Operational Risk Discussion KPMG PDF

KPMG
g
Business Dialogue
KPMG Luxembourg, 23rd May 2012
Operational
p Risk
Sven Muehlenbrock, Head of Financial Risk Management

Francesca Messini, FRM, Financial Risk Management
Bertrand Segui, Actuary, Financial Risk Management
Agenda
Introduction
Well known cases
Regulatory Framework
Operational Risk Management Process
The benefit to implement an operational risk management framework
Hints on implementing an operational risk management and

measurement system
What is next?
KPMG Solution
2012 KPMG Luxembourg S. r.l., a Luxembourg private limited company, is a subsidiary of KPMG Europe LLP and a member of the
KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights
reserved.
Operational risk in bank, funds and insurance company
What did we learn?
Barings case SocGen case Unsuitable investments

The trader Nick Leeson led to a loss The trader Jerome Kerviel led to a JP Morgan, UBS, Depfa Bank and
of USD 1.4 bio at his employer loss of EUR 4.9 bio at his employer Deutsche Bank paid approximately
Barings Plc Bank, that declader SocGen, taking a massive USD 602.4 mio to municipalities of
bankruptcy, taking a position in unidirectional position in European Milan, Italy, for selling complex
derivates. equity index futures in 2007 and derivatives inappropriate for
2008 inexperienced investors
1994 2008 2012
Clients, products
and business
practices events
continue to make up
the majority of the
top five losses each
month.
Source: SAS Software
reserved.
Operational risk is defined as the risk of loss resulting from inadequate or failed
internal processes, people and systems or from external events.
This definition includes legal risk, but excludes strategic and reputational risk
Cause Risk Event (what goes wrong) Impact
Fraud
Human error in processing transactions
Missing a control step
Internal Disruption or system failures (hardware, software,
telecommunications) Customers claim
(process, people
Act of sabotage or vandalism from an employee Near misses
and systems)
Not compliance with law and regulatory requirements Forgone Revenue
Di
Dispute
t with
ith employee
l d
due tto di
discrimination
i i ti or h
harassmentt Repurchase of stuff
New service and/or change in the current processes Fine from authority
Fraud
External
Act of terrorism and sabotage
reserved.
Agenda
Introduction
Well known cases
The benefit to implement an operational risk management

measurement system
What is next?
KPMG Solution
reserved.
Regulatory framework
Bank ManCo and Funds Insurance companies

Basel II / III CSSF Circular 07/290 Solvency II
CSSF Circular 06/273 CSSF Circular 11/512 Level 2 implementation
measures, CP 52, final advice
AIFMD (RTS)
Three-pillar approach
Pillar 1 Pillar 2 Pillar 3
Quantitative capital Qualitative supervisory Market discipline
requirements review
Own Funds ICAAP Transparency
Market Risk Supervisory

p y Review Disclosure requirements
q
Process (SRP)
Credit Risk Solvency and financial
Own risk and solvency condition report (SFCR)
Operational Risk assessment (ORSA)
...
reserved.
Regulatory framework for Banks
Advanced Measurement Approach

