Elena Pykhova argues that operational risk needs to demonstrate measurable business value rather than simply executing established processes. As organisations face increasingly interconnected risks and rapid technological change, the function must evolve from a compliance-focused “diminisher” into a “multiplier” that improves decisions and supports business performance.
Operational risk has spent decades proving its
regulatory credibility. Now it faces a different challenge: proving its
commercial value. The discipline has successfully strengthened organizational
resilience through governance, oversight and control, but today’s environment
demands more than simply executing established processes. To remain influential,
operational risk must demonstrate how it actively improves decision-making and
creates measurable business value rather than merely documenting risk.
That is the view of Elena Pykhova, CEO and Founder
of The Op Risk Company,
who believes operational risk stands at an important
point in its evolution. While the foundations of the discipline remain
essential, she argues that rapidly changing risks, advances in artificial
intelligence and rising expectations from senior leadership require a
fundamentally different mindset.
“The future of operational risk is therefore not
about abandoning the existing practices, but it’s about evolving them,” she
says. “The moment is now. That is what I call thinking sharper, acting
smarter.”
According to Pykhova, three powerful forces are
driving this shift. Risk landscapes have become increasingly interconnected through
complex networks of third and fourth parties. Reporting cycles that once supported
effective oversight are no longer sufficient in a world where emerging threats develop
rapidly.
At the same time, generative and agentic AI
represent a transformational opportunity for operational risk functions that
have yet to fully capitalize on the technology. Meanwhile, the industry’s core
operational risk processes have remained largely unchanged despite these dramatic
external developments.
Rather than questioning the relevance of operational
risk itself, Pykhova believes the industry should examine how it defines its
own purpose.
“I think every successful commercial function can
clearly explain its products and services, what it offers, who it serves, and
why it matters,” she says. “Operational risk second line functions often
cannot.”
Too often, operational risk professionals describe
their work through activities rather than outcomes. Risk and Control Self Assessments,
scenario analysis and reporting are valuable disciplines, but they are not, in themselves,
compelling value propositions. Organizations increasingly want to understand what
these activities actually deliver.
Instead of asking what processes operational risk
owns, Pykhova believes leaders should ask what organizational outcomes it
creates. This represents a shift from process-driven thinking toward a
commercial mindset focused on services and measurable value.
Historically, she notes, regulation has naturally
emphasized governance. Supervisory bodies consistently describe second line
operational risk through concepts such as independent oversight, challenge,
monitoring and framework development. Those responsibilities remain
fundamental, but regulations define mandates rather than customer value.
“What is largely missing is the articulation of how
the function creates value for its internal customers,” she explains. “The
regulation defines the mandate. It doesn’t define the value proposition.”
