OR 1 – Introduction to Operational Risk and Resilience

Most practitioners start from the wording of the Basel Committee on Banking Supervision (BCBS), for which operational risk is “the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events.” Read closely, that sentence is really a list of four root causes: processes, people, systems and external events. Anything that goes wrong because one of these four fails, and that costs the firm money, sits inside operational risk.

Because the definition is built on causes, operational risk management (ORM) is also organised around them. Managing the people cause means making sure staff are competent and that teams are properly resourced for the work they carry. Managing the systems cause means watching how technology performs and protecting it from failure and attack. The process cause calls for clear organisation and governance of every important activity in the firm, and the external cause calls for scanning the environment for events, from storms to pandemics to changes in the law, and asking how each one could reach the business.

Operational risk, non-financial risk and enterprise risk management

Some banks do not have a department called operational risk at all. They run a non-financial risk management (NFRM) function instead, and the label is deliberate. The word “non-financial” describes where the risk comes from, not what it costs. A failed payment system or a fraudulent employee is a non-financial cause, yet the result is usually a very financial loss, sometimes accompanied by operational damage such as lost service. This is the real contrast with market risk and liquidity risk, and to a lesser degree credit risk, whose drivers are prices, funding conditions and borrower finances. Operational risk drivers, by contrast, are mostly about how the organisation itself works.

Enterprise risk management (ERM) is the broadest of the three ideas. It looks at every risk the firm carries, financial and non-financial, from a single firm-wide point of view. In a bank or an insurer, market and credit risk are so large that ERM has to give them heavy weight next to operational risk. In a hospital group or a software company the picture is different: there may be little market or credit exposure, and the firm’s risk profile can be dominated by operational risk. In such firms ERM and ORM end up looking almost the same, which is one reason financial institutions can borrow ideas from general ERM frameworks when they design their own approach.

The BCBS sorts operational losses into seven broad categories, usually called the Basel level 1 event types. Each level 1 type splits into more specific regulatory sub-types at level 2, and those are illustrated by concrete cases at level 3. Together the three levels form the Basel taxonomy, which gives every bank a common language for recording incidents, so that loss data from different institutions can be pooled and compared.

The table below lists the seven level 1 types with their usual acronyms. The frequency and severity columns come from industry loss data collected through the ORX Banking loss report for the years 2014 to 2019, which is broad enough to be treated as representative of the banking industry. Frequency is each type’s share of the number of loss events, and severity is its share of the total amount lost. The last column is a derived figure: severity share divided by frequency share, which shows whether a typical event in that category is larger or smaller than the average operational loss.

Source: ORX Banking loss data, 2014 to 2019. Severity shares are rounded, so the column sums to 101%. The ratio column is derived.

Reading frequency against severity

Putting the two columns side by side tells a story about event size. External fraud accounts for 30% of events but only 9% of the money lost, so a typical external fraud event is small. That fits what banks see every month: thousands of card fraud cases, the great majority of them modest, with very large retail banks recording far more. The same category also contains hacking damage, which can be severe, so a single event type can hold incidents of very different sizes.

Clients, products, and business practices sits at the other extreme. It produces 22% of events, under a quarter of the count, yet 52% of the losses. The reason is that regulatory fines are booked here, and fines on large banks have sometimes reached billions of dollars. Business disruption and system failures shows the same tilt on a smaller scale, at 2% of events and 5% of losses.

One caution applies to everything in the table: these are direct financial losses only. The indirect costs of a large incident, such as reputational damage, a fall in market capitalisation, senior management being replaced and the cost of remediation, are not captured and can be much bigger than the direct loss. A further pattern worth knowing is regional: EPWS events are especially frequent among Latin American banks but hardly appear in European data.

Large operational losses make the abstract categories concrete. Four kinds of incident stand out in recent banking history.

Regulatory fines

In 2014 Bank of America paid the largest single fine on record, $16.7 billion, to the US Department of Justice over sales of residential mortgage-backed securities in the years before the financial crisis. Much of the conduct took place inside businesses it had acquired during the crisis, notably Merrill Lynch and Countrywide. Since 2000, Bank of America has paid 214 regulatory fines totalling $82.7 billion worldwide, while JP Morgan has paid $35.7 billion across 158 fines. In the UK, Lloyds Banking Group (Lloyds Bank plc, Bank of Scotland plc and Black Horse Ltd.) paid £21.9 billion ($28 billion) in fines and customer compensation between 2015 and 2019, imposed by the UK regulator because it mishandled payment protection insurance (PPI) claims and misinformed customers when selling that insurance with its banking products.

