The Ultimate Guide to Operational Risk Management

What is Operational Risk Management?

Operational risk management (ORM) is a continuous and proactive process that identifies, assesses, and mitigates risks that disrupt daily operations. These risks can be internal, such as people, processes, and systems, or external, like natural disasters or regulations. ORM helps businesses stay resilient.

Operational risk management (ORM) is the effective identification, measurement, and monitoring of operational risks. It is the most comprehensive form of risk management and involves an assessment of all risks faced by an organization. The main objective of this discipline is to protect existing businesses and ensure value creation while realizing opportunities created by business activities.

ORM should be an integral part of a business’s overall risk management strategy. An organization that understands the importance of this discipline will be able to take advantage of its benefits and minimize its costs by ensuring that all activities are performed within an appropriate framework. Further, when a risk does materialize, the organization will be able to recover quickly from its detriments and ensure business continuity.

In this article, we discuss the key aspects of an Operational Risk Management program within an organization, and why it is critical to sustaining business operations.

Why is Operational Risk Management (ORM) Important?

Operational risk is any type of business risk that can impact the failure of an organization’s internal processes, people, and systems. The term operational risk can also be used to describe any business activity where there is a potential for harm to employees, customers, and/or the community.

Operational risks may vary in their consequences, but they are all related to the way an organization conducts its business activities. Everything ranging from natural calamities to employee attrition is a risk to business operations.

For example, fire hazards pose a risk to businesses as they can disrupt operations, damage property, and potentially cause injury or loss of life. Similarly, the risk of mis-selling, or the risk of employees or agents selling products or services to customers in a deceptive or fraudulent manner, can damage an organization's reputation and lead to financial losses or legal liabilities. Any such risks can have significant impacts on an organization if not properly managed.

ORM leverages a set of processes for identifying and mitigating risks related to an organization’s business operations. ORM is also focused on the operational element of independent, non-operational risks identified by regulators as having a significant financial impact on an organization's ability to manage its business effectively if not managed properly.

The primary objective of ORM is to protect value creation and shareholder/stakeholder confidence by managing operational risks arising from business activities while seizing opportunities that they create. ORM is critical to maintaining smooth operations within the organization and preventing any detriment, reduction in efficiency, reduction in productivity, or halt in consistent business activity. An ORM exercise aims to understand the variables that may affect various aspects of the operational performance of an organization and take means to mitigate aspects that have the potential to create damage.

How is Operational Risk Measured by Banks and Financial Institutions?

The key risk indicators depend on the industry in which organizations operate. For example, banks and financial institutions follow guidance from the Basel Committee on Banking Supervision (BCBS). BCBS lays out the guidelines for measuring operational risk.

Basel II Event Categories

Basel II is a collection of international banking regulations that was first published in 2004. This is the second of three sets of guidelines known as the Basel Accords, developed by BCBS. The third accord, Basel III is set to take effect in January 2023. Basel II outlines seven categories of operational risk, which are:

• External fraud: This category includes theft of information, hacking damage, third-party theft, and forgery.
• Employment practices and workplace safety: This category includes issues such as discrimination, workers' compensation, and employee health and safety.
• Clients, products, and business practices: This category includes market manipulation, antitrust, improper trade, product defects, fiduciary breaches, and account churning.
• Damage to physical assets: This category covers natural disasters, terrorism, and vandalism.
• Business disruption and systems failures: This category includes utility disruptions, software failures, and hardware failures.
• Execution, delivery, and process management: This category covers issues such as data entry errors, accounting errors, failed mandatory reporting, and negligent loss of client assets.

Example of Operational Risk Management

Broadly speaking, the operational risk management process comprises of 4 main steps - risk identification, risk assessment, risk mitigation, and risk monitoring. 

Assessing risks is a crucial step. However, risk managers often find themselves confronted with the question: which risk assessment method to go with - qualitative or quantitative? 

The answer lies in the context of the risk being assessed and the objective of the assessment. 

For example, consider the risk of fire hazards. A risk assessor will initially run a survey with questions such as:

• Is the office premise located in close proximity to a transformer or other combustible processes? 
• How many fire incidents have occurred in the past? 
• What is the probability of this risk event? 
• Have any lives been lost to such incidents?

