oprisk

Issue #44

Last Update March 2, 2006

Finance Operational Risk by David Katz Business owners and investors are used to thinking of risk as coming from the economic activities in which they are engaged. Investment risk reflects the possibility that markets will not perform as expected, usually in respect to prices. Business risk reflects the possibility that company resources will be insufficient for company needs, or that technology will change the environment adversely, or that management my make unwise decisions. Other kinds of risks (currency risk in the case of international corporations, or credit risk for those businesses where customer debts are significant) are also carefully considered by the prudent manager, and by the individual considering a purchase of stock. Operational risk, the possibility that a company may fail or lose profits because of inadequate accounting, record-keeping or administrative systems, is rarely considered.

At the Managed Funds Association conference at Key Biscayne in February, operational risk was discussed as a significant factor in recent hedge fund failures. The lessons drawn from the hedge fund world are applicable to any type of business. In their workshop presentations, Robert P. Swain of Lighthouse Partners LLC and Stuart Feffer of The Capital Markets Co. described sources of operational risk and actions that must be taken to avoid it.

Some operational risk stems from a lack of adequate information about company performance. Such an information deficit can provide an opportunity for fraud, cripples management oversight that might prevent problems from flourishing, and prevents the actions that could take advantage of business opportunities. Poorly trained staff following inadequate procedures makes possible the errors that cost the firm money, destroy customer, vendor and investor confidence, and sow internal confusion. All of these problems also increase the probability that the company will transgress regulatory boundaries or fail to fulfill legal requirements.

Another kind of operational risk stems from the possibility of technological failure. Hacked networks or viruses can render a firm's data unavailable or unreliable, bringing corporate operations to a halt. Inadequate disaster recovery planning can put a company out of business should a natural or man-made crisis occur.

Minimizing operational risk requires that corporate owners and managers be aware of its importance, and that effective internal planing and execution be supplemented by independent evaluations and reviews of systems, procedures, personnel training and accounting activities and policies. Outside auditors can provide some of this independent oversight, although recent events have shown that even the largest auditing firms can be lax and compliant to the wishes of those with the ability to grant or withhold large fees. An operational audit by a consulting firm knowledgeable about the industry is often a useful addition to the normal financial/accounting audit, and will help ensure that management and the accounting auditor both do their jobs properly.

Investing in or doing business with a company entails a level of trust. In our market-oriented economy, this trust is supposed to be supported by accounting accuracy and transparency, verified by audit statements and enforced by regulatory oversight. The growing importance of operational risk as a factor in determining investment and business relationships should lead to operational audits becoming a normal and useful part of a firm's internal and external protection.