Successful hacking

Equifax took two months to disclose a breach that had exposed the data of 145 million customers. Uber hid a leak affecting 57 million US customers for a year and paid the hacker a ransom in the hope that the stolen data would be destroyed; in December 2017 a former employee also accused the company of corporate espionage. Both firms replaced their top management, and Equifax lost $3.5 billion of market capitalisation after the breach.

A failed IT migration

In April 2018 TSB Bank, previously part of Lloyds Banking Group, botched the move of its online banking system to a new platform. Millions of retail customers lost service and about 100,000 had no access to the bank at all for several weeks. Public anger was made worse by the chief executive, Paul Pester, who tweeted that the system was “up and running” while customers were still locked out. A parliamentary inquiry followed, and the episode added momentum to a regulatory push on resilience that was already under way.

Rogue trading

In January 2008 Jerome Kerviel caused Societe Generale’s largest recorded trading loss, €4.9 billion. The chief executive, Daniel Bouton, described him publicly as an “isolated genius,” a claim that specialists rejected, rightly. The bank lost billions more in equity value, most of the senior team was removed, and Kerviel spent several years in prison. UBS suffered a similar rogue trading loss of $2 billion in 2011.

How operational risk became a discipline

Credit, market and actuarial risk have been managed for centuries; banks have lent money and handled credit risk since the fifteenth century. Operational risk, as a named discipline with its own techniques, is much younger. Banks were never indifferent to fraud, which every industry watches closely without being told to, but for a long time no external rules were needed. What changed was the growth and speed of financial markets, which multiplied exposures and made a single failure far more damaging.

The turning point came in 1995. Nick Leeson, trading from the small Singapore branch of Barings, lost £660 million on derivatives and brought down Britain’s oldest merchant bank in the process. The BCBS, which sets supervisory principles for internationally active banks, used the shock to make banks manage the risks created by their day-to-day operations, on top of credit and market exposures. The new category, “operational risk,” collected every risk that was neither credit nor market risk, which is why it is so mixed. Many bank managers were sceptical at first: how could anyone measure, control and hold capital against people making mistakes? Supervisory guidance and the sharing of practice among the largest banks gradually built the discipline, with insurers following about 10 years later. Two decades on, the practice is still developing, but it has come a long way.

The Basel definition comes with a short rider: legal risk is in scope, while strategic and reputational risk are left out. Specialists have long debated why the line was drawn there. In 2021 the BCBS softened its stance in its revised Principles for the Sound Management of Operational Risk (RPSMOR), saying that, where appropriate, banks’ operational risk management should also consider strategic and reputational risks. So the formal boundary remains, but supervisors now expect firms to look across it.

Legal risk and compliance risk

Legal risk concerns contracts and the law: whether a contract can be enforced, whether it has been breached, whether it is still relevant, and what the firm loses when it gets a legal matter wrong. Legal losses can appear in almost any event type, though they cluster in EPWS (type 3), through employment disputes, and EDPM (type 7), through documentation and vendor disputes.

Compliance risk is wider than legal risk, because it covers every rule and regulation that applies to an activity and not only the law. In the early days of operational risk it was recorded under CPBP (type 4). Since then the rulebook has grown and penalties have risen many times over. The $1.9 billion fine HSBC received in 2012 over weak anti-money laundering controls, which included failing to catch at least $881 million of drug-trafficking proceeds moving through its US bank, was at the time the largest a regulator had ever imposed on a bank. The settlement also included a five-year deferred-prosecution agreement. A decade later that amount looks modest beside the £21.9 billion paid by Lloyds Banking Group or the Bank of America fines. Penalties of this size, often combined with business restrictions, have pushed most large banks to create separate compliance departments. In some, such as JPMC and BNPP, operational risk management actually sits inside compliance as one of its activities.

Reputational risk

One plausible reason regulators left reputational and strategic risk out is that it keeps operational risk measurement as objective as possible. Reputational risk usually describes the harm to a firm’s image that follows an operational incident. Seen that way, reputation is a consequence of other risks, not a primary driver, and most financial firms include reputational damage, its prevention and the response to it in their ORM work, typically as one of the impact dimensions in their assessment tables.

