Of course, risk management should help us reduce the frequency and size of negative events and then recover more quickly and effectively when negative events occur. But, risk management, in my view, should also help the right things happen by giving us tools to work more effectively.2 Innovation is an essential tool to manage risks, because not changing can be riskier than changing. For example, an incredibly powerful risk management activity is to transform a slow, manual process that often fails into a fast, efficient, automated process that can self-correct when there is a problem. Clearly, it is just as important to understand the risk of not doing something as it is to understand the risk of doing something. And, when we understand our risk appetite and our risks, we can comfortably conduct controlled experiments, learn faster, and innovate. We're no longer driving in the dark; we're getting where we want to go with headlights on, and we can stay inside the guardrails and not skid off the road. Second, risk management could be misunderstood as primarily the responsibility of risk management specialists. Actually, effective risk management is a way for everyone in an organization to help things go right. From the economic analysts to the cash processing operators to the software engineers, we can make better plans, decisions, and actions when we are prepared for change and have the capacity to adapt to surprises.
What does that take? Let's reframe the core components of operational risk – people, process, and technology – using a resilience lens.15 People are resilient when they are ready and able to adapt to change by adjusting priorities, replanning, and refocusing activities and resources. Resilient staff work with shared purpose across organizational siloes, operate effectively in environments of uncertainty and ambiguity, and are empowered to develop creative and innovative solutions. Processes are resilient when they are robust to changing internal and external conditions, including issues with suppliers, inputs, processing, outputs, and customers. Resilient processes provide clear signals of their operating state, have the right level of automation, and continue to function under stress. Technology systems are resilient when they are flexible, robust, and able to be recovered rapidly. And then the overall organization is resilient when these three components – people, process, and technology – work together effectively. Resilient processes and technology should support the ability of the staff to successfully manage in normal times and during disruptions. What are some concrete steps to strengthen resilience? In terms of processes, an important first step is to identify the processes that are critical to achieving organizational objectives. Gains are often found through simplification and automation of manual processes, especially when combined with performance metrics and risk metrics that provide real-time measures of process health.16 For technology, modernizing technology and software development processes can be a key area of focus.