A Theoretical Framework for Operational Risk Management and Opportunity Realisation

Sparrow, Adrian Working Paper A Theoretical Framework for Operational Risk Management and Opportunity Realisation New Zealand Treasury Working Paper, No. 00/10 Provided in Cooperation with: The Treasury, New Zealand Government Suggested Citation: Sparrow, Adrian (2000) : A Theoretical Framework for Operational Risk Management and Opportunity Realisation, New Zealand Treasury Working Paper, No. 00/10, New Zealand Government, The Treasury, Wellington This Version is available at: https://hdl.handle.net/10419/205425 Standard-Nutzungsbedingungen: Die Dokumente auf EconStor dürfen zu eigenen wissenschaftlichen Zwecken und zum Privatgebrauch gespeichert und kopiert werden. Sie dürfen die Dokumente nicht für öffentliche oder kommerzielle Zwecke vervielfältigen, öffentlich ausstellen, öffentlich zugänglich machen, vertreiben oder anderweitig nutzen. Sofern die Verfasser die Dokumente unter Open-Content-Lizenzen (insbesondere CC-Lizenzen) zur Verfügung gestellt haben sollten, gelten abweichend von diesen Nutzungsbedingungen die in der dort genannten Lizenz gewährten Nutzungsrechte. Terms of use: Documents in EconStor may be saved and copied for your personal and scholarly purposes. You are not to copy documents for public or commercial purposes, to exhibit the documents publicly, to make them publicly available on the internet, or to distribute or otherwise use the documents in public. If the documents have been made available under an Open Content Licence (especially Creative Commons Licences), you may exercise further usage rights as specified in the indicated licence. https://creativecommons.org/licenses/by/4.0/ Disclaimer: The views expressed are those of the author and do not necessarily reflect the views of the New Zealand Treasury. The Treasury takes no responsibility for any errors or omissions in, or for the correctness of, the information contained in these working papers. TREASURY WORKING PAPER 00/10 A theoretical framework for operational risk management and opportunity realisation Adrian Sparrow ABSTRACT Advanced probability models are used to evaluate risks and to justify decisions where reliable data is available, e.g. reinsurance, money markets and nuclear energy. Operational risk management – the trade-offs made to run an efficient and effective organisation – has much less, and lower quality, data. In the first part of the paper, observations are made about the factors shaping operational risk management: the increasing shift of influence from tangible to intangible variables; the intuitive manner in which most operational risk is managed; the dynamic nature of the trade-offs balancing risk and reward; and in particular, that the critical factor in managing risk and opportunity is often how each choice feels rather than how a rational choice should be made. An economic framework is then used to examine the optimal relationship between operational risk and reward. Although operational risk management has many investment characteristics, players are bias towards minimising risks rather than maximising opportunities. This is because of uncertainty over the variables, and better knowledge of costs than rewards. The conclusion is that an overt, systematic approach to managing operational risk will be more effective and efficient than allowing an informal, intuitive process to operate. This requires that assumptions and the judgement process must be made explicit; that the value of intangibles should be appreciated; and that the knowledge gained by individuals in managing risk should be codified and retained by the host organisation. ABSTRACT................................................................................................................................................1 SUMMARY................................................................................................................................................2 PART I: INTRODUCTION......................................................................................................................5 A BRIEF HISTORY OF OPERATIONAL RISK MANAGEMENT ......................................................................... 5 KEY FEATURES OF CURRENT OPERATIONAL RISK MANAGEMENT PRACTICE .............................................6 RISK APPETITE......................................................................................................................................... 8 OBSERVATIONS ABOUT MANAGEMENT BEHAVIOUR................................................................................. 9 DRIVERS ................................................................................................................................................12 PART II: THE KNOWLEDGE PRODUCTION FUNCTION............................................................ 14 KEY FACTORS........................................................................................................................................ 14 MODEL OF KNOWLEDGE USE AND FORMATION.....................................................................................15 EVOLUTIONARY PRODUCTION FUNCTION.............................................................................................. 16 TRADE-OFFS..........................................................................................................................................17 LEARNING AND INSIGHT ........................................................................................................................ 20 PART III: INVESTMENT TO MINIMISE RISK AND REALISE OPPORTUNITY..................... 