Making sense of operational risk practices in the financial services sector is a challenge. There is a temptation to explain the wide variety of approaches as a characteristic of the early stage of development in which the genre resides. Based on the evidence of three case studies, this paper explores the mechanisms that guide firms in their choice of operational risk methodologies. First, drawing on Power (2003a)'s notion of calculative cultures, we propose that senior risk officers develop 'personal philosophies' about the 'manageability' of risks. Second, we emphasise the role of institutionalised rules and conventions (Meyer and Rowan, 1977) in the selection and use of operational risk practices. The paper explicates a number of conventions that are being institutionalised in the operational risk area. The case studies draw attention to the conflicts between the demands of these multiple conventions, and how organisations struggle to resolve them.