Operational Risk Management Using Multi-Criteria Assessment (AHP Model)

Decision making and management are synonyms. Banks are facing a number of business risks and operational risk is prevalent. Risk management is related to making decisions; therefore, it is important for the whole organization. The aim of this paper is to develop a decision-making system when choosing the method of operational risk management by using the Analytical Hierarchical Process (AHP). AHP is an efficient process in solving decision-making problems. The final decision depends on the evaluation of a set of alternatives and decision criteria. Therefore, AHP defines the criteria related to operational risk and the alternatives that the bank management can undertake in order to successfully manage operational risk. The main purpose of the process is to find appropriate solutions for defined user factors in the current competitive environment. The results, obtained by the classical numerical method show that External Factors is the dominant criterion, especially during the financial crisis or the Covid pandemic, and that solutions should be sought in international standards along with using the control tools created by banks themselves.


INTRODUCTION
While the banks are focused on financial risk management systems such as credit risk, foreign exchange risk, interest rate risk, market risk, recently, they have started facing a problem regarding operational risk. Although operational risk is not a recent one, with the outbreak of the global financial crisis in 2008, it has become a dominant risk in banking. Up to now, the losses of the entire financial sector due to operational risk have been increasing steadily and are estimated at billions of dollars [14]. The negative results of the banks have been largely affecting their balance sheets as well. Disorders of financial flows have spilled over into commodity flows, which consequently brought the whole world into great financial uncertainty. Operational risk is the risk that arises as the result of failures in the work of employees, inadequate procedures and processes in a bank, inadequate information management and other systems in a bank, as well as due to unforeseen external events (terrorism, crime, natural disasters, pandemics, cyber-attacks, crises). This risk negatively affects financial results and the capital of a bank to a greater extent than it might have seemed at first glance when analysing economic, quantitative indicators of banks, such as ROE, ROA, assets, etc.
Operational risk management implies managing the organization of work and operations, human resources and technical support in a bank while respecting high standards, applicable regulations, and the adopted business practice. Globally, the financial sector is facing the problem since there is no standard framework for operational risk management. Each financial institution should form a specific framework appropriate to its operating environment. It does not necessarily have to meet the Basel Criteria entirely, but it should reflect the culture of operational risk behaviour and operational risk management. Within this framework, the procedures should be defined and the guidelines designed regarding risk measuring and self-assessment, and need to test the effectiveness of the conducted control. The management ought to provide appropriate information and submit it in a timely manner and in an appropriate format for risk analysis. The purpose of multi-criteria assessment, in the AHP model, is that a bank precisely defines the problem-operational risk identification. This is followed by operational risk assessment-the extent of the risk, the manner and the cost by which such risks can be mitigated; and the assessment whether the acceptance of the residual risk is consistent with the bank's strategy. Finally, when there is operational risk, bankers should strengthen their defence against operational risk by investing appropriately in technology, data, and analytics. The preparation of control and monitoring, such as stress tests and/or recovery planning, is also crucial.
Several years ago, we closely monitored and analysed the operations of the same banks in different economic conditions, i.e. states. The emphasis was mainly on quantitatively measurable indicators of the banks' operations. We analysed their market share, capital volume, asset structure, ROA, ROE, foreign exchange gains/losses, the application of the currency clause, and a number of other indicators [12]. In the paper, this focus is on the analysis of the operational risk of the banks from the environment, and the decision of the banks how to manage operational risk in accordance with the criteria and alternatives.
The structure of the paper is as follows. After the introductory part, Section II presents, in brief, operational risk. Section III provides an explanation of the AHP model, along with a literature review. The methodology is presented in detail in Section IV along with the modelling of decision problems. Section V presents the results of the research in which the solutions are presented as the final decisions of the banks' management in the process of operational risk management. The last section offers concluding remarks.

OPERATIONAL RISK
International standards, viewed through the spectrum of Basel II standards, place emphasis regarding banking operations on the analysis of the effects of operational risk. The standards unequivocally state that operational risks along with credit and market risks present the basis for determining bank's total risk. The Basel Committee defines operational risk as "the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events". It could be said that this is the definition of operational risk in a broader sense since it covers numerous non-financial risks, including fraud, cyber, suppliers, behaviour, privacy, illegal trading, information security, etc. The Committee singles out specific principles for operational risk management in line with healthcare industry practice [2].
