Evaluating Technology's Performance in Dubai Banking Risk Management

This report delves into the critical role of technology in operational risk management within the banking sector, specifically focusing on the context of Dubai. It begins with a literature review that defines operational risk, explores various risk factors like cyber threats, organizational changes, and outsourcing, and examines the key challenges in operational risk management. The report investigates the ways in which technology has affected operations performance and operations risk management, including the integration of operational risks and the three-point approach for counteracting the operational risks within the banking sector. The report also provides an overview of the key challenges in operational risk management within the banking sector. The report analyzes the parameters of performance management within the banking sector and the Key Performance Indicators. The report concludes by evaluating the performance of technology in the banking sector, including the role of technology in mitigating risks and improving overall operational efficiency. This report is a valuable resource for understanding the interplay between technology and risk management in the banking industry.

The role of technology in operation risk management and
evaluation of its performance in banking sector in Dubai
1

Table of Contents
Chapter 2: Literature Review...........................................................................................................3
2.0 Introduction to the chapter.....................................................................................................3
2.1 Concept of operational risk and operational risk management within the banking sector....3
2.2 Concept of performance management theory......................................................................10
2.3 The performance management theory in relation to technology, banking and operational
risks............................................................................................................................................12
2.4 The Parameters of performance management within banking sector and the Key
Performance Indicators..............................................................................................................13
2.5 Models for the identification of the operational risks..........................................................15
2.6 The ways in which technology has affected operations performance and operations risk
management...............................................................................................................................16
2.7 Conceptual Framework........................................................................................................24
2.8 Summary..............................................................................................................................24
References......................................................................................................................................26
2

Chapter 2: Literature Review
2.0 Introduction to the chapter
The section on literature review encompasses critical review of a number of research journals,
articles and books, relevant to the topic undertaken for the research; this helps in gaining a clear
understanding of the underlying concepts as well as the connection between different variables
involved in the research topic. This research topic deals with investigating and comprehending
the role of technology in operational risk management within the banking sector and the
evaluation of the performance of technology in the banking sector, with special focus on the
banking sector of Dubai. Hence, the research articles and journals chosen for the purpose
basically deals with the concepts of operational risk management, performance management,
modelsand theories relevant to the concepts as well as the key performance indicators and
parameters of performance management systems, as is applicable to the banking sector, in
general,as well as in Dubai, in particular.
2.1 Concept of operational risk and operational risk management within the banking sector
According to Archer and Haron, (2013), Operational risk can be defined as “the risk of loss
resulting from inadequate or failed internal processes, people and systems or from external
events, including the legal risks and excluding the strategic and reputational risks” (as put
forth by Basel Committee on Banking Supervision, 2003). Operational risks are dynamic in
nature and quantification of such types of risks, identification as well as its mitigation is quite
intricate. As per the studies of Barakat and Hussainey, (2013), the operational risks are a tad bit
different from the other banking risks in the fact that it is ‘intrinsic’ to the organization and is
stimulated by several factors such as business growth, regulatory landscape, preferences of the
customers, internal business processes and external factors like financial instability and natural
calamity.
3

Fig 1: Factors influencing operational risk
(Source: Infosys.com. 2019).
Major operational risks afflicting the banking sector
As per the surveys conducted among the operational risk practitioners, chief risk officers and
heads of operation risk of various financial firms and banks, insurers and managers of public and
private assets and reported in the studies of Bhatti, (2017), there are a range of different
operational risks that can afflict the banking sector; Cyber risk, Organizational change,
Outsourcing, Geo-political risk, change of Regulations, IT Risk, Conduct Risk, Fraud, AML and
other sanctions compliance and Physical attack, in form of theft or terrorism are the ten major
operational risks afflicting banks, globally.
4

Fig 2: Loss to banks by cases of Operational risks
(Source: Huber and Funaro, 2018)
According to Raghavan and Parthiban, (2014), the threats from cyber attacks and breach in the
security systems responsible for the maintenance of data are the most prominent operational risk
of recent times, in the banking sector. The imminent threat from the cyber attacks is ever-
increasing and is even metamorphosing into hideous forms, which are becoming increasingly
difficult to detect, according to the study. The Bangladesh Bank Heist which occurred in the year
2016, in which the hackers took opportunity of the technical lines of weaknesses in the ‘Swift’
Financial Communications Network and stole around $81 million from accounts of Central Bank
showcases the extent to which the technologically upgraded systems are labile to such cyber
threats (CNBC, 2019).
Another incidence in the year 2016,which occurred in Tesco Bank, in which £ 2.5 million from
the accounts of 9,000 different customers, when there was a breach of data in the data systems of
the bank, depicts the necessity for the maintenance of secure data security systems in order to
avoid such grave operational risks (Sapir and Wolff, 2013). As reported in the studies of Huber
and Funaro, (2018), according to General Data Protection Regulation Act, which had been
formulated by the governing body of European Union, the financial organizations, including
banks, which exhibited negligence in maintaining data security and reportedly faced data
security breach, would have to pay a fine of 4% of their global, annual revenue. This would a
5