Reputation becomes a risk in itself when management knowingly puts the firm’s image on the line for commercial gain: entering certain countries, selling certain products, or running a controversial marketing campaign to win business or raise brand recognition, even though some stakeholders or political groups will object. That should be a conscious risk appetite decision, accepting more reputational risk because the expected return is higher.

Strategic risk

Financial firms usually bring reputational risk into ORM but leave strategic risk out. The distinction is finer than it looks, because strategic risk has two parts. Losing money because the firm chose the wrong strategy is strategic risk in the narrow sense. Losing money because a sound strategy was carried out badly, through poor processes, weak people or failing systems, is a form of operational risk. More broadly, people are both the main source and the main mitigant of operational risk, and senior management competence is arguably the single largest driver of strategic results. Since competence, information quality and sound governance shape strategy, strategic risk can fairly be called operational risk in the boardroom.

A real 2016 case involved an international health insurer whose board abruptly removed its chief executive, largely because of mounting impatience and a clash between a conservative board and a more creative leader. The replacement, chosen from the executive committee for being accommodating, had almost no general management experience and soon proved unable to do the job. Within four years, 50% of the firm’s net asset value had gone, and the underperforming chief executive was dismissed in turn.

Some institutions do place strategic risk fully within non-financial risk management, on the view that risk management exists to help the firm achieve its objectives. ISO 31000 describes risk as the “effect of uncertainty on objectives,” a wording that ties risk directly to strategy. A key risk, on this view, is one that could damage a key objective, and an uncertainty that cannot touch any objective does not matter. Mapping risks to objectives is a practical way to bring risk into boardroom discussion and into everyday operations.

A risk management framework is a description of the actions, techniques and tools an organisation uses to manage its risks. Because operational risk takes up a large part of ERM in many non-financial industries, banks and insurers can draw on general ERM frameworks when they design an operational risk management framework (ORMF).

ISO 31000 and COSO ERM

Two ERM frameworks dominate, inside and outside finance. The International Organization for Standardization published ISO 31000 in 2009 and revised it in February 2018, shifting the emphasis towards creating value, tailoring risk management to the organisation and taking account of human and cultural factors. UN organisations follow the ISO approach. COSO, the Committee of Sponsoring Organizations of the Treadway Commission, finalised its own revision in September 2017, under the theme of aligning risk with strategy and performance. That update replaced COSO’s well-known cube with concentric circles that put mission, vision and risk culture at the centre and set out 23 tools and actions intended to improve strategic performance. Public and international bodies such as the World Bank draw on COSO. Both frameworks apply to financial and non-financial organisations alike.

The four core activities

Firms draw their frameworks as houses, building blocks, cycles or process charts, but underneath the pictures the work reduces to four activities that repeat in a loop.

Risk identification means discovering, defining, selecting and classifying, as completely as possible, the risks that a business or activity faces, with the focus on those that threaten its objectives and strategy. Risk assessment then rates each identified risk by likelihood and by impact, also called severity, to separate the negligible from the extreme and everything in between. Both dimensions move over time with the business’s exposures and with external conditions, which makes assessment one of the hardest parts of the job.

Risk mitigation deals with whatever assessment flags as too likely or too severe. The tools include several kinds of controls, insurance, other forms of risk transfer and simply reducing the exposure. Risk monitoring, together with reporting, checks whether all of this is working: whether the business is stable, whether controls perform as intended and how the risks themselves are changing. When monitoring shows something has not worked, the lesson is carried into the next round of identification, assessment and mitigation. That feedback is why the four activities are drawn as a continuous cycle and not a straight line.

Some frameworks describe actions, others list tools, and few connect the two. A firm gains a lot from drawing a complete picture that pairs each risk management activity with the techniques it actually uses, because gaps and overlaps then become visible. A composite ORMF of this kind, which each firm would adapt to its own practice, also adds three blocks that the basic cycle leaves out but that the financial industry treats as essential: risk governance at the top, a base of risk culture and conduct, and a risk appetite step inside the loop.

Based on a framework published by Ariane Chapelle; layout and wording are original.

The three added blocks

Risk governance is about who does what. It assigns roles and responsibilities across the organisation for carrying out risk management and for reporting on it, so that each activity in the cycle has an owner and an escalation route.

Risk culture and conduct is about winning the hearts and minds of every employee, so that people care about risk and behave well even when no control is watching. Because operational risk arises in every task, a framework that rests on a weak culture will leak, however good its tools look on paper.

