Common Sense Brings ‘Fuzzy Science’ of Ops Risk into Focus

American Banker editor Jeff Horwitz recently suggested operational risk management was the "flavor of the moment" and "fuzzy science." 

On the "fuzzy science" point, Horwitz is absolutely right.  To paraphrase Winston Churchill, never has so much arithmetic been done for so little benefit.  Efforts to develop precise operational risk capital calculations are largely a waste of time and an expensive diversion of limited resources. 

The Basel Committee on Banking Supervision's capital calculation guideline on advanced measurement approaches is a distraction to sound operational risk management.  Understood by only a few people (quantitative types who rarely have any experience actually operating banks), the AMA capital calculations basically boil down to one simple idea: As data from the Operational Riskdata eXchange Association shows, well less than 1% of the operational events produce 80% of the dollar losses. The reason the statistics are fuzzy is because it is very difficult to develop reliable models that reflect the impact of a few giant "black swan" losses.

Bankers and directors who understand this simple truth will shift their risk management practices to identifying, mitigating, monitoring and reporting on material risks that threaten safety, soundness and reputation.  I call these risks "10X risks," those that alone or in combination could cause a bank to fail. Unfortunately, current Basel guidelines push an "everything matters" approach to operational risk management.

Horwitz's broader suggestion, however, that operational risk management is a fad could not be more wrong.  As I point out with overwhelming evidence in my book, "Broke: America's Banking System," the history of bank failure in the U.S. is rooted in operational risk mistakes: the failure of people (i.e., bankers, directors, supervisors) to use capable processes to identify and control for existing and emerging risks. 

Yes, bad credit kills most banks, but operational risk failures are the true cause of bad credit.  My close examination of more than 100 material loss reviews – regulatory studies of failed banks – reveals that bank failure can always be traced back to weak management and directors who took on too much risk by growing their banks too fast or assumed devastatingly unwise strategic risk associated with acquisitions. 

Contrary to Horwitz's contention, now is the time for bank CEOs and boards to invest more time and energy to the common-sense best practices of operational risk management. Although the Basel Committee's quantification guidelines are of dubious value, its guidance around such tools as risk and control assessments, external and internal losses, and scenario analysis is prudent counsel.  

Bankers and directors can use these three operational risk tools to improve their risk profiles and achieve more consistent profits.  Almost without exception, large loss events and reputational damage can be detected early if management and directors focus attention on high-velocity changes to line items on the balance sheet and income statement.  When high-velocity change is evident, good governance demands intense scrutiny of management skills and processes for risk identification and mitigation associated with those activities.

One final point: although Horwitz says operational risk management is fuzzy, he closed his op-ed with a "scientific" operational risk study from three academics.  Ironically, the study he noted actually buttressed his argument.  The article purports to identify the "determinants of operational risk in U.S. financial institutions."

The study is an impressive display of statistical expertise. However, on page 1690, the authors reveal that "the data are culled from public sources" and acknowledge that "we do not believe this to be a major issue for our study."