Managing Operational Risk

The area of operating risk has not been a major focus for banks in the past. An unexciting business, operating risk was often relegated to one or two amusing stories at board committee meetings. Fraud and check kiting were primarily the domain of large banks and metropolitan areas, and community banks could rest safe in their knowledge of the local markets and the 'salt of the earth' nature of their constituents.

Unfortunately, timed have changed. As large banks have become more sophisticated in fighting crime, and as crimes against banks become more prevalent, no bank can ignore the issue of operating risk. It is everywhere.

The days when $1+ million ATM fraud crimes occurred only in cities with 5+ million in population are over. While bandit barriers are still the domain of isolated markets, the fraud issue is present in rural markets, small towns etc. The reason is because electronic means are now also available to the criminals, and they do not have to be identified in person when withdrawing cash from an ATM. The natural protection of the small town 'everyone knows everyone' is no longer a sufficient barrier to bank fraud entry in small markets. Further, as large banks, who did not have the home town advantage, resorted to more sophisticated crime prevention tools, the deterrence factor kicked in. One needs to outsmart the complex software programs installed in most large banks in order to be successful, while community banks remain electronically unprotected. As a result, I hear more and more incidents of operational losses from community banks at all levels, ranging from teller shortages that are larger than ever to major kiting, credit card and ATM fraud whose losses are in the millions.

To clarify, this column talks to non-bank-robbery type operating losses. Bank robberies are a separate and painful issue, whose implications go well beyond the bank's bottom line performance. This column focuses on the more preventable, less people-impactful crimes types of operating loss causes.

Bank CEOs need to recognize that operational risk management is no longer optional. Community banks need to upgrade their board level discussions of operational risk from the anecdotal story of a teller gone bad or a doctor running more cash than typical through their practice. While we should acknowledge that there still are some community banks with very little operational risk, we should also accept that the risk is spreading quickly to towns and institutions that were not on the criminals' radar screen until recently.

What can bank management do? First, one should measure the current operating loss rate from all sources and trend it. Become aware of the entire issue and scope it. See what others in your market have experienced; that number alone will be telling. Second, elevate the topic so it can be handled professionally, well beyond the anecdotal level. Toward that end, plan your preventive measures. While some crimes, such as bank robberies, are not as easy to deter, others, such as check kiting, can be better thwarted and deterred with a trained workforce and, if needed, software systems to support detection. Develop your preventive measures plan and target the maximum amount of losses you are prepared to take. It may feel awkward to goal losses, but by so doing you manage the entire organization's expectations to an appropriate industry standard yardstick. That will help not only raise awareness among your staff, but also allow you to better assess your institution's performance relative to others. Last, share with your team and your board the dimensions of the issue, your main concerns about future expansion of operating losses and the process you put in place to curb losses and proactively manage operating risk. Periodic reports on progress will keep the issue top-of-mind and will give you a handle on the trends you're experiencing in this area.

Bottom line: operating risk isn't a sexy topic, but it's becoming a major factor in earnings management for more community banks than ever before. It's hard enough to make ROE targets; it's heartbreaking to miss them because of preventive crimes against the bank. While this does not apply to every single bank in our nation, it is certainly a dimension to be considered in bank management in the future.