Article by: Otto Acuna N. MBA, CMC, CSSBB 🇨🇷 🇪🇪 - Originally published on LinkedIn on March 27, 2025 (in Spanish).
Banks and financial institutions in Central America, especially in Costa Rica, face the challenge of managing operational risk in highly regulated environments without drowning in bureaucracy. Recently, Costa Rica's General Superintendent of Financial Institutions, Hazel Valverde, warned that “too much [regulation] has been issued in recent years,” driven by commitments to the OECD and the IMF, and called for evaluating the effectiveness of what already exists before adding more controls. In this context, ISO 31000 stands out as an agile and adaptable reference framework for operational risk management, able to meet regulatory requirements efficiently and well suited to mid-sized institutions.
ISO 31000 vs COSO: adaptability and less bureaucracy
Both ISO 31000 and the COSO ERM framework are widely used in risk management, but there are key differences in their approach and application:
- Flexibility and a principles-based approach: ISO 31000 is a relatively concise standard, flexible and centered on a few fundamental principles
- Lower bureaucratic burden: The directness of ISO 31000 makes it easy to apply without generating excess documentation. By focusing on the essentials (identifying, assessing, treating and monitoring risks), it avoids a proliferation of unnecessary reports and controls. Its closeness to the Deming Cycle as the mechanism for addressing the risks found (PDCA) also helps align risk management with continuous improvement. By contrast, implementing COSO in full can be heavier in terms of policies, matrices and reports, something that consumes resources and time. In fact, experts point out that COSO, for all its conceptual value, “is not a ready-to-use risk framework” given its length and level of detail.
- Effectiveness in regulated environments: In strictly supervised contexts (such as banking), ISO 31000 has the advantage of integrating easily with existing regulations. Its guidelines are compatible with regulatory frameworks such as Basel, making it possible to meet requirements (e.g., operational capital or risk reporting) without duplicating structures. COSO, originally conceived for internal control and later extended to ERM, may require additional mapping to align with regulatory categories, which adds complexity. The principles-based approach of ISO 31000 fits better with the current trend among regulators toward a proportional, risk-based approach that avoids one-size-fits-all recipes.
- Applicability in mid-sized institutions: Many Central American financial institutions are mid-sized or cooperatives; they need frameworks that are robust yet accessible. Because it is adaptable, ISO 31000 is scalable: a mid-sized bank can apply the same principles as a global bank, adjusting the depth to its own reality. COSO, although applicable to any company, tends to be adopted by larger corporations with specialized risk areas. Experience shows that a lightweight framework such as ISO 31000 makes it easier to adopt good practices without heavy bureaucratic structures, which is critical for organizations with limited resources.
The Costa Rican context: smart regulation and SUGEF's vision
In Costa Rica, the supervisor (SUGEF) has issued numerous regulations in recent years to strengthen the financial system, partly in line with international standards. Between 2022 and 2024, reforms aligned with the OECD and the IMF were introduced.
However, the new Superintendent, Hazel Valverde, in her first interview in the role with the newspaper El Financiero [https://shorturl.at/hg6z2], stresses that it is time to consolidate and simplify, not to keep adding regulatory layers. Her stance of “less regulation, more evaluation” reflects the need for financial institutions not to “drown in controls”, but to develop agile and effective mechanisms for managing operational risk.
Valverde has suggested reviewing and fine-tuning the existing rules to make sure they address the underlying problem and not just the symptom. She also advocates faster, more flexible processes for handling critical situations, and using technology to have real-time information and detect problems early.
In our view, and from the "trenches" of EXYGE.COM, given our focus on helping organizations work better, all of this converges with the strengths of ISO 31000: a framework that prioritizes integrating risk management into everyday decision-making, with an emphasis on organizational culture and agility, rather than treating risk management as a mere compliance exercise.
Adopting ISO 31000 as a reference would allow banks in Costa Rica and the region to standardize their operational risk management in a practical way, complying with SUGEF and other regulators while avoiding documentation overload. The standard guides institutions to define their context, risk appetite and internal control processes proportionally. This is especially relevant for mid-sized institutions: instead of putting complex structures in place, they can show the Superintendency that they manage their risks effectively through policies and processes aligned with ISO 31000, focused on preventing losses and ensuring business continuity.
International momentum toward flexible, effective frameworks
The move toward risk management frameworks that are more flexible, principles-based and proportional is not just a local issue; it is an international trend backed by multilateral bodies:
- International Monetary Fund (IMF) and OECD: In their assessments and guidelines, they have encouraged both supervisors and institutions to adopt more dynamic approaches to risk management. For example, recent updates to the core principles for banking supervision explicitly advocate principles-based approaches to supervision and risk management in banks
- Basel and other financial standards: The Basel Committee has simplified its operational risk approaches (eliminating overly complex capital calculation methods) and stresses that each bank must have a comprehensive risk management framework suited to its profile. This is in line with ISO 31000, which provides a structure each institution can tailor. In fact, Basel's Core Principles for Effective Banking Supervision insist on the need for robust risk frameworks while also recognizing the heterogeneity of banks, allowing implementation on a “basis… proportionate to [the bank’s] risk profile and systemic importance”
- Other multilateral bodies: Institutions such as the World Bank, the IDB and regional regulators have also echoed these ideas in forums and guidance. The emphasis is on moving from “checkbox compliance” toward managing risks effectively. For example, for emerging topics such as climate risk or cybersecurity, agile frameworks that can quickly take on new types of risk are recommended. ISO 31000, with its periodic updates and generic nature, offers that versatility to integrate emerging risks (ESG, technology risks, etc.) without having to rewrite the whole system.
