1. Minimizing Operational Risk
& Optimizing Institutional
Performance

2. Interest in Enterprise-wide Risk Assessments is
being driven by Financial & Economic Realities
• Global spotlight on risk and corporate governance
– Sarbanes-Oxley Act of 2003 & COSO ERM Framework
• Increased involvement from the Audit Committee of the
Board of Directors with regard to risk management
– NYSE listing requirements
• Capital adequacy requirements and the need for efficient
capital allocation
– Basel Capital Accord
• Need for alternative risk solutions due to the current
insurance environment
• Maximizing shareholder value
• Sustaining a competitive advantage
2

3. Basel Committee’s Definition of Operational Risk
“The risk of direct or indirect loss resulting from
inadequate or failed internal processes, people and
systems or from external events”
Operational risk can result in increased write-offs,
additional expenses or loss of revenue
3

4. Operational Risk Management &
Shareholder Value
Examples of how operational risk management
drives shareholder value?
• Improving operating efficiency and thus operating margins,
by identifying and prioritising process improvement and derisking opportunities
• Improving management effectiveness by enhancing the
governance structure
• Enabling more effective capital usage by introducing
processes to assess exposure & integrate this with an
economic capital model
• Protecting assets by reducing losses through improved risk
control environment and financing programme
• Enhanced organizational capabilities & subsequent
competitive positioning through continuous improvement
4

5. How to Reduce Operational Risks?
Understand Risks
• Benchmarking
• Scenario Analysis
• Key Risk Indicator’s (KRI)
De-Risking Operational Procedures
• Define, Measure, Analyze, Improve, & Control
Risk Finance & Transfer
• Mapping to Insurance Products
• Developing New Products
• Financing Retained Losses
• Transferring Risk to the Insurance & Capital Markets
5

6. Op Risk/Lean Six Sigma Linkage
Op Risk Needs
Six Sigma Can Provide
Identification of critical
processes and activities
Hierarchical, process view of
a business
Monitoring of key indicators
and warning of potential
problems
Process Management &
Control
Cure problems in existing
processes
Process Improvement via
DMAIC & Lean
Prevention of problems for
new processes
Process Design via DFSS
6

7. Six Sigma Defined
• A data driven approach to understanding and
eliminating process variation and defects
• Three, universal, methodologies for process
management
• A performance target of 3.4 defects per million
opportunities
7

8. Risk Management: How Can Six Sigma Help?
• Six Sigma provides three powerful methodologies
for:
– Designing robust processes
– Fixing broken processes
– Controlling processes on an ongoing basis (i.e.,
keeping them from decaying and producing errors)
8

9. Risk Management: How Can Six Sigma Help?
• Designing robust processes:
– A structured methodology, DFSS (Design for Six
Sigma), assures that:
• New processes have high capability (satisfy customers
and produce low defects) right from the start
• New processes are designed to minimize the risk of
failure
9

10. Risk Management: How Can Six Sigma Help?
• Fixing broken processes:
– A structured methodology, DMAIC (Define,
Measure, Analyse, Improve, Control):
• Uses powerful statistical (and non-statistical) tools to
locate and eliminate the root causes of otherwise
intractable problems
• Focuses on removal and prevention of defects
• Reduces process variability
10

11. Risk Management: How Can Six Sigma Help?
• Controlling processes, so that their behavior is
predictable (within limits). Six Sigma provides:
– Special tools and techniques including a framework:
• For measuring and judging process variation
• For detecting special causes
• To providing early warning of process changes
– The ability to calculate Process Sigma, an index of
process performance
11

12. Companies Pursue Six Sigma to …
• Accommodate customer demands
• Drive out waste, cycle time and variability
• Direct improvement resource to the most significant
opportunities
• Establish a standard improvement methodology
• Develop leaders
• Reduce risk
• Grow the top-line
• Implement business strategy
• Increase product reliability
• Initiate cultural change
• Accelerate improvement
12

13. Sigma is a Measure of
Process Capability
Performance
boundary
Sigma DPMO
1
2
3
4
5
6
680,000
298,000
67,000
6,000
400
3.4
Requirement
4
2
Process
performance
5
6
3
1
Six Sigma is a level of process capability such
that less than 3.4 “defects” are produced for
every million opportunities.
13

14. Estimating the Benefits of Six Sigma
Sigma Level
Defects Per Million
Cost of Quality
3
66,807
20-30% of Sales
4
6,210
15-20% of Sales
5
233
10-15% of Sales
6
3.4
< 10% of Sales
Harry, Mikel J., Six Sigma: A Breakthrough Strategy for Profitability, Quality Progress, May 1998
14

15. Process Sigma Advantages
The Sigma Scale provides a common metric for comparison
The Sigma Scale provides a common metric for comparison
that includes the customer requirement and the degree of
that includes the customer requirement and the degree of
variation. Addresses multiple occurrences.
variation. Addresses multiple occurrences.
PROCESS
PERFORMANCE
Call servicing
32 seconds ASA vs goal of 35
Billing
98% accuracy, on time, right location
Accounts Receivable 33 days average aging vs goal of 40
Customer Service
82% rated 4 or 5 responsiveness
15

