Successfully reported this slideshow.
We use your LinkedIn profile and activity data to personalize ads and to show you more relevant ads. You can change your ad preferences anytime.

2. op risk and aml

606 views

Published on

  • Be the first to comment

2. op risk and aml

  1. 1. Managing Operational Risk with Key Risk Indicators Dr. LAM Yat-fai (林日辉博士林日辉博士林日辉博士林日辉博士) Doctor of Business Administration (Finance) CFA, CAIA, FRM, PRM, MCSE, MCNE PRMIA Award of Merit 2005 E-mail: quanrisk@gmail.com 2 Agenda Measuring operational risk with KRIs Implementing a KRI program 3 4
  2. 2. 5 6 7 Case: The lessons from selling Lehman Brothers’ investment products Do you know how many investment products you are selling? Do you know how many Lehman Brothers-related transactions are processed in the past 3 months? Do you know how many customers you have? Do you know how many new customers you have in the last quarter? Do you know whether your marketing staff have mis-communicated with your clients? Do you know whether your investment product documents are compliant with the SFC’s regulatory requirements? Do you know how many marketing staff have undergone proper product training? 8 Basel III classification on operational failures 1. Internal Fraud 2. External Fraud 3. Employment Practices and Workplace Safety 4. Clients, Products, & Business Practice 5. Damage to Physical Assets 6. Business Disruption & Systems Failures 7. Execution, Delivery, & Process Management
  3. 3. 9 Your questions on wealth management services Return How much profit to be generated from wealth management services? Risk What are the major operational failures (high frequency and/or serious loss) associated with wealth management? How do you measure this risk? What are the current risk level? 10 Wealth management services: questions on operational risk Is the operational risk level acceptable, too high or too low? Is the operational risk level increasing or decreasing during the last 12 months? Which branch and/or investment product contributes the most operational risk? If the operational risk level is too high, how to plan for the mitigation actions? How to assess whether a mitigation action is effective? How to set limits for operational risk level? 10 11 Think realistically… There is no perfect indicator You should look for some indicators that are associated with operational failures There is no single right indicator Your audit department and the bank regulator simply ask whether your know the operational risk and how you measure it. It is hard for them to prove whether you are right or wrong 11 12 Operational risk measurement Qualitative Low, medium, high Subjective Difficult to compare Quantitative Numerical Objective Relatively easy to compare
  4. 4. 13 What is key risk indicator (KRI)? Indicator Quantifiable Risk Sensitive to risk Key Only a few Definition from the HKMA: KRIs are primarily a selection from a pool of operations or control indicators identified and being tracked by various functions of a bank… 14 KRI report for settlement operations of a major bank in London 15 What regulators expect on KRIs? KRIs may be early warning signals KRIs help predict risk KRIs help the management know where the risks are KRIs help the management know the current risk and its recent trends KRIs help the management set risk limits and action plans 16 How do you benefit from KRIs? To measure operational risk in numbers To compare operational risk among business units To exhibit trend of operational risk To analyze level of operational risk To measure effectiveness of operational risk mitigation actions To communicate operational risk level bottom up
  5. 5. 17 Incentives for a corporate deployment of KRIs For audit department Help identifying high risk areas and outliers Thus focusing audits on the weakest link For business department An objective and on-going risk monitor system put in place Justify less audit if you are not an outlier 18 Characteristics of good KRIs Intuitive and simple Easy to observe and measure Recorded automatically Several KRIs on a single risk dimension No contradiction Less overlapping 19 Answer: Possible KRIs for wealth management services No. of investment products No. of regulatory guidelines on selling investment products No. of staff selling investment products No. of customers acquired investment products Monthly sales target of investment products 20 More specific KRIs for wealth management services No. of high risk investment products No. of regulatory guidelines issued last year on selling investment products No. of staff selling investment products with experience less than one year No. of customers acquired investment products with mis-matched risk level Residual sales target of investment products
