Process-
Process-based Risk Management
Beyond Compliance

Why is it so important?

Operational Risk Management
People
Environment
Process Technology
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 3

Loss event categories
Loss Business
Disruption &
Internal Fraud System Failures
Clients, products
and business
practices
Process Risk
External Fraud Damage to
Physical Assets
Execution,
Delivery &
Employment
Process
practices and
Management workplace
safety
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 4

Risks in processes
• Payment, settlement,
reconciliation, modeling, pricing,
capacity…
• Dealing with vendors and
suppliers, including oursourcing
• Documentation requirements
• Internal and external compliance
issues
• Customer management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 5

Current ORM Challenges
• Focusing more on compliance
and less on risk management
• Risk management
– Low visibility, hidden risks
– High complexity
– Interdependency
– High impact
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 6

Process classification
• Operational risk should be examined in all level
Management Strategy, Controlling, SHRM
Business
Value adding activities
Lines
Support,
IT, HR, Legal, Finance…
back office
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 7

Process problems
• Do not exist
• If exist, were not documented
• If exist, documented,
are not followed
• If exist, documented and
followed,
are not measured and
controlled
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 8

Process-based Risk
Management Approach

Integrating risk and process
management
Process-based risk management
Process Risk
Risk-based process management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 10

Process and risk
• Integrates tasks and resources
– Human
– Technical solutions
– Information (documents, databases)
• Records cross-unit processes
• Manages responsibilities
Helps to identify hidden risks!
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 11

Process and risk
• Loss related to a specific process or activity
– Process based risk management
• Inadeqate performance of a process or a service
– Outage of business services
– Outage of IT services
– Incident management
– Business continuity management
•( and )
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 12

Üzleti
kategóriák
t
en
Veszteség
m
g
er nt
an kin
se erv tle
nd ce
s
kategóriák
e
As y s set
C ban ale
e
Re ma es
n
em
n
ag
ba
in fina
m ing
ic
s
d
ta na g
ym ial
k
ok
Tr rate
Pa e rc
R ga
Ag nt
br
e
c
o
l
il
t
ai
en
rp
om
ad
et
Co
Internal Fraud
External Fraud
Execution, Delivery & Process Management
Employment practices and workplace safety Osztályok
Damage to Physical Assets
Clients, products and business practices
Business Disruption & System Failures
Emberek
Folyamatok
Technológia
Külső tényezők
Key Risk Indicator 1 Risk 1
Key Risk Indicator 2 Risk 2
Key Risk Indicator 3 Risk 3

Process-based risk management
Identifying and • Who, what, when, how
modelling processes • Resources
Risk identification • What could prevent us to perform this task?
and assessment • What requires for achieving quality results?
Control planning • Can’t eliminate every risk
and deployment • Embedded controls
Process • As a tool for risk management
development • As a tool for organisational efficiency
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 14

Process modelling
Process map
Process model
Organisational model
Documents
IT Systems
Products
Risks and Controls
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 15

Risk analysis
• Related to
– Activity
– Resources
• Human
• IT
• Information
Process Models created by the ADONIS system.
• Where and Why?
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 16

Risk assessment
• Experts
– Previous experiences
– Existing knowledge
• Collected historical data
• Quantifying expected
loss
• Indicators (KPI, KRI)
• Modelling risk
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 17

Risk overview
• Summarising risks
• Analysing interdependencies
• Scenario analysis:
– Exceptional events
– Simulations based on process
model
– Capacities, trends, path
analysis
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 18

Controls
• Activity or process
• Ideal control: preventive and automatic
• Human accountability and responsibility
• Workflow
Process Models created by the ADONIS system.
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 19

Process development
• Tool for risk management
• Developing general controls
• Combining with process management requirements
– Time
– Quality
– Resources
• Achievable objectives
– Where are we now (AS-IS)?
– Where do we want to go (TO-BE)?
• Output can be a policy
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 20

Challenges
• Developing the process-based approach requires a
systematic approach
• Conscious business process management is a
requirement
• Continuous maintenance is required
• Cooperation of front-office and back-office
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 21

Summary
• Why use the process-based approach?
– Measurement of losses is not risk management
– Helps to identify hidden and soft risks
– Helps to analyse risks is details
– Controls processes and risks
– Can involve every stakeholder in the development
– Provides the possibility of conscious risk management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 22

Thank You!
Péter Fehér
Corvinno Technology Transfer Center
H-1093 Budapest, Közraktár utca 12/a.
Tel/Fax: 06 1 210 80 62
http://www.corvinno.com