Most international banks are increasing their operational-risk cover to comply with the new capital requirements in Basel II.¹ Operational risk is a financial institution's exposure to losses arising from mistakes (such as computer failure and breach of regulations) and conspiracies (including loan fraud and embezzlement) that affect its day-to-day business.

Banks generally calculate their operational-risk cover by estimating the probability that a particular event might occur and the resulting financial loss—such as the fine for breaking a rule or the sum pocketed by an embezzler. But operational crises also upset shareholders and can lead to a decline in market value.

Few institutions, however, factor such potential market losses into their risk-cover calculations or operational-risk-management plans. New research suggests that they should. The decline in market value following an operational crisis can be far greater than the financial loss. The first step for banks will be to measure and understand the full extent of their operational risk.

We analyzed operational crises at European and North American institutions for which the actual financial loss was more than $1 million.² The average actual loss for the sample was $65 million. In the short term, the decline in shareholder value was, on average, about equal to the financial loss. After 120 working days, however, the former figure had ballooned to 12 times the latter one, knocking almost 2 percent, on average, off an institution's total returns to shareholders (TRS) (Exhibit 1). Even a small financial loss can be followed by a significant drop in the share price.

Different operational crises give rise to different degrees of market loss. Looking across the range of events,³ we found that the most harmful ones were embezzlement, loan fraud, deceptive sales practices, antitrust violations, and noncompliance with industry regulations (Exhibit 2). Just under half of the risk events in our sample fell into at least one of these five categories.

For European companies, the decrease in shareholder value was initially higher but tended to tail off, whereas North American institutions experienced smaller immediate losses that were still growing 100 days later. The fallout from an event may last longer in North America because of greater transparency: the market continues to receive details about a crisis long after it first hits the headlines, while in Europe subsequent findings are less likely to become public.

Losses also vary by subsector. Asset-management and corporate-finance companies are vulnerable to any incident that undermines the customer's faith in them and thus are heavily penalized for operational crises in both the medium and long-term. For retail banks, an initial decline in share price may persist for the same reason. Indeed, the market seems to turn against these companies more during the second three-month period following an event than in its immediate aftermath.

In contrast, businesses without such a customer franchise—sales, trading, and, to some extent, retail brokerage—usually recover after an initial loss. In these subsectors, we believe, stock prices are already discounted because of the volatile nature of the companies' revenue streams.

What triggers a risk crisis? About half of the operational-risk events in our sample arose from negligence, an unintentional failure to meet a professional obligation, or a defect in the nature or design of a product—problems that are largely within the institution's control. In particular, these issues stemmed from improper business and market practices, such as breaking antitrust rules, and from equally preventable lapses, such as using deceptive sales practices or concealing a product's characteristics. External and internal theft and fraud were responsible for 20 percent and 14 percent of risk events, respectively, while 8 percent were caused by process failures, particularly in monitoring and reporting.

A company can soften the impact of a crisis on its market value by communicating clearly with its shareholders. We compared two cases in which unauthorized trading led to actual losses of several hundred million dollars, for example. One institution issued a series of gloomy statements, including upward revisions of the extent of the loss and news of various resignations and reorganizations. The market penalized it heavily in the six months following the incident. The other institution was clear from the outset about the size of its loss, disclosed all of the pertinent details, and issued no further bad news. This company suffered no long-term damage to its market value, and within six months its TRS had nearly returned to the estimated value had the event not occurred.

Operational crises can be unexpectedly costly and potentially catastrophic events. Financial institutions need to understand the different kinds of operational risk they face and the amount of their potential losses in order to reduce their exposure. They can then apply the available management tools for controlling risk⁴ in a more informed and systematic fashion.