Whether it’s a system failure disrupting your ability to deliver service or employee mistakes leading to data breaches, risks abound for your organization on a daily basis. However, an increasing number of companies are still tending to their operational risk management as an afterthought and only reacting to crises.
The reality is that an estimated $2.6 trillion are lost every year as a result of the ups and downs of U.S. business performance. The truth is, it’s estimated to cost U.S. businesses a staggering $2.6 trillion annually in lost productivity, fines and damage to their reputations. Strategic operational risk management is not about merely surviving these crises, it’s a way to flourish and turn operational risk into a competitive edge.
This all-encompassing course will teach you everything you need to know about operational risk management, why it’s important, and how to create a resilient framework that will keep your business protected and continue to grow.
What is Operational Risk Management (ORM)?
Operational risk management is the process of identifying, quantifying and reducing risks from your businesses regular activities. These aren’t the big news crashes or industry-disrupting events the media is talking about, but rather the quiet, ever-present risks in the processes, systems and people in your business.
Basel Committee on Banking Supervision (BCBS) defines operational risk as “the risk of loss from inadequate or failed internal processes, people and systems or from external events. The term was coined in the banking industry, but can be used in other industries, including healthcare, manufacturing, technology, retail, and nonprofit organizations.
There are four key components to operational risk:
There are accidents and incidents that can happen to persons, by process failure, inefficient work flow, by systems, by technology, by cybersecurity, by data loss, by a natural disaster, by a regulatory change and all of these can be alleviated with some corrective actions.
Operational risks can be controlled – they are not strategic risks (entry into a wrong market) or financial risks (interest rate changes). That’s why operational risk management is a proactive endeavor that provides valuable, tangible benefits right from the get-go.
The Critical Role That Operational Risk Management Plays in Today’s World
The price of not addressing operational risks is more expensive than ever. So why operational risk management is a must have:
Greater pressure from regulation: There are plenty more regulations to comply with. New knowledge and information in financial services, health, pharmaceuticals and industry data have driven the need for advanced systems of operational risk management in these industries. There are severe consequences and penalties for non-compliance.
Greater surface area: Digital transformation has led to a greater surface area within organizations for risk. Every day, failure points are introduced in the cloud, remote workforces, with third parties and APIs.
Cost of Data Breaches: The average cost of a data breach is $4.45 million. Your ability to recover fast and damage minimization is directly related to operational resilience.
Reputational Damage: In today’s world, where people are connected around the clock and where social media technology can give them the ability to share information easily, service interruptions now damage reputation globally in hours. When it comes to seamless experience, you’ll need a reliable operation.
Talent Scarcity: With more and more people who are capable of doing what you are doing, it is a must to protect your knowledge and your abilities by documenting your processes and your knowledge and capturing it.
Interconnected Operations are Vulnerable to Disruption: Events of the past few years have shown how vulnerable these interconnected operations are. A few companies were in danger of extinction as they had no diversity in their supplier base, or none of their suppliers had contingency plans.
Operational risk management is a key aspect of business and an organization that is adept at this aspect has higher levels of customer satisfaction, employee retention rate, and profitability. They experience fewer compliance issues and rebound from crises faster and with greater competitive edge.
The 5 Core Categories of Operational Risk
It is important to know how an operational risk will become a reality so you can work out a specific mitigation strategy. The Basel framework has five categories:
Process Failures
Process failures: When one’s process documented does not work as expected, or if not documented. Examples include:
Departments failing to communicate effectively with each other.
Workflows that do not require any approvals
Any input error that is passed on to the systems.
Lack of coordination of deadlines due to poor ownership definition.
Routinely not following procedures at other sites
A financial services company discovered that their entire loan application procedure was a sequence of e-mails, and there was no central documentation, or even any audit trail. This was because of a process failure and exposure to regulation, no scaling was possible.
People-Related Risks
Your employees are one of your most valuable assets and a risk factor:
Lack of skills results in lack of good decision-making
Deliberate dishonesty or misdeeds
Inadequate screening of employees and hires.
Lack of skills and training of procedures / systems.
A situation where critical knowledge is held by one person (key person dependency)
High turnover and disruption in service due to burnout.
The company that was building the software had the principle architect of the software walk out the door without leaving any documentation and the software system could not be maintained. For six months, this risk with people halted the product development process!
System and Technology Risks
With digitalization, there has been a large increase in technology risks:
The customer is unable to access the system due to an outage.
