Five lessons operational risk can learn from the pandemic

“From our position working with over 100 of the world’s most prominent banks and insurers, we wanted to offer some early thoughts on what firms globally can learn operationally from the coronavirus crisis. While our focus is operational risk in the financial services industry, we believe there are lessons from our findings that can be valuable for all functions in all sectors.”
Luke Carrivick, ORX Director of Research and Information

ORX recently published a report on the key lessons businesses can learn from dealing with the coronavirus (Covid-19) pandemic. Using our unique position as the world's largest operational risk association, we have been in regular conversation with operational risk experts from our global membership throughout the crisis. This has included discussion, analysis and guidance to help firms with their operational planning and to minimise the impact of coronavirus.

We've distilled the findings from the report into the top 5 lessons that businesses can learn from operational risk's response to the pandemic.

1. Focus on material, critical, high-velocity issues

An immediate, rapid, and agile response by firms – as well as being able to reprioritise quickly – was vital for maintaining operations during the initial stages of this crisis.

Our Director of Research and Information, Luke Carrivick, who was involved throughout the study told us that: 

“Agile is perhaps the most overused term in business, but here it really does capture how banks and insurers responded to coronavirus. From the outset of the pandemic, firms have needed to act fast, streamlining critical parts of the operational approach to operate more effectively. Thousands of employees had to be transitioned to remote working; employees needed refresher training in cyber security due to increased risk when working from home; and process and compliance documentation needed updating rapidly.”

It is clear from our findings that moving at speed was only possible with robust foundations. Knowing what was important and time-critical was an essential input into the response. These foundational capabilities, which included anything from experience and relationships to frameworks and data, allowed institutions to be resilient in the face of the disruption.    

2. Review changes and adapt to changing risk profiles

Whilst the need to do things quickly has accelerated the move to more efficient ways of working, not all changes will persist, and some may need to be rolled back as the dust settles. Being able to unwind changes that were made in response to the pandemic in an orderly way is vitally important. The first step to this is simply being aware of all the changes at an enterprise level. Within financial services, operational risk played a vital role in cataloguing changes and providing a view of their aggregate impact – allowing an agile but controlled response.

As we begin to emerge from the crisis, it is clear that the risk profile of many firms is changing. Firms now need to be thinking much more than they were about conduct, legal, reputational and people risk alongside more traditional concerns such as business continuity, fraud, cyber, transaction, information security, model, and third party risk. Financial firms are acutely aware of the importance of understanding how the changing landscape combined with their own response to the pandemic has changed their risk profile.

3. Effective collaboration between operational risk teams and business units

One of the key learnings of the coronavirus pandemic has been the way operational risk teams became active commercial partners, and not a passive control function that slows things down. The coronavirus crisis has brought the role of operational risk to the foreground. Rather than seeing the risk function as a hurdle to overcome, front line teams are now looking to risk colleagues for real-time data, and to support them with things such as working through scenarios and running workshops to identify critical processes. This concept of cross-function collaboration responses is a feature seen across many industries.

4. More scenario analysis is required

We found that scenario analysis – the tool that businesses use to assess a variety of future situations to understand their exposure to extreme and rare events – has been particularly valuable to deal with coronavirus. Although most existing scenarios were in no way severe enough, the expertise and experience institutions have accumulated for creating useful scenarios proved essential.

In our study, we found that while many organisations had a good understanding of how to use scenarios, few had scenarios that reflected the true severity of the pandemic. However, the fact they had established methodologies and extensive experience allowed them to rapidly conduct scenario analysis which supported business decisions during the pandemic.

Organisations need to invest in their scenario development for the future, as they will be more important than ever. As a discipline, it is a useful tool in many areas beyond just risk management.

5. People are the key

People risk will continue to evolve as organisations establish remote working norms. Teams that are less connected could underperform and employees could have less job satisfaction, with implications for loyalty and turnover.

The pandemic has also shown that the frameworks do not work without people. People, rather than processes, have been paramount; and business has continued, even if business continuity plans had not been designed to cope with a pandemic on this scale.

The crisis offers an opportunity to strengthen the risk culture across the organisation. The pandemic may be the perfect time to reinforce that a strong risk culture is not simply about compliance, but rather about behaviours that enable the business to prosper.