10.3 Non-Financial Risks: Operational, Strategic, and Reputational
Key Takeaways
Operational risk arises from inadequate or failed processes, people, systems, or external events.
Strategic risk concerns flawed choices, failed implementation, or failure to adapt to the business environment.
Reputational risk is adverse stakeholder perception that can reduce clients, funding, market access, or regulatory confidence.
Legal, compliance, conduct, cyber, outsourcing, and business-continuity exposures commonly sit within or cut across operational risk.
A control must address the actual cause: training cannot repair weak system access, and insurance cannot restore all lost trust.
10.3 Non-Financial Risks: Operational, Strategic, and Reputational
Not every threat reaches a firm first through a price, interest rate, or default. Non-financial risk covers exposures generated by operations, decisions, behavior, law, technology, and stakeholder confidence. These events can still produce large financial losses, but the immediate source is not a market variable or obligor's credit quality.
Operational risk
Operational risk is the risk of loss or harm from inadequate or failed internal processes, people, systems, or external events. The categories are a diagnostic checklist:
- People: error, inadequate training, misconduct, fraud, unauthorized trading, or insufficient staffing.
- Process: poor design, missing approvals, inaccurate reconciliation, weak documentation, or a failed handoff.
- Systems: hardware or software failure, faulty interfaces, cyber intrusion, data corruption, or inadequate access control.
- External events: disaster, utility failure, vendor outage, civil disruption, or other events outside direct control.
Examples in a securities firm include a wrong order entry, failure to segregate customer assets, an unreconciled break, a cyberattack, or an outage at an outsourced service provider. Controls include segregation of duties, maker-checker approval, access management, reconciliations, exception reports, change control, staff competency, incident response, vendor oversight, backups, and tested continuity plans.
Strategic risk
Strategic risk arises from adverse or poorly informed business decisions, ineffective implementation, or failure to respond to changes in the environment. Launching a product without understanding demand, concentrating on a declining client segment, acquiring incompatible technology, or ignoring a regulatory change can impair objectives even if day-to-day processing is flawless.
Strategic risk is managed through disciplined planning, reliable information, scenario analysis, clear ownership, budget and capability review, performance indicators, challenge by the board, and periodic reassessment. It cannot be eliminated because every strategy involves choices under uncertainty. The aim is to take informed risk consistent with capacity, law, and stakeholder obligations.
Reputational risk
Reputational risk is the possibility that adverse perceptions among clients, investors, employees, regulators, counterparties, or the public will impair objectives. Consequences can include withdrawals, lost mandates, higher funding cost, reduced market access, staff attrition, closer supervision, and weakened franchise value.
Reputation is often a secondary consequence. A cyber breach is operational; failure to disclose it honestly can trigger conduct and compliance concerns; public reaction creates reputational damage; client departures then cause financial loss. Calling the whole sequence “reputation risk” can hide the controllable root cause. Management should identify the triggering event and then plan communication and remediation.
Legal, compliance, and conduct risk
Legal risk concerns unenforceable contracts, litigation, or adverse legal outcomes. Compliance risk concerns violation of laws, rules, regulatory conditions, or internal policies designed to implement them. Conduct risk concerns behavior that produces unfair outcomes, market abuse, conflicts, unsuitable selling, misuse of information, or other harm.
These categories overlap operational and reputational risk but deserve explicit attention. A trade may be operationally processed exactly as instructed yet still be unlawful insider trading. A sales script may be consistently followed yet mislead clients. Process consistency does not prove legal or ethical correctness.
Emerging and cross-cutting exposures
Cyber risk combines people, process, system, and external threat. Outsourcing transfers performance of an activity, not accountability for the regulated obligation. Model risk arises when a model is conceptually wrong, fed poor data, misused, or applied outside its limits. Business-continuity risk concerns the ability to sustain critical operations through disruption and recover within defined objectives.
Root cause and control matching
| Failure | Weak response | Better-targeted control |
|---|---|---|
| Excessive user privileges | General ethics seminar only | Least privilege, access approval, logging, and periodic review |
| Repeated settlement error | Insurance alone | Process redesign, validation, reconciliation, and escalation |
| Misleading product claims | Faster sales targets | Product governance, review, suitability, supervision, and consequence management |
| Critical vendor outage | Contract disclaimer only | Due diligence, service levels, resilience testing, alternatives, and exit plan |
Exam method
Identify the initial failure before its consequences. A system crash is operational even if it causes market loss. A bad expansion decision is strategic even if it later causes liquidity strain. Public distrust is reputational, but look for the operational, compliance, conduct, or strategic event that produced it. Then select a control that changes likelihood or consequence at the correct point in the chain.
Indicators and Escalation
Non-financial risk often appears first through operational evidence rather than a market price. Repeated settlement breaks, access-control exceptions, unresolved complaints, employee turnover in a control function, stale policies, or failed business-continuity tests can be leading indicators. Losses, sanctions, and adverse publicity are lagging indicators. A sound assessment records the event taxonomy, root cause, affected process, legal or contractual obligation, financial and customer impact, and responsible owner. Strategic and reputational consequences may emerge from an operational failure, but labeling every consequence “reputational risk” obscures the control failure that actually requires treatment.
A broker-dealer uses excessive system privileges, allowing an employee to alter settled-trade data without review. What is the primary risk?
Market risk
Credit risk
Operational risk arising from people, process, and system control weakness
Interest-rate risk
Management expands into a product it does not understand, underestimates required capabilities, and cannot execute the business plan. What is the primary risk?
Foreign-exchange risk
Settlement credit risk
Market liquidity risk
Strategic risk
Which statement about reputational risk is most accurate?
It often follows an operational, conduct, compliance, or strategic failure and then affects stakeholder behavior
It is exactly the same as daily share-price volatility
It exists only after a court enters a final judgment
It can always be transferred completely through insurance
Sections you finish are checked off in the contents.