I asked my network: in your point of view, on which of the following should financial incentives in the operational risk management (ORM) framework be based?
Suppose in scenario one, you have a bonus for reducing the amount of operational losses (an output from ORM). In scenario two, you have a bonus for assessing operational risk in a timely and accurate manner, or for identifying control weaknesses as accurately as possible (an input to ORM). Which will lead to better performance in the operational risk governance structure?
Appropriate performance management arrangements that encourage the implementation of operational risk management — especially when these incentives are financial — can enhance operational risk governance, and can also lead to unintended consequences.
The higher the amount of financial incentives, the more likely it is that employees will try to manipulate the system.
For example, in scenario one, employees may try to conceal losses in order to receive the bonus. Never underestimate the power of small and even symbolic motives.
In general, it is better to design incentives based on the inputs of the operational risk management framework than the outputs. However, outputs should not be overlooked, and it is better to consult with human resource specialists as well as the risk unit about incentive design, in order to maximize the effectiveness of risk management and reduce the risk of manipulation.
Finally, incentives in the operational risk governance structure must ensure that the organization's core objectives are met, and be designed accordingly.