The term operational risk management is defined as a continual cyclic process which includes risk assessment, riskdecision making, and implementation of risk controls, which results in acceptance, mitigation, or avoidance of risk. ORM is the oversight of operational risk, including the risk of loss resulting from inadequate or failed internal processes and systems; human factors; or external events. Unlike other type of risks operational risk had rarely been considered strategically significant by senior management.
Make risk decisions in the right time at the right level.
Three levels
; In Depth: In depth risk management is used before a project is implemented, when there is plenty of time to plan and prepare. Examples of in depth methods include training, drafting instructions and requirements, and acquiring personal protective equipment. ; Deliberate: Deliberate risk management is used at routine periods through the implementation of a project or process. Examples include quality assurance, on-the-job training, safety briefs, performance reviews, and safety checks. ; Time Critical: Time critical risk management is used during operational exercises or execution of tasks. It is defined as the effective use of all available resources by individuals, crews, and teams to safely and effectively accomplish the mission or task using risk management concepts when time and resources are limited. Examples of tools used includes execution check-lists and change management. This requires a high degree of situational awareness.
This process is cyclic as any changes to the situation requires re-evaluation per step one.
Deliberate
The U.S. Department of Defense summarizes the deliberate level of ORM process in a five-step model:
Identify hazards
Assess hazards
Make risk decisions
Implement controls
Supervise
Time critical
The U.S. Navy summarizes the time-critical risk management process in a four-step model: ; 1. Assess the situation.: The three conditions of the Assess step are task loading, additive conditions, and human factors.
Task loading refers to the negative effect of increased tasking on performance of the tasks.
Additive factors refers to having a situational awareness of the cumulative effect of variables.
Human factors refers to the limitations of the ability of the human body and mind to adapt to the work environment.
; 2. Balance your resources.: This refers to balancing resources in three different ways:
Balancing resources and options available. This means evaluating and leveraging all the informational, labor, equipment, and material resources available.
Balancing Resources verses hazards. This means estimating how well prepared you are to safely accomplish a task and making a judgement call.
Balancing individual verses team effort. This means observing individual risk warning signs. It also means observing how well the team is communicating, knows the roles that each member is supposed to play, and the stress level and participation level of each team member.
; 3. Communicate risks and intentions.:
Communicate hazards and intentions.
Communicate to the right people.
Use the right communication style. Asking questions is a technique to opening the lines of communication. A direct and forceful style of communication gets a specific result from a specific situation.
; 4. Do and debrief. : This is accomplished in three different phases:
Mission Completion is a point where the exercise can be evaluated and reviewed in full.
Future Performance Improvements refers to preparing a "lessons learned" for the next team that plans or executes a task.
Benefits
Reduction of operational loss.
Lower compliance/auditing costs.
Early detection of unlawful activities.
Reduced exposure to future risks.
Chief Operational Risk Officer
The role of the Chief Operational Risk Officer continues to evolve and gain importance. In addition to being responsible for setting up a robust Operational Risk Management function at companies, the role also plays an important part in increasing awareness of the benefits of sound operational risk management. Most complex financial institutions have a Chief Operational Risk Officer. The position is also required for Banks that fall into the Basel IIAdvanced Measurement Approach "mandatory" category.
