Once frequently overlooked, businesses are increasingly developing operational risk teams to analyze and track the risk associated with their conduct and choices. For banks and other regulated industries, this area of risk management is nothing new. For other industries, understanding operational risk requires a significant shift in how companies think about their own risk profiles
Operational risk is the financial and reputational risk associated with a business’s procedures, people, and systems. Instead of the more well-known business metric measuring what a business produces, an operational risk assessment would measure how a business operates. For example, a traditional business would measure its viability based on annual profit or manufacturing output, whereas an operational risk approach would analyze if the business’s practices are repeatable, secure, or ethical.
Most businesses already engage in some level of operational risk analysis and mitigation, even if they have not labelled it as such. Following standard accounting practices is operational risk mitigation. Employing appropriate security systems is operational risk mitigation. Making user manuals accessible to end-user employees is operational risk mitigation. The common theme is that these tools recognize the room for things to go wrong, and are built to prevent or limit the damage from those problems.
How can technology help businesses understand, plan for, and control their operational risk?
Procedures
Procedural or process risk is the potential harm to profitability or reputation that can come from a product design flaw, internal process failure, or other gaps in appropriate procedures. Key questions for monitoring procedural risk tend to address both policy and tools. Does the company have the right policies in place to monitor and control risk? Does the company have the right tools to be able to implement those policies?
Most healthy businesses spend serious time and money setting up good processes. Those processes ensure the business runs well. Automation is often an integral part of some of the most key processes because it creates repeatable efficiencies and reliability in routine business practices. Those efficiencies are what make technological tools like accounting software and customer relationship oversight so commonplace.
Businesses that want to leverage best operational practices should also consider utilizing systems to help better control vendor management. Taking something like contract lifecycle management from solely an employee responsibility and moving it to a software-based platform can help dramatically reduce the pitfalls of bias and blind spots that an individual performer almost certainly brings to the job. It also enhances a more layered oversight of how these contracts are handled.
However, it’s essential to do your due diligence before moving forward with any platform, and cross-referencing it with the CLM Gartner Magic Quadrant report can provide you with the much-needed data you require to make an informed decision. For instance, a company that’s been ranked as a “visionary” can provide you with the necessary insights to carefully monitor the market, allowing you to stay one step ahead of any potential risks. That is sure to make the compliance team, legal department, and insurance company happy.
People
The people in a company will always be the core of the business. Because of that, the people in the company are one of the biggest potential risk creators and the biggest potential risk mitigators for the business.
People risk deals with the possibility of the company’s employees creating financial or reputational problems for the business. Examples include hiring the wrong people, failing to attract or retain the right kind of employees, failing to properly manage or oversee employees, human error, fraud or other kinds of unlawful behavior, or any other human factor that endangers an aspect of the business.
Since people risk is the most organic and least purely logical type of risk, it may not be the first type of issues employers think of pairing with technology. However, there are some excellent software options for important features of employee management. Look into the software for employee management, change management, and management responsibility. These up-and-coming technologies are becoming the new norm in large-scale corporations because they are proven to reduce risk and overall costs that come with human error and bias.
Systems
Systems risk is the potential for financial and social harm to the company related to failures, performance issues, or omissions related to the systems built into the business. Common areas for systems risk are core systems used to run the business, information technology systems, utilities, and inter-department communication and information sharing.
Businesses who think end-to-end about risk build frameworks for risk management, starting with senior management and key systems. Having a plan to monitor system performance and a backup plan for when their performance dips below benchmarks is vital to ensuring business continuity.
There are three approaches to using technology to monitor and prevent system risk. First, use technology with safeguards built-in. Second, create outside testing and metrics for system performance. This can be done manually, like through an audit, or through external software, like anti-virus scans. Third, establish either redundancy or a backup technology plan in case a core system has a catastrophic breakdown.
The Goal
The goal is to protect the company’s financial well-being and positive public reputation. There is no way to totally prevent operational risk. Some level of risk is inevitable and, therefore, acceptable. Businesses take losses. Some level of loss is predictable, but failing to spot and comprehend risk gaps can cause a company to bleed and even hemorrhage money without realizing it. The point of understanding operational risk is to really understand the business inside and out, to make informed and strategic decisions about what risk is acceptable and what is not.
