operational risk frameworks in the age of COVID-19: in data we trust!
by Thibaud de Barmon The past 10 months have changed firms’ operational landscape in ways that few would have thought possible. To date, this change hasn’t led to major disruptions, but there is no doubt that the level of operational risks firms are now exposed to is on the rise. What does this mean for the practice of operational risk? Because the current changes are both profound and lasting, we believe they will particularly impact the way risk frameworks anticipate, measure and communicate. For operational risk this will mean major adjustments in three areas: more complex and dynamic scenario analysis; more granular self-assessments of the risks and controls; and agile reporting and escalation of risks and vulnerabilities. This article looks at each in turn.
the development of scenario analysis Firms’ operational environment is still very much in flux, and a new normal is still at least several months away. Yet new constraints are profound and environmental changes are very uncertain. For operational risk managers forward-looking tools will thus be crucial, and the scenario analysis process will be the key one. Through well-designed scenarios, risk managers can assess both the first and second order impacts of any operational risks. Seven months into the worst pandemic in a century, the first order impact of a pandemic is now pretty much known: thanks to the rapid adoption of remote working, it appears financially and operationally manageable. The longer-term and second order impacts on the contrary are still incredibly uncertain, as much as possible firms should try to anticipate them. This is no easy task, but we believe that it can be achieved by extending and refining the following three types of scenarios: • The scenarios most impacted by changes in the business environment because these lead to increases in impacts of many other events such as rogue trading, modelling failures, and processing errors. • The scenarios most impacted by the loss of access to the more secure legacy workplaces because remote working weakens external defenses and increases the chances of successful intrusions such as cyber intrusions, data leakages, and external frauds.
050
Intelligent Risk - November 2020
