Operational-risk events: Response and resilience

(7 pages)

Controls fail. Natural disasters strike. Product defects occur. No industry or company is a stranger to operational risk. These incidents carry a hefty price tag: according to the ORX global banking database, more than 65,000 loss events on average occurred from 2016 to 2021, with losses totaling close to $600 billion over the six-year period.¹

Methodology

To understand the effect of operational-risk events on share price, we analyzed operational-risk events between 2006 and 2020 at organizations from North America and Europe (including the United Kingdom), across sectors. Our analysis was similar to that undertaken by McKinsey in 2005,¹ The hidden costs of operational risk,” McKinsey, December 1, 2005. which looked only at financial institutions.

All analysis is based on public data, including the financial statements of these organizations and their peers. We filtered an initial database of 19,010 operational-risk events sourced from the SAS Institute’s SAS OpRisk Global Data. We isolated a group of 498, which met the following criteria: inflation-adjusted losses were at least $50 million; all affected organizations are publicly traded European and North American companies and institutions; only events with end dates in or after 2006 were considered (as dated from their first appearance in a major news outlet such as the Wall Street Journal or Bloomberg News).

The 498 risk events examined included events occurring at companies in North America (332) and Europe including the United Kingdom (166). Both financial (287) and nonfinancial (211) companies were represented. Of these events, two sets of subrisks stood out: improper business or market practices (210 incidents) and suitability, disclosure, and fiduciary events (189). All other events were grouped in a third category which includes theft, fraud, and disasters (99).

Stock price and company-level data were sourced from the S&P Global database. Abnormal returns were calculated in two ways: how the affected firm compared with the broader market and how it performed against peers (adjusted by the Fama–French three-factor model, including market, size, and value premium). The top 2 percent of gainers over a 160-day sampling window were excluded as outliers.

A final point is that two alternative methodologies for measuring impact were also explored, both widely used in academic research and industry analysis. The first alternative approach measures abnormal return for each company as the difference between actual and overall market return (instead of using the Fama–French three-factor model). Accordingly, the impact from operational-risk events is defined as the average cumulative abnormal return over 120 days from approximately 500 operational risk events in our sample. The second alternative approach estimates the impact as the average excess cumulative return of the affected companies relative to that of their respective industry peers over the same time window. The results and detectable patterns were much the same under the different calculation and measurement approaches.

Direct financial losses don’t capture the full impact. Operational-risk events can color a company’s reputation among its customers and employees, prompting questions over whether the event reflects foundational issues. Regulators may increase their scrutiny, shifting their interaction model for a particular company or a broader industry.

Perhaps the most telling sign of these near- and long-term repercussions lies in the stock price. Shareholders take operational-risk events seriously: in the months after an event, equity losses are on average five times greater than direct financial losses. Moreover, the severity of the damage can vary widely, depending on the type of event, industry in which it occurs, and broader market volatility. The following data and discussion give a snapshot of what is at stake in operational-risk events. It’s far greater than the immediate damages reported in a headline (see sidebar, “Methodology”).

Operational-risk events trigger persistent declines in share price

As news of operational-risk events hits the market, share price declines somewhat, in line with the actual fines, settlements, and monetary losses. But over time, total shareholder returns (TSR) continue to fall. Across our sample of nearly 500 operational-risk events at companies in North America and Europe, TSR declined by 2.7 percent in total returns compared with peers during the 120 days after the event. This is equivalent to $1.9 billion on average, or 3.7 times the average actual loss of $500 million (Exhibit 1).

The impact of operational-risk events on shareholder returns deepens in the ensuing weeks.

In the eyes of shareholders, not all operational-risk events are created equal

The decline in share price that follows an operational-risk event varies depending on the type of incident that caused it (Exhibit 2). The two most common subrisks in the data set are:

Improper practices. The market reacts negatively but gradually to events linked to improper business or market practices. The data indicate that short-lived recovery can occur in the days after the event, but over the period of 120 days, declines are nearly 2.9 percent versus comparable peers, or seven times the average actual losses from such events.
Suitability, fiduciary, and disclosure. Violations of suitability, disclosure, and fiduciary standards also trigger declines over time, but these occur faster. By fewer than 60 days after the event, average share price drop is 2.8 percent below peers’, approximately the level at which it remains at 120 days.

