FK
Uploaded byFrackson Kathibula-Nyoni
PPTX, PDF7,646 views

OPERATIONAL RISK MANAGEMENT FRAMEWORK PRESENTATION

The document outlines the National Bank of Malawi's operational risk management framework. It discusses the operational risk policy, roles and responsibilities of the board, management, and risk division. It describes the bank's approach to identifying, assessing, monitoring, and controlling operational risk. The bank has adopted the Basic Indicator Approach to measure operational risk capital charge and has developed business continuity plans to prepare for disasters. The presentation also discusses operational risk incident management guidelines and roles in reporting and addressing incidents.

Embed presentation

Downloaded 485 times
www.natbank.co.mw The Bank of the Nation National Bank of Malawi Operational Risk Management Framework Presentation
www.natbank.co.mw The Bank of the Nation Structure of Risk Management Policy Risk Management Policy Credit Risk Management Framework Operational Risk Management Framework -Operational Risk Policy - Operational Risk Loss Event Reporting Guidelines - Credit Operational Risk Boundary Events Guidelines - Operational Risk Incident Management Guidelines - Business Line Mapping Guidelines - Procedures for Filling Operational Risk Loss Event Reporting Template Market Risk Management Framework Liquidity Risk Management Framework
www.natbank.co.mw The Bank of the Nation Operational Risk Management Policy • Operational Risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. • Lays the framework for formal operational risk management architecture • Establish responsibility for OpRisk identification and analysis, planning for risk mitigation, management and oversight • Purpose of the Policy-ensuring Oprisks to NBM are identified, analyzed, and managed to maintain them at an acceptable level R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities • Board Risk Committee (BRC) • Enterprise Risk Committee (ERCO) • Senior Management • Risk Division • Internal Audit R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Board Risk Committee • Approves broad business strategies and policies that govern Operational Risk • Provide guidance on the level of tolerance for Operational Risk • Establish an appropriate structure and lines of authority for managing Operational Risk • Monitor the Bank’s performance and the overall Operational Risk Profile • Ensure the Bank takes necessary steps to identify, measure, monitor and control OpRisk R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Enterprise Risk Committee (ERCO) • Approve the operational risk governance and management structures of the Bank’s units • Oversee limit breaches and their resolution • Monitor Financial Performance against OpRisk Capital • Review the framework regularly to ensure the Bank managing OpRisk associated with New Products, activities and/or systems R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Senior Management • Implement OpRisk management framework • Develop policies, processes, and procedures for managing OpRisk in all material products, activities, processes and systems • Assign authority, responsibility, and reporting relationships to maintain accountability • Clear communication of OpRisk policies to staff at all levels Bank’s units that incur material operational risks • Enforce operational risk policies • Policies, processes and procedures well-documented R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Senior Management cont’d • Implement strategies in a manner that limits operational risks associated with each strategy and ensures compliance with Laws and Regulations • Maintain adequate systs and stds for measuring OpRisk • Maintain a comprehensive OpRisk reporting and management review process • Maintain effective internal controls and ethical standards • Ensure prudent risk taking against the Bank’s OpRisk Capacity and Appetite + where appropriate initiating risk transfer to mitigate against imprudent levels R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Risk Division • Develop OpRisk policies, philosophies and methodologies • Develop + oversee implementation of ORMF and risk control • Develop + implement an OpRisk limit + capital allocation framework for OpRisk • Monitor OpRisk utilization against hard limits and mngnt action triggers on a regular basis • If breaches occur assess appropriateness + timeliness of corrective actions • Submit reports to senior mngnt + BRC • Instances of non-compliance raised to Senior Mngnt + BRC R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Internal Audit Periodically assess: • Compliance with Banking Act and associated regulations • The validity, reliability and integrity of operational risk information • The valuation process, including the model validation process • The safeguarding of assets in so far as operational risk control is concerned R I S K D I V I S I O N
www.natbank.co.mw The Bank of the Nation Operational Risk Management Approach 1. Tolerance and Appetite The bank has a low appetite and tolerance for material operational risk it is exposed to. Currently, the operational risk loss and tolerance appetite is less than 0.1% of the Core Capital and the tolerance for breaches and fines is 0%.
www.natbank.co.mw The Bank of the Nation 2. Principles for Identifying, Assessing, Monitoring and Controlling/Mitigating OpRisk A. Identification & Assessment i.Risk and Control Self Assessments ii.Risk Maps and Process Flows iii.Risk assessment of new products, processes and systems
www.natbank.co.mw The Bank of the Nation B. Monitoring Monitoring techniques shall include: • Risk and Control Self Assessments • Key Risk Registers • Key Risk Indicators C. Control • Escalation triggers • Breach Logs and Near Misses • Operational Risk Internal Loss data template
www.natbank.co.mw The Bank of the Nation Basel II Operational Risk Categories The categories includes the following: • Handling of internal and external frauds • Employment practices + workplace safety • Clients, Products + Business Practices • Prevention of Damage to Physical Assets • Ensure efficient + secure execution, delivery + process management
www.natbank.co.mw The Bank of the Nation Other OpRisk Mngnt Approach • Appropriate segregation of duties, including indep authorization of transactns • Reconciliation + monitoring of transactns • Compliance to regulatory + legal rquirents • Documentation of controls + procedures • Reporting of Operational losses + remedial actions • Training + professional development • Ethical + business standards
www.natbank.co.mw The Bank of the Nation Measurement of OpRisk Capital Charge The bank has adopted The Basic Indicator Approach (BIA) to measure the amount of capital charge that should be put aside to absorb expected operational losses and to protect the institution against unexpected losses that may be encountered in the normal course of business.
www.natbank.co.mw The Bank of the Nation Business Continuity Planning The Bank shall have a comprehensive business continuity planning (BCP) framework to prepare for disasters and ensure that it will ultimately continue with its business operations of providing services to customers. Disasters in various forms, including fire out breaks, flooding, civil disturbances and equipment failure, can render our bank unit premises (together with their contents) not available for use.
www.natbank.co.mw The Bank of the Nation BCP Continued The BCP process shall include the following: • Business impact analysis (BIA) • Classification of operations and criticality analysis • Development of a BCP and Disaster Recovery Procedures (DRP) • Training and awareness program • Testing and implementation of plan; and • Monitoring.
