What is Operational Risk?
Operational risk encompasses the uncertainties and dangers encountered by a company while conducting its routine business operations within a particular sector or industry. Classified as a form of business risk, it arises from internal process failures, human errors, and system malfunctions, as opposed to issues caused by external factors like political changes or economic fluctuations, which constitute systematic risk affecting entire markets or segments.
Furthermore, operational risk falls under the category of unsystematic risk, distinctive to specific companies or industries.
Understanding Operational Risk
Operational risk pertains to the methods employed within an entity rather than the inherent traits or outputs of an industry. These risks are linked to deliberate choices concerning organisational functioning and its priorities. While these risks don’t necessarily lead to failure, reduced output, or increased expenses, their severity is contingent upon internal management choices.
Being rooted in human-made protocols and cognitive processes, operational risk essentially embodies a human factor, signifying the peril of business operations failing due to human mistakes. Sectors with limited human involvement usually exhibit lower operational risk.
Senior management often assumes the responsibility of overseeing operational risk by understanding existing risks and the corresponding strategies to mitigate them. While lower-level field managers are more immersed in daily operations, it remains crucial for senior management to supervise their activities to ensure effective implementation of operational risk strategies.
Operational risk varies across different industries and holds significance when evaluating potential investment choices.
Levels of Risk
Businesses often assess risk by categorising the probability of an event occurring as highly probable, probable, possible, improbable, or highly improbable.
A probability greater than 90% characterises the “highly probable” category, while “probable” encompasses a range consistently exceeding 50%. These percentages guide management in deciding the optimal approach when weighing the cost of mitigation against the potential cost of an adverse outcome.
4 T’s of Risk Management
The four T’s of risk management are commonly referred to as:
- Tolerate. Management chooses to accept a specific operational risk without taking any immediate action to prevent it.
- Terminate. Management is unwilling to tolerate any degree of risk associated with a particular activity and opts to cease that activity entirely.
- Treat. Management implements specific strategies to reduce the overall potential risk.
- Transfer. Management intends to engage in an activity but looks to delegate the associated risk to a third party (e.g., by purchasing insurance).
Causes of Operational Risk
Operational risk is usually caused by: people, processes, systems, or external factors. In handling operational risk, businesses must try to minimise risks within each category to the best of their ability, knowing that some level of operational risk may persist despite their efforts.
People
Operational risk caused by people can emerge from either deficiencies or shortages among employees. For instance, a company might lack personnel equipped with the necessary expertise to resolve specific issues. Conversely, inadequate staffing levels might hinder the company’s ability to effectively manage peak seasons or busier periods throughout the year.
To address these risks, companies may opt to recruit from the market to fill staffing gaps. However, this approach introduces new operational risks, such as identifying suitable candidates, providing adequate training, and maintaining high employee retention rates. Given the resource and time-intensive nature of each of these factors, these risks are closely linked to financial consequences.
Processes
Each company operates with its unique set of processes. For instance, the processes of a vehicle manufacturer differ from those followed by service-oriented law firms. Nevertheless, all companies entail a series of steps that must be executed in a specific sequence; deviating from this sequence could result in adverse consequences.
Usually, particularly within businesses that have encountered significant employee turnover, they lack establishment or documentation of procedures. Furthermore, some processes are susceptible to exploitation through collusion or inadequate internal controls, posing a risk of financial loss to the company due to theft.
Systems
Increasingly, companies are depending on software and systems to run their operations. Operational risk includes the possibility of these systems being outdated, insufficiently configured, or improperly set up. Also, performance contributes to operational risk, as there is a likelihood that one company’s systems may not be as effective as those of a competitor.
There are operational risks that extend to the technical aspects of systems, encompassing bugs or technical issues that are more susceptible to cybercrime. Systems also have limitations in capacity, and a company may be at risk by overloading its systems with excessive expectations.
External Factors
Operational risk often arises externally to a company, stemming from various sources such as natural disasters disrupting a company’s shipping or political shifts imposing limitations on operations.
These external risks vary. Some fall under specific categories like geopolitical risks, while others are inherent to business operations, like a third-party failing to fulfil a contract.
7 Categories of Operational Risk
The aforementioned four causes can be elaborated into seven key operational risk categories, which include the following (without any specific order):
- Internal fraud involves employees collaborating and often working together to bypass internal controls and misuse company resources.
- External fraud refers to outside parties attempting bribery, theft, forgery, or cyberattacks against the company.
- Technology failures encompass deficiencies within computer systems, hardware, software, or the interactions among these components.
- Process execution relates to management’s incapacity to effectively evaluate a situation, implement the appropriate strategy, or failure to execute a correct strategy.
- Safety concerns encompass violations or risks of violating workplace safety measures, whether they are physical, mental, or otherwise.
