What are the best practices for operational risk management in banking?

The most basic aspect on Risk Appetite is to understand the strategy and have reliable data base to set metrics and thresholds for a unique and effective tolerance monitoring.

A different perspective; articulated risk appetite can be seen as the sum of what we do. Unwanted results, or behavior, we should do less of, thereby reducing risk (appetite) as the organization learns (matures) from its mistakes (events).

Don't do it - it's a complete fallacy. Ask yourself some questions like: "How much poison am I prepared to drink?" "How many fingers am I prepared to lose doing this?" and you'll realise what a ridiculous concept Risk Appetite really is

Here are some of the reasons why defining risk appetite is important: 1. It helps banks to align their risk management activities with their overall business strategy: When banks have a clear understanding of their risk appetite, they can better prioritize their risk management resources and focus on the risks that are most important to them. 2. It helps banks to make better decisions about risk taking: When banks have a defined risk appetite, they can better assess the potential risks and rewards of new business opportunities and make informed decisions about whether or not to pursue them. 3. It helps banks to communicate their risk tolerance to their stakeholders.

The risk framework is the the thread that ties all aspects of risk management together. Without it, elements would be carried out in silo without meaning and without impact. Simplicity, transparency and accountability are fundamental here. Risk ID, assessment, measurement, monitoring, reporting and governance are all crucial.

There are at least five crucial components that must be considered when creating a risk management framework. They include risk identification; risk measurement and assessment; risk mitigation; risk reporting and monitoring; and risk governance.

Begin with risk identification, systematically assessing potential threats to processes, technology, and personnel. Quantify risks using tools like Key Risk Indicators and Loss Distribution Approach. Develop mitigation strategies and control mechanisms. Implement regular monitoring and reporting procedures, integrating feedback loops for continuous improvement. Clearly define risk ownership and responsibilities, aligning with organizational objectives and regulatory requirements. Regularly reassess the framework to adapt to evolving risks and market dynamics.

During my time as Head of Business Risk for a division at HSBC, we relied on a combination of inputs. Ideal scenario is to have as many automated sources which do not require data manipulation and interpretation. RCSAs were not dynamic and needed significant analysis. KRIs, loss events, near misses, regular participation/discussion with peers from across different functions helped the most. It's also important to be mindful of and get access to thematic issues which arise that can impact your coverage area.

Start by identifying internal sources like inadequate processes, human errors, and system failures. External sources may include regulatory changes, market volatility, and geopolitical events. Conduct thorough risk assessments by analyzing historical data, utilizing scenario analyses, and employing control self-assessment. Assess risks related to technology, fraud, and compliance. Human factors, such as talent management and organizational culture, are also crucial sources. Regularly update risk assessments to reflect the dynamic banking environment.

The senior management of a banking business firm is responsible for identification and assessment of risk. The senior management must ensure that the operational risk inherent in all of the firm's products, activities, processes and systems is identified and assessed to make sure that the inherent risks and incentives are well understood. Qualitative risk analysis is quick but subjective. On the other hand, quantitative risk analysis is objective and has more detail, contingency reserves, it takes more time and is more complex.

As risk detectives, our task is to uncover the potential threats lurking beneath the surface. Think of it as searching for hidden treasures – in this case, potential operational risks. From internal nuances like people and processes to external factors like market events, we scrutinize every nook and cranny. It's not just about seeing the dangers but understanding them. Like a skilled investigator, we use a mix of methods – interviews, data analysis, and scenario playbooks – to unravel the mystery and gauge the risks' likelihood and impact.

I have created and shared a KRI cheat sheet for banks and financial services. There are number of metrics that can be used. But the target should be to use whatever is meaningful to your department or organisation, for the information to be automated where possible, understandable without manipulation, and available to all relevant stakeholders.

Utilize Key Risk Indicators (KRIs) to track specific metrics indicating potential issues. Implement the Loss Distribution Approach for statistical modeling of potential losses. Regular stress testing evaluates resilience under adverse scenarios. Control self-assessment engages internal stakeholders for real-time insights. Continuous monitoring ensures dynamic risk assessment. Develop risk dashboards for visual representation. Regularly update risk assessments based on emerging threats and industry changes.

