Ten Laws of Operational Risk

Understanding its Behaviours to Improve its Management

Michael Grimwade

• Publisher: Wiley
• Year: 2021
• Print ISBN:
  9781119841357
• Edition: 1
• eBook ISBN:
  9781119841371
• Topic: Business
• Subtopic: Finance
• Index: Business

TEN LAWS OF OPERATIONAL RISK

Unlike credit and market risk, operational risk currently lacks an overarching theory to explain how and why losses occur. As a result, operational risk managers have been forced to use unsatisfactory tools and processes that fail to add sufficient commercial value.

In Ten Laws of Operational Risk: Understanding its Behaviours to Improve its Management, Michael Grimwade delivers an insightful discussion of the nature of operational risk and a groundbreaking redesign of the profession???s existing tools. The author???s Ten Laws are grounded on the business profiles of firms and the human and institutional behaviours that drive operational risk. They are underpinned by taxonomies for the causes; the inadequacies or failures that constitute both control failures and events; and the impacts of operational risks.

Drawing on twenty-five years of first-hand experience and research, this book explains the patterns and trends that are apparent in the historical data and offers solutions to the persistent problems inherent in risk appetite, RCSAs, scenario analysis, reputational risk, stress testing, capital modeling, and insurance. It also provides fresh insights into the everyday activities of risk managers with respect to predictive key risk and control indicators, root cause analysis, why controls fail, the risks posed by change, and product risk profiles.

Ten Laws of Operational Risk presents a structured and evidence-based approach to identifying emerging risks and predicting future behaviours related to pandemics, climate change, cybercrime, artificial intelligence, and machine learning. It includes revealing industry data, in-depth case studies, and real-world examples that shed light on recurring and obstinate problems in operational risk management.

A must-read resource for Chief Risk Officers and other risk professionals, as well as regulators, management consultants, and students and scholars of operational risk, Ten Laws of Operational Risk provides an invaluable new, systematic, and rigorous approach to operational risk management.

PRAISE FOR TEN LAWS OF OPERATIONAL RISK

???Operational Risk can no longer be described as a new concept, but as a discipline few attempts have been made to really understand its behaviour. In his book Michael does this very successfully, blending extensive practical experience with analytical thought leadership to propose a set of laws that explain why and how Operational Risks arise, and what can be done to manage them. Assertions are evidence based, with numerous real examples used to underpin his hypotheses. This is a valuable addition to Operational Risk thinking and is recommended for experienced professionals and novices alike.???
??? Dr Luke Carrivick, Director of Research & Information, ORX

???Michael has established himself as one of Operational Risk???s foremost thinkers. His ability to use historical data to analyse events is unrivalled. In this must-read book, he identifies ten fundamental laws that provide every Operational Risk practitioner with a clear set of rules they can use to understand current events and predict their impacts.???
??? Andrew Sheen, former Head of the FSA???s Operational Risk Review team

???Michael is one of the most prominent thinkers in Operational Risk. He combines a long career in Operational Risk management and measurement with a deep, long-standing reflection on the fundamental causes, dynamics and patterns in the manifestation of Operational Risk events. He produces, with this book, a remarkable synthesis of his insightful and innovative work.???
??? Dr Ariane Chapelle, Honorary Reader, University College London; Managing Partner, Chapelle Consulting

???Michael is a highly respected expert in the field of Operational Risk, who has developed some ground-breaking frameworks for analysing this risk and guiding better risk management decisions. As a working practitioner in the field he brings many insights that will appeal to other practitioners as well as regulators, students and scholars.???
??? Professor Elizabeth Sheedy, Macquarie Business School

???Michael???s views and analysis challenge the traditional Basel II views of Operational Risk and are genuinely thought-provoking. His book on the Ten Laws of Operational Risk will give financial services clarity and a practical view, where it has been previously lacking, on how best to manage such risks.???
??? Tin Lau, Group Head of Financial and Strategic Risk, TP ICAP

PART One
Ten Laws of Operational Risk (Grimwade, 2020)

Part One of the book describes the extent to which Operational Risk has displayed observable patterns of behaviour over the last two decades (Chapter 1). The existence of patterns, whether trends over time or sustained stability, suggests that there may be laws that govern Operational Risk. If this was not the case, then the behaviour of Operational Risk over time would be random. Chapters 2 to 4 then set out Ten Laws that govern different aspects of the behaviour of Operational Risk.¹ Each law is explained with specific examples, and Chapter 2 concludes with an extended case study using data from one of the largest ever Operational Risk loss events to illustrate the first five laws. Chapter 5 focuses upon three taxonomies that underpin these Ten Laws, i.e. inadequacies or failures (both events and control failures); causes; and impacts. These taxonomies are subsequently used extensively in Part Two to support the estimation of remote events (scenario analysis); the identification of sensitivities to the impacts of business cycles and predictive metrics; and to explain the coverage of insurance policies. Finally, Chapter 6 considers how and why these Ten Laws help to explain the behaviours that were described in Chapter 1.

TEN LAWS OF OPERATIONAL RISK

---

1. Occurrence: “Operational Risk events primarily arise from human failings, either directly or indirectly, ranging from mistakes to systemic misconduct to malicious acts. The types of events suffered by firms are driven by their business profiles and are exacerbated by internal and external causes, primarily culture, governance, resourcing and process definition. They are restricted by preventive controls, which may also be weakened by these causes.”
2. Detection: “The frequency of reported Operational Risk events reflects detection rates of both currently occurring losses and historical undiscovered failures. Strengthening detective controls increases the frequencies of reported events, whilst weakening them may lower their observed frequency, in the short term.” Detection success determines the duration of incidents, see 4th Law.
3. Velocity: “The rapidity (velocity) with which firms suffer losses (or gains) between an event occurring and ceasing is driven by the quantum of inadequacies or failures; causes; and the nature of the impacts generated by the event”, i.e. fines and penalties are low-velocity, whilst Market Risk boundary losses have the highest velocities, up to a 1,000 times greater than regulatory fines.
4. Duration and severity: “The severity of an incident reflects a risk's velocity and the length of time to detection (for large losses the average is ∼4 years). Average velocity declines with increased duration (average loss peaks between years 3 and 5). The severity of a loss may be limited by detective controls which accelerate discovery and corrective/resilience controls, e.g. insurance, that reduce the consequences of an event. Both may be weakened by internal causes.”
5. Lags in settlement: “The length of time between detection and settlement is linked to systemic misconduct; regulatory involvement; litigation; sensitivity to economic cycles; and the distribution of compensation to customers.” Almost three quarters of large losses crystallise over a year after detection.
6. Concentration due to internal drivers: “Different risks are concentrated because they are sensitive to the same internal causal factors that primarily drive occurrence. These factors lead to concentrations of events within banks.” Pre-crisis ∼80% of large losses were suffered by one third of the G-SIBs. During the...

Table of contents

• Cover
• Table of Contents
• Title Page
• Copyright
• Dedication
• About the Author
• Introduction
• PART One: Ten Laws of Operational Risk (Grimwade, 2020)
• PART Two: Operational Risk Management Tools Designed for Success
• PART Three: Predictions of the Future Behaviours of Operational Risk
• PART Four: Conclusions
• APPENDIX I: Taxonomy of Inadequacies or Failures: Events and Control Failures
• APPENDIX II: Impact Taxonomy and Their Relative Scales and Velocities
• APPENDIX III: Causal Taxonomy Based Upon a Review of Large, Well-Documented Events
• APPENDIX IV: Risk Taxonomies for Cybercrime and IT Operational Risks Based on Analysis of Actual Loss Events
• Glossary
• Bibliography
• Index
• End User License Agreement