Operational Risk Appetite (ORA) - Why, What & How

Operational Risk Appetite Presented by: Institute of Operational Risk October 29, 2009 Why? What? How? John Cyriac

Agenda
Introduction
The ‘Why’ of ORA
The ‘What’ of ORA
The ‘How’ of ORA
Summary
Q & A

ORA - Project Overview
Objectives
Why should a financial institution consider ORA?
How do you define ORA?
How to implement ORA?
Project Method
Qualitative inputs from OR across the bank
Public Survey
Existing research & academic
Introduction::

Agenda
Introduction
Regulatory reasons for ORA
ORA and employee decisions
Summary
Q & A

The ‘Why’ of ORA Survey result for “Why should an organization define its Operational Risk Appetite limit?” Survey result for the question- “The main use of having an Operational Risk Appetite limit is to influence control investments. Do you agree?”

Regulatory reasons for ORA
“ There is no explicit requirement or provision in the FSA rules, or guidance for firms to set or define an ORA. However, the evidence suggests that articulating an ORA, either explicitly or implicitly, may provide an important mechanism for demonstrating compliance with the general SYSC requirements and/or the ‘use’ test”
Financial Services Authority (2007) Operational Risk Appetite.
The ‘Why’ of ORA ::

ORA & employee decisions The ‘Why’ of ORA ::
Risk Vs Return
Credit & Market Risk  returns
Influence decision – banking activity
Operational risk -> negative mean
expenditure on controls
OR is inherent and is not taken intentionally.
Purpose of setting ORA is to find the point where the
marginal expenditure in controls equals the
marginal reduction in expected OR losses

Agenda
Introduction
Some definitions of Risk Appetite
Issues with such definitions when applied to OR
ORA definition
Summary
Q & A

The ‘What’ of ORA Response to the survey question – “Operational Risk Appetite – Are you happy with the terminology?” Response to the survey question – “Operational Risk Appetite for a business unit is the residual risk as perceived by the business. Do you agree?”

Some definitions of risk appetite “ The broad-based amount of risk a company or other entity is willing to accept in pursuit of its mission or vision” – Basel Committee “ Risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business objectives” – Barclays Bank “ Risk appetite is an expression of the maximum level of residual risk that the group is prepared to accept in order to deliver its business objectives and is assessed against regular (often daily) controls and stress testing to ensure that the limits are not compromised in abnormal circumstances” - The Royal Bank of Scotland Group The ‘What’ of ORA ::

Issues with Risk Appetite definitions applied to OR Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::
Gives the impression that an organisation is taking OR willingly.
There is no incentive for the OR practitioner to innovate and reduce residual risk to improve performance.
Gives the impression that taking OR below a stated appetite is not desirable.

Issues with Risk Appetite definitions applied to OR
Gives the impression that an organisation is taking OR willingly.
There is no incentive for OR the practitioner to innovate and reduce residual risk to improve performance.
Gives the impression that taking OR below appetite is not desirable.
Survey result for the question- “Businesses take financial risks as part of their business strategy to achieve a gain. Similarly, can we say that businesses as part of their strategy take on operational risks to realise a gain?” The ‘What’ of ORA ::

The ‘What’ of ORA :: Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives ORA Definition

Agenda
Introduction
Overview of top-down
Overview of bottom-up
ORA approach using expected volume growth
ORA implementation
Summary
Q & A

The ‘How’ of ORA Answer to the survey question: - “A successful Operational Risk Appetite framework needs a combination of top-down and bottom-up approaches to reduce the gap between board level and business level views on appetite. Do you agree with this statement?”

Overview of top-down risk appetite framework The ‘How’ of ORA :: Dimensions of risk appetite for OR Expected performance, and performance at stressed levels Expected loss – combination of market, credit & operational risks

ORA based on expected loss & volume growth The ‘How’ of ORA :: ORA based on expected loss & volume growth
Objectives for managing OR
To reduce the impact of losses suffered in the normal course of business (expected losses)
and reduce the likelihood of suffering a large extreme (or unexpected) loss
To help the bank run more effectively/efficiently and provide improved customer service.

ORA Implementation Guidelines The ‘How’ of ORA ::
Operational Risk Appetite should be the minimum expected performance by
OR function.
The OR function need to propagate a Target Risk Performance (a level less
than the expected level, less than ORA) and create a culture of
innovation (controls and risk management).
ORA for driving performance Key Indicators – thresholds aligned with ORA framework

Overview of bottom-up
Material risks & estimate of impact and probability
Key Indicators for risks for continuous assessment
Control effectiveness & cost of investing in controls
Input data for Key Risk Scenarios ( Probability & Impact of multiple risks causing a scenario)
The ‘How’ of ORA :: Summary of data points from RCSA Along with the already available data, if businesses document the cost of improving controls during RCSA, managers may be able to improve their judgment on investments in controls

ORA Implementation The ‘How’ of ORA :: Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT RCSA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action

ORA Implementation The ‘How’ of ORA :: Output for ORA Inputs Responsibility Frequency Action Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA ORA – minimum level of performance for OR Risk Performance Target(RPT) – a value less than ORA as a target to achieve by wise ORM ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action

Summary
OR is inherent and is not taken intentionally. Purpose of setting ORA is to find the point where the marginal expenditure in controls equals the marginal reduction in expected OR losses
Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives
Operational Risk Appetite should be the minimum expected performance by the OR function. The OR function need to propagate a Target Risk Performance (a level less than the expected level, less than ORA) and create a culture of innovation (controls and risk management).
Conclusion::

Agenda
Introduction
Summary
Q & A
[email_address]
+44 (0) 207 754 0347

http://www.compliancetrack.com	43
http://www.slideshare.net	36
http://www.compliance-track.com	4
http://site.compliance-track.com	1
http://www.lmodules.com	1
http://www.compliance-track.co.uk	1
http://service.compliance-track.com	1

Operational Risk Appetite (ORA) - Why, What & How

by ComplianceTrack on Nov 04, 2009

Accessibility

Categories

Tags

Upload Details

Usage Rights

7 Embeds 87

Statistics

Operational Risk Appetite (ORA) - Why, What & How — Presentation Transcript