Operational Risk Management: A New Performance Management Imperative
The unprecedented volatility of the last few years has called into question the effectiveness of current risk management processes. Investors, regulators, and managers are all seeking greater insight into both the positive and the negative impact of risk on a business's future performance. Although the need for improved financial information is receiving much more attention, companies should simultaneously be upgrading the processes, measures, and tools they use to manage operational risks.
Article Tools
Resource Center
Access white papers, product demos, and presentations from companies whose reputations have been built on helping BPM practitioners get the most from initiatives.
- BPM 101: Selecting a Business Performance Management Vendor" -- new white paper from BPM Partners
- "The Finance Challenge of Aligning the Business With Strategic Goals," a podcast featuring Palladium Group's Phillip Peck
- Ventana Research white paper "Decision-Making and Performance: Improving Essential Business Analytics and Technologies"
- “XBRL at a Glance,” white paper from XBRL US
advertisement
In his 1995 book "Managing in a Time of Great Change" (Truman Talley Books), Peter Drucker wrote: "Financial accounting, balance sheets, P&L, cost allocations, etc. are an X-ray of the enterprise's skeleton. But just as [many of] the diseases we commonly die from -- heart disease, Parkinson's, AIDS -- do not show up on an X-ray, so too a loss of market standing or a failure to innovate do not register in the accountant's figures until the damage is done." Recent events make the truth of Drucker's statement more apparent than ever before.
The economic downturn has provided numerous examples of poor performance management. The speed with which some major companies met their demise has rocked the confidence of investors, put board members squarely in the spotlight, and placed CEOs and CFOs on the firing line. The public had little warning that these companies' collapse was imminent. Only when the financial impact of management mistakes had crystallized on the balance sheet or profit-and-loss account -- in other words, when it was too late to do anything -- did the full magnitude of the problems become clear.
Legislators and regulators have moved quickly, passing new rules requiring greater disclosure of financial information in an attempt to improve transparency. These demands for more accurate and timely distribution of financial information are appropriate. However, the message behind Drucker's comments has gotten lost in the governance rhetoric. Few voices calling for improved corporate reporting acknowledge that the financial results of any business event are the last step in the process. Enron's problems began long before the energy trading losses were incurred. To improve their management of overall business risk and performance, companies need better insight into the operational drivers of their future results.
Today's Processes Fall Short
In "Against the Gods: The Remarkable Story of Risk" (John Wiley & Sons, 1998), Peter Bernstein succinctly describes the place of risk in the economic system: "The capacity to manage risk, and with it the appetite to take risk and make forward-looking choices, are key elements of the energy that drives the economic system forward." Risk-taking is fundamental to companies' creation of value.
Risks associated with markets, liquidity, and credit are well-understood, if not always managed effectively. However, the value of managing operational risk is only slowly gaining recognition in the business world. The need to develop a systematic and rigorous approach to operational risk management is perhaps most widely understood in the financial services industry. One of the major elements in the Bank of International Settlements (BIS) New Basel Capital Accord, published in January 2001, defines operational risk as "the risk of direct or indirect loss resulting from inadequate or failed internal control processes, people, and systems or from external events." Andrew Crockett, general manager of the BIS, subsequently commented, "We need to find ways for firms to provide a richer set of information about risk than is normally included in accounting standards." In other words, financial information is not enough to gauge a company's overall business risk.
By tracking operational indicators, organizations can identify opportunities and threats before they affect financial performance. Exhibit 1 illustrates some basic metrics for gauging operational risk. For example, if a company sees that the proportion of candidates accepting its job offers is falling, it can surmise that it is becoming a less attractive employer. The underlying reason could be that the company's reputation is deteriorating or that its competitors are offering better compensation packages. Early identification of this type of trend gives management time to react before the problem manifests itself in a labor shortage, decline in productivity, or increase in labor costs.
A systematic approach to measuring this type of risk would require companies to routinely review many nonfinancial factors, such as the quality of corporate governance, employee management, and customer manage- ment processes; the company's use of technology; and its deployment of best practices. Numerous tools already available -- including the Balanced Scorecard, activity-based costing, driver-based forecasting, real options, Monte Carlo simulations, and scenario planning -- are designed to provide insights beyond pure financial results. They can add value if used appropriately, but few organizations have established a process for translating the information generated by these tools into an understanding of operational risk that then leads to better decision-making.
