Managing Operational Risk in Financial Institutions

Managing Operational Risk

Chapter 1 Fundamentals of Business Models and Associated Business Risk in Financial Institutions

Key Financial Institutions - Insurance Collect premiums in excess of claims Actuarial services Statistical and probability scenarios Profit = Premiums received - claims paid + income from investments Types Life Insurance General insurance Health Insurance Policies Occurrence policies Claims paid policies

Key Financial Institutions - Retail Banking Money transmissions, savings and borrowings Income consists of interest and fees Excess cash at end of day Placed on deposit Invested in eligible money market instruments Commercial Banking Corporate customers Primary and secondary functions

Key Financial Institutions - Investment Banking Wide range of services Customers typically companies and governments Sell side Creation, analysis, promotion and sale of shares Long-term relationships, trusted advisor role

Key Financial Institutions - Investment Management Professional management of client portfolios Pension funds Private investors Corporations Discretionary management Investment manager is responsible to manage the investments within the framework of the customer s financial objectives and risk appetite Non-discretionary management Investment manager advises but does not make the ultimate investment decision Prime Brokerage

Key Financial Institutions - Stockbroking/ Wealth Management Stockbroking Intermediary between buyers and sellers of shares Wealth Management Management of investments of high net worth individuals Central Counterparties (CCP) Exchanges Central banks Payment institutions

General Business Risks Credit Risk - non-payment Market Risk - adverse market movements Liquidity Risk - inability to liquidate an asset Operational Risk - failure of internal operations Repetitional Risk - damages to the firm s reputation Conduct Risk products and services do not result in fair outcome for clients

General Business Risks Insurance Underwriting risk - claims exceed previous Combined ratio = (Incurred losses + expenses)/Earned premium EU Solvency II Directive Retail banking Balancing risk and profitability Investment banking High risk Increasing complexity

General Business Risks Investment management Credit, market and operational risk Subject to market movements for investment performance Stockbroking /Wealth management Subject to regulation related to investment advise

Chapter 2 Fundamental of Financial Risk in Financial Institutions

Balance Sheet Analysis Balance Sheet Snapshot of overall financial position of a company at a particular point in time Also known as Statement of Assets and Liabilities Assets = Liabilities + Equity Off-balance sheet items International Financial Reporting Standards - criteria Understandability Reliability Relevance Comparability Financial Stability Board Coordination of recommendations of national financial authorities and international accounting setting bodies

Balance Sheet Analysis Assets Non-current - tangible and intangible Current - assets to be converted into cash to generate an income Investments held in other companies Liabilities Obligation to transfer future economic benefits as a result of past transactions or events Current liabilities - short dated Non-current liabilities - borrowing Equities Share capital (ordinary, preference, bonus and founders shares) Capital reserves Revenue reserves

Capital Financial capital Funds provided by investors or lenders Accumulated financial wealth of a business Borrowed capital needs to be repaid Early Capital Accords Basel accord Capital Adequacy Directive (CAD) Capital Requirements Directive (CRD) Basel III Greater emphasis on internal risk management processes Greater flexibility towards risk measurement Greater risk-sensitivity Capital buffers Leverage ratio Liquidity requirements - Liquidity coverage ratio and net stable funding ratio

Capital Sarbanes-Oxley Accounting, auditor independence, corporate responsibility and analysts conflict of interest Enhanced SEC regulation Solvency II Eu regulatory requirements for insurance firms Risk based system Alternative Investment Fund Managers Directive Regulation applicable to fund managers Need to be established in the EU to operate in the EU

Capital Dodd-Frank US legislation Promote stability of the financial system High risk derivatives to be regulated by SEC or CFTC European Market Infrastructure Regulation (EMIR) EU regulation on derivatives, central counterparties, and trade repositories ESMA defines and supervises market infrastructure Enhanced reporting requirements

Capital Markets in Financial Instruments Directive (MiFID) and MiFIR Promote fair, efficient and integrated markets while facilitating competition between trade execution methods MiFID II also covers certain commodity firms, third country firms and data providers Requirement for robust risk management and internal control mechanisms Undertakings for Collective Investments of Transferable Securities (UCITS) Allows for investment scheme to operate freely throughout the EU Common standard for investor protection Requirements on depositaries

