P2.T7. Operational & Integrated Risk Management

Transcription

1 P2.T7. Operational & Integrated Risk Management Cruz, Peters, and Shevchenko, Fundamental Aspects of Operational Risk and Insurance Analytics: A Handbook of Operational Risk Bionic Turtle FRM Study Notes By David Harper, CFA FRM CIPM

2 CRUZ, CHAPTER 2: OPRISK DATA AND GOVERNANCE... 3 DESCRIBE THE SEVEN BASEL II EVENT RISK CATEGORIES AND IDENTIFY EXAMPLES OF OPERATIONAL RISK EVENTS IN EACH CATEGORY

3 Cruz, Chapter 2: OpRisk Data and Governance Describe the seven Basel II event risk categories and identify examples of operational risk events in each category. Summarize the process of collecting and reporting internal operational loss data, including the selection of thresholds, the timeframe for recoveries, and reporting expected operational losses. Explain the use of a Risk Control Self-Assessment (RCSA) and key risk indicators (KRI s) in identifying, controlling and assessing operational risk exposures. Describe and assess the use of scenario analysis in managing operational risk, and identify biases and challenges which can arise when using scenario analysis. Compare the typical operational risk profiles of firms in different financial sectors. Compare different organizational designs for a risk management framework. Operational Risk (OpRisk) Taxonomy Taxonomy is a term borrowed from biology. One activity of biologists is to discover and classify new species into a group based on characteristics or features. In this way, taxonomy refers to the conception, naming, and classifying organisms into groups. It is a common practice in biology to group individuals into species, arranging species into larger groups, and naming the groups, thus producing a classification. For example, because dolphins live in the sea and look like fish does not make them a fish; instead, their characteristics cause biologists to classify them as mammals. Taxonomy encompasses description, identification, nomenclature, and classification. Taxonomy has become important in risk management as new risks are being encountered at regular intervals. There are roughly three ways that firms drive this risk taxonomy exercise: Cause-driven: the risk classification is based on the reasons that cause losses. Although it has some advantages, challenges arise when multiple causes exist or the cause is not immediately clear. If this system is applied to a process where losses have high frequency, it is difficult to classify correctly every single loss. Impact-driven: the classification is made according to the financial impact of operational losses. Most firms that follow this approach do not invest heavily in OpRisk management; they just use this type to retrieve data from their systems. This is quite common in smaller firms. In this type of classification, it is difficult to manage OpRisk because it is difficult to understand what is driving losses. Event-driven: the event-driven classification is the most common used by large firms and this is used by the Basel Committee. Many firm follow their own classification initially and map to the Basel event-type category later. This system provides a broad definition which makes it easier to accept changes in the process. For example, under Execution, Delivery, and Process Management (EDPM; which is the level-1 event type), there is a sub-category called Transaction Capture, Execution, and Maintenance that can be an umbrella for a for several different risk types. 3

4 Describe the seven Basel II event risk categories and identify examples of operational risk events in each category. Basel II provides seven event risk types. These are referred to as Level 1 categories. Each Level 1 category contains several Level 2 sub-categories; each Level 2 sub-categories includes several Level 3 Activity Examples. The following are the seven Basel II event risk types: Event-Type Category (Level 1) Internal Fraud External Fraud Employment Practices and Workplace Safety Clients, Products, and Business Practices Damage to Physical Assets Business Disruption and System Failures Execution, Delivery, and Process Management Definition Losses due to acts of a type intended to defraud, misappropriate property, or circumvent regulations, the law, or company policy, excluding diversity/ discrimination events, which involves at least one internal party. Losses due to acts of a type intended to defraud, misappropriate property, or circumvent the law, by a third party. Losses arising from acts inconsistent with employment, health, or safety laws or agreements, from payment of personal injury claims, or from diversity/ discrimination events. Losses arising from an unintentional or negligent meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Losses arising from loss or damage to physical assets from natural disaster or other events. Losses arising from disruption of business or system failures. Losses from failed transaction processing or process management, from relations with trade counterparties and vendors. 1. Execution, Delivery, and Process Management (EDPM) EDPM loss event type encompasses losses from failed transaction processing, as well as problems with counterparties and vendors. Table 2.1 Execution, Delivery & Process Management (EDPM) Category (level 1) Execution, Delivery & Process Management (EDPM) Category (level 2) Transaction, Capture, Execution and Maintenance Monitoring and Reporting Customer Intake and Documentation Customer/Client Account Mgmt Trade Counterparties Vendors and Suppliers Activity examples Miscommunication; data entry, maintenance or loading error; missed deadline or responsibility; model/system mis-operation; accounting error/entity attribution error; other task mis-performance; delivery failure; collateral management failure; reference data maintenance Failed mandatory reporting obligation; inaccurate external report (loss incurred) Client permissions/disclaimers missing; legal documents missing/incomplete Unapproved access given to accounts; incorrect client records (loss incurred); negligent loss or damage of client assets Non-client counterparty mis-performance; misc. nonclient counterparty disputes Outsourcing; vendor disputes 4

