As automation sweeps capital markets, banks must focus on operational risk management.
Automation often improves efficiency, lowers costs and reduces operational risks that are inherent in manual processes and controls. However, technology can introduce unintended and potentially severe operational risk that needs to be systematically managed and controlled. Since piecemeal automation controls may only add to the danger, banks require a consistent, coherent and sustained long-term strategy for managing operational risk.
Chief Risk Officers have typically had a background in credit or market risk and tend to discount technology and operational risk as an administrative issue, not worth investing heavily in.
Banks’ capital markets divisions have responded to challenging market conditions with faster and more efficient execution, more sophisticated and detailed bank risk management and increased automation to optimize operational strategy and improve time-to-market.
Since the financial crisis, regulators have increased their scrutiny of operational risk management, adding pressure to create a more stable, transparent financial system with more automated, predictable bank front office environments. In the back office, where the primary objectives are efficiency and cost reduction, regulators have called for more robust control systems to eliminate unnecessary risk. As a result, comprehensive, systematic and auditable automation controls have taken over many routine tasks previously undertaken by (human) risk management specialists.
The interaction of bank automation and risk is complex since front office automation can actually increase risk. Bank operational risk is now gaining prominence alongside credit risk and market risk. For example, automation renders trading operations faster and more opaque, creating potentially dramatic financial consequences when technology risk goes unmanaged.
In the back office, increased automation can eliminate errors, speed up processes, reduce vulnerability to market impacts and impose greater discipline on the risk control environment. However, since operations and processes are typically automated piecemeal – with new systems being grafted onto earlier ones and leaving gaps and inconsistencies – new and unappreciated risks flow from the introduction of technology.
Most of these risks can be mitigated through operational risk management strategies, but it is not a simple task since there is limited historical data to estimate operational and technology risks, and quantification of possible impacts is highly subjective. The inability to reliably quantify risk makes judgments over the costs and benefits of mitigation, and the business case for investment, effectively impossible.
Today there is an increasing focus on retrospective work to understand and measure the risks that have been created alongside algorithmic trading and super-fast execution. Although the dangers of bank automation are now more widely appreciated, decisions are still too often being made within a short time horizon, and without full analysis of the ramifications across the organization. In addition, Chief Risk Officers, who are under pressure to minimize costs, have typically had a background in credit or market risk, and tend to discount technology and operational risk as an administrative issue, not worth investing heavily in.
Since it is difficult to make a sound business case for major investment in systems to improve operational risk management, some firms may target minimal regulatory compliance. However, leading financial institutions appreciate that doing the minimum necessary, and carrying unquantifiable but rapidly increasing risks, is unsustainable. These banks realize that they must pursue a necessary but expensive, five-ten year strategy with clear identification of specific priorities. While they may initially prioritize most pressing front office trading risk, they should also strive for greater visibility of operational and technology risk across the business.
An institution that creates a strategic vision to deal with the failings of the past can build a more robust business, to minimize technology and operational risk and the potential associated costs. These objectives are not only worthwhile, but may save the business.
To discuss these questions further, please contact:
KPMG in Germany
+49 89 9282 4982
KPMG in the US
+1 212 872 6549