Realistic Risk Management 133
is not a living creature: it is neither malicious nor benevolent. The investment errors are purely
the result of human action. Once human control becomes too lax and there is a systemic pat-
tern of errors, then these mistakes can become categorised under corporate operational risk
(OpRisk).
Operational risk protection: the “roof”
Finding out who, where, when and how much damage was caused is an expensive and labour-
intensive risk management process. Most companies are in a downsizing cycle – paring costs
by cutting personnel across the board. By doing so, they may be increasing operational risk
while reducing operating costs.
26
Key knowledge workers with crucial client links and process
innovators can be lost amongst those trimmed off as obvious corporate “fat”. A reduced ability
to meet customers face to face, relegating them to voice-mail and websites, can harm customer
satisfaction and disrupt the revenue stream.
There is a divorce between risk horizons, cutting operating costs while increasing long-run
costs to regain the lost customer base and to recover key staff. A short-run good-risk move
becomes a long-term strategic nightmare.
There are many ways of handling this risk. But, this presumes that the company has the
risk awareness to want to manage risk at all. One thing to do is to receive the correct market
intelligence, which is especially true in developing countries. Damage-limitation, or control
against accidents, is essential. In Russia, such protection is often called a “krisha” or roof – a
device to ward off unwelcome attention from the Mafia gangs. There will be strong incentives
to build a strong “roof” against local anti-social elements – such as the Nigerian 419-scam
gang members. The roof protects us from the outside. In the West, most of the damage threat
comes from inside.
This is the crux of the problem; most of the roofs are “pointing” the wrong way – they
are designed to protect against damage from the external sources. Unfortunately, much of
Western mainstream risk management has been trained on deliberate fraud from the outside.
The damage coming from inside the company is less acknowledged. That is why we have been
slow to focus on investment threats that originate from the CEO and the company leaders.
27
Furthermore, some company “accidents” have been either unknown or swept under the
carpet, so we remain unaware of the business losses.
Under the new Basel II banking regulations, there will be drives to force the company to
record the full extent of financial damage within the loss database. The lack of experience of
companies and the market watchdogs to process this database comprehensively will continue
to be a challenge. There will be obstacles when a company does not have adequately skilled
staff, or the board of directors remains unwilling to detail the full financial losses. Further
design and documentation problems remain for this valuable information.
28
The board has to
act positively to support risk management initiatives if it is to succeed.
This power of the board to create corporate wealth, and also to cause damage is a forceful
factor to concentrate the investor’s mind. Shareholders have concentrated on the leaders’
wealth-creation abilities, less on their risk management prowess.
26
“Managing people costs”, Towers-Perrin Insurance, www.towers.com, 2002.
27
“Can auditors detect fraud: a review of the research evidence”, C. Albrecht, W. Albrecht and J. Dunn, Journal of Forensic
Accounting, Vol.2, 2001.
28
“Overcoming the practical challenges of implementing an Integrated Loss Database”, ABN AMRO,Infoline Conference, London,
5 June 2003.