Operational risk is usually caused by four different avenues: people, processes, systems, or external events. For many aspects of operational risk, companies must simply try to mitigate the risk within each category as best as possible with the understanding that some operational risk will likely always be present.