Operational Risk Advanced Concepts

How to ensure an environment that supports good operational risk management?

More than the theoretical presence of the operational risk cycle, it is the implementation of a risk culture that generates effective practice. Management needs to ensure that all colleagues understand their responsibilities and create a culture that is focused on business outcomes rather than managing operational risk itself. Management should reinforce culture through role-modelling good practice and eliminate blame culture. This will help in the long run and allow mistakes to be escalated and remediation activity to take place openly. This will allow more equitable distribution of resources and better access to senior management who can assist in issue closure.

As part of good practice and formally as part of their Internal Capital Adequacy Assessment Process (ICAAP), financial institutions forecast potential future risks and their impact. For example, technology is a big risk to organisations and a scenario exercise may include a test against a cyberattack or ransomware playbook. This scenario analysis demonstrates what could go wrong under a set of extreme but plausible circumstances. The results from such tests are also used to review management strategic direction and also contribute to the firm’s capital calculations.

This example of operational risk’s connection to the ICAAP, and Prudential Regulation Authority’s new Operational Resilience requirements, are a frequent reminder of the connection between understanding operational risk and responding across a range of teams, areas and processes within a large bank.