From geopolitical conflict to supply-chain disruption to extreme weather, the risk forecast for companies has dimmed appreciably. However, increasing complexity is also intensifying risk to businesses, as well.
As a result, companies must establish and maintain a set of processes encompassing risk assessment, decision making, and implementation of risk controls, to reduce the risk posed by both internal and external threats to acceptable levels.
Together, these processes form the foundation of operational risk management. What then are the key steps to manage operational risk in today’s business environment? We answer that question and more in the subsequent article, outlining effective strategies for operational risk management.
Defining operational risk
Well, you can’t manage operational risk without knowing what operational risk is.
What is it? Operational risk conventionally refers to the risk of running a business; these types of risk run the gamut from ineffective or failed internal processes, personnel, systems, to external events. The five categories of operational risks include:
- People risk
- Process risk
- Systems risk
- External events risk
- Legal and compliance risk
All companies encounter operational risks to varying degrees, influenced by such factors as company size, workforce size, industry, and more.
Regardless of the variable, though, operational risks, if realized, can result in significant losses, including:
- Enterprise-wide disruption or failure
- Loss of systems control or data
- Financial losses
- Safety hazards
- Damage to reputation
- IT infrastructure impairment
- Customer and employee turnover
- Legal liability or regulatory fines due to employee negligence or intentional misconduct
- Legal liability or regulatory fines due to actions by external entities
- Competitive disadvantage
Operational risk management interventions
Despite the potential repercussions of certain risks, operational risk management doesn’t always means completely eliminating all operational risks. In fact, it often doesn’t.
What does it mean, instead? Well, businesses have to evaluate their operational risks within the context of existing systems and processes. The interventions they come up with to manage operational risk will then consist of one of the following:
Risk avoidance
Eliminating hazards, activities, and exposures that can negatively impact an organization and its assets.
Risk acceptance
Acknowledging the possibility of small or infrequent risks without taking steps to mitigate them.
Risk transfer
Formally or informally shifting the financial consequences of specific risks from one party to another.
Risk reduction
Mitigating potential loss impacts by decreasing the likelihood and severity of possible losses.
Risk retention
Deliberately accepting potential losses.
Key steps to manage operational risk
How to proceed from there? We recommend taking the following key steps to managing operational risks:
Assess impacts
Evaluate the impact of business and strategic decisions on your operational risk profile and operational resilience as part of your business and strategic planning processes.
Understand your operational risk profile
Maintain a comprehensive assessment of your operational risk profile, including effective information systems to monitor operational risk, compile and analyze operational risk data, and facilitate reporting.
Identify and document resources needed
Document the processes and resources required to deliver critical operations, including personnel, technology, information, facilities, and service providers, along with their interdependencies, associated risks, obligations, key data, and controls.
Scenario analysis
Conduct scenario analyses to identify and assess the potential impact of severe operational risk events, test operational resilience, and identify the need for new or revised controls and other mitigation strategies.
Conduct a comprehensive risk assessment
Perform a thorough risk assessment before providing a material service to another party. Some regulators may require regulated entities to review and enhance internal controls or processes where the regulator identifies heightened risks.
Implement controls
Design, implement, and embed internal controls to mitigate operational risks in line with your risk appetite and compliance obligations.
- Regularly monitor, review, and test controls for design and operating effectiveness, with the frequency commensurate with the materiality of the risks being controlled.
- Report testing results to senior management, rectifying any control environment gaps or deficiencies in a timely manner.
- Remediate operational risk management material weaknesses, including control gaps, weaknesses, and failures, supported by clear accountabilities and assurance, addressing root causes promptly.
Operational risk management framework
In addition to taking those steps, organizations, as a best practice, should develop and maintain an operational risk management framework.
However, not all frameworks are suitable for managing operational risk.
To be considered appropriate, the framework should align with the size, business scope, and complexity of your organization.
Per regulations such as APRA: CPS 230, key components of an operational risk management framework include:
- Governance arrangements for operational risk oversight
- An assessment of your operational risk profile, featuring a defined risk appetite supported by indicators and limits
- Internal controls designed and functioning effectively for operational risk management
- Appropriate monitoring, analysis, and reporting of operational risks and escalation processes for operational incidents and events
- A regularly tested business continuity plan (BCP) outlining how you will identify, manage, and respond to disruptions within tolerance levels
- Processes for managing service provider arrangements
Who’s responsible for managing operational risk?
But who’s in charge of maintaining this framework? By statute, the Board of directors will likely be responsible for maintaining the operational risk management framework.
The Board, therefore, has its work cut out. It will likely have to ensure that the organization sets clear roles and responsibilities for senior managers relating to operational risk management.
Those senior managers, in turn, will be responsible for the day-to-day execution of operational risk management, across end-to-end processes for all business operations.
Nevertheless, senior managers will have to provide information to the Board on the expected impacts on critical operations. And then, the Board must make decisions affecting the resilience of said operations.
Further Board responsibilities include:
- Oversee operational risk management and the effectiveness of key internal controls in maintaining operational risk profile within risk appetite. To this end, the Board must receive regular updates on the company’s operational risk profile and then ensure that senior management takes action as required to address any areas of concern.
- Approve the business continuity plan and tolerance levels for disruptions to critical operations, review the results of testing, and oversee the execution of any findings
- Approve the service provider management policy and review risk and performance reporting on material service provider arrangements.
Digital software to manage operational risk
How to put it all together? Well, companies looking to bring automation to the management of potential risks that could cause operational failures or disruptions to their normal operations are well advised to consider operational risk management software, like Noggin, that provides a holistic view of risks, streamlines operational risk-related processes, and fosters effective stakeholder collaboration and communication.
Key features to look for in Operational Risk Management software
The specific operational risk management software features to consider include:
Objectives
Align risk management initiatives with organizational objectives to ensure risks are managed in a way that aligns with your objectives so you can effectively manage threats and capitalize on opportunities.
Risks and Controls library
Get a head start with a pre-existing library of potential operational risks and corresponding control measures, inspired by the best industry practices to save time in recognizing and recording operational risks.
Audits
Gain oversight into the ongoing management of risk controls as they are implemented and maintained in your operational environment, using scheduled audits that personnel can complete from anywhere, on any device.
Reporting
Create custom reports that summarize historical data with charts, recommendations, and sign offs. Export these as PDF or Word documents and share with stakeholders and executives to enable them to make informed decisions, manage threats, and benefit from opportunities.
Obligations
Keep track of your compliance obligations with ease using a centralized register that enables you to monitor breaches and collaborate with your team to ensure compliance throughout your organization.
Risk assessments
Proactively identify, assess, and manage operational risks through a centralized workspace that provides a holistic view of risks, and streamlines risk assessment processes while fostering effective stakeholder collaboration and communication.
Document management
Streamline the risk document management process by leveraging centralized document management functionality to ensure personnel have the right information at their fingertips.
Analytics
Consolidate data to gain valuable insights and visualize it through interactive dashboards, charts, risk matrices, and maps in real-time, from any device.
Owing to external events and internal business complexity, operational risk is increasing fast. Businesses, as a result, will have to pay increased attention to how they manage operational risk to thrive in this threat environment.
One investment to make is Noggin’s next-generation risk management software, which provides a holistic view of risks, streamlines operational risk-related processes, and fosters effective stakeholder collaboration and communication.
But don’t just take our word for it. Request a demonstration to see Noggin for Operational Risk Management in action.
.svg)
.svg)
.svg)