On 6th & 7th October IIA Norway had invited Mrs . Elena Pykhova at The Op Risk Company to hold a two – day workshop with the above theme for an audience of Nordic risk profeccionals.
By reading this article you will gain insight into the key topics and recommendations that were adressed i this workshop.
The discipline of operational risk management is undergoing a fundamental transformation. Increasing geopolitical uncertainty, technological disruption, artificial intelligence (AI), cyber threats and growing organisational complexity are challenging traditional approaches to identifying, assessing and managing non-financial risks.
The presentations by Mrs. Pykhova and the guest lecture from Owe Lie Bjelland at Corporater covering risk culture, risk and control self-assessments (RCSAs), modernising operational risk management and its future development towards 2030—all highlight a common message: operational risk management must evolve from a predominantly process-driven and compliance-oriented function into an integrated, forward-looking capability that supports strategic decisions, organisational resilience and business performance.
For internal auditors these developments have important implications for evaluating governance, risk management and internal control effectiveness which may be summed up in the 7 recommendations below.
1. Strengthen Risk Culture Through Behaviour and Accountability
An effective risk culture cannot be established through policies, frameworks and formal statements alone. It is reflected in how employees and managers behave when confronted with uncertainty, conflicting objectives and operational pressures.
Mrs. Pykhova recommends applying the 3T Model: Tools, Tone and Traditions.
Risk management tools should support meaningful decisions rather than merely demonstrate procedural compliance. Leadership communication and everyday risk conversations should encourage transparency, constructive challenge and early escalation. Finally, desired behaviours must become embedded in organisational practices, performance measurement and accountability arrangements.
Risk culture should be assessed through observable indicators, including incident reporting timeliness, repeated control failures, remediation effectiveness, management responses and employees’ willingness to raise concerns.
For internal auditors, the implication is that evaluating risk culture requires examining actual management behaviour, incentive structures and decision-making—not simply reviewing documented policies.
2. Redesign RCSAs to Deliver Actionable Risk Intelligence
Traditional RCSAs frequently suffer from excessive documentation, repetitive assessments and insufficient connection to business decisions.
The workshop proposes three improvements, collectively described as the 3R Approach:
- Reduce: Concentrate assessments on material risks rather than generating extensive risk registers.
- Reformulate: Describe actual risk events, distinguishing them from underlying causes, control weaknesses and consequences.
- Reconnect: Integrate assessments with strategic planning, investment decisions, organisational change and resource allocation.
RCSAs should increasingly become dynamic, using operational incidents, Key Risk Indicators (KRIs), control-testing results and emerging threats to trigger reassessments when material changes occur.
Artificial intelligence (AI)-enabled analysis and automated monitoring can improve efficiency, but automation should not perpetuate ineffective methodologies or generate unnecessary assessment activity.
For internal auditors, assurance should focus on whether RCSAs accurately reflect material exposures, support risk-informed decisions and lead to appropriate mitigation—not merely whether assessments have been completed.
3. Integrate Operational Risk Across Organisational Boundaries
Operational risks increasingly cross traditional functional boundaries. Cybersecurity, third-party dependencies, data governance, conduct, business resilience and AI-related exposures are interconnected.
Mrs. Pykhova recommends moving towards a more integrated approach to non-financial risk management through common risk taxonomies, consistent assessment scales, coordinated assurance, shared data and cross-functional collaboration.
Particular emphasis is placed on establishing effective human connections between risk specialists, enabling rapid coordination when significant incidents occur.
Operational risk management should increasingly function as an organisational «risk nerve centre», connecting information across disciplines and translating fragmented risk signals into enterprise-wide intelligence.
Internal auditors should assess whether organisational structures facilitate collaboration, whether material risks fall between functional responsibilities and whether management receives a coherent understanding of aggregated exposures.
4. Make Risk Management Faster, More Forward-Looking and Decision-Oriented
Traditional risk management processes often operate too slowly to support rapidly changing business environments.
Mrs. Pykhova recommends involving risk professionals earlier in strategic initiatives, investments and transformation programmes, rather than primarily at final approval stages.
Risk involvement should be prioritised according to factors such as urgency, novelty, criticality, complexity, scale and reversibility.
Forward-looking risk management should also incorporate scenario analysis, geopolitical developments, emerging threats and continuous monitoring.
During crises, management needs timely assessments and practical advice, even when information is incomplete.
For internal auditors, this requires evaluating whether risk management contributes effectively to strategic planning, change governance, crisis preparedness and operational resilience.
5. Transform Risk Reporting from Information Delivery to Decision Support
Conventional risk reporting often concentrates on heatmaps, indicators and extensive descriptions of existing exposures.
The workshop advocates a more focused approach, addressing four essential questions:
- What has materially changed?
- Which exposures require management attention?
- What decisions or interventions are necessary?
- What is the independent risk function’s professional assessment?
Risk reporting should explicitly connect exposures to risk appetite, business objectives, resource allocation and management actions.
For internal auditors, reporting effectiveness should be evaluated according to the quality of insights generated and decisions influenced, rather than reporting frequency or documentation volume.
6. Exploit AI While Strengthening Governance and Human Judgement
AI represents both a major opportunity and an emerging source of operational risk.
Advanced analytics, continuous monitoring and automated control testing can substantially improve risk identification and assessment efficiency.
However, generative and agentic AI introduce additional challenges involving accountability, data protection, model reliability, unauthorised applications and autonomous decision-making.
Mrs. Pykhova therefore recommends combining technological innovation with stronger governance, appropriate controls and workforce development.
Human capabilities—including professional scepticism, curiosity, judgement, communication, influence and ethical courage—will become increasingly important as routine administrative activities are automated.
For internal auditors, this creates opportunities to evaluate AI governance, automated controls and the effectiveness of human oversight.
7. Measure Success Through Business Outcomes Rather Than Activities
Mrs. Pykhova’s overarching recommendation is to redefine the value proposition of operational risk management.
Success should increasingly be measured through better decisions, improved resilience, safer organisational change, stronger performance and greater stakeholder trust.
Risk functions should systematically simplify low-value activities, redirect resources towards emerging priorities and evaluate whether their services justify the effort required from business units.
For internal auditors, this reinforces the importance of assessing not only the design and operating effectiveness of risk management processes, but also their contribution to organisational objectives.
Conclusion: Implications for the Internal Audit Profession
The above recommendations describe a transition towards integrated, technology-enabled and strategically relevant operational risk management.
By 2030, operational risk functions may increasingly operate as enterprise-wide centres of non-financial risk intelligence, supported by AI and characterised by stronger cross-functional integration.
For internal auditors, the central challenge is to provide independent assurance that this transformation delivers genuine improvements in governance, risk-informed decision-making and organisational resilience.
The future effectiveness of operational risk management will depend not simply on more sophisticated systems, but on combining technological capabilities with sound professional judgement, organisational accountability and effective leadership.
Guest lecture: The Governance, Performance, Risk and Compliance (GPRC) matrix.
The above recommendations are well aligned with the GPRC matrix which was introduced by Owe Lie Bjelland at Corporater.
GPRC is aframework for the governance, management and assurance of an organsiation’s performance, risk and compliance.It is thus not a competitor to GRC, but is rather honouring and augmenting the GRC framework as it is illustrated in the figure below:
Mrs. Elena Pykhova book on operational risk is readily available in book stores: Operational Risk Management in Financial Services – A Practical Guide to Establishing Effective Solutions
