Operational risk appetite
- 9 March 2018
Throughout 2017, we carried out a comprehensive study of operational risk appetite within the financial services industry to better understand its level of maturity. We ran a similar study in 2013, but since then a considerable amount has changed, so we wanted to get a snapshot of the current landscape.
What did we find out?
Around 70 firms around the world took part in the study, which included a survey, consultations with participants and two roundtable events. We shared a full report of our findings with the participants, and they also received individual benchmarks comparing them to the other firms who took part. We've summarised our key findings below.
The industry has progressed in setting operational risk appetite
There has been good progress, particularly in the setting and governance and monitoring and reporting areas of operational risk appetite since we last explored it in 2013. Institutions have developed more holistic views on how to set their operational risk appetite. They've gained buy-in from the top and are more successfully monitoring and reporting on it. However, there are still some significant challenges shared by the participating firms, especially when it comes to implementing and embedding operational risk appetite.
Improved monitoring and reporting, but culture still a challenge
While we saw a definite improvement in the monitoring and reporting, it was felt that this might be masking the fact that many firms are still facing challenges with embedding operational risk appetite into their culture. A culture that embraces risk management, with employees taking risks aligned to the organisation's appetite will ultimately help in decreasing the instances of losses. Participants found cascading risk appetite throughout the institution and making it relevant to all areas of the business in particular to be a problem.
We need a common currency to enable forward-looking risk assessment
The industry still lacks a standardised measure or metric for capturing risk exposures that can be used across the business. The absence of a common currency that enables forward-looking assessment of risk, forces many to resort to using backwards-looking metrics, based on losses as the main top-level appetite measure. A common currency would provide the means to link, cascade or aggregate a measure within an organisation.
Consequences increase the effectiveness of operational risk appetite
Encouraging greater awareness and proactive operational risk discussions, and ensuring that there are consequences when risk appetite is not adhered to is key to effective operational risk appetite. Sound management decisions that are consistent with the operational risk should be rewarded. Firms need to identify who the risk takers are and encourage the operational risk function to engage with them. This in turn will demonstrate their role within operational risk and make the risk takers more accountable.
What next for operational risk appetite?
From the consultations and roundtables we held with participants, we identified that research focusing on non-financial metrics would be very beneficial as the majority found this to be a a challenge. In particular how to make metrics forward-looking, meaningful and measurable as part of risk appetite. Therefore, we've now moved onto phase two of the project, which covers the characteristics of effective non-financial metrics used to express risk appetite.
Non-financial metrics could include key risk indicators such as those used to monitor complaint levels or levels of acceptable system downtime. In phase two we will:
- Define the characteristics of a good non-financial metric
- Compile an inventory of ‘good’ non-financial metrics from participant submissions
If you'd like to know more about our risk appetite work please get in touch.