Everyone knows that running a business involves risk. But not all risks are created equal.
Business leaders will encounter certain risks that are intrinsic to doing business. In risk management, we refer to those risks as operational risks.
In this article, we will define just what operational risks are and how efficient operational risk management (ORM) processes can benefit business leaders seeking to avoid operational failures.
What are operational risks?
So, what’s operational risk, exactly? Operational risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events. This definition, put out by the U.S. Federal Deposit Insurance Corporation (FDIC), includes legal risk, but excludes strategic and reputational risk.
What are some practical examples of operational risks? Operational risks encompass the following:
Internal fraud
Employee theft, intentional misreporting of positions, and insider trading on an employee’s own account.
External fraud
Robbery, forgery, and check kiting.
Employment practices and workplace safety
Workers’ compensation and discrimination claims, violation of employee health and safety rules, and general liability.
Clients, products, and business practices
Fiduciary breaches, misuse of confidential customer information, money laundering, and sale of unauthorized products.
Damage to physical assets
Terrorism, vandalism, earthquakes, fires, and floods.
Business disruption and system failures
Hardware and software failures, telecommunication problems, and utility outages.
Execution, delivery, and process management
Data entry errors, collateral management failures, incomplete legal documentation, and vendor disputes.
Although external events figure into the definition of operational risk, the risk class itself typically comprises more operational failures. However, this doesn’t make operational risk less serious than material risk.
In fact, operational failures are usually present in material failures, exacerbating the latter. It’s often said that absent operational risk, material failures are less significant.
Approaches to controlling operational risk
The question, then, turns to, how to control operational risk?
ORM isn’t a new field. Traditional practices have included internal processes, audit programs, and insurance protection to counterbalance operational risk.
Often, though, these practices aren’t sufficient given the sharp uptick in operational risk vectors businesses are facing to day.
Modern operational risk management practices
What’s emerged, as a result, are new practices[i] extending more quantitative measurements, such as the following:
- Historical loss data
- Formal risk assessments
- Statistical analysis
- Independent evaluation
Particularly in the financial services industry, the prevalent approach to ORM seeks to mitigate some of the traditional siloing methods with more comprehensive, enterprise-wide oversight. It’s now the corporate function that oversees the establishment of the ORM framework, which is responsible for identifying, measuring, monitoring, and mitigating operational risk.
Rather than siloing, this produces a more top-down approach, in which the board of directors comes up with the firm’s risk tolerance; formal operational risk policies flow from that, such as the delineation of roles, data standards, assessment procedures, reporting norms, and quantification methods.
Sure, business line managers retain day-to-day risk ownership as beforehand. However now, the risks themselves are pinpointed through structured self-assessments, covering end-to-end processes and providing insights into individual process and product risks.
Where did ORM come from?
If this seems like enterprise risk management (ERM), there are overlaps.
However, ORM came into its own in response to the International Convergence of Capital Measurement and Capital Standards: A Revised Framework, better known as Basel II.
Basel II, now superseded by Basel III, is an international business standard, the main thrust of which is the requirement to maintain sufficient cash reserves to cover risks incurred by operations. Basel II also requires banks to publish their risk management practices.
As a result, regulators now expect banks that adopt Basel II to develop and implement comprehensive ORM, including data and assessment, as well as other quantification processes that are appropriate to the nature of their activities, business environment, and internal controls.
The advantages of operational risk management
What were the specific advantages envisaged by using ORM, though? Well, the primary value of ORM techniques is higher relevance to decision making and risk management.
The growing number of institutions making use of these techniques, therefore, cite the following benefits of a well-integrated ORM framework:
- Integrated corporate risk management
- Increased risk awareness and mitigation opportunities, which may minimize potential exposure
- Risk management supplements and reinforces business line risk ownership
- Core set of key risk and performance metrics/escalation triggers
- Enhanced risk management efforts by providing a common framework for managing risk
- Concise, uniform reporting to senior management and the board of directors.
- Use of quantitative information (potential operational risk exposure) and risk assessments to improve risk management.
