Benchmarking the Operational Risk Management of an Insurance Company

The board member in charge of the risk committee for a large Belgian organisation requested BDO to evaluate their operational risk management function in line with market practice.

The objective was to highlight the key strengths and weaknesses of their operational risk management framework and implementation, to strengthen their position wherever needed.

Given the internal nature of operational risk incidents, most organisations keep their operational risk management practice close to their chest. Because of this, there aren't many ways for organisations to benchmark their practise in relation to their peers.

The mission required openness and transparency from the CRO and its team, to share with BDO the risk reporting details, the frameworks methodology and its implementation throughout the organisation.

As like for any benchmarking exercise, the first step was to deeply understand the client's practice, their method, strengths and weaknesses. After meeting them to explain the mandate, BDO spent time examining all the risk documents: the policies and procedures, the reporting structure and its content, the governance arrangements, etc. They had several meetings with the client to really understand how they were deploying operational risk management in their organisation.

For the benchmarking exercise, BDO used a proprietary questionnaire of 70 questions split into 7 components of the risk management framework, with roughly 10 questions each, aimed at evaluating the level of maturity of the risk practice.

BDO qualified the answers to the questions in a simple scoring system of yes (2), no (0), and partially (1). They evaluated independently – based on their examination of the client's practice – the answers to each of these questions, and the organisation rated itself as well.

Next, BDO discussed the answers to each question to highlight any difference and confront viewpoints. After a couple of meetings, they were able to reach a consensus on practically all of the answers.

Finally, BDO delivered to the Board Risk Committee a synthetic reporting highlighting the strengths of the risk management framework as well as some points for improvements. They used these points for improvement to develop recommendations for the team.

This benchmarking exercise turned out to be a great opportunity for a well-performing risk team to showcase their strengths, based on an objective assessment from an external provider. The mission and findings gave comfort to the Board that the risk team trajectory to improve their operational risk management practice was sound and validated by experts.

After the presentation of the results and recommendations to the Risk Committee of the Board, the CRO presented their multi-year business plan to further develop and strengthen risk management in the organisation, explicitly taking into account all of BDO's recommendations.