Not all of the above questions can have a quantifiable answer as some require a yes/no response. These questions heavily depend on the knowledge and expertise of the risk assessor and therefore can be influenced by their bias and perception. That said, qualitative assessments are important to understand the likelihood and severity of the risk event.

Now, in the example of fire hazards, let’s assume that a fire incident can result in a monetary loss of $100,000. In other words, single loss expectancy (SLE) - the loss that could result from a single risk event - is $100,000.

If we now consider a scenario in which fire incidents can occur 5 times in a year then the ALE or annual loss expectancy will be 5x$100,000 = $500,000.

ALE is calculated by multiplying loss event frequency and loss magnitude.

This quantitative approach to assessing risks helps eliminate the ambiguity and subjectivity seen in the qualitative approach. Risk quantification, i.e. expressing risk in monetary terms, enables the decision-makers to accurately understand the risk exposure and the impact for effectively prioritizing and mitigating the critical risks.

What Are the Five Major Types of Operational Risks that Organizations Should be Aware of?

Operational risks can be broadly classified into five major categories, in the context of better mitigation.

People Risk

People risk is the risk associated with the human resource employed at an organization and originates out of any actions or omissions committed by the workforce. The acts or omissions can be an individual or a collective effort. People risk seeks to understand the effects of the decisions taken by employees within the organization and their impact on the operations.

Process Risk

Process risk is the risk associated with several processes deployed by the organization. The risk originates from inefficiencies within the process that have the potential to cause detriment to operations and revenues of the organization. Process risk involves understanding the changes in processes, changes in the market concerning the processes, and changes in organizational culture with respect to the processes that can cause damage.

Systems Risk

Organizational systems are complicated networks containing critical information about an organization. Therefore, systems risk is the risk associated with organizational systems that have the potential to create damage, extend unauthorized access, or delete critical business data.

External Events Risk

External events risk encompasses all risks that originate and exist outside of the organization, but can have a direct or indirect impact on its operations. External events may originate from third parties, customers, competitors, and partnerships – bringing the risks associated with each of these entities to the organization’s operations.

Legal and Compliance Risk

Legal and compliance risks are risks associated with regulatory authorities, jurisdictions, and geopolitics of a particular market. These risks differ depending on the operating region and affect the organization differently in different areas. The risks typically involve the risk of changing regulations, policies, and new tax regimes. 

What Are the Most Common ORM Challenges?

Operational risk management is a complicated task for any organization. Since operations are several and complex, ORM has to deal with various challenges before it can yield results. Here are some of the most prominent challenges to ORM.

Failure to Detect New Risks

One of the most significant challenges to the ORM is the inability to detect new risks that arise in the operational environment. The purpose of an efficient ORM strategy is to mitigate all risks to the operations of an organization. However, with an ever-evolving market and a dynamic economy, it becomes difficult for organizations to keep up with the changing risk landscape – creating gaps in the risk management strategies and existing risks.

Lack of a Common Understanding of Operational Risk

An organization’s ability to handle operational risk is only as good as its understanding of the risk. A common issue while assessing, preparing, and deploying strategies to combat operational risks is the lack of common ground between multiple entities involved in the process. While some parties within the organization may understand the risks to the same effect, others may comprehend it differently. Therefore, with lapses in a common understanding, the ORM exercise is likely to fail – largely due to inconsistent processes across various functions.

Lack of Skilled Resources

ORM is plagued with a lack of resources to deal with the risks that an organization faces. The ORM exercise is overlooked by organizations, with little attention and resources provided to the processes that help avert risks to operations. With limited resources and several complicated processes to develop, ORM becomes ineffective.

Difficulty in Representing the Impact of Operational Risks in Monetary or Business Terms

Operational risks are often intangible, and their consequences can be difficult to quantify. For example, the impact of a data breach on an organization's reputation may be difficult to quantify in terms of lost revenue or profits. Additionally, operational risks may have indirect impacts on an organization, such as reputational damage, that are difficult to quantify.

