• Save
Operational Risk Appetite (ORA) - Why, What & How
Upcoming SlideShare
Loading in...5
×
 

Like this? Share it with your network

Share

Operational Risk Appetite (ORA) - Why, What & How

on

  • 6,703 views

Implementing an Operational Risk Appetite (ORA) framework is inevitable if you are trying to achieve any of the following. ...

Implementing an Operational Risk Appetite (ORA) framework is inevitable if you are trying to achieve any of the following.

1. An integrated GRC (Governance, Risk & Compliance) approach
2. An Enterprise Risk Management (ERM) programme
3. Get ROI from your BASEL II or Solvency II compliance investments

Statistics

Views

Total Views
6,703
Views on SlideShare
6,490
Embed Views
213

Actions

Likes
6
Downloads
0
Comments
2

11 Embeds 213

http://www.compliancetrack.com 161
http://www.slideshare.net 36
http://www.compliance-track.com 4
https://www.linkedin.com 4
http://ddnyc.com 2
http://www.lmodules.com 1
http://site.compliance-track.com 1
http://service.compliance-track.com 1
http://www.linkedin.com 1
http://www.compliancetrack.net 1
http://www.compliance-track.co.uk 1
More...

Accessibility

Categories

Upload Details

Uploaded via as Microsoft PowerPoint

Usage Rights

© All Rights Reserved

Report content

Flagged as inappropriate Flag as inappropriate
Flag as inappropriate

Select your reason for flagging this presentation as inappropriate.

Cancel
  • Full Name Full Name Comment goes here.
    Are you sure you want to
    Your message goes here
    Processing…
  • Gentlemen,
    Can you please share the methods how can risk be calculated in easy-descriptive ways and measures.

    Thank you,
    Are you sure you want to
    Your message goes here
    Processing…
  • The risk appetite section is quite interesting and offers a good review of its definition
    Are you sure you want to
    Your message goes here
    Processing…
Post Comment
Edit your comment

