Operational Risk and Resilience Consulting

BCG’s Approach to Operational Risk and Resilience

Our take is simple: best-of-breed resilience risk management is a competitive advantage. It not only lets companies avoid disruption but also helps them streamline processes, improve operational resilience, and spark value—no easy feats. Successful resilience risk management requires the right governance, processes, roles, and culture. In short, it calls for an operating model for operational risk that is prepared to manage tomorrow’s uncertainty and enables the organization to innovate quickly.

To help companies, we have developed a unique operating model that combines deep experience in operational risk with expertise across functional and technical areas—everything from organization design to generative AI. We work with organizations on every aspect of operational risk management, from risk taxonomy to end-to-end risk function transformation. It’s a holistic approach built around four steps.

Expand All

Embed operational risk management into the business strategy

Operational risk covers a lot of ground. It includes any risk arising from a company’s processes, people, and systems. It’s essential to understand where—and to what degree—perils lurk. We help clients develop a risk taxonomy, a set of relevant risk types, and use it to assess risks by probability and impact. This evaluation lets companies optimize their risk appetite—setting the right level of risk for every type of operational risk—and develop a risk strategy that aligns with their business strategy.

Establish operational risk governance and an organization structure

A key success factor in operational risk and resilience is having clarity on roles and responsibilities across the three lines of defense: managers on the ground, the risk function, and internal and external auditors. We help clients define decision rights and strike the right balance of delegation and control, so operational risk management can be effective without slowing down day-to-day business.

Implement a strong risk management framework

At the heart of an operating model for operational risk are the mechanisms for assessing, mitigating, and monitoring risk. We develop the processes, playbooks, reporting, and testing that help organizations zero in on potential and emerging risks—and take the right action at the right time. We identify where technology, such as risk analytics and AI, can boost efficiency and effectiveness. And we create controls to ensure that the risk function runs as it should.

Leverage operational risk management enablers

People, technology, and culture are key ingredients—and potentially catalysts—in any risk management model. We help leaders set the tone from the top and establish a culture where operational resilience is a key strategic objective. And we unleash the power of data and AI to drive predictive analytics and fuel visual dashboards, so the right information gets before the right people at the right time—enabling faster, better decisions on operational risk.