Asset and Liability Management Coordinate management of assets and liabilities Management of risks due to mismatch in maturities Manage liquidity and interest rate risk Integrated approach to enterprise risk management

Off-balance sheet Asset or liability not legally owned No legal responsibility for the asset Derivatives IRS 39 - derivative is a financial instrument whose value is related to an underlying assets requires no initial investment, and is settled at a future date Financial futures Forward contracts Option contracts Swaps Caps and collars Securitisation Exchange traded funds

Specified Risks - Credit Risk Risk of loss caused by failure of a counterparty to meet their obligations Types of credit risk Pre-settlement risk Settlement risk Measuring credit risk Credit exposure management Credit risk premium Credit ratings Modern measurement techniques

Specified Risks - Market Risk Risk of loss of earnings or capital arranging from a change in value of a financial instrument Types of market risk Price-level risk Volatility risk Liquidity risk Basis risk

Specified Risks - Liquidity Risk Risk of loss through not being able to trade in a market or obtain a favourable price when required Improving liquidity by investing in instruments with varying maturity Measuring liquidity Bid-offer spread Market depth Immediacy Resilience

Chapter 3 Operational Risk in Financial Institutions

UK Corporate Governance Code Principles based, not a rigid set of rules No legal sanction for non-compliance Listing Rules require all companies with a premium listing (standard listing = voluntary compliance) to include a corporate governance report in their annual report and accounts Comply or explain

UK Corporate Governance Code - Principles Leadership guidance on the structure of the board Effectiveness guidance on the procedures and processes of the board, and appointment and training of directors Accountability guidance on the responsibilities of the board, including corporate reporting, control and audit Remuneration guidance on remuneration for executive and non-executive directors Relations with Shareholders guidance on relationships with shareholders and the use of the AGM

Operational Risk Risk of loss resulting from inadequate or failed internal processes, people and systems or from external events Includes legal risk but excludes strategic and reputitional risk Causes - Failure of process, people and systems Categories Internal and external fraud Employment practices and workplace safety Clients, products and business practices Damage to physical assets Busses disruption and system failures Execution, delivery and business failure

Regulatory Requirements and Risk Regulatory environment is subject to constant change Change in regulations typically result in change in processes and/or systems Types of change: People change Process change Systems change External events

Operational Risk Effect of corporate restructuring Lack of common culture and purpose Disaffection Misunderstanding of new system and lack of productivity Staff loss Effect on technology Encryption Password protection Portable devices Outsourcing Cloud computing Reduced IT cost and project management overheads Increased resilience Simpler business recovery Increased scalability

Operational Risk Algorithmic Trading Use of computer programmes to arrange orders Grown from approx 60 to approx 75% of market between 2011 and 2015 Potential for flash crash remedied by trading curbs Artificial Intelligence Machine learning Big data Social media

Consumer Demand Drives new products Changing financial requirements Effective competition On-line and mobile banking

Business Benefits Streamline risk management process Identification, measurement, and monitoring of risk Efficient allocation of and utilisation of operational risk capital Plan for future range indicators based on past events Cultural shift and potential to enhance innovation Information sharing resulting in improvement

Consequences Regulatory non-compliance Private and final warning notices Unlimited fines Resolution orders Cancellation or variation of operating authorisation Withdrawal of individual regulatory approval Public statements and/or ensures Non-compliance with internal policy guidelines Senior management responsibility Financial loss, theft and fraud may lead to direct losses, fines or penalties Fraud and theft Internal and external Caused by dishonesty, exploiting a weakness in process or systems design Loss due to fraud is potentially very large

Consequences Technological failures Power failures Virus Faulty back-up Customer dissatisfaction Delayed processing and documentary commissions Repetitional risk Data protection Breaches

