An apparatus for controlling operational risk in a data processing system comprises a risk domain segmenter for segmenting the data processing system into a plurality of risk domains, a domain risk threshold selector for selecting a domain risk threshold for at least one of the plurality of risk domains, a system element monitor operable to query the data processing system for an indication of presence of system elements, a risk quantizer for evaluating a system element for element risk and for computing the potential contribution of the element risk to a domain risk total, a risk threshold comparator for comparing the domain risk total with the domain risk threshold, and a domain assignor operable to assign the system element to a risk domain in dependency upon an output of the risk threshold comparator.