Observations on the impact of coronavirus on op risk management

The operational impact of coronavirus

In many organisations business continuity and crisis management functions operate within the remit of the operational risk management umbrella.¹ The spread of coronavirus (COVID-19) is delivering a unique stress on operations and business continuity plans themselves. Whilst the enactment of plans has been enough to maintain operations up until now, there are some fears going forward. A concern for the future stems from a common assumption within continuity strategies that one site or one location is affected, for example a single office. However, due to the global spread of the virus, there is impact in most locations which is far more challenging.

Firms acting ahead of goverment guidance

The operational impact has been huge, with many banks and insurers implementing proactive measures ahead of any formal government guidance. A commonly adopted initial strategy was to limit intra-company risks by segregating teams,² and to operate remotely where possible.^3,4 Branches have also been closed in significantly affected areas^5,6, and as within the wider world, specific coronavirus cases have led to evacuation of sites,^7,8,9,10 including even those of regulators.¹¹ The crisis is testing the operational resilience of firms and how well they function in a principally digital way.¹²

There has also been a significant impact on relationships with clients with many banks starting to waive fees, cut loan repayments, defer mortgage payments, with a particular focus on providing relief to small companies and households.^13,14,15,16

Starting to think about the longer term

Beyond business continuity, operational risk is now actively thinking about how their organisation’s response is changing the nature of their risk profile, and how to best manage risk within the “new normal”. There is a focus on if and how changes to operations and established control environments may be exposing institutions to increased risks, particularly in a period of instability. This could take many forms including both internally driven events such as data breaches, internal fraud and other conduct risks, and externally driven events such as cyber-attacks or identity theft.

Complying with rules & regulations

There are also concerns over the ability banks will have to comply with rules on regulated activities, for example when are traders working from home,¹⁷ and the ability for wealth managers to interact with their clients in a timely way.¹⁸ This is coupled with a period of significant market volatility, and increased trading volumes, conditions often associated with operational risk events.

Regulators like the rest of the world are beginning to operate more flexibility and remotely – for example the planned 2020 EU-wide stress test is now postponed until 2021¹⁹ and it is possible some other regulatory initiatives may also extend deadlines,²⁰ and in some cases virtual interactions with supervisors is happening for the first time.

Collecting & categorising op risk loss data for coronavirus

ORX members are also starting to think about collection of data – how to accurately and consistently attribute costs to the crisis, and what the potential future capital consequences will be. The data is extremely important to actively learn lessons and, in the future, have an accurate assessment of the true impact of coronavirus. To support this, some institutions have begun to review their pandemic scenarios to understand the adequacy of them in relation to the coronavirus.

ORX is facilitating an ongoing industry dialogue

To support our members in this period of extreme stress we are hosting weekly calls where senior operational risk individuals can discuss significant issues and exchange good practice with peers globally. Each call will focus on a specific topic and a short summary will follow for those unable to attend.

ORX is continually assessing how we can add further value and support our community through this challenging time, and I will keep you updated on the progress in future blogs.

Don't go it alone

ORX is founded on the principle of bringing financial organisations together to share data, experiences and ideas, and it's exactly at times like these when working together is definitely more valuable than working alone. We've already refocused a lot of our activities to be of the most value possible to our community during this time, and will be continuing to do so.

Find out more about joining ORX's op risk community

Links & references

1. Operational Risk: The Umbrella Function, ORX
2. Wall Street banks planning to separate Tokyo teams on virus fears, FT (paywall)
3. Japan shuts all schools to combat coronavirus, FT (paywall)
4. Coronavirus: Google asks all North American staff to work from home – as it happened, FT (paywall)
5. Coronavirus, Bper chiude filiali Codogno e Sesto San Giovanni, Adnkronos
6. Some bank branches shut by virus, korea joongang daily
7. Visa locks down floor in London HQ because of coronavirus exposure risk, QZ
8. HSBC evacuates over 100 from Canary Wharf HQ after employee contracts coronavirus, CityAM
9. UK banks step up support to coronavirus-hit customers, Reuters
10. Coronavirus: Google asks all North American staff to work from home – as it happened, FT (paywall)
11. ECB tells staff to work from home in coronavirus test, Reuters
12. Reimagining Operational Risk, ORX
13. Coronavirus: HSBC and Standard Chartered among Hong Kong banks to waive fees, cut loan repayments for small businesses, individuals struggling amid outbreak, SCMP
14. Coronavirus: Banks to allow customers to defer mortgage payments, BBC
15. UK banks step up support to coronavirus-hit customers, Reuters
16. Coronavirus: Google asks all North American staff to work from home – as it happened, FT (paywall)
17. Banks seek trading rule guidance as coronavirus spreads, FT (paywall)
18. Wealth managers ask rich clients to stump up more against loans, FT (paywall)
19. EBA statement on actions to mitigate the impact of COVID-19 on the EU banking sector, EBA
20. Operational Resilience: Impact tolerances for important business services, Bank of England