Emerging Practices for Capital Adequacy © Copyright 2003, CCRO. All rights reserved. 37 VI. OPERATIONAL/OPERATIONS (OPERATIVE) RISK Note: Operational and operations risk represent two distinct and separate risk components that are often referred to collectively. For simplicity and definitional clarity, this white paper refers to operational/operations risk as operative risk when the two components are addressed collectively. 6.1 Introduction to Operative Risk for Energy Industry Operative risk is an integral component of measuring capital adequacy. However, the discipline of operative risk management is not as well established as that for the other components of economic capital, market risk and credit risk. Given the nascent discipline of operative risk, the CCRO recommends consideration of a wide range of methodologies for managing these risks consistent with the framework outlined below. These methodologies vary across a wide range of complexity as applied to different operative risks. The CCRO recommends that companies begin monitoring these risks and working toward establishing robust internal measurement and control methods, both qualitative and quantitative. A previous CCRO white paper (“Valuation and Risk Metrics”) distinguished between operational risk and operations risk. Operational risk is defined as the risk of direct or indirect loss resulting from inadequate or failed internal processes, people, and systems or from external events. Operations risk is defined as the risk associated with delivering, producing, or storing physical energy products. This section focuses on the identification and control of operative risk. The concept of formally measuring operative risk as a component of capital adequacy originated in the banking industry. Yet the energy industry is inherently different from banking. The importance of physical assets and sources of energy to our industry heightens the significance of operative risk and adds to the complexity of its calculation. The unique challenges of operative risk are analyzed in this section. The framework for calculating operative risk as a component of economic capital provides approaches for: • Classifying operative risk • Measuring operative risk • Mitigating operative risk and its effects on economic capital adequacy. 6.2 Classification of Operative Risk The CCRO’s recommendation for measuring operative risk is to create a “risk taxonomy” as a long- term solution, coupled with the development of an internal rating-based scorecard (discussed in Section 6.3) as the first step toward including operative risk as part of economic capital. The risk taxonomy is a system for organizing types of operative risks by serving as a family tree, aggregating risks by various characteristics. The level of aggregation at which each characteristic presents itself may be determined individually. There is no standardized risk taxonomy, but certain characteristics should be used to create the groupings: