How can you prioritize operational risks to address the most important ones first?

What do you do for revenue? Build widgets? Fix widgets? Sit in a home office and email about widgets? On your worst day - is whatever risk you are taking to generate revenue worth the potential costs on your absolute worst day? Can people blow up? Or just lose money? What risk management resources are available? Insurance? Contracts? What factors can you not control? Then consult with knowledgeable subject matter experts to help set yourself up with success from legal perspective. For example - what contracts should you have (or not have). No contract is almost always better than a bad contract.

To prioritize operational risk, organizations can do the following 1) Review 24-36 months of operational loss inventory and isolate incidents where financial and reputational losses were above a materiality threshold (appetite) and place them on a priority risk inventory. 2) Determine whether the above controls have been strengthened and reassess the likelihood of reoccurrence and impact. 3) Scan the external environment for significant operational risk events over the past 24-36 months. Add these to the priority risk inventory. 4) Add other risks deemed material (after discussion with technical teams/senior management) 5) Develop a focused risk management strategy to mitigate the priority risks & provide regular progress reports to mgmt.

First of all, the company must have a internal proceedure that guides the hazards identification and risks evaluation process, and this shall be based on the best practices of risk management. It is important to garantee that a multidisciplinary team is selected for perfom the Hazard identification and Risk Evaluation, and also it is important to have a formal sistematic to perfom this. Beyond that, the company's risk management proceedure has to stablished wich Risk Scenarios must be evaluated in quantitative assessment. The risk screening shall be carefully defined.

Operational risk has an impact on multiple areas like fraud, business loss, reputation, cost leakage etc This would mean that, it is to Co owned by every stakeholder and not just the prerogative of a Risk management team. Secondly, in addition to the past operational risk incidents which of course can give insights, there needs to be a predictive power of anticipating the unanticipated, especially with many advancements in ML modelling now. Integrating this into the business KPIs as well as cultural ethos of the firm, is also essential, since ORMG is essentially about People, Process and Systems coming together.

In operational risk management, the key first step is to thoroughly identify potential risks facing an organization, both current and future. This involves a comprehensive approach, using a variety of information sources such as historical data, internal audits, risk assessments, incident reports, customer feedback, regulatory requirements, and industry benchmarks. It's crucial to understand how these risks are interlinked with the organization's operations, considering both external (market conditions, competition, technology) and internal (culture, strategy) factors. Clear and consistent risk description is vital, as it helps in devising innovative and resilient strategies, turning challenges into opportunities for growth and stability.

During the risk assessments, beyond the risk classification, the multidisciplinary team will adress additional recommendations to ajust the risk level (to remove from intolerable region or to reduce risk level to ALARP). So, regarding this, it is healthy to classify risks scenarios before and after the recommendations are implemented. This will be important to help in decision process on wich recommendations should be prioritized.

Assessing likelihood is so difficult. Too many of us look at recent history to assess if an event will occur. When you have very low frequency of events, how do you prioritize that event ahead of another low frequency event? I have found that scenario analysis is a better tool or process to assess the impact of an event when compared with matrixes of likelihood and consequences. Then the various impacts can be assessed across a variety of areas (people, product, systems) and compared to the baseline objective or scenario. Once the scenarios have been examined then a scoring or prioritization can occur to help address which "risks" need more attention from decision makers.

To conduct a?practical operational risk assessment?businesses need to have a clear understanding of their operations, including processes, systems, and key stakeholders. They should also consider external factors affecting their operations, such as market conditions, industry trends, or geopolitical events. By gathering this information, businesses can identify?potential risks?and prioritize them based on their likelihood and potential impact.

Get a view on both operational and financial consequences of the key risks. Estimate financial impact of the operational risks. And most importantly manage them.

Assessing likelihood and impact can be based on pure guesses or it can be scientific, even though operational risk is still very abstract as compared to market and credit risk. In my experience, metrics are a great way to remove any subjectivity - they provide historical context and the ability to predict what may happen. It is difficult to define and be able to collect the appropriate metrics. However, it is better to start with something and refine it as time goes by than to think you would come up with the right set immediately.

