Operational Risk Appetite Practice Benchmark

The Operational Risk Appetite Practice Benchmark looks at operational risk appetite within the financial services industry to better understand its level of maturity.

Around 70 firms around the world took part in the study, which included a survey, consultations with participants and two roundtable events. We shared a full report of our findings with the participants, and they also received individual benchmarks comparing them to the other firms who took part. 

Headline findings

The industry has progressed in setting operational risk appetite

There has been good progress, particularly in the setting and governance and monitoring and reporting areas of operational risk appetite since we last explored it in 2013. Institutions have developed more holistic views on how to set their operational risk appetite. They've gained buy-in from the top and are more successfully monitoring and reporting on it. However, there are still some significant challenges shared by the participating firms, especially when it comes to implementing and embedding operational risk appetite.

Improved monitoring and reporting, but culture still a challenge

While we saw a definite improvement in the monitoring and reporting, it was felt that this might be masking the fact that many firms are still facing challenges with embedding operational risk appetite into their culture. A culture that embraces risk management, with employees taking risks aligned to the organisation's appetite will ultimately help in decreasing the instances of losses. Participants found cascading risk appetite throughout the institution and making it relevant to all areas of the business in particular to be a problem.

We need a common currency to enable forward-looking risk assessment

The industry still lacks a standardised measure or metric for capturing risk exposures that can be used across the business. The absence of a common currency that enables forward-looking assessment of risk, forces many to resort to using backwards-looking metrics, based on losses as the main top-level appetite measure. A common currency would provide the means to link, cascade or aggregate a measure within an organisation.

Consequences increase the effectiveness of operational risk appetite

Encouraging greater awareness and proactive operational risk discussions, and ensuring that there are consequences when risk appetite is not adhered to is key to effective operational risk appetite. Sound management decisions that are consistent with the operational risk should be rewarded. Firms need to identify who the risk-takers are and encourage the operational risk function to engage with them. This in turn will demonstrate their role within operational risk and make the risk-takers more accountable.