Possible security system weaknesses and data breaches. The risk of data breaches and potential cybersecurity incidents.
Legacy systems that are not compatible with modern integration systems. Communication problems between legacy systems and modern integration systems.
Data that is not of good quality is hindering decision making.
Failure to have backup/disaster recovery plans in place
Poor access control to prevent unauthorized changes
Many of the ecommerce platforms that experience failures during the holiday season do so, and lose $12 million in sales – just another reminder that things that can go wrong will go wrong.
External Events
There are some risks that you may not be able to control:
Natural disasters (earthquake, flooding, hurricanes)
Failure of vendors/suppliers.
The need to modify the rules that require modification of the activities of the organization
Upheavals due to new competition on the market.
Political events affecting the supply chain.
Industry-wide technology failures
Organizations have highlighted the critical need for remote working and a lack of redundancy in supply chains due to COVID-19. When left unbuilt, systems tend to fail at other intervals when subjected to external events.
Compliance and Regulatory Risks
Facing legal and regulatory requirements comes with its own set of risks:
Failure to meet industry specific regulation.
Do not have adequate documentation for audits.
misreporting of transactions or reporting.
Failure to have mandatory security controls for computers. Lack of required computer security.
Lack of adequate consent (for data collection or processing);
The consequences of breaches in patient privacy will be extremely expensive to health care organizations, but not because they are trying to break it, rather because they have no procedures in place to ensure compliance.
To Build a Successful Operational Risk Management Framework
A robust operational risk management system puts in place a sustainable approach to operational risk management. A framework enables you to move forward in a proactive manner with risk situations and not to move back into a crisis situation.
The Assessment Phase
Firstly, conduct a comprehensive risk map of operational risks:
Risk Identification: Have teams within your organization have structured discussions on what could go wrong. Use processes including process mapping to understand workflow and to know where things can go wrong. Document:
In cases where there are manual touchpoints there they are.
In many instances, where knowledge lies is in the head of a single person
By the points of intersection to other systems
In areas where compliance is required to be at its highest. Where it is most needed at compliance sites.
Risk Analysis: Conduct a risk analysis for each of the listed risks, determining the probability and consequences of those risks. Create a risk register of the following:
Definition of risk and context of a risk.
All possible financial effects (direct and indirect costs)
Probability of occurrence
There are some control measures that are already in place.
The following controls were not found on the system, so they are recommended:
Risk Prioritization: Some risks require more attention than others. Utilize a matrix to show the risks by likelihood/impact. Handle the risks first that are likely to occur and are likely to affect the most.
Mitigation Strategies
If risks are identified, come up with specific responses:
Avoidance: Avoid the activity that is causing the risk. If a health care provider does not have the expertise required, they may not want to do high-risk procedures and may refer the patient to another health care provider.
Reduction: Implements measures to lower the risk and/or impact. There is a reduction in errors when we automate, a reduction in skill gap when we train and a reduction in risks of availability when there is redundancy.
Transfer: Risk put onto others, e.g. in insurance, contract or outsourcing. The difference between business liability insurance and service level agreements is that the latter transfers vendor risk.
Acceptance: If a risk is low impact, make a decision to accept the risk rather than expend more than the appropriate resources. Record this decision for audit purposes.
Monitoring and Control
Risk management isn’t a project, it’s an ongoing process:
Identify important indicators of risk and alert signs
Set up reporting schedules and accountability for reporting.
Develop escalation processes for developing risks
Carry out periodic control effectiveness Audit.
Check for changes to the regulations every quarter and update as needed.
Continuous Improvement
Your business structure should evolve with your changing businesses:
Conduct RCA following operational incidents. RCA following major operational incidents.
Apply learning from the lessons in new procedures
If risk has changed within the business review risk assessment.
Compare your ideas with what is done in other firms.
Retrain staff using new procedures/controls.
7 Essential Strategies for Operational Risk Management
1. Perform Thorough Risk Assessments
Most organizations simply estimate the risks that they have personally encountered. A holistic risk assessment uncovers the weaknesses that lie in plain sight but do not pose any harm.
What This Looks Like in Practice: A manufacturing company did have assessed but used one technician’s experience to do their quality control instead of systematic sampling. This was a serious threat to product quality as it was a key person dependency. They achieved this by using a systematic quality metrics approach which removed the dependency, and enhanced quality outcomes.
Action Steps:
Conduct cross-functional workshops with front-line staff that encounter risks on a day-to-day basis
Identify common points of failure in the process using process mapping
Pose “what if” questions in a systematic way in all operational areas
Record existing controls not presume that they are effective.