The fourth step in ORM is risk monitoring, how well control measures are working in reducing operational risk over time by assessing how successful they have been at preventing losses or accidents from occurring in specific areas of operations or departments within an organization.

There should be a detailed and well thought plan incorporating the responses mentioned i.e. avoidance, reduction, transfer etc. A differentiator would be to have an outlined response mechanism similar to a flowchart for the deltas that have not been accounted for. This playbook would help an immediate and well known response to a risk event that had not been accounted for - which happens quite often. It would also enrich future assessments and contribute to a strong learning path for the organisation.

Mitigating and controlling risk impact in operational risk management within banking involves a multifaceted approach. Implement robust internal controls and automation to reduce human errors. Diversify portfolios to minimize concentration risk. Establish contingency plans and business continuity strategies to navigate disruptions. Invest in advanced cybersecurity measures to counter technological threats. Foster a strong risk culture through employee training and awareness. Regularly conduct scenario analyses to identify vulnerabilities and refine mitigation strategies. Maintain adequate capital reserves to absorb potential losses.

Mitigating and controlling the impact of operational risks is a critical aspect of operational risk management. Operational risks can arise from various sources, including human error, technology failures, process weaknesses, and external events. Risk Assessment and Identification: Regularly assess and identify potential operational risks within your organization. This involves conducting risk assessments, analyzing historical incidents, and considering emerging threats. Risk Mitigation Strategies: Develop and implement risk mitigation strategies specific to identified risks. These strategies can include process improvements, redundancy, automation, and enhanced training.

Now, armed with our risk intelligence, it's time to build our fortress against potential storms. Picture it as a game plan against pirates trying to plunder our financial ship. We employ a range of strategies – risk avoidance, reduction, transfer, retention, and recovery. It's not just about weathering the storm; it's about minimizing the damage and ensuring our ship stays afloat. Developing and testing contingency plans is our version of practicing fire drills, ensuring our crew knows exactly what to do when the alarm rings.

It's important to regularly benchmark and keep up-to-date with best practice. Equally a conscious effort should be made to enable time to review lessons learnt and case studies. At most banks time isn't made for these activities but they are important to develop a proactive risk culture and environment as opposed to a reactive one.

Es importante comprender que el sistema de gestión de riesgo operacional es un ente en permanente cambio y actualización. Por lo anterior, las mejoras son constantes y las oportunidades de mejora estarán siempre al alcance de la mano.

Risk awareness in form of training. Conducting simulation test of past incident is also a way to look back on any missing risk components that can added at the same time creating the risk mindset.

An intersection of risk type and business / functional area of focus, prioritized based on the business environment is critical when fulfilling this life cycle of risk management activities. When too linear, the steps are not agile enough, so the cycle needs to be performed on a micro level and aggregated for macro level insights / risk decision making.

Operational risk management in banking involves cultivating a strong risk culture and governance structure, systematically identifying and assessing risks through methods such as scenario analysis and key risk indicators, and implementing robust risk measurement, reporting, and mitigation strategies. Banks should prioritize incident management, establish business continuity plans, and effectively manage third-party risks. Ongoing training and awareness programs for employees, compliance with regulatory requirements, and a commitment to continuous improvement are essential components.

I’ve witnessed leadership teams be very challenged in quantifying risk appetite in a way that aligns the strategy, mission and values with actual outcomes. This is an example of when ERM doesn’t align to strategy and mission. One of my regulatory interactions that illustrates this is in the following discussion: Q: you’re strategy says you want to make financial lives better and be the top bank in US banking. But your customer sat metric has a “we are winning” and satisfactory at 70%? Are you really okay with 30% mediocre or not happy? How are you winning? An effective ERM program will kick the tires to ensure all of the elements work together. The inform and feed each other to tell the C-Suite and the board if everything is working.

For sure, where there is risk there is opportunity. Good project management process should keep you in check but it’s really hard to have IT management formalize their project processes so that they are followed and efficient.