All financial services are subject to operational risk. The OTC derivatives markets have certainly experienced their share.
How do you find operational risk? You go out and look for it. You just have to know what you are looking for.
Operational risk is not necessarily what its name suggests. Some think it should include all risks other than credit and market risk. Some think it should be limited to back office problems. Others prefer a more neutral definition recently suggested by an industry-working group--the "direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events."
Depending on the definition, operational risk can cover a wide range of problems throughout the front, middle and back office. There is certainly an argument for a broad definition of op risk, as often losses are due to multiple factors--a narrower definition might exclude an important element. Whatever the definition, what matters most is that firms measure their effectiveness in controlling this risk against some defensible benchmark.
However you define it, there's no escaping it--few major financial services firms have escaped significant losses from op risk. Recent estimates of losses from this sort of risk have varied, but all have been alarmingly high, some in the range of USD7 billion per annum just for financial institutions.
LOCATING OP RISK
Locating potential op risk can be difficult, because there are so many relevant factors, many of which become identifiable only in retrospect. Op risk often occurs when firms operate at or beyond the limits of their abilities or during periods of rapid change. Firms can become vulnerable when they fail to properly assess all the risks of running a business or creating a new product. They may not have the right kind of staff to handle the new challenges. They may push the employees to meet aggressive revenue targets, without providing the right checks and controls or without questioning above market returns.
A list of general op risk indicators follows. However, each separate business line within a firm should develop its own specific indicators.
For the OTC derivatives business, some indicators might be the number of unsigned confirmations and master agreements, infrastructure expense, frequency of model adjustment, legal fees and actual losses and related causes, including front office execution error, faulty confirmations, model error, back office problems and others.
Firms are only now looking at op risk on a firm-wide basis, and some firms have yet to embark upon this early stage in the creation of an effective op risk program. Doing so can be a challenge for many reasons, including funding, internal politics and lack of clarity from regulators. Another important difficulty is data constraints. Much of the data that a firm would need is not readily available or cannot be obtained in a consistent or systematic way across all businesses. Even if there is data, models must be designed, tested, calibrated and refined.
MANAGING THE RISK
Once a firm has developed a plan for op risk, it can begin to manage it. A firm may be willing to take on greater op risk in some businesses and shed it elsewhere. Some changes will require relatively simple fixes, such as adding more staff and tightening controls. Other changes will involve long-term investments, such as building systems, reorganization or the purchase of businesses which provide portfolio diversification. Still further changes may be more fundamental, such as transforming a firm's culture or strategy. Indicators and analysis are only useful if they result in action.
INDICATORS OF RISK
Finding op risk requires careful observation, creative interpretation and a thorough knowledge of an organization. Since op risk is often hidden, it has to be diagnosed by induction and examination of observable indicators.
There are many such indicators. Here are a few that are universal to most businesses.
* Staffing volatility. A stable staff can often cover gaps with their institutional knowledge and good working relationships. In contrast, changes in staffing, whether additions or turnover, can pose numerous organizational and cultural challenges for firms, and may signal the potential for increased risk related to systems, processes, people and procedures. New staff members require training, which may be inadequate or non-existent. Moreover, the loss of staff members at the senior level (or just below it) can leave an organizational with a gap in its leadership ranks that cannot be easily replaced. Often the effect of staffing turnover is not fully realized until years later. Indicators of staffing volatility include staffing growth rates and turnover.
* Age and experience of employees. Older workers have greater life experience than younger workers. The additional judgement that comes with age and experience can affect the incidence of fraud, operations error, customer disputes, reputational damage and other issues. Experience can be particularly significant in technical areas such as analyzing or building complex valuation models. Indicators for this issue include composition of staff by age and job experience.
* Educational backgrounds. More highly educated professionals may be more effective in dealing with complexity and ambiguity. They may be more inclined to exercise discretion and judgement than automatically following rules to the letter. Indicators here include years and type of education.
* Abnormal revenue patterns. Abnormal or aberrant rates of revenue growth may indicate that businesses are stretched beyond their capacity for controlled and orderly growth. Firms often make the mistake of growing the revenues first and addressing the infrastructures and controls afterwards. Indicators of abnormal revenue patterns can come from rates of return for individual business units.
* Growth cycle of business. Firms should carefully watch the different growth cycles of their businesses. Greater op risk can often reside in new businesses. For example, models or methods used in existing businesses may not be adequate to evaluate the risks in new businesses.
* Scope of business. Some firms are in 10 distinct business lines, others 40. A wide and diverse range of products and services may (though will not necessarily) stretch the capacity and management of a firm. Indicators for scope of business risk come from the number of discrete business lines and products.
* Decentralization. Some firms are highly centralized, while others are structured as a portfolio of independent operating units. Autonomous subsidiaries may not have the same incentive to follow corporate standards or may not have the same access to corporate staff resources. Indicators of decentralization include revenue and number of staff related to independent operating subsidiaries.
* Geographic dispersion. Managing a global enterprise poses a challenge. Individuals who work outside the head office can become isolated or less able to obtain important information. Cultural differences can be a source of confusion or ambiguity. Indicators of geographic dispersion include the percentage of staff in countries and time zones other than the head office or where the primary language is other than the one used in the head office.
* Transaction volume. Most financial services business--whether underwriting, transactional processing, derivatives or others--can be measured by transaction volume. Volume increases may signal possible or actual strain on a firm's infrastructure.
* Compensation. Compensation can provide insight into different aspects of op risk. Compensation programs which are highly dependent on cash bonuses may create incentives for employees to enhance short-term gains at the expense of the long-term interests of a firm. Compensation programs which are at or below market can lead to turnover. Indicators of potential op risk from compensation include compensation differentials from industry averages and percentage of compensation comprised of bonuses.
* Ownership. The existence and incidence of employee ownership can be an important factor. Ownership--through, for example, grants of stock and partnership interests--can often align the interests of the individual with the long-term interests of the firm. Indicators of potential op risk here include ownership interest among employees in relation to senior management.
* Mergers. Mergers can be rich sources of op risk. They require integration of different systems, management, cultures and ways of doing business. Indicators of potential merger risk include revenue percentages attributed to acquired entities.
* Systems risk. Outdated or incompatible systems can be sources of op risk. Systems may not be adequate to manage new products or they may not integrate with newer systems. The age of systems, number of different systems and incidence of system failure can all serve as indicators for this type of op risk.
* Control staff. Op risk can be mitigated by well-funded and energetic control units. This includes legal, compliance, risk management, middle office, credit and other related areas. Indicators of this weakness include the number of oversight staff in each business line in relation to number of front office staff and related revenue.
* Operational readiness. Operational readiness attempts to analyze how well a firm is prepared to perform its existing and upcoming requirements. This is of necessity a subjective assessment by an independent oversight function. Indicators for this sort of risk include historical losses, audit ratings and self- assessment results.
Other potential indicators include litigation costs, settlement costs and fines.
These are only possible indicators. There is no magic number or score that will provide firms the ultimate answer. In the end, indicators must be used in concert with the subjective judgement of the firm's senior managers and oversight professionals. Perhaps one of a firm's best indicators is the number of nights per month that its managers can't sleep easily.
This week's Learning Curve was written byCharles Fishkin, a member of the Advisory Board of theInternational Association of Financial Engineers(IAFE) and its Operational Risk Committee. The author thanks other IAFE membersTanya Beder,Penny CaganandMonique Miller.