www.natbank.co.mw The Bank of the Nation SESSION 2 OPERATIONAL RISK INCIDENT MANAGEMENT GUIDELINES
www.natbank.co.mw The Bank of the Nation OpRisk Incident Mngnt Guidelines Purpose • Ensure operational risk incident management process is fit for the purpose, but also enables compliance with regulatory requirements including the qualifying criteria for the Advanced Measurement Approach; • Ensure incident data collected is sound in terms of validity, completeness, accuracy and timeliness to ensure that it may be used to manage incidents, assist management in decision-making and be used in scenario analysis, risk and control self-assessments, key risk indicators and capital modeling;
www.natbank.co.mw The Bank of the Nation Purpose Continued • Aligns relevant definitions, including the basis for reporting gross and net losses, and ensures that they are used consistently across business units in the bank • The current capital charge under the BIA which is 15% of Gross Revenue is high compared to Advanced Approaches if we adopt these good data collection methods
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities 1. ERCO • Set the tone from the top to promote a transparent culture where all staff are encouraged to report incidents while promoting a culture of accountability to avoid a blame culture • Assess the adequacy of actions being taken to address material incidents or trends of incidents • Ensure that the criteria being used to assess the materiality of each incident type is consistent with their operational risk appetite /tolerance
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Continued 2. Business Units shall: • Ensure that all their staff members are aware of this policy and adhere to its minimum requirements • Ensure that OpRisk incidents are identified and recorded as soon as the incident is recognised to have occurred • Define action plans for those incidents (individually or in aggregate) that highlight risk exposures or control weaknesses beyond an acceptable level • Promote a culture of transparency where staff are encouraged to report incidents
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Continued 3. Risk Division shall •Develop and maintain the incident management methodology that ensures that incident data is adequate to meet both internal management /business needs as well as the qualifying criteria for the Advanced Measurement Approach • Maintain a central database of all incidents captured across the bank • Oversee the compliance with the policy and methodology by all units • Develop a bank-level materiality matrix comprising thresholds for the escalation of OpRisk incidents based on materiality and significance
www.natbank.co.mw The Bank of the Nation Minimum Requirements A. Identification of a Reportable Incident • Incidents must include financial and non-financial impacts, and also incidents which could potentially lead to such impacts • All incidents which result in financial impact in excess of a minimum amount must be treated as reportable incidents • All financial crime incidents, irrespective of value, must be recorded to facilitate consideration for investigation by the Investigations Manager. • For incidents which do not result in a direct financial impact, an incident shall be treated as reportable if it reflects a failure of a key control, or an inadequacy of the control framework or operating model, which raises lessons to be learnt. As this remains a judgemental area, if there is any doubt over whether an incident is reportable Operational Risk shall provide case by case guidance on how to treat each incident.
www.natbank.co.mw The Bank of the Nation Minimum Requirements Cont’d B. Reporting an Incident • All staff members are required to report operational incidents except for fraud, forgeries and losses to Risk Division (RD), as soon as possible and at least within 48 hours after the incident is recognised. • Anyone who identifies a reportable incident should use the incident reporting form to report the incident to RD. • In the event that the incident reporting form cannot be completed within the 48 hour deadline, then an e-mail notification of the incident should be sent to RD and the form completed as soon as possible, thereafter.
www.natbank.co.mw The Bank of the Nation Incident Capture and Classification • All reported incidents shall be maintained within a central incident database administered by RD • Operational Risk shall ensure classification of each incident in accordance with the data requirements prescribed within the central database. This will include classification against each of the prescribed taxonomies.
www.natbank.co.mw The Bank of the Nation Measurement of Impact The impact of an incident must be measured in a consistent manner by all BUs, based on the loss measurement methodology provided by RD. This will include the following key elements: • Gross loss The loss incurred before mitigation or recoveries. Gross Loss amount is a key input into the capital model as well as a regulatory requirement. The gross loss amount of an incident must be recorded • Net loss The loss incurred after taking into account recoveries from clients, insurance or other sources
www.natbank.co.mw The Bank of the Nation Data Quality + Completeness • Each unit is responsible for the completeness and accuracy of incident data reported to the central database. Business line management must review and sign off all incidents reported. • A validation between the incidents reported to the central database and the general ledger will be performed.
www.natbank.co.mw The Bank of the Nation Losses that materialize over time In some cases, an incident can span several reporting periods. Additional recoveries or losses relating to the incident must be linked to the original incident, and the date of capture to the general ledger is a key requirement. A typical example is legal cases.
www.natbank.co.mw The Bank of the Nation SESSION 3 OPERATIONAL LOSS EVENT REPORTING GUIDELINES
www.natbank.co.mw The Bank of the Nation Operational Loss Event Reporting Guidelines Purpose: • Formalize and document NBM’s Operational Loss Event Reporting • Ensure effective and comprehensive reporting and classification of loss events that can be attributed to operational risk in line with Basel II regulatory requirements, governance requirements, risk management principles, policies and international best practice • Fulfill the Bank’s legal and statutory obligations
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities 1. Enterprise Risk Committee (ERCO) • Ensuring that systems, processes and procedures are in place for the recording, monitoring, reporting and reviewing of operational loss events, as defined by regulatory or group requirements; and • Monitoring and analyzing operational risk trends
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities continued 2. Risk Division (RD) • Creating awareness of the requirements of this policy • Monitoring implementation of this policy and supportive procedures by management • Regular reporting of operational loss events, as defined by regulatory or business requirements • Liaising with Finance Division officers to validate direct losses (per loss database) associated with operational loss events in the general ledger.
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities continued • Record-keeping of operational loss events • Validating the correctness of regulatory classifications of loss events 3. Heads of Division/Service Centre Mgrs • Reporting, escalating and signing off operational loss events, as defined by regulatory or business requirements • Creating awareness of the requirements of this policy within their area of responsibility
