Cause Categories in Operational Risk Management

The definition of operational risk has been narrowed down. This has helped organizations better manage their operational risks. All operational risks can now be traced to four basic causes viz. people, processes, systems, and external events. However, merely stating a risk as a systems risk does not provide too much information. There is no actionable information for the company to prevent or mitigate such a risk. It is for this reason that many organizations use cause categories. Cause categories are a mechanism used to further classify risks after they have already been classified in one of the four buckets mentioned above.

Let’s have a look at the different cause categories in this article.

People Risks

If a risk is simply classified as a people’s risk, tracking, monitoring, and mitigating such a risk might be difficult. It is for this reason that the people’s risk is further subdivided into three to four subcategories.

For instance, there might be a risk that the number of people performing a certain task is relatively few in the organization. Hiring such people from the market may also be an expensive and time-consuming process. Hence, the organization would be better off if they started training and developing more human resources within the organization.

It is also possible that the company doesn’t simply have the required number of employees. If a process can work effectively with five people and the company has only three, then this is a potential operational risk

The company may have people but they may not have the required experience. Since competence is built with experience over time, such a workforce is definitely an operational risk

Process Risks

Just like people risks, process risks may also be classified into many subcategories. Some of them have been listed below:

There might be manual complexity involved in a process. It may be too tedious or may require a certain special kind of skill for the work to be performed

The process may not have any automation at all. Processes that are heavily dependent upon humans tend to be error-prone and lack quality control

There might not be any documentation available regarding the process. This makes it difficult to look at the process from a high-level point of view and conduct an analysis in order to improve the efficiency of the process

The processes may not be designed in such a way that collusion can be completely ruled out. The process should be so strong that even if two or more people from the organization collude to embezzle funds, they should not be able to do so.

Systems Risks

The third category of operational risk is systems risk. This can also be subdivided into certain subcategories.

The systems being operated by the company may be old or outdated. As a result, their performance capability may be less as compared to the competitors

Many times, the systems being used by the company are unreliable. This is because they have bugs and other such performance issues which makes them unreliable.

Just like people, systems also have a maximum capacity. A lot of the time, companies do not upgrade their systems over time. As a result, their current system capacity does not support their current scale of operations.

There is a possibility that the system may erroneously provide access to individuals who are not meant to have such access.

External Events

Lastly, there are external events that impact the operational risk of the company. They can also be classified into cause categories such as social changes, political changes, natural disasters and acts of god, non-performance of contracts by third parties, etc. Risks in this category are generally classified in all organizations since it is intuitive to do so.

Along with the above-mentioned categories, it is also prudent to classify the same risks into more subcategories based on the actions that can be taken.

Detective: These are the risks where time is of the essence. If the risk is detected on time, then the financial impact of the risk can be reduced. In such cases, the risk management system should focus on identifying leading indicators that help reduce the response time

Corrective: These are risks such as outages or stoppages. Here even if the risk is not prevented, timely corrective action can drastically reduce the financial impact. Typical examples include having back-up systems and workarounds ready which enable the business to continue unhindered despite there being a major outage

Directive: These are the types of risks where there is more than one right action possible. Hence, the risk management team must know beforehand about how to evaluate the situation and take the right action which works in sync with the risk management policy of the company.

The bottom line is that these cause categories serve as important checkpoints for the organization. They can be used as a list to identify the operational risks in a company.