Operational Risk Appetite (ORA) - Why, What & How Presentation Transcript

  • 1. Operational Risk Appetite Presented by: Institute of Operational Risk October 29, 2009 Why? What? How? John Cyriac
  • 2. Agenda
    • Introduction
    • The ‘Why’ of ORA
    • The ‘What’ of ORA
    • The ‘How’ of ORA
    • Summary
    • Q & A
  • 3. ORA - Project Overview
    • Objectives
      • Why should a financial institution consider ORA?
      • How do you define ORA?
      • How to implement ORA?
    • Project Method
      • Qualitative inputs from OR across the bank
      • Public Survey
      • Existing research & academic
    Introduction::
  • 4. Agenda
    • Introduction
    • The ‘Why’ of ORA
      • Regulatory reasons for ORA
      • ORA and employee decisions
    • The ‘What’ of ORA
    • The ‘How’ of ORA
    • Summary
    • Q & A
  • 5. The ‘Why’ of ORA Survey result for “Why should an organization define its Operational Risk Appetite limit?” Survey result for the question- “The main use of having an Operational Risk Appetite limit is to influence control investments. Do you agree?”
  • 6. Regulatory reasons for ORA
    • “ There is no explicit requirement or provision in the FSA rules, or guidance for firms to set or define an ORA. However, the evidence suggests that articulating an ORA, either explicitly or implicitly, may provide an important mechanism for demonstrating compliance with the general SYSC requirements and/or the ‘use’ test”
    • Financial Services Authority (2007) Operational Risk Appetite.
    The ‘Why’ of ORA ::
  • 7. ORA & employee decisions The ‘Why’ of ORA ::
    • Risk Vs Return
      • Credit & Market Risk  returns
        • Influence decision – banking activity
      • Operational risk -> negative mean
        • expenditure on controls
      • OR is inherent and is not taken intentionally.
      • Purpose of setting ORA is to find the point where the
      • marginal expenditure in controls equals the
      • marginal reduction in expected OR losses
  • 8. Agenda
    • Introduction
    • The ‘Why’ of ORA
    • The ‘What’ of ORA
      • Some definitions of Risk Appetite
      • Issues with such definitions when applied to OR
      • ORA definition
    • The ‘How’ of ORA
    • Summary
    • Q & A
  • 9. The ‘What’ of ORA Response to the survey question – “Operational Risk Appetite – Are you happy with the terminology?” Response to the survey question – “Operational Risk Appetite for a business unit is the residual risk as perceived by the business. Do you agree?”
  • 10. Some definitions of risk appetite “ The broad-based amount of risk a company or other entity is willing to accept in pursuit of its mission or vision” – Basel Committee “ Risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business objectives” – Barclays Bank “ Risk appetite is an expression of the maximum level of residual risk that the group is prepared to accept in order to deliver its business objectives and is assessed against regular (often daily) controls and stress testing to ensure that the limits are not compromised in abnormal circumstances” - The Royal Bank of Scotland Group The ‘What’ of ORA ::
  • 11. Issues with Risk Appetite definitions applied to OR Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::
    • Gives the impression that an organisation is taking OR willingly.
    • There is no incentive for the OR practitioner to innovate and reduce residual risk to improve performance.
    • Gives the impression that taking OR below a stated appetite is not desirable.
  • 12. Issues with Risk Appetite definitions applied to OR
    • Gives the impression that an organisation is taking OR willingly.
    • There is no incentive for OR the practitioner to innovate and reduce residual risk to improve performance.
    • Gives the impression that taking OR below appetite is not desirable.
    Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::
  • 13. The ‘What’ of ORA :: Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives ORA Definition
  • 14. Agenda
    • Introduction
    • The ‘Why’ of ORA
    • The ‘What’ of ORA
    • The ‘How’ of ORA
      • Overview of top-down
      • Overview of bottom-up
      • ORA approach using expected volume growth
      • ORA implementation
    • Summary
    • Q & A
  • 15. The ‘How’ of ORA Answer to the survey question: - “A successful Operational Risk Appetite framework needs a combination of top-down and bottom-up approaches to reduce the gap between board level and business level views on appetite. Do you agree with this statement?”
  • 16. Overview of top-down risk appetite framework The ‘How’ of ORA :: Dimensions of risk appetite for OR Expected performance, and performance at stressed levels Expected loss – combination of market, credit & operational risks
  • 17. ORA based on expected loss & volume growth The ‘How’ of ORA :: ORA based on expected loss & volume growth
    • Objectives for managing OR
    • To reduce the impact of losses suffered in the normal course of business (expected losses)
    • and reduce the likelihood of suffering a large extreme (or unexpected) loss
    • To help the bank run more effectively/efficiently and provide improved customer service.
  • 18. ORA Implementation Guidelines The ‘How’ of ORA ::
    • Operational Risk Appetite should be the minimum expected performance by
    • OR function.
    • The OR function need to propagate a Target Risk Performance (a level less
    • than the expected level, less than ORA) and create a culture of
    • innovation (controls and risk management).
    ORA for driving performance Key Indicators – thresholds aligned with ORA framework
  • 19. Overview of bottom-up
    • Material risks & estimate of impact and probability
    • Key Indicators for risks for continuous assessment
    • Control effectiveness & cost of investing in controls
    • Input data for Key Risk Scenarios ( Probability & Impact of multiple risks causing a scenario)
    The ‘How’ of ORA :: Summary of data points from RCSA Along with the already available data, if businesses document the cost of improving controls during RCSA, managers may be able to improve their judgment on investments in controls
  • 20. ORA Implementation The ‘How’ of ORA :: Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT RCSA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action
  • 21. ORA Implementation The ‘How’ of ORA :: Output for ORA Inputs Responsibility Frequency Action Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA ORA – minimum level of performance for OR Risk Performance Target(RPT) – a value less than ORA as a target to achieve by wise ORM ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action
  • 22. Summary
    • OR is inherent and is not taken intentionally. Purpose of setting ORA is to find the point where the marginal expenditure in controls equals the marginal reduction in expected OR losses
    • Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives
    • Operational Risk Appetite should be the minimum expected performance by the OR function. The OR function need to propagate a Target Risk Performance (a level less than the expected level, less than ORA) and create a culture of innovation (controls and risk management).
    Conclusion::
  • 23. Agenda
    • Introduction
    • The ‘Why’ of ORA
    • The ‘What’ of ORA
    • The ‘How’ of ORA
    • Summary
    • Q & A
    • [email_address]
    • +44 (0) 207 754 0347