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities continued • Implementing or adjusting business processes to meet the requirements of this policy • Implementing appropriate action plans or controls to address systemic control failures
www.natbank.co.mw The Bank of the Nation Operational loss event reporting principles 1. Open Risk Culture The Bank promotes an open, positive and non- punitive approach towards operational loss event reporting and has therefore adopted an open practice policy to encourage staff to report on operational loss events. The Bank is aiming to ensure that employees feel comfortable in reporting operational loss events in the knowledge that the information provided will be treated constructively and shared only as appropriate. No disciplinary action will be taken against an employee reporting a loss, unless there has been a breach of law, dishonesty or wilIful negligence.
www.natbank.co.mw The Bank of the Nation Reporting Requirements It is the policy of the Bank to report any operational loss event that meets the criteria for being an operational risk direct/indirect loss or a near miss
www.natbank.co.mw The Bank of the Nation SESSION 4 CREDIT OPERATIONAL RISK BOUNDARY EVENTS GUIDELINES
www.natbank.co.mw The Bank of the Nation CREDIT OPRISK BOUNDARY EVENTS GUIDELINES Purpose: • Is intended to complement and give effect to the principles outlined in the Operational Risk Incident Management Policy in respect of all boundary events • Establishes a set of core principles to drive the identification, monitoring, and reporting of credit risk boundary events within the bank, ensuring alignment to regulatory requirements and industry best practice
www.natbank.co.mw The Bank of the Nation CREDIT RISK Credit risk is the risk of loss due to counterparty default. It is understood that, for capital purposes, any write-down value due to loss of recourse may be considered credit loss Credit Risk Boundary Event Operational risk incidents and losses which occur within the credit risk regime (process) and which may on occasion be comingled with credit risk losses.
www.natbank.co.mw The Bank of the Nation Control Failure For management information purposes all Operational Risk / Credit Risk boundary events are to be classified as one of the following: • Opening account document problems • Input into Credit scoring system incorrect / manipulated • Non-compliance with policy • Non-compliance with processes • Non-compliance with legislation • Non-Compliance with conditions of Grant • Security lost/not enforceable • Facility letter incorrect • Facility captured incorrectly • Faulty valuation methodology used Mandate exceeded
www.natbank.co.mw The Bank of the Nation Operational Risk Operational Risk is the risk of loss suffered as a result of inadequacy of, or a failure in, internal processes, people and systems or from external events. This includes information risk and legal risk, but excludes reputational risk and strategic risk.
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities 1. Business Unit Management • Ensure that Credit Risk boundary events i.e. Type 1 and 2 are reported through to the relevant business Unit, and Risk Division immediately upon identification; • Ensure that a detailed explanation of the loss is prepared • Ensure that the root causes are understood and appropriate remedial actions are taken in response to lessons learnt
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Cont’d 2. Risk Division • Facilitate a discussion around the underlying causes of the reported credit risk boundary event; • Undertake a review of Business Unit data in order to ensure that all data regarding credit risk boundary event have been duly reported
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Cont’d • Establish whether the reported credit risk boundary event was correctly categorised by Business Unit Management; • Quantify the portion of the credit risk boundary event attributable to the operational risk incident:  The rationale used for the attribution must be clearly documented; and  Such attribution must be approved by the Heads of Risk and Credit;
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Cont’d • Ensure that the credit risk boundary event is properly captured on the Operational Risk Loss Data Reporting template; and • Ensure that the Business Unit are taking the relevant action to address the root causes of the incidents
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Cont’d 3. Enterprise Risk Committee (ERCO) • Consider items raised to it and advise on the relevant classification between the event types defined in this policy; • Consider losses referred to it by the Business Units and decide on the appropriate attribution of the loss amount
www.natbank.co.mw The Bank of the Nation Roles and Responsibilities Cont’d • Ensure such decisions are consistent with the treatment of any similar items; • Ensure that the rationale and assumptions pertaining to such an attribution are clearly documented and available for independent scrutiny • Monitor and report non-compliance with the policy to the Board Risk Committee • Undertake an annual review of these guidelines and underlying methodology to ensure it remains fit for purpose and practical to implement
www.natbank.co.mw The Bank of the Nation Minimum Requirements • Each Business Unit must institute a process in order to identify, monitor and report all material operational risk incidents which are related to credit risk • The Business Unit management, in conjunction with Risk Division must ensure that the incident is captured onto the Operational Risk Loss Data Reporting template and “flagged” as a Boundary Event. The incident report should also comply with the requirements for any operational risk incident set out in the Operational Risk Incident Management Policy.
www.natbank.co.mw The Bank of the Nation Minimum Requirements • Where there is a material loss arising from the operational risk component of a credit related incident, this amount must be separately identified in accordance with this policy and separately recorded as an operational risk loss in the operational risk loss data reporting template • However, this loss must be excluded from the operational risk loss data set which is used for operational risk capital modeling purposes
www.natbank.co.mw The Bank of the Nation Identification + Classification Type 1 – Operational Credit Risk Boundary Event Where there has been an operational risk incident related to a credit process resulting in a loss but where the loss is not related to the credit worthiness of the counterparty, the event is to be treated as an operational credit risk boundary event; Type 2 – Operational Risk /Credit Risk Boundary Event In the case of a loss that arises due to the credit worthiness of a counterparty but where an operational risk incident has contributed to the severity of the loss, the event is to be treated as an operational risk /credit risk boundary event;
www.natbank.co.mw The Bank of the Nation Identification + Classification Type 3 – Credit Risk Event In a case of a loss wholly related to the credit worthiness of the counterparty, it is to be treated as a credit risk event with no further implications for operational risk reporting; and Type 4 – Operational Risk Event Where there has been an operational risk incident not related to a credit process and not resulting in a credit default, the event is to be treated as a pure operational risk event. The total amount of loss is to be classified as operational risk loss. The incident is to be captured as an operational risk loss.

