Operational risk management: How to reduce risk and strengthen business performance

Businesses seeking to effectively manage their risk often focus on specific threat vectors, like cyberattacks. But what if you don’t want to stop just one specific type of threat, but make your overall operations more resilient?

Pursuing an operational risk management strategy can help you do that. Keep reading to learn more about what that means and how to start managing operational risk to protect your business.

What is operational risk management?

Operational risk management is the practice of making your business operations more resilient against disruption. This typically involves taking a close look at how your business operates, identifying threats and then establishing controls to mitigate those threats and to help your business keep running even if something goes wrong.

Every organization is exposed to a certain amount of operational risk, which can interfere with the normal operations of your business. This can include anything from a cyberattack to data inaccuracies to an exit by a key leader without a succession plan in place.

You can’t prevent all operational risks from occurring. However, by implementing an operational risk management strategy, you can prioritize which risks to prepare for and defend against, helping ensure that, if and when trouble occurs, your business can handle it with minimal financial, operational or reputational consequences.

Why operational risk management matters

Operational risk management matters because operational disruptions or risk-related challenges can actively harm your business. This may include costs, lost revenue, missed opportunities, slow growth, poor decisions, reputational damage, regulatory action and more.

Operational risk equals financial risk

Anything that leads to reduced or ineffective operations carries a financial cost. If you can’t serve your market or get accurate visibility into your business, your bottom line will take a hit.

This hit may appear in the form of a dramatic, one-time event like a ransomware attack, which can lock you out of your core systems and even force you to make a ransom payment to regain access. That’s an expensive problem to solve.

But operational risk can also be more subtle. Over time, it may lead to reputational damage because you’re not able to serve your customers as effectively or bad decisions that result in you slowly losing ground to your competitors.

Operational holes hurt your visibility into your business

Consider the risk of leaders making business decisions based on poor information. If your team is using AI more frequently in their daily tasks without a data foundation and effective governance in place, they may be getting inaccurate AI outputs that result in bad information flowing up to your C-suite.

Is this going to result in an immediate crisis? Probably not — but it could hamper your growth by making it harder to understand what your customers want or what your business needs to thrive.

Managing operational risk sets you up for growth and resilience

Conversely, taking action to manage your operational risk helps you fill in holes in your operations that can block you from growth. Assessing your risks and establishing controls helps you better understand how your business functions, which typically helps you identify process improvements or inefficiencies you can solve.

A business that actively manages operational risk is also more resilient. This means that even if trouble occurs, it’s less likely to knock you off course, because your team and systems are better prepared to deal with it.

Common sources of operational risk

Operational risk can arise due to one or a combination of factors. Common sources or types of operational risk include rapid growth, fraud, poor internal controls, AI or technology-related factors, cyberthreats, third-party vendor issues and personnel challenges.

Growth

Businesses that are growing often take on a higher level of operational risk. Adding new customers, people or offerings will usually strain your existing systems and controls. This is especially true after a merger or acquisition, as the rapid changes that result from merging with another organization can create new risk exposure faster than you can manage it.

Fraud

Internal malfeasance, like fraud, can stem from loose controls that make it easier for bad actors to manipulate your systems. Fraud is one of the more common reasons why organizations start taking action to manage operational risk; however, this often occurs only in response to fraud that’s already been discovered rather than as a proactive, preventive measure.

Poor controls

Poor controls mean you have less visibility into what’s happening inside your business, fewer hedges against error and more limited means to prevent bad behavior from either internal or external actors. This can lead to both dramatic, highly visible triggering events or low-level issues that build up over time.

AI

Businesses moving to integrate AI more deeply into their operations face risks as well as benefits. Absent proper governance and policies, AI can expose you to data privacy issues, cyberthreats, bias and regulatory challenges, reputational harm, low-quality information and hallucinations.

Technology

A digital transformation is essential for most businesses to compete in today’s marketplace, but embracing that shift comes with risks. These can range from having to eat the cost of an ineffective ERP implementation to regulatory complications around switching core systems, to not establishing proper controls as you move from on-prem to cloud-based technology.

Cybersecurity

Cybersecurity threats are everywhere and come with expensive consequences. Business email compromise, ransomware or malware, data theft and other cyber incidents can cause both short-term operational disruptions and longer-term ripple effects that make it harder to carry out your work.

Vendor management

As your business engages more third-party vendors like SaaS companies, you gain new risk exposure. Any data you share with a third-party vendor is potentially vulnerable should your vendor’s systems get breached. If the vendor that supports one of your core systems gets attacked, that could also interfere with your ability to use that system until the attack is resolved.

Personnel

Finally, an unexpected departure of a key executive or employee poses an additional source of operational risk. If your CFO suddenly jumps ship or the only person who knows how your bookkeeping really works abruptly retires, that can snarl your operations in ways that can be difficult to quickly untangle.

