Operational risk management (ORM) is the practice of identifying, measuring, and controlling the risk that a process, person, or system will fail to perform as expected. Here’s the insight most ORM explanations miss entirely: variation is the mathematical proxy for operational risk. The more a process output swings away from its expected value, the more operational risk that process carries.
That’s exactly why Six Sigma, a methodology built to reduce variation, fits so naturally into ORM work. Raising a process’s sigma level doesn’t just improve quality. It directly lowers the operational risk sitting underneath it. Two Six Sigma tools do most of the heavy lifting here: FMEA for identifying and prioritizing risk before it happens, and control charts for catching risk as it emerges in real time.
Quick-Reference Table: ORM Concepts at a Glance
| Concept | What It Means |
| Operational risk | The chance a process, system, or person fails to perform as expected |
| Variation | The mathematical proxy for operational risk: more variation, more risk |
| Sigma level | A measure of how far a process sits from its nearest failure point |
| FMEA | A tool for identifying and ranking risks before they occur |
| Control chart | A tool for monitoring a process in real time to catch risk as it develops |
Table of contents
Key Takeaways
- Variation and operational risk are the same mathematical concept, described by two different industries. Reducing variation reduces risk, directly and measurably.
- The Basel Committee has recommended Six Sigma as a best practice for managing operational risk in banking, which tells you this connection isn’t theoretical. Regulators have already formalized it.
- FMEA identifies risk before it happens. Control charts catch it as it’s happening. A complete ORM system needs both, not just one.
- Most operational risk programs stop at measurement and capital provisioning. The Six Sigma lens pushes ORM further, into an actual control-and-improve cycle, not just a quantification exercise.
- Raising a process’s sigma level is a direct risk reduction action, not a separate quality initiative running in parallel with risk management.
- A risk register without a reduction plan is just a list. The whole point of identifying a risk is building the next step: a mitigation action tied to a measurable owner.
What is Operational Risk Management?
Operational risk management is the discipline of identifying, measuring, and reducing the risk that comes from how an organization actually runs, as opposed to financial risk, market risk, or credit risk.
It covers things like process failures, system outages, human error, and control breakdowns. If a wire transfer goes to the wrong account because someone fat-fingered a digit, that’s operational risk. If a manufacturing line ships a defective batch because a sensor drifted out of calibration, same thing.
Here’s where most explanations of ORM stop short. They treat it as a measurement and reporting exercise: identify the risks, assign them a score, set aside capital to cover potential losses, and move on. That’s compliance. It’s not management. Real operational risk management asks a harder question: how do we actually reduce this risk, not just account for it?
Public, Onsite, Virtual, and Online Six Sigma Certification Training!
- We are accredited by the IASSC.
- Live Public Training at 52 Sites.
- Live Virtual Training.
- Onsite Training (at your organization).
- Interactive Online (self-paced) training,
The Core Insight: Variation Is the Proxy for Operational Risk
This is the single most useful idea in this entire topic, and it’s the one most ORM content never states directly. Operational risk, at its mathematical core, is the standard deviation of a process’s actual performance from its expected performance. That’s not a metaphor. That’s the definition.
Six Sigma was built around exactly this same measurement. A process running at a higher sigma level sits further from its nearest failure point, meaning less of its output strays into unacceptable territory. Raise the sigma level, and you have directly reduced operational risk, using the exact same math a risk manager would use to calculate it.
Think about why this matters practically. A bank calculating operational risk capital and a Six Sigma Black Belt calculating process capability are running the same calculation with different vocabulary. One calls it “risk exposure.” The other calls it “defects per million opportunities.” They’re describing the same variance.
Also Read: What is Strategic Risk Management? Why It Matters?
Why Few Organizations Have Actually Connected the Two
Despite this overlap, surprisingly few organizations formally integrate their Six Sigma program with their risk management framework. Part of the reason is organizational, not mathematical. Risk departments tend to report through a compliance and finance lens, focused on identifying and quantifying exposure for capital and audit purposes. Six Sigma teams tend to report through an operations lens, focused on reducing defects and improving throughput.
