Operational risk management: what IAM and third-party controls change

TL;DR: Operational risk management now has to account for faster digital failure modes, including shadow IT, unvetted browser extensions, vendor breaches, and weak identity controls, according to Panorays. The practical shift is from quarterly review to continuous visibility, because operational loss increasingly starts where access, process handoffs, and third-party trust intersect.

Editorial analysis by NHI Mgmt Group, based on content published by Panorays: “Operational Risk Management: Strategies for Business Resilience”.

Key questions

Q: What breaks in operational risk management when shadow IT and unsanctioned tools bypass normal controls?

A: When shadow IT bypasses normal controls, the organisation loses visibility into who can access what, what data those tools can touch, and which approval paths were skipped.

Q: Why do browser extensions and other user-installed tools create operational risk?

A: They create operational risk because they often inherit browser context, user sessions, and permissions that security teams never intended to grant.

Q: How should organisations prioritise third-party risk inside operational risk programmes?

A: They should prioritise the third parties that sit closest to critical services, revenue, sensitive data, or privileged access.

Practitioner guidance

• Map operational risk to identity trust paths Identify where access decisions, credential sharing, and third-party permissions sit inside critical workflows so you can see which failures can become business interruptions.
• Review browser extension permissions continuously Inventory sanctioned and unsanctioned extensions, then compare their privileges with the data and sessions they can reach in the browser.
• Tie KRIs to control drift Track access anomalies, vendor score changes, and recurring process exceptions so that risk reporting reflects live operational weakness rather than stale quarterly status.

Bottom line: Operational risk now overlaps with identity governance because unapproved tools, shared credentials, and vendor dependencies can bypass normal controls.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →