Operational-risk quantification has recently become important owing to the new Basel II regulations. Current methods based on observation of losses and their magnitudes to quantify operational risk do not preserve the cause-to-effect relationship that shows how operational risk can be reduced, managed, and controlled. We introduce a cause-to-effect operational-risk modeling methodology that enables operational risk to be reduced, managed, and controlled. As part of this methodology, we develop a decomposition algorithm to address the complexity of large-scale models. We demonstrate the use of this methodology with an example inspired by the settlement process of an inter-bank financial clearinghouse.