What Is Operational Risk? Definition & Real Examples

Although there are diverse methods of applying the ORM process steps, Operational Risk Management is mostly used as a five-phase process. Each of the five phases is essential and necessary to be conducted. The five phases of ORM include:  

Phase 1: Risk Identification  
The first step is to identify risk so it can be managed. The identification of risk starts by learning the organization’s objectives. In this context, risks are anything that diminishes an organization’s ability to achieve its objectives.  

Process Analysis: Reviewing the internal processes of the organization (production, IT, HR, customer service, etc.) to identify possible fail points and/or lapses in process.

Loss Data Review: The review of the organization’s historical loss data to identify trends and areas of concern (financial loss, hacking, compliance violations, or any incidents that impacted operations). 

Risk Workshops and Interviews: Engaging employees at varying levels within the organization to conduct workshops or interviews to gather their experiences – perceived risks, opportunities for improvement, and past incidents. 

External Event Review: Evaluating outside events that might impact the organization through change. This includes generally accepted trends in the industry, changes in the implementation of regulations/laws, advancements in technology, and other external events such as geopolitical events.

Scenario Analysis: Developing hypothetical scenarios to analyze risks and their implications. This also engages the concept of resilience and if the organization is prepared for unlikely odds with traction.

Step 2: Risk Assessment
Risk Assessment is a structured, repeatable method for ranking risks according to their likelihood and impact. There will be an outcome from the risk assessment, which is a ranked list of known risks, also known as the risk owner and risk mitigation plan, that is simply referred to as a risk register. It may not be feasible nor advisable for an organization to address all identified risks; thus, prioritization is important for the management of operational risk and points project teams to focus on those risks that are most significant. This risk assessment process may look like the risk assessment of the internal audit, and this should be informed by previous audit reports and findings.

Step 3: Risk Mitigation
The risk mitigation step of the process includes the development and selection of a course of action for the controls for specific risks. There are four ways to address potential risk events if a risk event is defined in the Operational Risk Management process: transfer, avoid, accept, and mitigate.

Transfer: Transferring means shifting the risk to another organization. The two most common means for transferring are outsourcing and insuring. When management outsources, the organization is never able to fully transfer the responsibility for controlling risk. Insuring against the risk does transfer some of the financial impacts of the risk to the insurance company.

Avoidance: Avoiding risk means the organization does not have the opportunity to enter into a high-risk situation or environment. For example, when selecting a vendor to provide you a service, the organization could choose to accept a vendor with a higher-priced bid if the lower-priced vendor did not have enough references to assure the organization of their ability to perform the service.

Accept: Based on the assessment of the risk to the cost of mitigation, management could choose to accept the risk and accept the high-risk scenario. There is again an example, and that is the requirement to assess the risk of an employee hurting themselves from using new coffee makers in the break room. In this case the outstanding benefits to employee satisfaction outweighed the risk of a potential employee burning themselves using hot coffee, and management therefore accepted the risk and put in new coffee makers.

Mitigate: Action plans and control implementation in relation to risks will mitigate them by decreasing their likelihood and/or the impact if the risk were to occur. For example, if an organization has a policy to allow employees to work from home, there would be a risk of data leaking when data is transmitted across the public internet.

Step 4: Control Implementation 
Once risk mitigation decisions have been reached, action plans are drafted, and residual risk is documented, the next step is implementation. Controls should be designed specifically to treat and mitigate the addressed risk. The rationale, objective, and activity related to the control should be formally documented so controls can be communicated and put into practice. Controls can appear in many forms: a process, an additional approver, system controls, or a combination of all three, for example, to limit the end user from making mistakes or conducting malicious acts. Whenever possible, controls should be designed to be preventive instead of detective or corrective. Just like risk management and medicine, the best option is going to be prevention. Still, specific risks may be impossible to prevent, which is where the role of detective controls is utilized. Detecting some inconsistency and then correcting it may be enough to mitigate some risks.

Your organization likely has some controls implemented to address risks! It’s still a good idea to annually review those controls (at a minimum) and assess those controls (if they have holes, implement additional controls) or if the controls are sufficient to address the risk and require no modifications.

Step 5: Monitoring
As controls may involve people making mistakes or have the potential to change, controls need to be monitored. Control monitoring includes assessing if the control is appropriately designed and that it is operating effectively. Any exceptions or issues need to be escalated to appropriate management with an action plan in place.

Within the Operational Risk Management strategy’s monitoring step, some organizations, particularly in financial services, have integrated continuous monitoring or early warning systems around key risk indicators (KRIs). Key risk indicators are measures used by organizations to provide an early warning signal of an increased risk exposure in various areas of the organization. KRIs designed around ratios monitored by business intelligence applications are how banks manage operational risk; however, the concept can be applied in any industry. KRIs can be designed to monitor almost any risk, which can be sent as a notification. As an example, a company could design a key risk indicator around customer satisfaction scores. A decline in customer satisfaction scores could indicate that customer service representatives are not being trained or that the training is not effective.