Navigating Operational Risk in Banking

Operational risk is a risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. It includes legal risk, but excludes strategic and reputational risk. Operational risk management has always been a complex function for banks. Today the scope of regulatory compliance and risk management has become much broader, and the potential impact of non compliance is significantly high.

The risk function at banks is evolving from being a number crunching function to a more dynamic business enabler, focusing on risks arising from complex products, diversified operations, diverse workforce, multiple channels, and regulatory compliance at regional and global levels. Operational risk has come to force since 2001 when it was recognized as a distinct class of risk outside credit and market risk, by Basel II.

Though the Basel committee proposed some approaches to measure operational risk, their level of sophistication varies across banks. This is also because operational risk is the most complicated risk type, when it comes to risk quantification, identification, and mitigation. Operational risk is highly dynamic in nature and is impacted by numerous factors such as internal business processes, regulatory landscape, business growth, customer preferences and even factors external to the organization. It is founded on the premise that a bank, independent of outside factors, will fail to meet one or more operational targets in a given year.

Operational Risk and its management has garnered substantial attention since the mid1990s as a consequence of banking crises resulting from human error, fraud and/or missing controls (e.g. Barings Bank, Daiwa Bank and Allied Irish) and due to the intent of the Basel Committee on Banking Supervision since 1999 to introduce a new regulatory capital charge for Operational Risk in addition to the minimum regulatory capital requirement for credit and market risk.

Further, technology and increased product complexity has led to a greater focus on the management of Operational Risk rather than its mere measurement.