2. Establish Good Internal Controls
Internal controls include the controls which prevent, detect and correct operational risks. There are some common attributes to all effective controls:
Reactive: Only react after a problem has already arisen (only training after mistakes)
Detective – Be able to find quick answers to problems if they arise (reconciliations, audits).
Corrective – fix things in a timely and efficient manner (incident response processes):
Documented: Formalized, and when staff change these remain consistent
Tested: regularly tested to verify that they work as they are intended.
The problem was identified by a professional services company, which found there were $2 million in billing errors per year after reconciling project billing with time entry systems monthly, and are working to correct the issue. By using this single control, the accuracy was increased and it ensured compliance with billing regulation.
Implementation Approach:
Document current controls and associate with risks identified.
Create new control designs to meet the needs of gaps
Make sure that every task is broken into such a way that no one can approve, do and check transactions.
Introduce technology to enable repeatable and traceable controls.
Ensure you have a good mix of control and efficiency of operation.
3. Develop Clear Procedures and Policies
Policies contain statements of HOW things should be done. Procedures provide instructions on how it should be done. In combination, they provide the operating base which helps to prevent risks from escalating.
You can find good examples of policies and procedures below:
Clear: written in a language that is easily understood by front line workers
Accessible: stored in centralized locations and easy to access and navigate
Current: Provided updates as conditions change in business. (Current: Updates when business conditions change)
Specific: Specific enough to make sure things are clear, not too detail oriented or “micromanaging”
Enforced: This was done regularly and with the use of consequences.
A customer service company had a definite escalation process as it clearly defined when the supervisors should be included. This prevented loss of high value customer issues, reduced churn by 18%.
Development Process:
Document procedures prior to drawing existing workflow.
Include front-line personnel that implement procedures
Pilot before rollout all around the organization
Set up loops for feedback on ideas for improvement
Annually check and update review procedures as necessary
4. Develop Staff Through Training and Development
If employees don’t know about and use your procedures, they are not going to be successful. Policies become action through training.
Effective Training Includes:
New employees induction with all necessary procedures explained thoroughly.
An annual refresher training to critical controls.
Expert guidance on dealing with exceptions, based on scenarios. In-depth advice on how to handle exceptions in scenarios.
Consequences of non-compliance
Whenever procedures change, a new training is provided.
Real-World Impact: A quarterly compliance training program for a financial institution reduced compliance violations by 67% within two years. More importantly, the workers perceived risks as a proactive process, rather than under the auspices of a particular audit.
Training Best Practices:
Provide role specific training which relates to their duties.
Use combination teaching method: face-to-face, online, a written, and a job aid.
Avoid relying on the achievement of tests as a sign of understanding – rely on assessments to find out if there is understanding.
Maintain documentation of training for auditing purposes.
Congratulate and praise staff on good control practices.
5. Develop Entrepreneurial Attitudes. Encourage a Technology and Automation Based Approach
There are multiple operational risk aspects that can be addressed with technology:
Human error is eliminated by automated validations: invalid data is not allowed to enter systems. Automated workflows guarantee proper approvals are given in the right order.
Systems generate audit trails: Digital workflow tracks who did what, and when, are key to regulatory compliance and investigation.
Monitoring is possible with technology: Real-time dashboards allow you to see exceptions as they happen, rather than having to wait for end-of-period reports.
Procedures in systems scale consistency: When procedures are part of a system they are applied everywhere, by all shifts.
Smart Implementation: Automated reminders for appointments were implemented by a healthcare provider which lowered no-show rates by 34% and alerted clinicians to which patients were not showing up for their appointments. This, one single technology deployment, helped resource utilization and patient outcomes.
Technology Selection Criteria:
Choose systems for processes and not processes for systems!
Make sure that they fit into the current systems – don’t build systems in silos!
Take into account total cost of ownership (TCO) such as training and support.
Determine the reliability and long-term viability of vendors
Plan for the migration from an old to new system. Design Migration of Old system to new system.
6. Build a Risk-Aware Culture
The most advanced model is broken when employees think of operational risk management as compliance theater rather than the necessary protection.
An organization with a risk culture has the following characteristics:
Leadership Commitment: If the executives show commitment towards the operational risk management, the employees will be convinced that it is important. This includes provisioning of resources, periodic review of metrics and tasking risks seriously reported.