Data Inconsistency

Operational risks often involve multiple data sources and systems, which can lead to data inconsistencies that make it difficult to accurately assess risks. Additionally, operational risks may be dynamic and constantly evolving, which can make it difficult to keep data up to date and accurate. This can make it challenging for organizations to effectively manage operational risks and make informed decisions about how to mitigate them. 

What are Operational Risk Management Guidelines?

Here are some of the key guidelines that can help organizations develop and implement an effective ORM program:

• Tone at the Top

  It has been said time and again that effective risk management starts with the tone at the top – driven by the top management and adhered to by the bottom line. Effective management of operational risks needs continued support and commitment from the board, risk management committees, and senior management. The management and the board must understand the importance of operational risk management and leverage it to enhance competitiveness and performance. 

• Data Integrity and Accuracy

  A successful ORM program heavily relies on data consistency and accuracy. Organizations must establish well-defined processes for identifying, assessing, and monitoring key operational risk exposures and capturing and analyzing loss events, supported by a standardized taxonomy. ORM helps to turn these data into actionable insights, enabling the organization to evaluate the gaps arising from risk and control frameworks. 

• Right ORM Software

  Implementing a comprehensive ORM program must be supported with the right technology that improves risk visibility and foresight, preparedness for unknown unknowns, and efficiency in decision-making. A robust ORM solution supports features like role-based dashboards, control testing results, and scorecards that provide visibility into ongoing risk management efforts and bring high-risk areas into focus. 

• Clear Roles, Responsibilities, and Accountabilities

  Well-defined roles and responsibilities in risk management is an imperative part of ORM. It helps streamline the risk management process by enabling chief risk officers to incorporate accountability at each level in the risk team. 

• Risk-Smart Workforce and Environment

  An ORM framework should facilitate a cultural shift to a risk-smart workforce and environment. It ensures that the organization has the capacity and tools to be innovative while recognizing and respecting the need to be prudent in protecting its interests. 

• Continuous Risk Management Learning

  Most business units today acknowledge that continuous learning is fundamental to making informed and proactive decisions. To ensure this, business units are sharing their experiences with risk management, and providing best practices - internally and across organizations. This supports innovation, capacity building, and continuous improvement.

What are the Four Steps for Effective Operational Risk Management?

Risk Identification

Risk identification is the process of discovering risks associated with different aspects of an organization and their potential impact. To identify risks, organizations may use a variety of methods such as brainstorming sessions, interviews with stakeholders, and risk assessments. It is important for organizations to identify risks in order to understand potential impacts and prioritize risk management efforts.

Risk Assessment

Risk assessment involves evaluating the exposure, impact, and effects of identified risks. Risk exposure refers to the potential impact of risk and the probability of its occurrence. It is calculated by multiplying the probability of risk occurrence by the potential impact of the risk. There are various types of risk exposure, including transaction risk, operating risk, translation risk, and economic risk. Risk scoring is the practice of using statistical analysis to quantify risk in order to understand the level of associated risk. Common methods of risk scoring include range analysis, probability analysis, and impact analysis.

Risk Mitigation

Risk mitigation involves implementing strategies to minimize the likelihood or impact of risks. This may include implementing controls, transferring risks to third parties, or accepting risks. It is important for organizations to have a risk mitigation plan in place to minimize the impact of risks on their operations.

Risk Reporting

Risk reporting involves communicating risk information to relevant stakeholders. This may include preparing risk reports, presenting risk information to management or the board of directors, and disclosing risk information to regulators or investors. Risk reporting helps organizations understand the status of their risk management efforts and take appropriate actions to address risks.

Read more: What is Risk Management? 

How Can Organizations Build a Robust ORM Framework?

An Operational Risk Management Framework (ORMF) is a structured approach that helps businesses proactively identify, assess, prioritize, monitor, and report operational risks, such as process failures or human error, to minimize potential losses and exploit opportunities.

Risk Identification

First, an organization must understand the risks that exist in the business environment. While identifying risks, organizations must consider risks of all impact potentials to fill any gaps in the framework and keep the organization future-ready.

