When the concept of capital requirements for operational risks was first introduced by the Basel Committee in 1999, banks were highly reluctant to implement this regulatory demand. The growing materialization of operational risks with extremely large losses (Société Générale’s Kerviel affair, Libor scandal, London Wales, etc…) has made this debate obsolete. Those striking examples argue for consideration of extreme values in the calculation of capital requirements for operational risks. However, the vast majority of operational risk losses both in numbers and in total value are due to high frequency but low magnitude events. As a consequence, updated and back-tested operational risk mapping and exhaustive loss databases are essential, both in terms of capital calculation and risk management. By controlling their correct implementation, the internal audit function is then key in helping banks to run an effective and efficient operational risk management.