21 RISK AND OPPORTUNITY “OPTIONS” ..................................................................................................... 21 PART IV: ECONOMIC FRAMEWORK .............................................................................................23 OPTIMISING EXPOSURE TO RISK ............................................................................................................ 23 OPTIMISING THE REALISATION OF OPPORTUNITY..................................................................................26 FURTHER CONSIDERATIONS ................................................................................................................... 28 CONCLUSION ........................................................................................................................................ 29 BIBLIOGRAPHY.................................................................................................................................... 30 GLOSSARY OF TERMS........................................................................................................................ 31 2 SUMMARY This paper was written mainly for people who manage operational risks and opportunities. It looks behind management techniques to see what concepts can be used to describe what happens, why it happens, and how these concepts can be used to improve the techniques that are in use. The paper should also be of interest to people who are curious about the factors that shape the way decision-makers respond to the challenge of balancing risk and opportunity. The paper takes a broad, high-level view, using various perspectives to examine the trade-offs made between risk and opportunity to run an efficient and effective organisation. Consequently there is no detailed investigation of specialist areas of risk management such as structural engineering, clinical risk management or risks relating to financial instruments. For the purposes of this paper, operational risk management is defined as the systematic assessment and management of the trade-offs made between risk and opportunity to run an efficient and effective organisation. Operational risks and opportunities managed implicitly and intuitively by individuals will not be managed as effectively or efficiently as those managed by an explicit and rational system. In either case, the up-front investment costs of mitigating risks or realising opportunities are much better known than the potential costs associated with realised risks or missed opportunities. (This is true of both tangible and intangible factors, although by definition, the intangibles are more difficult to measure.) As a consequence, there is a bias towards sub-optimal reduction in investment costs, and a value placed on wait-and-see options. As the drivers of organisational behaviour in both private and public sectors move organisations towards increasingly abstract, difficult to measure intangibles such as convenience, there is a higher reliance on the judgement of operational decision-makers. Many operational decisions must be subjective, yet they will be less fallible if they are made with the help of systematic and explicit assessment of risks, opportunities and investment costs. The interpretive information screens which decision-makers use are initially implicit. If this allowed to continue, unconscious sifting of data will occur, and the knowledge assets to manage operational risk will be built up covertly, making it difficult for the host organisation to retain or access the knowledge. It will also be difficult to enhance the efficiency and effectiveness of the assets through codification and abstraction. Techniques and methodologies to manage operational risks and opportunities are filters. They are designed to economise on the processing and consumption of data. Given that astute data manipulation offers a lever to exert a magnified influence over physical factors, the trade-off between data and 3 physical inputs will shift in favour of data over time. As data is collected and collated, the emphasis will shift in turn towards identifying patterns and trends, so that the use of data can also be reduced. Using more data, less physical resources occurs as decision-makers move up the risk management learning curve. In combination with insight jumps in productivity, the complexities of managing operational risk are reduced, which frees up capacity for new learning. As different parts of an organisation standardise “best practice” risk management approaches around the most valued features, there is a danger that the assessment process will ossify. When the operational risk/opportunity context changes, this will render the ‘optimal’ risk management system suboptimal. If this situation is allowed to continue, the system will fall into disrepute, causing individuals to revert to their own, unassisted judgement. Articulation of the knowledge gained in managing operational risk so that it can be captured in a formal risk management system offers the means to reduce contextual complexity. This is preferable for most organisations rather than allowing enabling individuals to absorb complexity, managing operational risks and opportunities by implicit – and opaque – judgement. Whatever approach is adopted, individuals and organisations are faced with the same investment decisions when deciding what treatment is appropriate to reduce exposure to risk or to realise opportunities. The value of the risk or opportunity must exceed the cost of treatment. Investment will not occur in either risk mitigation or realisation of opportunity until the required margin above the resource cost