Measuring and reporting operational process risk

Transcription

1 Measuring and reporting operational process risk Utilizing risk management as the first line of defense Prepared by: Joe Valasquez, Manager, RSM US LLP George Simms, Director, RSM US LLP John Brackett, Partner, RSM US LLP July 2014 Compliance with the process reporting requirements of Basel III 1 and the Advanced Measurement Approach 2 may require data 1 Basel III: International framework for liquidity risk measurement, standards and monitoring, Basel Committee on Banking Supervision, Bank for International Settlements 2 Operational Supervisory Guidelines for the Advanced Measurement Approaches, Basel Committee on Banking Supervision, Bank for International Settlements aggregations that result in over 1 million reporting variations. The challenges financial institutions are facing are multifaceted. One key challenge is how to collect meaningful data that is actually used by the first line of defense to manage their processes. For operational process risk data aggregations to be flexible and enable risk to be aggregated, it is best to start at the raw data level. Data built at the first line of risk defense facilitates risk mitigation at the process level.

2 Controlling like processes across an organization is equally challenging. In order to spot trends across like processes, risk elements must be summarized across the businesses before they result in negative bottom-line impact. Regulation background Markets, although efficient, are not as self-regulating as once thought. Irrational investor behavior has proven that self-regulation alone is not enough. Regulators have stepped in to drive the Dodd-Frank Act, reaffirm the Basel III direction for all U.S. banks and put the financial services players on notice that they need to take a more prudent approach in managing other people s money. According to the Bank for International Settlements (the organization responsible for Basel III), a key issue from the 2008 financial crisis was that many banks lacked the ability to aggregate risk exposures and concentrations quickly and accurately at the bank group level, across business lines and between legal entities. In January 2013, the Bank for International Settlements issued Principles for effective risk data aggregation and risk reporting (Principles). 3 These requirements focus on managing and reporting process operational risk. The effective implementation period is over the next three to six years, depending on the size of the financial institution. Most of the Basel III regulations are focused on the measurement of operational risk associated with financial information and financial instruments. The Principles and its associated reference documents require the management of process risk. Compliance with the 11 principles for effective process operational risk management is a challenge within itself. Effective implementation of these specifications achieves business value, while simultaneously ensuring regulatory compliance. The key is to manage process operational risk implementations at the first line of defense. It is here that adoption will guarantee both business value and compliance. The Principles are designed to cover the length and breadth of the financial services industry. This level of coverage is appropriate for the global systemically important banks (G-SIBs). For regional, community banks and lines of business implementation, the challenge is to distill the broader specifications to ensure both compliance and true business value are attained. The current state of measuring and reporting operational risk involves several issues. These include: Operational risk measuring and reporting within financial institutions is a fragmented environment with a proliferation of dispersant controls. In many cases, there is unclear accountability. The systems for measuring risk are predominately reactive. Ever-increasing numbers of specialized products and information technology (IT) systems. The constant drive for reduced unit costs. The normalization of the deviance of controls. Unacceptable risk becomes acceptable over time when viewed at a micro level. The financial industry has been compromised by a system of incentives that reward those who increase risk, while maintaining their insulation to losses. Building risk data at the first line of defense When data reporting is close to the actual process, proactive process management is a natural outcome. Data definitions and terminology built at the foundational level provide a solid base to facilitate consistency in the measurement system. For example, building a clear definition of what s included and what s not, a measurement (numerator and denominator) and a dictionary of terminology for each risk segmentation is an effective foundation. Data built at the first line of risk defense facilitates risk mitigation at the process level. Statistical limits are established for each key risk element. Using straightforward algorithms, risk elements are spotted before reaching critical levels. Basel Committee on Banking Supervision Principles for effective data aggregation and risk reporting. Compliance is required for the large banks (G-SIBs) at the start of 2013-all other financial institutions around the world follow. Principles for effective risk data aggregation and risk reporting The Principles identify 11 principles for effective data aggregation and risk reporting. Two of the principles, adaptability (Principle 6) and accuracy (Principle 7), are discussed in the next sections. Overarching governance and infrastructure Principle 1 - Governance Principle 2 - Data architecture and IT infrastructure Improving banks ability to aggregate risk data will improve their resolvability. Financial institutions have developed a patchwork of regulatory compliance measurements and reporting. 3 Principles for effective risk data aggregation and risk reporting, Basel Committee on Banking Supervision, Bank for International Settlements data aggregation capabilities Principle 3 - Accuracy and integrity Principle 4 - Completeness Principle 5 - Timeliness Principle 6 - Adaptability 2

