The Biggest Challenge to Operational Risk Management
Wednesday, September 05, 2007
Posted in: Risk Management
While at the recent Institute of Internal Auditors (IIA) Risk and Control Conference in San Diego I remembered what Ken Wooten, our Director of Product Management had to say about operational risk management last month. Here it is:
The Global Association of Risk Professionals (GARP) completed a survey of risk professionals in the area of Operational Risk. The survey asked risk professionals a series of questions around their current initiatives and challenges, and I thought some of the findings were very interesting.
The first question was “What is the largest challenge tied to operational risk?”. The top two responses were “Risk Measurement” and “Data Integration”. Together they accounted for almost 70% of the responses.
Now I would argue that these are two sides to the same challenge. Effective risk management can only occur when all of the systems containing relevant data are integrated. Once a consolidated view of the environment exists, only then can operational risk be identified and measured. Before the existence of ERP and other integrated business applications, the same challenge existed in the realm of financial risk. For most organizations the data exists for meaningful quantitative financial risk measurement, but so far this is not the case for operational risk.
Further supporting this notion is another question from the survey. It asks “In terms of measuring and managing risk, my firm uses:”. Fifty-two percent of the respondents indicated that they use “disparate systems”.
The good news is that organizations have come to the realization that this is important and are beginning to address the problem. A major first step for most companies is just understanding what they need to measure. Once they get past that, they face two major challenges. The first is the integration itself. The second is that fact that much of the information needed to quantify operational risk does not exist in any system with which to integrate. There is a myriad of manual tasks, piles of paper, scattered spreadsheets and documents that all must be considered.
So the fact is that this is not just an integration challenge, but that additional systems will likely be needed to consolidate this data before effective Operational Risk Measurement is possible.
Ken's thoughts here echo what I heard from IIA conference delegates in San Diego.