SESSION/SÉANCE : PS-1

Transcription

1 1

2 SESSION/SÉANCE : PS-1 (Joint session) The Insurance Company and Operational Risk SPEAKER(S)/CONFÉRENCIER(S) : Elaine Lajeunesse, FCIA, FCSA, CFA Vice President & Chief Risk Officer, Insurance BMO Financial Group Tim Deacon, CA, CPA Senior Vice President, Enterprise Risk Management Manulife Financial Moderated by: Ralph Ovsec, FSA, FCIA Vice President, Senior Corporate Actuary Manulife Financial 2

3 Discussion Topics Operational Risk 101 Recent loss events and lessons learned Industry operational risk implementation experience: BMO approach to Operational Risk management MFC approach to Operational Risk management 3

4 Operational Risk 101 What is operational risk? Risk of loss resulting from inadequate or failed internal processes, systems failures, or human performance failures or from external events excludes reputational risk and strategic risk Processes People Systems External Events Events Loss 4

5 Operational Risk 101 Operational Risks Process Fraud Human Resources Regulatory AML Accounting & Financial Management Privacy Project & Change Management Legal Taxation Business Continuity Model Information Technology Information Risk Outsourcing / Supplier Management Property Physical Security 5

6 Operational Risk 101 Basel sound principles Regulatory perspective on ORM through 11 core principles. First issued in 2003 and updated in 2011 OSFI requires Banks to comply. Insurance requirements expected to be similar. Governance Identification & Assessment Monitoring & Reporting Control & Mitigation Independent oversight up to Board incorporating clear lines of responsibility and Three Lines of Defence model Independent ORM Function Management level operational risk committee Overarching framework, policy and risk appetite and tolerance Risk Control Self Assessment, Loss Data collection, Key Risk Indicator tracking, Scenario Analysis Change management process (e.g. new products, activities, processes, systems) Business strategy development processes Capital allocation / measurement Reporting to business line level, senior management and Board Independent review of ORM Framework/Program Appropriate internal controls, risk mitigation and/or transfer strategies Technology and Outsourcing risk management Business Continuity program 6

7 Operational risk primer Three Lines of Defence Overview A robust ORM Framework is centered on the Three Lines of Defence 1 st line BUSINESS MANAGEMENT Risk Identification, assessment, assumption, mitigation Product design/pricing Underwriting Reinsurance Sales & Distribution Claims Credit Adjudication Operations Investment Management 2 nd line RISK OVERSIGHT FUNCTIONS AND COMMITTEES ORM framework & process design, risk policies & appetite, targets/limits (where applicable) Policy compliance activities Measuring, monitoring, reporting and escalation 3 rd line INTERNAL AUDIT Independent assessment of effectiveness of risk oversight and risk management functions and controls 7

8 Operational Risk 101 ORSA focus increasing globally The Own Risk and Solvency Assessment (ORSA) is a process that examines the full scope of an insurer s ERM framework including the examination of all risks inherent within the business including operational, credit, market, etc. The ORSA is a means by which an insurer can bring together its ERM processes and use the information to support business decisions ORSA is embedded in the IAIS Insurance Core Principles (ICP) which provides a globally accepted framework for the supervision of the insurance sector National Regulator Regulation Expected Timeline OSFI (Canada) EIOPA (Europe) NAIC (US) Dynamic Capital Adequacy Testing (DCAT) No formal timeline, however relevant aspects of DCAT is consistent with IAIS and Solvency II ORSA principles Solvency II Expected to come into force in 2014 Solvency Modernization Initiative No formal timeline, however ORSA feedback pilots are scheduled for

9 Operational Risk 101 Other regulatory requirements are evolving Canada (OSFI) Fall 2012 QIS expected to include operational risk component Future for explicit operational capital requirements Future broader guidance on operational risk management (i.e. expected to be similar to Basel Sound Principles) Europe (Solvency II etc.) Solvency II includes explicit operational risk capital requirements along with high level guidance around risk assessment, loss collection, monitoring and reporting and oversight US (NAIC etc.) Solvency Modernization Initiative implicitly incorporates operational risk as all risks must be considered Various regulatory governance / enterprise risk management requirements in place or under-development that at least implicitly relate to operational risk 9

