The importance of operational risk management in financial and commodity markets has increased significantly over the last few decades. This paper demonstrates the application of a nonhomogeneous Poisson model and dynamic extreme value theory (EVT) incorporating covariates on estimating frequency, severity and risk measures for operational risk. Compared with a classical EVT approach, the dynamic EVT gives a better performance with respect to the statistical fit and realism. It is also flexible enough to handle different types of empirical data. In our model, we include firm-specific covariates associated with internal control weaknesses (ICWs) and show empirically that firms with higher incidences of selected ICWs have higher time-varying severities for operational risk. Our methodology provides risk managers and regulators with a tool that uncovers the nonobvious patterns hidden in operational risk data.