Operational Risk (3): Risk & Control Assessments

Objective

Performing an assessment

• A third party review, which uses a central understanding of critical objectives and processes together with an independent validation of assessments.
• Facilitated assessments (conducted by an outside consultancy, risk management and business managers), which uses the central understanding to identify and agree the business risks with the business.  The effectiveness of internal controls is also documented and action plans are agreed where necessary.
• Self assessment (conducted by the business managers), which uses the detailed knowledge of people in the business to identify the business risks and to agree on their monitoring.  As with facilitated sessions, control effectiveness is also assessed and action plans put in place to enhance ineffective controls.

The three methods of operational risk assessment above have an increasing level  of business benefit although these are balanced by an increasing level of  process sophistication. In particular, a self assessment (being conducted by the business itself) gives the best platform for cultural change. (It should be recognised that most firms will, necessarily, go through a period of cultural change whilst embedding operational risk management into the structure and decision making of the firm).

Possible methodologies

• Workshops, which can be very effective and efficient in a firm that is open to discussion and challenge. However, the drawback is that a first risk and control assessment generally takes a full working day to complete and it is therefore necessary for all workshop attendees to be absent from their desks for the day.
• Interviews, which work very well in a firm that is used to one-to-one discussion of issues. Interviews are relatively inefficient as a certain amount of iteration is necessary in order to obtain agreement on the risks and controls. They are nevertheless effective when an entire cadre of staff cannot be spared or is not available for a full day workshop.
• Questionnaires, which can be easy and quick although these generally need strong management and significant communication skills in order to achieve a cohesiveness to the wide ranging results that can be a consequence. Good design of the questions is fundamental to obtaining an outcome that has business benefits. This is often harder than it may appear as risks, control failures and indicators can easily become confused in the mind of the person answering the questionnaire.

Why do assessments go wrong?

There are a number of reasons why risk and control assessments go wrong. At a high level, these include cultural issues, administrative hurdles and value perception.

1. Cultural Issues

Another common cultural issue is the lack of support from senior management for the risk and control assessment process.  This is often characterised by a lack of attendance by senior management at risk and control assessment workshops or by sudden departures after 30 minutes or 1 hour. Alternatively the firm’s appraisal or review mechanisms may not take into account good (or bad) risk management by the employee being evaluated.

A further typical cultural issue is the use of operational risk management to reduce risk rather than managing it appropriately to the organisation.  Some firms aim for a perceived level of best practice, whereas operational risk management should be focussed on managing risk at a level suitable to the firm’s size and substance.

2. Administrative Hurdles

3. Value Perception

Carrying out assessments

1. Level
The level at which an assessment is to be carried out should first be decided.  Many organisations first look at the major processes undertaken and assess the risk and controls over these.  Other organisations leave the major process risks until the strategic risks and controls have been assessed.  This second practice has the advantage that the major processes can then be placed into the context of the business objectives and their risks and controls, rather than trying to back fit the process risks into the strategic level at a later date.  The other major advantage of starting with the business objectives as the first level risk drivers is that there is rapid buy-in from the most senior management in the firm as they are responsible for achieving the business objectives and any obvious assistance is always appreciated.

2. Approach
Risk and control assessments can be carried out at using two different assessment approaches which can also be combined. The most common starting point is to assess the risk after the controls (i.e. after taking into account the mitigating effect of the controls). This is known as net or residual risk assessment. However, losses generally occur after controls have failed and therefore net risk assessment by definition does not give any values for the likely loss that the firm will suffer when the risk event occurs. Only values for ‘expected’ losses are measured. This problem can be overcome with the use of gross risk assessment followed by an assessment of the controls. The risk is assessed before taking into account the effect of any controls imposed by the firm, as these will have failed when the risk occurs.

3. Enhanced Approaches
As a firm progresses along the risk and control assessment path, it sometimes combines the above two approaches by assessing risks at a gross and net level as well as assessing the mitigating controls. Often an assessment of the risk at a ‘target’ level (i.e. after any remedial action) is also made. In any of the approaches, the action plans for enhancing the perceived defective controls are also identified. The owner of each action plan is identified together with a brief description of the plan, its expected completion date and any cost involved.

4. Owners

5. Scoring

The scale for likelihood is linked to the likely rate of occurrence of the risk and that for design and performance is linked to the likely failure of the control.  However, the impact scale requires some thought as different firms use different impact criteria such as the impact to annual revenues, three year plan profits or the share value.

6. Cause, event and effect

7. Control assessment

Monitoring assessments

There are varying levels of sophistication in risk monitoring, even when simple concepts such as heat maps are involved. The first figure below shows the drawbacks of using fixed values for the boundaries of the impact and likelihood. A risk can be categorised as a major risk (because it falls within that square) even when it is calculated as a minor risk (and therefore requires significantly less attention).

2. More flexible heat map with varying boundaries (click image to see enlarged view)

Tables and radar charts are also becoming more sophisticated and the reporting article later in this series will contain further details of risk assessment monitoring.

Software tools

• Purpose built risk and control assessment software that focuses mainly or solely on risk and control assessments using any methodology (sometimes together with process mapping and action plans);
• Questionnaire based products that are focused on completing the assessment through questionnaires;
• Analytical tools that are mainly based around complex mathematical algorithms; and
• Fully integrated operational risk products that capture risk and control data as part of an overall approach to operational risk involving indicators, losses and modelling as risk, controls and action plans.

The choice of tool will depend on how comprehensive an approach is required by the firm.  However, it is easier to buy a comprehensive tool and grow into it than it is to change software part of the way through an operational risk management programme.  There are a number of points to consider when implementing operational risk software:

• fit with the firm’s business culture: select software that works in the same way as the firm, e.g. if the firm generally uses workshops and brainstorming, do not select a questionnaire based tool;
• fit with the firm’s IT culture: support will be required from IT so ensure that it is involved early in the process; and
• fit with the firm’s risk culture: software that focuses on controls is not going to work well if the firm is committed to a combined risk and control assessment.

Summary