Chapter 4: Operational, Financial, and Strategic Risk - Review (Part 1 - Operational) Flashcards
(16 cards)
Basel II definition of operational risk
“The risk of loss resulting from inadequate or failed internal process, people and systems, or from external events”
ISO 31000 definition of operational risk
“Any event that affects an organization’s objectives”
Four Basel II categories of operation risk
People
Process
Systems
External events
People as a category of operational risk
(Basel II operational risk)
- Typically includes all employees, as well as contractors, vendors, clients, and other groups
- Most risks are hazard or other types of insurabel risks, but other types of risky conduct (ex. rogue trading) may not be insurable
- Risks related to opportunities that managers or employees do not take are also not insurable (ex. refusing to customize a product or service)
- Errors during course of business can lead to significant cost
Process as a category of operatoinal risk
(Basel II operational risk)
- Typicall includes procedures nad practices organizations use to conduct business activities
- Manging thes risks involves a framework of procedures, and method to determine when practices deviate from these procedures
- Procedures should represent best practices designed for quality and safety of products and employees
Systems as a category of operational risk
(Basel II operational risk)
- Involve risks associated with technology (equipment and software)
- Evolution of technology lead to greater recognition of operational risk
- However, equipment failure may represent hazard risk as well as risk for continuing operations
External events as a category of operational risk
(Basel II operational risk)
- Include natural disasters (ex. windstorms or earthquakes) that can result in property damage and business interruption
- Loss of key supplier can create operational risk
- Utility failures or inadequacy (ex. overload of an electrical system) can result in loss of business
What are KRIs?
Key Risk Indicators (KRIs) are a risk management best practice to determine operational risk
How can Risk Indicators be used to help manage risk and prevent loss?
- Risk management is most effective when issues are managed before a loss occurs
- Root cause analysis is helpful but may be too late to prevent a catastrophic loss
- Analyze near misses or incidents prior to loss - those issues can then be removed or managed
- KRIs should be leading rather than lagging
Three operational risk classes
People
Processes
Systems
5 risk indicators for people
(Operational risk class)
- Education
- Experience
- Staffing levels
- Employee surveys
- Management experience
5 risk indicators for processes
(Operational risk class)
- Quality scorecards
- Analysis of errors
- Areas of increased activity
- Review of outcomes
- Internal and exernal review
5 risk indicators for systems
(Operational risk class)
- Benchmarks against industry standards
- Internal and extenral review
- Analysis to determine stress points and weaknesses
- Testing
- Monitoring
How are exposure indicators used to monitor operational risk?
- Exposure indicators (i.e. metrics used to identify risk inherent to operations) are integral to operations
- Organizations have data available regarding exposures, which can be used to identify exposure indicators
- Ex. insurers track losses and can benchmark loss ratios to industry results
What are control indicators and how can they manage operational risk?
- Control indicators (ex. metrics to identify an organization’s management of risk) provide information about management
- Ex. insurers can develop control indicators regarding claims management - indicators such as claim representative, claim volume, and skill level can provide indicators about management of claim offices
Using the example of a staffing agency, how would an organization evaluate how a control indicator affects outcomes?
- Agency could chart the number of complaints received from clients and the experience level of employees assigned to those clients
- If there is a correlation in the above, the agency could analyze the trend
- If a trend is confirmed (i.e. more complaints against less experienced employees), the agency could decide to benchmark employee experience against others in the industry
- Risk indicators: 1) complaints correlated to experience, 2) average experience of employees is decreasing and is lower than industry average, 3) number of complaints is increasing
- Through these KRIs, the agency identifies an issue of decreasing experience and can manage the issue
