operational risk management...risk appetite matrix (will be discussed in the rcsa workshop)...
TRANSCRIPT
![Page 1: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/1.jpg)
BenchMatrix>
Operational Risk ManagementRisk & Control Self-Assessment (RCSA) Workshop
Irfan FazliChief Executive OfficerBenchMatrix W.L.L
1
![Page 2: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/2.jpg)
BenchMatrix>
• The new Basel Capital Accord specifically introduces a capital charge related to the operational risk an institution faces.
• Additionally, Corporate Governance requirements place a specific duty on directors to address operational risk issues.
Three Basic Pillars
Minimum Capital
Requirements
Risk Weighted
Assets
Credit Risk
Standardised Approach
Internal Ratings-based
Approach
Operational Risk
Basic Indicator Approach
Standardised Approach
AdvancedMeasurement Approaches
Market Risks
Standardised Approach
Models Approach
Definition of Capital
Core Capital
Supplementary Capital
Supervisory Review Process
Market Discipline
Capital Requirements (Basel II)
2
![Page 3: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/3.jpg)
BenchMatrix>
Key Success Factors
• Knowledgeable Facilitators
• Business – Subject Matter Expert Participation
• SELF ASSESSMENT !!! NOT AUDIT
• Part of Annual Performance - Attendance
3
![Page 4: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/4.jpg)
BenchMatrix>
RCSA Models
• Scoring Models
• Pre Defined Models – Vendor Scoring Based
• Qualitative Models
• Hybrid Models
4
![Page 5: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/5.jpg)
BenchMatrix>
RCSA Models
• Scoring Models
– Scores Risks and Controls (Traditional Audit Approach)
– Scoring 1- 10 linked to certain ranges
– Total Score linked to overall Thresholds
• Pre-Defined Scoring Models
– Scores Risks and Controls
– Scoring Linked to financial ranges
– Predetermined Weights for Control Effectiveness to arrive at residual risk
– Inherent Risks – Control Score = Residual Risk
5
![Page 6: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/6.jpg)
BenchMatrix>
RCSA Models
• Qualitative Models
– High, Medium and Low (Traditional Risk Assessment)
– Each Selection Defined Qualitatively (Subjective)
• Hybrid Models
– High, Medium and Low (Traditional Risk Assessment)
– Each Selection Defined Qualitatively (Subjective)
– Each Selection Defined Quantitatively (Financial)
– Over all Assessment Based on Financial and Non Financial
– Inherent Risks – Residual Risks = Control Mitigation Value
– Business Driven
6
![Page 7: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/7.jpg)
BenchMatrix>
RCSA Understanding
to Business
Risk Appetite Matrix
Decision on Model –
Management Driven
Key Activities and Business
Profile Vs Process
Mapping
List of Standard Risks and Controls
Key Staff
RCSA Pre-Requisites
7
![Page 8: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/8.jpg)
BenchMatrix>
RCSA Process
Identify objectives of business unit/activity being assessed
Assess level of Inherent Risk (before controls) by Likelihood and Impact
Identify risk treatments (controls) in place for each risk
Assess the controls for design and performance
Assess level of Residual Risk (after controls) by Likelihood and Impact
8
![Page 9: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/9.jpg)
BenchMatrix>
Help with Assessing Gross Risks
• Assessment: Frequency and impact should be assessed on a Gross (before the application of controls) basis
• Impact: Impact of a risk refers to the level to which the risk will affect the financial results of a business. UGB shall use the following dimensions for the impact buckets used for assessment:
S. No Impact Description
1 CatastrophicThis risk would probably have a very significant financial severity if it was to occur, or, this risk would cause severe reputation damage to the business.
2 HighThis risk would probably have a material financial severity if it was to occur, or, would cause reputation damage to the business.
3 ModerateThis risk would probably have a moderate financial severity if it was to occur.
4 LowThis risk would probably have a low financial severity if it was to occur, or, would cause minimal reputation damage to the business.
9
![Page 10: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/10.jpg)
BenchMatrix>
How to View IMPACT
• Inherent Risk
• Controls (Standard Industry)
• Residual Risk
• Controls (Company Specific – An in control of the firm)
• Target Risk
• Desired Risk (Considering cost/benefit balance)
• Consider Value – Average Transaction Size
• Consider Room Temperature ! – Current environment other than specific controls
• Consider activity outside your location or another bank
• Consider going on long vacation – A new guy on the job takes over responsibility
• Consider High Risk by admin/office boy and High Risk by Treasury (both on same report)
10
![Page 11: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/11.jpg)
BenchMatrix>
How to View Frequency/Likelihood
S. No Frequency Description
1 Frequent Monthly (12)
2 Likely Semi Annual (2)
3 Unlikely Annual (1)
4 Remote (0.25) 1- 4 Years
• Frequency: Frequency of a risk refers to the chances of that risk occurring. UGB shall use the following dimensions for the frequency buckets used for assessment:
• Consider Volumes
• Consider Number of Activities
11
![Page 12: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/12.jpg)
BenchMatrix>
Help with Assessing Controls
• Assessment: A control shall be assessed based on its design and performance. A flaw in either component will result in a poor or ineffective overall control score.
• Control Design: Consider how well the control should work in theory, if it is always applied in the way intended.
• Control Performance: Consider the way in which the control is operated in practice, if it is applied when it should be and in the way intended by its designer.
12
![Page 13: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/13.jpg)
BenchMatrix>
Help with Assessing Controls
Assessment Description
PoorControl is not effective in mitigating the portion of the risk it is designed for. The control needs to be replaced.
InadequateControl is not effective in mitigating the portion of the risk it is designed for. Significant improvement is needed.
AdequateControl is mostly effective in mitigating the portion of the risk it is designed for. Minor improvement is needed.
StrongControl is fully effective in mitigating the portion of the risk it is designed for. For controls rated strong for a specific risk, the risk must be fully mitigated.
13
![Page 14: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/14.jpg)
BenchMatrix>
Risk Appetite Matrix
High Risk (Asset Management ) = High Risk (Administration)
Subjective Assessments = Subjective Value Addition ( ??? At the top)
Measurable Assessment = Difficult (Value addition)
RULE OF THUMB (Below)
Addition Floor and Caps
Sample RAM
Total Revenue Low Moderate High Catastrophic
2 weeks One month Two Month Three Months
120 Million 5 Million 10 Million 20 Million 30 Million
14
![Page 15: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/15.jpg)
BenchMatrix>
Risk Appetite Matrix (will be discussed in the RCSA Workshop)
Investment Banking
Total Revenue Low Moderate High Catastrophic
2 weeks One month Two Month Three Months
XXXX
Asset Management
Total Revenue Low Moderate High Catastrophic
2 weeks One month Two Month Three Months
XXXX
15
![Page 16: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/16.jpg)
BenchMatrix>
Heat Map
• Heat maps will be used to plot inherent and residual risks and assess their impact on the overall risk profile of the Bank.
16
![Page 17: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/17.jpg)
BenchMatrix>
RCSA Deliverables
• Top 20-30 Risks Identified with Associated Controls
• Management Decision on Acceptability of Risks not within Appetite or Decision on its Mitigation
• Action Plans with clear deadlines and responsible person
17
![Page 18: Operational Risk Management...Risk Appetite Matrix (will be discussed in the RCSA Workshop) Investment Banking Total Revenue Low Moderate High Catastrophic 2 weeks One month Two Month](https://reader035.vdocuments.us/reader035/viewer/2022062612/6137881a0ad5d2067648ae36/html5/thumbnails/18.jpg)
BenchMatrix>18
Thank You! Questions?