Beyond Luck & Guesses: Overcoming the High Cost of Worthless Op Risk Models

[dennis_wenk]

The modern organization is highly dependent on information technology, simultaneously and quite unintentionally, information technology has introduced new exposures which have deceptively seeped into every layer of the financial organization.  The likelihood that an organization will experience a catastrophic loss from an IT-service interruption caused by an IT issue is far greater than an interruption coming from some disaster or ‘black swan’ event.  Still, the key to survival is allocating the appropriate amount of resources to the “right” risks; while that may include planning contingencies for a worse-case scenario, to be rational about risk more guidance regarding the investment tradeoffs that mitigate risk.

The “Big Question” is how to optimize scarce resources today, to achieve the greatest reduction in future losses.  The Big Question two components: (1) which risks are the serious ones and (2) what are the optimal risk-reduction actions.  The real problem for `traditional’ approaches like the Business Impact Analysis (BIA) and qualitative High-Medium-Low Risk analysis, is not that they are wrong, but that they offer no guidance on how to improve the situation. These traditional methods offer little advice for answering the Big Question.  In fact, they can be dysfunctional.  The unintended consequence of these outdated methods has been that the operational aspects of IT have been systematically neglected: This might be the biggest blunder in business today.  

The value of operational risk management lies not in identifying risks and exposures; the value lies in determining the optimal ‘investment’ to mitigate the most serious risks.  The cost-of-downtime and the BIA neither help identify causes nor help prioritize preventative actions.  The BIA provides little value for controlling operational risks because its primary purpose is to respond and recover, not prevent.  It overlooks the causal relationship of risk because it was never intended to treat a cause or a symptom.  It is an after-the-fact approach to produce contingencies for worse-case circumstances and not a preemptive, proactive approach to strengthen operations.

While traditional methods have inherent disconnects and do not answer the Big Question, there are things that can be done today to keep the odds in our favor.  A loss-expectancy risk model that economically quantifies operational risk will not only identify the serious risks but it also will provide the important cause-and-effect correlation needed to rationally evaluate risk-reduction tradeoffs through cost-benefit balancing. Visit the link below to read the details in Beyond Luck & Guesses: Overcoming the High Cost of Worthless Op Risk Models Click Here to Read.