P2.T7. Operational & Integrated Risk Management

Size: px

Start display at page:

Download "P2.T7. Operational & Integrated Risk Management"

Berenice Heath
5 years ago
Views:

1 P2.T7. Operational & Integrated Risk Management Bionic Turtle FRM Practice Questions Marcelo G. Cruz, Gareth W. Peters, and Pavel V. Shevchenko, Fundamental Aspects of Operational Risk and Insurance Analytics: A Handbook of Operational Risk By David Harper, CFA FRM CIPM

2 CRUZ, CHAPTER 2: OPRISK DATA AND GOVERNANCE... 3 P2.T OPERATIONAL RISK EVENT RISK CATEGORIES

3 Cruz, Chapter 2: OpRisk Data and Governance P2.T Operational risk event risk categories P2.T Operational loss data: recoveries and thresholds P2.T Risk control self-assessment (RCSA), key risk indicators (KRIs) and scenario analysis P2.T Operational risk profiles and organizational designs P2.T Operational risk event risk categories Learning Objectives: Describe the seven Basel II event risk categories and identify examples of operational risk events in each category. Please note that the Bank for International Settlement (BIS) is proposing a single, simplified method for the estimation of operational risk capital called the Standardized Measurement Approach (SMA), see released in March Trader Ben Smith enters a foreign exchange (FX) spot transaction, buying euros for dollars. He then quickly enters another transaction selling euros for dollars. He makes a quick profit from these two transactions, however due to confusion in the back office, settlement to the counterparty is delayed to four days later. The counterparty demands compensation for the delayed settlement and the claim includes lost (forgone) interest. The cost of the mistake exceeds the profit on the trade, resulting in an operational loss. To which Level 1 event risk category should this loss be assigned? a) Improper Business or Market Practices b) Business Disruption and System failures c) Clients, Products, and Business Practices d) Execution, Delivery & Process Management An Investment Advisor at a division of an international bank was sued by an employerbased retirement plan sponsor for fiduciary breach. The client claimed that the Advisor's recommendation put the Advisor intention to earn a commission and the firm's profit motive above the client's best interest. The lawsuit was settled. To which event risk category should this loss be assigned? a) Improper Business or Market Practices b) Business Disruption and System failures c) Clients, Products, and Business Practices d) None of the above, legal risk is not an operational risk 3

4 Last year, Goodholdings Bank released a major upgrade of its custom-built enterprise resource planning (ERP) software platform. However, the release exposed problems with the extant codebase. Consultants were hired to re-factor the code and resolve the so-called technical debt. Technical debt is the development effort required to fix structural software problems that remain in code due to sub-optimal programming practices; for example, a quickfix might satisfy an immediate user requirement but interfere with long-term compatibility or performance. Management views the cost of hiring the consultants as an operational loss. To which event risk category should the loss be assigned? a) Internal fraud b) Business disruption and system failures c) Employment Practices and Workplace Safety d) None of the above, technical debt is an exception that is excluded from the taxonomy 4

5 Answers: D. Execution, Delivery & Process Management Cruz: "2.2.1 EXECUTION, DELIVERY, AND PROCESS MANAGEMENT: Losses of this event type are quite frequent as these can be due to human errors, mis-communications, and so on, which are very common in an environment where banks have to process millions of transactions per day. A typical example of execution losses might help to illustrate how frequent these losses can be. Consider the following deal: A foreign exchange (FX) trader bought USD 100,000,000 for 90,000,000 (i.e., USD 1 = 0.90) and then sold USD 100,000,000 for 90,050,000 (i.e., USD 1 = ) with a trading initial profit of 50,000. Both transactions were made almost at the same time, and the trader was obviously very satisfied with a profit of 50,000. In his/her excitement at the successful deal, however, there were some snags in the back-office with some confusion on where to remit the payments of one leg of the deal, and the transaction was finally settled 3 days later than it should have been. In FX transactions trading tickets are usually larger to compensate for the low margins. Similar situations as described earlier may lead to errors. The counterparties obviously would have demanded a compensation as the settlement has been delayed for 3 days, and the bank would also have paid a penalty, in the form of interest claims of 55,000. Therefore, any error has the potential to be higher than a transactions eventual economic profit. The overall scenario is alarming. There was a loss of 5000 on the aggregate due to operational errors ( 50,000 transaction profit less 55,000 interest claims due for late payment). This is the reality a trading environment faces on the day-to-day. The actions of traders are recognized at the closing of the deal, and errors coming to light at a later time (e.g., mispricing, late settlement) are not linked back to the underlying cause. The error goes to an error account or the like and, in terms of OpRisk management, those who are responsible for the errors are never identified; even worse is that the real profitability of individual transactions is rarely understood. The cost side (and the OpRisks involved) is in general ignored." In regard to false (A), please note that "Improper Business or Market Practices" is a Level 2 Category under Clients, Products & Business Practices. There are seven event-type categories (at Level 1; each includes sub-categories at Level 2 and Activity Examples at Level 3): Internal fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party. External fraud: Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party Employment Practices and Workplace Safety: Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events 5

