|
Operational risk is the risk that deficiencies in information systems or internal controls will result in unexpected losses. It is associated with human error, system failure and inadequate procedures and control. Operational losses can include losses due to personnel unavailability or injury, natural disasters, the failure of external systems such as an exchange, or a failure of internal controls. By their nature, most of these risks are difficult to quantify and therefore handled judgementally. But senior managers can mitigate operational risks by ensuring that the firm has comprehensive systems for capturing and monitoring risk. There must be effective internal control over the entry of data into the database, transaction numbering, data and time notation and the confirmation and settlement processes. The system must be able to capture all relevant details of a transaction, identify errors and process payments, and move assets quickly and accurately. Further, the possibility of system failure must be tackled with a fully documented and tested contingency plan. For institutions with a large volume of financial transactions, a live back-up site is imperative.
Finally, there must be a comprehensive risk-reporting process in place, producing accurate, informative and timely reports. These reports must be easily read and understood by top management.
Policies for each type of risk must be regularly reviewed and evaluated because market circumstances change and so do staff skill levels. Such reviews must include re-evaluating the firm’s risk measurement methodologies, models and assumptions, especially the correlations used to aggregate across risk categories. At a minimum, underlying methodologies and models should be reviewed annually.
|
