Our podcast about Introducing the ORX Reference Risk Indicator Library featured a dynamic conversation exploring risk indicators and their importance in ONFR. Leading the discussion were Steve Bishop, the Director of Research and Information at ORX, Mike Constantinou, a Consultant at ORX, and Tom Ivell, representing the global management consultancy, Oliver Wyman.
The podcast comes off the back of the recent launch of the ORX Reference Indicator Library - the latest addition to our strategically important programme of activity to develop a core set of contemporary standards and references.
As part of the podcast, we asked our panel to reveal their top four challenges around using Risk Indicators. We’ve shared them here, along with some tips from our members on tackling these challenges with workable solutions.
1. Poor data quality
The most common issue is not being able to report Risk Indicators to management that are sufficiently insightful, accurate and timely to inform proactive management action. Many firms still struggle with poor data quality, and this may prevent a potential Risk Indicator being used in the first place or if it is used, it may undermine its credibility with management.
2. Measuring risks
Risk indicators allow management to track non-financial risks they may be concerned about, either as regular reporting or a formal expression of risk appetite. However, many non-financial risks are difficult to measure directly because their occurrence is rare and financial institutions have to be creative in what they measure. They may measure metrics that speak to the effectiveness of their control environment instead.
3. Timeliness
A majority of Risk Indicators are still manually collected rather than automated and there’s often a lack of quality systems support for timely reporting. This means that even where they could be informative, the delay in reporting plus the fact that they are often retrospective, means that the information can be too historic to allow any pre-emptive action.
4. Board level reporting
The highest profile Risk Indicators in firms are normally those reported to the Board and often used to support risk appetite. By their nature, these Risk Indicators are top-down, often generic and can detract from effort to implement indicators that are more effective for day-to-day management in the first line.
Tips for improving Risk Indicator Practice
The first area that a number of members have focussed on is increased involvement of the 1LOD, using management knowledge of business processes and as a way of increasing buy-in. This could be with data sourcing or automating the collection and reporting of Risk Indicators for example.
Members also stressed the important of standardising the process by developing a risk indicator library. Reporting then becomes not only comparable but easier to aggregate and risk appetite can be cascaded more easily if the metrics being used are the same.
Many members have been enhancing their Risk Indicators to provide a higher percentage that are forward looking in nature, in particular Risk Indicators that look at inherent risk, for example the number of third parties supporting critical services. Similarly, they have identified indicators that measure control effectiveness, such as the number of third parties with a valid contract in place.
The last recommendation was to make backward-looking indicators more predictive and comparable by using trend analysis and relative measures. In other words, turning the indicators and data into insight. Take for example the issue of technology outages - to make it more predictive, you can take a metric such as system downtime and turn it into a trend indicator that gives you a sense of whether things are improving or deteriorating.
