(i) Internal Controls

The Technical Committee, in its report on risk management and control guidance for securities firms, ⁶ aimed to provide a contribution to establishing a more rigorous approach to capturing non-measurable risks that relies on qualitative assessments. The report sets out 12 "elements of a risk management and control system" which are intended to be benchmarks which can be used by supervisors to measure the adequacy of firms' control systems.

Increased emphasis on internal controls aims to limit the losses from operational failure. It recognises that capital and effective risk management are equally important and focuses management's attention on controls.

To make this supervisory approach more effective it may be necessary to respond to weak controls with some form of sanction - e.g. extra capital requirement, restrictions on business, or fines.

(ii) Disclosure of Operational Losses

Operational risk might be dealt with via a more explicit disclosure regime covering all losses arising from operational problems. While these disclosures would, realistically, be made privately to the supervisor, such a regime might be coupled with public disclosure of more appropriate information on a firm's risk profile.

Quantification of operational risks will provide useful data to the supervisor and possibly, via the supervisor, to the market. Reputational risk applies a market discipline to management. Furthermore reporting trends could act as an early warning signal of growing operational risks at a firm. There are however issues regarding the materiality of the losses to be disclosed, the timing of disclosure and the appropriate sanctions.

(iii) Insurance

A limited market exists to insure against some elements of operational risk. This approach is market-based and therefore will benefit well-controlled firms. It would also shift risk to a group of firms capable of assessing occasional, random major problems (earthquakes, hurricanes etc.). But it could lead to a false sense of security and the incentive for improved risk control may be limited by the markets' ability to price these risks. There are major issues regarding the reliability of coverage and the timing of payouts. Furthermore the risk is merely shifted to another group of regulated firms on whose solvency the value of many individuals' assets depend.

Footnote:

6. See footnote 2.