A customer support chatbot's risk register conflates operational risk with reputational risk. What is the correct distinction between the two?
Select an answer to reveal the explanation.
Short Explanation
One is about whether it works, the other is about how it looks when it doesn't. They can fail independently, so you track both.
Full Explanation
The correct distinction is that operational risk concerns the system failing to function reliably, such as outages or degraded responses, while reputational risk concerns damage to public trust, such as a widely shared bad interaction. A chatbot can be operationally reliable yet still generate a response that goes viral for the wrong reasons, and it can also be operationally unreliable with no reputational fallout at all; the two risks track different failure modes. The choice saying they are the same category described with different words, so only one needs tracking, is incorrect because collapsing categories means a fix aimed at one failure mode can leave the other unaddressed. The choice limiting operational risk to hardware failures and reputational risk to software bugs is incorrect because operational risk includes software and process failures, not just hardware, and reputational risk is not limited to bugs. The choice treating reputational risk as a subset of regulatory risk that does not need separate assessment is incorrect because reputational harm can occur with no regulatory violation at all; the categories overlap in some cases but are not nested. For the exam, be able to name what each risk category is actually about, not just recite the label.