Managing Operational Risk Within Your Treasury Environment

1. Managing Operational Risk Within Your Treasury Environment

2. AGENDA • General points • Impact of modern risk transfer • Proven techniques to control and assess operational risk • Objective approach to managing operational risk • Exploiting operational VaR

3. Why is Operational Risk a hot topic? It is still the risk responsible for the most spectacular bank failures • Barings – Index futures • Natwest – Incorrect volatilities used to value cap portfolio • AIB – Forex trading What do they have in common? • Treasury activities • Failure is mostly due to operational risk

4. Operational Risk – What is it? Basel Definition “Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events”

5. Where does Operational Risk occur? Derivatives Desk Transaction After Deliver Product Before Identify client need During Structure Transaction Risk Model Risk Business Continuity Risk Model Risk Disclosure Legal Risk Intellectual Capital Key People Fraud, Processes People, Technology Reputational

6. AGENDA • General points • Impact of modern risk transfer • Proven techniques to control and assess operational risk • Objective approach to managing operational risk • Exploiting operational VaR

7. The Trend • Moving from prevention to active management • Tools and technology exist to transfer unwanted risks to other counterparties • Interest rate derivatives • Credit derivatives • Innovative insurance products using derivatives .

8. Implications Risks are intertwined . If the primary objective is to take and manage market risk • Incur credit risk (counterparty risk) • Incur operational risk (model risk, fraud etc.)

9. Why does the use of derivatives or structured products increase the operational risk of my business? • Characteristics of these OTC products are described legal documents/contracts • Pay-off may be linked to external events • Share prices, Bond Prices • Default of a third party • Complex mathematical models are needed to value these instruments • Skilled people for Administration and Risk management • Appropriate IT solutions end-to-end is scarce .

10. AGENDA • General points • Impact of modern risk transfer techniques • Proven techniques to control and assess operationalrisk • Objective approach to managing operational risk • Exploiting operational VaR

11. Proven techniques for control and assess Operational Risk – Within the Company • Internalaudit • Ensures the quality of risk processes • Ensures compliance with internal policies & procedures • Compliance • Ensures compliance of risk processes with external stakeholders such as regulators • Straight -Through – Processing • Adequately skilled staff .

12. Proven techniques for control and assess Operational Risk - External • Securities Exchanges • Custody systems • Electronic trading systems • Settlement Systems .

13. AGENDA • General points • Impact of modern risk transfer techniques • Proven techniques to control and assess operational risk • Objective approach to managing operational risk • Exploiting operational VaR

14. Model Risk Objective measures for all risks To understand what a business’ most significant risks are, all exposures must be expressed in common terms, e.g., in Rands. What’s my largest exposure? Legal Risk Fraud

15. Concept of Value-at-Risk An estimate of the level of loss on a portfolio, which is expected to be equalled or exceeded with a given, small probability. • Measured in monetary terms • Specific Time horizon • Given level of confidence (99%) .

16. ILLUSTRATIVE What is Operational VaR? Operational Value at Risk (VaR) is the difference between the annual aggregate loss at a selected confidence level and the expected annual loss. Distribution of losses for the bank Expected Losses (included in costs) Unexpected Losses (VaR) Mean Annual aggregate loss (R)

17. Categorisation of Operational Risk Measure losses from operational risk events in terms of six components, which include first and second order losses. Replacement Cost direct losses Legal Total Operational Loss Regulatory Business forgone income Reputation Business Interruption

18. +5 100 Insurance contract -5 0 Overview of the Statistical/Actuarial Approach Operational VaR = f (Exposure, Relevance, Quality, Transfers) Frequency of events Adjusting for insurance programs Mapping products / service to generic business units Mapping quality of control environment to peer group Severity of loss The statistical/actuarial approach is based on the theory that historical data can be used to measure the full range of potential exposures each business faces.

19. Internal Loss Data • Significant commercial benefits • Quantification of operational risk • Development of management processes. • How do I transform the raw data to make it useable? • Convert to the bank’s currency, • Adjust for inflation

20. ILLUSTRATIVE Transaction Processing Criminal Technology No. of lossesMean STD. Retail Banking No. of lossesMean STD. Commercial Banking No. of lossesMean STD. Trading Loss Data Matrix Loss Data Matrix 11 1.2 0.6 54 2 3 11 1.2 3.6 21 3 6 21 0.4 0.3 18 0.2 0.4 11 1.5 4 31 2.2 2.6 70 2.4 4.1 The loss data are placed in a matrix which is used to calculate the risk profile of each business, i.e., the inherent exposure of each business to each type of risk.

