Obfuscating Operational Risk Management

Operational Risk Management is continuing to evolve as a key component of an Enterprise Risk Management ("ERM") program. However, it continues to be an area of great debate as a formal discipline due to its broad focus and impact across the business. One area that confuses and frustrates many businesspeople when confronted with operational risk is the notion of risk appetite vs. risk tolerance. In some cases, the two terms are used interchangeably. However, in other cases, risk appetite refers to the total amount of risk to be taken to achieve a given business objective and risk tolerance refers to specific risk limits associated with a given business activity. The Institute of Operational Risk has developed guidance that is practical and useful for risk practitioners in dealing with these terms. Here's their view.

In simple terms, expressing Operational Risk Appetite is a question of defining what is acceptable to an organisation and what is not. This could be achieved by deciding, for each type of risk, what is acceptable, what is unacceptable, and the parameters of the area between those two (i.e. what is tolerable).

Regardless of the way these terms are used, the key for operational risk managers is to help businesspeople understand risk in their own terms rather than in risk management vernacular. Otherwise, the focus will remain on terminology rather than what is really important - creating value for the business.

ERM Growing as an Accepted Practice

This year, the US Securities and Exchange Commission instituted new disclosure rules requiring public companies to inform their shareholders about the role of the board of directors in overseeing risk management. A major US law firm recently reviewed annual proxy statements of S&P 500 corporations to determine the extent and nature of risk management across various industries. One of the more interesting findings in the review was the number of companies who are employing Enterprise Risk Management programs to help manage their risks. Here is what they reported.

In the wake of the financial crisis, many companies have implemented more comprehensive and integrated risk management programs, and boards of directors have expanded their risk oversight to encompass not just the legal and financial risks that audit committees have traditionally overseen, but also the full panoply of risks that a company may face.  Enterprise risk management (ERM) is the current buzzword applied to a top-down holistic approach to risk management.  It addresses all of an enterprise’s risks—including operational, financial, strategic, compliance and reputational risks—under one umbrella, in contrast to the more traditional “silo” approach in which each operating function or division tackled risk independently.  ERM is not focused simply on risk reduction.  Rather, it encompasses an assessment of both upside and downside risks and, thus, helps inform the strategic planning process.  Indeed, to make informed decisions about the company’s strategic direction, the board must have a full understanding of all of the major risks involved.

Fifty-four percent of surveyed companies expressly used the term “enterprise risk management.” Sample disclosures are set forth below:

American Express Company:  “The Company relies on its comprehensive enterprise risk management process (ERM) to aggregate, monitor, measure and manage risks.  The ERM approach is designed to enable the Board of Directors to establish a mutual understanding with management of the effectiveness of the Company’s risk management practices and capabilities, to review the Company’s risk exposure and to elevate certain key risks for discussion at the Board level.  The Company’s ERM program is overseen by its Chief Risk Officer who is an executive officer of the Company and a member of the Company’s most senior management.”

Express Scripts, Inc.:  “In order to assist the board of directors in overseeing our risk management, we use enterprise risk management (“ERM”), a company-wide initiative that involves the board of directors, management and other personnel in an integrated effort to identify, assess and manage risks that may affect our ability to execute on our corporate strategy and fulfill our business objectives.  These activities entail the identification, prioritization and assessment of a broad range of risks (e.g., financial, operational, business, reputational, governance and managerial), and the formulation of plans to manage these risks or mitigate their effects.”

With more than half of the companies relying on ERM, the review shows that ERM is growing as an accepted practice beyond just financial services companies. If your company is looking to implement or simply improve your ERM program, Wheelhouse Advisors can help. Visit www.WheelhouseAdvisors.com to learn more.

Reputation Is Everything

In last month's issue of Operational Risk & Regulation magazine, Goldman Sachs' operational risk management program and its focus on reputational risk was profiled.  The article focused on Goldman Sachs' use of scenario analysis in anticipating the magnitude of reputational risk events.  Scenario analysis exercises such as these are very useful tools to increase the risk awareness within an organization.  Here is a summary of Goldman Sachs' approach.

