CURVY ROAD AHEAD – OPERATIONAL RISK MGMT.

Banks need to manage many different risks every single day. While most probably think about credit or interest rate when "risk" is mentioned, risks can be just as substantial. The banking industry has evolved over time, however and practices such as outsourcing, loan servicing, account processing, greater reliance on technology, rising complexity of financial products and managing multifaceted strategies can all increase bank risk. These types of risk fall under the regulatory classification of operational risk, which has only recently begun to see much regulatory scrutiny. This is not because operational risk was previously unimportant, but rather because regulators found it a difficult risk to measure. While operational risk is admittedly in early development stage at many banks, incorporating it into an enterprise-wide risk management framework has become much more important over the years. Specifically, operational risk (according to the regulators) is the risk of loss due to inadequate or failed internal processes, people, systems, or from external events. Operational risk management has become much more important as banks rely on technology and automated processes to drive their business units. When banks used manual processes, errors were usually confined to areas where a given employee worked. These days, breakdowns in controls, errors in software code and other technological problems can have devastating effects on bank performance. To measure this risk, bankers need to begin systematically collecting operational loss data. While many banks currently lack such data, starting now is important. Banks can begin by clearly defining risk exposures and identifying the causes of and controls for their losses. This will give management a process to begin more effectively integrating decisions about risk-taking into strategic and tactical decision making. To be meaningful, the quantification of operational risk must also be forward-looking. While models will not guarantee an effective risk management process, bankers should work to continuously improve data integrity and internal controls. Categorizing risks into buckets based on the type of event and the business line in which the event might occur is a great start and is how many banks are currently beginning to track operational risk. To be effective, operational risk management should include quantitative and qualitative components that identify, measure, manage and control risk throughout the bank. Those still not a believer in the importance of managing operational risk may want to consider a few more factors. In so doing, management is provided information to allow it to make better risk-and-return decisions, thereby enhancing the return on their bank's capital. By including operational risk as part of any assessment of capital requirements and profitability, executives begin to create a framework around business lines. Having a good handle on operational risk by business line helps executives decide where increased resources may be needed and where risk may exceed reward. At the very least, over time bankers can include operational risk factors into pricing decisions, strategic planning processes, portfolio management and when making decisions regarding incentive compensation. Additionally, managing operational risks can reduce losses (by surfacing control weaknesses), improve customer satisfaction (fewer errors and issues with customer service) and retention. Note that a recent survey found more than 60% of banks now have an operational risk management function, compared to about half that number just 2Ys ago. Operational risk management is critical, so expect regulators to increase their focus in this area in upcoming exams. Drive safely as you approach the operational risk curve just up the road.