Study faults bank risk management.

Financial services would appear to be an industry that has a vital interest in risk management, but a recent global survey finds that large banks and other financial institutions are suffering multimillion-dollar losses as a result of poor operational risk management.

The survey by Risk Waters Group and SAS found that one in five financial companies still doesn't have an operational risk management program, yet 90 percent of these companies lose more than $10 million a year because of poor risk control practices. In fact, the survey of 400 risk managers at 300 financial institutions found that a third of them expect to spend less than $1 million on improving their risk management this year.

"Many companies are at a loss to know what to do about this threat to their business," says Peyman Mestchian, head of risk management for SAS U.K. "While new regulations such as Sarbanes-Oxley and Basel II have pushed risk management up the agenda, expenditures--both in terms of systems and procedures and headcount--are still a fraction of what they should be."

In an interview, Mestchian defined operational risk as the threat coming from such factors as people, processes and internal systems, as well as external events unrelated to market or credit risk. Broader business risk, such as strategic or reputational risk, is not included.

Understanding the vulnerabilities is largely a data issue, he adds. "Unlike market or credit risk, this data is difficult to grab--a lot of it is qualitative and subjective. You have data embedded in financial databases, human resources, etc. It's difficult to analyze where the highest risks are."

A particularly striking survey finding was that 21 percent of companies said they suffered losses between $10,000 and $100,000 at least once a day. Asked to explain, Mestchian said these could be caused by transaction error or fraud, system failures and resulting downtime, as well as by inefficiencies or mismatching of financial transactions.