The machine stops

On invisibility and tigers

It’s a periodic complaint – mostly among operational risk managers – that good operational risk management is invisible. The complaint becomes particularly sharp around budget time, when operational risk managers face sceptical superiors and embark on the task of explaining why their budgets are justified (a conversation that can all too easily recall the old joke about the tiger-repelling rock – “How do I know if it’s working?” “Seen any tigers recently?”)

This is especially true for the infrastructure of operational risk management – the software and systems on which the financial industry ultimately depends. This month, our annual software rankings list the providers to whom the industry turns for operational risk and compliance management, led by IBM, Chase Cooper and SAS. Tight budgets haven’t stopped financial firms investing heavily in compliance software, but they have meant far closer scrutiny of the implementation, providers say.

We also hear from Diana Chan, chief executive of central counterparty EuroCCP – one of the “system risk managers” described by the Bank of England’s Paul Tucker in a recent speech. The drive towards central clearing makes the role of the CCP ever more important, and an operational risk failure could have system-wide consequences.

As could, for that matter, an infrastructure problem with more sinister roots – as well as online criminals, banks and other companies now face a rising threat of attack from enemies with motives other than gain, such as online activist groups and even nation states. This month, we look at how they can protect themselves. The UK government has classed some banks and the interbank payment system as ‘critical infrastructure’ from the point of view of online defence – putting operational risk management in the financial sector into the ‘invisible and essential’ category for the economy as a whole. More attention from the authorities will mean, or should mean, more attention by individual companies – at least it should also mean that the case for increased operational risk management spending will be easier to make.