Guest-editors:<\/p>\n
Sergeja Slapni\u010dar, <\/strong>the University of Queensland, Australia<\/p>\n Sebastian Oelrich,<\/strong>Aarhus University, Denmark<\/p>\n Operational risks, such as cyber risk, pandemics, natural disasters, terrorism, geopolitical Deadline: August 31, 2024<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":" Guest-editors: Sergeja Slapni\u010dar, the University of Queensland, Australia Sebastian Oelrich,Aarhus University, Denmark Operational risks, such as cyber risk, pandemics, natural disasters, terrorism, geopolitical uncertainties, a lack of employees\u2019 skills, fraud, supply chain risk, and failure of processes and systems are more pervasive than ever before (ECIIA, 2022; World Economic Forum, 2023). They contribute to the […]<\/p>\n","protected":false},"author":91,"featured_media":0,"menu_order":0,"comment_status":"open","ping_status":"closed","template":"","meta":{"ngg_post_thumbnail":0},"event_category":[],"event_tag":[],"event_target_group":[],"class_list":["post-4755","event","type-event","status-publish","hentry"],"acf":[],"yoast_head":"\n
\nuncertainties, a lack of employees\u2019 skills, fraud, supply chain risk, and failure of processes and
\nsystems are more pervasive than ever before (ECIIA, 2022; World Economic Forum, 2023).
\nThey contribute to the increased complexity of the business environment and operations. Not
\nonly that operational risks require adequate procedures and management controls, but when
\nmaterialising, existing management control tools may show limited usefulness. How can
\nmanagement control tools that address such risks be designed and used? Challenges are
\nnumerous: Operational risks have been notoriously difficult to measure due to the rarity of
\nevents, the novelty of threat types and the scarcity of data (Wahlstr\u00f6m, 2006, 2009). Apart from
\ntheir wide-ranging nature, operational risks differ from other significant risks due to their loss
\ndistribution pattern, characterised by a higher frequency of small losses with low impact and a
\nfew rare but high-impact losses (black swan events) (Kay & King, 2020; Taleb, 2009). These
\nunique characteristics challenge quantifying, managing, and overseeing operational risks.
\nRisk management of various operational risks tends to be confined to silos and special,
\noften self-managing teams (security specialists, compliance officers, crisis managers). While
\nsome internal operational risks, such as fraud or cyber breach, may be managed with boundary
\nand belief systems (codes of conduct, training, organisational culture and transparency)
\n(Bussmann & Niemeczek, 2019; Oelrich, 2021; Posch, 2020), managing the risks coming from
\nexternal disruptions calls for different approaches, such as stress testing, scenario analysis,
\ncontingency planning and crisis management (Harrer & Wald, 2016; Kaplan & Mikes, 2012)
\nor, for example, in case of supply chain risks – risk performance target setting, information
\nsharing, supplier support and joint problem solving (Dekker, Sakaguchi & Kawai, 2013).
\nWhile recent advances in digital technology allow risk detection to become more
\neffective (Andreassen, 2020; F\u00e4hndrich, 2023), a methodological shift is taking place from risk
\nprevention and detection to building resiliency, encompassing response and recovery (Tsen, Ko
\n& Slapni\u010dar, 2022). These approaches demand different forms of management control. One
\naspect is how organisations approach high-level risk management standards and guidelines
\n(e.g., ISO\/IEC 3100) with numerous discretions (Jemaa, 2022). Second, operational risk
\nmeasurement heavily relies on expert judgment, and research is largely lacking on what biases
\nrisk specialists are prone to when estimating highly uncertain events (Montibeller &
\nWinterfeldt, 2015; Themsen & Skaerbaek, 2018). Third, quantifying operational risks to
\ncompare them to other risks causes considerable frustrations and hinders their integration with
\nEnterprise Risk Management (Boehm, Laube, & Riek, 2018; Ittner & Oyon, 2020; Mikes &
\nKaplan, 2015; Pollmeier, Bongiovanni & Slapni\u010dar, 2023;). Fourth, organisations seem to have
\ndifferent approaches to the measurement of operational risks, from pragmatic ones, based on
\nqualitative assessments and narratives to idealist, pursuing quantification with statistical and
\nmachine learning approaches (Arena et al., 2010; Mikes, 2009, 2011; Slapni\u010dar et al., 2023). It
\nis not well understood which factors affect the adoption of alternative approaches and how
\neffective they are for risk outcomes. Fifth, the scarcity of studies exploring the behavioural
\naspects of operational risk management further hinders our understanding of how firms design
\nrisk-focused control practices to embed risk considerations in employee decision-making
\n(Posch, 2020) and why risk management failures persist (Meyer, Grisar, & Kuhnert, 2011).
\nLast but not least, temporal dynamics play an essential role (Ahrens & Chapman, 2007; Klein
\n& Reilley, 2021): when risks such as a pandemic, major fraud or natural disasters occur, how
\ndo organisations use traditional management controls such as attainment of budgets and
\nincentivising employees.<\/p>\n