Operational Risk: The Management Perspective

Abstract

’Operational Risk’ (OpRisk), interpreted in the context of Basel II as ‘the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events’, introduces a challenge to financial services providers and institutions who have to date predominantly controlled their organization’s exposure to market and credit risk. It is no surprise that approaches chosen and methods employed are often dominated by the needs of corporate controlling, accounting and regulatory reporting functions. This observation raises no immediate concerns, however, a lack of proactive cooperation from risk management counterparts can render controlling-driven OpRisk initiatives inefficient and ineffective over time. Moreover, to portray a worst-case evolution, attempting to address Basel II’s OpRisk by means of introducing another set of independent software tools into an already complex IT infrastructure; generating yet another pool of practically irreconcilable data originating from a mix of objective measurements and individual subjective assessments of uncertain quality; and employing practically incompatible analysis methods; may actually raise an organization’s exposure to OpRisk, hence defeating the objective.

Beyond reactively addressing stakeholders’ and managers’ requirements, appropriately implemented OpRisk management infrastructure, process and people investments can be business enablers — turning risk management into an opportunity and addressing the requirements of Advanced Measurement Approaches (AMA) as a desirable side-effect. Early-mover financial services providers and a larger number of industrial organizations have in these efforts demonstrably generated net value. This article attempts to outline a generic roadmap for organizations who have in the past placed little or no emphasis on the management aspects of OpRisk — allowing the early introduction of those evolutionary steps known to generate considerable value quickly; highlighting some appropriate choices at policy level; and building on practical lessons learnt in managing typical hurdles throughout the implementation of suitable OpRisk management systems and processes.