This article explores why operational risk management must evolve alongside the threats it is designed to manage. As organisations become more interconnected and risk events move faster across traditional boundaries, trust and established frameworks alone are no longer sufficient; highlighting the need for more dynamic approaches across an organisation
For decades, operational risk management has been built around governance
frameworks, documentation, and periodic assessments. Those foundations remain
important, but they are no longer sufficient for a world where technology,
geopolitics, and business models evolve almost continuously.
According to Satu Qersh, Head of Operational Risk Management at DNB
Sverige, the profession must fundamentally rethink how it approaches risk if it
hopes to keep pace with the environment it is trying to control.
“The risk management discipline and the methods that we’re using are not
dynamic enough,” she says. “At the end of the day, risk management is
very often 90 percent change management because change creates risk.”
That belief has been shaped by decades working across the Nordic banking
sector, where Qersh has responsibility for Sweden, Finland, and Denmark. While
these countries share many cultural characteristics, she believes they also
offer important lessons about how culture influences operational resilience.
“The Nordic countries have a very strong trust culture,” she explains. “There’s
high trust in employees, authorities, technology and banks. That reduces
friction enormously and supports collaboration.”
Yet trust can also create unintended consequences.
“People are managing risk every day, but they might not be updating the risk
data at the same time,” she says. “If it’s not documented, it doesn’t exist.
That attitude can sometimes be difficult to reconcile with how risk management
needs to operate.”
Qersh argues that national culture influences communication styles, but
organizational culture ultimately determines whether effective risk management
succeeds.
“At the end of the day, it’s the organizational culture that makes people
do what they should be doing because it’s connected to what behavior is
rewarded,” she argues.
“If there’s a culture of transparency, it’s much easier for a second line
operational risk professional to challenge. If there’s a culture of accountability,
people are much more willing to discuss the issues they face.”
The differences between Nordic countries become particularly visible when
organizations undergo change. Swedish organizations, she suggests, tend to
prioritize planning and consensus, while Norwegian organizations often make
decisions more rapidly through flatter structures.
Finland, meanwhile, frequently adopts a pragmatic approach focused on execution.
“The Finnish culture is very much ‘just get it done’,” she says.
“Sometimes, before we’ve even communicated the deadline, they’ve already
completed the work.”
Those differences matter because Qersh believes change management has
become one of the defining challenges for operational risk.
“Organizations sometimes discuss AI as though it should become a completely
separate risk category,” she says. “Instead, they should ask whether they’re
using AI within the framework they already have and how that changes their
existing controls.”
The pace of technological development exposes another weakness within
many traditional operational risk frameworks. While businesses continuously
adopt new