The impact of operational-risk events on shareholder returns varies over time according to the type of event.

North American and European markets respond differently

The way companies communicate information about such events to investors may influence market response. Our analysis indicates that European markets tend to react faster and more strongly. Within three days, shareholder losses equal reported losses from the event itself; by 30 days, losses are five times reported losses. By 120 days, the European companies in our data set had seen a decline of more than 4 percent in their share price, equivalent to ten times direct losses.

The reaction of North American markets is only half as strong, and it’s more gradual. But as with European markets, TSR continues to drop over time, perhaps as more information emerges. Investors in both geographies seem to assume that the losses exceed the amounts reported, perhaps believing that operational-risk incidents signal more general mismanagement that may compromise the company’s ability to create value (Exhibit 3).

The impact of operational-risk events on shareholder returns is greater for European versus North American companies.

Markets punish financial-services firms more harshly for operational risks

Operational-risk events affect the share price of firms of all types, but shareholders punish financial institutions more strongly. By 120 days after event, financial firms see a decline of nearly 4 percent in TSR versus peers, while other firms see a decline of only 1 percent—equivalent to 14.0 times and 0.9 times associated reported losses, respectively. This observation holds in both North America and Europe.

The data suggest that shareholders may read more into what an operational mishap says about future earnings potential for a financial institution. Our data don’t indicate whether the perception is due to differential conjecture about firm management, implications for future regulatory scrutiny, or something else (Exhibit 4).

The effect of operational-risk events on shareholder returns is greater for financial institutions than other types of firms in North America and Europe.

The impact on TSR from operational risk events is largest when markets are volatile

Our analysis indicates that when markets are volatile, operational-risk events trigger larger drops in the share price of affected companies compared with peers that have not had events. To analyze a statistically significant number of operational-risk events, we looked at loss events over five-year periods in the data set. In the period from 2005–10, the average drop in TSR (120 days after the event) for all events in the rolling five-year period was nearly 7 percent versus only 1.5 percent during the period from 2010–15. Over this same period, S&P 500 volatility dropped nearly 40 percent.² In times of high market uncertainty, firms should be particularly aware that operational-risk losses can have a magnified effect on shareholder value (Exhibit 5).

The outcome of operational-risk events on shareholder returns can be affected by market volatility.

What can leaders do?

The findings have several urgent implications for leaders as they think about the overall resilience of their institutions, how to minimize the risk of such events occurring, and how to respond when crises do hit.

The findings strongly suggest that broad market forces and industry dynamics can magnify adverse effects. Effective crisis and mitigation planning has to take account of these factors. Experience supports this view. In the not-so-distant past, especially before the financial crisis of 2008–09, many companies approached operational-risk measures from a regulatory perspective, with an economy of effort, if not formalistically. Incurring costs and paying fines for unforeseen breaches and events were accordingly counted as the cost of doing business. Amid crises, furthermore, communications were sometimes aimed at minimizing true losses—an approach that risked a damaging cycle of upward revisions.

The present environment, however, is unforgiving of such approaches. An accelerated pace of change, especially in digitization and social media, magnifies the negative effects of missteps in the aftermath of crisis events. Leaders are consequently grappling with the long-term effects of operational-risk events, seeking crucially to avoid the dangers of underestimating their impact on market value.

The directional change in the response to operational risk has been from this formalistic, regulatory approach toward corporate resilience and the reduction of the most material risks. Part of this involves the development of robust monitoring and response capabilities, designed to help organizations understand their own position, that of their peers, and the broader market. In shaping their rapid-response capabilities, furthermore, organizations will need to manage stakeholders proactively. This includes developing an effective plan for communications, since the ways organizations communicate information to investors about operational-risk events have a bearing—positive or negative—on the market’s response.