![Page 1: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/1.jpg)
Risk management for mutuals
John Thirlwell
AFM conference, The Belfry, 17 October 2012
![Page 2: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/2.jpg)
![Page 3: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/3.jpg)
‘The world has never been so full of risk.’
![Page 4: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/4.jpg)
National security strategy (Oct 2010)
TIER 1 TIER 2
International terrorism Chemical, biological, nuclear,
radioactive (CBNR) weapons
Cyber attacks and large scale cyber
crime
Overseas insurgency creating
environment for terrorism
Major accident or natural hazard,
e.g. extensive coastal flooding,
pandemic
Organised crime
International military crisis Satellite communications disrupted
![Page 5: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/5.jpg)
Risk interconnections map
![Page 6: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/6.jpg)
Felix qui potuit rerum cognoscere causas (Vergil, Georgics)
![Page 7: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/7.jpg)
Felix qui potuit rerum cognoscere causas. (Vergil, Georgics)
It is the cause, my soul, it is the cause. (Shakespeare, Othello)
![Page 8: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/8.jpg)
Operational risk
‘The risk of loss resulting from inadequate or failed internal processes, people or systems or from external events’
- excludes strategic and reputational risk
![Page 9: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/9.jpg)
The Risk Chain
Cause(s) Event Effect(s)
Resources
Reputation
People
Processes
Systems
External Events
Human
9
![Page 10: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/10.jpg)
Agenda
Risk management
- getting the framework right
- getting the culture right
- getting the people right
- because we’re worth it
and mutuals
![Page 11: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/11.jpg)
The 3 lines of defence
RISK
OWNERS
Business
operations
RISK
OVERSIGHT
e.g.: Risk,
Compliance,
Legal, Health
& safety, IT
security, HR
Risk
Committee
B O A R D
Audit
Committee
RISK
ASSURANCE
Internal and
external audit
![Page 12: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/12.jpg)
• The board
• Roles and responsibilities (and
accountability)
• Whose risk is it anyway?
![Page 13: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/13.jpg)
Whose risk is it anyway?
![Page 14: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/14.jpg)
• The board
• Roles and responsibilities (and
accountability)
• Whose risk is it anyway?
• Reporting
![Page 15: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/15.jpg)
Each manager is a fresh obstacle to the flow
of truth up the hierarchy of wastebaskets
![Page 16: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/16.jpg)
Agenda
Risk management
- getting the framework right
- getting the culture right
- getting the people right
- because we’re worth it
and mutuals
![Page 17: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/17.jpg)
![Page 18: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/18.jpg)
![Page 19: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/19.jpg)
Embedding a healthy risk culture
• Committed leadership
– Tone from the top
![Page 20: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/20.jpg)
![Page 21: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/21.jpg)
Embedding a healthy culture
• Leadership
– Tone from the top / tune in the middle
![Page 22: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/22.jpg)
The tune in the middle
![Page 23: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/23.jpg)
Embedding a healthy risk culture
• Leadership
– Tone from the top / tune in the middle
• Strategy and objectives
![Page 24: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/24.jpg)
Whose risk appetite is it anyway?
Public Politicians
Regulators Members
![Page 25: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/25.jpg)
Embedding a healthy risk culture
• Leadership
– Tone from the top / tune in the middle
• Strategy and objectives
• Values and excellent behaviours
![Page 26: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/26.jpg)
US Congressional Financial Crisis
Inquiry Commission (2011)
‘The crisis was avoidable.’
The key conclusions were that there were:
‘dramatic failures of corporate governance
and risk management at many
systemically important financial
institutions’
‘a systemic breakdown of accountability and
ethics’
![Page 27: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/27.jpg)
Embedding a healthy risk culture
• Leadership
– Tone from the top / tune in the middle
• Strategy and objectives
• Values and excellent behaviours (risk
culture)
• Clear roles and responsibilities
• Openness, transparency and
communication
![Page 28: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/28.jpg)
![Page 29: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/29.jpg)
Risk and culture
• Leadership
– Tone from the top / tune in the middle
• Strategy and objectives
• Values and excellent behaviours (risk
culture)
• Openness, transparency and
communication
• Reward
![Page 30: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/30.jpg)
Agenda
Risk management
- getting the framework right
- getting the culture right
- getting the people right
- because we’re worth it
and mutuals
![Page 31: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/31.jpg)
Mitigating people risk through
behaviours
• Behaviours are the drivers for key people risk controls:
– Selection
– Induction and training
– Appraisals and performance assessment
– Reward
• Managing behaviours also mitigates reputation risk, often a people risk issue
• The HR function
![Page 32: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/32.jpg)
Agenda
Risk management
- getting the framework right
- getting the culture right
- getting the people right
- because we’re worth it
and mutuals
![Page 33: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/33.jpg)
Because we’re worth it
• Better informed decisions
• Better understanding of risks and risk events –
past, present and future
• Better protection if something goes wrong (+
early warning)
• Culture is a source of competitive advantage
(can copy technology and products, can’t copy
culture) – your DNA is unique
• So it’s worth it
![Page 34: Risk management for mutuals Thirlwell.pdf · Felix qui potuit rerum cognoscere causas. (Vergil, Georgics) It is the cause, my soul, it is the cause. (Shakespeare, Othello) Operational](https://reader034.vdocuments.us/reader034/viewer/2022051606/60170c3a7c09e9049753228d/html5/thumbnails/34.jpg)
Agenda
Risk management
- getting the framework right
- getting the culture right
- getting the people right
- because we’re worth it
and mutuals