The risks businesses once filed under "everything else" are now the ones most likely to bring them down

For decades, operational risks — the human errors, broken processes, fraud cases and outside shocks that don't fit neatly into financial risk categories — were treated as a leftover category in corporate risk management. A new article by Sebastian Oelrich (Aarhus University) and Sergeja Slapničar (University of Queensland) argues that this era is over. Geopolitical instability, energy insecurity, digital interdependence and regulatory turbulence have pushed these risks to the centre of the boardroom agenda.

Introducing a special issue of the Journal of Management Control, the authors propose a simple but consequential distinction. Some are amplified core risks: familiar problems such as bribery, money laundering, supply-chain breakdowns and product recalls, now moving faster and at far greater scale thanks to AI and global integration. Deepfake CEO scams and AI-generated fake invoices are classic frauds on steroids. Others are structurally novel risks that could not have existed before — AI systems inventing facts, algorithms quietly discriminating against loan or job applicants, or entire operations hanging on a handful of AI providers.

The distinction matters because each demands a different response. Amplified risks can still be prevented and detected, using stress-tested versions of existing controls. Novel risks often cannot be prevented at all, shifting the goal towards transparency, accountability and the ability to recover quickly. Five studies in the issue show that no single tool or department can manage this alone: effective control comes from combining clear non-negotiable boundaries, trust between people and units, and external regulatory pressure.