Chapter 4 Organisational Considerations in Operational Risk Management

Governance in Financial Institution Process undertaken by board of directors to agree Key objectives Framework Business model and on-going process Risk profile Ensure safety, soundness, and ethical operation Effective chairman UK Corporate Governance Code Comply or explain No one size fits all Shareholder decision

Organisational Culture The way things are done Reflects collective beliefs and traditions of the workforce Impacts operational risk management Effective leadership needed to embed the appropriate culture Strategy and objectives Effective communication Suitable and appropriate reward arrangements

Organisational Culture Values and expected b behaviours included in: Staff remuneration and appraisals Risk policy and independence of risk function Calibre of risk personnel Escalation and whistleblowing Leadership Driver of culture Setting example of expected behaviour Ensure common understanding of cultural values Drives strong operational risk management

Three Lines of Defence First line of defence - Business operational management Controls to deal with day-to-day business Identification of risks and business improvements, controls and reporting Second line of defence - Risk management and compliance Facilitation and monitoring of implementation of effective risk management systems Oversight or risk and review of risk management procedures Third line of defence - Internal and external audit Risk based audits covering first ad second line of defence Detailed view of business lines taking into consideration a wide variety of factors

Front, Middle and Back Office Organisational structure Front office - trading by authorised staff Middle office - risk management and calculation of profits and losses Back office - Operations, administration and support Business Unit-Based Managing risk in separate business units across the financial institution as a whole Enterprise Wide Framework to understand, address and manage interrelated risk across the firm Optimise risk process Understanding risk exposure Manage consequences of risk Common understanding of risk

Outsourcing Internal External third party Reasons Focus on core business Access to professional expertise Avoidance of burdensome regulation Reduction in short-run cost Challenges Suitable outsourcing partner Contract formulation Service level agreements Data protection

Key Personnel Chief Executive Officer and Board of Directors Board is responsible for oversight and appointment of CEO CEO is most senior person in the firm Audit Committee Board Risk Committee Chief Risk Officer Head of Operational Risk Operational Risk Committee New business and new product approval committees

Corporate Governance Effective operational risk management framework Responsibility of board of directors Strategy covering Risk appetite Tolerance of risk Board of directors Agree to take operational risk serious Effective operational risk management policy

Support and Control Functions Compliance Independent and permanent compliance function (MiFID - 2007) Sufficient authority and able to operate effectively Wide range of responsibilities Internal Audit Provide independent assurance that an organisation s risk management, governance and internal control processes are operating effectively Regular business reviews assessing firm s processes and procedures are adequately controlled Legal Legal services and advise Legal risk - risk of loss due to legal issues resulting form an inability to enforce legal contracts Enforceability of contract

Support and Control Functions Credit Assessing creditworthiness of counterparties Forecasting margin requirements Collecting payments due Increasing efficiency and improvement of internal processes and procedures Human Resources Marketing Treasury Planning and operations Cash and liquidity management Funding and capital markets Financial risk management Corporate governance Stakeholder relations

Support and Control Functions Operations Business Continuity Ensure core operational functions are at all times available Business continuity plan Health and safety Technology Information Security Intrusion to systems Espionage and data theft Malicious alteration of systems or networks Denial of services attack Financial fraud and other commercial abuse

Chapter 5 Management of Operational Risk in Financial Institutions

Key Aims Effective identification, measurement, assessment and management of operational risk management Reduction or mitigation of potential impact should a risk occur Key aims of effective risk management policy Senior management awareness Cost reduction Protection and enhancement of reputation and credit rating Detection of non-compliant issues

Policy Principles, Application and Scope Policy covers Definition, description of the process, and risk appetite Roles and responsibilities Escalation and reporting Procedures and standards International best practice Fundamental part of banks risk management Board should establish an effective and holistic culture Operational risk framework Operational risk discipline reports to operational risk committee Business managers act as 1st line of defence

Business Objectives and Risk Appetite Business objectives form the context for risk management Risk appetite Level of risk a firm is prepared to accept How the firm is perceived by stakeholders Determine the appropriate level of risk Operational risk environment Continually changing environment Periodic reassessment of risk

Interdependencies in Risk Management