Risk–Reward Evaluation of Mitigation and Control Effectiveness

Rafael Cavestany and Javier Martinez Moguerza

In Chapter 11, we introduced the integration of the operational risk profile into the business plan and the monitoring of the plan execution using an operational risk appetite framework. Here, we examine examples of the evaluation of controls and mitigation plans that have an impact on the risk profile, which can be used for measuring the consumption of, and/or adjusting the risk limits defined by, the ORA framework.

The impact of the mitigation and controls on the risk levels, ORA, limits and so on should be evaluated, as they change the risk profile of the institution, which is measured by the operational risk capital model. Far too often, the operational risk analysis is single-sided, evaluating only the threats and potential losses. In this chapter we examine various examples of joint analysis of the risk impacts and the benefits of their mitigation.

The chapter is structured into the following sections, describing the risk–reward evaluation of the mitigation actions that can be included in an operational risk business plan:

• □

  “Insurance programmes: evaluation of their mitigation impact”;

• □

  “Risk–reward evaluation of the mitigation impact of action plans”;