Reassessing self-assessment

Traditional approaches to assessing and controlling operational risk within institutions are outdated, argues Gerald Sampson. Self-assessment needs rethinking, and proper risk evaluation is far better served if risk management departments assume their responsibilities and identify the required controls themselves.

Self-assessment routines are probably the most common tool in use today to address operational risk. Not all institutions have a common language of risk or process classification, and most do not yet have an effective and tested capital calculation model. But most do perform, in one form or another, a self-assessment exercise. The most common format consists of gathering respondents in a room to identify their key risks, assess likelihood and impact, and, in many cases, identify controls and