It is recognised that operational risk cannot be confined to specific organisational units but remains largely the responsibility of line managers or owners of the core processes, and some defined and certain special and support functions (such as ICT, HR and Legal).