An Operational Risk Paradigm Shift: Tracking the Velocity of Change

D. R. Maurice and Jitendra Rathod

Operational risk tends to be considered as a catch-all risk category. It is defined broadly as anything that is not credit or market risk. Given the evolution of financial services, which continues to emphasise technology gains, this traditional definition does not recognise that all risks are increasingly integrated. Consequently, a failure to appropriately define operational risk more generally also suggests that the corollary to risk identification – risk mitigation – may also fall short. Operational risk addresses a range of flawed operations that, since the financial crisis, have at its root failed processes. Process-orientated flaws such as data breaches resulting from, for example, a distributed denial of service (DDoS) reflect system flaws but also deliberate human actions.

In addition, capturing risks associated with malicious actions may require risk managers to consider enhancements to traditional methods of risk identification, management and remediation. Preventative and defensive controls, and other tools focusing on measuring and avoiding process risk, may be inadequate. In this rapidly evolving environment, the risk management standby of building repeatable