Risk appetite and tolerance is a requirement for regulated financial firms, which must set the limits of the risk they are prepared to take in pursuit of their objectives. Appetite matters because it decides priorities: which exposures the firm accepts and which it must mitigate first. That is why it earns its own place in the loop, directly after identification and before assessment, so that what the firm finds is judged against what the board has agreed to accept.

Operational risk has five features that set it apart from market and credit risk and that explain why it is hard both to manage and to model: it is heterogeneous, idiosyncratic and diffuse, heavy tailed, interconnected and dynamic. This section takes the first three; the next covers the last two and pulls together the management challenges.

Heterogeneous

Operational risk is a collection of very unlike risks. Forged cheques and counterfeit notes paid in at a branch belong to it, and so does an earthquake that destroys an office building. Each type materialises in its own way, and the way it shows up also depends on the business line where it happens. Variety persists even inside a single type: external fraud runs from a stolen credit card to a ransomware attack, and internal fraud covers anything from cash theft in a branch to rogue trading on a desk. This mix is why firms must invest in a careful taxonomy to identify, define and classify their risks, and it also complicates any attempt to model operational losses as one distribution.

Idiosyncratic and diffuse

Much operational risk is idiosyncratic, meaning it is driven by the quality of the firm’s own processes and systems; EDPM is the clearest case. Other types, such as DPA, are mainly triggered by external events, though even there the firm’s preparedness decides how much damage follows. Because the firm’s own ability and willingness shape the exposure, operational risk can be reduced a great deal. It can never be eliminated, however, because even a very risk-averse organisation cannot avoid, hedge or insure it away completely.

The risk is also diffuse, since it comes from every person and every process. A back-office clerk has to reconcile transactions properly before validating them, or fraud and errors slip through. An IT manager has to run the full test script before releasing a new application, or bugs and outages follow. A credit officer has to record collateral diligently, or the net loss on a default can multiply. That is the origin of the familiar saying that “everyone is a risk manager.” Credit risk management and market risk management can be centralised in specialist teams; operational risk cannot. The central ORM function still matters, because it gathers reporting and information and issues guidance to management, but the day-to-day management of operational risk, and above all its mitigation, rests with every employee.

Heavy tailed

Operational losses are highly asymmetric. Most of the probability sits on small losses, and the distribution has a long right tail that stretches out to a handful of huge events, each several orders of magnitude bigger than the median. Imagine putting petty cash fraud in branches and small fee calculation errors into the same dataset as the Societe Generale rogue trading loss, the Equifax cyberattack, the billion-dollar fines on BNPP for breaching embargo rules and the days of online banking outage at TSB Bank. The range of values is enormous.

This shape matters for priorities. Not every incident is lethal or even significant, so not every risk deserves the same level of management, monitoring or attention. The asymmetry and the heavy tail, which statisticians describe as excess kurtosis, also make it very uncertain to measure losses at the highest percentiles, the region that drives capital estimates (Cope et al., 2009).

Sending money to the wrong client, billing the wrong amount, misleading a customer about a product, breaching data protection rules, clicking a phishing link that lets attackers in, and losing or breaking equipment are all operational risk events. Behind most of them lie the same few root causes: weak controls, human biases and failings, and changes in the operating environment. Those shared causes make the different operational risk types partly correlated, and external forces such as economic, political and environmental events add further common drivers.

Boundary events

The same root causes also produce losses in other risk categories. A boundary event is one whose cause is operational but whose loss shows up as market or credit risk. A trader who books a buy instead of a sell, or the reverse, creates a market loss even though the cause was an execution error. A mistake in credit processing, such as poorly recorded collateral, can turn into a credit loss. Borrowers carry operational risk too: a restaurant that floods and has to close for six weeks may well default on its loans if it was not insured against the closure. Operational risk interacts with every other risk type in ways like these, and those links are complex and hard to model.

Dynamic

To understand operational risk you have to understand the operations and exposures of the sector or firm concerned, and those change all the time. This is the fifth feature: operational risk evolves with the business. In finance, serious debate began in the 1990s with outsized exposures and fraudulent trades in newly developed derivatives markets, with the 1995 Barings collapse as the best-known case. Physical disasters later reached extreme scale, with the attacks of September 11, 2001 and the earthquake behind the Fukushima nuclear accident in Japan as extreme cases of DPA, alongside the human tragedy. Internal fraud produced the €4.9 billion Societe Generale loss in 2008 and the $2 billion UBS loss in 2011. As regulators began punishing weak anti-money laundering controls (HSBC), mis-selling of investment products (ING) and of subprime securitised assets (Bank of America), and breaches of embargo rules (BNPP), extreme losses moved into CPBP. Digitalisation then brought very large cyber losses (Equifax, JPMC). The TSB Bank disruption set off a new wave of regulation on operational resilience, which the COVID-19 pandemic then reinforced by reshaping how work is organised and speeding up digitalisation further.

