Why invest in operational risk management?

This section will explain the reason why operational risk has become such an
important issue. Over the past five years there have been a series of financial losses
in financial institutions which have caused them to rethink their approach to the
management of operational risk. It has been argued that mainstream methods such
as control self-assessment and internal audit have failed to provide management
with the tools necessary to manage operational risk.
It is useful to note The Economist’s comments in their 17 October 1998 issue on
Long Term Capital Management which caused some banks to provide for over
US$1billion each due to credit losses:
The fund, it now appears, did not borrow more than a typical investment bank. Nor was
it especially risky. What went wrong was the firm’s risk-management model – which is
similar to those used by the best and brightest bank.
The Economist states further that ‘Regulators have criticized LTCM and banks for
not stress-testing risk models against extreme market movements’.
This confusing mixture of market risks, credit risks and liquidity risks is not
assisted by many banks insistence to ‘silo’ the management of these three risks
into different departments (market risk management, credit risk management and
treasury). This silo mentality results in many banks arguing about who is to blame
about the credit losses suffered because of their exposures to LTCM. Within LTCM
itself the main risk appears to be operational according to The Economist: lack of
stress-testing the risk models. This lack of a key control is exactly the issue being
addressed by regulators in their thinking about operational risks.
Although much of the recent focus has been on improving internal controls this is
still associated with internal audit and control self-assessment. Perhaps internal
controls are the best place to start in managing operational risk because of this
emphasis. The Basel Committee in January 1998 published Internal Controls and
this has been welcomed by most of the banking industry, as its objective was to try
to provide a regulatory framework for regulators of banks. Many regulators are now
reviewing and updating their own supervisory approaches to operational risk. Some
banking associations such as the British Bankers Association have conducted
surveys to assess what the industry consider to be sound practice.
The benefits (and therefore the goals) of investing in an improved operational risk
framework are:
Ω Avoidance of large unexpected losses
Ω Avoidance of a large number of small losses
Ω Improved operational efficiency
Ω Improved return on capital
Ω Reduced earnings volatility
Ω Better capital allocation
Ω Improved customer satisfaction
Ω Improved awareness of operational risk within management
Ω Better management of the knowledge and intellectual capital within the firm
Ω Assurance to senior management and the shareholders that risks are properly
being addressed.
Avoidance of unexpected loss is one of the most common justifications of investing
in operational risk management. Such losses are the high-impact low-frequency
losses like those caused by rogue traders. In order to bring attention to senior
management and better manage a firm’s exposure to such losses it is now becoming
best practice to quantify the potential for such events. The difficulty and one of the
greatest challenges for firms is to assess the magnitude and likelihood of a wide
variety of such events. This has led some banks to investigate the more quantitative
aspects of operational risk management. This will be addressed below.
The regulators in different regions of the world have also started to scrutinize the
approach of banks to operational risk management. The papers on Operational
Risk and Internal Control from the Basel Committee on Banking Supervision are
instructive and this new focus on operational risk implies that regulatory guidance
or rules will have to be complied within the next year or two.
This interest by the regulators and in the industry as a whole has caused many
banks to worry about their current approach to operational risk. One of the first
problems that banks are unfortunately encountering is in relation to the definition
of this risk.