Technology Risk Measurement and Reporting

risk without thinking about technology risk. Workflow-based applications, system-driven notifications and databases with web front ends are proliferating, and they make operational processes indistinguishable from the systems on which they run. A failure in the process of creating a loss event can almost inevitably be tracked down to a technology control that was not designed well or that failed to operate. For instance, high-profile incidents at Barings1 and SocGen,2 among other places, showed inappropriate access to systems as a significant causal factor. This expansion of the risks emanating from technology has significant implications for the technology risk manager, who is not only answerable for the traditional responsibilities of information security and data protection, but is also (welcomingly) involved in a multitude of business process discussions relating to access controls, segregation of duties, approval hierarchies, notifications, and automated communications to clients, vendors and insiders. As a result, technology risk is considered a large enough source of risk to often merit separate departments and budgets that may exceed the budget of the core operational risk function itself. Yet, when compared to market and credit risks, the estimation, measurement and reporting of technology risks remains an undeveloped discipline. Risk measurement tools available today to the technology risk manager are at best not much more than crude directional indicators of risk. The measurement and communication of technology risk continues to remain an art, and is far from evolving to a science. The available tools—risk and control matrices with varying levels of risk and control granularity; red, amber and green dashboards; heat maps; quadrants; and other similar nonquantitative measurements of risk—do not come close to the sophistication of the tools available to market and credit risk professionals. This article attempts to identify better ways of communicating risk by drawing parallels from the more advanced disciplines of market and credit risk. Therefore, technology risk is looked at, within this article, as a significant subset of operational risk. This article revisits how risk measurement and quantification currently work for market and credit risk, and looks briefly at operational risk modeling as it is used for compliance with the Basel framework.