Operational risk management practice varies from one organization to another. There is no consistency in its implementation. This has caused misinterpretation, half-hearted implementation which eventually, denies the full function of its capabilities to support a business operation. Previous studies have provided limited exposure in finding on the best practice of operational risk management implementation. To fill the gap, this study aimed to uncover and explore how operational risk management is institutionalized within an organization and the best practice from a primary GLC in Malaysia. An extended case study approach by Burawoy (1998) was adopted. The primary data from 42 semi-structured interviews were analyzed using thematic analysis. The study found seven processual stages which the case company underwent to institutionalize risk management and regarded as the best practice of operational risk management implementation that supports business operations. Namely, strong leadership and obtaining external consultancy, setting the apparatus and assignment of tasks to the person in charge, risk framework, risk diagnostics, monitor and measure, developing and nurture a risk management culture, and consistent risk management enforcement and monitoring. These are regarded as a best practice by similar organizations in its sector.

Keywords: case study, institutionalization, operational-risk-management