Resources & Articles

Corporate culture and operational risk management.

Copyright 2005 Gale Group, Inc. Business and Management Practices Bank Accounting & Finance
February 2005
SECTION: Vol. 18, No. 2; Pg. 35; ISSN: 0894-3958
RDS-ACC-NO: 4663946
LENGTH: 1566 words
HIGHLIGHT: Risk Management

When First Union and Wachovia merged to form Wachovia Corp., CEO Ken Thompson articulated a simple but meaningful vision for the new company: to become the best, most trusted and most admired financial services company.

A strong risk management culture is key to achieving this vision. At Wachovia, we believe that effective management of operational risk can position our company at the forefront of the industry. By communicating consistent guidelines and standards for managing risk across the company, we can reduce uncertainty, minimize losses and choose where to invest discretionary capital. This results in a better customer experience, enhanced reputation and greater shareholder value.

Definition of Operational Risk

Operational risk management seeks to identify and manage the risk of loss resulting from human error, inadequate or failed internal processes and systems, or external events.

Operational risk can take many different forms, such as technology failure, a vendor mishap, a breach of customer privacy or a simple keying error. For a company as large and complex as Wachovia, there are thousands of different risk points. lf unchecked, such risks can negatively affect the company as well as employees, customers, shareholders and communities.

Unlike credit and market risks, which have a defined population of risk takers, the operational risk profile can be affected--positively or negatively--by every employee. This is why the development of a strong operational risk-management culture is key to our success at Wachovia. Everyone plays an important role in managing operational risk.

What Is Culture?

Culture can be defined as the shared set of beliefs, values and behaviors of a community or group that guide perceptions, judgments and actions. A simpler definition of culture follows:

To build a strong risk-management culture, it is important to identify the beliefs, values and behavior patterns that constitute the actions we want employees to emulate--as well as those actions we want employees to avoid (Exhibit 1).

In a good operational risk culture, employees accomplish the following:

Wachovia’s Approach

At Wachovia, we categorize operational risk into 12 different functional risk areas (Exhibit 2). For each category of operational risk, there is a senior leader who is responsible for creating policies, guidelines and networks for managing that risk across the company. This approach leverages the skills and competencies of experts on specific types of risks. The goal is to create consistent standards and guidelines--so business units and employees across the company know the best ways to manage these risks.

The operational risk committee, chaired by the chief risk officer, is composed of functional risk “owners” as well as line-of-business representation. The operational risk committee oversees the framework that measures the company’s operational risk levels and develops policies, controls and guidelines to manage it.

Operational risk is managed in the business units on a daily basis, where each employee has the ability to affect the company's operational risk profile positively or negatively. Each business unit has an operational risk manager who works with business leadership to ensure that polices and procedures are in place to mitigate operational risk.

Within the lines of business, the executive in charge of the business is clearly responsible for ensuring appropriate management of risk across all risk types for their business.

Technology: Creating a Common Language

Building a consistent information technology foundation undoubtedly streamlines processes and improves efficiency--but it also begins to create a common language. This language has consistent definitions and processes resulting in more dependable--and actionable--communication between business lines and support areas.

Wachovia’s operational risk platform supports proactive risk management through consistent risk information processes and reporting methods. The system provides enterprisewide data to encourage consistency across the organization and support the development of an enterprisewide operational risk profile.

Strengthening Culture

Governance, process and technology are all important, but at the end of the day, good operational risk management comes down to having the right person with the right training in the right job. Employees have to understand how to identify and respond to various operational risks. To encourage a strong risk management culture, Wachovia invests in a significant amount of risk-based training:

One of the key messages that we consistently send to our employees is that everyone plays an important role in managing operational risk. Each employee can help by following procedures, understanding interdependencies and raising their hands if something doesn’t make sense or needs extra attention.

Through Wachovia Listens, an internal survey of our employees, we learned that employees place a lot of value on being heard and knowing that their opinions are respected. This is the foundation of a strong risk management culture--an environment where employees know and do the right thing, even when no one is looking. When something is wrong, they’re not afraid to speak up.

Keys to a Strong Operational Risk Culture

Engage Senior Management

Operational risk should not be additive but complementary to business units. Risk information becomes important criteria to enhance business decisions. Senior management knows that investing in operational risk is not only necessary but also benefits their business. To encourage this mindset, executive management must endorse and support each step. The tone is always set at the top of the organization.

Form Alliances Throughout the Organization

Find and include anyone who has a stake in managing risk. Include the key stakeholders in the process early and often. Gain the support of those who manage risk on the ground, within the business units. There are many support areas that play important roles, including corporate functions such as legal, compliance and finance. We are all working to solve the same problems. These groups can help to reinforce the operational risk approach.

Take Every Opportunity to Reinforce Goals, Strategy and Outcomes

When you are passionate about what you do, people will give you the opportunity to tell your story. Make it simple, align it to their strategy and take every opportunity that you get.

Target Outcomes

We recognize that operational risk is the fastest growing area of risk in our company, consuming a bigger piece of the overall risk pie. Our changing business mix drives this. As we build our advisory, brokerage, trust and processing businesses, operational risk will become a more significant user of economic capital.

By putting the right processes around operational risk, we have a strong structure to manage risk, reduce uncertainty and enhance shareholder value. Our operational risk framework is based on three key outcomes:

  1. A solid risk culture. Employees know and do the right thing, even when no one is looking.
  2. Responsibility and ownership. Business units clearly understand that managing operational risk is their responsibility.
  3. Involvement and partnership. Business strategies and events planned by a line of business are shared with other areas in order to assess the level of risk and ensure successful planning, testing and implementation.
We believe that by improving employee awareness, understanding and skills around operational risk management, we will effectively lift performance and further our vision of becoming the best, most trusted and most admired financial services company.

Exhibit 1: Operational Risk Culture in Action

Examples of Poor Operational Risk Culture Examples of Good Operational Risk Culture

Exhibit 2: Wachovia’s Functional Risk Areas

Joe Hanssen is Senior Vice President, Risk Management, at Wachovia Corporation, Charlotte, North Carolina. He call be reached at joe.hanssen@wachovia.com. Copyright [c] 2005 Wachovia Corporation. This article is included herein and reproduced with the permission of Wachovin Corporation.Copyright2005 Aspen Publishers Inc.1331

TYPE: Journal; Fulltext
JOURNAL-CODE: BANKACCF
LOAD-DATE: May 6, 2005

Close This Window