How to Manage the Human Side of Process Risk for Financial Services Organizations

By Jacob Ukelson, ActionBase

In financial services organizations, most business processes are knowledge-intensive human processes.They consist of gathering information, collaborating and negotiating with others, and making decisions -- all of which are fundamentally human activities. Even though analysts use different terms (ad-hoc processes, unstructured processes, human processes; some even use the term case management), all agree that these unstructured, ad-hoc people processes make up between 60 percent and 80 percent of all processes in an organization.

The world over, people use basic office tools (e.g., e-mail, documents) to execute these unstructured processes, but that leaves businesses with no visibility into these processes -- either during execution or upon completion; no IT support for control, management and tracking of these processes; and no way to measure the effectiveness of these processes. This lack of visibility means that 60 to 80 percent of your business processes and their associated risks are not being managed. For example, think of your business' regulatory and compliance processes. These are people-intensive processes that are initiated as a result of an external regulation or investigation (or the threat of one). Think of how many e-mails and documents are generated by these processes. Does your business really know how compliance procedures are being executed? Or where each of the currently running compliance processes stand? Since these processes tend to be ad-hoc and change on a case-by-case basis, people use ad-hoc methods (e.g., documents and e-mail) to deal with them.

These unstructured, ad-hoc, human processes exist at every level of the organization, from the board level to the level of the individual knowledge worker. A real-life example of such a process is the risk management of loans to real estate developers overseas. In this particular scenario, the financial institution made heavy investments in real estate projects overseas, and those projects have reached a point where the developers will be asking for additional funding to enable the projects' completion. Since these now represent large, relatively risky investments and the possibility of external scrutiny of the handling of those deals, the investments were brought to the board's attention. The board requested that the international banking division and the real estate division jointly look into the viability and risk of the projects, taking into account various deal parameters such as the current legal situation of the country involved, the macro-economic outlook, the expected amount of financing that will be requested, the financing sources for the projects, the capital structure of the projects, etc.

Of course, such a deep dive will generate a lot of activity (mostly in e-mail and documents) involving many people throughout different divisions. Since the process is executed via e-mail, the executive owners of the process have no visibility into the process as it is executed. They can delegate sub-processes in e-mail, but have no ability to track and monitor the progress or methodology. This lack of visibility could allow important steps to be missed and follow-ups to be skipped, increasing the possibility that the information is not complete and increasing risk. If the need arose to retrace the steps involved in the decision making, either for external regulators or internal auditors, it would be practically impossible to piece together all of the steps that were taken in response to the board's request.

So how can financial institutions lower the risk related to unstructured processes while not strangling the work of key personnel? How can you prepare for an uncertain regulatory environment? There are a number of technologies to address this need in a way that meets user needs for a flexible and accessible tool, and business needs of process management, tracking and auditability. These tools include e-mail and document-based human process management systems (HPMS), process-aware wikis and collaboration platforms, and next-generation case management tools.

Even though each of those technologies addresses the issues from a different technology perspective, they all support the basic requirements of managing unstructured processes:

Process Aware Collaboration -- Allows the participants in the process to collaborate within the context of a process, but in an ad-hoc way. The process itself is goal oriented and the participants make the decisions on how the process should advance in service of that goal. The collaboration process has a complete history and audit trail - both for audit and process analysis purposes Analytics and Reporting Infrastructure -- Both personal reporting ("Where do I stand with respect to my processes?") and organizational reporting ("Where does my department stand with respect to its processes?"). System of Record Repository -- A repository of all the documents, messages and interactions (either storing them directly, or through links to the organization's document repository) that define the context and trail of the process.

These emerging technologies hold the promise of increased productivity while reducing both the operational risk and the audit risk caused by ad-hoc, unstructured human processes.

Jacob Ukelson is CTO of ActionBase, a New York-based company that provides human process management and action tracking solutions that enable businesses to manage their business critical processes.