5 Hypothetical example. Consider the following deal: A foreign exchange (FX) trader bought USD 100,000,000 for 90,000,000 (i.e., USD 1 = 0.90) and then sold USD 100,000,000 for 90,050,000 (i.e., USD 1 = ) with a trading initial profit of 50,000. Both transactions were made almost at the same time; the trader makes a profit of 50,000. But there were snags in the back-office (i.e., confusion on where to remit the payments of one leg of the deal), and the transaction was finally settled 3 days later than it should have been. The counterparties demand compensation as the settlement was been delayed for 3 days; and the bank pays a penalty, in the form of interest claims of 55,000. Any error has the potential to be higher than a transactions eventual economic profit. There was a loss of 5000 on the aggregate due to operational errors ( 50,000 transaction profit less 55,000 interest claims due for late payment). The actions of traders are recognized at the closing of the deal, but errors are not linked back to the underlying cause. The error goes to an error account and those who are responsible for the errors are never identified; the real profitability of individual transactions is rarely understood. But knowing where the errors occur is very important for OpRisk management. Actual Example. Misunderstanding an order: Large US Private Bank, August 2012 Many purchase orders, particularly in private banking, are still placed by oldfashioned telephone methods. A common mistake is the misunderstanding of the order, especially when the counterparty is a foreign-language speaker and the communication chain goes from client to banker to trader assistant to trader, and in any one of these links communication breakdowns can happen. In a busy afternoon at the end of summer 2012, a client asked his private banker to purchase USD 100,000 of a particular share. The private banker passed this order to the trader, and at the end of the day the trader passed a bill to the private banker for several million US dollars. The private banker was stunned to see that they had bought a significant portion of this particular company. As a consequence of this transaction, the share price of this company rose significantly which also generated questions from authorities that suspected some type of pump-and-dump scheme. The bank decided to keep the shares and sell it little by little. The operational loss in this case was reflected in the value lost in returning the stocks to the market after the shares returned to their average price. 5

6 2. Clients, Products, and Business Practices (CPBP) CPBP risk type encompass losses from disputes with clients and counterparties, regulatory fines from improper business practices, or wrongful advisory activities. Table 2.2 Clients, Products and Business Practices (CPBP) Category (level 1) Category (level 2) Activity examples Clients, Products, and Business Practices Suitability, Disclosure and Fiduciary Fiduciary breaches/guideline violations; suitability/disclosure issues (e.g., KYC); retail customer disclosure violations; breach of privacy; aggressive sales; account churning; misuse of confidential Improper Business or Market Practices Product Flaws Selection, Sponsorship and Exposure Advisory Activities information; lender liability Antitrust; improper trade/market practices; market manipulation; insider trading (on firm account); unlicensed activity; money laundering Product defects (e.g., unauthorized); model errors Failure to investigate client per guidelines; exceeding client exposure limits Disputes over performance of advisory activities Example: SBC Warburg (Investment Bank), October 1996 The investigation relates to a mistake made during the execution of a 300 million program trade for an investment trust which caused the price of a number of French stocks to fall sharply. The SFA investigation focused on a 30-min period on October 30, At some time around mid-day, SBC Warburg traders learnt that the bank had been awarded three contracts by Kleinwort Benson European Privatization Investment (Kepit) to execute a series of share sales on its behalf. It involved SBC Warburg taking the 300 million-worth of shares onto its books just minutes later, at 12:30 pm, and paying Kepit the mid-market prices for each share at that time. In the remaining minutes before the 12:30 pm deadline, SBC Warburg traders sought to sell some of the same shares they were about to get from Kepit in order to reduce the risk (this process is known as short sell). Elsewhere at SBC Warburg, a trader was running an arbitrage position on Kepit, seeking to make money by exploiting differences between Kepit's own share price and the price of the shares the bank owned. In the minutes before the 12:30 pm deadline, the SBC Warburg trader running the arbitrage position was seen on the trading floor making gestures with his hands for traders to get the price of the shares down. A mistake by one of the SBC Warburg's Paris-based traders attracted the attention of SFA. Instead of selling as much as he could before 12:30 pm, the trader misunderstood his instructions and attempted to sell at the strike time. The trader failed to put a so-called down limit on his proposed share sales, turning it into an unlimited sell order. In the tapes passed to the SFA, the trader is heard talking with a colleague about how the price of the French shares had fallen much further than they had planned. The trader complained that a colleague told him that they should only have pushed the prices down by 1%. SBC admitted in March 1997 that its short selling contributed to adverse price movements and dismissed several employees involved in the trade. 6

