The First Line of Defense in Operational Risk Management – The Perspective of the Business Line

The Basel Committee wrote in its update of the “Principles for the Sound Management of Operational Risk” in June 2011 that the frst line of defense is business line management. This underlines the continuous development from (ex-post) operational risk controlling to (ex-ante) operational risk management. From the point of view of a business line, this “active” operational risk management can be achieved by reuse of concepts from quantitative quality management together with a fundamental understanding of the underlying “power law” characteristics of operational risk loss distributions. In an integrated cycle, !ve steps are combined. 1. Definition of an operational risk strategy (to accept and manage, to reduce, to mitigate, to avoid) and awareness for specifics of operational risk. 2. Measurement of operational risk (loss distribution) with special regard to the asymptotic tail of the distribution and the limits of measurement. 3. Analysis of measured operational risk indicators with consequences for the business line. 4. Management process for the implementation of improvements along the whole hierarchy. 5.'Controlling of results achieved by the business line management and, respectively, critical review of the fundamental assumptions of the entire approach. This “active” approach to operational risk management takes into account that a business line such as transaction banking with, for example, more than four billion high-volume payment transactions and more than seven million international and high-value transaction per year brings along operational risk generically, which has to be managed starting from “the frst line of defense.” Consequently, the essential success factors are a broad understanding of the fundamental features of operational risk, open communication, and a permanent learning process for staff and management of the business line.