Transcription
Operational Risk –An Enterprise RiskManagement PresentationMargaret Tiller SherwoodFCAS, ASA, MAAA, FCA, CPCU, ARM, ERMP, CERAPresidentTiller Consulting Group, Inc.Session Number: TBR4Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk – An ERM PresentationDefinitionTypes of Operational RiskOperational Risk Management FrameworkQuantificationMitigationMonitoringRisk Identification and Mitigation ExamplesWords of WisdomJoint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionBasel II – Operational risk is the risk of loss resultingfrom inadequate or failed internal processes, peopleand systems, or from external events. Thisdefinition includes legal risk, but excludes strategicand reputation risk.3Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionWho are these people?What does this have to do with us?4Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionBasel Committee on Banking Supervision –Committee of banking supervisory authorities thatprovides a forum for cooperation on banksupervisory matters and encourages convergencetowards common approaches and standards. It alsoframes guidelines and standards for banks and banksupervisors.Basel Accords – Recommendations on banking lawsand regulation5Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionBasel II was intended to create an internationalstandard for banking regulators to control how muchcapital banks need to put aside to guard against thetypes of financial and operational risks banks face.Basel II lists three types of risk:Credit riskMarket riskOperational riskWhat about liquidity risk?6Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionMarket liquidity is the risk that a security can not besold at all or quickly enough to prevent a loss.Market liquidity risk is a type of market risk. It isaddressed in Basel III.Funding liquidity risk is the risk that liabilities can notbe met when due.Funding liquidity risk is an operational risk.7Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionSolvency II codifies and harmonizes EU insuranceregulation.Solvency II definition - Operational risk means therisk of loss arising from inadequate or failed internalprocesses, personnel or systems, or from externalevents. [It] shall include legal risks, and excluderisks arising from strategic decisions, as well asreputation.8Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionLegal risk - risk of loss due to legal actions oruncertainty in the applicability or interpretation ofcontracts, laws, or regulations. Included.Strategic risk – risk arising from decisionsconcerning a company’s direction. Excluded.Reputational risk - risk related to the trustworthinessof the company. Excluded.9Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionBetter definition - Operational risk is the risk arisingfrom execution of a company’s business function.This focuses on the risks arising from people,processes, and systems.Note that it includes external events that affect acompany’s operations.10Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
DefinitionOperational risk does not include strategic risk – therisk that arises from decisions concerning acompany’s objectives.Reputational risk may arise from operational risk butis not, in and of itself, an operational risk. It also canarise from credit risk, market risk, and strategic risk.Operational risk is not used to generate profit,whereas market risk, credit risk, and strategic risk cando so.11Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Types of Operational RiskBasel II ListInternal fraud – misappropriation of assets, tax evasion, intentional mismarking ofpositions, briberyExternal fraud – theft of information, hacking damage, third party theft and forgeryEmployment practices and workplace safety – discrimination, workers’ compensation,employee health and safetyClients, products, and business practice – market manipulation, antitrust, impropertrade, product defects, fiduciary breaches, account churningDamage to physical assets – natural disasters, terrorism, vandalismBusiness disruption and system failures – utility disruptions, software failures,hardware failuresExecutive, delivery, and process management – data entry errors, accounting errors,failed mandatory reporting, negligent loss of client assetsLegal risk is in several of these categories.12Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Types of Operational RiskOperational risk losses usually are idiosyncratic to aparticular institution.Operational risk losses most commonly are from afailure of internal controls.Internal operational risk losses arise from errors andineffective operations.13Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk Management FrameworkBasel IIRisk organizational and governance structurePolicies, procedures and processesSystems used by a bank in identifying, measuring,monitoring, controlling and mitigating operational riskOperational risk measurement system (ORMS) –systems and data used to measure operational riskto estimate the operational risk charge14Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk Management FrameworkEnterprise