Strategies to manage operational risk
Of course, ORM doesn’t just happen by itself. ORM constitutes an actual process (or cycle) of risk assessment, decision making, and implementation (of controls) that needs to be pursued.
The precise strategies needed to implement effective ORM include the following:
Risk identification
The identification stage consists of isolating all potential operational risks, whether recurring risks or potential one-offs. Risk identification involves staff across the business, not just C-suite executives.
Risk assessment
Once identified, operational risks must be added to a risk register where they are to be assessed based on a number of factors, like how likely the risk is to occur, how frequently the risk will occur, and the potential risk exposure to human and non-human assets if the risk is not managed.
The use of a risk matrix, an established risk assessment methodology, is a standardized way of prioritizing risks in a central risk register by likelihood and consequences.
The severity of each risk can then be assessed separately, either as inherent, target, or residual risk, using a common methodology. At the end of the evaluation, risk is traditionally categorized as either very high, high, medium, low, or very low.
Analysis
In analyzing risk, teams will consider which risk controls (if any) to put in place. Additionally, teams will provide decision makers with a thorough risk analysis, a clear cost and benefit evaluation as well as outlines of possible alternative measures to take.
Decision
Based on the analysis furnished, decision makers will choose the best control (or combination of controls).
Implementation
Carrying out the decision taken requires having a plan for applying the selected controls. Adequate time and resources must also be allocated for any control measure to be successful. In addition, implementing controls requires clearly communicating your plan to everyone involved.
Monitoring
Implementation, however, isn’t the end of the story. Once they’re put in place, controls will have to be consistently monitored to ensure they are working as expected.
Manage your operational risk with Noggin
If that process seems overwhelming? It doesn’t have to. Digital operational risk management software helps companies mitigate operational risks and strengthen enterprise resilience.
Solutions like Noggin Resilience, in particular, help organizations proactively identify, assess, and mitigate potential risks that could cause operational failures or disruptions to their normal operations.
Key features of Noggin software for Operational Risk Management
With what features? Noggin’s operational risk management software offers the following:
Objectives
Align risk management initiatives with organizational objectives to ensure risks are managed in a way that aligns with your objectives so you can effectively manage threats and capitalize on opportunities.
Obligations
Keep track of your compliance obligations with ease using a centralized register that enables you to monitor breaches and collaborate with your team to ensure compliance throughout your organization.
Risk and controls library
Get a head start with Noggin's pre-existing library of potential operational risks and corresponding control measures, inspired by the best industry practices to save time in recognizing and recording operational risks.
Risk assessments
Proactively identify, assess, and manage operational risks through a centralized workspace that provides a holistic view of risks, and streamlines risk assessment processes while fostering effective stakeholder collaboration and communication.
Audits
Gain oversight into the ongoing management of risk controls as they are implemented and maintained in your operational environment, using scheduled audits that personnel can complete from anywhere, on any device.
Document management
Streamline the risk document management process by leveraging Noggin’s centralized document management functionality to ensure personnel have the right information at their fingertips.
Reporting
Create custom reports that summarize historical data with charts, recommendations, and sign-offs. Export these as PDF or Word documents and share with stakeholders and executives to enable them to make informed decisions, manage threats, and benefit from opportunities.
Analytics
Consolidate data to gain valuable insights and visualize it through interactive dashboards, charts, risk matrices, and maps in real-time, from any device.
Finally, ORM involves the systematic process of understanding, managing, and monitoring risks to minimize the potential negative impact on an organization’s objectives and outcomes, the benefits of which this article has sought to lay out.
Bringing these efficiencies to your risk management program often requires automation, though. And here, digital software like Noggin provides a holistic view of risks, streamlines operational risk-related processes, and fosters effective stakeholder collaboration and communication.
But don’t just take our word for it. Request a demo of Noggin to see for yourself.
[i] Ali Samad-Khan, “Fundamental Issues in OpRisk Management,” OpRisk & Compliance, February 2006.
.svg)
.svg)
.svg)