10 the Operational Risk discipline for banks has developed significantly over last decade & continues to evolve THEN: NOW: No common definition of Operational Risk, particular the sub-risk types Backward-looking No agreed upon methodology or tools available No public industry loss data Limited quantification capabilities No technology / software Limited regulatory guidance Clearer understanding and definitions for Operational Risk More forward-looking Advanced methodologies and tools now widely available More public industry consortiums for data sharing and comparative analysis (e.g. ORX, Algo Fitch, etc.) Advanced Operational Risk measurement systems now more commonly used and being developed Active regulatory oversight over Operational Risk 10

11 there has been increased focus on Operational Risk Management (ORM) reflecting changes within the global Banking industry Regulatory & Industry Expectations Regulatory and industry expectations for Operational Risk Management(ORM) are continually increasing and evolving ORM is maturing as a risk discipline and there are established benchmarks. Banks must ensure their Operational Risk capabilities continue to evolve and improve Increased Pace of Change Post Financial Crisis Increased level and pace of change across the industry, post financial crisis Recognition that Operational Risk permeates all functions of the Enterprise and influences the ability to effectively manage other risks Increased Business Complexity Increased range of products and processes result in increased business complexity (e.g. crossbusiness processes, outsourcing, shared services) Greater level of role specialisation - functional silo s can lead to a reduced understanding of the end-to-end processes for providing products or services 11

12 Recent loss events and lessons learned Why be concerned about operational risk? Operational risk is pervasive -> almost every employee takes on and manages operational risk (unlike credit and market risk) Operational risk contributes to credit, market and insurance risk losses Resulting financial losses and reputational damage can be huge: Examples of recent large Operational Risk losses: UK banks agree to pay more than 9Bn to customers it mis-sold Payment Protection Insurance to $2.3Bn in unauthorized trading losses due to gaps in control framework agreed to a settlement of $335MM for lending discrimination in its mortgage unit agreed to pay $158MM to settle civil claims regarding quality of mortgage loans TD Bank (US arm of TD Financial group) ordered to pay $67MM for its role in a Ponzi scheme 12

13 Recent loss events and lessons learned Key observations for insurance companies JP Morgan derivative trading losses: Importance to recognize units as profit or risk management centres Importance of strong risk management oversight and controls Dangers of over-reliance on models Knight Capital trading system error: Importance of risk culture Stature and influence of risk and compliance staff IT change management Segregation of duties 13

14 Industry operational risk implementation experience BMO approach to risk management 14

15 having a risk culture is a key component to ORMF embedding within our organisation Propensity to take risks and be innovative, framing risks as challenges to be overcome and seeking appropriate risk to create rewards Our culture is driven by an open door policy and flat management structure. We have a robust operational risk issues tracking methodology and risk acceptance process We have strong risk understanding and insight across the enterprise driven by structured risk-return analysis and detailed tracking of key metrics in our reporting Propensity to take measured risk Risk management as well as the corporate and business teams demonstrate a high level of commitment to understand and address risk issues. We are dedicated to respond quickly to risk issues Cooperative relationships exist between risk, corporate and business teams, evidenced through our 3 Lines of Defence operating model 15

16 In order to establish a robust Operational Risk Management Framework, the first step is to create a strong Risk Culture throughout your organization Risk culture is characterized as the actions and behaviours exhibited by our employees and groups as they identify, interpret and discuss risk and make choices in the face of both opportunity and risk Then Now Reactive ERM safeguard enterprise value Strategic ERM maximise enterprise value Focused on compliance Extensive risk mapping Risk mitigation (defence) Disconnected from strategic and operational decisions Limited to corporate staff Necessary but low-value-added activities in the mind of senior management Focused on value Emphasis on key risks driving uneven gains/losses Risk optimisation (offense and defence) Core to strategic and operational decisions (including resource allocation) Involves line managers and senior executives Organisational capability = short term performance and long term health of capabilities 16