hefty sum and thus, necessitates the banks and other financial organizations to take up measures
and adopt strategies for minimizing and/or mitigating the chances of data security breaches and
cyber threats as far as possible.
As reported in the studies conducted by Rbi.Org, (2019), Organizational Change, whether due
to change in regulatory policies framed by the government, changes in the technological systems
of the organizations or re-structuring of the organization based on the views of the management
and their vision, always causes a mass upheaval and introduces significant operational risks. As
reported in the studies of Chen, (2013), the change in desk structures and internal risk transfer
processes for the banks, according to the revised ‘market risk capital framework’, are examples
of forced organizational changes that mainly impacts the front-office businesses of banks
majorly.
As per the views of Tayeh et al., (2015), owing to the evolution of technology and the
introduction of technologically upgraded systems that are able to cater to the needs of the
customers more efficiently, it becomes absolutely necessary for the banks and other financial
firms to cope with such technologies. In the views of Belás and Gabčová, (2016), they require
offering such superior facilities to their customers as well, for maintaining customer satisfaction
and a stable position in the market. According Saks, (2015), for this, maintenance of systems for
coping with the technological advancements and designing training sessions for the staffs, for
helping them function in the technologically advanced environment without any problem, is
absolutely necessary. However, as per reports published in the year 2016 by Capgemini, though
96% of the global banking executives agreed to the fact that possessing technologically advanced
systems was important for banks in order to deliver good services to the customers, only 13% of
the banks have all the requisite systems in place for the purpose. According to Trkman, (2013),
post the analysis of the reports published by Capgemini, it calls for introduction of organizational
change in the structure and the culture of the organizations and thus, increases the threat of
operational risks.
6

Fig 3: Organizational chart for operational risk management function within the banking sector
(Source: Rbi.org.in., 2019)
Outsourcing is another significant operational risk, which according to the studies of Upadhaya
et al., (2014), after the passing of GDPR legislation, has become a riskier venture for the
organizations. The study reveals that the banks and all other financial firms, in fact, would be
required to maintain the data of their customers in portable format, for quick reference at all
times. As per the researches of Mills et al, (2016), this would mandate understanding of complex
algorithms and web of relations with outsourcers, in order to avoid the hefty fines that could be
imposed upon the firms, for failing to maintain a compact data of the information related to the
customers; distributed ledger technology would aid in this process.
Effective strategies for operational risk management within the banking sector
Enhancing risk coverage, integrating operational risk and decentralizing the operational risks
forms the basis of the ‘three-point approach’, for counteracting the operational risks within the
banking sector. According to Pollitt and Dan, (2013), a model called ‘three lines of defense
7

model’ is predominantly resorted to understand and manage operational risks, by aiding in
designing solution frameworks for the purpose. For enhancing the risk coverage, the solution
framework is required to include such risk sources, which is lacking in most banks of modern
times.
Fig 4: The extent to which Operational Risk management has helped mitigate losses to banks
(Source: Huber and Funaro, 2018)
According to Setia et al., (2013), Continuous monitoring of all the potential sources of risk
exposure in the banking processes like customer on-boarding, tracking of employee records and
managing the portfolios of the prospective customers is required, besides identifying and
allocating accountability to each level within the risk management plan. This helps the
employees and management understand their respective job roles and responsibilities clearly.
According to the studies of Summerfield, (2018), identifying prospective defaults in the product
fitment systems, based on the profile of the customers involved and the degree of risk associated
with the same as well as establishing strong communication and feedback systems across
various levels of management and stakeholders allows for efficient coverage of risks. The
solution framework, thus, allows going beyond the traditional types of risks and ensuring
coverage of all business processes and interactions.
Furthermore, going by the studies of Summerfield, (2018), the integration of operational risks
involves five different steps viz. risk integration, quantification, analysis, reporting and
8

governance, which allows for efficient management of theoperational risks, within the banking
sector. Formation of ‘Enterprise Case Management Systems’, which would allow for formation
of ‘risk catalogs’ for alerting the different departments regarding the types of risks,based on their
nature and source, allows for reducing the cost of managing such risks, both operational as well
as technological and are thus, highly advantageous.
Fig 5: Framework for integration of operational risks
(Source: Infosys.com. 2019)
Management of the Operational risks is not the sole duty of the risk team and according to Davis,
(2018), formation of a dedicated team for ensuring compliance to all regulatory clauses and
participation of all the business functions on ground, would help in cutting down the costs of risk
management and benefit the concerned organization. Closing the gaps in the business processes
andoperations would go hand in hand with the systems forchecking compliance to the regulatory
clauses and thus, would make thesystems for the management of the operationalrisks much
smoother and efficient, as reported in the studies of Idnani, (2017). For example, the operational
risk manager can form regulations concerning customer on-boarding processes for future, based
on the results from the audits and risk modelling whilethe retail banking manager in the bank can
mitigate the imminent risks in the customer on-boarding processes (Guidara et al., 2013).
The key challenges in operational risk management within the banking sector
9

