Units of Measure for operational risk are homogenous groupings of risks to allow sensible modeling decisions to be made. For example, some risks may be fat-tailed, for example the risk of regulatory fines. Other risks may have finite tails - for example damage to physical assets risk (DPA) may be limited to the value of the asset in the question.

Additionally, risk reporting may need to be done at the line of business, legal entity or regional basis, and in order to be able to do, so the right level of granularity needs to be captured in the risk modeling exercise. The level of granularity applied is called the 'unit of measurement' (UoM), and it is okay to adopt all of the choices listed above as the dimensions that describe the unit of measure.

Note that it is entirely possible, even likely, to use legal entity, risk type, region, business and other dimensions simultaneously, though doing so is likely to result in an extremely large number of UoM combinations. That can be addressed by then subsequently grouping the more granular UoMs into larger UoMs, which may ultimately be used for frequency and severity estimation.