Operational Risk in Process-Driven Businesses

Operational risks in real estate businesses fall into four categories. Process Risk: the risk that documented processes contain errors, gaps, or inefficiencies that produce incorrect outcomes. Examples include offer calculations that omit holding costs, closing checklists that miss required documents, and rehab scopes that underestimate work. People Risk: the risk that team members fail to follow processes correctly due to inadequate training, carelessness, or intentional deviation. Technology Risk: the risk that systems fail, data is lost, or integrations break. A CRM crash during a high-volume marketing campaign can result in hundreds of lost leads. External Risk: the risk that events outside the business disrupt operations—title company errors, contractor abandonment, regulatory changes, or natural disasters.

Each operational risk should be assessed on two dimensions: likelihood (how probable is the risk event?) and impact (how severe are the consequences if it occurs?). Use a 5x5 matrix with likelihood scores from 1 (rare) to 5 (almost certain) and impact scores from 1 (negligible) to 5 (catastrophic). Risks scoring 15+ (likelihood times impact) require immediate mitigation. Risks scoring 8-14 require monitoring and contingency plans. Risks scoring below 8 require awareness only. The assessment should be performed for each core business process, producing a comprehensive operational risk register that is reviewed quarterly.

Once risks are identified and assessed, four response strategies are available. Avoid: eliminate the risk by not engaging in the activity. For example, avoid the risk of contractor fraud by using only licensed, bonded contractors with verified references. Mitigate: reduce the likelihood or impact through controls. SOP documentation, training, checklists, and approval workflows are all mitigation controls. Transfer: shift the risk to another party through insurance, contracts, or outsourcing. Errors and omissions insurance, general liability coverage, and indemnification clauses in vendor contracts are transfer mechanisms. Accept: acknowledge the risk and prepare a response plan without attempting to prevent it. Some risks are too unlikely or too costly to mitigate—accepting them with a contingency plan is the rational response.