Business involves risk. It is uncommon to find an organization where risk isn't often acknowledged and evaluated. It is even more important in the case of Banks and Financial institutions. Banking, being a service oriented industry and driven by people with technology, operational efficiency and management of risk play a significant role. Growing number of high-profile operational loss events worldwide have led banks and supervisors to view operational risk as an integral part of business strategy.

Key indicators (KI) help to identify, quantify, monitor or manage risks and /or risk consequences that are directly associated with key business objectives. KI plays a crucial role in monitoring risk and improving business performance. These can support various operational risk management activities and procedures viz. risk identification, risk and control assessments, adoption of efficient framework for risk appetite, risk management and governance.

Effective risk assessment allows a bank to better understand its risk profile and most effectively target resources. Amongst the possible indicators/tools that may be used by banks for assessing operational efficiency and risk are: 

• Key Risk Indicators
• Key Performance indicators
• Key Control Indicators
  

At a fundamental level, Key Risk Indicators (KRIs) measure changes to risk exposure while Key Performance Indicators (KPIs) measure the degree to which the result of objective is met. Key Control Indicators (KCIs) measure how well a control is performing in reducing causes, consequences or the likelihood of a risk.

Key Risk indicator (KRI) is one of the important elements under BEICF (Business Environment and Internal Control Factors) which envisages identification of emerging Operational Risks in Banks.

Key risk indicators are metrics, which can provide insight into a bank’s risk position or that track exposure or loss or trouble. They can provide insights into potential risk events. 

KRIs can provide means to express risk appetite. The practical purpose of KRI is based on a system of thresholds; when a KRI breaches its prescribed threshold limits, it triggers a review, escalation, or management action. 

Implementation of Key Risk Indicator will help the bank to understand and allocate risk management resources more effectively.

Major objectives of KRIs are:

• To Provide an effective proactive and forward looking technique for monitoring the business parameters which can materially affect the operational risk profile of the bank. 
• Compliance with RBI / Basel guidelines and implementation of good industry practices for the management of operational risk. 
• To monitor and control operational risk as per risk appetite of the bank where all the critical / high risk areas of the business operations can be covered. 
• To identify emerging risk trends and issues which are required to be addressed. Trends in indicators will provide an indication of whether the bank’s exposure to a particular risk is increasing or decreasing.
• To use KRIs for an early warning mechanism for potential risks that are imminent, prompting management to take preventive measures. If KRIs are selected appropriately, can provide a means of identifying:
  • emerging risk trends;
  • current exposure levels; and 
  • events that may have materialized in the past which could re-occur.

Examples of Key Risk Indicators.

• Staff attrition rate
• Regulatory penalties
• Cash shortage instances 
• Service-related customer complaints
• Number of units /branches exceeding Cash Retention Limits, 

KCI are the metrics designed to measure the adequacy of control around underlying processes and business strategies. KCIs can identify process deviation from desired outcome.

KCIs are quantifiable criteria that show if a control in an organization is likely to fail. KCIs often seek to provide a response to the query, "Are our organization's internal controls effective?"  Management can proactively detect impacts on the organization's enterprise and operational risk portfolio by analyzing patterns in KCIs. As a result, they are able to respond proactively as soon as possible gaps are found to remedy control failures.

The KCIs role is to ensure that adequate responses and monitoring have been provided to a risk situation identified by Key Risk Indicators. Control verification is a key component of a KCI, and it usually includes auditing, quality assurance and improvement programs.

KCIs have a strong relationship with KRIs, simply because, if a KCI indicates the failure or weakness in a control, then it is likely that the level of risk is increasing. For example, a KCI that monitors the effectiveness of staff supervision, if this activity is reduced, then it is likely that the risk mitigated by the control will become more likely to increase. KCIs are more focused than KRIs, in a sense that they are specifically related to the controls that mitigate a risk. Moreover, KCIs can apply to multiple controls, which themselves can mitigate multiple risks.

Examples of KCI:

% Of crown jewels to protect  

% Of loans with insufficient collateral cover

% Of Trades executed within time tolerance 

% Of Trade settled T+1 / T+2 / T+3 

% Of Deliverables completed within tolerance

KPIs help an organization to define its performance targets based on its goals and objectives and to monitor its progress towards achieving these targets.

Key Performance Indicators (KPIs) are the crucial (key) indicators of development toward a desired outcome. They enable them to determine whether objectives of organization/Bank are being met. KPIs aid in focusing attention on the issues that really matter by providing an analytical foundation for decision-making. 

Many different types of key performance indicators exist. Some have a longer-term emphasis, while some are intended to gauge monthly progress toward a goal. All KPIs have a strategic purpose in common, which is the only element that unites them. A good number of KPIs can be implemented to measure every type of transaction and service in a bank to accurately evaluate performance, profit, customer service and others.

Examples of KPIs are: 

• No. of pushback accounts against the total no. of CASA opened at the same point in time.
• Average time to close any issues/complaints.
• Sales Per Branch: No. of mutual fund/Insurance schemes sold during the month. No. of housing loan leads generated etc. This KPI helps management assess which branches are the highest- and lowest-performing.
• Operating profit, per month /per defined period 

1. Three Key Indicators (KIs) – KPIs, KCIs, KRIs – are closely related as they rely on common sets of data to identify risks in achieving business objectives and executing strategies. 
2. Structuring the metrics into a comprehensive Key Indicator Framework allows managers to follow clearly the progression of process issues to control gaps to potential risks.
3. Trending analysis of KIs over time serves to identify emerging process issues, control gaps and operational risks. 
4. Establishing thresholds on KIs trends will assist in quantifying the criticality of the emerging process issues, control gaps and operational risks.

   Breakthrough in technology, increased data availability, new business models and value chains are transforming the way they serve the customers, interact with third parties and operate internally are adding to operational risks. Operational risk must keep pace with this dynamic environment, including evolving risk landscape. Thus the Objective of operational risk management has become a valuable partner to the business.

When considering operational risk as it relates to operational efficiency, there are essentially two different approaches that an organization can take. The first is to approach risk as a necessary part of doing business while recognizing that more risk can potentially lead to more reward. The second approach seeks to mitigate risk whenever possible, enabling a minimal risk strategy with a slow and stable growth pattern. 

All businesses seek to have high levels of operational efficiency as this equates to better business growth, increased stability, and greater profitability. However, to improve upon current levels of operational efficiency, it is first necessary to explore operational risk. In fact, the two can be considered as two sides of the same coin, as they are intrinsically connected. With a reduced level of risk comes greater operational efficiency and vice versa. 

Operational efficiency can be considered the level of effectiveness a business upholds when doing business, while operational risk describes the potential risks that may arise when doing business. Understanding the differences between these two concepts can help an organization better move to the next steps of operational risk mitigation and improving operational efficiency.

*****

Amarnath Jha is working as a Divisional Manager in the Operational Risk Management Department, Risk Management Wing, Canara Bank. He joined the bank as Probationary Officer in 2005 and has experience in both Branch Banking & Risk Management. His Qualification Includes CAIIB, B.Sc. Agri and FRM. He can be reached at amarjha@canarabank.com