Risk Appetite – Taking the Right Amounts of the Right Risks

Risk Appetite – Taking the Right Amounts of the Right Risks ACSDA Senior Summit – December 5, 2013

Agenda • Introduction and Risk Appetite Overview (20 minutes) • CDS Case Study (60 minutes) • Discussion Groups (45 minutes) • Presentation of Discussion Group Results (45 minutes) Please ask questions or provide comments at any time and share your experiences!

Overview Defining Risk Capacity and Risk Appetite • Risk capacity “refers to the maximum potential impact of a risk event that the firm could withstand and remain a going concern”(1). • Risk appetite “expresses the total amount of risk that an organization is willing to take to achieve its strategic objectives and meet its obligations to its stakeholders”(2) Capacity ≥ Appetite Committee of Sponsoring Organizations of the Treadway Commission (COSO), Strengthening Enterprise Risk Management for Strategic Advantage, 2009 Towers Watson, Risk Appetite –The Foundation of Enterprise Risk Management, 2010

Overview Need for a Risk Appetite Statement • Not having a risk appetite statement can: • lead to inadequate control resulting in the acceptance of undesirable risk positions, or • an avoidance of acceptable risks and underperformance • “All the cool kids are doing it” • Organizations that we consider our peers in risk management have developed or are developing risk appetite statements • Lastly, the regulators require it! • The CPSS/IOSCO Principles for Financial Market Infrastructures (PFMIs) explicitly require FMIs to have a “risk tolerance” statement

CDS Case Study CDS Case Study Objective: To share the experience that CDS has had in order to (a) provide useful guidance to CSDs beginning a similar exercise (b) provoke discussion of experiences of other CSDs (c) to inform CDS’s next phase of enhancements CDS’s experience in developing and using risk appetite has had 3 distinct phases: • Phase 1 (2007 to 2010) • Phase 2 (2010 to 2013) • Phase 3 (2013+)

CDS Case Study Phase 1 – A Starting Point Defined “risk tolerance” only for the purposes of identifying our most important risks A key enterprise risk is an event which, if it occurred, could plausibly create an outcome exceeding CDS’s risk tolerance, more specifically: • A financial loss to CDS in excess of its reserves, currently $10 million; • A financial loss to participants who are members of a collateralized credit ring in CDSX or cross-border services in excess of realized value of the collateral available in the relevant collateral pools; • An inability of CDS to meet fundamental services requirements; • An inability of CDS to meet its financial obligations as contractually obligated; • A reputational loss to CDS such that its ability to effectively provide services to its participants and customers is seriously questioned.

CDS Case Study In 2007, CDS had not expressed its willingness to take risk in any meaningful way December 2007 In 2007, we thought that if these risks really existed, we would likely have been put out of business by then “Risk tolerance” used as threshold for identifying risks that require attention by senior management and Board Missed opportunity to use expression of willingness to take risks as part of day-to-day management of risks

CDS Case Study Risk metrics without context Are these results good or bad? What can we measure them against in order to determine if they are acceptable? CDS presented these charts as part of a presentation on responding to market turmoil at the 2008 ACSDA general assembly in Toronto

CDS Case Study Phase 2 – The light starts to go on! • We realized that our “risk tolerance” was not our willingness to take risk, but our maximum capacity to take risk • We needed to distinguish the risk appetite and capacity of our participants from that of CDS • Most importantly, we needed to address critical cultural issues: • Need to eliminate “zero risk tolerance” mindset • Need to drive ownership and accountability for risk management to the business units Zero Risk

CDS Case Study Relative “Size” of Proprietary and Participant Risk Capacity and Appetite The “Eye Chart” was presented to CDS’s Risk Management Committee in December 2010

CDS Case Study Development of CDS’s risk appetite statement – 4 key inputs Governing objective representing the value proposition of CDS to its key stakeholders Risk capacity and constraints representing CDS’s ability to bear risk Risk Appetite Risk philosophy representing CDS’s set of shared beliefs and attitudes on risk taking Business strategy and objectives which embody the strategic direction of CDS over the planned time horizon

CDS Case Study Phase 2 - Risk Appetite Development Cycle Governing objective, risk capacity and constraints, risk philosophy, business strategy and objectives Keep senior management in the loop as statement changes with stakeholder input! Stakeholders: participants, regulators, Board members (should have included staff!)

CDS Case Study Risk appetite considerations • Risk appetite is still an evolving concept and CDS’s risk appetite statement will evolve as we better understand our willingness to accept risk and as the environment and our strategy changes • A risk appetite is not an excuse for poor performance, unexpected losses or lack of commitment to operational excellence • Expressing a risk appetite does not mean that we don’t care about losses within our risk appetite…we will investigate and learn from losses…could it have been worse?…do we need to adjust our behavour in light of the loss?

CDS Case Study Risk philosophy With the senior management team, we identified a number of basic beliefs and expressions about how we think about risk: • CDS Clearing is fundamentally a risk averse organization. • CDS Clearing recognizes that its ability to manage risk can ultimately affect the financial welfare of Canadians. • CDS Clearing has a fiduciary responsibility as a result of holding assets in safekeeping for our participants. • CDS Clearing considers its peers in risk management to include large financial institutions, public institutions vital to the health and welfare of Canadians and enterprises whose products require extreme levels of safety and reliability. • CDS Clearing is too important to fail (without the moral hazard implications). • CDS INC and CDS Innovations are able to take more risk than CDS Clearing.

