Abstract/Summary

This research studies a growing area of interest in financial services, namely operational risk management. The use of the term operational risk has grown in importance in financial services over the last ten years for a number of reasons, not least of which is the catastrophic failure of Barings bank in 1995. The failure of Baring's management to manage its operational risk exposures was one of the main factors behind the collapse. This study is focused on the UK retail banking industry and looks specifically at how these banks mitigate their operational risk exposures. The first problem with operational risk is finding an agreed and accepted definition within the financial services community. It is typically described as the potential for loss arising from inadequate or failed internal processes, people and systems or external events. It is thus an umbrella term covering a number of risk categories such as legal risks, people risks, information technology risks, compliance risks and so on. The Basie Committee on Banking Supervision, a Committee of banking supervisory authorities established by the central-bank Governors of the Group of Ten countries in 1975, published in January 2001 a draft capital accord which requires, inter alia, banks to set aside capital to cover their operational risk exposures. This accord resulted from a number of discussion documents issued by Basie, which focused increasing attention on the need for adequate management of operational risks. There is, and continues to be, mounting pressure on bank management to ensure that operational risk exposures are being mitigated effectively. This provided-the impetus for the research, which is the first independently sponsored study of how UK retail banks have established their operational risk management frameworks, which in tum provide the basis for mitigating their operational risk exposures. The research is inter-disciplinary exploring the main players in operational risk management: Internal Audit, the Risk Management Unit and Operational Management themselves. Since the process of mitigating an operational risk involves making a decision, theoretical propositions in this area established the foundations from which the fieldwork could be undertaken. The design for the study uses multiple case studies to answer the research questions and establish 'core practice' in operational risk mitigation. Interviews were held with practitioners from the main players in operational risk management cited above. Four leading UK retail banks were selected as representatives of the industry. The research supports the conclusions of Basie and others that' the responsibility for operational risk management, and therefore mitigation, rests with operational managers. The analysis illustrates, however, that they do not do this in isolation but are assisted by other 'experts'. A model of operational risk mitigation is proposed illustrating the complexity of the decision making process which is directly related to the nature and the scale of the operational risk identified. An operational risk mitigation checklist is suggested to help operational managers determine the feasibility of the proposed mitigation tactic together with a high-level review document for auditing the Operational Risk function. The thesis concludes by identifying some of the possibilities for research in this new and developing field.