Appetite Statement

Once you have identified these risks, it's important to develop a risk appetite statement that outlines what's acceptable or unacceptable (tolerable) in terms of operational risk. This includes the type of damage that can be caused by each type of operational error or incident. It also highlights how quickly recovery from each type of incident should occur after it occurs—and how long it will take for them all to be resolved completely.

Risk and Control Self-Assessment and Mitigation

Once you have established this baseline for your organization's tolerance level for operational errors/incidents, create a risk assessment process so that everyone on staff has clear expectations about how their role fits into helping eliminate those risks from happening again in future situations.

Read more: Demystifying RCSA: 6 Critical Factors to Modernize Your Risk and Control Self-Assessment Program

Collecting and Processing of Loss Data

Loss data, more aptly known as operational risk event data, is the core source of information for gauging the impact of a past event and using this to forecast the potential damage from a future operational risk event. For example, banks and financial institutions follow guidance as outlined by the Basel II seven loss event categories. 

What Are the Benefits of a Strong ORM Framework?

ORM helps organizations protect their operations and ensure business continuity. Here are some of the benefits of a strong ORM framework:

Better Awareness of Operational Risks

A strong ORM helps organizations understand their operational risks better, helping them improve controls, make informed decisions and educated business choices. It improves awareness and makes all related parties known of the operational risks, enabling them to better contribute to risk mitigation and remain prepared for the materialization of the operational risks.

Reduced Stress on the Organization

When businesses develop a strong Operational Risk Management framework, they reduce stress by efficiently managing resources to tackle the outcomes of risks. As a result, businesses reduce operating costs by identifying potential issues before they become problems, making resource consumption and allocations more effective, and preparing provisions for unexpected events that may cause damage to the organization.

Improved Decision Making

ORM can improve a business’s ability to manage risks, which will lead directly to improved decision-making and increased profit margins. With more information, insights, and data in hand, organizations can develop accurate predictive models to help make better business decisions. These decisions are consistent with the business objectives while considering the effects of potential risks on operations. 

How Can Organizations Ensure a Robust ORM Framework?

To ensure the robustness of an ORM framework, it is essential to adopt ORM as an integral function within the organization ensuring the due attention, resources, and time are allocated to yield the desired results.

Integrating ORM into GRC

Integrating operational risk management with governance, risk and compliance (GRC) frameworks provide a structured approach to managing risks and ensuring compliance with relevant regulations and standards. By integrating operational risk management with GRC, organizations can identify and prioritize operational risks, assess their impact on the business, and develop controls to mitigate them. This integration can also help ensure that risk management is aligned with the organization's overall strategy, and that compliance requirements are met while minimizing business disruption. Ultimately, an integrated approach to operational risk management and GRC can help organizations enhance their risk management capabilities and improve overall business performance.

Leveraging an integrated GRC platform that includes ORM capabilities allows various elements of the GRC function, including ORM, to communicate and share information with each other. This helps to provide a more holistic view of risks and enables the organization to make more informed risk management decisions. Additionally, an integrated GRC platform can help to streamline the risk management process, making it more efficient and effective. 

How can Operational Risk Management Help Organizations Gain a Competitive Advantage?

Operational Risk Management can be a key component of any organization's risk management strategy. The ORM framework does not focus only on risk but also on value creation.

Effective ORM delivers a competitive advantage to organizations by providing a strong focus on:

• Helping the business grow by creating new customers 
• Enabling faster innovation than competitors by managing competition and strategic risks 
• Ensuring top risks related to critical operations are always under control 
• Enabling organizations to respond faster and better in case of a crisis or operational failure 

How MetricStream Can Help

MetricStream's Operational Risk Management software is designed to help organizations follow a robust risk management discipline and adopt a pervasive approach to operational risk management. It helps organizations improve risk visibility and foresight with predictive risk metrics and indicators, reduce losses and avoid adverse risk events with robust controls and analytics, and drive agile, risk-based business decisions with a single view into the top organizational risks. Built on the MetricStream Platform, the software helps strengthen collaboration across all business functions, from executives and risk managers to business process owners. It also helps establish a robust risk data governance and issue reporting framework with clear lines of accountability, enabling organizations to build confidence with regulatory authorities and executive management.