CDS Case Study Risk outcome rating exercise conducted with Board Conducted workshops with the Risk Management and Audit Committee of Board: • Discuss a number of risk exposures faced by CDS; • Identify the relevant risk capacity for that type of exposure; • Identify and quantify actual or potential scenarios that have caused or could cause losses due to this type of risk exposure; • Rate CDS’s appetite for the risk that could cause this outcome or scenario on an appropriate scale.

CDS Case Study Board Workshop Exercise #1 CDS holds cash owned by its participants and customers and invests that cash to generate a return. These investments can fluctuate in value as a result of changes in prices (market risk). The total value of these investments typically range between $50 million and $100 million. What is an acceptable level of risk for these investments?

CDS Case Study Board Workshop Exercise #2 In order to record securities in CDSX, critical information about the characteristics of each security such as conversion and extension privileges must be extracted from various documents and entered into the system. Interpreting and recording this information is subject to error (operational risk). What is an acceptable level of risk? Observed historical loss

CDS Case Study Board Workshop Exercise #3 The daily operation of CDSX is vital. As an IT system, CDSX’s availability can be affected by hardware, software and network failures. The recovery time objective (RTO) for CDSX is 2 hours after declaration of disruption. How much risk of a CDSX outage is acceptable?

CDS Case Study Phase 2 – Where did we end up? Quantitative and qualitative statements of our willingness to take specific kinds of risks Different legal entities are willing to take different amounts of risk Examples of these statements are provided in the appendix

CDS Case Study Example 1 – Using risk appetite to manage risk exposure October 2008 November 2013 Relevant Risk Appetite Statement: Participants are willing to accept losses which result from a defaulter’s collateral in a central counterparty service being insufficient. Participants expect that these uncollateralized losses should occur in no more than 1% of potential defaults for CNS.

CDS Case Study Example 2 – Using risk appetite to manage risk exposure October 2008 November 2013 Relevant Risk Appetite Statement: Participants are willing to accept losses resulting from the default of a fellow member of a category credit ring up to the amount of the collateral pledged to the collateral pool by the surviving members (red line in graph).

CDS Case Study Phase 3 – Risk appetite becomes fundamental part of decision making for everyone at CDS Today, there are still a number of issues that CDS needs to address: • The use of risk appetite as a key input into risk decisions is not consistent • Many parts of the organization are unfamiliar with relevant risk appetite statements • Operational risk appetite statement has not successfully been translated to day-to-day operations • Lingering cultural issues – perception of zero risk tolerance still exists; often viewed as an excuse for not taking risk • Our ownership structure has fundamentally changed and we need to generate return for our shareholders while appropriately balancing that return with the resulting risks given our systemic importance

CDS Case Study Phase 3 - Risk appetite in the context of a comprehensive approach to managing our business Business Strategy Organizational Objectives Compliance Rules RCSA – Risk Assessment Risk Appetite Control Objectives Control Design Internal Audit Review Create coaching opportunities Process RCSA Control Procedures Mngt Supervision Self-Assessment Escalation

CDS Case Study Conclusions and lessons from CDS’s experience (so far) • Defining and using your risk appetite statement is a journey, it should and will evolve • Keep things simple • Use real examples from your business • Involve all stakeholders • Tailor it for your organization, make it your own

Discussion Groups Discussion Groups Each group is assigned a topic for discussion and will report back on the results: • Group 1 – What corporate cultural issues can you foresee (or have experienced) in developing and implementing risk appetite and how can these be addressed? • Group 2 – Operational risk is an important category of risk for CSDs and presents particular challenges for defining and implementing risk appetite statements. What are those challenges and how can they be addressed? • Group 3 – CSDs operate with different ownership structures while providing systemically important services in their markets. How can risk appetite help balance meeting the needs of owners (e.g. return) and market participants (e.g. low cost and safety)? • Group 4 – A risk appetite statement typically includes a series of quantitative and qualitative measures. What are the characteristics of effective measures for risk appetite statements? If your group prefers to address a new topic, please go ahead! Select a spokesperson for your group and report on the results of your discussion.

Appendix: Other examples of risk appetite statements Operational Risk • Are willing to accept cumulative losses (to CDS itself or to its participants caused by CDS) resulting from known and accepted operational risk exposures up to 0.5% of total expenses during any 12-month period (approx. $350,000). • Are willing to accept losses from operational processes where the cost of mitigating the risk is greater than a reasonable estimate of the potential future loss (subject to limit above). Strategic Risk • Are willing to invest up to $10 million each year in enhancements to existing businesses with an expected positive return in terms of reduced cost, improved efficiency or value for participants.

Appendix: Other examples of risk appetite statements Financial Risk • Are willing to accept only extremely low amounts of market, credit and liquidity risks for investments made on behalf of third parties: • Market risk: Maximum one-day portfolio market value decline resulting from interest rate changes of less than 0.2% with 99% confidence ; • Market risk: Zero foreign exchange risk; • Credit risk: Extremely low issuer default risk (federal and provincial government securities only); • Liquidity risk: Lowest possible risk of being unable to immediately liquidate positions without loss.

Risk Appetite – Taking the Right Amounts of the Right Risks