by : Lawrence Richter Quinn
The concept is so simple; so why
are so many people, including shareholders, having such a hard time getting
their heads around the phrase "operational risk" or "op
risk" - the risk of loss from any operational failure at a company?
Not only are they having a hard
time understanding it, the vast majority of stakeholders have never heard the
term - even though a great a great number of finance specialists say
extraordinarily poor management of operational risk (not other categories of
risk, such as market, liquidity or credit) is exactly what led to the collapse
of global financial markets starting in 2007. (Read about the financial crisis
that struck in 2007 in The 2007-08 Financial Crisis In Review.)
That is exactly why investors and
other stakeholders need to get up to snuff on operational risk as quickly as
possible. If they don't, there's every reason to expect other financial
implosions to follow.
The Impact Of Op Risk
What may surprise stakeholders is
that a number of financial experts say poor operational risk management has
been the underlying cause of every major financial services loss over the past
two decades - including this past year's $180 billion-plus bailout of American
Insurance Group (AIG) and well-publicized fiascoes such as those at Barings,
Long Term Capital Management (LTCM), Allied Irish Bank-All First, Societe
Generale, Bear Stearns and Lehman Brothers.
Even more surprisingly, the
finger pointing doesn't stop there. Any number of additional significant upsets
at "non-financial" companies - everything from Union Carbide's
chemical leak in Bhopal, India years ago to JetBlue's massive ticketing and
route scheduling failures to accounting-related fraud at Cendant and Bausch
& Lomb - can be attributed to operational risk management failures.
"Until investors and all
stakeholders - John Q. Taxpayer, corporate board members, 'C-suite' executives,
shareholder activists, ratings agencies, analysts, regulators, even legislators
- understand this risk and how to measure and manage it, there is no way to
guarantee that we won't face future financial meltdowns as big as, or bigger,
than the most recent one," says Ali Samad-Khan, founder and president of
Stamford Risk Analysts (a recent rebranding of OpRisk Advisory) in Connecticut.
"Coming to terms now with
operational risk must become a strategic imperative for organizations in all
industries, not simply for financial services giants."
Bolstering the view that stakeholders
must understand the importance of operational risk is a just-released study
from the Society of Actuaries, the Casualty Actuary Society and the Canadian
Institute of Actuaries called A New Approach for Managing Operational Risk:
Addressing the Issues Underlying the 2008 Global Financial Crisis.
"Regulators and other key
stakeholders (e.g., rating agencies) need to take an active role in calling for
improved ORM practices," the report notes. "Historically, ORM has
taken a back seat to the management of the other major risks, which are often
defined as market, credit, insurance and strategic risk and sometimes include
'liquidity,' 'legal' and 'reputation' risk … This has not only caused
operational risk to be underestimated, but has also obscured the underlying
causes of many of the most significant financial losses."
Just What is "Operational
risk"?
So how do we define operational
risk? On its face, it sounds enormously simple: the risk of financial loss from
any operational failure. But "operational failure" encompasses a
dizzying array of possible events, actions and inactions - everything from
inadvertent execution errors, system failures and acts of nature to conscious
violations of policy, law and regulation. Of course, it also encompasses the
greatest of all faux pas: direct and indirect acts of excessive risk-taking.
It's exactly this depth and
breadth of issues and "cross-silo" concerns that has lead to ongoing
confusion about exactly what is and isn't an operational risk - and continuing
doubts about how to identify and manage it. For instance, too often op risk has
been misdiagnosed as other, relatively newer areas of recognized exposures such
as those involving IT security, supply chain and business interruptions.
As a result, some corporate managers
argue that op risk simply doesn't exist - that it is nothing more than existing
risks by a newly-invented name - or that, if in fact it is a legitimate,
separate exposure, the amount of operational risk they face isn't significant
enough to merit a specific and separate measurement and management system.
Typically, executives at non-financial organizations advance these views -
pointing out, for instance, that they don't run complex trading operations or
have the related balance sheet concerns faced daily by the world's banking,
energy and commodity firms.
Finally, that op risk has been
recognized formally by the regulatory community as a legitimate issue only
recently (and then, by financial services regulators exclusively), hasn't
helped encourage active recognition or management of it. That acknowledgment
came in 1999, when the Basel Committee on Banking Supervision, a global
financial services firm, highlighted operational risks as a distinct potential
bête noire..
Much Ado About Nothing?
Many stakeholders might view
discussions about whether op risk exists, what it is, how it differs from other
exposures, and if and how it can be managed as academic. It's easy to dismiss
the debate thinking that, whatever its merit, it has no bearing ultimately on shareholder
value, reputation, governance or related concerns.
But op risk proponents say it's
not so. Those who don't acknowledge their own op risks are simply setting
themselves up for future devastating material failures and losses.
Indeed, they say, the seeming
minutiae of operational issues can quickly spin out of control into a major
balance sheet and stakeholder concern. One example comes from Norm Parkerson,
executive director of advisory services at Grant Thornton in Atlanta, who
points to a recent unanticipated op risk loss suffered by one of his own
clients. In this case, a manufacturing company introduced a new product covered
by a warranty reserve based on its own historical data. Unexpectedly, a
manufacturing problem - an operationally-related risk - generated warranty
claims far exceeding the warranty reserve booked on its balance sheet. The
result: a loss of well over $100 million.
"This happened rapidly and
the impact was far reaching," says Parkerson. "Not only was there an
impact to the financial statement; there was an adverse impact on the
manufacturing process, the quality assurance process, the procurement of raw
materials, the ability or inability to fulfill customer orders, and the
company's reputation."
Managing Op Risk
Unfortunately for stakeholders,
no models exist where they can turn to management and boards and ask: "How
effectively are you managing op risk - for instance, against X, Y or Z?"
In fact, banks and insurers
acknowledge that they don't know if their op risk management endeavors to date
have been successful.
The SOA's report says "Many
financial firms have spent millions of dollars hoping to improve their
management of operational risk, but those initiatives do not appear to have
achieved their desired objectives. Developing an effective method of managing
operational risk is proving to be a daunting task."
Meanwhile, stakeholders remain
far more exposed than they realize.
"Organizations that choose
to remain blissfully ignorant of the importance of operational risk will continue
to operate under a false sense of security," says Samad-Khan. "They
will remain 'under-controlled' in areas where they have the most risk and
significantly 'over-controlled' in areas where they have the least risk. So
without addressing op risk head on, recognizing and understanding it and
acknowledging the crucial role it plays, we face the prospect another global
financial crisis in the not too distant future."
The Bottom Line
Operational risk remains a controversial topic, but by whatever name you call it, the risk will not dissipate by being ignored. While managing op risk may be a daunting task, it is one of utmost importance to companies and shareholders alike.