More Related Content

PPTX
Operational Risk Management
byAsad Hameed
 
PPT
Operational Risk Management - Understanding Your Risk Landscape
byEneni Oduwole
 
PDF
Operational risk management and measurement
byRahmat Mulyana
 
PDF
Operational risk management (orm)
byBushra Angbeen
 
PPT
operations risk management power point presentation.
byMiyelani Shibambo
 
PPT
Operational Risk Management Under Basel II & Basel III
byEneni Oduwole
 
PDF
Operational Risk Management
byarsqureshi
 
PPTX
Operation Risk Management in Banking Sector
bySanjay Kumbhar
 
Operational Risk Management
byAsad Hameed
 
Operational Risk Management - Understanding Your Risk Landscape
byEneni Oduwole
 
Operational risk management and measurement
byRahmat Mulyana
 
Operational risk management (orm)
byBushra Angbeen
 
operations risk management power point presentation.
byMiyelani Shibambo
 
Operational Risk Management Under Basel II & Basel III
byEneni Oduwole
 
Operational Risk Management
byarsqureshi
 
Operation Risk Management in Banking Sector
bySanjay Kumbhar
 

What's hot

PPT
Operational Risk for Bank
byRahmat Mulyana
 
PPTX
Operational Risk Management - A Gateway to managing the risk profile of your...
byEneni Oduwole
 
PPT
Operational risk management (2)
byUjjwal 'Shanu'
 
PPT
Coso erm
byHumberto Omar Valverde Taborga
 
PPTX
Risk management
byManish Tiwari
 
PPTX
Key risk indicators shareslide
byZakaria Salah, Ph.D,MBA
 
PPTX
KRI (Key Risk Indicators) & IT
byMax Neira Schliemann
 
PDF
Risk Appetite: A new Menu under Basel 3? Pieter Klaassen (UBS) voor het Zande...
byZanders Treasury, Risk and Finance
 
PDF
Risk Appetite
byTowers Perrin
 
PPT
Measuring operational risk
byUjjwal 'Shanu'
 
PDF
Sharing Practice on Enterprise Risk Management (ERM)
byDiane Christina
 
PDF
127017438_RMA_OperationalRiskAppetite_v1.0
byRachael Phelan
 
PDF
Riskpro - Operational Risk Management
byManoj Jain
 
PPTX
Operational risk ppt
byNehaKamboj10
 
PDF
Risk Management Overview
byJIGNESH PADIA
 
PDF
Introduction to Risk Management ISO31000:2009
byAhmad Azwang Aisram Omar
 
PPTX
Integrating Risk into your Balanced Scorecard
byAndrew Smart
 
PDF
Risk appetite
byMichel Rochette
 
PPTX
COSO VS ERM -
byNaresh Parandhaman
 
PPTX
10 Key Principles of Operational Risk Management
byColleen Beck-Domanico
 
Operational Risk for Bank
byRahmat Mulyana
 
Operational Risk Management - A Gateway to managing the risk profile of your...
byEneni Oduwole
 
Operational risk management (2)
byUjjwal 'Shanu'
 
Coso erm
byHumberto Omar Valverde Taborga
 
Risk management
byManish Tiwari
 
Key risk indicators shareslide
byZakaria Salah, Ph.D,MBA
 
KRI (Key Risk Indicators) & IT
byMax Neira Schliemann
 
Risk Appetite: A new Menu under Basel 3? Pieter Klaassen (UBS) voor het Zande...
byZanders Treasury, Risk and Finance
 
Risk Appetite
byTowers Perrin
 
Measuring operational risk
byUjjwal 'Shanu'
 
Sharing Practice on Enterprise Risk Management (ERM)
byDiane Christina
 
127017438_RMA_OperationalRiskAppetite_v1.0
byRachael Phelan
 
Riskpro - Operational Risk Management
byManoj Jain
 
Operational risk ppt
byNehaKamboj10
 
Risk Management Overview
byJIGNESH PADIA
 
Introduction to Risk Management ISO31000:2009
byAhmad Azwang Aisram Omar
 
Integrating Risk into your Balanced Scorecard
byAndrew Smart
 
Risk appetite
byMichel Rochette
 
COSO VS ERM -
byNaresh Parandhaman
 
10 Key Principles of Operational Risk Management
byColleen Beck-Domanico
 

Similar to OPERATIONAL RISK MANAGEMENT FRAMEWORK PRESENTATION

PDF
operational risk managemnt
byAshima Thakur
 
PDF
operational risk management in banks
byAshima Thakur
 
PPTX
Punjab national bank
byTakur Singh
 
PPTX
Operational risk (by ms.sweta vijuraj)
bySaras Singh
 
PDF
Enterprise-Wide Risk - The Missing Link in Indian Financial Institutions
byRam Garg
 
