Operational risk is a significant risk faced by institutions requiring coverage by own funds. It is essential to take account of the diversity of institutions in the Union by providing alternative approaches to the calculation of operational risk requirements incorporating different levels of risk-sensitivity and requiring different degrees of sophistication. There should be appropriate incentives for institutions to move towards the more risk-sensitive approaches. In view of the emerging state of the art for the measurement and management of operational risk the rules should be kept under review and updated as appropriate including in relation to the charges for different business lines and the recognition of risk mitigation techniques. Particular attention should be paid in this regard to taking insurance into account in the simple approaches to calculating capital requirements for operational risk.