Controls fail. Natural disasters strike. Product defects occur. No industry or company is a stranger to operational risk. These incidents carry a hefty price tag: according to the ORX global banking database, more than 65,000 loss events on average occurred from 2016 to 2021, with losses totaling close to $600 billion over the six-year period.1
Direct financial losses don’t capture the full impact. Operational-risk events can color a company’s reputation among its customers and employees, prompting questions over whether the event reflects foundational issues. Regulators may increase their scrutiny, shifting their interaction model for a particular company or a broader industry.
Perhaps the most telling sign of these near- and long-term repercussions lies in the stock price. Shareholders take operational-risk events seriously: in the months after an event, equity losses are on average five times greater than direct financial losses. Moreover, the severity of the damage can vary widely, depending on the type of event, industry in which it occurs, and broader market volatility. The following data and discussion give a snapshot of what is at stake in operational-risk events. It’s far greater than the immediate damages reported in a headline (see sidebar, “Methodology”).
Operational-risk events trigger persistent declines in share price
As news of operational-risk events hits the market, share price declines somewhat, in line with the actual fines, settlements, and monetary losses. But over time, total shareholder returns (TSR) continue to fall. Across our sample of nearly 500 operational-risk events at companies in North America and Europe, TSR declined by 2.7 percent in total returns compared with peers during the 120 days after the event. This is equivalent to $1.9 billion on average, or 3.7 times the average actual loss of $500 million (Exhibit 1).
In the eyes of shareholders, not all operational-risk events are created equal
The decline in share price that follows an operational-risk event varies depending on the type of incident that caused it (Exhibit 2). The two most common subrisks in the data set are:
- Improper practices. The market reacts negatively but gradually to events linked to improper business or market practices. The data indicate that short-lived recovery can occur in the days after the event, but over the period of 120 days, declines are nearly 2.9 percent versus comparable peers, or seven times the average actual losses from such events.
- Suitability, fiduciary, and disclosure. Violations of suitability, disclosure, and fiduciary standards also trigger declines over time, but these occur faster. By fewer than 60 days after the event, average share price drop is 2.8 percent below peers’, approximately the level at which it remains at 120 days.
North American and European markets respond differently
The way companies communicate information about such events to investors may influence market response. Our analysis indicates that European markets tend to react faster and more strongly. Within three days, shareholder losses equal reported losses from the event itself; by 30 days, losses are five times reported losses. By 120 days, the European companies in our data set had seen a decline of more than 4 percent in their share price, equivalent to ten times direct losses.
The reaction of North American markets is only half as strong, and it’s more gradual. But as with European markets, TSR continues to drop over time, perhaps as more information emerges. Investors in both geographies seem to assume that the losses exceed the amounts reported, perhaps believing that operational-risk incidents signal more general mismanagement that may compromise the company’s ability to create value (Exhibit 3).
Markets punish financial-services firms more harshly for operational risks
Operational-risk events affect the share price of firms of all types, but shareholders punish financial institutions more strongly. By 120 days after event, financial firms see a decline of nearly 4 percent in TSR versus peers, while other firms see a decline of only 1 percent—equivalent to 14.0 times and 0.9 times associated reported losses, respectively. This observation holds in both North America and Europe.
The data suggest that shareholders may read more into what an operational mishap says about future earnings potential for a financial institution. Our data don’t indicate whether the perception is due to differential conjecture about firm management, implications for future regulatory scrutiny, or something else (Exhibit 4).
The impact on TSR from operational risk events is largest when markets are volatile
Our analysis indicates that when markets are volatile, operational-risk events trigger larger drops in the share price of affected companies compared with peers that have not had events. To analyze a statistically significant number of operational-risk events, we looked at loss events over five-year periods in the data set. In the period from 2005–10, the average drop in TSR (120 days after the event) for all events in the rolling five-year period was nearly 7 percent versus only 1.5 percent during the period from 2010–15. Over this same period, S&P 500 volatility dropped nearly 40 percent.2 In times of high market uncertainty, firms should be particularly aware that operational-risk losses can have a magnified effect on shareholder value (Exhibit 5).
What can leaders do?
The findings have several urgent implications for leaders as they think about the overall resilience of their institutions, how to minimize the risk of such events occurring, and how to respond when crises do hit.
The findings strongly suggest that broad market forces and industry dynamics can magnify adverse effects. Effective crisis and mitigation planning has to take account of these factors. Experience supports this view. In the not-so-distant past, especially before the financial crisis of 2008–09, many companies approached operational-risk measures from a regulatory perspective, with an economy of effort, if not formalistically. Incurring costs and paying fines for unforeseen breaches and events were accordingly counted as the cost of doing business. Amid crises, furthermore, communications were sometimes aimed at minimizing true losses—an approach that risked a damaging cycle of upward revisions.
The present environment, however, is unforgiving of such approaches. An accelerated pace of change, especially in digitization and social media, magnifies the negative effects of missteps in the aftermath of crisis events. Leaders are consequently grappling with the long-term effects of operational-risk events, seeking crucially to avoid the dangers of underestimating their impact on market value.
The directional change in the response to operational risk has been from this formalistic, regulatory approach toward corporate resilience and the reduction of the most material risks. Part of this involves the development of robust monitoring and response capabilities, designed to help organizations understand their own position, that of their peers, and the broader market. In shaping their rapid-response capabilities, furthermore, organizations will need to manage stakeholders proactively. This includes developing an effective plan for communications, since the ways organizations communicate information to investors about operational-risk events have a bearing—positive or negative—on the market’s response.
