Operational Risk Management (ORM) in Financial Services

Operational risks present extreme complexities to mitigation strategies due to diverse and volatile risk factors that span multiple aspects such as technology, people, policies, and external factors.

For instance, the sheer availability of data can give rise to challenges in data processing, privacy, security, etc., leading to the risks of data theft or misuse. The ongoing need to adopt new/disruptive technologies to keep up with the evolving market can also spawn unique risk scenarios concerning cybersecurity and technological breakdown.

Operational risks can result in substantial financial losses, damage to reputation, penalties, and customer dissatisfaction. This blog discusses the types of operational risks and challenges to managing and mitigating them to ensure stability and resilience.

Types of Operational Risks

Operational risks can be categorized into various types such as the following:

1. IT/Technology Risks

IT disruption is a serious risk today where cyberattacks have become more advanced and IT failures a common sight. This risk relates to disruptions in technology infrastructure, such as system failures, data breaches, Wi-Fi/VPN failures, and ransomware attacks.

The financial services sector witnessed a staggering 238% increase in cyberattacks during the pandemic, and this threat has persisted into 2022

2. Regulatory Violations

The ongoing risk of non-compliance can result in significant penalties and reputational damage. Staying ahead of the ever-evolving regulatory landscape and ensuring that the processes align with the latest compliance requirements can be daunting. The following add another layer of complexity, making it further challenging to maintain a comprehensive oversight:

• Financial products and services offered by institutions
• Operations in multiple regions and geographies
• Data privacy regulations such as GDPR

3. Human Error

Human error, including mistakes, misconduct, and negligence, can significantly increase operational risks that can lead to failures and implications such as:

• Internal process failures
• Compliance and regulatory breaches
• Technical or systemic glitches
• Financial losses
• Data breach
• Reputational losses

4. Fraud

Banks are dealing with more people using online banking. In the digital world, online financial services are essential, but they also come with a risk of fraud and theft. The ease of online/digital banking creates opportunities for various forms of fraud, including:

• Phishing
• Identity theft
• Transactional fraud
• Card skimming
• Account takeover
• Unauthorized transaction

Fraud and theft typically arise from weaknesses in internal controls, processes, and systems. It can lead to financial losses and adverse impact on the reputation and the banks’ or financial institutions’ bottom line.

In 2022, digital fraud attempts have gone up by 24% compared to last year.

5. Employee Wellbeing

Employee well-being is one of the top operational risks and concerns for financial institutions. Many employees are stressed due to uncertainty. Burnout is becoming common, and it can be difficult to balance work and life.

According to a survey, 62% of financial employees want to change careers, mainly because of a bad work-life balance. That’s despite 77% feeling supported by their employer last year.

This situation poses a challenge for companies. If not handled well, organizations might face a higher risk of losing their staff.

4 Common Challenges in Operational Risk Management

Following are some Intrinsic challenges financial institutions may encounter in operational risk management.

1. ORM-ERM Alignment

The alignment between the ORM-ERM is a critical challenge that financial institutions often face when it comes to managing operational risks.

Operational risk management specifically addresses operational and compliance risks. It comes under the ERM umbrella and focuses on things that are non-financial and can have a financial impact. While ERM addresses risks across the organization with a much broader perspective. Lack of alignment between the two can lead to the following challenges:

• Risk silos that can cause blind spots
• Duplication of efforts leads to inefficiency and increased cost
• Lack of unified view leading to ineffective decisions
• Compliance issues
• Reduced resilience
• Inconsistent and unclear reporting/risk communication

2. Diverse Risk Types

Operational risk comprises numerous diverse risk types, each with varying characteristics, and impacts, requiring specific mitigation strategies. These risks range from technology and compliance risks to human error and fraud. As a result, they can create challenges for the ORM initiatives, such as:

• Overwhelming multiple and complex assessment
• Understanding the interconnectedness between the risks and their interaction
• Prioritizing resources for risk mitigation and response for each risk type
• Regulatory compliance due to diverse regulations for various risk types
• Data analytics and management
• Risk transfer considerations

3. Fluid Roles Definitions

The roles of the operational risk function and other oversight groups, such as compliance, financial crime, cyber risk, and IT risk, have not been clearly defined, leading to:

• Overlaps and confusion
• Unclear accountability
• Risk oversight gaps
• Compliance issues
• Difficulty in identifying and training the right individuals
• Issues with allocating resources effectively
• Disruption and delays in reporting

4. Skill Gaps and Lack of Resources

Skill gaps and lack of resources also pose a significant challenge to financial institutions when it comes to effectively managing operational risks in their line of business. They may arise due to a limited resource pool and struggles related to employee retention.

Insufficient resources and expertise can lead to:

• Failure to identify and assessing potential risks
• Ineffective risk controls and mitigation strategies
• Inability to use data-driven insights for risk management
• Impede adoption and utilization of technology and specialized risk management solutions
• Increases training cost due to limited resources

5 Key Strategies for Effective Operational Risk Management

Financial institutions must adopt a multifaceted approach to navigate the complexities of operational risk management. Here are key strategies for effectively managing operational risks:

1. Robust Internal Controls

Banks must establish strong internal controls and processes to minimize the occurrence of errors or fraudulent activities. This may involve:

• Implementing segregation of duties
• Regular audits
• Fraud detection systems

It is also important to test the internal controls to ensure their effectiveness.  To learn more, refer to our previous blog on 10 Best Practices for Internal Control Testing in Banking.

2. Avoid Unnecessary Risks

It is critical to continually evaluate and minimize avoidable operational risks. For this, financial institutions need to have a thorough understanding of potential risks. They also need to prioritize those based on potential impact and likelihood. To achieve this, it is important to enable employees through:

• Clear policies
• Compliance measures
• Ongoing training

It is also important to ensure a positive relationship between the risk and returns. Financial institutions should evaluate and eliminate processes that do not reward the organization but solely incur unnecessary risk.

3. Data and Real-time Analytics

Replacing subjective controls and self-assessments with real-time risk indicators and targeted analytics is crucial.

Advanced analytics, including machine learning, coupled with dashboards can significantly improve the detection of operational risks and reduce false positives.

Examples include:

• Anti-money laundering
• Employee conduct
• Cyber risk management
• Fraud analytics
• Process quality monitoring

4. Employee Training and Awareness

Financial institutions should recruit individuals and develop specialized expertise in managing different types of operational risks, such as cyber risks, fraud, etc.

To minimize human errors, financial institutions need to ensure continuous workforce training, educate their employees about potential risks, and provide them with the necessary tools and knowledge. This will also help identify and report risks promptly.

To achieve this effectively, financial institutions can consider digital learning and knowledge management solutions such as Fluent to train their workforce and build hands-on execution capabilities within a few weeks to months.

5. Incident Management Plan

Banks should establish robust incident management and business continuity plans to ensure a swift response to any operational disruptions. These plans should outline the steps to be taken in the event of an incident and specify the roles and responsibilities of key stakeholders. These include but are not limited to the following:

1. Preparation
2. Detection/Identification
3. Containment and eradication
4. Documentation and reporting
5. Recovery
6. Post-incident review

Conclusion

In an era where the financial landscape continues to evolve at a rapid pace, financial institutions must enhance overall operational resilience by prioritizing employee training, establishing robust internal controls, and continually refining processes to minimize the occurrence and impact of human errors and other operational risks.

Anaptyss as a strategic partner helps financial institutions with innovative solutions to identify and mitigate operational risks and strengthen resilience. By partnering with Anaptyss, financial institutions can gain access to cutting-edge technology and a team of experts dedicated to managing enterprise risks and boosting operational resilience.