
314 Operational Risk Control
Speaking from personal experience, a number of companies have no idea what their
costs are, which is evidently silly. While operational risk must be controlled in a
rigorous and determined manner, both cost and return on investment should be taken
into account. As Figure 15.1 shows, their relationship is not characterized by a
straight line but by a U-curve. Throwing money at the problem solves nothing.
Optimization is, therefore, absolutely necessary.
What I have said in the preceding paragraph is that much more true as the overall
cost of operational risk control will, in all likelihood, end by being quite high. The
exact ...