Basel II, Pillar I: Capital Requirement
AMA
Regulatory Capital = Internal statistical
Three approaches: the increase of sophistication model - capital charge is equal to the
is related to the fact that the AMA can be tailor- unexpected losses (UL) with 1 year of
made to the specific bank horizon time and 99.9% of confidence level;
sophisticattion
effect of insurance up to 20% can be taken
i t accountt
into
develop a risk management framework:
methods to identify, assess, monitor and
control;
Standard Approach*
Collect internal loss data;
SA use external losses;
Regulatory Capital = GI *BL perform scenario analysis and review
business environment and internal
(between 12% and %) control factors;
validate the model results.
Basic Indicator Approach
board of directors and senior management actively involved;
BIA clear role and responsibilities assigned;
Regulatory Capital = systematic collection of operational risk data, integrated into the processes;
*
Average of last 3 years GI * regular
l reporting
ti and
d good
d documentation;
d t ti
subject to regular review by external auditors and/or supervisors.
KPMG network of independent member firms affiliated with KPMG International Cooperative (KPMG International), a Swiss entity. All rights * ASA alternative SA 2 BLs based on ptf volume instead of GI
reserved.
Regulatory framework for AIFM
AIFMs shall
implement Operational Risk
adequate risk
management
systems in AIF AIFM
order to
identify
identify, A failure in operation can impact Potential liability from professional
measure and
the return of AIF
monitor negligence in performing the
appropriately Examples:
all risks activities of AIFM
Failures in trading,
relevant to
settlement and valuation
each AIF services
investment
Internal or external fraud
strategy and Implementation of operational risk
to which each Failure in the reconciliation
processes performed by management framework
AIF is or may
fund administration
be exposed Additional Own Funds
(Directive 2011/61/EU Etc.
art 15) Hold a professional indemnity insurance
reserved.
Regulatory framework for AIFM
Professional
Indemnity Additional Own
Insurance (PII) Funds
0.01% * AuM
QUANT
Can be lowered to 0.008% provided AIFM can demonstrate that liability risk is
adequately captured, based on historical loss data and minimum historical
observation of 3 years
Implement an effective internal operational risk management policies and

QUAL
procedures
It shall be performed by an independent function
Record and make use of historical internal loss data, external data, scenario
analysis and factors reflecting internal controls
reserved.
Regulatory framework for Insurance companies
Under Solvency II, there are two ways to calculate the exposure to operational risk
Standard Formula Internal / Semi internal

model
Advantage:
- Simple to implement and fast calculation

- Doesnt require to create sophisticated models
- Already approved by the regulator
Inconvenients:
- The formula is deterministic and doesnt fit to every business

- The calibration has been done on the whole insurance market and may be totally inappropriate for
specific
ifi iinsurance off reinsurance
i companies
i lleading
di to potential
i l overestimation
i i off the
h capital
i l charge
h
- The formula remains static and doesnt integrate any update of the companys historical losses
reserved.
Solvency I balance sheet / The lack of risk management
Excess of
capital
Capital
Solvency
Margin
Required
((SMR))
ASSETS
In book value In non-life:
SMR Max (18 %. P 50 M 16 %. P 50 M ; 26 %. P 35 M 23 %. P 35 M )
In life:
Technical SMR 4 %. P 2 %. Riskycapit al
Provisions
NO RISK MANAGEMENT
The operational risk had NO impact on the
solvency margin
reserved.
The standard formula approach
Market Health Default Life Non-life Intangible
2012 KPMG Luxembourg S. r.l., a Luxembourg private limited company, is a subsidiary of KPMG Europe LLP and a member of the 12
reserved.
BSCR
reserved.
SCR
Adj BSCR Operational
reserved.
SCR
Adj BSCR Operational
In the context of the standard formula, the operational risk is a function of the BSCR:
Operational Risk = Min ( 30% x BSCR ; Op ) + 25% Exp UL
Where:
- Op is a charge for all business other than Unit Linked products (simple formula expressed as
a % of premium and a % of the technical provisions)
- Exp UL represents the expenses incurred the last 12 months in respect with UL products
reserved.
Agenda
Introduction
Well known cases

measurement system
What is next?
KPMG Solution
reserved.
Implement an advanced operational risk management approach

is much more that capital relief!!
It is not just fulfil some regulatory capital obligations!!!
Go deeper to the end of the things, understanding the root cause
Make operational risk very concrete and keep it alive
Employees start using it for their day-to-day risk management,

embedded in the business
reserved.
Pay attention to the invisible part of the iceberg
In some cases, operational risk is

the cause of the exposure to other
Model
ode
risks
i k type.
t risk
Silo mentality results in lack of

