Operational risk is difficult to measure and hard to quantify in
terms of likely financial loss. It is therefore difficult to allocate cap-
ital to cover such a risk turning into an actual loss. Nevertheless,
progress is being made on operational risk models, as more and
more organisations seek to quantify the operational risk of their
business. It is therefore important that managers begin the process
of measuring risk by developing risk measurement models suitable
for in-house use.
On a day-to-day basis, when we look at quantifying and measuring
operational risk we need to first consider what it consists of.
At the highest level, operational risk can be said to comprise:
• Settlement risk
• System risk
• Personnel risk
• Infrastructure risk
• Counterparty risk
• Regulatory risk
• Legal risk
• Reputational risk.
However within these headings are many subsets of risk that can
(and often do) combine to generate risk situations that go across one
or more categories. The combination of risks makes measuring and
managing operational risk a complex exercise, and it can also result
in a situation where the cost of managing the risk is prohibitive.
As with all types of risk, there is operational risk that is acceptable
as part of the business, provided that the risk is known and under-
stood. There is a danger that the subject of operational risk can be so
diverse and so large that managing it becomes an administrative and
costly nightmare. It is therefore important for any organisation, and
any individual person with responsibility for operational risk (this
includes everyone working in a derivative operations team), to estab-
lish exactly what the objectives are when trying to measure and
manage operational risk.
One way to do this is to perform a workflow analysis that
demonstrates:
• The processes and their duration
• The complexity, ranking (in terms of primary, secondary) and the
extent of automation of these processes
• The deadlines associated with the processes
• The level of resource available for the process
Operational risk 163