PPT
Operational risk management
byUjjwal 'Shanu'
 
PPTX
Operational Risk Management
byAsad Hameed
 
PPTX
operational risk Assessment training.pptx
byshiva3305
 
PDF
ORM 2011
byMostafa Khedr
 
PPTX
Operational Risk Managment, ORM refined,approved.pptx
byShiferaw Biru
 
PDF
BCSCI Rosenblatt 2017 - Mike Pinedo slides
byThe Boeing Center
 
PPTX
Operational Risk : Take a look at the raw canvas
byTreat Risk
 
PDF
Operational Risk Management under BASEL era
byTreat Risk
 
DOC
Basel II
byEagle-Eye Management Consultancy (UK) Limited
 
DOCX
IBIRONKE_FAGBEMI_CV
byIBIRONKEABEBI FAGBEMI
 
PPTX
Managing Operational Risk in Banks Bangladesh.pptx
byMatiurRahman60
 
PDF
BCG-Five-Practices-of-Operational-Risk-Leaders-Oct-2016_tcm80-214941
byDr. Marc D. Grüter
 
PPT
Operational risk & incident reporting
byShivaLeela Choudary
 
PDF
Operational risk-white-paper
byVincenzo Dimase
 
PDF
Introduction to Operational Risk Management for Bank Junior Officers in India
bymlvenkat
 
operational risk managemnt
byAshima Thakur
 
operational risk management in banks
byAshima Thakur
 
Punjab national bank
byTakur Singh
 
Operational risk (by ms.sweta vijuraj)
bySaras Singh
 
Enterprise-Wide Risk - The Missing Link in Indian Financial Institutions
byRam Garg
 
Operational risk management
byUjjwal 'Shanu'
 
Operational Risk Management
byAsad Hameed
 
operational risk Assessment training.pptx
byshiva3305
 
ORM 2011
byMostafa Khedr
 
Operational Risk Managment, ORM refined,approved.pptx
byShiferaw Biru
 
BCSCI Rosenblatt 2017 - Mike Pinedo slides
byThe Boeing Center
 
Operational Risk : Take a look at the raw canvas
byTreat Risk
 
Operational Risk Management under BASEL era
byTreat Risk
 
Basel II
byEagle-Eye Management Consultancy (UK) Limited
 
IBIRONKE_FAGBEMI_CV
byIBIRONKEABEBI FAGBEMI
 
Managing Operational Risk in Banks Bangladesh.pptx
byMatiurRahman60
 
BCG-Five-Practices-of-Operational-Risk-Leaders-Oct-2016_tcm80-214941
byDr. Marc D. Grüter
 
Operational risk & incident reporting
byShivaLeela Choudary
 
Operational risk-white-paper
byVincenzo Dimase
 
Introduction to Operational Risk Management for Bank Junior Officers in India
bymlvenkat
 

