These two cases made me realize how easily an organization can mistake a “map” for the “North Star.” In Case 3.1, the team had documents but no real orientation; in Case 3.2, we saw how even an evidence-based ORP can miss major exposures simply because they haven’t happened before. The key lesson for me is that Op Risk creates value not by knowing the business, but by applying a disciplined framework to uncover what’s missing and make the risk profile forward-looking.
This case shows that internal loss data alone only gives us the current exposure profile: what has already gone wrong inside the bank. To build a complete and forward-looking view of risk, we must expand beyond our own history. That means incorporating relevant external industry events to capture risks that peers have experienced, using scenario analysis to imagine plausible events that have not yet occurred but could happen under changing conditions, and applying the factor-in-change lens to reflect real shifts in the internal and external business environment. Only by combining internal data, external events, and forward-looking scenarios, can we construct a full, comprehensive exposure profile that anticipates emerging risks instead of simply recording past ones.
I think this case shows why an exposure profile cannot stay backward looking. We used the historical loss data carefully and the profile made sense for the old business. However we still missed a major risk because the business changed. For me the key takeaway is that exposure has to reflect what the company is doing now, not only what happened before. When a new activity involves physical assets or new operational steps, the team needs to build the exposure map from the ground up. This means looking at peers, thinking through where losses could occur, and testing the assumptions with forward looking judgment. Historical data is helpful, however it cannot guide us fully when the business is evolving.
I like the double meaning of North Star in this case. It’s the company name, but also the idea of having a guiding star when you’re dealing with something unfamiliar. It fits really well with the ECRG model, because our “North Star” is always to start with E: Exposure. Even if we don’t know the business, we’re not navigating blind. We can just anchor ourselves by mapping out what losses could happen, using both historical data and forward-looking judgment, and build our ECRG model from there.
This case nails the gap between history and reality. We built a solid profile from past losses, but we missed a new exposure, damage to stored commodities. Lesson is that an exposure profile must add current business changes and external signals, not just clean the old data.
These two cases made me realize how easily an organization can mistake a “map” for the “North Star.” In Case 3.1, the team had documents but no real orientation; in Case 3.2, we saw how even an evidence-based ORP can miss major exposures simply because they haven’t happened before. The key lesson for me is that Op Risk creates value not by knowing the business, but by applying a disciplined framework to uncover what’s missing and make the risk profile forward-looking.
This case shows that internal loss data alone only gives us the current exposure profile: what has already gone wrong inside the bank. To build a complete and forward-looking view of risk, we must expand beyond our own history. That means incorporating relevant external industry events to capture risks that peers have experienced, using scenario analysis to imagine plausible events that have not yet occurred but could happen under changing conditions, and applying the factor-in-change lens to reflect real shifts in the internal and external business environment. Only by combining internal data, external events, and forward-looking scenarios, can we construct a full, comprehensive exposure profile that anticipates emerging risks instead of simply recording past ones.
I think this case shows why an exposure profile cannot stay backward looking. We used the historical loss data carefully and the profile made sense for the old business. However we still missed a major risk because the business changed. For me the key takeaway is that exposure has to reflect what the company is doing now, not only what happened before. When a new activity involves physical assets or new operational steps, the team needs to build the exposure map from the ground up. This means looking at peers, thinking through where losses could occur, and testing the assumptions with forward looking judgment. Historical data is helpful, however it cannot guide us fully when the business is evolving.
I like the double meaning of North Star in this case. It’s the company name, but also the idea of having a guiding star when you’re dealing with something unfamiliar. It fits really well with the ECRG model, because our “North Star” is always to start with E: Exposure. Even if we don’t know the business, we’re not navigating blind. We can just anchor ourselves by mapping out what losses could happen, using both historical data and forward-looking judgment, and build our ECRG model from there.
This case nails the gap between history and reality. We built a solid profile from past losses, but we missed a new exposure, damage to stored commodities. Lesson is that an exposure profile must add current business changes and external signals, not just clean the old data.