These two functions are solving the same underlying problem from opposite ends of the building, and they rarely compare notes. The Basel Committee has recognized this gap specifically in banking, recommending Six Sigma as a best practice for managing operational risk, precisely because its tools quantify and reduce the exact variation that drives operational loss events.
The Two Core Six Sigma Tools for Operational Risk
Two tools do most of the real work in a Six Sigma-driven ORM approach, and they cover two different moments in a risk’s lifecycle.
FMEA: Catching Risk Before It Happens
Failure Modes and Effects Analysis (FMEA) identifies every way a process could fail, before any of those failures actually occur. For each potential failure, a team scores three factors:
- Severity, how bad the impact would be if it happened
- Occurrence, how likely it is to happen
- Detection, how likely you are to catch it before it causes damage
Multiply those three scores together, and you get a Risk Priority Number (RPN). This single number tells a team exactly which risks deserve attention first, replacing a gut-feeling risk list with a ranked, defensible priority order.
Control Charts: Catching Risk as It Develops
A control chart monitors a process in real time, flagging the moment it starts drifting outside its normal range of variation. This is the real-time counterpart to FMEA’s upfront analysis. FMEA tells you what could go wrong before launch. A control chart tells you the instant something is starting to go wrong in production.
Together, these two tools cover the full risk lifecycle. FMEA handles prevention at the design stage. Control charts handle early detection once the process is live.
How FMEA and ERM Connect: Mapping the Eight Components
Enterprise risk management (ERM) frameworks typically break risk management into eight components: internal environment, objective setting, event identification, risk assessment, risk response, control activities, information and communication, and monitoring. Here’s the thing: Six Sigma tools map directly onto nearly every one of these components, which is exactly why the two disciplines fit together so cleanly.
| ERM Component | Matching Six Sigma Tool or Concept |
| Event identification | FMEA, process mapping |
| Risk assessment | RPN scoring, statistical analysis |
| Risk response | DMAIC’s Improve phase |
| Control activities | Standard work, process ownership |
| Monitoring | Control charts, ongoing capability studies |
This isn’t a loose analogy. It’s a structural overlap. An organization running Six Sigma projects is already doing ERM work, just without labeling it that way.
Also Read: Biggest Risks Six Sigma Faces Without a Governing Body
A Step-by-Step ORM Framework Using DMAIC
- Define the risk scope. Name the specific process or system under review, and the specific failure types you’re worried about. “Payment processing errors,” not “things that could go wrong.”
- Measure current variation. Pull real performance data. How often does the failure actually occur today? What’s the current defect or error rate?
- Analyze root causes using FMEA. Score each potential failure mode for severity, occurrence, and detection. Rank them by RPN, and focus on the highest-scoring risks first.
- Improve by reducing the top-ranked risks. Redesign the step causing the highest RPN score. This might mean adding a control, mistake-proofing a step, or removing a manual handoff entirely.
- Control with a monitoring system. Install a control chart or equivalent tracking mechanism on the improved process, so any future drift gets caught early, not discovered after a loss event.
A Worked Example: Reducing Operational Risk in Loan Processing
A regional bank’s loan processing team is seeing an increase in compliance exceptions, cases where required documentation wasn’t properly verified before a loan closed.
Define: The risk is incomplete documentation verification before loan closing, specifically on the income verification step.
Measure: Current data shows a 6% exception rate on income verification, against an internal target of under 1%.
Analyze with FMEA: The team scores several failure modes. “Verifier skips a step under time pressure” scores highest, with high occurrence and low detection, since nothing currently catches a skipped step until a post-closing audit finds it.
Improve: The team adds a mandatory digital checklist that won’t let the loan file move to the next stage until every verification field is completed, removing reliance on memory under time pressure.
Control: A weekly tracking chart monitors the exception rate going forward, flagging any week where it climbs back above 2%, well before it reaches the original 6% level.
This is operational risk management functioning as an actual reduction system, not just a quarterly report listing the exception rate as a known risk.
