Modeling operational risk in business processes

ABSTRACT We propose an approach for modeling and analyzing the operational risks in a financial institution based on its business process model. This approach is complementary to the widely used loss-event database-based quantification approaches used by financial institutions and addresses one of their key shortcomings by enabling sufficient granularity and transparency to map operational risks across processes, people and technologies. By connecting the generation of a probabilistic network with the business process model, this approach enables the operational risk model to be adjusted easily whenever a change occurs in the business process of the financial institution. This can be used as a basis to further assess options and countermeasures for lines of business to mitigate and manage risks. We demonstrate this methodology with some examples including IT-related, infrastructure-related and outsourcing-related risks.