Abstract: A method is provided for analyzing operational risk associated with one or more organizations, comprising receiving operational loss data from a plurality of organizations at a third-party risk management entity that is a separate entity from the plurality of organizations. The operational loss data includes confidential information regarding one or more of the plurality of organizations. The data received from the plurality of organizations, including the confidential information, is pooled. The pooled data is used to generate an operational risk model for one of the plurality of organizations, and this operational risk model is transmitted to the organization. A system for modeling operational risk for a plurality of organizations is provided, comprising a first data store configured to collect data regarding operational losses from the plurality of organizations, whose data includes confidential information regarding one or more of the organizations.