OPERATIONAL RISK MANAGEMENT FRAMEWORK PRESENTATION

  • 1.
    www.natbank.co.mw The Bankof the Nation National Bank of Malawi Operational Risk Management Framework Presentation
  • 2.
    www.natbank.co.mw The Bankof the Nation Structure of Risk Management Policy Risk Management Policy Credit Risk Management Framework Operational Risk Management Framework -Operational Risk Policy - Operational Risk Loss Event Reporting Guidelines - Credit Operational Risk Boundary Events Guidelines - Operational Risk Incident Management Guidelines - Business Line Mapping Guidelines - Procedures for Filling Operational Risk Loss Event Reporting Template Market Risk Management Framework Liquidity Risk Management Framework
  • 3.
    www.natbank.co.mw The Bankof the Nation Operational Risk Management Policy • Operational Risk is the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. • Lays the framework for formal operational risk management architecture • Establish responsibility for OpRisk identification and analysis, planning for risk mitigation, management and oversight • Purpose of the Policy-ensuring Oprisks to NBM are identified, analyzed, and managed to maintain them at an acceptable level R I S K D I V I S I O N
  • 4.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities • Board Risk Committee (BRC) • Enterprise Risk Committee (ERCO) • Senior Management • Risk Division • Internal Audit R I S K D I V I S I O N
  • 5.
    www.natbank.co.mw The Bankof the Nation Board Risk Committee • Approves broad business strategies and policies that govern Operational Risk • Provide guidance on the level of tolerance for Operational Risk • Establish an appropriate structure and lines of authority for managing Operational Risk • Monitor the Bank’s performance and the overall Operational Risk Profile • Ensure the Bank takes necessary steps to identify, measure, monitor and control OpRisk R I S K D I V I S I O N
  • 6.
    www.natbank.co.mw The Bankof the Nation Enterprise Risk Committee (ERCO) • Approve the operational risk governance and management structures of the Bank’s units • Oversee limit breaches and their resolution • Monitor Financial Performance against OpRisk Capital • Review the framework regularly to ensure the Bank managing OpRisk associated with New Products, activities and/or systems R I S K D I V I S I O N
  • 7.
    www.natbank.co.mw The Bankof the Nation Senior Management • Implement OpRisk management framework • Develop policies, processes, and procedures for managing OpRisk in all material products, activities, processes and systems • Assign authority, responsibility, and reporting relationships to maintain accountability • Clear communication of OpRisk policies to staff at all levels Bank’s units that incur material operational risks • Enforce operational risk policies • Policies, processes and procedures well-documented R I S K D I V I S I O N
  • 8.
    www.natbank.co.mw The Bankof the Nation Senior Management cont’d • Implement strategies in a manner that limits operational risks associated with each strategy and ensures compliance with Laws and Regulations • Maintain adequate systs and stds for measuring OpRisk • Maintain a comprehensive OpRisk reporting and management review process • Maintain effective internal controls and ethical standards • Ensure prudent risk taking against the Bank’s OpRisk Capacity and Appetite + where appropriate initiating risk transfer to mitigate against imprudent levels R I S K D I V I S I O N
  • 9.
    www.natbank.co.mw The Bankof the Nation Risk Division • Develop OpRisk policies, philosophies and methodologies • Develop + oversee implementation of ORMF and risk control • Develop + implement an OpRisk limit + capital allocation framework for OpRisk • Monitor OpRisk utilization against hard limits and mngnt action triggers on a regular basis • If breaches occur assess appropriateness + timeliness of corrective actions • Submit reports to senior mngnt + BRC • Instances of non-compliance raised to Senior Mngnt + BRC R I S K D I V I S I O N
  • 10.
    www.natbank.co.mw The Bankof the Nation Internal Audit Periodically assess: • Compliance with Banking Act and associated regulations • The validity, reliability and integrity of operational risk information • The valuation process, including the model validation process • The safeguarding of assets in so far as operational risk control is concerned R I S K D I V I S I O N
  • 11.
    www.natbank.co.mw The Bankof the Nation Operational Risk Management Approach 1. Tolerance and Appetite The bank has a low appetite and tolerance for material operational risk it is exposed to. Currently, the operational risk loss and tolerance appetite is less than 0.1% of the Core Capital and the tolerance for breaches and fines is 0%.
  • 12.
    www.natbank.co.mw The Bankof the Nation 2. Principles for Identifying, Assessing, Monitoring and Controlling/Mitigating OpRisk A. Identification & Assessment i.Risk and Control Self Assessments ii.Risk Maps and Process Flows iii.Risk assessment of new products, processes and systems
  • 13.
    www.natbank.co.mw The Bankof the Nation B. Monitoring Monitoring techniques shall include: • Risk and Control Self Assessments • Key Risk Registers • Key Risk Indicators C. Control • Escalation triggers • Breach Logs and Near Misses • Operational Risk Internal Loss data template
  • 14.
    www.natbank.co.mw The Bankof the Nation Basel II Operational Risk Categories The categories includes the following: • Handling of internal and external frauds • Employment practices + workplace safety • Clients, Products + Business Practices • Prevention of Damage to Physical Assets • Ensure efficient + secure execution, delivery + process management
  • 15.
    www.natbank.co.mw The Bankof the Nation Other OpRisk Mngnt Approach • Appropriate segregation of duties, including indep authorization of transactns • Reconciliation + monitoring of transactns • Compliance to regulatory + legal rquirents • Documentation of controls + procedures • Reporting of Operational losses + remedial actions • Training + professional development • Ethical + business standards
  • 16.
    www.natbank.co.mw The Bankof the Nation Measurement of OpRisk Capital Charge The bank has adopted The Basic Indicator Approach (BIA) to measure the amount of capital charge that should be put aside to absorb expected operational losses and to protect the institution against unexpected losses that may be encountered in the normal course of business.
  • 17.
    www.natbank.co.mw The Bankof the Nation Business Continuity Planning The Bank shall have a comprehensive business continuity planning (BCP) framework to prepare for disasters and ensure that it will ultimately continue with its business operations of providing services to customers. Disasters in various forms, including fire out breaks, flooding, civil disturbances and equipment failure, can render our bank unit premises (together with their contents) not available for use.
  • 18.
    www.natbank.co.mw The Bankof the Nation BCP Continued The BCP process shall include the following: • Business impact analysis (BIA) • Classification of operations and criticality analysis • Development of a BCP and Disaster Recovery Procedures (DRP) • Training and awareness program • Testing and implementation of plan; and • Monitoring.
  • 19.
    www.natbank.co.mw The Bankof the Nation SESSION 2 OPERATIONAL RISK INCIDENT MANAGEMENT GUIDELINES
  • 20.
