Operational Risk Management

We view risk management as an integral part of good management. Risk management should take a balanced view of decision problems encompassing all significant risks and rewards. Operational risks are only one type of risks and therefore are only one piece in the jigsaw puzzle that only makes sense when all pieces are assembled. All risk analyses are based on the same general principles - generation of alternatives, quantification of uncertainties and preferences, modeling of consequences - but factors deserving the most attention vary from problem to problem. We distinguish three broad types of operational risks according to the frequencies of loss events: nominal, ordinary and exceptional. Depending on the type, uncertainties are negligible, similar or very large compared to expected losses. Nominal risks are the province of Total Quality Management, a well-developed discipline, but perhaps better known in manufacturing than in financial services. The analysis of ordinary and exceptional risks is illustrated by case studies from which we draw general lessons. With ordinary risks, it is crucial to understand the interaction among risks and with costs and rewards; risks do not add up, indeed operational risks may sometime reduce other uncertainties. With exceptional risks, we show the importance of quantifying the risk attitude of a financial institution in order to arrive at rational decisions such as mitigation or transfer of risks.