Psychological Safety: Ensure Staff feel safe to raise concerns without consequences. The first person who spots something amiss should feel free to say something if many incidents in operation could be avoided.
Shared responsibility: It is important to note that successful organizations do not have responsibility for operational risk management in one department, they share it. All coordinate within an enterprise framework, with finance owning financial control risks, IT owning system risks and HR owning people risks.
Celebrate Prevention: recognize and reward staff who are able to “see” risks before they “happen. One worker’s eye could save the million dollar incident.
The continuous learning process: complete investigations, share the information broadly and revise procedures. Consider incidents as learning opportunities, not opportunities to find blame.
Cultural Example: A manufacturing company used “safety moment” as their kickoff for the daily stand-up when employee close calls and lessons learned will be shared. The number of risks reported has more than doubled, while the number of operational incidents have decreased 42% in one year.
7. Monitor and Review Continually
Risk Management is not a once a year event. In good organizations, continuous monitoring will be embedded within their processes:
Daily/Weekly Monitoring:
Availability and performance monitoring of the system.
An audit is a review of crucial processes that are verified as they are completed.
Compliance exception detection
Monthly Monitoring:
An indicator of the key risks trending.
Control effectiveness assessment
Process anomaly investigation
Quarterly Monitoring:
Change in the risk profile due to a different scenario for a business.
The new requirement for assessment of regulations.
Procedure effectiveness review
Annual Monitoring:
Update of comprehensive risk assessment: This is an updated comprehensive risk assessment.
Comparing it with the industry standards.
Risk reassessment with a view to a changed business plan
Effective Monitoring Requires:
Unique duties for each monitoring activity.
A set of metrics and thresholds are programmed. A set of some metrics and some thresholds are defined.
Monitoring identify problems and escalate procedures are followed.
Follow up verification of corrective actions that led to solutions to problems.
Adjusting to monitoring when it becomes outdated due to change
Operational Risk Management Best Practices
Documentation Standards
The good documentation can serve two purposes: It can be used to make the operation consistent and it can be a document of compliance.
Documentation Best Practices:
Maintain procedure repository in a single location and maintain version control
For each procedure include owner and revision date
Use “why” not “what” in procedures (this will help staff use procedures in unusual circumstances)
Make sure procedures go into effect after being signed off by subject experts and compliance functions.
Use out-of-date protocols for historical purposes and/or to track the audit trail.
Escalation Procedures
Many incidents are going wrong due to poor communication. Effective escalation protocols will result in issues being escalated to decision makers before they reach crisis.
Effective Escalation Includes:
Very clearly identified when to escalate and when not.
Incident Type Escalation Paths recorded.
The time limits for each level of escalation are listed below:
Contact information remains up-to-date.
Follow up on issues that were escalated to the next step and verification of follow up
Stakeholder Communication
Operational risk is not a Finance or Compliance matter, but a matter for all departments. If everyone is on the same page then there is alignment:
A regular risk report to the Board/ Leadership team
Risk Reports specific to each department with relevant risks and metrics.
Annual review of approach to risk management within the organization with all staff.
Communication process for incidents that ensures that the affected parties are informed in a timely manner.
Performance Metrics
What you can’t measure you can’t improve. ORM metrics should be meaningful in that it should ask the question of whether ORM is working:
Financial Metrics:
The amount of losses, and the damage caused by the losses.
The cost of incident response/recovery. The expenses involved in a response and recovery.
Regulatory fine avoidance
Operational Metrics:
Process error rates
The uptime and availability of the system.
Minimising key person dependency
Procedure compliance rates
Strategic Metrics:
The proportion of risk identified is measured, as well as mitigation plans.
The swiftness with which incidents are dealt with.
Employees’ satisfaction on the awareness training on risk factor. Employees satisfaction on awareness training on risk factors.
The Most Common Mistakes That Companies Make With Regard to Operational Risk Management
Follows the Rules That the Game Has to Adhere To. It Is Viewed as a Compliance Checkbox
The Blunder: Organizations only apply the minimum necessary amount of controls, put a check mark in the compliance box and then move on.
Compliance requirements do not set targets, they set baselines as to why it fails. Minimal compliance can fail to address your targeted business model’s important risks.
Better Approach: Prioritise compliance requirements and then assess and control industry, business model and risk appetite specific risks.
Insufficient Resource Allocation
The Mistake: Absence of dedicated function and dedicated resources and resources for operational risk management. The Mistake: Lack of operational risk management as a separate function, separate resources and resources.