    www.natbank.co.mw The Bankof the Nation OpRisk Incident Mngnt Guidelines Purpose • Ensure operational risk incident management process is fit for the purpose, but also enables compliance with regulatory requirements including the qualifying criteria for the Advanced Measurement Approach; • Ensure incident data collected is sound in terms of validity, completeness, accuracy and timeliness to ensure that it may be used to manage incidents, assist management in decision-making and be used in scenario analysis, risk and control self-assessments, key risk indicators and capital modeling;
  • 21.
    www.natbank.co.mw The Bankof the Nation Purpose Continued • Aligns relevant definitions, including the basis for reporting gross and net losses, and ensures that they are used consistently across business units in the bank • The current capital charge under the BIA which is 15% of Gross Revenue is high compared to Advanced Approaches if we adopt these good data collection methods
  • 22.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities 1. ERCO • Set the tone from the top to promote a transparent culture where all staff are encouraged to report incidents while promoting a culture of accountability to avoid a blame culture • Assess the adequacy of actions being taken to address material incidents or trends of incidents • Ensure that the criteria being used to assess the materiality of each incident type is consistent with their operational risk appetite /tolerance
  • 23.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Continued 2. Business Units shall: • Ensure that all their staff members are aware of this policy and adhere to its minimum requirements • Ensure that OpRisk incidents are identified and recorded as soon as the incident is recognised to have occurred • Define action plans for those incidents (individually or in aggregate) that highlight risk exposures or control weaknesses beyond an acceptable level • Promote a culture of transparency where staff are encouraged to report incidents
  • 24.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Continued 3. Risk Division shall •Develop and maintain the incident management methodology that ensures that incident data is adequate to meet both internal management /business needs as well as the qualifying criteria for the Advanced Measurement Approach • Maintain a central database of all incidents captured across the bank • Oversee the compliance with the policy and methodology by all units • Develop a bank-level materiality matrix comprising thresholds for the escalation of OpRisk incidents based on materiality and significance
  • 25.
    www.natbank.co.mw The Bankof the Nation Minimum Requirements A. Identification of a Reportable Incident • Incidents must include financial and non-financial impacts, and also incidents which could potentially lead to such impacts • All incidents which result in financial impact in excess of a minimum amount must be treated as reportable incidents • All financial crime incidents, irrespective of value, must be recorded to facilitate consideration for investigation by the Investigations Manager. • For incidents which do not result in a direct financial impact, an incident shall be treated as reportable if it reflects a failure of a key control, or an inadequacy of the control framework or operating model, which raises lessons to be learnt. As this remains a judgemental area, if there is any doubt over whether an incident is reportable Operational Risk shall provide case by case guidance on how to treat each incident.
  • 26.
    www.natbank.co.mw The Bankof the Nation Minimum Requirements Cont’d B. Reporting an Incident • All staff members are required to report operational incidents except for fraud, forgeries and losses to Risk Division (RD), as soon as possible and at least within 48 hours after the incident is recognised. • Anyone who identifies a reportable incident should use the incident reporting form to report the incident to RD. • In the event that the incident reporting form cannot be completed within the 48 hour deadline, then an e-mail notification of the incident should be sent to RD and the form completed as soon as possible, thereafter.
  • 27.
    www.natbank.co.mw The Bankof the Nation Incident Capture and Classification • All reported incidents shall be maintained within a central incident database administered by RD • Operational Risk shall ensure classification of each incident in accordance with the data requirements prescribed within the central database. This will include classification against each of the prescribed taxonomies.
  • 28.
    www.natbank.co.mw The Bankof the Nation Measurement of Impact The impact of an incident must be measured in a consistent manner by all BUs, based on the loss measurement methodology provided by RD. This will include the following key elements: • Gross loss The loss incurred before mitigation or recoveries. Gross Loss amount is a key input into the capital model as well as a regulatory requirement. The gross loss amount of an incident must be recorded • Net loss The loss incurred after taking into account recoveries from clients, insurance or other sources
  • 29.
    www.natbank.co.mw The Bankof the Nation Data Quality + Completeness • Each unit is responsible for the completeness and accuracy of incident data reported to the central database. Business line management must review and sign off all incidents reported. • A validation between the incidents reported to the central database and the general ledger will be performed.
  • 30.
    www.natbank.co.mw The Bankof the Nation Losses that materialize over time In some cases, an incident can span several reporting periods. Additional recoveries or losses relating to the incident must be linked to the original incident, and the date of capture to the general ledger is a key requirement. A typical example is legal cases.
  • 31.
    www.natbank.co.mw The Bankof the Nation SESSION 3 OPERATIONAL LOSS EVENT REPORTING GUIDELINES
  • 32.
    www.natbank.co.mw The Bankof the Nation Operational Loss Event Reporting Guidelines Purpose: • Formalize and document NBM’s Operational Loss Event Reporting • Ensure effective and comprehensive reporting and classification of loss events that can be attributed to operational risk in line with Basel II regulatory requirements, governance requirements, risk management principles, policies and international best practice • Fulfill the Bank’s legal and statutory obligations
  • 33.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities 1. Enterprise Risk Committee (ERCO) • Ensuring that systems, processes and procedures are in place for the recording, monitoring, reporting and reviewing of operational loss events, as defined by regulatory or group requirements; and • Monitoring and analyzing operational risk trends
  • 34.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities continued 2. Risk Division (RD) • Creating awareness of the requirements of this policy • Monitoring implementation of this policy and supportive procedures by management • Regular reporting of operational loss events, as defined by regulatory or business requirements • Liaising with Finance Division officers to validate direct losses (per loss database) associated with operational loss events in the general ledger.
  • 35.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities continued • Record-keeping of operational loss events • Validating the correctness of regulatory classifications of loss events 3. Heads of Division/Service Centre Mgrs • Reporting, escalating and signing off operational loss events, as defined by regulatory or business requirements • Creating awareness of the requirements of this policy within their area of responsibility
  • 36.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities continued • Implementing or adjusting business processes to meet the requirements of this policy • Implementing appropriate action plans or controls to address systemic control failures