and uncertainty value. In this respect, the value of a decisionmaker lies in how well he or she manages the trade-off between opportunity, treatment, and risk. Due to the conditional nature of decisions to invest in risk/opportunity treatment, there is often an incentive to retain the option to invest rather than to invest fully. The wait-and-see approach is rational on four counts: a) at least part of a treatment investment is an irreversible sunk cost, b) the opportunity cost of not pursuing other treatments is uncertain, but could overtake the investment treatment under consideration, c) the probability of success is variable, and d) treatment factors are invariably ‘lumpy’. Decision-makers do not operate in a vacuum. Examining contextual drivers, and the marginal costs and benefits of investment decisions is helpful in understanding the behaviour of decision-makers in how they view operational risks and opportunities. There is a bias towards: a) under-investment in treatment, b) minimisation treatment costs, and c) reducing risk exposure. 4 Investment to realise opportunities suffers accordingly – which is compounded where there is an inherently low organisational appetite for risk. Because of the difficulty measuring intangible factors, decision-makers tend to wait-and-see, and to err towards under-investment. Consequently decision-makers will tend to fall short of the optimal points of investment in risk mitigation and, especially, in realising opportunities. A brief background goes through some of the factors leading to the current situation. At the moment, those managing operational risks are doing so mainly on an intuitive rather than intellectual basis. The key features of the current situation are described before going on to describe the particular objectives and scope of the paper. The main body of the paper examines the forces underlying operational risk management. A simple framework is proposed to illustrate the dynamics of risk and opportunity. Using this framework, various inferences are drawn which are then compared with observations made about risk management in public and private sector practice. The paper is summarised in a brief conclusion, which points out some advantages of the framework while acknowledging its limitations. 5 PART I: INTRODUCTION A Brief History of Operational Risk Management Humans have been managing risk ever since they were capable of coherent thought – weighing up the risks of attacking large animals against the reward of tasty food; investing in the planting of crops for the reward of the harvest; sacrificing to the gods in expectation of reward in the afterlife. Taking the opportunity out of risk and taking the risk out of opportunity is natural. However, making that process explicit, systematic and logical – risk management – only really began with the coming of probability mathematics. Since then areas and industries lending themselves to quantitative analysis have devised increasingly sophisticated mathematics and methodologies to determine the likelihood, impact and exposure to risks. Where data is available the results have been largely successful, but by definition the outcome of risk management is uncertain. Where relevant data is incomplete or unable to be collated into useful information, judgement is involved. The decision-maker has to form an opinion about the situation and evaluate the costs and benefits of various action or inaction. Further uncertainty arises in the area of operational risk due to the value of economic intangibles such as goodwill, and the volatility of interrelationships amongst the factors determining each aspect of risk and opportunity. Both the value of economic intangibles and volatility of interrelationships have been increasing rapidly over the last ten years. Given these features, risk management remains more of an art than a science, despite the growing body of literature classified as risk management. In terms of quantitative work, substantial progress has been made. The basic principles of risk management are simple but lend themselves to elegant theories where data and process can be brought together in specialist niches. Similarly, there is a growing body of methodologies and case studies, which demonstrate how various risk management approaches can be used to bring structure to the management of operational risk. This is in response to the mounting appreciation of the value that systematic management of risk provides, even in areas where reliable quantitative data does not exist. Risk management has been recognised as a valuable discipline within various activities for some time, even if different terminology has been used. These range from nuclear energy to policing initiatives. A particularly strong tradition has developed in areas where there is sufficiently reliable data to use mathematics to produce useful quantitative analysis. Momentum has been building in applying the same principles in operational risk management, where data is less reliable or is unavailable, and subjective judgement is used to provide more qualitative assessments. 