Strategic risk threatens where an organisation is going; operational risk disrupts how it gets there. This guide explains the difference using ISO 31000, the Commonwealth Risk Management Policy and APRA's CPS 230, and shows why the two belong in one