An operational risk policy should include:
* The firm's definition of risk: Clearly defining what constitutes operational risk for the organization.
* The governance of operational risk including who owns it, what it owns, and how issues should be
* escalated: Establishing roles and responsibilities for managing operational risk.
* The main activities and elements that are managed by the operational risk function: Outlining the key processes and controls that are in place to manage operational risks.