3 reporting practices Principle 7 - Accuracy Principle 8 - Comprehensiveness Principle 9 - Clarity and usefulness Principle 10 - Frequency Principle 11 - Distribution Adaptability: a pragmatic approach As mentioned, in order for operational risk data aggregations to be flexible and enable risk to be aggregated, it s best to start at the raw data level. Basel III is fairly specific on the five operational loss risk reporting segmentations. foundational segmentations 1. Loss or damage 2. Legal liability 3. Restitution 4. Write-down 5. Regulatory action foundational segmentations are aligned to risk activity levels, of which Basel has defined more than 70. The Basel III specification provides terminology for risk activities at a high level. Specific definitions are, for the most part, left to the financial institution. Each of the risk activity levels should be customized to the specific financial institution and defined appropriately. activities are then linked to products, and the products linked to business units or legal entities. This pragmatic approach to detection, consistent data definitions and simpler output will ultimately require less data to effectively manage risk. Advantages of a pragmatic approach include: With the ability to view and compile data across products and legal entities comes the ability to spot emerging risk trends. It enables the comparison of areas and franchises from an operational risk perspective and provides a basis for operational risk capital management. Using data comparison provides insight to the firm on the interrelationships of business characteristics and business entities to operational risk characteristics. Steps for aggregating risk data from the bottom up: Identify the key process output indicator (product-, process- or function-based) Align the indicators to the terminology and definitions library (this may require development in the case of new implementation) Convert the process metric to a dollar value (as an additive approach, a risk priority methodology may be used) 4 Align the indicator with the appropriate risk segmentation Aggregating risk data built from the foundation up RISK DOLLARS BUSINESS REPORTING Loss or damage Legal liability Restitution Write-down Regulatory action 5 Activity groups ACTIVITY REPORTING Entity level 1 Capabilities for data customization: Dashboards and flash reports Having built the data set from the risk loss foundational level up, integration into a dashboard is the next step. An effective dashboard should be easy to use and learn and possess the following characteristics: Traits of an effective dashboard 5 activity level dollars x risk level reporting = reporting variations 5 x 70 = 350 reporting variations event category Entity level 2 Legal entity and business unit reporting variations x 40 activity groups = 14,000 reporting variations Product reporting for 100 products x 14,000 reporting variations = Over 1 million reporting variations event type Ability to consolidate relevant data from multiple sources into a single application Ability to explore the associations in your data Enable social decision-making through secure, real-time collaboration The visualization of data with engaging, state-of-the-art graphics Ability to search across all data directly and indirectly Ability to interact with dynamic apps, dashboards and analytics Ability to access, analyze and capture data from mobile devices At the dashboard level, effective management of risk requires limits. As risk may rarely be totally eliminated, a key to the management of operational risk is the proper use and establishment of limits. Operational limits based on history, trends, current capability constraints or the risk appetite of the financial institution are displayed in conjunction with the risk being reported. Limits based on historical data use either range to depict risk tolerance levels or alternatively utilize a control limit approach. The Western Electric rules for control charting may be built into the dashboard. 6 Control limits are statistically 4 System and Method for Operational Assessment and Control, Patent , Sep. 22, 2009, Joseph Valasquez co-inventor 5 Source: QlikView 11/2/ Western Electric Company (1956), Statistical Quality Control handbook. (1 ed.), Indianapolis, Indiana 3

4 calculated based upon historical variation. Potential out-ofcontrol conditions are identified as an advance warning for potential risk issues. Remedial actions and managing risk Even a world-class operational risk reporting and measurement system will not reduce risk without a defined structure to manage the risks. A preferred operational risk management process incorporates a closed-loop framework for mitigating risk. As both a regulatory and business management requirement, financial institutions will continue to strive to improve both the quality and usage of operational risk data. Adopting a strategy that manages process operational risk implementations at the first line of defense helps accomplish two key goals: increasing your business value and managing compliance demands. A closed-loop process for mitigating risk R ISK G OVE R NANCE reporting and communication R ISK MANAG E M E N T P RO CE SSE S identification monitoring STRATEGIC AND BUSINESS OBJECTIVES assessment or measurement response or control optimization 7 R I S K C U LTURE A N D R ISK APPETITE An effective operational risk measurement and reporting system includes several elements to help communicate risk and protect your institution. These include: A pragmatic approach to detection, consistent data definitions and a usable output, which ultimately requires less data A simpler approach allows risks to be transparent and understood and can therefore allow for better understanding at the first line of defense Operational limits are based on history, trends, current capability constraints or the risk appetite of the financial institution Using data comparison, the dashboard provides insight to the firm on the interrelationships of business characteristics and business entities to operational risk characteristics The dashboard enables the comparison of areas and franchises, and provides a basis for operational risk capital management 7 RSM framework for enterprise risk management 4

5 This publication represents the views of the author(s), and does not necessarily represent the views of RSM US LLP. This publication does not constitute professional advice. This document contains general information, may be based on authorities that are subject to change, and is not a substitute for professional advice or services. This document does not constitute audit, tax, consulting, business, financial, investment, legal or other professional advice, and you should consult a qualified professional advisor before taking any action based on the information herein. RSM US LLP, its affiliates and related entities are not responsible for any loss resulting from or relating to reliance on this document by any person. RSM US LLP is a limited liability partnership and the U.S. member firm of RSM International, a global network of independent audit, tax and consulting firms. The member firms of RSM International collaborate to provide services to global clients, but are separate and distinct legal entities that cannot obligate each other. Each member firm is responsible only for its own acts and omissions, and not those of any other party. Visit rsmus.com/aboutus for more information regarding RSM US LLP and RSM International. RSM and the RSM logo are registered trademarks of RSM International Association. The power of being understood is a registered trademark of RSM US LLP RSM US LLP. All Rights Reserved. wp_fs_0915_measuring_and_reporting_operational_process_risk