understanding of operational risk as
di
driver ffor other
th risk
i k ttypes. Credit Liquidity
Liq idit
Risk risk
Operational
Risk
Some of the well-known
ell kno n e
examples
amples are
the market-related operational risk
events which are often associated with
rouge trading, unauthorized, leverage Market Business
operations or complex instruments risk Risk
and new products.
reserved.
The Benefit for the institution to implement an operational risk management
Sound evaluation of all the processes
It is integrated and Internal

interfere with the Audit
Private
b i
business off the
th Banking &
institution. Asset Back Office
manage-
ment
Operational
O ti l Ri
Risk
k
Management function has
a global picture of the risk Operational
profile of the entire Legal Risk Front Office
Function
instit tion
institution.
Complian-ce Accounting
HR, IT,
Facility
reserved.
Implement an operational risk management framework
To create value for the management of operational risk, the actual risk exposure must
be aligned with the overall risk appetite of the institution
Operational Risk
Management Framework
Risk Policy &
Strategy &
Strategy
anization
Risk
Operational Risk Policy, S

Risk
nce and Orga
M
Management t
Identification
Procedures
& Monitoring
P
Governan
Risk Risk
Reporting Assessment
Culture and Awareness
reserved.
Have a sound view: past + future thinking the unthinkable
Operational Risk management process is based on the relationship among various

instruments
Operational Risk Management

R
Reporting
ti
Measurement and Modeling of Capital charge
Business
External Loss Data Environment (KRI)
Internal Loss Data Control Factors Scenario Analysis
BACKward-looking PRESENT-looking FORward-looking
Process Risk Mapping
reserved.
Identification
The detection of any event which potentially triggers a

Ri k Policy
Risk P li & material
t i lbbusiness
i iimpact,
t or which
hi h represents
t a
Strategy modification of the risk profile, must be done as early as
possible (timely) and could be initiated by:
Claims from customers or incidents
Risk
Risk Key Risk Indicators breaches
M
Management t
Identification
& Monitoring External Losses
Change of business
New regulatory requirement
Internal / External Audit finding
Risk Risk New product / project

Reporting Assessment Scenario Analysis
Etc...
All risks as well as root causes of losses are identified and mapped
pp to the banks risk classification ((Basel II
Event Type) and the potential impact estimated (how, where, how much)
reserved.
Identification
Identify an operational risks means at the same time identify its root cause
Losses due to acts of a type intended to defraud, misappropriate property or

Internal Fraud circumvent regulations, the law or company policy, excluding diversity/
discrimination events, which involves at least one internal party
Losses due to acts of a type intended to defraud, misappropriate property

External Fraud or circumvent the law, by a third party (theft, hacking damage, etc.)
Losses arising from acts inconsistent with employment

employment, health or safety laws
Employment Practices
or agreements, from payment of personal injury claims,
and Workplace Safety or from diversity / discrimination events diversity
Losses arising from an unintentional or negligent failure to meet a professional

Clients, Products and
obligation to specific clients (including fiduciary and suitability
Business Practices requirements), or from the nature or design of a product.
Losses arising from loss or damage to physical assets from natural disaster or
Damage to Physical Assets other events (terrorism, vandalism).
Business Disruption and Losses arising from disruption of business or system failures (hardware,
System Failures software, telecommunications)
Losses from failed transaction processing or process management, from