17 we then established an Operational Risk Strategy, that aligns to our core principles, which guides the effective management and mitigation of Operational Risks Strategic Objectives: Greater transparency - enhance awareness and communication of Operational Risks Culture is critical - create an environment where awareness of Operational Risks is a key requirement Proactive management - extrapolate trends, capture and priorities issues based on financial impact, probability, risk materiality, scope and cost Move from assessment to mitigation - focus on dedicating resources to mitigate high priority issues for real economic benefits Operational risk management integrate with other aspects of the core risk management function. Operational Risk cannot be effective as a solo within risk management Expected Benefits: Provides an integrated approach to Operational Risk Management, with a stronger emphasis on risk content in addition to risk process Provides robust techniques to identify key risks and points of weakness in controls, enabling BMO to knowingly take or avoid Operational Risk as aligned to our risk appetite Minimize errors and losses that will improve bottom line performance Reduce surprises and enable the Lines of Businesses to be more proactive in mitigating risks Enhances the reputation of the enterprise in the eyes of key stakeholders including customers, regulators and rating agencies via the reduction of significant failures and achievement of the AMA accreditation Operational effectiveness through a culture of awareness, openness and a ability to discuss and then act on current and future risks. 17

18 using enhanced ORMF tools we are better able to identify, monitor and mitigate Operational Risk Risk Control Assessments are used by our businesses to identify and assess key risks reflecting changes in business environment & internal controls Scenarios Analysis considers potential large tail-risk events that could have a detrimental effect on the Bank Capital Model allows the Bank to more accurately measure how much capital it needs to hold to support its Operational Risk profile Reporting allows the Bank to combine, track and assess Operational Risk information from different business areas 18

19 our Scenario program provides management with insight into catastrophic, high impact events, these are then used to validate output of our Capital Model. Potential Scenario Topics Benefits of Scenarios Natural disasters contributing factors may include insufficient contingency and technology planning, management inaction, weak crisis management, inadequate disclosure Violation of consumer protections laws could include deceptive marketing, discriminatory lending practices resulting in regulator penalties and client restitution Acquisition integration failed integration of acquired companies resulting in losses and financial objectives not being achieved Damages caused by hacking attacks e.g. cloud computing Fines and penalties for high pressure sales tactics lack of disclosure to clients Failure to accurately disclose/misrepresent investment products resulting in lawsuits, and client restitution for losses Scenario analysis is a key component of the ORMF. It provides an important link between the measurement and management of Operational Risk. They provide management with a subjective, forward looking analysis of the catastrophic, high impact events that could impact the Bank, and the events that could trigger such an occurrence. Scenarios provide management with a better understanding of the level of preparedness needed to mitigate against these types of events. 19

20 BMO approach to operational risk management What is the Advanced Measurement Approach (AMA)? We are enhancing Operational Risk Management practices through the adoption of AMA AMA approach encourages entities to invest in better risk management systems, streamline and integrate governance risk and compliance programs. As part of the AMA program, BMO FG is moving from a revenue-based capital calculation to one that is loss-based to quantify minimum capital required for operational risks as well as enhancing existing qualitative processes i.e. reporting, key risk indicators, scenarios, etc. OSFI has an expectation that the larger Canadian banks will seek AMA status under Basel II by Benefits of AMA include: Greater transparency on types and concentration of operational risk in the business to allow better management, mitigation and value generation A more objective, disciplined approach to managing operational risk based on greater transparency and operational risk management capabilities More robust capital modeling will provide a risk-sensitive allocation of regulatory and economic capital for decision-making 20

21 the Basel II AMA implementation is a significant undertaking that builds/enhances processes embedded within the ORMF Key enhancements to the Operational Risk Management Framework in support of AMA compliance are described below: AMA Capital Model RCA Loss Event Scenarios KRIs Under AMA, Operational Risk capital calculation changes from a revenue to a loss based methodology incorporating: Forward looking risk profile and internal control factors from RCAs Internal and external loss data Large tail event data from the scenario analysis Risk & Control Assessment (RCA) is a program used by the business to identify and measure key risks Under AMA, the RCA process is used to capture forward-looking risk information reflecting changes in business environment & internal controls. This information is a key input to the AMA Capital Model Loss/event data is essential for risk analytics, benchmarking, and under AMA, capital modeling Centralized loss event collection will enhance management s ability to identify trends, isolate root causes and prioritize action Scenario analysis is the assessment of large, tail-end events introduced to provide management with insight into catastrophic events and to highlight the need for preparedness/mitigation Scenarios is key input to the AMA Capital Model Key risk indicators are used to provide advance notification of potential changes in Operational Risk exposures In support of the AMA use test, the KRI framework has been formalized to support the quantitative expression of Operational Risk Appetite as well as enhanced reporting Reporting Timely, integrated reporting is essential to support Operational Risk decision making In support of the AMA use test, enhanced reports were developed with added analysis and consistent communication of key findings/conclusions 21