Clients, Products & Business Practices (includes Level 2 "Suitability, Disclosure & Fiduciary Fiduciary" and "Improper Business or Market Practices"): Losses arising from an unintentional or

6 Clients, Products & Business Practices (includes Level 2 "Suitability, Disclosure & Fiduciary Fiduciary" and "Improper Business or Market Practices"): Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Damage to Physical Assets: Losses arising from loss or damage to physical assets from natural disaster or other events. Business Disruption and System Failures (includes Level 2 "Systems" which encompasses hardware, software, telecommunications, and utility disruptions): Losses arising from disruption of business or system failures Execution, Delivery & Process Management: Losses from failed transaction processing or process management, from relations with trade counterparties and vendors C. Clients, Products, and Business Practices Cruz: "2.2.2 CLIENTS, PRODUCTS, AND BUSINESS PRACTICES: Loss events under Clients, Products and Business Practices (CPBP) risk type are usually the largest, particularly in the US. These events encompass losses, for example, from disputes with clients and counterparties, regulatory fines from improper business practices, or wrongful advisory activities. Table 2.2 presents the Basel event-type breakdown and definition for this risk type. This is a specific and an important risk type for firms with operations in the US where litigation is very common. As seen in recent regulatory fines imposed on French banks and other foreign banks operating in US jurisdiction, this loss type can also be significant to off-shore entities." This Level 1 Category (Clients, Products and Business Practices) includes the following Level 2 Categories: Suitability, Disclosure, and Fiduciary (e.g., fiduciary breaches/guideline violations; suitability/disclosure issues; retail customer disclosure violations; breach of privacy; aggressive sales; account churning; misuse of confidential information; lender liability); Improper Business or Market Practices (e.g., antitrust; improper trade/market practices; market manipulation; insider trading on firm's account; unlicensed activity; money laundering); Product Flaws (e.g., product defects; model errors); Selection, Sponsorship, and Exposure (e.g., failure to investigate client per guidelines; exceeding client exposure limits) and Advisory Activities (e.g., disputes over performance of advisory activities) 6

7 B. Business disruption and system failures includes hardware and software Cruz: "2.2.3 BUSINESS DISRUPTION AND SYSTEM FAILURES: Business Disruption and System Failures (BDSF) event type is one the most difficult to spot in a large organization. A system crash, for example, would almost certainly bear some financial loss for a firm, but these losses most likely would be classified as EDPM. An example might help to clarify this point. Suppose that the funding system of a large bank crashes at 9:00 am. Despite all efforts from IT, the system comes back online only by 4:00 pm when money markets are already closed. When the system returns, the bank learns that it needs to fund an extra USD 20 billion on that day. As the markets are already closed, they need to make requests to their counterparties to allow them special conditions; however, the rates in which they capture these funds are higher than the daily average. This extra cost, although due to a system failure and, therefore, should be classified as BDSF, would hardly be captured at all. Table 2.3 presents the formal Basel definition and breakdown of this risk type." Discuss in forum here: 7

P2.T7. Operational & Integrated Risk Management

P2.T7. Operational & Integrated Risk Management Cruz, Peters, and Shevchenko, Fundamental Aspects of Operational Risk and Insurance Analytics: A Handbook of Operational Risk Bionic Turtle FRM Study Notes