Modern banking has shown that operational risk should take an important place in the risk management agenda of banks. Losses are significant, and future risks are increasing. Therefore, it is not surprising that supervisors require banks to bring operational risk under control and improve operational risk management methods. The experience shows that banks are ready to improve risk management. Most of them have already taken action in this direction with positive outcomes and results.
Modern banking flows accompanied by numerous crises, unstable financial markets and constant political pressures have directed the old perceptions and behaviour towards the risk to changes. In fact, they have been constantly changing, but to a greater extent in the last decade. Over the last years rising costs, as the result of the greater impact of operational risk, have made bank management concerned about operational risk management. Outdated operational risk management systems are being replaced by a new risk management methodology along with new sophisticated operational risk management systems.
It is crucial that banks develop an effective operational risk management framework with which organizational goals and superior performance can be achieved. For example, adequate operational risk management can accelerate the development of new initiatives. Simultaneously, international standards impose a new dimension. Through the Capital Accord, the Basel Committee imposed the obligation to banks to allocate regulatory capital for development, which specifies the minimum level of required capital for regulatory measures. The Supervisory Committee emphasizes the need to calculate the capital based on its own risk management techniques in banking activities. This strengthens the practice of operational risk management within a competitive environment.
The Basel Committee provides the guidelines indicating the precautionary measures that banks should take. At the same time, regulatory guidelines for states are taken as recommendations, which the economy has to/can follow. Therefore, risk and capital management present the basis for improving the growth and profitability of banks or financial institutions. The regulatory defined amount of the required capital that banks need to have should not be viewed as a requirement, but as a basis for improving risk management practices. Banks invest significant resources in improving their internal risk processes, data infrastructure, and analytical capabilities.
Basically, banks are recommended to manage operational risk management in stages as well. Adequate preventive activities can significantly reduce the impact of external and internal factors, but also mitigate the negative effects that operational risk causes. Planned activities should be conducted within the framework of banks' behaviour model in the situation of operational risk. In the second phase, the operational risk identification phase, it is necessary to set adequate operational risk recognition indicators. It is necessary to timely identify operational risk and intervene with adequate tools (depending on the banking product, users of banking services, and third parties) to mitigate the negative effects and consequences on the bank's operations. The last phase, which is timelimited, implies the implementation of the activities aimed at mitigating and reducing the risk of banks' behaviour. It is essential to act quickly, with adequate measures and instruments, since we are talking about the phase in which it is evident that a risk with negative consequences has occurred. During all the phases, it is necessary to maintain control and perform the audit of operational risk assessment in accordance with the risk framework, complying with the regulations and internal audit reports.

ABOUT THE AHP MODEL
Although the most important measures for assessing the sustainability of financial institutions are considered to be financial measures, the paper will now focus on other, indirect effects on banks' financial results. Based on the use of multiple criteria analysis, a framework will be proposed through which potential criteria for assessing the existence of operational risk and alternatives for operational risk management will be selected. The essence of the AHP model is reflected in a greater degree of objectivity, which reduces the importance of making decisions based on subjective feeling. It is effectively applicable in complex situations and simplifies the decision-making process.
Numerous analytical processes and systems are used for making decisions within organizations. Furthermore, by using multi-criteria models Zopounidis and Doumpos [22,23], Steuer and Na [21], Spronk et al. [20], Nasrallah and Kavasmeh [13] provide the support for making decisions within the banking sector -financial planning, bankruptcy assessment, credit risk assessment, stock classification, the choice of financial instruments, bank/banking product rating, interest rate choice, business risk analysis, etc. Moreover, the AHP model is one of the most commonly used multi-criteria decision making models. It is designed to solve complex problems with multiple criteria. It allows individuals or teams to make good assessment of isolated problems within organizations. While doing so, the technique of the AHP model for organizing and analysing complex decisions is based on the combined application of mathematics and psychology. It is widely used in group decision-making and in various decision-making situations (industry, business, health, employment, job creation, education, etc.).
Recently, the use of various methods of job evaluation has been growing. Saaty's AHP model, which is used to solve problems with multiple decision-making criteria, has been increasingly in use [16]. The basis of the model is to make the best decision according to the set criteria. The application of the model is widespread and exists in almost all branches of the economy.
