All types of risks should be measured, but operational/strategy/reputation risks caused by non-financial factors are primarily managed through the monitoring and improvement of processes such as internal controls.