An operational risk management framework

Outside of regulated industries, most businesses don’t have an official operational risk management framework to turn to. However, a good approach to managing operational risk will usually include the following pillars or steps:

1. Perform a risk assessment

Look at your systems, processes, controls and financials to identify potential operational disruptions and understand which risks could have the biggest impact on your business. Typically, you’ll want to bring in a third-party risk advisor to make this assessment so that it’s as clear and accurate as possible.

2. Prioritize your risks

Based on your risk assessment, prioritize which risks you should mitigate. You can’t boil the ocean or be strong everywhere, so focus on the risks with the greatest potential for harm, whether financial, operational or reputational.

3. Create a roadmap

Create a plan based on your risk priorities to establish new controls and better processes to address these risks. Consider if you need to hire new people to help do this. Quantifying the potential financial impact of a given risk can help you determine how much money is worth investing here.

4. Implement new controls

Follow through on your roadmap by implementing new controls, better processes and additional risk mitigation measures to make your business more secure and resilient. But do so thoughtfully, as an overcontrolled environment can harm your business too.

5. Monitor and reassess when needed

Risk management is never a one-and-done effort. Treat risk as an ongoing process that involves monitoring and regular reassessments to evaluate how your risks have changed since your last assessment, so you can adapt as needed.

The role of internal controls in operational risk management

Internal controls are a core pillar of operational risk management. Controls are processes, procedures or policies that help reduce your risks by setting up protective guardrails around risk areas inside your business.

• For example, to reduce the risk of fraudulent purchase orders, you might establish a control that requires every purchase to be approved by a designated member of your accounting team, who then also confirms that the purchased item has been delivered. You could then strengthen that control further by requiring a second approval from a manager.
• Establishing that basic control would make it harder for any one employee to treat fraudulent purchases as a normal operational expense, reducing your risk of financial loss.

How strong controls improve operational resilience

Strong controls lower your operational risk levels, making your business more resilient against threats. This happens both by reducing the likelihood that a triggering event occurs and by limiting its spread or creating fail-safes that allow you to maintain operations or recover more quickly in the event of a disruption.

Controls are also a crucial source of business information. The process of looking for gaps and establishing new controls helps you better understand how your business functions. Once you have effective controls in place, you can also feel more confident that your financial and operational data is accurate.

This allows your leadership team to breathe easier from an operational and financial risk standpoint. As a leader, you can make decisions knowing you’re doing so based on what’s really happening, not incomplete or inaccurate data.

Operational risk management best practices

Your business’s specific risk management strategy should fit your needs, circumstances and appetite for risk. However, consider adopting operational risk management best practices like:

• Segregation of duties: Requiring multiple layers of approval or different reviewers for sensitive activities like purchases, payroll or financial transfers.

• Automated controls: Whenever possible, opt for automated controls over manual ones, because manual controls risk human error and operate more slowly.
• Access controls: Don’t give anyone on your team more access to your systems, facilities or assets than is necessary (this includes your executives). If you do need to give broad access to certain individuals, establish controls to ensure an independent team member can review all actions taken by those individuals.
• Don’t overcontrol: Controls are essential to managing risk, but don’t make yours more complicated than they need to be. Too many controls or controls that involve too many steps will slow down your operations to the point that they create more risks than they solve.
• Be open to change: Just because you’ve always done something a certain way doesn’t mean you should keep doing it that way. Risk management is about making your business more adaptable to face today’s challenges, not yesterday’s.

Benefits of implementing a strong organizational risk management model

It can feel tough to quantify the value of simply avoiding risks. However, consider that implementing an effective organizational risk management strategy delivers visible, concrete benefits for your business. These include:

• Smarter decisions: Your leadership gets more accurate information on the state of your business, resulting in smarter, more confident decisions.
• Streamlined processes: As you assess your processes to identify risks and control gaps, you’ll also learn more about how your business works so you can integrate silos and make process improvements.
• Fewer organizational redundancies: A controls review also helps you find inefficiencies or unnecessary redundancies in how you operate.
• Simplified audits: Financial statement audits will be simpler and less expensive, because your financial statement auditor will have greater confidence in your controls.
• Ready for growth: Managing operational risk helps you align your operations with your growth needs and plug holes that can slow or block growth.

How Wipfli can help

We advise businesses on how to avoid harm and support growth by managing operational risk. Let’s talk about how we can help make your business stronger and more resilient. Start a conversation.

Let’s make your business more resilient

Read more

• Nation-state actors represent a growing cybersecurity threat
• Shadow AI: How business leaders can avoid this growing risk
• Can outsourcing solve top ERP implementation risks?