Basically, the AHP model is realized through three steps. Firstly, a hierarchical structure of the problem is created. Afterwards, a pairwise comparison between the elements/alternative decisions is made. Finally, the synthesis of priorities is conducted [17]. The structure of the model consists of a general problem, a group of options or alternatives for achieving the goal, and a group of factors or criteria that connects the alternatives with the goal. A deeper analysis is also possible when the criteria are divided into sub-criteria at as many levels as the problem requires. The advantage of the AHP model is that it can be designed depending on the existing problem, as well as on the knowledge, assessments, values, opinions, needs, or desires of participants in the decision-making process [9]. According to Leung et al. [10], the advantage of the AHP model is reflected in the fact that it can be easily adapted to specific situations, overcoming some traditional problems of subjective versus objective measures.
Thus, Spyridakos [19] conducted a multi-criteria evaluation of jobs in a large company, and Dagdeviren [4] used AHP to evaluate various jobs in the power industry, while Erarslan et al. al. [5] used it for job evaluation in a steel company. In the field of finance, Butterworth [3] used the multiple-decision model when making a decision to relocate the bank's headquarters. Kauko [8] suggested the use of the AHP model to rank bank's location attributes, while Bergendahl and Lindblom [1] pointed to the importance of the model when considering locating a bank according to its business activity. Kyaw and Kyi [9] used the AHP model as a useful tool for job-seeking, developing a decision-making system for a job-seeking process. The application of the AHP model in health care, an effective tool to support decision-making in this field, was demonstrated by Schmidt et al [18] and Liberatore et al. [11]. Jurik and Sakal [7] used the AHP model in the field of human resource management, where they used this method for employee selection as well as assessment and competencies of managers.

METHODOLOGY
Analytical hierarchical processes (AHP model) have been used for almost five decades in multi-criteria decision-making tasks. It has been applied in the decisionmaking process on complex problems and tasks that exist when organizing activities within the company. The AHP methodology was created by an American mathematician Saaty [15] and ever since has been effectively applied in a number of areas of society. We can almost say that the method has become the most used decision-making method. (We have listed a number of scientific papers and researches below).
Within the hierarchical structure of the AHP model until the final result and the right outcome for decisionmaking, it is necessary to start by pairwise comparison of the elements and evaluation of their mutual significance. For this purpose, Tab. 1 lists the scale of relative importance first created by Saaty in his methodology: Intermediate values Source: Saaty [15] The application of this scale is a key tool in the decision-making process, as it provides a greater number of possibilities. In this way, through the analysis of the elements (criteria and alternatives) within the hierarchical structure of the AHP model of pairwise comparison, it compensates for the existence of potential decision makers' uncertainty. Actually, uncertainty is reduced due to minor changes in decision makers' assessments. The obtained values, in the following iteration, form the elements of the corresponding comparison matrix (matrix A). In order to obtain each element of the matrix (a ij ) we use Saaty's scale of comparison of elements in pairs of two consecutive hierarchical levels, for example a lower hierarchical level with the first higher one. The measures of this comparison are indicators of the importance of the element i and j, where i = 1, 2, ..., n and j = 1, 2, ..., n.
Methodologically, the structure of the AHP model is based on a hierarchical network used in the decisionmaking process. The model consists of three or more hierarchical levels, depending on the purpose of the analysis. In Fig. 1, we present them as goals, criteria, and alternatives. As a rule, the goal is at the top of the hierarchical network. The rule is not to compare the goal with the other elements in the hierarchical structure. The comparison starts at the first structural level, i.e. with criteria. Pairwise comparisons are performed by comparing the first element with an element at a successively higher level. By comparing pairs, alternatives are evaluated, comparing each of them. In this way, a hierarchical network of problems is created. At the same time, we use this network to define solutions to problems. Respecting the mathematical rules and the order in the mathematical sequence, the values thus obtained create a matrix. The matrix is filled so that the diagonal takes the value 1. Then the values above the diagonal (top left) and their reciprocal values below the diagonal (bottom right) are entered. Comparative comparison of elements is performed using the eigenvalue method, which determines the weight vectors of the entered elements through a linear system: where A is the matrix (the dimension n × n), λ is the eigenvalue,  is the eigenvalue vector, T is a period, and e is the unit vector. The next step involves the application of a distribution model of aggregation, which allows the synthesis of local priority vectors [12]. Then, the consistency of the obtained vector values is examined. After that, the degree of consistency is calculated and the consistency of the obtained grade is checked using the CR parameter, for which the limit value is defined at 0.1 level. In case the degree of consistency is higher than 0.1, it is necessary to repeat the entire assessment evaluation of the vector in the matrix. In other words, the comparison by the method of eigenvalues is repeated. The final values of the consistency index are ranked and thus a solution to the decision problem is obtained.

