Improving the communication and control of operational risk profiles

Abstract

This thesis takes a hard look on the present techniques and methods that are used for communicating and controlling risk profile to find improvements. The popular term “risk appetite” is dismissed and replaced with a new concept; RiskPAT. RiskPAT is a tool that is based on the principle to help an organization gain benefits by making it state three values; risk preference, risk acceptance and risk tolerance. By stating a risk of preference and its allowed volatility (respectively, risk preference and risk acceptance) and the limit of risk that the external environment tolerates (risk tolerance), I argue that an organization can gain substantial benefits both internally and externally. The implementation process of RiskPAT benefits the internal environment of the organization greatly by optimizing it for operational risk management. Measuring techniques are thoroughly improved to optimize communication of risks and preventing problems with ambiguity. These improvements consist of dismissing risk maps in favor of individual risk distributions derived from Bayesian networks and dismissing all other metrics than amounts when measuring. By continuously measuring the individual risks and ensuring their compliance with the RiskPAT, the board gets a clearer image of the true operational risk profile which further increases their control. The reaped benefits of having implemented RiskPAT are equally bountiful from the external environment. Increased control over operational risks are highly sought after, and displaying this to investors and rating bureaus will definitely cause benefits through increased capital and better ratings. The terms of RiskPAT can effortlessly be controlled, and any false statements will easily be revealed. This is what makes it such a good tool externally too. The RiskPAT will help the external environment to find organizations that have good operational risk management by comparing their risk preference with the risk tolerance. If a financial organization has a risk preference above their risk tolerance, they are undoubtedly more vulnerable to volatility than an organization with its risk preference below the risk tolerance. This scenario ultimately is in favor of the latter organization which most likely would attract more investors. The RiskPAT could be the future of communicating and controlling risk profiles, and the authorities would be wise to find ways to incentivize this throughout the industry.