Goldman Sachs is using scenario analysis to study reputational risk, employing operational risk expertise within its broader risk management framework, according to its global co-heads of operational risk management, Spyro Karetsos and Mark D'Arcy.  The bank says it embraces events, even those creating more reputational risk exposure than financial risk exposure, into its framework.  "Franchise value is highly important within the organisation and managing reputational risk is a by-product of that," says Karetsos, who is based in New York. "While it is not our responsibility to quantify reputational risk, there is an internal process that measures our exposure to those risks that are difficult to quantify, one of which is reputational risk."

The timeliness of this story is ironic given the potential massive impact to the bank's reputation as a result of the fraud charges levied by the Securities and Exchange Commission on Friday.  Once the announcement was made, the bank lost close to $12.5 billion in shareholder value by the end of the trading day.  Whether that loss can be overcome remains to be seen.  However, it does prove that in business, reputation is everything.

More Risk Management Work Remains

A recent survey demonstrates the need for more work to improve risk management practices at financial institutions across the globe.  Results from the survey conducted by Deloitte show that while great strides are being made in strengthening corporate governance, the supporting risk management infrastructure at many institutions continues to be a work in progress.  The following are some significant findings from the survey of 111 financial institutions across the globe.

• Seventy-three percent of the institutions surveyed had a Chief Risk Officer (CRO) or equivalent position. As an indicator of the role’s importance, the CRO reported to the board of directors and/or the CEO at roughly three quarters of these institutions.


• Only 36 percent of the institutions had an enterprise risk management (ERM) program, although another 23 percent were in the process of creating one. Among institutions with $100 billion or more in assets, 58 percent had an ERM program already in place. The institutions that had ERM programs found them to be valuable: 85 percent of the executives reported that the total value (both quantifiable and non-quantifiable) derived from their ERM programs exceeded costs.


• Roughly three quarters of the institutions had fully completed or substantially completed the work required to identify operational risk types, and to standardize the documentation of processes and controls for operational risk. Yet, only roughly 40 percent of executives considered their operational risk assessments and their internal loss event data to be well-developed. Other operational risk methodology areas, such as key risk indicators, external loss event data, and scenario analysis, were said to be well-developed by 20 percent or less of the institutions surveyed.


• Many institutions may have significant work to do to upgrade their IT risk management infrastructure. Roughly half of the executives were extremely or very satisfied with the capabilities of their risk systems to provide the information needed to manage market and credit risk. In other areas, such as systems for liquidity risk and operational risk, 40 percent or fewer provided ratings this high.

Wheelhouse Advisors is well equipped to address risk management challenges such as these.  Visit www.WheelhouseAdvisors.com to learn more.

Breaking Down the Silos

Last week, Wheelhouse Advisors participated in a webinar hosted by OpenPages that examined some of the root causes of the current economic crisis associated with operational risk management, and how operational risk management can be leveraged for strategic advantage moving forward.  John Wheeler, Managing Principal at Wheelhouse Advisors, described how operational risk management is the one discipline that binds all the other risk disciplines together in a truly successful enterprise risk management ("ERM") program.  Mr. Wheeler discussed the following strategies for risk professionals to improve their operational risk management program and, in turn, increase the overall effectiveness of the ERM program.

•Simplify & Streamline

1. Eliminating redundant activities


2. Adopting common methods / terminology


3. Coordinate efforts across functional silos

•Develop an Active & Consistent Dialogue

1. Frame conversations in relevant terms (e.g. discuss underwriting and documentation improvements as it relates to improvements in credit quality)


2. Meet on “their turf” to develop greater understanding and buy-in

•Measure & Monitor

1. Agree on a few key risk indicators


2. Monitor relentlessly

The webinar provided much more information about how to use operational risk management practices and supporting technologies to manage risk in a cost-effective manner that will translate into a major competitive advantage.  To learn more about how Wheelhouse Advisors can help your company, visit www.WheelhouseAdvisors.com.