Operational Risk

Operational risk can be defined as "the risk of a change in value caused by the fact that actual losses, incurred for inadequate or failed internal processes, people, and systems, or from external events (including legal risk), differ from the expected losses.” In simpler words, it is a risk faced by a company due to failed internal processes such as those of a faulty system, unsuccessful procedures, employee errors, and legal hazards. Some other factors include technological glitches such as breaches of personal data resulting from cybersecurity attacks or risks tied with automation and artificial intelligence. These can also be caused due to physical catastrophes such as cyclones, earthquakes, or man-made events such as terrorism and vandalism.

Operational risk includes all other risks except those of credit and market. These risks can be as minor as an affordable loss caused due to poor management of human error; for example, a poorly trained employee may lose a sales opportunity, or the organization's reputation may suffer indirectly from poor customer service. or as major as a serious felony such as internal or external fraud which may trigger the risk for bankruptcy for the company.

 It is an unsystematic risk which means it is exclusive to a specific company or industry and this makes it difficult to identify and then eliminate. But there is a process that can help us mitigate this risk and it is divided into four stages

Stage 1: Risk identification

Risks ought to be identified so that they can be controlled. Risk identification starts with a deep understanding of the company’s objectives. Risks are anything that hinders the company from attaining its current set of objectives. 

Stage 2: Risk assessment

Risk assessment is a systematic process for rating risks based on the probability and impact of risk involved. The result from the risk assessment is a list of known risks. The risk assessment process is somewhat similar to the risk assessment done by an internal audit.

Stage 3: Risk mitigation

The risk mitigation step involves selecting a plan for controlling the specific risks. In the Operational Risk Management process or ORM, there are four alternatives for risk elimination: transfer, avoid, accept, and control.

 Stage 4: Control implementation

After the selection for risk mitigation has been made, the next step is implementation. The controls are specifically designed as a response to the risk at play. Their implementation should focus on preventive control activities more rather than policies.

These stages will help eliminate the operational risks but they should be performed frequently to identify risk at its earliest before it becomes a hazard to the company.

 To conclude this article, I’d like to mention one such case study which throws light on the operational risks present in the banking sector.

This would be the case study of Harshad Mehta or the infamous “Big Bull”. He committed one of the biggest scams the Indian stock market has ever faced termed as the “securities scam” which involved a fraud of over Rs. 4,000 crore. He was a registered and well-known stockbroker who along with his partners took advantage of loopholes that prevailed in the banking system. This led him into manipulating the entire Bombay Stock Exchange(BSE). 

It was systematic fraud in which he colluded with bank employees to get fake Bank Receipts. He then used these receipts to convince banks to lend him money whilst they were under the impression they were lending against Government Securities. He then invested the sum in the stock market, increasing share prices by an astounding 4400 percent. Mehta sold these shares gaining significant profit and then returned the principal amount to banks. After his felony was discovered and exposed it triggered many changes in India’s financial regulatory system.

This scam not only highlighted one of the reasons for operational risk, internal fraud but also brought forward the consequences of these risks not being mitigated. Therefore, firms try to steer clear of operational risks.