What type of risk involves both internal and external factors leading to loss?

Operational risk encompasses the potential for loss resulting from inadequate or failed internal processes, people, and systems, or from external events. It captures a wide spectrum of issues that could disrupt an organization's operations, whether such disruptions are caused by internal weaknesses—like mismanagement or system failures—or external factors, such as natural disasters or cyber-attacks. This dual nature of operational risk is essential to understanding its breadth and impact, as both internal mechanisms and external pressures must be managed effectively to prevent significant losses.

Compliance risk, while relevant, primarily pertains to the organization's potential failure to adhere to laws and regulations, which is more sharply focused on legal frameworks rather than operational elements. Legal risk tends to revolve specifically around potential legal actions or claims, rather than the broader spectrum of internal and external challenges to operations. Regulatory risk specifically refers to the impact of changes in laws or regulations on the organization, which, while important, does not encapsulate the broader operational vulnerabilities.