Why these features make operational risk hard to manage

Taken together, the five features explain the specific challenges. Heterogeneity forces firms to invest in classification and makes a single model unrealistic. The idiosyncratic and diffuse nature means risk management depends on the behaviour of every employee rather than a central desk. The heavy tail means the losses that matter most are the ones with the fewest data points, so measurement at high percentiles is uncertain. Interconnection means losses can be correlated and can hide in market and credit results, and the dynamic nature means yesterday’s risk map ages quickly.

Interest in resilience rose in the late 2010s, when regulators and the financial sector decided that the financial soundness of banks and insurers was not enough. They also wanted firms to be operationally stable, able to withstand and recover from major disruptions. The concern grew from the industry’s heavy reliance on IT systems and infrastructure, and from its growing dependence on critical third parties such as cloud and internet providers, payment infrastructure firms and central clearing counterparties.

The UK approach

UK regulators moved first, with a consultative paper followed by formal guidance. The Financial Conduct Authority (FCA), the Prudential Regulation Authority (PRA) and the Bank of England (BoE) began their joint work with a discussion paper on building operational resilience in the UK financial sector, issued in July 2018. In that work, operational resilience is the capacity of individual firms, and of the sector as a whole, to prevent operational disruptions, adapt and respond when they happen, recover, and then learn from them. Rather than a one-line definition, the regulators describe several components.

• Continuity of business services. This is closest to traditional business continuity planning: preventing disruption of critical business provisions and limiting it when it happens.
• Important business services. This is the new idea. Supervisors shifted from a process view of continuity to a service view. A firm must identify the services whose disruption would cause intolerable harm to consumers or to market integrity, and keep those services running within tolerance levels.
• Impact tolerance levels. A firm must quantify how much disruption it could tolerate if an incident occurred. The idea resembles the recovery time objective in continuity planning, with one key difference: the tolerance attaches to critical business services, not to individual processes, because the test is whether the customer or the market would suffer intolerable harm. Tolerances also give the board and senior management a basis for setting resilience standards of their own, deciding priorities and choosing where to invest.
• Management of disruption. How the firm responds, how it keeps the trust of key stakeholders and how clearly it communicates in a crisis all contribute to the stability of the wider system.
• Lessons learned. Learning from the firm’s own incidents and from public events at other firms is a defining difference from traditional business continuity. Firms are expected to improve continuously so that they cope better with unexpected extreme shocks.

From prevention to detection and correction

The rise in cyber risk and a run of high-profile attacks changed the industry’s mindset. Firms now accept that severe disruptions will happen at least occasionally. So the focus has moved from pure prevention to a more balanced mix of preventing, detecting and correcting incidents, with the aim of keeping the net impact as small as possible. Regulators have also been clear that resilience rules add to existing ORM requirements rather than replacing them. In 2018 the BoE pointed out that firms and financial market infrastructures (FMIs) already carry responsibility for operational resilience, that the current framework supports it, and that supervisors were considering how to supplement existing policy to make the system as a whole more resilient.

The 2018 UK paper can be read as a reaction to the TSB Bank failure. At the time the industry was focused on IT disruption and cyberattacks, and built most of its resilience capacity around keeping IT infrastructure and services running. Then COVID-19 arrived. Work moved home, call centres were run from employees’ living rooms, and essential payment flows and market trades kept running in conditions far more extreme than any stress scenario firms had tested. The later BCBS guidance of 2021 draws on lessons from that crisis.

The UK, the US and the BCBS are the three main authorities that had issued official operational resilience guidelines as of May 2022. Other regulators had published consultations or guidance on particular aspects.

US: the Federal Reserve’s sound practices

In 2020 the Federal Reserve (Fed) issued Sound Practices to Strengthen Operational Resilience. It follows the same lines as the UK work, with important business services, impact tolerance and the view that operational resilience is a key outcome of an effective ORMF. It also stresses that resilience must be built into a holistic enterprise risk management framework. Rearranging the Fed’s topics shows resilience as the combined result of several ORM components, which the figure below lays out.

