Operational Risk Management

1. Operational Risk Management Member Education Series Seminar Indian Institute of Banking & Finance Nagpur November 2005

2. Agenda • Definition • Causes/Contributors • Process • Gross Income • Computation of Capital Charge • Approaches • Assessing events • Measurement basis • Monitoring • Data requirements • Management tasks

3. Definitions Operational risk (OpRisk)has been defined by the Basel Committee on Banking Supervision as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. Management of Operational Risk means and includes identification, assessment, monitoring and control/mitigation of this risk.

4. Causes of OpRisk • Internal fraud • External fraud • Employment practices and workplace safety • Clients, products and business practices. • Damage to physical assets. • Business disruption and system failures • Execution, delivery and process management

5. Causes of OpRisk • Highly Automated Technology • Emergence of E- Commerce • Emergence of banks acting as very large volume service providers • Outsourcing • Large-scale acquisitions, mergers, de-mergers and consolidations • Engagement in risk mitigation techniques giving rise to legal risk

6. Contributors to OpRisk • People Risk • Process Risk • Transaction Risk • Documentation/contract risk. • Operational Control Risk • Model Risk • Systems Risk • Technology Risk- • MIS Risk. • Legal and Regulatory Risk • Event Risk

7. OpRisk Management process • Appropriate policies and procedures • Efforts to identify and measure operational risk • Effective monitoring and reporting • A sound system of internal controls, and • Appropriate testing and verification of the Operational Risk Framework

8. Concept of Gross Income • The Basel Committee has allowed each relevant national supervisor to define gross income. RBI defines gross income as follows, • Gross income = Net profit (+) Provisions & Contingencies (+) operating expenses (Schedule 16) (-) profit on sale of HTM investments (-)income from insurance (-) extraordinary / irregular item of income (+) loss on sale of HTM investments

9. Computation of Capital Charge Standardized Capital change based on single risk indicator Foundation Capital based on business lines and industry standards Operational Risk Advanced Capital based on business lines and internally calculated standards

10. OpRisk Approaches

11. OpRisk Approaches

12. 18 18 12 15 18 15 12 12 Standardized Approach--Capital Charge • Corporate finance Gross income b1 • Trading and sales Gross income b2 • Retail banking Gross income b3 • Commercial banking Gross income b4 • Payment and settlement Gross income b5 • Agency services Gross income b6 • Asset management Gross income b7 • Retail brokerage Gross income b8

13. Recognizing/Assessing Risk Events (i) Experience - The event has occurred in the past (ii) Judgment - Business logic suggests that it is a risk (iii) Intuition - Events where appropriate measures saved the institution in the nick of time (iv) Linked Events - This event resulted in a loss resulting from other risk type (credit, market etc.) (v) Regulatory requirement ASSESSMENT • Self assessment • Risk mapping • Key Risk indicators

14. Factors: Assessing Potential risk areas (i) Staff related factors such as productivity, expertise, turnover (ii) Extent of activity outsourced (iii) Process clarity, complexity, changes (iv) IT Indices (v) Audit Scores (vi) Expected changes or spurts in volumes

15. Risk Measurement: Basis (i) Total number of risk events (ii) Total financial reversals (iii) Net financial impact (iv) Exposure: Based on expected increase in volumes (v) Total number of customer claims paid out (vi) IT indices: Uptime etc. (vii) Office Accounts Status: such as changes in balances

16. Monitoring Operational Risk--Issues Operational loss events Identification of appropriate indicators Frequency of monitoring and reporting MIS Business line identification Corporate finance, Trading and sales, Retail banking, Commercial banking, Payment and settlement , Agency services, Asset management, and Retail brokerage.

17. Data Types Transactional Operational/CRM Analytical Risk management Economy/Industry Data Collected Loss Event Data Causal Data Loss Effect Key Risk Indicators (KRIs) Proxies Risk Inventories Structured Self Assessment Data External Data OpRisk Management & Data Needs

18. Management tasks • Decision whether control for risk minimization or bear • Risk mitigation tools as complementary to control • Investment in technology and Information security • Outsourcing policy-- development and adoption • Impact of operational break downs and loss---intra and outside bank • Business Continuity plans and testing • Review of Business Continuity plans

19. Organisational Set-up • Board of Directors • Risk Management Committee of the Board • Operational Risk Management Committee • Operational Risk Management Department • Operational Risk Managers • Support Group for operational risk management

21. THANK YOU