Output (step 4)

The final assessment of operational risk should be formally reported to business
management, the centralized Raroc group, and the partners in corporate governance
(such as internal audit. compliance, etc.). As illustrated in Figure 12.11, the output
of the assessment process has two main uses. First, the assessment provides better
operational risk information to management for use in improving risk management
decisions. Second, the assessment improves the allocation of economic capital to
better reflect the extent of operational risk being taken by a business unit (a
topic we discuss in more detail below). Overall, operational risk assessment guides
management action – for example, in deciding whether to purchase insurance to
mitigate some of the risks.

The overall assessment of the likelihood of operational risk and severity of loss for
a business unit can be plotted to provide relative information on operational risk
exposures across the bank (or a segment of the bank) as shown in Figure 12.12 (see
also Appendix 4). Of course, Figure 12.12 is a very simplified way of representing
risk, but presenting a full probability distribution for many operational risks is too
complex to be justified – and may even be misleading given the lack of historical
evidence. In Figure 12.12, one can see very clearly that if a business unit falls in the
upper right-hand quadrant then the business unit has a high likelihood of operational
risk and a high severity of loss (if failure occurs). These units would be the focus of
management’s attention.

A business unit may address its operational risks in several ways. First, one can
avoid the risk by withdrawing from a business activity. Second, one can transfer the
risk to another party (e.g. through more insurance or outsourcing). Third, one can
accept and manage the risk, say, through more effective management. Fourth, one
can put appropriate fallback plans in place in order to reduce the impact should an
operational failure occur. For example, management can ask several insurance
companies to submit proposals for insuring key risks. Of course, not all operational
risks are insurable, and in the case of those that are insurable the required premium
may be prohibitive.