The Basel Committee on Banking Supervision introduced operational risk framework in banking starting from 2004. Operational risk is generally defined as the risk of financial loss arising from inadequate or failed internal processes, people, systems or external events. According to the Basel Committee there are seven event types that can cause operational risk and these include: (1) internal fraud, (2) external fraud, (3) employment practices and workplace safety, (4) clients, products and business practice, (5) damage to physical asset, (6) business disruption and systems failure and (7) execution, process and delivery management. Operational risk is immanent to every business process in organisation and can therefore have significant material and even more reputational consequences for organisation. Having in mind the sensitivity of credit institutions to reputational risk it is evident that the impact of operational risk on business activity is significant. There are several aims of this paper. Firstly, authors will give an overview of operational risk management framework and operational risk events that may occur in banking practice will be identified. Secondly, an overview of regulatory requirements regarding operational risk will be presented with special accent put on historical lessons learned in the decade since operational risk regulatory framework has been introduced. Thirdly, operational risk practices in Croatian credit institutions will be analysed based on publicly available data. The last mentioned aspect is of special importance when having in mind the relationship between operational and reputational risk on one hand and principal – agent theory on the other. Expected contributions of this paper are: detailed systematic analysis of operational risk management framework in banking, increased awareness of scientific community about operational risk and an analysis of Croatian credit institutions’ exposure to operational risk.