Because: It has to be a priority to be continually monitored and improved. Part-time efforts do not cover risk of emerging and embedding of improvements.
Good practice: Invest in resources, proportionate to size and complexity. This may be a single individual within a small business who has a strong commitment and is backed by executive buy-in.
Lack of Good Risk Management Practices = Risk Management Work in Silos
The Mistake: Financial controls managed by Finance, system risks by IT, people risks by HR and little interaction among them.
Why It Fails: Most significant incidents are failures in a number of risk categories. Lack of integrated management leaves system gaps and wastes efforts.
Improved Approach: Implement risk coordination processes (enterprise risk committee, common risk register, monitoring dashboard) to have a comprehensive view of risks.
Outdated Risk Assessments
The Mistake: Risk Assessments that are not updated when there are changes in the business environment and are conducted every couple of years.
Why It Fails: With the evolution of technology, market changes, regulatory adjustments, and organizational growth, your risk profile is constantly changing. An audit without consideration of the existing risks is out of date!
Good Practice: Carry out broad-based assessments each year and update on a quarterly basis where there are material changes. Apply incident analysis to check the accuracy of assessments of actual risk.
How to Put ORM in Place in Your Organization
Step-by-Step Implementation Guide
Phase 1 (Months 1-2): Foundation
Make sure the concept is supported and known by the executive and board. Get executive support and board buy-in to the concept.
Make sure there is transparency of accountability and ownership
Designate starting budget and resources
Assess the existing situation: What is the informal risk management situation?
Communicate vision to the organization
Phase 2 (Months 2-4): Assessment
Complete risk assessment of all aspects of business.
Create risk registry of identified risks
Concentrate on risks that are most likely to happen and are severe enough to warrant attention.
Ensure that records are kept of controls for each risk
Identify gaps and mitigation opportunities for pinpointing controls
Phase 3 (Months 4-6): Strategy
Explain the extent of risk acceptance – acceptable amount of operational risk?
Develop strategies to reduce the high priority risks.
Determine who is responsible for each risk and who is accountable.
Set up governance framework for continued management
Determine important risk information and monitoring strategies
Phase 4 (Months 6-9): Implementation
Implement risk mitigation programs. Start risk remediation efforts.
Put in place monitoring systems and reporting
Provide training to staff on new procedures and controls.
Introduce new policies and record keeping.
Pertaining to the education and care environment, set up a regular review schedule.
The final phase is Ongoing (Phase 5) Monitoring and Improvement. The last phase is Ongoing (Phase 5): Monitoring and Improvement.
Continuously track and track down critical risk indicators.
Re-check and update risk assessment every 3 months.
Properly investigate incidents and rectify the situation.
Implement changes in response to lessons learned.
A review of the risk position that is completed annually.
Key Stakeholders
To be successful, it’s important to engage your organization:
Executive Leadership: Provides budget, strategic direction and accountability.
Board/Audit Committee: It is responsible for the risk management strategy and their performance.
Assumptions are made by Risk Owner; normal response is in Finance, Compliance, or Operations and takes part in enterprise efforts.
OPS Risk Head: OPS Risk Head for their region.
Catch the risk and do the controls, provide feedback, Front-Line Employees.
IT Department: Sets up system controls and monitoring.
Test the effectiveness of controls, audit function.
In addition to internal partners, there are external partners who are third-party service providers, auditors, consultants.
Success Metrics
What evidence can you give of implementation?
The number of unexpected operation incidents has been reduced.
Quick response and resolution of incidents if they happen
Better achievement of compliance audit standards
More employees being aware of and reporting risks.
Enhance the level of Board confidence on operational resilience.
Reduced regulatory fines and penalties for non-compliance
Improved service availability and customer satisfaction.
A Suite of Operational Risk Management Tools and Technologies
A family of operational risk management tools & technologies.
Monitoring and implementation are easy and quick with the right tools. Consider:
Tools for Risk Assessment and Mapping
These will help you to systematically detect, record and prioritize risks. The capabilities offered are scenario modeling, heat maps and automated reporting.
Workflow/Automation Platforms
Robotic process automation (RPA) systems are able to automate tasks that are previously done manually, which are susceptible to errors, and automatically provide audit trails.
Compliance Management Systems
These are based on the centralization of policy management, control monitoring, compliance tracking and audit workflows. They’re particularly valuable for regulated industries.
