1 / 27

Operational Risk

Operational Risk. Risk Appetite & Operational Excellence. Catherine van Doorslaer Operational Risk Manager at ING Belgium. Catherine van Doorslaer – Short Bio . 1990-1996: University degrees (Namur, Leuven, Louvain-la-Neuve) in Economics and International Politics

amir-cooper
Download Presentation

Operational Risk

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Operational Risk Risk Appetite & Operational Excellence Catherine van Doorslaer Operational Risk Manager at ING Belgium

  2. Catherine van Doorslaer – Short Bio • 1990-1996: • University degrees (Namur, Leuven, Louvain-la-Neuve) in Economics and International Politics • 1997- 2000: Banca Monte Paschi Belgio • 2000-2003: ING Credit Risk Analyst • 2003-2014: ING Operational Risk Manager • Set up of ORM framework within ING Belgium • Team Manager for ORMers (Business Advisory) • Scenario Analysis and Risk Assessment • Entreprise Risk Management

  3. Agenda • ING Belgium in 2 slides • Operational Risk – A young discipline with a lot of dilemmas • Risk Cartography : Risk & Event dilemma • Completeness : The pixel dilemma • Risk Appetite • Operational Risk vs Operational Excellence • Operational Risk – Sharing some trends • Image & Social media • Controls & Communication • Cybercrime • Need for some “industry approach” • Physical security – The next challenge?

  4. Online channels made easier Home’Bank Plus:sign a business credit online Home’Bank: new accounts overview Mobile: ordering ING Visa Classic with ‘MyING.be’ Tablet: launch of ‘Smart Banking’

  5. ORM – a young discipline Risks of a bank « Operational risks » Credit Risk CreditRisk MarketRisk Basel 1 (1988) Basel 1 (1995) Credit Risk Market Risk Credit Risk Market Risk Operat. Risk Basel 2 (2004) Residual risk

  6. Basel II • Context • The increased competitive environment has pushed the various industries to venture into new markets and new products which has increased the complexity of their operations and consequently their risk profile. A deeper analysis of all risks is a necessity. Adequate management and supervision of operational risks is one of the big challenge within the banking industry. • 9/11 has put increased focus on Financial Economic Crime (FEC) a.o. terrorism financing (Compliance) • Financial crisis has put the focus on operational risks with an increased attention to fraud related risks • Definition of Operational Risk • The Basel Committee defined operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events”.The definition includes legal risk but excludes strategic and reputational risk. The nevertheless, the latest is often included by banks (case of ING). 7

  7. Basel II – Capital Measurement Basic approach 15 % of income Standardisedapproach capital =  * gross income per business line, with  between 12% and 18% depending on business line (Corporate Finance, Trading, Retail,…) Advanced MeasurementApproach Need for compliance with quantitative & qualitative standards, such as incident reporting history of 5 years, independent ORM function, implication of Senior Management, written policies and procedures and active day-to-day ORM – 4 quantitative building elements InternalLoss data ExternalLoss data Scenario Analysis Business Environment & Internal Control Factors Basel II Operational & Compliance Risk Department

  8. Basel II • Next to this definition, the Basel Committee defined (7) operational risk events that are commonly considered as having the potential to result in substantial losses and that help to refine the definition of Operational Risk: • Internal Fraud • External Fraud • Employment practices and Work place safety • Clients, products and Business Practices • Damage to physical assets • Business disruption of system failures • Execution, delivery and process management • Institutions can adapt these categories to build their own model. 9

  9. ORM – Risk & Event Dilemma • Literature • All guides related to Operational Risk advises you to start by establishing your « risk cartography » based on existing processes • Identify the possible events (impact/likelihood) to prioritize your risk mitigation/management activities Whatever the root cause… you’ve lost your building! That’s the risk…

  10. ORM – Risk & Event Dilemma • Each event can be placed on a impact/likelihood matrix • At the end how will you evaluate the overall risk independently from the cause… • Our approach: • Be sufficiently alert in defining the most probable event. • Agree on impact. • Define an « average » likelihood in order to have something realistic vs experience and expectations • Yearly expected loss as a 2nd check

  11. ORM – Completeness – The pixel dilemma • All organizations are more and more complex • After the bank crisis, all parties (regulators, external auditors, … board of directors, …) want to have a complete view on all risks at a very granular level • Two dilemmas to handle :

  12. ORM – Completeness – The pixel dilemma • Keep the overview despite an increasing number of risk points

  13. ORM – Completeness – The pixel dilemma • Avoid to make a risk appear (absurdly) bigger than it is

  14. ORM – Completeness – The pixel dilemma

  15. ORM – Completeness – The pixel dilemma Risk Management vs Risk Measurement

  16. ORM – Completeness – The pixel dilemma • Our approach: • Standard Risk Library • Detailed issue & action tracking but aggregated measurement and test results (e.g at value chain level)

  17. Risk appetite • Where do you place your call for action? • Keep business aligned • Risk Profile / max Hit / 1 in 10 / Scenario • Integrate the Pixel dilemma in the picture • Our approach: • Relates to gross income at entity level • Based mainly on risk profile but other concepts are now being integrated • Attention given to scenario but in separate view • Split between risk area still to be fine-tuned • Some recurring discussions • Discussion on profile vs incidents • Losses vsbehaviour • How to quantify (& measure) the reputational risk…

  18. Operational Risk & Operational Excellence • Still seen as two separate (and parallel) journeys…and often perceived as the best enemies • Operational Excellence focuses mainly on Processing ensuring an acceptable “Processing Risk”often without looking at the other risk (Lean, 6S, ...) • Bringing both together is a key factor for success and long term savings • Our approach : • 10 Risk areas • Compliance, Control, Personal & Physical Security, Internal Fraud, External Fraud, Unauthorized Activity, Employment Practice Risk, Processing Risk, Business Continuity Risk, IT Risk

  19. Operational Risk & Operational Excellence • As reducing one risk will increase another one… you best have to find the right balance as from the beginning and regularly re-challenge this balance as environment is also changing • Need an holistic view on the risks… • Many saving programs lead to serious investments once the holistic view is taken • Solution? ERM • Identify and manage risk across the End-to-End Process • Example: • Payment Name & Address Check • Following the law can not be enough…

  20. Operational Risk & Operational Excellence • Imagine that you improve the following process with the fuel consumption as only focus…

  21. Operational Risk – Sharing some trends & feelings • Image & Social Media • Incidents are known by the wholecommunity • Social media is used to complain with exponential exposure • Image/Reputational impact is huge • Our approach: • Proactive follow-up of discussions about our company • Dedicated team to ensure proper communication • Pro-active media scripts part of incident management

  22. Operational Risk – Sharing some trends & feelings • Controls & Communication Case: In 2010, ING Belgium has been targeted by fraudster due to a higher default limit on their debit card (weekly limit vs day limit). Analysis of the incidents has shown that people above 60 were also specifically targeted. As temporary solution, it has been decided to reduce the default limit of this group of clients. Wrong communication lead to strong reactions in the media and complaints related to discrimination. Control was right but was not sustainable due to wrong communication… In the meantime default daily limit (applicable for all customers) has been implemented without any reaction.

  23. Operational Risk – Sharing some trends & feelings • Cybercrime – Global risks requiring an industry broad approach (e.g. awareness) • Case study: • Awareness campaign built with Febelfin (Association of Belgian Banks)

  24. Operational Risk – Sharing some trends & feelings

  25. Operational Risk – Sharing some trends & feelings • Physical security challenge – Staff & Clients • Human become more and more the easiest “point of failure” • Reduction of cash has lead to soften the physical protection… is this right?

  26. Thanks for your attention

More Related