A key issue in operational risk management is the difficulty associated with pinning down a likelihood and a severity, as well as using information from external events in a meaningful way. Because of that, the measurement of volatility in operational risk is the primary puzzle risk specialists seek to solve. However, they have developed a few good techniques you can use to put your operational risks into perspective.

In Chapter 9 we introduced scorecards and consequence tables as basic risk management tools. These tools are particularly useful for gauging operational risk. Risk managers often adapt them to provide more specific information and increased value in understanding and tracking operational risks.

Begin by developing specific scorecards for each critical segment of operational risk, including all operational risk subcategories (e.g., people/organization, business process management) that affect you. If you are creating a scorecard with a special focus on people and organizational risks, for example, first develop a specific set of questions and indicators. These questions should signal the propensity of specific sorts of risks in your organization. When doing this, it is important to identify indicators as much as possible. Example: the number of vacant positions relative to total workforce or the percentage of vacancies. Another example is the attrition of workforce—are you losing people? At what rate? Do you have key man risk? In how many positions?

Next, try to link these answers to actual likelihood. If you don’t have specific numbers, try to determine relative likelihood. Set up a scale:

Try to avoid lumping every risk about which you’re uncertain into the “Medium” category. Be as specific as possible. In fact, many organizations avoid this middle category and use an even number of categories. This forces the ranking to reflect either slightly higher or slightly lower risks.

Likewise, create a consequence table (see Chapter 9) for each subcategory of operational risk and for each department in your company. Try to link these to specific financial impacts wherever possible.

As you’ve seen throughout this book, your own teams can be enormously useful in supporting analysis and solutions for operational risk. The teams can help develop scenarios, likelihood estimates, and consequence estimates.

There are several techniques for integrating individuals and teams into the risk management process. Work with different teams throughout the organization to identify key areas that could be sources of risk. Start by developing process flowcharts for each function. List all of your key items of equipment and the supporting teams. Identify the critical success factors or key steps to which your teams must adhere. Determine which of the process steps, pieces of equipment, and teams are most critical. Work through the likelihood of any failures in the processes. Rate the probability of each result (high, medium, low, or very low), or try to provide comparative probabilities. Try to phrase these comparisons or ratings in terms of how frequently an event could happen: once a month, once every three months, once a year, etc. This can help you obtain a more specific view of likelihood.

When you’re finished, repeat the same process flowchart to analyze event consequences. Consider drawing external event data from other companies, or simply work through an event flow with experienced team members. When you do this, try to determine roughly how long an event might take to play out, how much product could be lost, and so on.

Sound like a lot of work? It is, but once you have gone through the exercise, it is much easier to refresh it and update it in the future. This approach generally leads to valuable data about where your true risks lie and what they could really mean. It also gives you data you can feed into the other basic measurements that support your analysis of mitigation cost-benefit trade-offs.

Another valuable technique for measuring and analyzing operational risk is loss event capture. As the name suggests, the object is to record all of the losses that have occurred in the organization.

To fully capture each loss event and generate the information you need, follow these steps:

Build a simple checklist or spreadsheet that includes the following basic information about each loss event:

By now you should realize how important it is to analyze risk events after they have occurred. Doing so provides a means of understanding what happened and helps expose critical information about how to prevent it from happening again. The information can also be used to gauge probability of such an event happening again and its severity should it occur.

One of the key methods for analyzing past risk events is root cause analysis.To reap the most benefits from this type of analysis, you need to start it as soon as possible after an event has occurred, so the data, information, and people’s memories will be freshest.

In addition, to maximize root cause analysis, you must be inclusive. Everyone in your organization needs to feel that they can contribute to the investigation. Don’t dismiss or discount ideas that may seem naive or come from a source who is not an expert. These seemingly worthless comments can often unlock a key piece of the puzzle.

Begin by establishing a timeline for the risk event. Track every activity that led up to the event. Note each event and activity on the timeline.

Next, categorize the potential sources to investigate, which are known in risk management parlance as 4ME:

Display the specific categories and potential sources of the event on a chart, called a “fish bone” diagram. Treat each of the six core categories just described as one of the main “bones” on the “fish”—its spine, if you will. The subcategories below each primary category will fill out the “small bones” along the spine of the fish.

When conducting this analysis, ask “why” or “how” the event could have occurred under each source category. Use a technique called the “five whys,” which involves asking the question “Why?” five times to drill down to the core truth, or root cause, of any particular matter.

For an example of the “five whys” in use, suppose that your car has broken down. Begin with the first, most basic, question:

There you have it—the root cause.

These techniques not only help you get to the root cause more quickly, but they also help identify weaknesses throughout the operation. As you become skilled with root cause analysis, you may discover that it can serve as a means for developing probability, severity, and mitigation tactics for events that worry you but haven’t yet occurred.