TOPIC: Operational Risk Management
1. Operational Risk: Operational risk is the risk of loss resulting from inadequate or failed internal
processes, people, systems, or external events. It encompasses risks associated with the day-to-day
operations of an organization, including but not limited to human error, system failures, fraud, legal
risks, and external events.
2. Operational Loss Events: Operational loss events refer to incidents or occurrences that result in
financial losses for an organization due to operational risk factors. These events can include system
failures, fraud, errors in transactions, legal fines, and other unforeseen circumstances that impact the
organization's operations.
3. Categories of Operational Risk:
a. Internal Process Risk: These risks stem from deficiencies in internal processes within an
organization. Examples include:
Lack of Controls: Inadequate control mechanisms leading to errors or fraud.
Marketing Errors: Mistakes in marketing strategies that result in financial losses.
Money Laundering: Failure to detect and prevent money laundering activities.
Documentation or Reporting Failures: Errors or omissions in documentation or reporting processes.
Transaction Error: Mistakes in processing transactions leading to financial losses.
Internal Fraud: Fraudulent activities committed by employees or internal stakeholders.
b. People Risk: These risks arise from human factors within the organization. Examples include:
Recruitment and Selection: Risks associated with hiring unsuitable candidates.
Performance Management: Failure to manage employee performance effectively.
Training and Development: Inadequate training leading to errors or inefficiencies.
Remuneration and Compensation: Issues related to fair compensation and incentive structures.
Succession Planning: Risks associated with lack of succession planning for key roles.
Adequacy of Complement: Insufficient staffing levels leading to operational challenges.
Disciplinary Actions: Risks associated with disciplinary procedures and their effectiveness.
Separation from Service: Risks related to employee turnover and exit processes.
c. Systems Risk: These risks are related to technological systems and infrastructure. Examples include:
Data Corruption: Loss or corruption of data leading to operational disruptions.
Inadequate Project Control: Failure to manage technology projects effectively.
Service Interruptions: Downtime or disruptions in services due to technical issues.
System Security Problems: Breaches or vulnerabilities in system security leading to data breaches or
unauthorized access.
System Unsuitability: Incompatibility or inadequacy of technology systems for business needs.
Cyber Crime:
Unauthorized access to sensitive data.
Ransomware attacks encrypting critical files and demanding payment for decryption.
Phishing scams targeting employees or customers to obtain sensitive information.
d. External Risk: These risks originate from external events beyond the organization's control.
Examples include:
Natural Disasters: Such as earthquakes, floods, or hurricanes impacting operations.
Economic Events: Economic downturns or fluctuations affecting business performance.
e. Legal Risk: Legal risk arises from the potential for legal or regulatory sanctions, financial loss, or
damage to reputation due to non-compliance with laws, regulations, or contracts. Examples include:
Lawsuits: Legal actions filed against the organization.
Regulatory Fines: Penalties imposed by regulatory authorities for non-compliance.
4. Operational Risk Management: Operational risk management involves identifying, assessing,
measuring, mitigating, and monitoring operational risks to minimize their impact on an organization's
objectives. It aims to enhance decision-making processes and ensure the effective allocation of
resources to manage risks.
5. Operational Risk Management Process:
a. Identification: Identifying and understanding the various sources of operational risk within the
organization.
b. Assessment: Evaluating the potential impact and likelihood of occurrence of identified risks.
c. Measurement: Quantifying risks in terms of potential financial losses or other relevant metrics.
d. Mitigation and Control: Implementing measures to reduce the likelihood and impact of identified
risks.
e. Monitoring and Reporting: Continuously monitoring risk exposures, assessing the effectiveness of
risk mitigation measures, and reporting findings to relevant stakeholders.
6. Contemporary Best Practices in Operational Risk Management:
a. Audit Oversight: Independent review and oversight of operational risk management processes by
internal or external auditors. b. Critical Self-Assessment: Honest and objective evaluation of the
organization's operational risks and controls. c. Risk Mapping: Visual representation of operational
risks and their interrelationships within the organization. d. Causal Networks: Analyzing causal
relationships between events and identifying root causes of operational failures. e. Key Risk
Indicators: Monitoring leading indicators of operational risk to proactively identify emerging threats. f.
Actuarial Models: Quantitative models used to assess the financial impact of operational risks. g.
Earnings Volatility: Assessing the potential impact of operational risks on the organization's earnings
stability.
7. Example of Operational Risk Measurement and Management: An example could be a bank
implementing a new online banking system. Operational risk management would involve identifying
potential system failures, data security risks, and customer service disruptions associated with the
new system. The bank would then assess and quantify these risks, implement appropriate controls
such as robust cybersecurity measures and staff training, continuously monitor the system's
performance, and report any incidents or breaches to relevant stakeholders.
8. Functional Structure of Operational Risk Management Activities:
a. Centralized Risk Function: A centralized unit responsible for overseeing and coordinating
operational risk management activities across the organization. b. Business Line Risk Function:
Operational risk management functions embedded within individual business units to address risks
specific to their operations. c. Individual Business Unit Risk Function: Operational risk management
activities conducted at the level of individual business units or departments to address risks inherent
to their operations.
9. Three Lines of Defense in Operational Risk Management: The three lines of defense model is a
framework for effectively managing operational risk within an organization, involving:
10. a. Business Lines Management: First line of defense responsible for identifying, assessing, and
managing operational risks within their respective business units. b. Independent Operational Risk
Management Function: Second line of defense comprising risk management experts who provide
oversight, guidance, and support to business units in managing operational risks. c. Independent
Review and Challenge (Audit): Third line of defense consisting of internal or external audit functions
responsible for independently reviewing and validating the effectiveness of operational risk
management processes and controls.
Explanation of Three Lines of Defense:
a. Business Lines Management: The first line of defense involves business units taking ownership of
managing operational risks inherent in their day-to-day activities. They implement controls and
procedures to mitigate risks and ensure compliance with policies and regulations.
b. Independent Operational Risk Management Function: The second line of defense provides
independent oversight and support to business units in managing operational risks. This function
establishes risk management policies, frameworks, and procedures, conducts risk assessments, and
monitors the effectiveness of controls.
c. Independent Review and Challenge (Audit): The third line of defense conducts independent reviews
and assessments of operational risk management processes and controls. Internal audit or external
audit functions verify the adequacy and effectiveness of risk management practices and provide
assurance to senior management and stakeholders.