Areas that typically report into a central operational risk function include business continuity planning, information security, and embedded operational risk coordinators or specialists or managers. Geopolitical and strategic planning, while important, does not typically report into the central operational risk function but rather into separate strategic or planning departments.
References:Operational risk function organizational structure.