The 1990s offered a rainbow of case studies of risk management failings in markets, financial regulators, financial institutions, non-financial institutions and even countries as a whole; showing the vital need for integrated operational risk management systems.

Of course, operational risk management was not new – certainly not for industrial or even military institutions, which had all been successfully managing operational risk for years.

But when the Basel Committee, central banks and other financial regulators began to make rulings about the need for operational risk management in financial institutions, and the path this should take, it became inevitable that it would bleed out of those bodies responsible for financial supervision and be much more widely adopted.

In Mexico this call for enforcement of an integral risk management culture has been heard, and it is now required of all the country’s government institutions. Materialising their risks has had a direct impact on the fulfilment of government bodies’ previously established objectives and goals, so operational risk management has become very important recently.

Best governance practice
Operational risk is generally defined as the potential loss due to lack of adequacy or failure of processes, personnel or systems before external or internal events.

In accordance with the principles of corporate governance set by the OECD, government institutions should:
- Implement a standard model of internal control that operates at the strategic, managerial and operational level of institutions
- Establish minimum steps to the process of risk management
- Establish peer forums that contribute to achieving the fulfilment of goals and objectives, using comprehensive and orderly internal control as a means, primarily follow the institutional development and make a link between the standard model of Internal Control and risk management.

In July 2010 the Mexican Ministry of Civil Service, which is responsible for ensuring the regulatory compliance of all federal government institutions in Mexico, called for the establishment and update of the systems of internal control of all agencies and entities of the general public administration.

To achieve this, a systematic process that allows for the identification, evaluation, ranking, control, and monitoring of risks that may impede the fulfilment of institutional goals must be implemented. A thorough analysis of the internal and external factors that may increase the impact and likelihood of materialisation of the risks must also be conducted, and strategies and actions to control them and strengthen the system of internal control must be defined.

Of course, the minimum stages envisaged for risk management only consider the fundamental elements and minimum requirements that may be used by any public institution. The individual institutions must apply the methodologies, methods and theories that they consider most appropriate in light of their technical capabilities, their experience in the subject, and the means and resources to acquire or develop better tools. Similarly, training and awareness of the culture of risk management must be promoted.

Process stages
Because operational risks are not identical across all government institutions, each department is held individually responsible for identifying, limiting and managing their own risks.

A healthy prudential measure to strengthen a culture of self-control and self-evaluation lies in the fact that the government agencies and institutions must themselves determine the establishment of risk committees as a collegiate forum to support decision making, and where issues of compliance with internal control, institutional goals and objectives must be addressed.

The first stage in implementing operational risk management across Mexico’s government bodies is the adequate training of all staff in the culture of internal control and risk management. Risk management in general, and operational risk management especially, only functions when an adequate training process is established for all personnel.

In market and credit risk management, for example, it is sufficient that adequately trained personnel are in charge of performing such risk management tasks – the risk management team has the expertise needed to manage such risks. But for operational risk management, the expert in each individual operational function also has the risk management expertise. There is no such thing as an operational risk management expert. That is why adequate training of all personnel involved in the government body is an absolute must.

The next stage is diagnosis: raising the foundations, designing the conceptual model, and preparing the strategic plan and work programme that make it possible to establish and implement appropriate operational risk management.

Finally, a suitable operational risk management process computational system must be implemented to provide timely and accurate information, allowing government bodies to make informed decisions.

The key desirable outcomes of this plan are:
- An integrated operational risk management map
- Appropriate internal controls in processes that will make it possible to achieve the goals and targets previously established,
- Mitigating measures for the mapped risks which, because of their impact, may be relevant,
- Operational continuity plans to deal with events of force majeure.

As in every process that involves changing previous conventions and ways of behaviour, introducing operational risk management will be a process of baby steps that take a while to make a difference. Let’s hope it will be the first of many steps towards a more professional, transparent and efficient way of doing things in our government agencies and institutions. Certainly the Ministry of Civil Service has to face great challenges; but will also reap great results in the long term.

Enrique Núñez-Escudero is chairman of Shirebrook Commodities