  6. 6. 21 How to analyze KRIs? Peer analysis Which branch is the most risky? Which branch is the least risky? Trend analysis Is the operational risk increasing? Is the operational risk reducing? Threshold analysis At which level has material operational failure started to emerge? At which level has even minor operational failure never observed? Statistical analysis What is the average risk level? What is the distribution of risk level? 22 Peer analysis Monthly no. of transactions per teller - 500 1,000 1,500 2,000 2,500 3,000 3,500 A verage Sha Tin Eastern K w un Tong Yuen Long K w aiTsing Tuen M un W ong TaiSin SaiK ungSham ShuiP oK ow loon C ity TaiPo Tsuen W an High risk trigger level Inefficient trigger level 23 Trend analysis Monthly no. of transactions per teller (Shatin branch) - 500 1,000 1,500 2,000 2,500 3,000 3,500 Jan-2010 Feb-2010 Mar-2010 Apr-2010 May-2010 Jun-2010 Jul-2010 Aug-2010 Sep-2010 Oct-2010 Nov-2010 Dec-2010 High risk trigger level 24 Effectiveness of mitigation plan Monthly no. of transactions per teller (Shatin branch, with two tellers re-deployed from Tai Po in 2011) - 500 1,000 1,500 2,000 2,500 3,000 3,500 Apr-2010 May-2010 Jun-2010 Jul-2010 Aug-2010 Sep-2010 Oct-2010 Nov-2010 Dec-2010 Jan-2011 Feb-2011 Mar-2011 High risk trigger level
  7. 7. 25 Setting trigger limits High risk trigger level The level of KRI at which material operational failure starts to emerge Inefficient trigger level The level of KRI at which even minor operational failure never occurred, an indication of inefficiency Trigger limits could only be set after a relevant KRI system is in place for a sufficient long history, e.g. one business cycle Some trigger examples 90th percentile Mean + 1.67 SD The KRI level 3 month before a failure occur 26 Your benefits (again) To satisfy regulatory requirements To minimize audit findings To demonstrate a high standard of OPM compatible with major international banks To prevent potential operational failures To justify additional resources To disclaim liabilities in case of request on additional resources disapproved 27 Disadvantages of KRIs Cost of do business Backward looking No standard KRIs Long data history to build KRI database Unclear causal relationship between operational loss and KRIs 28 Agenda Measuring operational risk with KRIs Implementing a KRI program
  8. 8. 29 Who design the KRIs? You design your own KRIs Only you know which KRIs are the best Not compliance department They specify more KRIs to satisfy regulators Not external auditors They specify more KRIs to justify their audit fee Not external consultants They specify useless KRIs to charge more 30 Number of KRIs KRIs must be key Preparation of KRIs is costly Less then no. of productive staff in your department Inconsistency among KRIs are difficult to explain More KRIs trigger more questions from management, auditors and regulators Rule of thumb for a simple business line Between 5 to 7 At least 3 At most 12 31 Common KRIs Annual gross revenue No. of critical operational failures per year No. of customers per staff per month No. of transactions per staff per month Transaction amount per staff per month Time required to process one transaction No. of low, medium, high audit findings Results from control self-assessment … 32 Roll out strategy Start with each business line Then product and branch Start with simple numbers No. of customers No. of low, medium and high risk customers No. of mis-match selling Start with quarterly measures Conduct annual review
  9. 9. 33 Preparing management reports Peer analysis e.g. by branch Trend analysis e.g. from last 12 months Threshold analysis e.g. did outliers experienced material failures? Statistical analysis e.g. mean, standard deviation, relationship with material operational failures 34 Common misunderstandings The more KRIs, the better OPM Limit KRIs only to a few KEY Assign “Low”, “Medium”, “High” value to a KRI Use numeric as much as possible External consultants can design KRIs They charge you by copying Bank A’s KRIs to your bank They charge Bank B by copying your bank’s KRIs to Bank B KRIs are forward looking KRIs only tell you as they are Plan to roll out a perfect KRI system You cannot improve your KRI system next year KRI is the most important task You are paid because of creating revenue KRI is only one of the few major OPM methods 35 Use of external consultants Bring in experiences from regulators and other banks Put in place the skeleton of an KRI framework Introduce a culture of KRIs Conduct training on KRIs Design MIS systems and reports But, external consultants can never design KRIs for your 36 Final advice Start your KRI system tomorrow Start with simple and easy KRIs
  10. 10. 37 Your exercise List three major business lines in your department List three KRIs for each business line Specify how to collect the KRIs Your opinions http://sites.google.com/site/quanrisk

×