Journal of Operational Risk

Marcelo Cruz

Editor-in-chief

Welcome to the fourth issue of Volume 21 of The Journal of Operational Risk.

Financial institutions have never been short of data. Banks process millions of transactions on a daily basis, whether these be proprietary trades (or those executed for clients) or credit and debit card transactions. These transactions are duly recorded on bank and regulatory ledgers, so there is usually a large data set of historical daily transactions and settlement failures associated with transaction processing. Market and credit risk managers have long been heavy users of such data for the estimation of their respective risks. More recently, nonfinancial risk managers have started to pay closer attention to this data. Indeed, two of the papers in this issue use this information to estimate and predict operational risks in banks.

With the widespread introduction of artificial intelligence (AI) in financial institutions, and as organizations increasingly rely on AI systems to interpret large volumes of information and support decisions across their operations, operational risk managers are starting to use both rich transactional data and AI to perform operational risk analysis. By combining internal records such as transaction histories, incident reports and process data with external signals, AI can help identify patterns that may point to fraud, cyber incidents, process failures or supplier disruptions. This can make operational risk estimates more timely and detailed, helping organizations to see where exposure is growing or where controls may be falling short. Conversely, AI use can also increase the risk of misestimation: incomplete or inconsistent data, historical biases, changing operating conditions and black-box models can produce results that appear precise but do not reflect actual exposure; AI also creates risks of its own, including inaccurate or “phantom” outputs, overreliance on automation, and failures in the information technology (IT) or third-party services on which a process depends. Organizations therefore need to assess both the risks AI helps to measure and those introduced by using it, supported by reliable data governance, model validation, ongoing monitoring, human review and clear accountability. The editorial board welcomes submissions that discuss both the benefits and organizational risks of AI.

RESEARCH PAPERS

In the issue’s first paper, “An expert-validated risk assessment framework for bank IT supply chain management”, Merikh Ahadi, Eronimus Antonysamy and Kamran Morovati observe that the growing dependence of banks on complex IT vendor ecosystems has significantly increased exposure to third-party and IT supply chain risks. Grounded in principal–agent theory and transaction cost economics, their study develops and statistically validates a comprehensive risk assessment framework for bank IT supply chain management. The authors derived 108 risk factors from the risk literature, regulatory guidance and domain risk practices, and they translated these factors into a measurable questionnaire instrument. Their framework’s nine risk domains are explicitly mapped to the Basel Committee’s operational risk event categories, supporting integration with banks’ regulatory capital measurement processes. Expert data was then collected from 200 banking and IT risk professionals across public and private sector institutions. Ahadi et al show that all 108 identified risk factors are rated significantly above the neutral-importance benchmark (p < 0:001). These findings provide strong empirical support for their framework’s validity. The paper contributes a domain-specific, empirically validated and operationally usable IT supply chain risk model for banking institutions, advancing both principal–agent and transaction cost theoretical frameworks in the context of financial sector technology outsourcing governance.

In “Enterprise risk management and corporate financial outcomes: empirical evidence from Indian firms”, the second paper in the issue, Shubhangi Bedi, Keshav Malhotra and Meena Sharma examine the impact of enterprise risk management (ERM) practices on the capital structure decisions and firm performance of Indian firms listed on the Standard & Poor’s BSE 500 index. The authors’ analysis is conducted using panel data regression covering the period from 2015 to 2022. Their findings suggest that firms with higher ERM disclosure scores tend to adopt more conservative capital structures, indicating less reliance on debt financing and improved financial performance. These outcomes imply that effective risk management enhances transparency and reduces information asymmetry, thereby influencing firm-level financing decisions. The authors offer practical insights for managers, creditors and regulators by underscoring the strategic role of ERM in shaping financial policy. Their study adds to the growing body of literature on risk governance by highlighting how formal risk management practices affect financial architecture in emerging markets. To further address concerns regarding potential reverse causality between ERM adoption and financial outcomes, the study additionally employs a two-stage least squares instrumental variable approach, using the industry-year average ERM disclosure score as an instrument; the results of this robustness test corroborate the baseline findings.

Our third paper – “Can we predict settlement delays and failures? Transactionlevel evidence on liquidity and operational frictions” by George A. Krimpas, Nikolaos A. Krimpas, Spyridon D. Lampropoulos and Georgios L. Thanasas – investigates settlement failures and delays using transaction-level post-trade securities data. The authors research whether settlement frictions can be predicted ex ante and whether the timing of settlement completion reflects systematic liquidity and operational risk patterns. Using a logistic regression framework, they show that on-timesettlement failures are predictable using observable transaction characteristics and historical account-level settlement behavior. Their model achieves meaningful out-of- sample performance, with an area under the receiver operating characteristic curve of 0.764 and strong risk stratification across predicted-risk deciles. Using a Cox proportional hazards model, Krimpas et al further show that settlement timing varies systematically across transaction types, currencies and historical settlement behavior. Delivery-versus-payment mechanisms are associated with faster settlement completion, while certain transaction types and accounts with prior settlement frictions exhibit reduced settlement intensity. Robustness checks using gradient boosting and aWeibull duration model confirm the stability of the authors’ main findings. Overall, their results suggest that settlement failures and delays are not purely random backoffice events but contain economically meaningful information about both post-trade liquidity stress and operational and financial market infrastructure resilience.

FORUM PAPER

Finally, the issue’s fourth paper, “Operational risk and resilience in financial data infrastructure: a practitioner-research study of institutional risk systems and digitalasset benchmarking” by Lev Yatsemyrskyi, observes that financial systems are increasingly dependent on real-time data infrastructure, whose failures can propagate into risk estimates, benchmark values, trading processes, audit trails and service continuity. This paper reframes three recurring engineering problems – latency misalignment, data-normalization debt and input-layer observability gaps – as operational risk mechanisms. The study follows a structured practitioner-research design combining institutional experience with a live digital-asset benchmarking implementation and a separately collected high-resolution telemetry sample. The empirical implementation did not establish universal architectural superiority, but it did provide a transparent production case with 443 days of longitudinal evidence, 1.9 million persisted index observations, 30 completed scheduled rebalancing events, explicit incident records and high-resolution tail-latency telemetry. The conservative output continuity was 99.957%; the prospective full-cycle calculation latency had a median of 21.235 ms and a _{p99 of 92.700 ms, while external-request latency had a median of 99.312 ms and a p99 of 755.528 ms. Tail events and timestamp artifacts prove as informative as the headline averages because they reveal the conditions under which operational risk becomes visible. The broader implication of the author’s findings is that institutions should treat the data layer as part of the operational risk control environment. Freshness, integrity, lineage, transactional state, observability and recovery capability should be measured with the same discipline applied to downstream models and business processes. For AI-enabled financial systems, those infrastructure controls are a necessary complement to model-risk governance.}