Business Continuity and Disaster Recovery Platforms
These are tests to attempt to show what you will do in the event of disruptions. They are essential for them who play a significant role or have high expectations for their customers in their organizations.
Integrated Risk Management Suites
There are some vendors who provide a full package solution which covers the assessment, monitoring, incident management and reporting process. These help to ensure enterprise risk is captured in a single source of truth.
Key Selection Criteria
Integrated: Does it integrate with existing systems?
Scalability: Does it have the ability to expand as your company expands?
User Adoption: Will it be easy for staff who will have to use it on a daily basis?
Reporting: Is the information in the report what you’re looking for?
About Vendor Stability: Can the vendor be expected to be in business for 5-10 years?
A Programme of Measurement for Operational Risk Management
Any programme of measuring Operational Risk Management.
Key Performance Indicators
How many and how much incidents do they happen? Incident Frequency:
The number of incidents that are currently operating. Number of incidents currently under way.
Average time for problem detection.
Time taken to clear an incident on average.
There is a financial impact of incidents. There is a cost associated with incidents.
Control Effectiveness:
Released annually and tested and validated by percentage of controls in place.
Number of failures (uncontrolled) in the control system identified
Time to address strengths identified as remediation
Process Compliance:
The proportion of department procedures completed successfully (as % of total procedures).
Training completion rates
Policy acknowledgment rates
Risk Profile:
Risk Identification = Percentage of identified risks that have mitigation plans
The number of high priority open risks that are not within acceptable timelines.
Critical processes that key persons rely on
Maturity Models
Typically, there are stages to become risk management “mature”:
Level 1 (Initial): Reactive response to crisis – No formal framework is in place.
If you have any of the following items, you will be rated as Level 2: Basic risk assessments; documented procedures; informal monitoring.
3 (Defined): Documented risk assessment process, enterprise risk register, structured governance, frequent checks and review.
Level 4 (Managed): Risk indicators are predictive; Risk metrics are quantified; Risk mitigation is pro-active; Continuous improvement.
AI-powered risk prediction, real-time risk optimization, enterprise-wide integration, peer-leading practices – these are all the end of the road for Level 5 (Optimized).
It’s a good idea to set your target level to be 3 or 4, depending on the type of industry your organization is in, and how complex your business is.
Benchmarking Approaches
Industry Benchmarks: Benchmark Risk Metrics with peer organizations in your industry.
Research and understand the models of leading organisations on risk management programs, best practice – study model
Show the willingness to apply industry-specific regulatory frameworks as a guide to regulatory action.
Continual Improvement: Your trends over the years in your own metrics
Conclusion
Operational Risk Management is not a burden or compliance obligation, it is a responsibility of the business which will affect the profitability, customer satisfaction and the organisational resilience. Companies that master the operational risk management have less disruptions, faster recovery in case of incidents and are more trusted by their stakeholders.
The ideas and methods mentioned herein are suitable for any size organization and industry. Regardless, principles of operational risk management are the same: You must know what can go wrong, you must have controls in place to prevent it, you should monitor it all the time, and you should get better all the time.
In today’s business environment it is essential that errors can be identified quickly and corrected or rectified, not necessarily accurately. If you make it a part of your culture and processes and you have an operational risk management framework in place, then you can convert your operational weaknesses into corners of your organization’s competitive advantage. Prioritize the most critical risks, to start with early wins that gain momentum and then work in a systematic way. You’ll build discipline and resilience that will be recognised by your stakeholders.
Frequently Asked Questions
Q. What’s the difference between operational risk management and enterprise risk management?
All risk categories, such as strategic, financial, operational and compliance risks, are covered by enterprise risk management. The focus of operational risk management is specifically on internal processes, people, systems and external events. Operational risk management should be viewed as a key part of the enterprise risk management.
Q. How often is a risk assessment performed while a process is running?
Perform detailed evaluations once-a-year, and re-evaluate every quarter when there are major changes to the business, such as new products, system implementations, or market changes. Regularly check accuracy of assessments using incident analysis.
Q. I think so, but in what way? Yes, but how?
Absolutely. Although the amount of control done varies according to the size of the organization, all businesses require the identification of risks, the basic controls and the monitoring of results. Begin by
Q. How does operational risk management affect employees’ productivity?
Eliminating time spent on workarounds and rework is achieved through good controls. Staff have good training, are effective and confident. Poor controls are placed (approvals that don’t need to be granted, bureaucracy etc.) the effects on productivity are symptomatic of poor control design, not of operational risk management.