Operational risk within investment management firms can stem from many sources. Firms also have varying tolerance levels for accepting or handling such risk. SEI believes virtually every firm can benefit from taking a fresh look at common areas of risk and consider the variety of relatively straightforward risk management measures that can readily be deployed. In that spirit, SEI put together a 10-part guide as an effective risk management tool to set the foundation for operational excellence. Below are excerpts from chapters five and six, now available for download at www.seic.com/OpsSurvivalGuide.

5) NAÏVE RELIANCE ON TECHNOLOGY: The Downside of Automation

While automation is a powerful tool for mitigating operational risk, it can create new hazards if systems are not carefully designed and implemented.

Common pitfalls: Too often, systems are used by staff who don’t know how to accomplish manually the tasks being automated, making it easy for missing steps and mistakes to fall through the cracks.  Many other problems are caused by poor system design or implementation, inadequate documentation, and makeshift add-ons.  Inadequate testing of new systems and software is another frequent source of risk.

What can firms do?

Put automated functions in context – Make sure that those who deal with operational systems understand the function being automated, as well as its system and workflow linkages.

Develop detailed written specifications – No system or software development project should be undertaken without such a guide.

Diagram all systems and workflows – Identify all systems in use, including spreadsheets and proprietary databases.

Keep up with system upgrades and maintenance – Update access permissions, upgrade infrastructure, and build audit trails as needed. Whenever a new application or system is introduced, review all related workflows to flag needs for re-engineering.

Engage knowledgeable staff in testing – Those who test new features or systems should thoroughly understand their functions and operational context.

Hire consultants thoughtfully – They need to be specialized enough to address IT needs, but should also understand the investment management business.

Strong, collaborative working relationships among IT staff, operations staff and outsourced service providers are the foundation for successful risk management. All must work well together if firms are to create a smoothly operating, risk-managed infrastructure.

6) PLAYBOOKS: Workflow Documentation

An operations department without workflows is like a traveler without a set of maps or a community without a zoning plan.

Common pitfalls: Extreme as it may sound, some firms manage to operate with a total lack of formal workflow documentation.  Many more firms have obsolete or incomplete process-and-procedure documentation, which can frequently be a factor in operational breakdowns.

What can firms do?

Develop a plan and timeline for reviewing, developing and documenting workflows – If your firm has lagged on documentation, don’t try to tackle every process at once.

Establish a regular schedule for reviewing and updating workflows – They should be reviewed at least annually.

Create procedures for escalating incidents of failure to management – The most effective procedures use both the magnitude and timing of potential impacts in determining which incidents go up the chain of command, and when.

Take steps to make sure staff members understand workflows – Periodic meetings, operational reviews and audits may all be helpful. 

Consolidate and focus workflows as much as possible - Ideally, workflows define a single, logical set of activities in manageable pieces.

Make workflows available both online and in hard copy – Otherwise they may be inaccessible in critical situations when they are needed most.

Not only will well documented workflows help you avoid mistakes and miscommunication, they make it much easier to train new employees.  Investing the effort it takes to do the job will pay off in improved efficiency and a lower rate of errors every single business day.