6 While there has been steady progress in areas such as environmental care, various events around the world have accelerated the use of a systematic approach to the management of potential future events. In the United States the loss of the Challenger space vehicle and collapse of thrifts had an impact; in New Zealand it was the collapse of the scenic Cave Creek viewing platform. While these events were sufficiently shocking at a national level to promote the advent of recognised operational risk management processes, at an organisation level localised shocks caused similar demands to put risk management systems in place. This is particularly true of health and safety systems. With the rising awareness and recognition of operational risk management as such, various generic standards were published. These have been successful in providing a reference against which individual organisations can compare their own methodologies. The Australian/New Zealand Risk Management Standard is one example. First published in 1995, it was revised in 1999 to incorporate some of the communication aspects highlighted in the Canadian standard. This advancement has been reflected in ancillary aspects of risk management, for example in the management of governance risks through the Treadway Commission - Blue Ribbon Report process in the United States of America, King recommendations in South Africa, and Cadbury-Hampel process in the United Kingdom. A major feature of operational risk management as it is used by line managers in both private and public sector organisations (rather than vocational specialists) is the degree of judgement involved. Usually the critical factor in being a good manager of risks for these decision-makers is not the rational reason for dong one thing rather than another but how each choice is felt . In the absence of complete or reliable quantitative data, and under time pressure, they resort to using intuition to evaluate cause and effect. This is done instinctively rather than intellectually, so that emotions indicate when an ex ante decision is right, wrong or in some grey zone of doubt. It is increasingly recognised that a systematic evaluation process will improve on that approach. Methodologies based on the same principles outlined in the AS/NZS Risk Standard show in better perspective the risks and opportunities facing organisations. Key Features of Current Operational Risk Management Practice • Complexity. The rate of change in technology, relative competence and environment makes it too expensive and cumbersome to quantify all relevant variables to any great depth. Operational risk management tends to use only simplistic mathematical modelling, since assigning more detailed values quickly becomes arbitrary and the results misleading through unsubstantiated pretensions of accuracy. For example, a car manufacturer could compare precise monetary values on potential legal claims if it continues to install petrol tanks knowing that they are likely to 7 explode in an accident, against costs to retool production, yet discount a vague figure for loss of reputation, which could eventually be catastrophic. • Judgement. Due to incomplete and imprecise data, the screens that filter information into the knowledge used to make decisions inevitably skew interpretations to fit the organisational model. An organisation that is driven by technocrats to making sound ecological decisions for the disposal of obsolete plant could be badly wrong-footed if it ignores an emotive campaign waged by ecological activists. For this reason, the filters need to be made explicit and recognised as such. Organisational custom and practice, the ‘tone at the top’ and ethical norms will shape interpretation of the environment and potential events. Risks and opportunities are therefore subjective, making operational risk management inherently imprecise. The situation is compounded because events are not often well documented. Key players tend to move on, and managing the ramifications of an event takes precedence over analysing the causes • Extrapolation is dangerous. Probabilistic uncertainty remains high when managing operational risks. As Heraclitus noted, “Everything flows and nothing stays… you can’t step twice into the same river”. Twenty-six centuries on, organisational rivers flow a little quicker than they did in his time. Even in the public sector, organisational and environmental dynamics render past experience as no more than an indication of future interactions. • Operational risk is idiosyncratic and situational. A risk management system, which works well in one organisation, industry or sector, will not necessarily work well in another. Analytical perspectives and filters will be different, as will data sources. In addition the impact of externalities will have varying impacts on different organisations e.g. a change of government philosophy regarding import tariffs will impact Customs, importers and retailers in different ways and to different degrees. Where possible, managers of operational risk will use quantitative assessment, but the balance is by necessity skewed towards non-quantitative methods. Translating qualitative assessment into quantitative form allows clearer identification and setting of relative priorities in the treatment of risks and opportunities. Giving judgements consistent values and making the judgements explicit makes the risk assessment process more transparent, and introduces some robustness into what can be an otherwise arcane process. The danger is that the mathematical veneer can be mistaken for something more substantial, when in reality it is merely a crude conceptual tool with which to handle incompatible data. Assessing operational risk can be compared in some ways to the study of Black Holes. Specific data is unavailable about the actual phenomenon itself, but an 14 PART II: THE KNOWLEDGE PRODUCTION FUNCTION The first part of the framework follows Max Boisot’s model of the production function1 in which he describes how knowledge minimises an organisation’s consumption of energy, space and time for a given amount of effort. Key Factors The key factors in the knowledge production function are defined as follows: ♦ Data is a property of things . A distinction between physical states, which may or may not convey information to an agent, depends on the agent’s knowledge capacity to distil the data into information. ♦ Information is selected and re-arranged data . Information effectively establishes a relationship between things and agents; it is that part of the data residing in things that sets an agent in motion, having been filtered by the agent’s perceptual or conceptual apparatus. ♦ Knowledge builds on information that is taken out of data . Knowledge is a property of agents inclining them to act in particular circumstances. Knowledge cannot be directly observed, but it can be viewed as a set of probability distributions held by an agent, which orient the agent’s subsequent actions. When a knowledgeable person does not explicitly articulate his knowledge, his actions seem to be intuitive – by instinct or ‘sixth sense’. Many successful entrepreneurs have learnt how to take data, rearrange it, and use their appreciation of the context to make profitable deals. The same can happen with teams. Failing to make knowledge explicit means that it can be lost when the individual (or group) is no longer available in person. No-one is now sure how the pyramids were built with such precision, for example. The knowledge can also become redundant or become inflexible ‘received wisdom’. Unlike intuition the knowledge may be explicit, but it becomes irrelevant because the datainformation-knowledge relationships are allowed to ossify. 1 Boisot (1998) 15 Event (data source) Agent (knowledge source) Data Information Model of Knowledge Use and Formation The knowledge to manage operational risks is often held by agents and organisations insensibly. The interpretative information screens used to sift operational data are therefore shaped unconsciously, as new information arrives to either consolidate or modify implicit probability distributions. Risk management knowledge builds up over time to guide the reduction of exposure and realisation of opportunities, while simultaneously economising on the consumption of physical resources. As an example, a soldier on peacekeeping duties see an explosion (an event) and provides details (data) to an Intelligence Officer, who uses specific and general techniques (perceptual and conceptual filters) to provide a situation assessment (information) to the Commanding Officer (Agent), who then decides what risks and opportunities are latent, and what action should be taken. Given that codification and abstraction reduces the costs of converting potentially useable knowledge into knowledge assets, then allowing operational risk management to work in a covert, intuitive fashion is inefficient. If the existence and nature of knowledge can only be inferred from the action of agents, then knowledge assets have to be understood in a roundabout way. In short, making operational risk management explicit is an important step towards better effectiveness and efficiency in running an organisation. This applies not only to the techniques and methodologies applied to operational risk management, but also to the theory underpinning them. 16 Evolutionary Production Function Using capital and labour as traditional factors of production, curves aa’ and bb’ indicate the different mixes of treatment which can be applied to reduce exposure to risk (or alternatively, realise opportunity). Moving along either of the given curves gives the rate at which one factor can be substituted for another. Applied to operational risk management, technical progress acts to reduce the quantity of capital and/or labour to achieve a given level of risk exposure (or realise a given level of opportunity). This shifts the curve towards the origin, from aa’ to bb’ – an exogenously given discontinuity. However, following Boisot, it can be assumed that factors of production such as labour and capital can be decomposed into entities possessing both physical and information attributes. Information attributes have the capacity to modify the behaviour of physical attributes, and hence decrease their rate of consumption for a given benefit. These information attributes and the knowledge capacity to manipulate them are becoming increasingly valuable2. Boisot goes on to separately abstract physical and information attributes from the factors of a conventional production function to describe an evolutionary production function. Using this model, data about operational risks and opportunities provides the raw material for information, so that the judgement decisionmakers possess (knowledge assets) can be modified appropriately. The knowledge assets dispose the decision-makers to act in a particular way. Risk management methodologies and techniques help shape the knowledge assets possessed by individuals, and to build up the knowledge assets of the organisation. The methodologies and techniques act as information filters, which economise on the consumption and processing of data. Irrespective of an organisational risk management system being in place, the judgement of decision-makers emerges as a valuable knowledge asset for which the individual is rewarded. However, without an explicit system of capturing the knowledge, those assets are seldom recognised as such and 2 See for example K Sveiby “Managing Know How” (1987) and G von Krogh “Knowing in Firms” (1998) Data Physical factors b’ b a a’ a’ Capital Labour b’ b a 17 even less frequently captured systematically into the host organisation’s institutional memory. Boisot’s evolutionary production function offers two insights into the management of operational risk. Trade-Offs