There a three primary choices in handing data risk:

1. Ensure data risk is considered for all other types of risk
2. Seperately agreegate data risk into operational risk
3. Manage data risk as a peer to other risk types

If you haven't made it clear to the owners of each risk type which of the above approaches has been taken how do you know if you are accurately agreegating data risk?

Approaches for Managing Data Risk

Risk Type Master List