About four years ago, Paychex, the world's leading provider of outsourced payroll services to companies, realized it was vulnerable to significant operational risk. In the Paychex world, where more than 561,000 U.S. companies rely on the vendor to manage payroll and related employee benefits transactions and records, operating risk is when the payroll process and supporting services experience interruptions in the intended cycle. Since its operations were contingent on human beings entering appropriate payroll and tax information, the possibility of failed transactions was high.

Moreover, as this data was transmitted from one to another of Paychex' two dozen product systems, such as direct deposit, 401(k) record keeping and Taxpay tax processing services, additional operational risks were introduced. Individuals working in these product areas corrected the original incomplete and/or improper data, creating disjointed reams of information. The consequences for Paychex ranged from miffed clients potentially taking their business elsewhere to expensive tax penalties levied by authorities.

Unfortunately, no specific entity within Paychex was charged with identifying and mitigating the operating risk, with the various personnel responsible for addressing failures splintered across hundreds of departments and branches in the various product areas. The solution was clear–a single centralized department responsible for operational risk mitigation. It took Paychex three years to complete the phasing in of the new entity. "We now have a consistent approach to our operating risk and truly understand the key drivers in this regard," says John M. Morphy, Paychex senior vice president, CFO and secretary.