Rolling Up Operational Risk

Transcription

1 Rolling Up Operational Risk SHARI BREITEN Director, Operational Risk September 17, 2015

2 Historical Perspective Goals & Objectives Industry Challenges Solutions

3 HISTORICAL PERSPECTIVE: Regulatory Environment Basel II Accord (2004) Introduced capital requirements for Operational risk (adopted by U.S. banking system in 2007) Within financial services, Basel II remains the primary standard for operational risk Set standards for industry, made of three pillars Solvency II adopts similar approach More regulatory efforts underway to develop common requirements NAIC Initiatives ORSA ComFrame Joint Forum (IAIS, IOSCO, BCBS)

4 Key Data Elements HISTORICAL PERSPECTIVE: Basel II Accord Internal Loss Data Comprehensive collection of loss data for: - Current and historical views - Analysis of future exposure External Loss Data Business Environment Internal Control Factor Common risk infrastructure and assessment methodology thru: - Risk & Control Self Assessment (RCSA) - Business Environment Assessment (BEA) Scenario Analysis Informed Decision- Making Purchased data to supplement internal loss data, stimulate discussion, generate scenarios. Probability and impact assessment of plausible, high severity operational risk events. Quantitative Data Qualitative Data OBTAINING THE RIGHT DATA

5 GOALS & OBJECTIVES Key Program Objectives Provide visibility into how risks are managed Demonstrate strong risk management to regulatory and supervisory authorities Quantify risk exposure Right-size the amount of corporate insurance needed Estimate risk exposures to correctly allocate capital Deliver a framework and system solutions that strengthen our lines of defense

6 INDUSTRY CHALLENGES Business process & knowledge Changing landscape, requirements and diverse business practices TOP 5 Variations of risk taxonomy and risk approach throughout the business Lack of data aggregation and common measurement Adoption of standard operational risk framework elements RCSA, Scenarios, Loss Data, etc. Weaknesses in risk technology infrastructure, architecture and applications Multiple systems and data sources, often without shared connectivity HEIGHTENED EXPECTATIONS

7 Governance alone will not meet these challenges. Sustainable Risk Assessment Framework Includes: Data architecture Methodology Systems HEIGHTENED EXPECTATIONS

8 SOLUTION: Risk & Control Self Assessment

9 SOLUTION: Risk & Control Self Assessment A living, on-going assessment completed by the risk owner (1 st line of defense) Connects risks with suite of controls, using common language Qualitative assessment of risk based on available data and expert opinion Provides actionable risk data/risk intelligence Quantitative, forward-looking estimate of exposure What is an RCSA?

10 Why the RCSA? It can Assess Connect Support Show Estimate Risk where it is owned & managed Risk owners and control owners Risk and control ownership and accountability Importance and effectiveness of controls Of risk exposures by risk owner Capture Establish Drive Provide Identify Management s treatment of risk Risk tolerance at risk owner level Prioritization for risk mitigation Material input into capital calculation Any gaps in risk and control structure SOLUTION: RISK & CONTROL SELF-ASSESSMENT

11 Metrics (KRI, KPI, KCI) Incident Management Operational Risk Losses (Internal/External) Policy & Regulatory Requirements Quantitative RCSA Qualitative Control Testing Environment Changes (Business Environment Assessment) Issue Management SOLUTION: RISK & CONTROL SELF-ASSESSMENT

12 Informs SOLUTION: Risk & Control Self Assessment 1 EMPOWER Front Line Units Identify, assess, monitor, set controls and manage risk. RCSA completed by 1 st line of defense ENABLE Risk transparency 2 Independent Risk Management Holistic view of risk and performance of controls, identify emerging trends. Sharing best practices. Accountability & Ownership Risk tolerance & appetite 3 INFORM Internal Audit Objective evaluation of the design and effectiveness of risk management activities. Risk data aggregation & reporting THREE LINES OF DEFENSE

13

14 SOLUTION: A Holistic View of Risk 1 Cross-functional view of risks overseen by Corporate Risk Management Disciplines (2 nd Line of Defense BU # 1 Risk disciplines are inter-related and affect all business areas. BU #2 BU #3 BU #4 BU #5 2 Each area of risk is assigns an owner with deep subject matter expertise. 3 who ensures the organization has an enterprise-wide view of their specific area of risk focus. Information Security 2 nd Line of Defense Responsibilities Risk Disciplines: Affect all business units Align with company strategies and objectives Continually evaluated Fraud Human Resources Risk Compliance Accounting /SOX Business Continuity Vendor Management Model Risk Marketing Provide technical advisory support (e.g., policies, standards, guidance) across the enterprise. Provide change management expertise (e.g., monitor and implement) across the enterprise. Provide communications and training support specific to their areas of expertise. Perform aggregate review of risks, ensuring risks are managed within company established appetite and tolerances. Participate in processes to identify emerging risks and to manage incidents within their risk discipline.

15