Operational risk is commonly defined as “the risk of loss from failed or inadequate processes, people or systems or from external events”. These four categories represent the four cause categories of all operational risk.
Root cause analysis, which forms a key component of Bow Tie Analysis or Fishbone diagrams, requires the assessment of “but why” did a risk incident or event happen? We ask “but why” until the answer is “it just is” or the answer is “outside of our influence”. Where it is outside of our influence, it usually forms part of the “external” cause category. This category covers those risks that are driven by events external to our organisation.