According to the reports published by Infosys, in the year 2019, there are majorly four
significant challenges to operational risk management within financial institutions like banks. In
the views of Ellul and Yerramilli, (2013), inefficient parameters for the identification of the
imminent risks is the major challenge, followed by the presence of large amount of data for the
processing as well as the complex logic for the process and the absence of centralized data set
within most of the organizations in the sector. In the views of Cherian and Jacob, (2013), the
lack of vision among the employees as well as the management is another key challenge.
According to Patel, (2019), the Key Resource Indicators as well as the Key Performance
Indicators that are used for identification and analysis of the Operational Risk Management by
most of the banks do not provide a holistic view of the data and thus leads to inefficient
identification of the imminent risks.
According to Dionne, (2013), one of the key to efficient operational risk management is proper
monitoring of all the transactions occurring in a particular bank, all throughout the year, each and
every day; this becomes increasingly impossible with the growing populations that are interested
in availing banking facilities, in both urban and rural areas. In the views of Koch and
MacDonald, (2014), the pressure on banking infrastructure increases because of this and the
current processing logic is quite inefficient by standards, for handling this exponential increase,
which increases the chances of failure of operational risk management. Further going bythe
studies of Devaraj et al, (2017), absence of data management systems, which allows for the
availability of synchronized data in centralized systems, within the banking sector, poses a
significant challenge to Operational Risk Management. Most of the banks do not have clear
knowledge of the ways in which the operational risks needs to be managed and thus, fails to
formulate adequate strategies for counteracting the same; this lack of vision poses another
significant challenge to the effective management of imminent operational risks within the
banking sector.
2.2 Concept of performance management theory
According to Vukšić et al., (2013), the term ‘performance management’ can be defined as “a
process which continuously identifies, measures and develops the performance of the
workforce in the organizations, while connecting the individual performance and the
objectives to the organizational mission and goals”. According to Shields et al., (2015), the
10

concept lays emphasis on motivating the employees, in order to steer the performance of the
organization towards better achieving better results. There are two key aspects to management
systems, the continuous process and the link to organizational goals. Going by the studies of
Arnaboldi et al., (2015), the activities which helps in performance management within
organizations includes setting clear goals, maintaining continuous reports for progress,
communicating amongst the employees and the management for suggestions on improved
performance, training the employees to make them able to perform well and lastly,awarding
them for theiraccomplishments.
As reported in the studies of Slack and Brandon-Jones, (2018), Goal Setting Theory and
Expectancy Theory are two theories that underlie the basis of Performance Management within
organizations. According to Goal Setting Theory, which had been proposed by Edwin Locke in
1968, the individual goals set by the employees has a major role to play for improving the
performance of the organization (dos Santos and Cabrita, 2016). According to Expectancy
Theory proposed by Victor Vroom in 1964, the employees of an organization tend to adapt to the
imminent organizational situations, for achieving the organizational goals (dos Santos and
Cabrita, 2016). According to Soin and Collier, (2013), apart from these, there are few other
theories which help in understanding the concept of performance management as well as the
activities that needs to be done in order to encourage good performance in the workplace; these
includes Control theory, Justice theory, social cognitive theory and others.
Fig 6: Performance Management System
(Source: dos Santos and Cabrita, 2016)
11

2.3 The performance management theory in relation to technology, banking and operational risks
Performance Management Theory in relation to Technology
According to Gitau, (2014), the incorporation of technologically advanced systems into the
banking systems helps the banks and other financial firms to deliver seamless and effective
services to the customers, within a short span of time. As per Upadhaya et al., (2014), the
technology influences positive attitudes among the employees, regarding the reviewal of
performance and well as increases the efficacy of the feedback processes on performance. As
reported in the studies of Guidara et al., (2013), the data from performance management systems
aids in identification of the employees with highest contribution towards the organization, thus,
allowing for setting up efficientperformance appraisal systems. According to Hameed et al.,
(2014), as per Control theory of performance management, self-regulation of the interim
processesin the organization is important and critical for the success, since it reduces the
discrepancy between the standards of performance that should be exhibited by the concerned
organizations and the level of performance already being exhibited by the same, in current times.
Furthermore, as per Vieira and Sehgal, (2018), the incorporation of the technological systems
helps in the planning and strategy development processes, even while the employees and the
management are not functioning from the same location, as well as helps in collection of data
relevant to the KPIs and others. This, in turn, helps in identification of flaws in the systems and
correcting the same. According to Vukšić et al., (2013), this brings forth total control over the
performance, post the technological improvisations and implementations, in accordance to the
stated performance management theory.
Performance Management Theory in relation to Banking
The Goal-Setting Theory and Expectancy Theory expresses the need of the organizational
leaders to motivate the employees to help them understand the consequences of their actions as
well as aid them in accepting their own responsibilities in the job roles they are required to
perform. According to Grigoroudis et al., (2013), in banking sector, the employees functioning in
the lower levels of the organizational pyramid are expected to act as per the instructions from the
seniors. However, they are also expected to improvise ways in which they can execute their
responsibilities in a more efficient manner, in order to play a role in the development of the
organization, at large.
12