Webcast >> Op Risk Technology

What they don't do is spell out what advanced data management is, but they do state clearly that it's something you need to have in order to solve risk management problems.

So there's a conundrum that a lot of banks face and that's where consulting methodologies are very, very important now to guide, more so than complete solutions.

Once you've got the budget, I think there are some practical implementation problems and challenges that people face, and I would divide those problems into three areas. One is what is the data? How do you access the data? How do you translate it into information and so on? The other thing is people. Consistently in the surveys we've done, customers comment that you can have the best systems in the world, and the best processes and procedures, but you need people to actually buy into the process, because without their co-operation a lot of the qualitative data needed to make this work is not going to be there.

The final area, I would say, in terms of practical challenge, is that a lot of organisations are struggling with whether they should go with a centralised approach, ie, driven by group. Then there's a de-centralised approach where you give autonomy to the local business units and business clients to manage operational risk the way they want with some common standards so that it can be aggregated up at the group level. Which is better is very much specific to the organisation. I've seen both work very well. Those are the key strategic and practical problems I've seen in the market.

So, for the minute, operational risk managers must have the best tools available to understand and have direct access to the data they've got. I suspect that until this method has matured, and until the overseers finally come up with a 'design for living', that would prove the best strategy.

Then in the fullness of time, with all the wonderful creative minds in the software world, there will be another wave of products that will respond to that mature market-place.

The problem, I think, is that at the moment we're not even at the first stage. Even the systems that allow you to go and collect data on a more regular and more comprehensive basis are not being used.

At the moment, many firms are still effectively at the spreadsheet stage. They do not have embedded processors for collecting information. They do not know exactly what they should be measuring, where, and how. Already, the tools we have are more advanced than the majority of firms need. It's easy for software people to say, 'logically, the next step should be this'. We're way ahead as software providers of where people are in their management of operational risk and their collection of information. So I think it's difficult to say how the industry should evolve to supply these products when in fact the current products are more than people need at the moment.

The key issue at the moment is trying to get standard ways of measuring and managing operational risk to get buy-in in the organisations and to get people actually collecting the basic information rather than thinking about what sophisticated tools they can use to actually get the information and display the information. People at the ground level are still not always bought-in to operational risk management.

One area we have seen demand for is linking, in an automated way, risk-specific technologies, ie, linking the op risk management system to your fraud management system, like credit card fraud systems for retail banks, making sure that that data is coming in in a visible way, in a managed way; anti-money laundering systems coming in; HR systems-management systems coming in, because all of these disparate systems also provide the key risk indicators required for the calculation at the end of it.