If a risk event took place - or as one would rather say something really went wrong - there are instantly comments like "Didn't I tell you?" and "I knew that would happen!"
Even if that is not helping quite often those people are right: Looking at the reasons for the losses following an event we note that there had been controls in place that were neglected . There had been risk preventing measures in place that had been disposed of for cost or efficiency reasons. There had been fights on the necessity of backup systems. You know the story for sure. (Please don't start the blowout-preventer discussion …)
Simulation can bring a lot of facts and figures to back up management decisions concerning risks and control measures in a business process . After the short term economic history resulting in the financial crisis many experts realized that the analysis of market and credit risk only is not sufficient - operational risk management is getting suddenly a much higher attention. But operational risk management has something to do with business processes and systems. This is not a natural fit with the methods that have been established on the credit and market risk side. How to judge a risk that is happening somewhere in a business process? Sure it is about impact and probability but how often may such a risk situation take place? What are the threats and vulnerabilities? Are there connections between risks along the process chain? Is a noted measure (control) effectively managing (reducing) the risk values? Is it working preventive or detective? Is it based on samples or checking on every instance of the process? How is it correlated with basic process risk like availability of resources and systems? There is a lot more to operational risk management than simply employing the metrics from credit & market risk.
Jim Sinur already last year had a point when stating that more than often leaders seem to be surprised when confronted with more extreme conditions and events. I share an opinion with him on how little effective scenario planning and response optimization is conducted in our companies and institutions. Using simulation on your business processes would enable you to dig into that discussion on how to react when things get rough or how to take care that those events do not take place or affect your own business. Today you are even able to refine your analysis with real data on your operative transactions from your core systems. So why neglecting such a lever for sustainable business?
We believe that process risk simulation can give substantial value to those discussions and ensure better balanced decisions. So I'm happy that we are now able to offer our customers enhanced process risk simulation! Fitting to the upcoming release we therefore asked experts to give you insight into this topic and the new possibilities coming along during the next weeks in our #LoungeTalk series and on www.grc-lounge.com.
Stay tuned!