22 Level of development Industry operational risk implementation experience Banks v. Insurers Banks furthest ahead (Basel Sound Principles issued in 2003). European insurers developing programs under Solvency II Canadian insurers generally lag banks and Euro & US insurers Level of Development * Banks Euro Insurers US Insurers CDN Insurers Best-in-class. Advanced Fully implemented; meets the criterion Partially implemented; some gaps remain Under-development; significant gaps Does not exist; not applicable * Based on subjective comparison across peer groups 22

23 Manulife Approach to Operational Risk Management Manulife values guide everything we do - from strategic planning to day-to-day decision-making, to the manner in which we treat our customers and other stakeholders. These values are described by the acronym PRIDE: Professionalism Real Value to Our Customers Integrity Demonstrated Financial Strength Employer of Choice

24 MFC approach to operational risk management Significant time invested upfront to develop approach Extensive peer benchmarking Learn from Banks experience Participate in industry forum with major US lifecos Stay abreast of evolving regulatory environment In the absence of insurance specific regulations in Canada self assess against Basel Sound Principles Regular meetings with OSFI Internal Pilots Researching best practices Selective use of external consultants 24

25 MFC approach to operational risk management Internal Pilots Internal pilots conducted to experiment with different implementation approaches Focused on Risk Control Assessments with several Businesses Overall process provided good results: Provided very structured process for risk identification and assessment Workshop resulted in active, engaged discussions on risk Documented action plans for top risks Areas for improvement: Process could be streamlined to produce similar results with less effort More time/focus on top risks. Less focus on everything else Need to better integrate with other risk oversight functions/processes (e.g. Compliance) Learning's incorporated into program design 25

26 MFC approach to operational risk management The 8 Guiding Principles 1. Key objective is to preserve and enhance business value. 2. Enhancing ORM is a focus for MFC, irrespective of regulatory or rating agency expectations. 3. Operational risk must be managed both top down and bottom up. To be effective it must be embedded within all businesses and functions and with every employee. It must be part of the culture. 4. All accepted risks will be within and consistent with the Company s risk appetite and strategic objectives. 5. Risk governance is based on Three Lines of Defence model, which clearly delineates responsibilities for risk taking and risk management, risk oversight and assurance. 6. Existing people, process and systems must be leveraged where possible to ensure the efficiency and effectiveness of the program. 7. A risk-based (materiality) approach will be used in the design and implementation of all aspects of the program to ensure effort and resources are focused where risk (materiality) is highest. 8. Program implementation will be incremental and gradual to allow time to learn, refine processes and balance with other business priorities. 26

27 MFC approach to operational risk management Objectives of MFC Operational Risk Program Help business to better identify and manage significant operational risk exposures Identifying holes/gaps in ORM where even the most operational-risk savvy GMs need to focus attention going forward to prevent losses: risk-based mapping/maturity exercise proactively identifying and addressing vulnerabilities and weaknesses in our controls and processes vs. reporting Identify opportunities to reduce costs where cost of controls not warranted in view of risk 27

28 Program Planning MFC approach to operational risk management Guiding principles drive program design & implementation Prioritisation based on level of risk and risk management maturity Governance Monitoring & Reporting Identification & Assessment, Measurement Common Language Systems Infrastructure Culture & Awareness Independent oversight by Corporate and Divisional Risk functions (per market, credit and insurance risks) Senior Management visibility of operational risk exposures through standardised reports; comparable across BUs / Divisions. Formal tracking of action plans Structured process for risk identification and assessment Formal tracking of losses at appropriate threshold. Focus on root cause analysis. Sharing of learning's across BUs and Divisions Consistent risk definitions and ratings to improve clarity and comparability of risk information and ability to aggregate One repository for risk information. Enter data once but use for multiple purposes Training for managers to make them risk aware and more inclined to proactively identify risk and avoid losses 28

29 Some Insurer Examples In case you were thinking losses couldn t happen to you. Vanishing Premiums from the 1990 s Claims Practice Management Policyholder taxation errors Escheatment / Death Master-file issues The list keeps growing. 29

30 Questions? 30

31 31