Enterprise Risk Management: From Incentives to Controls, 2nd Edition

CHAPTER 14

Operational Risk Management

In many respects, operational risk is nothing new. Businesses have had to deal with human fallibility, defective processes, and unreliable technologies since time immemorial. However, the advent of enterprise-wide risk management, the introduction of new regulatory capital requirements, and the increasing emphasis on sophisticated quantitative models for other types of risk (such as market and credit risks) has jump-started interest in more active management of operational risk.

Operational risk has been the subject of increasing management attention over the past few years. A 2011 report by Deloitte found that about 66 percent of the surveyed financial institutions calculated economic capital for operational risk as well as credit and market risks, while 69 percent would prioritize improvements in operational risk management systems in the subsequent year (ranked third most important in a list of 12 different priorities).1 An earlier study shows that 45 percent of the companies surveyed named the CEO (in addition to high-level management) as the spearheading force behind operational risk management initiatives.2 These figures signify how business executives have come to see operational risk as just as important as other forms of risk. With corporate scandals (e.g., Enron, Worldcom, J.P. Morgan), the interest level in operational risk management has continued to grow, in conjunction with related discussions regarding corporate governance ...