Governance is the foundation, because coordinated ORM and resilience work only begins once roles and responsibilities are assigned. ORM is the central component, since resilience is impossible without it and without two of its specialisations: third-party risk management, which protects the supply chain, and scenario analysis, which prepares the firm for tail events. Two critical pillars support the structure, business continuity management (BCM) and resilient IT systems. Finally, everything needs to be monitored and reported so that the pieces stay coordinated and maintained.

BCBS Principles for Operational Resilience

The BCBS issued its Principles for Operational Resilience in March 2021, at the same moment as its revised RPSMOR. The timing was deliberate: Basel treats resilience as an outcome that benefits from effective management of operational risk, and it states up front that a robust ORM framework is the first condition for good resilience. Its seven principles are summarised below.

Read as a group, principles 1 and 2 tell firms to embed resilience in a holistic framework using governance and risk functions they already run. Principles 3, 5 and 7 cover business continuity, third parties and ICT resilience, the same pillars the Fed emphasises. Principles 4 and 6, mapping dependencies for critical services so that intolerable disruption is prevented and having plans ready if it occurs, echo the UK service-based approach.

Europe: the Digital Operational Resilience Act

In September 2020 a draft regulation, the Digital Operational Resilience Act (DORA), was published for financial services as part of the European Commission’s wider strategy to support digital finance across member states while containing its risks. The proposal imposes a range of ICT requirements on financial entities. It builds on existing ICT risk management rules and gathers several recent EU initiatives into one regulation, so that the EU, its regulators and financial firms follow a coordinated approach.

Singapore: resilience in remote working

In early March 2021 Singapore’s central bank and regulator, MAS (Monetary Authority of Singapore), issued a joint paper with the Association of Banks in Singapore on managing risk and staying resilient while staff work remotely. It addresses risks created by the large-scale remote working that financial institutions adopted during the COVID-19 pandemic: operational and technology risk, information security, fraud, misconduct by staff, and legal or regulatory exposure. The paper sets out key risk management actions and sample mitigating controls, giving Singapore institutions a benchmark of good practice. It also looks at the effect of remote work on people and culture, calling for awareness of the new situation, vigilance about new risks and a fresh look at existing controls and assumptions.

Credit risk is rewarded through the credit spread and market risk through market returns, so the payoff for bearing them is visible. Operational risk has no such premium, which makes ORM a harder sell inside a firm than its sister disciplines. John Coates of Cambridge University once joked that a risk manager’s job is to “rain on someone’s parade.” Saying no is part of the job, but more often the job is setting the conditions under which the business can say yes. Good risk management captures as much upside as possible while capping the downside, much like holding a call option.

Firms that embrace risk management can both steady their performance and raise their value. Showing that value does not depend on the impossible task of proving what did not happen. Preventing incidents is a central role, but not the only one.

Capital and compliance: the minimum case

The usual argument is lower regulatory capital. Regulatory capital is held mainly as equity, the most expensive form of funding, so needing less of it reduces the firm’s overall cost of capital. In practice, though, the current calculation rules make operational risk capital too insensitive to a firm’s actual risk profile to reward better management, and the capital figure is often a poor guide to how well risk is managed. The second argument is better compliance, which avoids fines and sanctions and brings lighter regulatory scrutiny. That is a real benefit, yet compliance is a floor, not a source of performance.

Better decisions: the real case

Beyond capital and compliance, risk management creates value by improving decisions, and as organisations mature their view of risk shifts from capital and compliance towards seeing it as a condition for superior performance. The value shows up in several measurable ways.

• Fewer large losses bring stability, visible in lower volatility of income and share price and in favourable comparisons when peers suffer public incidents.
• Fewer recurrent losses lift operating margins, provided controls are cost-effective. Control costs should be judged against the losses avoided and the extra stability and predictability they give processes.
• Higher productivity follows from fewer incidents, because less time goes into remediation and recovery. In every industry, fixing a problem usually costs far more than preventing it.
• Better projects, since project management now sits within ORM scope, can mean lower failure rates and greater benefits.
• Better strategic choices come from a risk function that advises on strategy and investment, balances risk against reward and proposes cost-effective mitigation.

Mature firms build risk into every decision, which lets them seize more and better opportunities, succeed more often and grow in a way that lasts. Treating performance management and risk management as two sides of the same coin lifts risk management to the top table, where it is most effective. Making the business case on these broader benefits, rather than on capital and compliance alone, lets risk managers play their full role, provided the ORM framework is genuinely embedded in how the organisation runs its operations.