In order to have appropriate solutions to mitigate operational risk, the Risk management officers “RMOs” need valuable data and tools to guide them where to focus on and the levels of these risks (high, medium, or low). Which tools? (1) Risk matrix: correlation and relationship between likelihood and impact to see the final level of risk. (2) Risk heat map: tools to define where RMOs need to pay attention to, risk areas of red colour needs to be deal with firstly. Notes: The final result of each type of risk at certain moment is the summary of risk level of risk indicators/ risk factors. So that the scoring mechanism and identification on all primary risk factors are material. Warm regards, Hannah.

In my experience, prioritizing operational risks is a collaborative effort. One can start with a risk matrix or heat map, however, prioritizing items of the same rank is generally best performed in conversation and collaboration with business leaders across business units. While often time consuming, it is a valuable exercise that is generally worth the resource and effort involved.

By far, the easiest way to prioritise Operational Risk is to classify them across two different axes: potential loss (low, medium, high) vs. likelihood (rare, likely, very likely). Then, give each discrete description a value from 1 to 3. Finally, multiply them: if an event is likely (2) with a high potential loss (3), the score is 6. If an event is rare (1) with a low potential loss (1), the score is 1. There you go: the highest the score, the highest the priority. You can play with the discrete categories and make them more sophisticated - the world is your oyster!

The prioritization of operational risks can be done not only in terms of impact and likelihood, but also based on the strategic goals of the organization.

One inherent drawback of heat maps is that they are subjective and based on judgement of the Operational Risk Manager. This may lead of bias in reporting the severity and extent of risk and its prioritization. To avoid the risk of subjectivity, both qualitative and quantitative data and analysis should be used. This will reduce the bias of qualitative judgement. Both positive and negative aspects of the risk must be identified, and a balanced scorecard can be used to measure performance and for value creation.

1) Operational environments evolve, new risks may emerge or existing ones may change in nature. Organizations should establish a robust system for ongoing risk assessment and management rather than treating it as a one-time activity. 2) Further, involving a diverse set of stakeholders in the risk identification process can yield valuable perspectives. Collaboration with employees at various levels, customers, suppliers, and industry peers can provide insights that might not be apparent from a solely internal analysis. 3) Additionally, organizations should consider scenario analysis as part of the risk assessment process. By simulating different scenarios, they can better understand the interconnectedness of risks and their cumulative impact

Risk Management in Digital space is most important in current time. This should be added as a separate section. In digital space, all financial or non-financial transactions are happening on-line. Risk weightage of each trans to be judged in relation to the client whom it relates. FRM tool comes here. The whole exercised starts from risk profiling of clients computed based on certain perimeters. Based on risk base of clients, FRM tool to allow "GO" or "NO GO" to each digital transactions. This will secure tolerable operational risk from the very origination. 2. Operational Risk compliance from Regulatory perspective is another critical factor, with zero tolerance.

Operational risks are sometimes very well defined in an organizations policies and procedures. The person who wrote them, trained on them and audited them leaves or retires and no clear plan was in place to proceed without them. Continuance strategies whether it be due to losing a key leader or dealing with a disaster of some kind is mandatory

The importance selecting a multidisciplinary team of experts and a competent team leader should not be overlooked. Team leader role is like an orchestra conductor to ensure that everyone in the team has opportunity to contribute and provide input leveraging their expertise of subject matter and organization and no one dominates by their position or personality. Risk reduction actions for risks outside of organization’s risk tolerance or appetite may also have a potential for unintended consequences. Always ensure that this risk trade off is positive in reducing the net risk and does not introduce other new risks. To be effective, Proposed risk reduction action(s) must consider feasibility, budgets, regulations and also company policy.

And don't forget the importance of designing, implementing and tracking truly forward looking KRI's. This will enable those in charge to act proactively and ideally avoid the risks. This also ties in to the importance of quantification (e.g. FAIR or similar) and system support for managing "the whole".