The Hierarchical Structure of the AHP Model
In general, the AHP model is designed to allow both individual and group decision making. The whole process of analysing the problem of decision-making is realized through several hierarchical levels. The most commonly used structure of the AHP model is presented in Fig. 1.
Modelling in the AHP model begins with the creation of an overall hierarchical structure. The first step is to define the problem. Then all the elements of two consecutive levels of hierarchy (elements of the lower with the elements of the higher level of hierarchy) are compared. In our example, operational risk is a problem faced by the banking sector. Therefore, we have placed it at the top of a hierarchically structured decision-making model, i.e. AHP model. The question is how to manage operational risk? In accordance with the set problem of the AHP model, the criteria are defined which clearly identify the problem, i.e. operational risk. The following criteria were singled out: C 1 -Inadequate Infrastructure, C 2 -Human Resources, C 3 -External Factors, and C 4 -System Events. The results are obtained from several predetermined alternatives which represent the options for solving the problem: A 1 -Technology, Data and Analytics, A 2 -Supervision Elements, and A 3 -International Standards. The final decision is made on the basis of the highest rank, and that is the best solution to the defined problem. Good operational risk management implies an adequate framework in which banks can identify, measure, and mitigate operational risk. In this way, the following things are measured, such as how much the bank is prone to risk, the bank's responsibility; afterwards special plans for managing the bank's operational risk are developed. The bank's propensity to operational risk should be low. It is not easy to identify and understand operational risk (behaviour, fraud, cyber, external factors, etc.). Therefore, we define adequate criteria based on which we can measure the harmful consequences for the reputation, liquidity, and the bank's capital. Solutions should be sought through the best alternative, through precisely defined technology, data and analytics, as well as through international standards and independent banking tools [6].
It is important to emphasize that the bank management should not view operational risk through the regulatory framework, but through a hierarchical structure within which all operational risk criteria and solutions for operational risk management will be analysed. This provides the space to improve the competitiveness and performance of the bank. Otherwise, operational risk management will be made more difficult and the business operation costs more!

RESULTS OF THE APPLICATION OF THE AHP MODEL
The evaluation of the criteria and alternatives was conducted by two experts in the field of economics, banking and finance, professors and lecturers, with relevant references in this field. For a wider research, other experts could be included, such as the ones covering other indicators related to the education of service users, digitalization of banking operations, as well as broader social aspect of employees. Representatives of financial associations, NGOs and business people could also contribute to a better decision-making process.
Firstly, the analysis was initiated by defining a goal. With such a defined goal, according to the AHP model, the decision makers compared the criteria with the set goal. By defining the criteria, they also defined the alternatives within the hierarchical structure of the model. To select the best means/tools for operational risk management, the comparison of 3 alternatives was conducted, based on 4 criteria. The next phase regarding the choice of means/tools for managing the application of the AHP model was the development of the hierarchy of the problem. The evaluation of the criteria was the next step, within which the above-mentioned Saaty's nine-point scale was applied. The aim of the evaluation criteria is to define the weighting coefficients required to assess performance, methods or tools for operational risk management. The next is the fifth phase, in which we use the criteria to evaluate all alternatives. In other words, each of the 3 alternatives was evaluated based on 4 decision criteria. Thus, each alternative gained its own value. In the final phase, a decision and the choice of alternatives were made. The final phase is crucial and gives us the decision and choice of the best option. The alternative with the highest degree of value is the most favourable solution for the bank in the process of operational risk management.
