The definition of operational risk by the Basel Committee on Banking Supervision is broad in conceptual terms, but also brief in its wording. If we accept that operational risk represents loss resulting from inadequate or failed internal processes, people and systems, or from external events, then to appreciate the amount of assumed exposure we must:
• specify the people, processes and systems that are responsible for operational risk events; and • estimate the frequency and impact of these events as well as assign corresponding responsibilities. I fully agree with the principle advanced by The Geneva Association that everyone is accountable for operational risk. The challenge is to identify everyone’s accountability, bearing in mind that the operational risk definition includes people, processes, systems, and whole organizations. In the last analysis, companies are made up of people.
Table 1 presents a list of what I believe to be the top dozen operational risks encountered in nearly every entity. The pattern shown in Figure 1 helps in appreciating that these operational risks can be grouped into three major categories:
• the more classical, with legal risk being one of them;
• the more modern, where the role of people is emphasized;
• those which are technology- and systems-oriented.

One more reference is needed to complete this introduction. The myriad of operational riskswhich formthe aforementioned 12 classes have neither the same frequency, nor the same impact. Therefore, when analysing operational risk for insurance coverage, aswell as for riskbased pricing of insurance contracts, it is necessary to distinguish between high frequency/ low impact (HF/LI) and low frequency/high impact (LF/HI) events.
If properly priced, insurance contracts for LF/HI operational risk events might be the more lucrative. The downside is the lack of reliable databases on the frequency of operational risks and the impact of each risk. Risk-based pricing is not an exact science. Lack of data makes contract-pricing a matter of guesswork that can end in disaster.

It might seem superfluous to explain to insurers that theirs is the science of the unlikely.
Risk coverage is usually given for improbable but possible events. Therefore, understanding the frequency and severity of a potential claim is a prerequisite to factual and documented insurance coverage.
Better understanding of risks invariably means including in our calculations extreme events, even the ‘‘impossible’’. Insurers are, from time to time, confronted with happenings that they would have qualified ex ante as impossible. The use of passenger airliners as flying bombs crashing into high towers is this sort of case. In consequence, 11 September 2001
(9/11) has led to:
• a rigorous test of insurance hypotheses and mechanisms; and
• stress testing of adequacy of reserves and of reinsurance possibilities.
One of the lessons learnt from 9/11 is the need for better understanding behind events which happen or, alternatively, which are expected but do not happen. The search for causality is inseparable from the study of the unlikely; it is also at the roots of scientific investigation.1
While personal experience is very important, it will not alone provide the panoply insurance companies need for risk-based pricing in a new domain such as operational risk coverage. Harold D. Koontz, one of my professors at UCLA, taught his students that sometimes 20 years’ experience is nothing more than one year’s experience repeated 20 times.
Can insurers transfer to operational risk a culture of scientific investigation?
‘‘I have never been confronted with sophisticated modeling on underwriters’ part in my negotiations; remember I work for assureds, not for underwriters’’, said Alain Bernard. ‘‘My experience with underwriters of all nationalities, and always of good ratings, is that people work on past experience and that’s all . . . Everything is recorded but although post mortems can be useful, they cannot provide the tools to prognosticate.’’
Insurers, however, can learn from engineering, wherewe use experimental design to gain insight and foresight about a situation with which we are confronted. As a result of our findings we obtain better understanding, and this allows us to set tolerances and limits. The latter help to appropriately define the resulting quality of our design. A similar principle is valid in underwriting.
The introduction stated that insurance is a science, but it did not say it is exact.No science needs to be exact in order to feature tolerances and limits. Insurance, and finance at large, are not exact sciences, but it needs no explanation that insurance coverage cannot go beyond the ultimate uninsurable risk, which itself is a tolerance.
• Insurance can only operate within the limits of insurability.
• These limits are defined by amount of impact, finite insurance capacity, and other critical
perimeters.