7 3. Business Disruption and System Failures (BDSF) BDSF event type is defined as losses arising from disruption of business or system failures and is one the most difficult to spot in a large organization. Example: The funding system of a large bank crashes at 9:00 am. Despite all efforts from IT, the system comes back online only by 4:00 pm when money markets are already closed. When the system returns, the bank learns that it needs to fund an extra USD 20 billion on that day. As the markets are already closed, they need to make requests to their counterparties to allow them special conditions; however, the rates in which they capture these funds are higher than the daily average. This extra cost should be classified as BDSF. Table 2.3 Business Disruption and System Failures Category (level 1) Category (level 2) Activity examples Business Disruption and System Failures Systems Hardware; software; telecommunications; utility outage/disruptions 4. External Frauds External frauds are frauds committed or attempted by third parties or outsiders against the firm. Examples would be system hacking and check and credit card frauds. External fraud is very common in retail businesses where financial firms deal with millions of clients. Frauds attempted or committed by clients are a daily event in sectors such as retail banking, retail brokerage, and credit card services. Table 2.4 External Frauds Category (level 1) Category (level 2) Activity examples External Fraud Theft and fraud Theft/robbery; forgery; check kiting Systems security Hacking damage; theft of information (w/monetary loss) 5. Internal Fraud Internal frauds are frauds committed or attempted by a firm's own employees. Events such as traders mismarking positions are not uncommon. Recently there were a number of large internal frauds in which billions of dollars were lost as traders of a particular bank failed to mention their position. These are usually low-frequency/high-severity events. Table 2.5 Internal Fraud Category (level 1) Categories (level 2) Activity examples Internal Fraud Unauthorized Activity Transactions not reported (intentional); transaction type unauthorized (w/monetary loss); mismarking of position (intentional) Theft and fraud Fraud/credit fraud/worthless deposits; theft/ extortion/embezzlement/robbery; misappropriation of assets, malicious destruction of assets; forgery; check kiting; smuggling; account take-over/ impersonation/etc.; tax noncompliance/evasion (willful); bribes/kickbacks; insider trading (not on firm s account) 7

8 Example (Internal Fraud): Model Inputs Fraud, NatWest, March 1997 In February 1997, a few days after the bank released its annual results, it announced a loss of approximately USD 150 million caused by a junior trader who had already left the bank. The trader was dealing in long-dated OTC interest rate options. The valuation problem is these are relatively illiquid. The trader calculated the price of the options by providing his own estimates of volatility, creating fictitious profits that built up in the books over time. The volatility estimates resulted in the options being underpriced. The trader attracted more clients, booking the requested premium, thereby increasing the apparent profitability of his desk (and, by extension, his remuneration). The loss was realized when the options were exercised. 6. Employment Practices and Workplace Safety (EPWS) EPWS type of risk is defined as losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity/discrimination events is more prominent in the Americas than Europe or Asia as either the labor laws are old-fashioned and/or there is more a culture of litigation against the employers. Table 2.6 Employment Practices and Workplace Safety (EPWS) Category (level 1) Categories (level 2) Activity examples Employment Practices and Employee relations Compensation, benefit, termination issues; organized labor activity Workplace Safety Safe environment General liability (e.g., slip and fall); employee health and safety rules events; workers compensation Diversity and discrimination All discrimination types Example: Some large banks in Brazil would count employment litigation on the tens of thousands and it is one of the main OpRisks for banks. In some lines of business like investment banking, employment issues are also quite important. As these line of business mostly provide advisory to large corporations and the key personnel is highly compensated, litigation against some of these key employees and losing them can cost millions of dollars. 7. Damage to Physical Assets (DPA) DPA is defined as losses arising from loss or damage to physical assets from natural disaster or other events. The most common method to assess the exposure to this risk is through scenario analysis using insurance information. Very few firms actively collect losses on this risk type as these are usually either too small or incredibly large. Table 2.7 Damage to Physical Assets (DPA Category (level 1) Categories (level 2) Activity examples Damage to physical assets Disasters and other events Natural disaster losses; human losses from external sources (e.g., terrorism, vandalism) 8