  • 37.
    www.natbank.co.mw The Bankof the Nation Operational loss event reporting principles 1. Open Risk Culture The Bank promotes an open, positive and non- punitive approach towards operational loss event reporting and has therefore adopted an open practice policy to encourage staff to report on operational loss events. The Bank is aiming to ensure that employees feel comfortable in reporting operational loss events in the knowledge that the information provided will be treated constructively and shared only as appropriate. No disciplinary action will be taken against an employee reporting a loss, unless there has been a breach of law, dishonesty or wilIful negligence.
  • 38.
    www.natbank.co.mw The Bankof the Nation Reporting Requirements It is the policy of the Bank to report any operational loss event that meets the criteria for being an operational risk direct/indirect loss or a near miss
  • 39.
    www.natbank.co.mw The Bankof the Nation SESSION 4 CREDIT OPERATIONAL RISK BOUNDARY EVENTS GUIDELINES
  • 40.
    www.natbank.co.mw The Bankof the Nation CREDIT OPRISK BOUNDARY EVENTS GUIDELINES Purpose: • Is intended to complement and give effect to the principles outlined in the Operational Risk Incident Management Policy in respect of all boundary events • Establishes a set of core principles to drive the identification, monitoring, and reporting of credit risk boundary events within the bank, ensuring alignment to regulatory requirements and industry best practice
  • 41.
    www.natbank.co.mw The Bankof the Nation CREDIT RISK Credit risk is the risk of loss due to counterparty default. It is understood that, for capital purposes, any write-down value due to loss of recourse may be considered credit loss Credit Risk Boundary Event Operational risk incidents and losses which occur within the credit risk regime (process) and which may on occasion be comingled with credit risk losses.
  • 42.
    www.natbank.co.mw The Bankof the Nation Control Failure For management information purposes all Operational Risk / Credit Risk boundary events are to be classified as one of the following: • Opening account document problems • Input into Credit scoring system incorrect / manipulated • Non-compliance with policy • Non-compliance with processes • Non-compliance with legislation • Non-Compliance with conditions of Grant • Security lost/not enforceable • Facility letter incorrect • Facility captured incorrectly • Faulty valuation methodology used Mandate exceeded
  • 43.
    www.natbank.co.mw The Bankof the Nation Operational Risk Operational Risk is the risk of loss suffered as a result of inadequacy of, or a failure in, internal processes, people and systems or from external events. This includes information risk and legal risk, but excludes reputational risk and strategic risk.
  • 44.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities 1. Business Unit Management • Ensure that Credit Risk boundary events i.e. Type 1 and 2 are reported through to the relevant business Unit, and Risk Division immediately upon identification; • Ensure that a detailed explanation of the loss is prepared • Ensure that the root causes are understood and appropriate remedial actions are taken in response to lessons learnt
  • 45.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Cont’d 2. Risk Division • Facilitate a discussion around the underlying causes of the reported credit risk boundary event; • Undertake a review of Business Unit data in order to ensure that all data regarding credit risk boundary event have been duly reported
  • 46.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Cont’d • Establish whether the reported credit risk boundary event was correctly categorised by Business Unit Management; • Quantify the portion of the credit risk boundary event attributable to the operational risk incident:  The rationale used for the attribution must be clearly documented; and  Such attribution must be approved by the Heads of Risk and Credit;
  • 47.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Cont’d • Ensure that the credit risk boundary event is properly captured on the Operational Risk Loss Data Reporting template; and • Ensure that the Business Unit are taking the relevant action to address the root causes of the incidents
  • 48.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Cont’d 3. Enterprise Risk Committee (ERCO) • Consider items raised to it and advise on the relevant classification between the event types defined in this policy; • Consider losses referred to it by the Business Units and decide on the appropriate attribution of the loss amount
  • 49.
    www.natbank.co.mw The Bankof the Nation Roles and Responsibilities Cont’d • Ensure such decisions are consistent with the treatment of any similar items; • Ensure that the rationale and assumptions pertaining to such an attribution are clearly documented and available for independent scrutiny • Monitor and report non-compliance with the policy to the Board Risk Committee • Undertake an annual review of these guidelines and underlying methodology to ensure it remains fit for purpose and practical to implement
  • 50.
    www.natbank.co.mw The Bankof the Nation Minimum Requirements • Each Business Unit must institute a process in order to identify, monitor and report all material operational risk incidents which are related to credit risk • The Business Unit management, in conjunction with Risk Division must ensure that the incident is captured onto the Operational Risk Loss Data Reporting template and “flagged” as a Boundary Event. The incident report should also comply with the requirements for any operational risk incident set out in the Operational Risk Incident Management Policy.
  • 51.
    www.natbank.co.mw The Bankof the Nation Minimum Requirements • Where there is a material loss arising from the operational risk component of a credit related incident, this amount must be separately identified in accordance with this policy and separately recorded as an operational risk loss in the operational risk loss data reporting template • However, this loss must be excluded from the operational risk loss data set which is used for operational risk capital modeling purposes
  • 52.
    www.natbank.co.mw The Bankof the Nation Identification + Classification Type 1 – Operational Credit Risk Boundary Event Where there has been an operational risk incident related to a credit process resulting in a loss but where the loss is not related to the credit worthiness of the counterparty, the event is to be treated as an operational credit risk boundary event; Type 2 – Operational Risk /Credit Risk Boundary Event In the case of a loss that arises due to the credit worthiness of a counterparty but where an operational risk incident has contributed to the severity of the loss, the event is to be treated as an operational risk /credit risk boundary event;
  • 53.
    www.natbank.co.mw The Bankof the Nation Identification + Classification Type 3 – Credit Risk Event In a case of a loss wholly related to the credit worthiness of the counterparty, it is to be treated as a credit risk event with no further implications for operational risk reporting; and Type 4 – Operational Risk Event Where there has been an operational risk incident not related to a credit process and not resulting in a credit default, the event is to be treated as a pure operational risk event. The total amount of loss is to be classified as operational risk loss. The incident is to be captured as an operational risk loss.