- Natural disasters include adverse weather conditions, fires, or harsh winter conditions that endanger physical assets and disrupt employees’ ability to carry out their daily tasks.
- Business practices involve operational activities that may harm customers, disseminate misleading information, encourage negligence, or inadvertently fail to comply with requirements.
Evaluating Operational Risk
Evaluating operational risk involves two primary components: key risk indicators (KRIs) and data.
KRIs are measurable metrics that a company sets to gauge risks. They are usually quantifiable, providing a tangible means for companies to track and evaluate performance.
For example, a company might establish a KRI stating that no more than three vendors should default on contracts to maintain a high level of creditworthiness among partners. Throughout the year, the company monitors progress toward this KRI, investigates any deviations, and implements necessary measures to mitigate associated risks.
The second crucial element is data. Absence of relevant data prevents a company from assessing whether KRIs are being met or falling short. To address this, companies often establish robust data collection methods, employing automation, third-party surveys, financial reports, or industry data.
Regarding KRIs and data, some companies may have predefined operational risk areas worth monitoring. For instance, banking regulations might mandate specific processes, cash reserves, or systems. In such cases, predefined benchmarks ease operational risk assessment since KRIs are already established.
How to Manage Operational Risk
Although companies have the liberty to select their approach in dealing with these risks, here are four ways commonly employed to manage operational risks.
Steer Clear of Avoidable Risks
It’s essential for companies to consistently assess whether they’re exposing themselves to risk without commensurate rewards. For instance, the scenario involving vendors who might default on contracts. If there are other vendors with superior credit histories available, working with less reputable vendors could pose a risk to the company.
Similar to investing, there is a direct correlation between risk and rewards. When companies assume more risk, they should expect higher returns as compensation. Therefore, companies can mitigate operational risk by eliminating processes that don’t yield rewards but instead generate unnecessary risk.
Evaluate the Cost-effectiveness
Businesses can effectively handle risk by consistently assessing cost-effectiveness scenarios. Similarly, businesses need to navigate risk by weighing the advantages they accrue against the risks they undertake. Rather than focusing solely on risk factors, this approach involves being mindful of the company’s gains.
For example, a company might opt to venture into a global market. While this may carry considerable operational risk, thorough research and an untapped market could render the business expansion’s rewards far surpassing the operational risks.
Entrust Decision-making to Higher-level Management
In order to ensure optimal decision-making, it is advisable for top-level management to steer the course when addressing operational risk. These leaders often possess extensive knowledge of the company and grasp broader strategies that can work effectively.
In the scenario mentioned earlier, assigning the decision-making process for international expansion to a senior management figure is recommended. This executive should collaborate with various teams within the company to gain comprehensive insights into logistical, legal, procurement, and shipping risks. Such a significant responsibility is not suitable for an individual at a lower level.
Anticipate Potential Risks
An important factor in risk management involves anticipating potential risks. This foresight enables companies to proactively determine whether to accept, mitigate, or avoid risk.
In the context of expanding internationally, a company can conduct extensive research to understand geographical constraints, political risks, or variances in consumer preferences within the market. The initial step towards acknowledging or handling risk is to foresee potential risks and prepare strategies to tackle them.
Operational Risk vs. Other Risks
Operational Risk vs. Financial Risk
In the corporate realm, financial risk pertains to the possibility wherein a company’s cash flow might be insufficient to fulfil its commitments, specifically its loan repayments and other financial obligations. This insufficiency could be associated with managerial choices, particularly those made by finance professionals within the company, as well as the performance of its products.
However, financial risk is delineated from operational risk, primarily because of the company’s use of financial leverage and debt funding rather than the endeavours to ensure the company’s profitability.
Operational Risk vs. Market Risk
Market risk denotes the risk to fluctuations in the prices of financial instruments. These price changes are commonly influenced by investor disposition towards a company’s stock, interest rates, and economic conditions.
While market risk predominantly pertains to investments and securities, operational risk is more centred on a company’s internal functioning, including its resources and people.
Operational Risk vs. Strategic Risk
These two categories of risks might overlap in specific areas, but the primary distinction is that strategic risks usually pertain to the long run and often entail more involvement of external entities.
For example, a new competitor in a market is a strategic risk, while the company’s approach to this situation is an operational risk. Moreover, the competitor might have opted to enter the market due believing that their operational risk could be lower compared to other companies.
Managing operational risk involves identifying, assessing, and mitigating these risks through various strategies, including implementing robust internal controls, improving processes, investing in risk management systems, providing staff training, and developing contingency plans to address potential disruptions. It’s an integral part of overall risk management within an organisation to ensure its smooth functioning and resilience against unforeseen events.
DISCLAIMER: This article is for informational purposes only and is not meant as official corporate advice.