operational risk – Compliance Guru

The FFIEC issued a joint statement recently regarding Microsoft’s discontinuation of support for Windows XP. The statement requires financial institutions to identify, assess, and manage the risks of these devices in their institutions after April 8, 2014. After this date Microsoft will no longer provide regular security patches or support for this product, potentially leaving those devices vulnerable to cyber-attack and/or incompatibility with other applications.

Identifying, assessing and managing these devices within your own organization is fairly straightforward. Have your admin or support provider run an OS report and present it to the IT Committee for review and discussion of possible mitigation options. But somewhat lost in the FFIEC guidance is the fact that you are also responsible for identifying and assessing these devices at your third-party service providers as well. While the statement was written as if it was directed at both FI’s and TSP’s separately, the FFIEC makes it clear that:

A financial institution’s use of a TSP to provide needed products and services does not diminish the responsibility of the institution’s board of directors and management to ensure that the activities are conducted in a safe and sound manner and in compliance with applicable laws and regulations, just as if the institution were to perform the activities in-house.

So my interpretation of the expectations resulting from this guidance is that you must reach out to your critical service providers and ask about any XP devices currently in use at their organization. If they aren’t using any, an affidavit from the CIO or similar person should suffice. If they are, a statement about how they plan to mitigate the risk should be made a part of your risk assessment. The fact that the FFIEC mentioned “TSP’s” five times in less than two pages indicates to me that they expect you to be pro-active about this.

One other thing that might have been overlooked in the guidance is this concept of operational risk. Many IT risk assessments focus exclusively on the information security elements in their risk assessments, i.e. access to NPI/PII. They only assess the GLBA elements of privacy and security. Operational risk addresses the risk of failure, or of not performing to management’s expectations. If your risk assessment is limited only to GLBA elements, expand it. Make sure the criticality of the asset, product, or service is assessed as well. And, when indicated by high residual risk, refer to your business continuity plan for further mitigation.

In a recent speech to the Exchequer Club¹, Thomas J. Curry, the new head of the OCC, stated that although asset quality has improved, charge-off rates have fallen, and capital now stands at its highest level in a decade, another type of risk is gaining increasing prominence; Operational Risk.

“Some of our most seasoned supervisors, people with 30 or more years of experience in some cases, tell me that this is the first time they have seen operational risk eclipse credit risk as a safety and soundness challenge. Rising operational risk concerns them, it concerns me, and it should concern you.“

In fact, the OCC considers it currently to be at the top of the list of safety and soundness issues for the institutions they supervise. Earlier this year I wrote about how risk assessments were one of the compliance trends of 2012, and how regulators are now asking about things like strategic risk and reputation risk and operational risk, and expecting that these risks are assessed alongside the more traditional categories like privacy and security.

So the question is: What exactly is operational risk, and how can financial institutions effectively address it? The FFIEC defines it this way:

“Operational risk (also referred to as transaction risk) is the risk of loss resulting from inadequate or failed processes, people, or systems. The root cause can be either internal or external events. Operational risk is present across all business lines.”

Furthermore, because the implications of operational risk extend to all other risks….

“Management should distinguish the operational risk component from other risks to enable a stronger focus on operational risk mitigation.“

If you are still a bit confused about exactly what operational risk looks like, you are not alone. Because it exists in all business lines and manifests itself in every other risk, it is one of the most difficult risks to assess. In other words, it’s everywhere…and affects everything!

Simply put (and assuming your policies and procedures are adequate), most of the time operational risk can be defined as a failure to adhere to your own internal policies and procedures. In other words, if you don’t do what you say you will do, or you don’t do it the way you say you’ll do it, something will fail as a result. Whether a it’s a process, a control, a system, or a risk model…if they are in place and operational, but either flawed or not followed, operational risk is the result.² But here is the kicker, even if your processes/procedures/models, etc. are flawless and followed to the letter, if you can’t document that they are, you may still have a high operational risk finding in your next safety and soundness examination.

The best way to address operational risk is to implement an internal control self-assessment process to assure that risk management controls are adequate, in place, and functioning properly. Reporting will document that your day-to-day practices follow your written procedures. Finally, make sure all business decisions reflect the goals and objectives of the strategic plan, and report to the Board on a regular basis.

In summary, integrate assessment of operational risk into your risk management process, and expect to hear more about it from the regulators in the future. And don’t think that because you aren’t regulated by the OCC you won’t see this trend. After all, as Mr. Curry stated:

“As regulators, one of our most important jobs is to identify risk trends and bring them to the industry’s attention in a timely way. No issues loom larger today than operational risk in all its dimensions, the manner in which all risks interact, and the importance of managing those risks in an integrated fashion across the entire enterprise.”

[poll id=”3″]

¹ The Exchequer Club is comprised of senior professionals from trade associations, federal regulatory agencies, law firms, congressional committees and national press with a primary interest in national economic and financial policy.

² Business Continuity Planning uses a slightly different definition of operational risk. Since the basic assumption of a BCP is that your processes and systems have already failed because of a disaster, operational risk manifests itself in the additional overhead that the alternative recovery processes and procedures temporarily impose on your organization. Of course if your BCP is inadequate, failed processes will be the result.

Tag: operational risk

Windows XP and Vendor Management

“Operational Risk Increasing”

[poll id=”3″]