risk Indicators’ Guide

View ‘Operational
Resilience’ Guide

©2023 The Institute of Operational Risk. All Rights reserved Site designed and powered by Eko UK Limited

Log in with your credentials

Forgot your details?