Risk Management Steps1. Identify risks2. Describe and/or quantify risks3. Decide how to mitigate risks4. Implement decisions5. Monitor results of decisions and make changes asneededCommunication is key.15Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk Management FrameworkBasel II differentiates between verification andvalidation.Verification tests the effectiveness of the overallORMF and tests ORMS validation processes toensure they are independent and implementedconsistent with bank policies.Validation ensures that the ORMS is sufficientlyrobust and provides assurance of the integrity ofinputs, assumptions, processes, and outputs.16Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk Management FrameworkEssential elements for verification and validation:IndependenceCapacity – adequately staffed with adequateresourcesProfessional competence and due diligence17Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationBasel Committee on Banking Supervision “Operational Risk – SupervisoryGuidelines for the Advanced Measurement Approaches” June 2011Operational risk data categories for AdvancedMeasurement Approaches:Internal loss data (ILD)External data (ED)Scenario analysis (SA)Business environment and internal controlsfactors (BEICF)18Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationIt all starts with scenarios.Ask “What if ?”Don’t know what internal and external data to collectunless you have some idea of what scenariosyou need to look at.Data includes qualitative as well as quantitative.Qualitative data sometimes is more important thanquantitative, particularly when there are recentchanges.19Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationInternal Loss Data (ILD)Internal to the organizationUsed to estimate loss frequenciesUsed to inform the severity distribution(s)Serves as input into the scenario analysis20Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationExternal Data (ED)External to the organizationUsed to estimate loss severity, particularly for the tailMay be from a consortium of like members(Association of British Insurers’ Operational RiskConsortium – www.abioric.com)21Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationScenario Analysis (SA)Scenario outputs form part of the input into theAdvanced Measurement Approach modelQualitativeProduce range of resultsQuantify uncertainty arising from scenario biases –This is a significant challenge.22Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
QuantificationBusiness Environment and Internal Controls Factors(BEICF)Highly subjectiveOften used as indirect input into the quantificationframeworkOften used as an ex post adjustment to modeloutput23Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationGoalsHave business continuityMitigate financial lossReduce reputational risk24Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationThe size of loss a company is willing to acceptcompared to the cost of correcting errors orimproving operations determines its operationalrisk appetite.Most effective means of reducing operational riskare sound policies, practices, and procedures forinternal events and insurance for external andsome internal events.25Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationLow frequency, low severity – may do nothing.Low frequency, high severity – analyze by scenario testing.Handled by planning for these in advance and/or by financingrisk such as by purchasing insurance.High frequency, low severity – may do nothing. Howeverthese can accumulate to the point where the severitybecomes larger, such as if it triggers a loss of reputation.High frequency, high severity – take risk control measures.May finance risk such as by purchasing insurance.26Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationInsurance companies sell products that mitigateothers’ operational risks.27Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationBasel Committee on Banking Supervision - “Principles for the SoundManagement of Operational Risk” June 2011Internal controls embedded in day-to-day operationsare designed to ensure to the extent possiblethat:Activities are efficient and effectiveInformation is reliable, timely and completeThe entity is compliant with applicable lawsand regulation.28Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MitigationThree lines of defense:Business line managementAn independent corporate operational riskmanagement functionAn independent review29Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