16. The Antecedents of Six Sigma
• Six Sigma is the latest and most powerful in a long
line of process management and process
improvement methods, e.g.:
–
–
–
–
Guilds
The Scientific Method
Quality Circles
TQM
• Six Sigma has built on these ideas and added
powerful tools
• It is specially useful for transactional processes
16

17. Sound Practices in
Operational Risk Management
Principle 1
The board of directors should be aware of the major aspects
of the bank’s operational risks as a distinct risk category that
should be managed, and it should approve and periodically
review the bank’s operational risk management framework.
The framework should provide a firm-wide definition of
operational risk and lay down the principles of how
operational risk is to be identified, assessed, monitored,
and controlled/mitigated.
Source: Sound Practices for the Management & Supervision
of Operational Risk (Basel Committee – July 2002)
17

18. Sound Practices in
Operational Risk Management
Principle 2
The board of directors should ensure that the bank’s
operational risk management framework is subject to
effective and comprehensive internal audit by
operationally independent, appropriately trained and
competent staff. The internal audit function should not be
directly responsible for operational risk management.
Source: Sound Practices for the Management & Supervision
of Operational Risk (Basel Committee – July 2002)
18

19. Sound Practices in
Operational Risk Management
Principle 3
Senior management should have responsibility for implementing
the operational risk management framework approved by the
board of directors. The framework should be implemented
throughout the whole banking organization, and all levels of staff
should understand their responsibilities with respect to
operational risk management. Senior management should
also have responsibility for developing policies, processes
and procedures for managing operational risk in all of the
bank’s products, activities, processes and systems.
Source: Sound Practices for the Management & Supervision
of Operational Risk (Basel Committee – July 2002)
19

20. Sound Practices in
Operational Risk Management
Principle 4
Banks should identify and assess the operational risk
inherent in all material products, activities, processes
and systems. Banks should also ensure that before
new products, activities, processes and systems are
introduced or undertaken, the operational risk
inherent in them is subject to adequate assessment
procedures.
Source: Sound Practices for the Management & Supervision
of Operational Risk (Basel Committee – July 2002)
20

21. Sound Practices in
Operational Risk Management
Principle 5
Banks should implement a process to regularly monitor
operational risk profiles and material exposure to
losses. There should be regular reporting of pertinent
information to senior management and the board of
directors that supports the proactive management of
operational risk.
Source: Sound Practices for the Management & Supervision
of Operational Risk (Basel Committee – July 2002)
21

22. The 6σ Process
Key Risk Indicators
(Dashboards)
Establish
Controls
Operational Risk
Assessment & Analysis
Project
Selection
Measurement
System Validation
SIPOC
New
Process
Capability
New Process
Pilot
Capability
Baseline
IMPROVE
Measurement
System Validation
New Policies
& Procedures
Process
Specifications
Process Risk
Mapping
Confirm
Impact
Correlation
Analysis
Identify Key
Risk Drivers
22

23. Monitoring & Updating
SP
C
An
a
ly
si
s
&
E
&
C
Li
n
es


es
s
Co
nt
Ca
pa
ro
l
bi
lit
y
ss
Ch
ar
ts
pi
ng
ap
M

Pr
oc
e
A
RI
M
Risk Solutions




Operational Risk Definition & Analysis
us
in
Risk Profiling



B
Quantification & Modelling




1
Identification & Risk Mapping




Le
ve
l
Creating Management Awareness
An
al
ys
i
s
Operational Risk
Management
Framework
O
Level 2 & Activity Groups
Mapping 6σ to Operational Risk Framework
Natural Linkage to Operational Risk Management Framework
••Natural Linkage to Operational Risk Management Framework
Operates at Level 1, Level 2 and Activity Group Level (All Business Lines)
••Operates at Level 1, Level 2 and Activity Group Level (All Business Lines)
Linked to All Products, Activities, Processes, and Systems
••Linked to All Products, Activities, Processes, and Systems
DMAIC Employed to Improve Existing Policies, Procedures, and
••DMAIC Employed to Improve Existing Policies, Procedures, and
Processes….DFSS Leveraged to Design New Ones
Processes….DFSS Leveraged to Design New Ones

24. Operational Risk Management Using 6σ
Operational Risk Internal Measurement Analysis (ORIMA)
Business Line
Probability
Risk
of Loss
(Exposure
Event (PE)
Indicator - EI)
Loss
Given
Event
Occurs
(LGE)
Expected
Loss (EL)
Potential Risk
Factors
Potential Failure
Effects
Potential
Causes
Current
Controls
1 Corporate Finance
-
-
-
-
0.50
0.10
100
5.00
2
Trading and Sales
-
-
-
-
-
-
-
-
3
Retail Banking
-
-
-
-
-
-
-
-
4
Commercial Banking
-
-
-
-
-
-
-
-
5
Payment and Settlement
-
-
-
-
-
-
6
Agency Services
-
-
-
-
7
Asset Management
-
-
-
-
8
Retail Brokerage
-
-
-
-
Business Line Description
Six Sigma Focus
• Identify Risks
• Describe Outcome of Failure
• Determine Cause & -Effect • Evaluate Current Controls
ORIMA Drills-Down From Top Level
ORIMA Drills-Down From Top Level
Business Line to the Processes
Business Line to the Processes
Within Each Activity Group
Within Each Activity Group
Expected
Loss Factors
24

