|
1.
Focus on quantity first: the underlying idea is that quantity breeds quality. The
selection will be done at a later stage.
2.
No criticism: the participants and facilitator are asked to suspend all judgment to
create a supportive atmosphere where everyone feels free to express their ideas,
however unusual or seemingly eccentric.
3.
Unusual ideas are welcome: unconventional and unusual ideas may lead to impor-
tant scenarios that no one has considered.
4.
Combine and improve ideas: blending suggestions may create fresh insights and
scenarios. The facilitator has an important role to play by encouraging new ideas
and combining existing ones. Free association and discovery help to generate use-
ful ideas.
SA workgroup facilitators are ORM professionals. Their task is to initiate the dis-
cussions at each step of the process, to coordinate the debates and to reach the best
consensus based on the input of every member.
It is helpful to start the meeting with simple warm-up questions that engage the
participants and encourage reflection. For example:
■
What’s the biggest operational incident that you’ve experienced in recent years?
■
How bad was it and why?
■
If you’ve avoided a large loss, how did you do it? What could have gone wrong
otherwise?
These questions will help participants to think about past frights or disruptions and
potential large losses, before focusing on specific scenarios. Next, the facilitator intro-
duces scenario analysis and asks the participants for their ideas, encouraging everybody
to speak (see case study). The participants explore each scenario idea, to refine the qual-
ity. When no more ideas are expressed, the facilitator categorizes the ideas according
to the type of risk or the type of consequence and encourages discussion. Additional
ideas may be generated. The initial output should contain at least 20–30 scenarios, and
the participants are expected to produce around 15 scenarios after the selection. Small
firms may produce fewer, while large international organizations may generate more.
An important drawback of risk identification is that the findings are strongly biased
by what happened in the past, when in fact the biggest risks may be those that have
never materialized and most people have not seen coming. Therefore, screening any
new elements in a business will lead to more revealing and rigorous scenarios that
16
RISK IDENTIFICATION
embrace, amongst other things, changes to products, technology, business processes,
management structure, lines of business, third parties and software.
A comprehensive picture of risks is more likely if everyone in the group has a
chance to speak. Inevitably, strong personalities will dominate the debate, but it is use-
ful to draw out the views of the more reticent participants, who often have great insights,
and the group facilitator must encourage them to speak up. Generally, scenario anal-
ysis meetings should not last more than three hours on the same day, as productivity
and creativity will decline the longer the meeting goes on. To maintain focus, phones
should be switched off and other external distractions avoided. Arrange meetings in
the morning, when people are fresh, or in the second part of the afternoon, as attention
levels are generally low immediately after lunch.
C A S E S T U D Y : F T S E 1 0 0 I N S U R A N C E C O M P A N Y –
S C E N A R I O G E N E R A T I O N P H A S E
A large international insurer based in the UK asked the regulator to approve
its internal modeling approach (IMA) of operational risk, which was essentially
based on the quantification of scenarios. After years of preparation and hundreds
of pages of documentation, the insurer received approval in 2014. During this
long and demanding process, I was in charge of the brainstorming workshops to
identify the scenarios to model.
We ran six groups from six different significant business entities. Each work-
shop session had senior managers from the business lines. These were reflection
meetings, without slideshows or set agendas and with as little external interfer-
ence as possible. We politely discouraged participants from using their phones
and checking emails.
At the start of the meeting each participant was asked to write down two
or three worries, recent near misses or other past incidents that they felt could
still threaten the business. By starting with written contributions from every-
one, all the participants were immediately involved and engaged in the meeting.
This avoided the all-too-common occurrence where the most opinionated and
outgoing individuals set the agenda and frame the debate.
Once the participants had taken time to reflect and then write down their
thoughts, they were asked to share their ideas on risk one at a time. This provided
a wealth of information on losses, current and emerging threats, and the over-
all business environment, which could be developed into scenarios. The same
approach was used for each business unit in turn.
The resulting scenarios are usually organized either by business units, risk types
or risk owners, depending on the institution. All of this is fine, particularly if it fits
Do'stlaringiz bilan baham: |