MonitoringKey Performance Indicator (KPI) – Are weachieving our desired level of performance?Key Risk Indicators (KRI) – How is our risk profilechanging and is it within our desired tolerancelevels?Key Control Indicators (KCI) – Are ourorganization’s internal controls effective?30Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesFine Dining RestaurantFamily ownedOpen only for dinner Monday through SaturdaySeats 80 at a time for two seatings a nightPrivate party room upstairsOwner is one of the managers on duty but is also a chefHas a general manager and one other manager on dutyHas two part-time office staff and one cleanerHas an Executive Chef, two Line Chefs, one Dessert ChefHas two expediters and two dishwashersHas three captains, six waiters, six bussers, and one bartenderHas one hostess and one coat checkerSubcontracts car parking31Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesFine Dining RestaurantInternal policies, practices, and proceduresWhat can go wrong in the front of the house?What can go wrong in the kitchen?What can go wrong in the office?What can go wrong elsewhere?What communication problems can there be?External eventsWhat could negatively affect the restaurant?32Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesLarge Taxi CompanyIn major cityOwned by one private investorNo Board of DirectorsOne garage locationOwns 500 cabsHas 1,000 driversHas 20 mechanics in own repair shopHas own gas station and car washHas 5 dispatchersHas 10 office staff including CEO, COO, and CFO positions33Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesLarge Taxi CompanyInternal policies, practices, and proceduresWhat can go wrong on the streets?What can go wrong in the repair shop?What can go wrong with the gas station and car wash?What can go wrong with dispatching?What can go wrong in the office?What can go wrong elsewhere?What communication problems can there be?External eventsWhat could negatively affect the company?34Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesInsurance CompanyPrivately heldMuch of board is family membersWrites automobile liability and physical damage for taxis inlarge cityRecently had large business expansionIs moving from low-tech to high-tech back officeUses independent agents to write business35Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesInsurance CompanyInternal policies, practices, and proceduresWhat can go wrong with the agents?What can go wrong with customer service?What can go wrong with underwriting?What can go wrong with claim handling?What can go wrong with data processing?Increased inefficiency due to data overloadCompliance risk if data not protectedPrivacy riskSecurity risk36Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesInsurance CompanyInternal policies, practices, and procedures(continued)What can go wrong with accounting?What can go wrong with investing?What can go wrong with reinsurance?What can go wrong with the Board of Directors?What can to wrong with the owners?What can go wrong elsewhere?What communication problems can there be?External eventsWhat could negatively affect the company?37Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Risk Identification and Mitigation ExamplesInsurance CompanyOperational risk losses usually are idiosyncratic to aparticular institution.Very highly automated back-office systems –exposure to IT operational risksLow tech back office – exposure to people andprocess operational risks38Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Words of WisdomStrategic decisions affect operations.Have an “open door” policy.Manage by walking around.“Good reason” versus “real reasons.”When someone presents a problem, they must alsopresent a possible solution or be willing toparticipate in finding a solution.39Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Words of WisdomSome processes need to be “hard-wired” in: noexceptions.Manage by exception. Use those to improveprocesses and systems.Allow people to make exceptions that are in thecompany’s long-term best interest.Cross train.40Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Words of WisdomBe aware of what is going on outside the company:Clients/customersService providersCompetitorsRelated industriesGeneral population – demographics, workenvironments, sociallyTechnology innovationAccounting standardsPoliticallyJudiciallyLegislativelyWith the country in generalWith the world in general41Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Words of WisdomBe more proactive than reactive.Keep an open mind.See what is really there.Be prepared.Be flexible.Communicate, communicate, communicate.42Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk – An ERM PresentationDefinition - Operational risk is the risk arising fromexecution of a company’s business function.Types of Operational RiskOperational Risk Management FrameworkQuantificationMitigationMonitoringRisk Identification and Mitigation ExamplesWords of Wisdom43Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational Risk – An ERM PresentationMargaret Tiller SherwoodFCAS, ASA, MAAA, FCA, CPCU, ARM, ERMP, CERAPresidentTiller Consulting Group, Inc.10401 Litzsinger RoadSt. Louis, Missouri 63131USAwww.tillerconsultinggroup.comPhone: 1 314 567 7480Fax: 1 314 567 4199msherwood@tillerconsultinggroup.com44Joint IACA, IAAHS and PBSS Colloquium in Hong Kongwww.actuaries.org/HongKong2012/
Operational risk does not include strategic risk - the risk that arises from decisions concerning a company's objectives. Reputational risk may arise from operational risk but is not, in and of itself, an operational risk. It also can arise from credit risk, market risk, and strategic risk. Operational risk is not used to generate profit,
