Introduction

Financial institutions rely on the effective management of risk. While market and credit risks are well understood as categories of risk and techniques for managing them are relatively well developed, operational risk is a less understood and developed field of risk practice within financial institutions. Even less well understood and clearly defined are those risks related to the records a financial institution relies upon to conduct its business and manage other types of risks. Yet, in many cases it will be necessary for those involved in aspects of managing records to make risk-based decisions – in relation to the type of records that must be retained or the level of control needed to meet legal and regulatory requirements when these are not clearly delineated, in relation to the length of time for which records should be retained, especially in situations where there are conflicting legal or regulatory requirements, or in relation to how to handle records in mergers, acquisitions, divestitures and closures, to cite just a few examples. This chapter offers a guide to the basics of risk-based decision making concerning records and records management for those with little or no previous exposure to risk-management concepts. ‘Points to Ponder’ throughout this chapter are records-specific questions aimed at uncovering common records-related risks.

Records-related risk management relies on principles and practices that are common to the management of most types of risk but has as its particular focus the business records of the financial institution. This chapter defines risk management, outlines its key processes, identifies how to spot records-related risks, explains the steps in setting up a governance framework for a riskmanagement programme and provides tips and hints from the ‘front lines’ of battling records-related risks in global financial institutions.

Like records, risk is defined differently in different contexts. ARMA International, a leading professional association for records and information managers, has issued Evaluating and Mitigating Records and Information Risks (ARMA International, 2009), which draws on ISO/IEC Guide 73 to define risk as ‘the combination of a probability of an event and its consequences’.