As the plane bumped along in choppy air, the pilots scanned their instruments for data ? both on the weather and the performance of the plane to its capabilities. As we disembarked at LGA, the pilot remarked, ?A plane west of us really hit some bumpy air.? Pilots look for early warning of capability limitations in a changing environment that would cause them to act differently.
Early warning is also needed by leaders piloting financial companies, their business units, products and operations. ?Key Risk Indicators? (KRIs) is the current banking term of art for this early warning. Yet, it doesn?t take long at an industry meeting for sad tales to be told of KRI projects that wasted far too much for too little insight. Or, to hear a leader with profit and loss responsibility ask an operational risk manager ?what are we supposed to be getting from the time and money we spent on this project??
The bad news is that KRI projects have struggled painfully. The good news is that in diagnosing the difficulties, common pitfalls are apparent. While a bit of an oversimplification, three steps are critical to getting more business insight from KRIs.
Step One: Understand the Business. Like the pilot, the critical foundation is to understand how institution capabilities hold up against dynamic forces. ?Capabilities? includes the design and performance to design of capabilities such as quality of governance, management, controls and core business processes. This can be basic (success rates and customer satisfaction in teller window transactions) or complex (integration of an acquisition ? time, budget, customer satisfaction and avoiding competitive losses).
The historical view looks asks, ?How smooth were past flights?? The future view asks, ?How smoothly can we fly through the next bad weather?? In banking, asking detailed ?what if?? questions is part of scenario analyses that tell complete stories of an unfolding situation (with actors, actions, objects, impacts, consequences and coincidences). Scenario analysis is the heart of managing risk.
Step Two: The Right KRI for the Job. Too many discussions and projects get muddy because there are at least three definitions of a KRI:
KRIs directly linked to Key Performance Indicators (KPIs) such as share price, revenue, cost, profit, completed transactions or customer satisfaction. These KRIs are prospective measures of the likelihood of missing an upcoming performance objective. Their strength is being laser linked to performance. Their weakness is that they are disconnected from root cause.
KRIs that measure the most likely causes of problems. These are looking at the ?sore thumbs? ? the more obvious or frequent causes. Their strength is following the frequent. Their weakness is that they can be disconnected from both performance and root cause ? missing both key business impacts and the cascading ugly ?surprises.?
KRIs linked to root causes as described in scenario stories. Their strength is that they are closest to the problem and give the earliest warning and most time to fix a cascading problem. Their weakness is that they are ?many lights on a control panel? and take more people skill to evaluate. Automation ? based on causal understanding ? can simplify the ?many lights.?
Step Three: Follow Analysis with Action: KRI initiatives associated with the best business performance outcomes use a blend of KRIs types.
Use KRIs based on performance objectives to focus attention on managing risk to business objectives. This also helps drive risk ownership. The owner of a performance objective also owns managing the risks to that objective.
Use KRIs based on root cause (created in scenario analysis workshops) to peer into ?dark corners? to see the trouble brewing before it explodes and delivers a stinging blow.
Use the same scenario analysis information that helped design the KRIs to plan prevention, preparation and reaction steps to be ready for when situations unfold.
Taken together, these (yes, oversimplified, but powerful) steps can repair and/or revitalize many KRI projects ? saving time and money in the risk management process, and contributing to better business outcomes.
Brian Barnier, of ValueBridge Advisors, is an OCEG Fellow and the author of The Operational Risk Handbook for Financial Companies: A guide to the new world of performance oriented operational risk (Harriman House, London, 2011). He writes and speaks widely from an investor perspective. This article is based on The Handbook that is widely available online. Corporate quantity discounts are available directly from Harriman House.
