With new episodes of 1990s hit series The X-Files airing in January, it got me thinking about the show’s tagline “The Truth Is Out There” and how it applies to the cloak and dagger world of operational risk.
The X-Files revolves around two FBI Special Agents who investigate unsolved, often supernatural or mysterious cases. Fox Mulder is guided by his gut and believes in the existence of aliens and paranormal phenomena because that’s what his experience and intuition tell him. His partner Dana Scully, on the other hand, is a medical doctor by training and she bases her assumptions on scientific evidence – quantitatively measurable, seemingly rational, coldly unemotional.
I think the contrast of these two characters offers a fascinating parallel between the qualitative and quantitative approaches to dealing with operational risk in most financial institutions.
I confess that I am the Mulder in this regard. I have always believed your people intuitively know where the true risks are in your organization – just give them the right training, incentives and tools, and they’ll help you identify, assess and prioritize your operational risks. The truth really is out there. Of course, once operational risk owners shine a spotlight and document the truth, it’s then up to risk management leadership to make sure those accountable for treating their risks chase down and eradicate them.
On the flipside are the Scullys whose primary objective is to measure operational risks for purposes of minimizing capital. These people work with scientists and mathematics geniuses who collaborate with the government (in our case, regulators) to build and adopt their own empirical models. They form an elite shadowy collective that uses terms like “scenario analysis” and “loss distribution approach” and do experiments with homogeneous segments and expected total losses. Operational risk, in other words, only matters where you can quantify it.
Mulder would think this all sounds beyond belief because how is measuring the immeasurable even possible? Is an advanced measurement approach a lie or the truth?
I admit that the quantitative side of operational risk is a bit alien to me. My background is more deeply rooted in strategy, people and business process. So I want to believe that identifying and treating all the things that can prevent your organization from being successful is the most important reason to manage operational risk – satisfying a regulator’s capital requirement ought to be secondary.
What do you believe?