The first is that there is a trade-off between consumption of data and consumption of physical resources, (shown in the above diagram by moving up the curve aa’ ). Two simple examples are the use of Collators on major police investigations, and Account Managers in consultancies who enable more focused use of professionals to solve crime and sell services respectively. The second is that as organisations evolve, the trade-off between physical and information inputs is asymmetrical, having a tendency to shift towards increasing the processing and consumption of data. A process of differentiation, integration, and creation of memory-models do this. Where these remain implicit in the realm of operational risk management, the working of this evolutionary production function is less efficient than where the models are explicit. Even if it were entirely efficient, the management of operational risk would still require some element of physical resource. Furthermore, decision-makers confront the need to economise on the consumption of data as well as physical resources. Filtering information from the data, and discarding the remaining data (represented here by the discontinuous jump down from one curve to another closer to the origin) does this. Decision-makers, as managers of operational risk and opportunity intuitively look for the regularities that suggest patterns. Once a pattern is discerned, the need to deal directly with the data is largely for verification only. The focus consequently shifts from data to pattern – focus is much sharper when screening filters, information and knowledge are made explicit and subject robust examination. Differentiating between risk and opportunity priorities can be achieved by insights which reduce the amount of data and physical resources by jumping to a curve closer to the origin. It can also be done by substituting data for physical resources i.e. an upward and leftward shift on the aa’ transformation curve. Mirroring technical change in the more conventional production function, the data-economising process is characterised by Data Physical factors Experience Insight 18 discontinuities (as is the knowledge to which it gives rise). The potential for endogenous discontinuity is therefore an inherent feature of operational risk management systems, whether the system is explicit or implicit. It is obviously easier to realise that potential when the system is made explicit. A given insight will reduce data handling, the weight on the system’s recall and the load on data exchange. An insight however cannot be predicted from a prior knowledge of the data to be processed or the characteristics of the data processing agent. Paradoxically therefore, an operational risk management system that is working well tends to pursue a discontinuous, unpredictable course. Over the last five years operational risk management have provided sound models to guide the extraction of information from data in a methodical, codified fashion. However, even leading methodologies such as AS/NZS 4360:1999 do not deal with abstraction in building up the knowledge assets that result. What is generally inferred in the methodologies is that there exists a direction to the technical change (unlike traditional production functions), in that over time the trade-off between factors will usually favour the use of data over physical resources. The knowledge assets used to manage risks are generated as data accumulates, interpretative models are improved (moving productive activity upwards and to the left) and insights occur (dropping productive activity vertically downwards to another curve as better information is dug out of the data). This assumes that the knowledge assets develop in such a way that they yield a net gain, given that the operational context is dynamic and so liable to make some aspect of the knowledge asset redundant as the relative value of risks, opportunities and treatment costs fluctuate. The starting point for the implicit, intuitive risk management process used by most operational decision-makers is accumulation of tacit, experiential knowledge. This ability to absorb complexity is controlled by individuals within an organisation. In the absence of a coherent process, such knowledge can only be articulated and communicated with difficulty. At the most basic level the absence of commonly understood terminology will lead to confusion. Knowledge remaining in the heads of individuals makes its value to, and existence within, an organisation, precarious. For this reason, it is better for organisations to invest in the expression of knowledge and to reduce complexity, rather than to allow a risk management system to revert to the natural status quo (i.e. the absorption of complexity and the concomitant accumulation of tacit knowledge). This can be seen in the way that mechanical diagnosis has been ‘built-in’ to modern cars, so that the value of remedial actions is retained and used not only to reduce exposure to breakdown risks, but also to realise latent design opportunities. Where operational risk is managed implicitly, the knowledge assets, which determine the management of operational risk, are not as appropriable as physical assets. The more widely organisations rely on implicit knowledge 19 assets to manage operational risk, the more difficult it is to capture and retain whatever value is created. Even in the public sector this is a concern. For the private sector this suggests that it will be difficult to defend the return from any competitive advantage brought from advanced operational risk management. 