Approaches to Reinsurance Regulation
The reinsurance industry is a very important part of the structure of the insurance industry of any country. It is the reinsurance industry that provides the much-required stability and backup capital that enables insurance companies to underwrite more business. Hence, the regulation of reinsurance companies and the reinsurance business is equally important when compared to […]
Reinsurance Policy Coverage: Advanced Scenarios
In the previous article, we have already seen that the scope of coverage of reinsurance policies can become quite complicated and open to interpretation. We now know that reinsurance policies are covered under three main different terms and conditions. However, over the years, there have been some complications have arisen in these different types of […]
Importance of Ethics
Most of us would agree that it is ethics in practice that makes sense; just having it carefully drafted and redrafted in books may not serve the purpose. Of course all of us want businesses to be fair, clean and beneficial to the society. For that to happen, organizations need to abide by ethics or […]
Leadership-Member Exchange (LMX) Theory
Informal observation of leadership behavior suggests that leader’s action is not the same towards all subordinates. The importance of potential differences in this respect is brought into sharp focus by Graen’s leader-member exchange model, also known as the vertical dyad linkage theory. The theory views leadership as consisting of a number of dyadic relationships linking […]
Individual and Organizational Sources of Resistance to Change
Individual sources of resistance towards a change exist in the basic human tenets or characteristics and are influenced by the differences in perception, personal background, needs or personality-related differences. It is important to understand those triggering factors or issues which refrain individuals from endorsing change or extending their support and cooperation towards any change initiatives […]
The definition of operational risk has been narrowed down. This has helped organizations better manage their operational risks. All operational risks can now be traced to four basic causes viz. people, processes, systems, and external events. However, merely stating a risk as a systems risk does not provide too much information. There is no actionable information for the company to prevent or mitigate such a risk. It is for this reason that many organizations use cause categories. Cause categories are a mechanism used to further classify risks after they have already been classified in one of the four buckets mentioned above.
Let’s have a look at the different cause categories in this article.
If a risk is simply classified as a people’s risk, tracking, monitoring, and mitigating such a risk might be difficult. It is for this reason that the people’s risk is further subdivided into three to four subcategories.
For instance, there might be a risk that the number of people performing a certain task is relatively few in the organization. Hiring such people from the market may also be an expensive and time-consuming process. Hence, the organization would be better off if they started training and developing more human resources within the organization.
It is also possible that the company doesn’t simply have the required number of employees. If a process can work effectively with five people and the company has only three, then this is a potential operational risk
The company may have people but they may not have the required experience. Since competence is built with experience over time, such a workforce is definitely an operational risk
Just like people risks, process risks may also be classified into many subcategories. Some of them have been listed below:
There might be manual complexity involved in a process. It may be too tedious or may require a certain special kind of skill for the work to be performed
The process may not have any automation at all. Processes that are heavily dependent upon humans tend to be error-prone and lack quality control
There might not be any documentation available regarding the process. This makes it difficult to look at the process from a high-level point of view and conduct an analysis in order to improve the efficiency of the process
The processes may not be designed in such a way that collusion can be completely ruled out. The process should be so strong that even if two or more people from the organization collude to embezzle funds, they should not be able to do so.
The third category of operational risk is systems risk. This can also be subdivided into certain subcategories.
The systems being operated by the company may be old or outdated. As a result, their performance capability may be less as compared to the competitors
Many times, the systems being used by the company are unreliable. This is because they have bugs and other such performance issues which makes them unreliable.
Just like people, systems also have a maximum capacity. A lot of the time, companies do not upgrade their systems over time. As a result, their current system capacity does not support their current scale of operations.
There is a possibility that the system may erroneously provide access to individuals who are not meant to have such access.
Lastly, there are external events that impact the operational risk of the company. They can also be classified into cause categories such as social changes, political changes, natural disasters and acts of god, non-performance of contracts by third parties, etc. Risks in this category are generally classified in all organizations since it is intuitive to do so.
Along with the above-mentioned categories, it is also prudent to classify the same risks into more subcategories based on the actions that can be taken.
Detective: These are the risks where time is of the essence. If the risk is detected on time, then the financial impact of the risk can be reduced. In such cases, the risk management system should focus on identifying leading indicators that help reduce the response time
Corrective: These are risks such as outages or stoppages. Here even if the risk is not prevented, timely corrective action can drastically reduce the financial impact. Typical examples include having back-up systems and workarounds ready which enable the business to continue unhindered despite there being a major outage
Directive: These are the types of risks where there is more than one right action possible. Hence, the risk management team must know beforehand about how to evaluate the situation and take the right action which works in sync with the risk management policy of the company.
The bottom line is that these cause categories serve as important checkpoints for the organization. They can be used as a list to identify the operational risks in a company.
Your email address will not be published. Required fields are marked *
