Risk of loss from failed processes, systems, people, or external events. Controlled through internal controls, segregation of duties, and assurance functions.