20 Learning and Insight To summarise, the knowledge assets emerging in risk management are the product of both moving up the learning curve, and of insight. Insight is triggered by empirical data, and in return insight provides a base from which to improve the type of data collected. Making explicit the development of operational risk management knowledge allows faster incorporation of useful data within the information structures created by insight; it also quickens the consequent shedding of excess data by enabling selective purges of redundant data. This has the effect of reducing complexity, creating fresh capacity for further improvements and insights. The types of models that can be built using this approach include credit scoring for bank loans. When operational risk management is left as an intuitive process, the rate of progress along the curve is limited to the capacity of individuals. This is because the organisation does not systematically collect, collate or share individuals’ experience. When users are educated and acquire experience in a shared, transparent process then upward movement along the learning curve is hastened. Introducing systematic risk assessment is not without drawbacks. A standard pattern of risk assessment and management will tend to emerge as performance improvements occur around those features that are most valued. Initially, the standardisation process moves in relatively large insight leaps downward from one experience curve to the next. The insights also stimulate progress along each curve, which in turn leads to further insights. Data complexity is reduced and factor savings result, but the closer the improvements come to the origin, the more constraining structures and standards become. Hence, once established, risk management systems can ossify if it becomes accepted wisdom that optimal treatment has been determined. As previously discussed, the context in which knowledge assets develop is continually changing, so that a good operational risk management process must take care to steer between reducing complexity in the amount and nature of data that is processed, and absorbing complexity in the information screens that filter the data which feeds it. Logically, organisations should choose to invest in the means to articulate and capture knowledge so that it can be shared and used to facilitate good operational risk management. Investment in operational risk management however, is inherently skewed towards the alternative, which is to allow knowledge to remain tacit, and to enhance the ability of individuals to cope with higher levels of complexity. This is examined in the next section. 21 PART III: INVESTMENT TO MINIMISE RISK AND REALISE OPPORTUNITY This part of the framework follows Dixit & Pindyck in their work on investment3 and applies their reasoning to operational risk. Risk and Opportunity “Options” Dixit & Pindyck assert that the value of a risk must exceed the purchase and installation cost of the action necessary to treat it appropriately, i.e. by an amount equal to the value of keeping the investment option alive. The opportunity cost of investing in the treatment can be large; and the opportunity cost is sensitive to uncertainty over the future value of the investment undertaken. It follows that there is an incentive to pay an exercise price for holding a risk or opportunity in abeyance rather than treating it, since exercising the treatment option is at least partially irreversible. The option to invest is valuable in itself, because the potential realisation of an opportunity or a risk is uncertain. If the value of the risk exposure or opportunity reward rises, the net value of investment in the treatment rises accordingly – and vice versa. If the situation remains unclear, the organisation need not invest to the full extent and will suffer only the cost necessary to obtain deferral of the investment decision. The cost of postponement must be assessed against the costs imposed by a realised risk or missed opportunity. Doing little or nothing is a valid choice, which is rational if considered assessment is made of the likelihood and impact of a potential event. In the absence of clear parameters and data to populate such a rational model, it could be argued that the value of a manager lies in the judgement to “know” when, and how much, to invest in the treatment of each risk and opportunity. This is particularly true in relation to real and anticipated changes in the relative values of treatment cost, opportunity and risk. “Most investment decisions share three important characteristics in varying degrees. 1. First, the investment is partially or completely irreversible . In other words, the initial cost of the investment is at least partially sunk; you cannot recover it all should you change your mind. 2. Second, there is uncertainty over the future rewards from the investment. The best you can do is assess the probabilities of the alternative outcomes that can mean greater profit (or loss) for your venture. 