21. ILLUSTRATIVE Severity Probability Size of Loss Probability Severity is initially assumed to follow a Log-normal distribution (based on best-fit analysis of existing loss data). In order to calculate the severity distribution for a cell we need to know the mean and standard deviation (the parameters of the Log-normal distribution) of the losses in each cell. Size of Loss

22. ILLUSTRATIVE Severity Internal Loss Data Matrix Transaction Processing Criminal Technology 11 1.2 3.6 11 1.2 0.6 No. of lossMean STD. 54 2 3 Retail Banking 1 0.2 0.4 21 0.4 0.3 No. of lossMean STD. 0 Commercial Banking Anchor cell 11 1.5 4 No. of lossMean STD. 3 2.2 2.6 0 Trading In most cases internal data is incomplete. One can therefore use “anchor cells” - internal data cells that appear to have a sufficient number of small, medium and large losses and external data relationships to populate cells that do not have sufficient data. To be populated by anchor cell(s) and external data

23. ILLUSTRATIVE Why use external loss data ? External data is necessary here Number of events Size of loss SMALL LOSSES - MANY INTERNAL DATAPOINTS MEDIUM LOSSES - SOME INTERNAL DATAPOINTS LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS

24. ILLUSTRATIVE Criminal 14 123 422 1216 3.2 Transaction Processing 11 109 312 835 2.4 Technology 21 214 614 2327 5.2 Sales Practices 21 102 211 612 1.5 Unauthorized Activities 23 213 424 1123 3.1 Internal business unit event count External business unit event count External all financial data event count External all data event count Weighted (annual) average frequency Frequency Retail Banking Frequency is assumed to follow a Poisson distribution. Mean frequency for each cell is calculated using a weighted average of internal and external data.

25. Frequency ILLUSTRATIVE Retail Banking Criminal Frequency Distribution Retail Banking Criminal Severity Distribution Probability Probability Size of loss (R) Number of events The end result is a customized set of frequency and severity distributions for each business unit, for each risk category.

26. AGENDA • General points • Impact of modern risk transfer techniques • Proven techniques to control and assess operational risk • Objective approach to managing operational risk • Exploiting operational VaR

27. Operational VaR – Value Proposition • Create objective measure • Expected Losses (Cost of operational failure) • Unexpected losses (Largest exposures) • Provide framework for cost-benefit analysis • Link controls to performance measurement • Quantifying Operational Risk Capital • Link to shareholder value • Rationalise Insurance Programs

28. ILLUSTRATIVE Sample Operational Risk Report Private Banking Retail Banking Asset Management Investment Banking Trading & Sales VaR (‘000 $) UnauthorizedActivities Sales Practices Technology Criminal Management Processes TransactionProcessing Disasters Unit Name First Second Third Fourth 168 161 153 145 168 161 153 145 33 32 30 29 33 32 30 29 33 32 30 29 33 32 30 29 106 101 96 91 Disasters Quality Score UnauthorizedActivities SalesPractices Technology Criminal Management Processes TransactionProcessing Unit Name First Second Third Fourth 50 60 75 90 50 60 75 90 50 60 75 90 50 60 75 90 50 60 75 90 50 60 75 90 50 60 75 90 18% Percent of Firm Capital Risk Capital 82%

29. ILLUSTRATIVE VaR Comparison VaR is primarily driven by low frequency, high severity risks. Thus, some businesses which experience high annual losses may have a relatively low VaR. Probability Distribution of losses for Business Unit A Distribution of losses for Business Unit B 99th percentile B 99th percentile A VaR A VaR B Mean A Mean B Annual aggregate loss ($)

30. RAROC Calculate the operational risk capital needed in RAROC processes. Risk Adjusted Returns RAROC = Capital for Unexpected Losses Credit Risk Market Risk Insurance Risk Operational Risk Medium Probability Low $10m R1billion Operational VaR

31. Cost Benefit Analysis ILLUSTRATIVE Tool to help a business cost justify investments or risk transfers that will reduce operational risks. Issue Trading and Sales Department considers purchasing a new state-of-the-art computer system for transaction processing. Cost = R18.0 million New Net Quality Score Current Estimate Change Unauthorized Act. 62 67 5 Sales Practices 64 66 2 Human Resources 36 38 2 Cost Benefit Analysis Criminal 88 88 - Management Prs. 54 55 1 VaR savings R36M Hurdle Rate 15% Annual benefit R5.4M VaR cost savings Cost of New System over 5 years R27M > R18M Trans. Processing 44 53 9 Disasters 67 68 1 Technology 68 74 8 External 75 75 - Total Change = +28 Capital VaR Estimate R378 R342 -R36

32. Insurance Analysis ILLUSTRATIVE Medium Issue Without Insurance Whether to purchase a rogue trader insurance policy with excess of R50 million. Cost = R0.8million Probability Low 50m 200m 1billion Potential Loss Cost Benefit Analysis Medium With Insurance VaR savings R6.0M Hurdle Rate 15% Annual Benefit R 0.9M VaR cost savings Cost of Insurance R0.9M > R 0.8M Probability Low R 1billion R50m Potential Loss Capital VaR Estimate R80 R74 -R6

33. Operating Performance Compliance & Prevention Strategic Initiatives Opportunity A B C Uncertainty / Variance Hazard The Challenge pwc

34. Managing Operational Risk Within Your Treasury Environment