Operational risk at a crossroads

Just where is operational risk going? This is the question that, in one form or another, seems to be dropping from the lips of most executives in the field these days. People are clearly worried.

I certainly think it has hit a crossroads. The 'founding fathers' of Basel II tried to "let a thousand flowers bloom" and not be very prescriptive in how they structured their regulatory guidelines. This was for a good reason – it is a new discipline, and they wanted to let innovation carry the day. But now, it seems, there is real concern that op risk has hit a wall. Those who tried to implement Basel II as best they could have, in many cases, wound up with software that is out of date, data they don't understand, and policies and procedures that overlap considerably with both audit and compliance.

Some op risk people are leaving the industry, while others are looking for other risk disciplines to shift into. Others are nailing their colours to programmes such as Six Sigma, Coso and Business Process Improvement.

What is the answer? One consultant I spoke to says the industry has suffered because those who shifted into op risk roles four or five years ago came from either risk management or audit backgrounds, and generally tried to apply their previous job's methodologies to op risk. For example, self-assessments and KRIs have come out of an audit approach. Risk management executives focused on collecting data and modelling it.

I agree with the consultant – who happens to be Ali Samad Khan – that op risk doesn't really fit neatly into either of those two boxes. As a discipline, it has proved to be difficult and unwieldy. The recent report from the Basel Committee on Banking Supervision on how banks are handling the advanced measurement approach – which showed that there was little consensus on anything having to do with op risk – simply underscored what many op risk executives have come to understand is the nub of the problem.

Fresh thinking is needed on op risk measurement and management.

While I'd not really encourage throwing the proverbial baby out with the bath water – a lot of interesting and useful work has been done – I think that it is the duty of operational risk managers to now set aside the issue of Basel II compliance and ask... what next?

Perhaps it is time to stop borrowing from other disciplines and take an approach that can evolve from the ground, up. What is the core difficulty in measuring operational risk? How can we apply people and technology to solve that difficulty without suffocating the business? How can op risk add value?

I will not pretend to have the answers. But I'd like to throw that question out to the industry and see what people have to say.

Have a good month!

Ellen Davis, Editor