Operational Risk Appetite (ORA) - Why, What & How

Operational Risk Appetite Presented by: Institute of Operational Risk October 29, 2009 Why? What? How? John Cyriac

Agenda

Introduction

The ‘Why’ of ORA

The ‘What’ of ORA

The ‘How’ of ORA

Summary

Q & A

ORA - Project Overview

Objectives

Why should a financial institution consider ORA?

How do you define ORA?

How to implement ORA?

Project Method

Qualitative inputs from OR across the bank

Public Survey

Existing research & academic

Introduction::

Agenda

Introduction

Regulatory reasons for ORA

ORA and employee decisions

Summary

Q & A

The ‘Why’ of ORA Survey result for “Why should an organization define its Operational Risk Appetite limit?” Survey result for the question- “The main use of having an Operational Risk Appetite limit is to influence control investments. Do you agree?”

Regulatory reasons for ORA

“ There is no explicit requirement or provision in the FSA rules, or guidance for firms to set or define an ORA. However, the evidence suggests that articulating an ORA, either explicitly or implicitly, may provide an important mechanism for demonstrating compliance with the general SYSC requirements and/or the ‘use’ test”

Financial Services Authority (2007) Operational Risk Appetite.

The ‘Why’ of ORA ::

ORA & employee decisions The ‘Why’ of ORA ::

Risk Vs Return

Credit & Market Risk  returns

Influence decision – banking activity

Operational risk -> negative mean

expenditure on controls

OR is inherent and is not taken intentionally.

Purpose of setting ORA is to find the point where the

marginal expenditure in controls equals the

marginal reduction in expected OR losses

Agenda

Introduction

Some definitions of Risk Appetite

Issues with such definitions when applied to OR

ORA definition

Summary

Q & A

The ‘What’ of ORA Response to the survey question – “Operational Risk Appetite – Are you happy with the terminology?” Response to the survey question – “Operational Risk Appetite for a business unit is the residual risk as perceived by the business. Do you agree?”

Some definitions of risk appetite “ The broad-based amount of risk a company or other entity is willing to accept in pursuit of its mission or vision” – Basel Committee “ Risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business objectives” – Barclays Bank “ Risk appetite is an expression of the maximum level of residual risk that the group is prepared to accept in order to deliver its business objectives and is assessed against regular (often daily) controls and stress testing to ensure that the limits are not compromised in abnormal circumstances” - The Royal Bank of Scotland Group The ‘What’ of ORA ::

Issues with Risk Appetite definitions applied to OR Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::

Gives the impression that an organisation is taking OR willingly.

There is no incentive for the OR practitioner to innovate and reduce residual risk to improve performance.

Gives the impression that taking OR below a stated appetite is not desirable.

Issues with Risk Appetite definitions applied to OR

Gives the impression that an organisation is taking OR willingly.

There is no incentive for OR the practitioner to innovate and reduce residual risk to improve performance.

Gives the impression that taking OR below appetite is not desirable.

Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::

The ‘What’ of ORA :: Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives ORA Definition

Agenda

Introduction

Overview of top-down

Overview of bottom-up

ORA approach using expected volume growth

ORA implementation

Summary

Q & A

The ‘How’ of ORA Answer to the survey question: - “A successful Operational Risk Appetite framework needs a combination of top-down and bottom-up approaches to reduce the gap between board level and business level views on appetite. Do you agree with this statement?”

Overview of top-down risk appetite framework The ‘How’ of ORA :: Dimensions of risk appetite for OR Expected performance, and performance at stressed levels Expected loss – combination of market, credit & operational risks

ORA based on expected loss & volume growth The ‘How’ of ORA :: ORA based on expected loss & volume growth

Objectives for managing OR

To reduce the impact of losses suffered in the normal course of business (expected losses)

and reduce the likelihood of suffering a large extreme (or unexpected) loss

To help the bank run more effectively/efficiently and provide improved customer service.

ORA Implementation Guidelines The ‘How’ of ORA ::

Operational Risk Appetite should be the minimum expected performance by

OR function.

The OR function need to propagate a Target Risk Performance (a level less

than the expected level, less than ORA) and create a culture of

innovation (controls and risk management).

ORA for driving performance Key Indicators – thresholds aligned with ORA framework

Overview of bottom-up

Material risks & estimate of impact and probability

Key Indicators for risks for continuous assessment

Control effectiveness & cost of investing in controls

Input data for Key Risk Scenarios ( Probability & Impact of multiple risks causing a scenario)

The ‘How’ of ORA :: Summary of data points from RCSA Along with the already available data, if businesses document the cost of improving controls during RCSA, managers may be able to improve their judgment on investments in controls

ORA Implementation The ‘How’ of ORA :: Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT RCSA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action

ORA Implementation The ‘How’ of ORA :: Output for ORA Inputs Responsibility Frequency Action Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA ORA – minimum level of performance for OR Risk Performance Target(RPT) – a value less than ORA as a target to achieve by wise ORM ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action

Summary

OR is inherent and is not taken intentionally. Purpose of setting ORA is to find the point where the marginal expenditure in controls equals the marginal reduction in expected OR losses

Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives

Operational Risk Appetite should be the minimum expected performance by the OR function. The OR function need to propagate a Target Risk Performance (a level less than the expected level, less than ORA) and create a culture of innovation (controls and risk management).

Conclusion::

Agenda