Execution,, Delivery
y and
relations with trade counterparties and vendors (miscommunication
(miscommunication, wrong data
Process Management entry/ handling, delivery failures, negligent loss of clients assets, etc.)
reserved.
Identification
The instruments usually used in order to identify ex ante, and then monitor and
calculate the exposure to operational risk are:
Business
External Loss Data Environment (KRI)
Internal Loss Data Control Factors Scenario Analysis
BACKward-looking PRESENT-looking FORward-looking
In the regulation these instruments are identified as the key building blocks of risk
!
measurements, BUT it does not elaborate on how to put them together.
I tit ti
Institutions have
h the
th tasks
t k off finding
fi di the
th mostt appropriate
i t way!!
reserved.
Assessment
The Operational
p Risk Function assesses the
Ri k Policy
Risk P li &
Strategy risk exposure both in qualitative and
quantitative term.
The assessment of an incident or a potential
Risk risk aims at quantifying the risk in financial
Risk
M
Management t terms using
i either
i h simple
i l or sophisticated
hi i d
Identification
& Monitoring methodologies like simulation using Monte
Carlo approach.
Risk Risk
Think the unthinkable! Integrate the backward-looking view with the forward-looking
reserved.
Operational Risk
Assessment with LDA Model Overview
The most popular method in the industry to satisfy the highest standards is the loss
distribution approach (LDA)
INPUT OUTPUT
Adjustments: KRI,
mitigation factors
(i e insurance
(i.e. insurance, ect)
External losses Frequency Distribution

Loss Distribution
Body Tail
Monte
Carlo
Internal losses Severity Distribution Simulation
Body
Expected 99.5 /99.9%

Scenario data Loss Quantile
T il
Tail
reserved.
Example of internal module simulation
We consider an insurance company with following characteristics:

50 years old
Historical loss data well documented:
* 3 fraud events Losses in the range 100 000 - 1 000 000

* 5 lawsuit actions Losses in the range 50 000 - 200 000
* 2 vandalism Losses in the range 10 000 - 150 000
* 7 damages to physical assets Losses in the range 40 000 - 800 000
Step 1: Inputs
Convert those events into scenarios:
Range of loss severity Frequency

(
(EUR) ) (
(years))
Scenario 1 100 000 1 000 000 3/50
Scenario 2 50 000 200 000 5/50 = 1/10
Scenario 3 10 000 150 000 2/50 = 1/25
Scenario 4 40 000 800 000 7/50
As the number of losses may remain an insufficient basis, one more scenario deemed relevant can
be added:
*TTerrorism
i attack
tt k
Scenario 5 500 000 10 000 000 1/200
reserved.
Example of internal module simulation
Step 2:
We translate the severity information into a scale distribution of severity and we fit the best
parametric distribution
Frequencies
0
Losses (Severity)
Step 3
W suppose than
We th severity
it and
d frequency
f are two
t independent
i d d t random
d variables
i bl and
d we simulate
i l t
them independently
Excel sheet
reserved.
Reporting
Enhance senior management awareness of

operational risk: it is put on the agenda
Risk Policy &
Strategy The BoD and Senior Management are timely and
soundly informed about material risks and change of
the actual risk profile of the bank, covering causes,
Risk
Risk potential early mitigation measures, assessment and
Management
Identification recommendation,
d ti in
i order
d tot take
t k the
th appropriate
i t
& Monitoring
action.
Risk Risk BoD Senior

Reporting Assessment Management
Operational
O i l Ri
Risk
kMManagement
Function
Unit A Unit B Unit C
reserved.
Reporting
Benefit of having in place a timely reporting and escalation process:
Internal view External view

Enhance awareness of risk Increase reputation versus
competitors
More informed decisions making Reduce exposure to reputational
risk through timely management of
operational incidents
Clearlyy defined procedures
p for Improve communication and
action and remedial steps in the disclosure to external stakeholders
event of material breaches like:
Supervisors
Auditors
Rating agencies
Clients
Shareholders
reserved.
Management and Monitoring
Risk Policy &

The Operational Risk Management Strategy
function should support the BoD in
taking the most appropriate mitigation
Risk
action based on the reported information Risk
Management
Identification
& Monitoring
High Severity / Low Frequency events

Insurance policies & Self Insurance
Derivatives hedging (cat options and cat bonds) Risk Risk
H
TRANSFER AVOID
Limitation or stop of
product / project
severityy
Change investment type
ACCEPT MITIGATE High Frequency / Low Severity events

