The aim of this thesis is to investigate operational risk management with a special emphasis on people risk. The motivation to implement research in this particularly challenging area of risk management is twofold: Firstly, the increasing magnitude of operational losses as a result of people over the last decade and their negative effect on the banking industry. Secondly, literature on operational risk in banking has focused on measurement of operational risk and capital adequacy, and is therefore inconclusive on several vital questions regarding the qualitative elements of operational risk, particularly people risk management. By way of interviewing operational risk managers, junior bank operatives and operational risk consultants with regard to operational risk management in general and people risk in particular, this thesis contributes to the existing research on operational risk in several ways. This study enhances understanding of the effect of the limited definitions, processes and practice with regard to both operational risks in general and people risk in particular. The study also provides a detailed account of the regulatory influence on ORM and also draws attention to the role of the Board and senior management particularly the tone at the top and in the process highlights, the difference between what they say and what they do, and the effect that this has on operational risk and people risk management. The current study also extends present understanding in relation to the contradictions between the three lines of defence in theory, and as discussed in the industry, and in the process also highlight how it operates (or does not) in practice. In particular the study identifies and examines the development of sub-lines of defence (la and Ib) which are filling gaps within the three lines of defence, particularly the qualitative elements and specifically people risk. More importantly the study proposes and examines a framework for people risk management and in the process also proposes an intermediary people risk management function which sits in the three lines of defence and, is staffed by human resources and operational risk which are currently managing elements of people risk separately.