25. Operational Risk Management Using 6σ
Methods
Operational Risk Internal Measurement Analysis (ORIMA)
Expected
Loss (EL)
0.10
100
5.00
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
Potential
Causes
Current
Controls
1 Corporate Finance
-
-
-
-
0.50
2
Trading and Sales
-
-
-
-
3
Retail Banking
-
-
-
-
4
Commercial Banking
-
-
-
5
Payment and Settlement
-
-
6
Agency Services
-
-
7
Asset Management
-
8
Retail Brokerage
-
Business Line Description
Key Risk Indicators
(Dashboards)
Establish
Controls
Operational Risk
Assessment & Analysis
Processor Review
Measurement System
Validation
Disclosures
Application
SIPOC
New Process
Capability
Create approval letter
Capability
Baseline
New Process
Pilot
Fast Loan
Approval
IMPROVE
Measurement
System Validation
# of loan processors
Process Risk
Mapping
Confirm
Internet capability
Identify Key
Impact
Correlation
Process Capability Analysis for Risk Drivers CT_
Approval
Enter in
System
Loan
Approval
Notify Bank &
Customer
Prepare
Documents
Pareto Chart for Loan Amount
120.000
*
LSL
Mean
Sample N
StDev (Within)
StDev (Overall)
Approve Loan
Amount
*
98.126
530
19.2991
19.5817
Within
Disperse
Funds
Regression Plot
30
50
70
90
+ 1327.06 pH**2
Pp
PPU
PPL
Ppk
*
R-Sq(adj)Observed Performance
= 40.0 %
PPM < LSL
*
PPM
Quadratic > UB
Model
*
*
60
200
40
20
0
Cpm PLT.YLD. = 68371.0 -*19042.9 pH
150
300
100
*
*
Overall R-Sq = 42.5 %
Capability
S = 18.7123
80
400
PPM Total
*
133962.26
133962.26
110
130
Exp. "Within" Performance
PPM < LSL
*
PPM > UB
PPM Total
*
*
150
100
I Chart for Approval
170
Exp. "Overall" Performance
PPM < LSL
*
PPM 150
> UB
PPM Total
Individual Value
Enter in
System
PLT.YLD.
Customer
Signs
Paperwork
100
500
Overall
Potential (Within) Capability
Cp
*
CPU
*
CPL
Cpk
Environment
UB
Upper Bound
Target
YES
Machine
Analysis
Notify Bank
Manager &
CustomerProcess Data
C oun t
Review
Application
Defect
Count
Percent
Cum %
0
1
<$
60
254
47.9
47.9
,0 0
0
$1
60
100
Mean=98.13
1
0
7.1
7.2
0 -$
164
30.9
78.9
50
pH
,00
UCL=156.0
*
*
50
7.0
# of underwriters
Remote Printing
Credit Score
Process
Specifications
NO
Easy to understand instructions
Loan amount
Manager approval
Project
Selection
New Policies &
Procedures
Receive Loan
Application
Material
-
-
Potential Failure
Effects
100
200
300
400
500
Observation Number
The Discipline and Its Approach,
The Discipline and Its Approach,
Combined With a Rich Set of Analysis
Combined With a Rich Set of Analysis
Tools, Makes Six Sigma a Perfect Fit
Tools, Makes Six Sigma a Perfect Fit
for Operational Risk Management
for Operational Risk Management
LCL=40.23
19
9 ,0
00
$2
,00
00
29
0-$
53
10.0
88.9
9 ,0
01
0
$3
0 ,0
00
-$ 4
38
7.2
96.0
99
,00
2
e rs
Oth
21
4.0
100.0
P ercen t
Loss
Given
Event
Occurs
(LGE)
Business Line
Probability
Risk
of Loss
(Exposure
Event (PE)
Indicator - EI)
Potential Risk
Factors

26. A Way Forward
Outside In or Inside Out
• Outside In:
1. Review statistics for comparable businesses and identify risk
by type
2. Identify the processes that lie behind the risk (hierarchy)
3. Perform risk analysis on the key processes (FMEA)
4. Identify key measures inside and outside of the process
5. Collect data
6. Monitor, using dashboards and control charts. Search for
signals
7. Take action as required (DMAIC, Lean, DFSS or other)
26

27. A Way Forward
• Inside Out:
1. Inventory all processes
2. Identify those presenting the greatest risk
3. Identify the sub-processes that lie behind the risk (process
hierarchy)
4. Perform risk analysis on the key processes and subprocesses (FMEA)
5. Identify key measures inside and outside of the process
6. Collect data
7. Monitor, using dashboards and control charts. Search for
signals
8. Take action as required (DMAIC, Lean, DFSS or other)
27

28. Questions?
Further Questions / Information:
Lori Marin
Telephone: 312-381-4420
Email: lori_marin@ars.aon.com
28

29. 29

30. 30