The Risk of Doing Business

All organizations regardless of industry are vulnerable to ever-present operational risks on both sides of the isle. These risks range from corporate cultural, moral, ethical risks to processes, controls, data, third parties, staff conduct related risks. Layered on top are the technology risks, which are compounded as the technologies such as automation, and artificial intelligence (AI) are embraced by the organizations in droves.

In short, operational risk is the risk of doing business. The maturity of the operational risk regimes vary by industry however one constant is the growing awareness and appreciation across boards and senior managements to better understand operational risk management. In many parts of the world, surprisingly even in some G20 countries, operational risk is just beginning to be taken seriously as an effective differentiator. Despite its pervasive nature, many organizations treat operational risk as an obligation (mostly out of regulatory or some other mandate requirements), thus adding more risk to an already risky endeavor.

Organizations across the globe have been struggling to support a risk culture that empowers risk accountability, understands operational risk losses, and encourages appropriate risk escalations. Small failures can have a snow-balling effect on the entire organizations, if left unchecked. These failures can be avoided if organizations better understand their operational risk profiles, and risk tolerances. ORM should be nothing less than an organizational essential and an essential C-Suite tool. Regrettable as it is, organizations only realize the significance of ORM only after having experiences a loss or a loss event that needs to be explained to the customers, shareholders, and the regulators.

Equally important to lack of realization on importance of operational risk management, are the challenges organizations usually face in developing strong operational risk management programs. Some of these challenges include:

• The hidden function: Many organizations incorporate ORM in their compliance, IT, operations, or other functions, leading to a growing identity crisis. This kind of embedding operational risk management in any one of stand-alone multiple functions leads to lack of all relevant risks identification which leads to complicating the implementation of cross functional operational risk oversight and governance leading to assurance and review cycle compromises. When ORM sits within another function or functions, instead of being centralized and run independently, there is always s concern for segregation of duties.
• Cross-functional disconnect: ORM, for the most part, has been used as a reactive tool, many organizations have not been able to properly dimension the cross functional advantages of a proper ORM program. Manual and disjointed systems, and metrics that are reported just for the sake of regulations or compliance have been the hallmark of such reactive and disconnected ORM programs. Senior management in many instances have not been able to see beyond the elementary level of the true benefits of an interconnected ORM program thus ignoring ORM’s true value proposition.
• The complex process: Thanks to increasing amounts of risk-relevant data, and no common taxonomy to aggregate risks, most ORM programs are behind the curve before they even get up and running. Adding to this: investing in a team that can provide governance and oversight, as well as stay on top of risk perspectives, can be a big financial investment.

To develop strong and fully embedded ORM programs, organizations should:

• Let ORM stand alone:ORM can only be effective when it is delinked from core functions, and run as a standalone or under the overall enterprise risk function. The size of the organizations and its breadth of its business landscape, decides if it functions as a standalone entity or part of the overall ERM program. The ORM is most effective when managed by a risk management professional.
• ORM as a partner, not competitor: ORM must be positioned as a partner to all functions in the organization, not as their competitor. When paired with business functions in defining, and aggregating risks the overall organizational risk environment is strengthened and other units can be left to focus on delivering their core duties making time to market a lot faster.
• Make ORM a habit, not a rule-breaking monitor: ORM programs are at their best when they are used for helping the business in reducing risks/exposures and extend the risk/reward benefits for the entire organization. ORM program should clearly refrain from testing for violation of policies/procedures etc. ORM can set the tome for identifying material risks helping the organizations avoid losses before they occur.

Finally appropriate risk mitigation and internal controls procedures are established by the business units such that residual risk is mitigated to the acceptable level. Regular reviews must be carried out, to analyse the control environment and test the effectiveness of implemented controls, thereby ensuring business operations are conducted within acceptable risk limits. Further, it is essential that the ORM program ensures consistent monitoring and controlling of operational risk, and that risk information is received by the appropriate people, on a timely basis, in a form and format that will aid in the monitoring and control. Operational risk metrics or “Key Risk Indicators” (KRIs) are established to ensure timely warning is received prior to the occurrence of an event. Key to effective KRIs lies in setting threshold at the acceptable level of risk. Execution and implementation of Operational Risk framework is key to setting up effective Operational Risk environment ensuring that business is conducted within appropriate risk tolerance limits.

Author’s Note. “The views and opinions expressed in this article are strictly those of the author and do not reflect the official policy or position of any company.”

Originally published on LinkedIn, 22 May 2020.