Operational Risk Management in Central Banks: A Systematic Literature Review, Bibliometric Analysis, and Future Research Agenda

Abstract

Background Central banks operate in increasingly complex environments shaped by digital transformation, cyber threats, third-party dependencies, payment-system innovation, and growing expectations for operational resilience. However, research on operational risk management in central banks remains fragmented across governance, cybersecurity, business continuity, risk appetite, technology risk, and operational resilience. This study systematically synthesises this literature and identifies priorities for future research. Methods A systematic literature review was conducted in accordance with the Preferred Reporting Items for Systematic Reviews and Meta-Analyses (PRISMA) 2020 framework. The review integrated bibliometric analysis, methodological quality assessment, and qualitative thematic synthesis. The final evidence corpus comprised 13 publications meeting the predefined eligibility criteria. Keyword co-occurrence, co-citation, bibliographic coupling, temporal analysis, and thematic coding were used to examine the intellectual, conceptual, methodological, and thematic development of the field. Results The findings show a transition from conventional control- and governance-oriented operational risk management toward technology-enabled operational resilience. Major themes include operational risk identification and assessment, operational risk management capability, governance and internal control, risk appetite and tolerance, cybersecurity and technology risk, business continuity and third-party risk, and operational resilience. Important research gaps remain in empirically validated central-bank-specific risk assessment models, Risk Appetite Frameworks, quantitative resilience measurement, cross-country evidence, longitudinal analysis, and assessment of governance and digital/cybersecurity capabilities. Conclusions The review develops the Central Bank Operational Risk Appetite and Resilience Framework (CB-ORARF), integrating operational risk identification, risk assessment capability, operational risk management capability, risk appetite, and operational resilience while recognising governance and digital/cybersecurity capabilities as important enabling conditions. The framework is review-derived and conceptual rather than empirically validated and provides a testable foundation for future empirical and cross country research.