Simmons Bank

Many organizations struggle with the concept of risk analytics because it attempts to identify, assess, and quantify potential perils as a monetary amount. The struggle increases as companies attempt to identify and assess emerging risks that may be encountered on the horizon due to changing regulatory requirements, competition or technology. This usually occurs from awareness that there are unknown dependencies that vary by relationship and magnitude: how is a company supposed to identify, assess, and quantify reputational impacts that arise from business decisions gone awry or brand impacts from poor customer experiences in implementing a new product or service?

IT and analytics departments tend to be taskedwith quantifying a potential dollar amount as a loss if the risk is realized. However, beyond producing this dollar amount, most companies do not engage in regular risk analytics efforts sustained across time and at every level of the organization, mainly its business units or departments.

Risk analytics are important forcontemplating business decisionsin pursuit of a company’s rewards (i.e., revenue). Although there are multiple approaches and forms that make-up the concept of risk analytics, a large portion resides in scenario analysis (scenarios). Scenarios are a risk analytics tool permitting exploration of operational risk losses due to failures: created by human errors; within business units’ processes in pursuit of goals; of the company’s systems; or arising from external events such as acts of terrorism or natural disasters (e.g., COVID pandemic).

  ​Risk analytics are important for contemplating business decisions in pursuit of a company’s rewards (i.e., revenue). Although there are multiple approaches and forms that make-up the concept of risk analytics, a large portion resides in scenario analysis.

In general, scenarios are forward-looking, hypothetical storylines that explore potential future risk exposures. Many of these storylines emphasize risks involving emerging smart technology, data breaches, orphishing efforts against employees. For instance, a scenario was recently completed on remote workers potentially being more susceptible to data breaches from remote employees transferring sensitive files between work and personal devices. Once a storyline has been fully developed with socialization and feedback from key stakeholders in the First and Second Lines of Defense, a workshop to discuss the scenario with those key stakeholders must contemplate the probability of occurrence and the resulting potential losses inclusive of reputational impacts to the company’s brand and regulatory fines.

The work shops assess the frequencies(e.g., 1 in 3) and their associated severities (e.g., dollar amounts)of operational losses based upon historical data. Using statistical techniques such as hypothesis testing or regression, the workshop produces a narrative of how the scenario plays-out. It identifies current controls to mitigate the inherent risk to residual risk, control gaps that are needed to mitigate the risk exposure (i.e., residual risk),documents relationships and their magnitudes; and provides insights on risk drivers with recommendations to mitigate the aggregated inherent, reputational, and regulatory risk.Qualitative factors such as social media and brand impacts can be combined with the scenario outputs as estimates based upon documented constraints, limitations, and assumptions discussed during the workshop.

Ultimately, the workshop’s goal is to have the participants document the storyline and results into a whitepaper format that is sent to the appropriate management committees and where warranted, to the Board for their action in ensuring the emerging risk is sufficiently mitigated. Dependent upon the size and level of complexity of the organization, scenario analyses as a risk analytics tool should be an iterative effort that is systemic and tied to at least a quarterly workshop to produce the scenario whitepapers. These emerging risk scenarios contribute to the larger effort for each organization in identifying, analyzing, documenting, and actioning risk into business decisions.

The views and opinions expressed in this article are those of Morris Estep and are not endorsed by, and do not necessarily reflect the views of, Simmons Bank. Simmons Bank does not provide tax, accounting or legal advice.