Operational risk workshop – College Pal

Traditional Risk Workshops: Operational Risk (Fall 2019)

Operational Risk – Definition:

Operational Risk is the risk of loss resulting from inadequate or failed internal processes, people, and systems, or from external events. This definition includes legal risk, but excludes strategic and reputational risk.

Legal risk is the risk of loss (including litigation costs, settlements, and regulatory fines) resulting from the failure to comply with laws, regulations, prudent ethical standards, and contractual obligations. 

Operational risk (OR) is categorized in Basel II by seven Level 1 Event Types, as seen in Annex 9 of the attachment.     

These definitions are highly similar across BIS Basel, US Interagency Final Rules for Basel, and Solvency II documents.  See pp 144, 305-307 of the attached extract of BIS bcbs128 (June 2006) from the following source: https://www.bis.org/publ/bcbs128.pdf

Operational Risk – Key concepts:

All institutions have operational risk.  However, in contrast to certain other financial risk types, e.g., Credit, Market, Insurance Underwriting, firms typically are not compensated explicitly for taking the operational risk that is inherent in their business activities.

Firms seek to manage and/or control operational risk with operational risk management frameworks to identify, assess, measure, monitor, and report operational risk.  These frameworks rely on establishment of a Risk Culture and Governance, are articulated by Policies and Procedures, and are implemented with clear and distinct roles and responsibilities. These roles are referred to in banking regulation as the three lines of defense. 

Risk Culture: Risk culture is a firm’s norms and behaviors related to risk awareness, risk-taking, and risk management.

Risk Governance: Risk governance includes identifying the roles and responsibilities of different parts of the firm for managing and addressing risk.

Risk Appetite: The overall amount and type of risk that an organization is willing to seek or accept in pursuit of value. A broad set of statements that lays out the amount and type of risk the firm is willing to pursue or accept.

Risk Tolerance: The amount of risk an organization is willing to take (or accept) in key risk areas. It is more specific and granular with a quantifiable limit(s) for financial risks and more likely metrics with established thresholds for monitoring Operational Risk.  This is a subset of risk appetite statement.

Risk Framework and Policies:

Risk Management Framework is a set of components including tools that support and sustain risk management throughout an organization. There are two types of components: foundations and organizational arrangements. Foundations include the firm’s risk management policies, objectives, mandate, and commitment. And organizational arrangements include the plans, relationships, accountabilities, resources, processes, and activities to manage an organization’s risk. 

Risk Management Policy at the highest level includes a statement that defines a general commitment, direction, or intention. A risk management policy statement expresses an organization’s commitment to risk management and clarifies its general direction or intention.

Operational Risk Management tools can vary by industry and typically may include:

·                    Elements for identification, assessment, and monitoring, for example:  RCSA, Loss collections, KRIs, and Scenario Analysis.

·                    Risk mitigation functions aimed at specific risks, for example: Business Continuity, Vendor/Third-Party, Model Risk, etc.

·                    Quantification tools, including capital calculations and stress testing.

Template outline:

This workshop is designed to provide a more immersive experience than lecture to understand how each of the traditional risk functions contribute to a robust ERM program. The purpose of each workshop is to provide a self-study guide to learn more about each risk discipline. This workshop deals with Operational Risk. The lecture slides and attached links are only the beginning of your research. You are required to explore the topic further to determine how to apply the separate risk disciplines in ways that lead to appropriate responses to adverse events or untapped opportunities. Each workshop will be scenario based and you must apply your reading and research to develop an appropriate response to the adverse event.

Instructions:

1.                  Understanding the Environment: Read the related articles and watch the video links on Knight Capital. Feel free to perform other research beyond these links, these are merely a starting point.

Initial resources on Knight Capital:

https://www.youtube.com/watch?v=oIhn-l0y6dI