Enhancement of internal controls
L Business Continuity Planning (systems, supplier,
frequency H
staff and workspace)
reserved.
Hints
on implementing a operational risk management and measurement system
Data integrity:
use of external loss data
data, which require a mapping or scaling to the firms own data
poor-quality of internal loss data creeping into model assumptions
Perform scenario analysis using a bottom

bottom-up
up approach
Increase the operational risk culture in the firm
Do not ignore tools like Key Risk Indicators (KRIs) for monitoring operational risk
Standard IT tool to centrally collect all data (for instance internal losses, breaches, external losses,
findings, etc.) and related information (mitigation actions taken, procedures)
Advanced approaches: stress testing & sensitivity analysis in the scope of model validation
reserved.
What is next?
Top 10 operational risk concern for 2012 and beyond

Fraud and insider risk
Disaster recovery and business continuity
Miss-selling
Regulatory
g y compliance
p
Online security
Model risk
Sanctions and money laundering
Ongoing updates: for bank AMA model change Policy (EBA GL 45; CSSF Circular 12/535)
Looking for more sensible approaches

under discussion the alfa and beta indicators used in the BIA and SA for banks
replace the Gross Income as indicator
reserved.
KPMG Solutions
Impact study Assistance in enhancing the

(cost-benefit analysis) risk management framework
KPMG
Assistance in the
implementation of advance Assistance in operational
models and in obtaining risk modeling
regulatory approval
reserved.

Operational Risk Discussion KPMG PDF

Uploaded by

Document Information

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Operational Risk Discussion KPMG PDF

Uploaded by

Copyright:

Available Formats

KPMG

Sven Muehlenbrock, Head of Financial Risk Management

Well known cases

Operational Risk Management Process

The benefit to implement an operational risk management framework

Hints on implementing an operational risk management and

Barings case SocGen case Unsuitable investments

1994 2008 2012

Cause Risk Event (what goes wrong) Impact

Well known cases

Operational Risk Management Process

The benefit to implement an operational risk management

Hints on implementing an operational risk management and

Bank ManCo and Funds Insurance companies

Own Funds ICAAP Transparency

Market Risk Supervisory

Advanced Measurement Approach

Implement an effective internal operational risk management policies and

Standard Formula Internal / Semi internal

- Simple to implement and fast calculation

- The formula is deterministic and doesnt fit to every business

Market Health Default Life Non-life Intangible

Market Health Default Life Non-life Intangible

Adj BSCR Operational

Market Health Default Life Non-life Intangible

Adj BSCR Operational

Market Health Default Life Non-life Intangible

Well known cases

Operational Risk Management Process

The benefit to implement an operational risk management framework

Hints on implementing an operational risk management and

Implement an advanced operational risk management approach

It is not just fulfil some regulatory capital obligations!!!

Go deeper to the end of the things, understanding the root cause

Make operational risk very concrete and keep it alive

Employees start using it for their day-to-day risk management,

In some cases, operational risk is

Silo mentality results in lack of

It is integrated and Internal

Risk Policy &

Operational Risk Policy, S

Culture and Awareness

Operational Risk management process is based on the relationship among various

Operational Risk Management

Measurement and Modeling of Capital charge

Internal Loss Data Control Factors Scenario Analysis

BACKward-looking PRESENT-looking FORward-looking

Process Risk Mapping

The detection of any event which potentially triggers a

Risk Risk New product / project

Losses due to acts of a type intended to defraud, misappropriate property or

Losses due to acts of a type intended to defraud, misappropriate property

Losses arising from acts inconsistent with employment

Losses arising from an unintentional or negligent failure to meet a professional

Losses from failed transaction processing or process management, from

Internal Loss Data Control Factors Scenario Analysis

BACKward-looking PRESENT-looking FORward-looking

External losses Frequency Distribution

Expected 99.5 /99.9%

We consider an insurance company with following characteristics:

* 3 fraud events Losses in the range 100 000 - 1 000 000

Range of loss severity Frequency

Enhance senior management awareness of