In the world of risk management, which encompasses the business continuity disciplines, many types of risk require evaluation. Financial risk is most often the primary focus, followed by product and market risks. Another critical area, which typically lacks a thorough review or may be overlooked, is operational risk. This category encompasses many risk exposure types including those around building structures and systems, environmental issues, nature, neighbours, clients, regulatory compliance, network, data security and so on. At times, insurance carriers will assess internal hazards, but seldom do these assessments include more than a cursory look at other types of operational risk. In heavily regulated environments, risk assessments are required but may not always include thorough assessments of operational exposures. Vulnerabilities may linger or go unnoticed, only to become the catalyst for a business disruption at a later time, some of which are so severe that business recovery becomes nearly impossible. Businesses may suffer loss of clients as the result of a prolonged disruption of services. Comprehensive operational risk assessments can assist in identifying such vulnerabilities, exposures and threats so that the risk can be minimised or removed. This paper lays out how an assessment of this type can be successfully conducted.