Mastering Risk Loss Incidents

Bazzi Consulting’s Learnings

When a risk incident occurs—be it operational failure, third-party disruption, or a cybersecurity breach, the immediate response is often hampered by siloed communication and disparate tools. For example, during a major payments processing failure at a European bank we advised, the Risk team logged the incident in one system, Legal tracked potential exposures in another, and IT managed the technical remediation separately. This lack of synchronization delayed the response, obscured the full impact, and complicated regulatory reporting.

Academic research underscores this systemic issue. As Power (2016) notes, the operational risk landscape is often characterized by „coordinated fragmentation,“ where organizational structures inadvertently hinder a unified response. This aligns precisely with what we observe in practice.

Our Approach: Building Cohesion with ServiceNow

At Bazzi Consulting, we leverage ServiceNow’s Risk Management not as a simple logging tool, but as a central orchestration hub. Our implementation philosophy is built on four pillars:

1. Unified Stakeholder Engagement: We establish a cross-functional governance model from day one. By mapping all stakeholders to a single workflow in ServiceNow, we create a shared source of truth. This was pivotal for a client facing complex third-party vendor failures, ensuring Procurement, Risk, and Business Continuity teams acted on the same data in real time.
2. Configuring for Clarity, Not Over-Customizing: The allure of excessive customization is a major pitfall. We prioritize ServiceNow’s Out-of-the-Box (OOTB) functionality, especially for critical calculations like gross loss (actual financial impact) and expected loss (probable future exposure). This ensures transparency, reduces maintenance debt, and guarantees upgrade compatibility. Our rule is simple: customize only when it provides definitive competitive or compliance advantage.
3. Granular, Role-Based Access Control: Effective coordination requires the right people to have the right information. We design precise access roles that allow department heads to see end-to-end processes while restricting sensitive financial or customer data as needed. This balances transparency with security and compliance.
4. Automated Workflows for Seamless Handoffs: We automate task assignments and escalations between departments. When Legal completes its assessment, the workflow automatically notifies Finance to provision a reserve. This removes manual handoffs, reduces delay, and creates an auditable trail.

A Real-World Application: The Trade Settlement Incident

For a global investment bank, a settlement failure risked significant financial loss and regulatory scrutiny. Our implemented ServiceNow solution enabled:

• Unified Logging: The incident was logged once, immediately notifying Market Risk, Operations, and Compliance.
• Parallel Action Streams: While Operations worked on the technical fix, Legal began assessing contractual liabilities, and Finance calculated the preliminary loss amount—all within linked records in the same platform.
• OOTB Loss Calculation: The platform’s built-in modules aggregated costs (fines, rebates, labor) to provide a real-time, consensus view of gross loss, eliminating debate over spreadsheets.
• Automated Reporting: A consolidated report for regulators was generated automatically from the gathered data, saving dozens of manual hours.

The result was a 40% faster incident resolution and a fully auditable, compliant process that satisfied both internal auditors and regulators.

Lessons Learned for the Industry

Our deep expertise confirms that technology alone is not the solution. The key learnings we integrate into every project are:

• Process First, Platform Second: Align departments on a common process before configuring a single field in ServiceNow.
• Governance is Non-Negotiable: A designated process owner with authority across departments is essential to break silos.
• Leverage OOTB Intelligence: Trust the platform’s native capabilities for core functions like loss calculation to ensure stability and clarity.
• Design for the Auditor: Every workflow should be built with the end goal of providing clear, concise evidence for internal audit and regulators like the ECB, FINMA or BaFin.

Managing risk loss incidents effectively is less about managing the risk itself and more about managing the organizational response to it. Success lies in transforming departmental coordination from a recurring challenge into a structured, automated strength.

At Bazzi Consulting, we turn this complexity into clarity. Our certified expertise in ServiceNow IRM, combined with our real-world risk experience, enables us to implement solutions that are not just technically sound, but operationally brilliant.

Facing similar coordination challenges in your risk or compliance processes? Let’s discuss how to build a more resilient, coordinated response.
Contact Bazzi Consulting today.

References

Power, M. (2016). Riskwork: Essays on the Organizational Life of Risk Management. Oxford University Press.

European Banking Authority. (2023). Guidelines on Incident Reporting under ICT Risk Management. Available at: https://www.eba.europa.eu

ServiceNow. (2024). Now Platform: Risk Management. Available at: https://www.servicenow.com/products/risk-management.html