In short, in our view, adopting ISO 31000 in the region would not be a leap into the unknown but rather a way of aligning with current international best practice. Regulators will keep demanding rigor, but they increasingly value that rigor coming from processes well integrated into management, rather than from stacks of manuals.
Digital transformation and AI: complements to the ISO 31000 framework
Modern risk management cannot do without technology. Digital transformation and tools such as artificial intelligence (AI) have become natural allies of risk frameworks, boosting their effectiveness. Because ISO 31000 is methodologically open, it can be complemented perfectly with digital solutions to take operational risk management to a new level:
- Smart risk identification: The first stage of the ISO 31000 process is identifying risks, and this is where AI can make a difference. Today it is possible to scan large volumes of internal and external data (transactions, operating records, news, social media) to detect early risk signals that the human eye might miss
- Real-time analysis and monitoring: Traditionally, assessing and monitoring risks was a periodic exercise (e.g., monthly reports). With digital tools, it becomes continuous and real-time. AI can model complex risk scenarios and predict potential consequences quickly
- Optimized risk treatment: Once risks have been identified and assessed, action follows. AI can also help here by suggesting optimal treatments or controls based on historical data and best practices. Imagine an intelligent system that, on detecting a recurring operational risk, automatically proposes preventive measures (for example, duplicating a certain validation in a process, or targeted training for staff in a problem area) by comparing with solutions that worked in other subsidiaries or in the industry. This complements the decisions of risk managers, who remain in charge, but now with powerful support tools.
- Custom AI with internal data: It is important to note that the benefits come from feeding these algorithms with the institution's own internal data, respecting privacy while making the most of the institution's own information. An AI model trained on the bank's historical operational incidents, its transactions and even its internal audit records can tailor risk detection to that institution's reality (it is not a “generic AI,” but one made to measure). This creates a kind of “risk intelligence” of its own for each institution, working in synergy with the ISO 31000 structure. In practice, the standard asks for criteria to be set and the environment to be monitored; AI helps do this more thoroughly and quickly than any team could manually.
Of course, implementing these technologies brings challenges (data quality, costs, staff training), but many mid-sized banks are finding cost-effective ways, such as secure cloud services, AI running in internal private clouds or affordable specialized tools, to bring AI into their risk areas. The result is an operational risk management system that is more agile, predictive and effective, one that meets the principles of ISO 31000 while extending its reach. For a CEO, this translates into peace of mind: fewer unpleasant surprises and more control over operational uncertainty.
Reflection: toward more agile and effective operational risk management
At EXYGE.COM we have spent years helping our clients work better through robust methodologies, our own and third-party ones such as ISO 31000; best practices that lead to efficiency, operational transparency and control; and the practical application of state-of-the-art technology, for example fully customized, secure AI models that can even run internally "on-premise", following the agreement with our latest technology partner, TheDiscoveryAI.
In the competitive and challenging Central American financial environment, adopting ISO 31000 as the reference framework for operational risk management offers clear strategic advantages. Compared with more rigid traditional approaches that can overload organizations with bureaucracy, ISO 31000 provides a solid yet flexible structure that:
- Satisfies regulators: It demonstrates alignment with international best practice and with the spirit of local rules, focusing on the real effectiveness of controls and not just on paperwork. This responds directly to SUGEF's call for institutions that manage risk with agility, without drowning in rules
- Drives efficiency and internal culture: By becoming part of strategy and daily operations, risk management stops being an isolated exercise and becomes part of the institution's DNA. Employees better understand the risks and their role in controlling them, which fosters a proactive culture. The lightweight ISO 31000 framework makes this cross-functional understanding easier, unlike more complex frameworks that are often fully understood only by the risk area.
- Is proportional to the size of the institution: A mid-sized bank or cooperative can implement ISO 31000 without creating new departments or investing exorbitant resources. Existing structures can be leveraged and optimized. By contrast, very heavy frameworks can be impractical or costly to maintain for smaller players. The proportionality of ISO 31000 allows the risk system to grow as the institution grows, step by step and sustainably
- Complements innovation: As digital transformation advances, ISO 31000 serves as the backbone for adding new tools without losing direction. Whether it is integrating AI for real-time monitoring or adapting the framework to new risks (such as cyber-operational or climate risks), the standard is flexible enough to accommodate them. In a world where risks change quickly, this adaptability is pure gold.
“We manage risk to the highest standards, effectively and without paralyzing our business.”
Looking ahead, ISO 31000 offers CEOs and other key players in the financial sector a clear, pragmatic and globally recognized roadmap for taking operational risk management to the next level. Adopting this framework in Central America's financial institutions, with special emphasis on Costa Rica given the events of recent months, where the regulatory conversation already points to agility and effectiveness, means gaining resilience and competitiveness. It is about being able to say: “We manage risk to the highest standards, effectively and without paralyzing our business.”
Institutions that embrace this model will be better prepared to face uncertainty, achieve their strategic objectives and build trust with regulators, investors and clients.
In today's landscape, that is a competitive advantage no leader should pass up. ISO 31000 provides the map; it is up to executives to take the wheel and steer their organizations toward truly modern and effective risk management.