3. Third, you have some leeway over the timing of your investment. You can postpone action to get more information (but never, of course, complete certainty) about the future.”4 3 Dixit & Pindyck (1994) 22 Since the option value increases with the sunk cost of an investment and with the degree of uncertainty over future prices, the opportunity cost of the action chosen to treat a risk is a significant part of an investment decision. The nature and degree of uncertainty over future costs will have a significant effect on the treatment decision. The higher the degree of uncertainty, the more valuable becomes the freedom not to invest if the treatment price goes up. Often, action such as organisational restructuring takes place in several phases but uncertainty pertains to the total cost of the investment. Information will be revealed after the first few steps of the project are undertaken, so the pilot or proving stages have value above that suggested by traditional net present value calculations. Finally, the value of greater flexibility provided by a small scale investment might offset the economy of scale advantage enjoyed by a larger investment. This is a particularly appealing notion if it is accepted that those managing operational risks and opportunities have a low risk appetite and follow a waitand-see approach. In summary, operational risk management involves sunk costs; each decision must be made in an uncertain environment, and each choice allows some freedom of timing. Consequently there will be a full commitment to mitigation of risk, or realisation of an opportunity until one of two conditions occurs. The first is that the value of the marginal output of the investment is perceived to be sufficiently above the cost. The second is that the required margin or multiple above the resource cost is higher than the value of the sunk cost and / or the uncertainty of the outcome. 4 Investment Under Uncertainty , Dixit & Pindyck, p.3 23 PART IV: ECONOMIC FRAMEWORK Optimising Exposure to Risk For any organisation it should be remembered that the costs are not only direct, (such as contracting in skilled assistance), but also indirect and intangible, (such as damaging staff morale by diverting resources promised to one team to another team so that an opportunity can be realised elsewhere). Managers have to set and justify priorities by some basis. This is more easily done if the decision-making model is specific, logical and transparent. This is the final part of the framework. It proposes a simple economic model of the trade-offs made between risk and opportunity to run an efficient and effective organisation. 30 BIBLIOGRAPHY Australian Public Service Guidelines for Managing Risk in the Australian Public Service , APS Management Advisory Board & Management Improvement Advisory Committee Report No.22, 1996 Integrating Best Practice Risk Management into Organisational Strategies and Operations , J. Sesel, Presentation Paper for Australian Institute of Risk Management, 1999 Investment Under Uncertainty, A. K. Dixit & R. S. Pindyck, Princeton University Press, 1994 Knowledge Assets , M. H. Boisot, Oxford University Press,1998 Learning About Risk: Choices, Components & Competencies , Canadian Institute of Chartered Accountants, 1998 Managing Risk in the Australian Public, C Vassarotti, The Canberra Bulletin of Public Administration No.84, May 1997, pp.79-84 Managing Risk in Public Services , International Journal of Public Sector Management Vol.9 No.2 1996 pp 57-64, 1996 Operational Risk Management, Basle Committee on Banking Supervision, 1998 Operational Risk: Towards a Standard Methodology for Assessment and Improvement , B. Young, Operational Risk Research Forum, 1999 Owning the Future: Integrated Risk Management in Practice , ed. D. Elms, Centre for Advanced Engineering, 1998 Risk-based Management: A Reliability-centred Approach , R. Jones, Gulf, 1995 Project Risk Management: Process, Techniques & Insights , C. Chapman & S. Ward, Wiley, 1997 Risk Management Standard , AS/NZS 4360:1999, Standards New Zealand, 1999 Risk Taking , Z Shapira, Russell Sage Foundation, 1995 Risk Management Today & Tomorrow , D. McNamee, Special Paper commissioned by the New Zealand State Services Commission, revised 1997 The Knowledge-Creating Company , I. Nonaka & H.Takeuchi, OUP, 1995 31 GLOSSARY OF TERMS The following interpretations have been made for the purpose of this paper. Risk appetite The point of balance between risk and reward at which a decisionmaker feels most comfortable. Cost Total price to be paid by an organisation (being the sum of direct and indirect, tangible and intangible charges). Event An incident or situation that has occurred. Exposure (residual risk) Risks remaining after risk treatments have been applied. Impact Realised potential of a risk or opportunity, i.e. the effect of an event or a potential event. Inherent Risk Risks intrinsic to a given situation prior to the application of any alleviating or aggravating treatment. Likelihood A value assigned to the probability or frequency with which a potential event is estimated to occur. Operational Risk Management The systematic assessment and management of the trade-offs made between risk and opportunity to run an efficient and effective organisation. Opportunity A potential event deemed to have a positive effect on an organisation. (Evaluated by estimating the combined impact and likelihood.) Risk A potential event deemed to have an adverse effect on an organisation. (Evaluated by estimating the combined impact and likelihood.) Risk Assessment A systematic process of analysis and evaluation of risks and opportunities. Risk Management The systematic and conscious understanding, organisation and treatment of risks and opportunities. Sunk Cost Costs which cannot be recovered when an organisation withdraws from providing a good or service Residual Risk (exposure) Risks remaining after risk treatments have been applied. Treatment Conscious action in relation to a risk or opportunity:  Reject (walk away).  Transfer (split the risk with another party ).  Accept (take the risks & opportunities as they come).  Optimise (reconfigure strategy, operations, culture, etc. to maximise opportunity and/or minimise risk). Uncertainty Context in which an event occurs with some probability, the distribution of which is unknown