Operational Risk Perspective: The ATR Dilemma!!!

ORM : A need for behavior shift?

Today, in a Monday morning meeting; there is no point in standing up and saying that the risk was documented in the RCSA sheet when the risk event has happened and the resultant loss is catastrophic… the cascading impact yet to be assessed. And again no one is going to listen that an Action Taken Report was generated…

The question asked is whether the envisaged risk was translated into Action that was supposed to be delivered in X number of days?

The most common answer from the ORM function is “it was told”

And then the story begins….

So, points to deliberate is how to change the Behaviour?

1. The Management needs to ensure that clear ownership is defined and thereby adequate resource and tools is available to address the strategic challenges that emanate today from various crisis starting from geo political risks; cybersecurity threats to impending AI risks.

• The ORM desk should be with the Business desk to see what the Business sees; to understand why “ they see what they see” and then disagree to make them agree with “what ORM wants them to see” with informed reasons from seasoned minds

• The First line needs to see “ what’s in store for me” and hence it becomes critical for the ORM function to “sell” their inputs so that the first line “buys” them to use it

• The job of first line today is intertwined with Third Party partners and who in turn is dependent with some other partners to ensure that the spokes of the wheel is well-oiled and works seamlessly…. But it is far from reality… There are many a crack at each step and the interdependent control governance is weak…. Hence translation of Direction to mitigate into Action gets lost. Hence, it is important that beside the inventory and the repository being in place; ensure that the stakeholders is Aware about How to Use It.

•  Another critical area is effective understanding of “Operational Resilience “and it is not that good to have but it has to be “Must Have” so that we act proactively and invest decisively to ensure we do not wait for the Incident to happen with us… It’s time to stop balancing the risk and control; it is time to Integrate and Ingrain in the behaviour to ensure it is Implemented….