Operational Risk Management in Islamic Banks : New Research Findings

1. Operational Risk Management in Islamic Banks: New Research Findings Session 9 Presentation by Dr. Nasreen Al Qaseer, GM – Risk Management Kuwait International Bank

2. Investing in Operational Risk Management Most Banks are investing to manage Operational Risks based on: Best fits for their individual objectives Circumstances and Management views Practice Banks are trying to find the right balance between Risk Measurement and Risk Management

3. Traditional and Modern ORM Two general approaches for managing Operational Risk: Traditional Related to an imminent threat Requires tactical decisions and solution May not address strategic issues such as optimizing the Risk / Control relationship in the context of risk / loss tolerance Modern Designed to help make strategic decisions Requires different framework based on data models and scenario analysis

4. Diversity and Common Approach – Key Findings Diversity is caused by Choices and circumstances Regulatory influence Early stage in evaluation of risk management Common Approaches – Building Blocks Good Governance enabling scenario analysis Preparing and designing scenarios with clear objectives Assessment by subject matter experts, business unit managers, executives, risk managers, etc. Validation of results Reporting

5. Problems with Traditional Methods In most banks, the ORM framework is based on traditional risk and control self assessments (RCSA) High Risk is often assessed as High Likelihood and High Impact rather than Low Frequency and High Severity Focus on high operational issues rather than operational risk May result in excessive controls in areas where there is most risk Managing operations differs from managing risks Limits potential failures to one possible outcome, whereas in fact they can have wide range of outcomes

6. Modern Approach to ORM Modern ORM framework is based on Historical Data and Actual Loss Models Loss Frequency and Severity distribution of expected and unexpected losses A multi-dimensional framework Helps determining the nature of businesses to invest in, based on their risk-reward relationship Helps determining which risk mitigation strategies to employ by optimizing the risk/reward and risk/control relationship across the full spectrum of exposures.

7. The Problem with Loss Data Analyzing internal loss data merely depicts the status of a bank’s control environment. To model and anticipate risks, scenarios should be employed, preferably with the frequency and severity input of reliable external data. Such data are hard to come by from public sources. Ideally, banks would share their losses anonymously in a loss data consortium, as is already being done by conventional banks in various countries, such as the UK, the US, Italy, Germany, Korea, Japan, Kazakhstan, or Indonesia. There is interest for such consortia in several Gulf states, but without the local regulator’s public encouragement, the efforts keep ending up as failed initiatives.

8. Risk Management in Islamic Banks Islamic Banks face lower levels of Risk than Conventional Banks due to the following: The returns on saving/investment deposits are contingent. As depositors are rewarded on a profit/loss sharing basis, they share also the business and credit risks of the bank’s operations. The use of Islamic financing models on the asset side changes the nature of traditional risks. Credit risk arises in the form of counterparty risk due to non-performance of a trading partner. Non-payment of dues in the stipulated time by the counterparty implies a loss to bank. Market risk incurred in instruments like commodities and equities traded in well-traded markets appears to be lower.

9. Operational Risk Challenges in Islamic Banks -1 Operational risk can arise from different sources: Some aspects relevant to operational risk in Islamic banks are the legal risk involved in contracts, the understanding of the modes of financing by employees, producing computer programs and legal documents for different instruments, etc. Operational risk is lowest in fixed income assets, and highest in product-deferred sale contracts. As the rates of returns on deposits in Islamic banks are based on profit sharing, this implies certain risks on the liability side of the balance sheet. Even though returns on deposits can vary, Islamic banks are under pressure to give the depositors a return similar to that of conventional banks. Depositors typically blame the bank for a lower rate of return.

10. Operational Risk Challenges in Islamic Banks -2 Other sources for operational risk include: Islamic financial institutions have also identified other risks that they face. At the government level, these include legal, central bank regulations and legislation, no Islamic window for borrowing in terms of need, non-availability of short-term funds foreign exchange, natural disasters, specific industries, domestic economy and politics, and international financial and market environment. Not to be neglected is the KYC principle. Islamic banks must not do business with customers who turn to Shariaa non-compliant activities. Ongoing KYC is therefore much more important than with conventional banking.

11. Boundary Risk Challenges in Islamic Banks Operational misbehavior or misguided strategies of the bank may result in reputational harm. And in Islamic finance, a bank’s reputation is much more critical to attract investors than in conventional banking. Any Islamic bank with consistent negative headlines like currently JPMorgan, RBS, Barclays or UBS would probably long be out of business. Similar to other banking types, operational risk is a major part of a bank’s credit portfolio. In my thesis I found that about 60% of underlying reasons for loan defaults were operational in nature, 10% were market risk driven, and only 30% of underlying default reasons were truly credit risk.

12. Assessment of Operational Risk in Islamic Banks -1 One of the highest traditional risks for banks is Operational Risk, but it is hardly ever recognized with its inherent importance. As per the overall assessment of Risk Management Systems in Islamic Banks, the following aspects appear to have been reasonably addressed Establishing an Appropriate Risk Management Environment, Policies, and Procedures Maintaining an Appropriate Risk Measuring, Mitigation, and Monitoring Process Policies and Safety nets introduced by regulatory authorities to protect the integrity of markets, to safeguard the interests of depositors and to avoid systemic risks.

13. Assessment of Operational Risk in Islamic Banks -2 Ensuring the maintenance of a minimum level of risk-based capital Putting in place an effective system of risk-based supervision and ensuring the timely disclosure of correct information about risk management systems and processes Risk Disclosure: Providing transparency to stakeholders Relevance of the International Standards for Islamic Banks: The Core Principles document sets pre-conditions for effective banking supervision The difficulty in applying international standards for Islamic banks lies in applying uniform capital adequacy standards.

14. Some Other Shariaa Related Issues Murabaha, Shariaa Operational Risk related issues: Type of transactions Sequence of owning the financed “goods”, Bank owns first, then the client The existence of the “goods” and to check its specifications, and extent of the financial impact of the transactions on the Bank’s profits Tawaruq, Shariaa Operational Risk related issues: 3rd party is really involved in the deal by selling or buying Wording and attachments of the contract

15. Presented by Dr. Nasreen Al Qaseer • nalqaseer@gmail.com