Operational risk is the risk of one or more future events impairing the effectiveness or viability of the business model in creating value for customers and achieving expected financial results. These risks relate to the various business activities along the value chain within which the organization’s business model is applied (e.g., the supply chain, customer fulfillment processes, human resources, information technology, crucial channels, key customers and ultimate consumers, among other things).
Generally, an operational assessment is directed to assessing performance against quality, time, innovation and cost targets to identify critical gaps. Significant performance gaps lead to decisions around making appropriate midcourse corrections or analyzing root causes with the objective of determining actionable process improvements to close the gaps. The question to consider is whether this traditional approach to an operational review is adequate.
The reality of today’s business environment is that the enterprise is boundaryless and not an island in and of itself. Over the last two decades, globalization, outsourcing, increased cross-border sourcing, information technology and shared services centers have encouraged many organizations to consolidate facilities and streamline processes to eliminate nonessential and redundant activities, as well as focus, simplify and automate remaining activities. The successive waves of total quality management, process re-engineering and Six Sigma process improvements have created a bias for
strong supplier relationships and tight coupling within supply chains and distribution channels with the objective of driving costs out of processes and products while adhering to prescribed quality standards. These improvement initiatives have driven decisions to decrease inventory levels, have a sole-source or single-source strategic supplier in any country of the world, and adopt just intime manufacturing and delivery techniques on the one hand versus higher inventory levels, multiple suppliers and other process buffers on the other hand. These decisions involve trade-off assessments where quality, time and cost considerations often win out over business continuity considerations. The supply chain disruptions resulting from the tragedies in Japan and Thailand clearly illustrate that these trade-off decisions are not without risk.
Accordingly, the appropriate risk assessment approach applied to operational risks suggests the need for an end-to-end extended enterprise view of the value chain, requiring consideration of looking upstream to supplier relationships, including the suppliers of critical suppliers, as well as downstream to channels, customer relationships and all the way to the ultimate end user. In effect, the enterprise’s business relationships are just as important as its internal processes, personnel and systems because they are inextricably linked to what makes the business model work. Therefore, the assessment of operational risk is directed to understanding the risk of loss of any of the key links in the chain. By contrast, a “four walls” approach to evaluating operational issues focusing solely on internal processes and systems presents the risk of missing the big picture.
What would happen to the organization’s business model if any key component of the value chain were taken away or altered in a significant way through either failure or an unexpected catastrophic loss? To illustrate, what would the business impact be if any of the following value chain elements were taken away – a strategic supplier of essential raw materials or other inputs at a reasonable cost; availability of power at a reasonable price; lines of credit and working capital; key employees on whom the company depends; critical systems and facilities; key distribution channels, transportation and logistics for delivering products; or major customer contracts? Said another way, at every stage of the value creation process, what would be the implications of a shortage, disruption or quality problem in a key input or output along the value chain or the loss of a major customer? How long would the company be able to operate?
When evaluating operational risks, management should consider the following factors:
- The velocity or speed to impact, including whether the loss of any critical component of the value chain can occur without warning (i.e., does it smolder or is it sudden?)
- The persistence of the impact (i.e., the duration of time before the loss of the component can be replaced)
- The resiliency of the company in responding to a catastrophic event resulting in a loss of a component
- The extent of uncompensated risks the company faces across the value chain (e.g., increased warranty costs
Board Perspectives: Risk Oversight (Issue 31)