The decision makers had the task to single out the criteria, then, using the Saati scale, make a pairwise comparison of the criteria with the set goal, and then to compare the pairs of alternatives with each criterion. Tab. 2 shows that the most important criterion for the banking sector is External Factors, followed by Human Factors, and, finally, two criteria with the same weight vector, Inadequate Infrastructure and Systemic Events. Pairwise comparison of the criteria within the matrix was performed. When determining the value of the criteria, errors in drawing conclusions are possible. Therefore, an assessment of the extent of deviation from the consistency was undertaken. After calculating the maximum value of the comparison matrix, λ max = 4.15, the consistency index (CI = 0.06) and the degree of consistency (CR = 0.05) were assessed. The estimated value of the consistency index was less than 0.1. When we compare the obtained value with the limit value, we see that it is lower, which leads us to the conclusion that the matrix is set correctly. In the next step, the evaluation of alternatives was performed according to the set criteria, i.e. the evaluation of alternatives for each criterion separately. Tab. 3 shows the comparison matrices for all alternatives according to the set criteria, with the corresponding weight vectors.
Methodologically, the structural network of the AHP model implies that the priority of the criteria according to the set problem is first calculated; then the priority of alternatives for the stated criteria is calculated; finally, the priorities of alternatives according to a given problem can be calculated. The result of these calculations is computed weights for each level. The end of the procedure implies the implementation of a comprehensive synthesis of the problem of choice. In the last step, all results were ranked according to the size of the computed weight, which provided a solution for the best choice and decisionmaking by the bank in terms of operational risk management (Tab. 4). The alternative with the highest total weight received the highest value in the rank. Simultaneously, it was the final decision, that is, selecting the optimal way to manage operational risk.  4), in the last field (grey background) the sum of all values of alternatives (last column) is given, which corresponds to the sum of all values of the criteria (last row), and it is identical and equal to 1. At the same time, it was a confirmation that the procedure was methodologically accurate and correct.
The final decision indicates that the acceptance of international standards and the application of adequate tools in identifying, mitigating and most importantly eliminating of external operational risk factors are crucial for operational risk management in the banking sector. Nowadays, external factors, such as terrorism and criminal activity, natural disasters, economic crises, migration, pandemics, or cyber-attacks have the greatest impact on the occurrence and existence of operational risk, increasing the negative effects on the business results of the banking sector. In modern circumstances, when the influence of these factors is frequent, and very similar, the solution should be sought in internationally valid standards. This implies a change in regulations, application of accounting and other standards in accordance with the flows in banking operations and measures that should be made in operational risk management. The latter also refers to the recommendations that international institutions give to states and banks. The recommendations insist on creating your own tools, such as stress tests, early warning indicators, etc. Particular emphasis is placed on the need to plan recovery and solving of problems, then define the time for the implementation of all actions, as well as improving risk forecasting matrix. By including additional criteria and alternatives, it would be possible to examine bank operations in more detail in the conditions of the growing impact of operational risk with all negative consequences for banks.

CONCLUDING REMARKS
In this paper we have shown that the bank's management can reach the best solution in the process of operational risk management by applying the AHP model, as a model of multi-criteria decision-making. It has been once again confirmed that the AHP model is a useful tool in solving the problem of multi-criteria decision making. Respecting the methodological concept and rules for the introduction of separate attitudes of decision makers, different types of importance of the selected criteria for the selection of operational risk indicators are ranked. The structure of the AHP model also provides the possibility for a more detailed analysis of the selected criteria, within which a more comprehensive analysis of all sub-criteria can be conducted.
The paper precisely defines the criteria and alternatives within the structural network of the AHP model. The criteria are evaluated in relation to the defined goal, and in the next iteration the alternatives are evaluated in relation to the selected criteria. All calculated criterion weight vectors and alternative weight vectors are within the limit values. They are shown through the created square matrices. The final ranks are obtained based on the height of weight vectors. Finally, the ranks allow a final decision to be made. The paper results have proved that the best ranked is the external factor indicator, and that the key solution is in international standards and recommendations for the development of own tools in the process of operational risk management.
We can conclude that operational risk deserves an important place in the risk management system of banks or any financial institutions. Although it does not directly affect banks' financial indicators, it indirectly leads to huge losses. The nature of operational risk is influenced by numerous external and internal factors with great financial consequences in the long run. We have also seen that there is a strict control due to regulations and international standards imposed on states, both by supervisors and because of the demands of investors in the financial sector.