A structured approach to operational risk management in a banking environment

Abstract

Operational risk was identified as one of the primary risk types that a bank faces. Neglected for many years, there is a growing awareness in the banking industry that the management of operational risk is crucial for their future existence. The effective management of operational risk, however, requires a structured approach. This study, therefore, investigates the management of operational risk by way of a literature study and empirical research in order to develop a framework for a structured approach to operational risk management in banking. The framework comprises the primary risk factors of operational risk, namely: people, processes, systems and external events, as well as a definition of operational risk. The operational risk exposures that apply to the aforementioned primary risk factors are identified. It, furthermore, illustrates that operational risk management is an ongoing process that consists of risk identification, risk evaluation, risk control and risk financing and addresses the methods that could be applied in the management process. As operational risk management in the banking industry is still in a development stage it is believed that this study could assist banks with establishing formal operational risk management processes. The framework demarcates the area of operational risk properly and provides insight into all the activities that should be performed in the operational risk management process, but the following issues still require further research: • The practical implementation of methods for the quantification of operational risk and determining a capital charge for it; • The effect of the requirements of corporate governance on banks as it relates to the management of operational risk; and • The interaction between operational risk and the other primary risk types to ensure an effective, enterprise-wide risk management process. The framework that has been developed could also be applied to any other enterprise as operational risk management is not unique to banks and the basic principples are generic.