Many data availability and reliability issues still need resolving. An internal loss experience for the important (low frequency, high severity) operational risk types is rare and any relevant data are likely to be in the form of risk self-assessments and/or external loss experiences.
Extreme events and stress testing: One of the key roles of the risk management process is to manage extreme events, such as those associated with the tails of statistical distributions and could have probability of occurrence as low as one percent. These are low probability but high loss instances associated with extreme operational events such as rogue trading or accounting fraud.