Common Mistakes Organizations Make With Operational Risk Management
- Treating ORM as a quantification exercise instead of a reduction system. Measuring and reporting a risk isn’t the same as reducing it. A risk register that never connects to an improvement action is just a very detailed list of problems nobody is fixing.
- Running risk management and process improvement as separate departments with no shared data. When the same variation data feeds both a risk report and a Six Sigma project, the organization gets a much clearer, faster signal than when each team works from its own disconnected numbers.
- Scoring FMEA risks once and never updating them. A risk priority number from two years ago, on a process that has since changed, tells you almost nothing useful today.
- Relying entirely on detection instead of prevention. A control chart that catches drift after it starts is valuable, but it’s still reacting. The FMEA step, done properly upfront, prevents some of these risks from ever reaching the monitoring stage at all.
Frequently Asked Questions on Operational Risk Management
What is operational risk management?
Operational risk management is the practice of identifying, measuring, and reducing the risk that a process, system, or person will fail to perform as expected, covering things like process failures, human error, and control breakdowns.
How is operational risk connected to variation?
Operational risk is mathematically the standard deviation of a process’s actual performance from its expected performance, which is the same core measurement Six Sigma uses to track process variation. Reducing variation directly reduces operational risk.
What is the role of FMEA in operational risk management?
FMEA, or Failure Modes and Effects Analysis, identifies potential failure points in a process before they occur and ranks them using a Risk Priority Number based on severity, occurrence, and detection, giving a team a clear, defensible priority order for addressing risk.
How do control charts help manage operational risk?
A control chart monitors a process in real time, flagging the moment it begins drifting outside its normal range of variation, which allows a team to catch emerging risk early rather than discovering it after a loss event has already occurred.
Has Six Sigma been formally recognized for operational risk management?
Yes. The Basel Committee has recommended Six Sigma as a best practice for managing operational risk specifically within banking and financial services, due to its ability to quantify and reduce the variation that drives operational loss events.
What is the difference between operational risk management and enterprise risk management?
Operational risk management focuses specifically on process, system, and human failure risk. Enterprise risk management (ERM) is a broader framework covering strategic, operational, reporting, and compliance risk across the whole organization, with operational risk as one of its core components.
Why do most operational risk programs fail to actually reduce risk?
Most programs stop at identifying and quantifying risk for reporting and capital purposes, without connecting that measurement to an actual improvement action. Without a structured reduction step, like DMAIC’s Improve phase, a risk register stays a list rather than becoming a working control system.
Final Words
Operational risk management and Six Sigma are describing the same underlying mathematics from two different professional vocabularies: variation. A risk manager calls it exposure. A Six Sigma practitioner calls it defects per million opportunities. Both are measuring how far a process strays from where it’s supposed to be.
The organizations getting real value from ORM aren’t the ones producing the most detailed risk registers. They’re the ones using FMEA to catch risk before it happens, control charts to catch it as it develops, and DMAIC to actually close the loop with a measurable fix, turning risk management from a reporting exercise into a genuine reduction system.
Build Risk-Reducing Process Skills with SSDSI
Reducing operational risk starts with the same discipline Six Sigma has always taught: measure the variation, find the root cause, and control the fix. SSDSI delivers IASSC-accredited Green Belt and Black Belt training that covers FMEA, control charts, and the full DMAIC framework used to turn risk identification into real risk reduction, through onsite, live virtual, public, and self-paced formats.
SSDSI has certified 5,322+ professionals across 600+ organizations in 52 cities, backed by a 5-star Google review rating. If your organization wants to build this capability internally, a conversation about the right certification path is a solid next step.
About Six Sigma Development Solutions, Inc.
Six Sigma Development Solutions, Inc. offers onsite, public, and virtual Lean Six Sigma certification training. We are an Accredited Training Organization by the IASSC (International Association of Six Sigma Certification). We offer Lean Six Sigma Green Belt, Black Belt, and Yellow Belt, as well as LEAN certifications.
Book a Call and Let us know how we can help meet your training needs.
