Guidance for Operational Risk Management in Government Debt Management 1 Tomas Magnusson, Abha Prasad and Ian Storkey

Transcription

1 Gu dancef oroper at onalr skmanagement n Gover nmentdebtmanagement TomasMagnusson,AbhaPr asad and Ian St or key Mar ch 2010 Thef nd ngs, nt er pr et at ons,andconcl us onsexpr essedher e nar et hoseoft heaut hor ( s), anddonotnecessar l yr ef l ectt hev ewsoft hei nt er nat onalbankf orreconst r uct onand Devel opment/thewor l dbankand t saf f l at edor gan zat ons,ort hoseoft heexecut ve D r ect or softhewor l dbankort hegover nment st heyr epr esent.

2 Gudance for 1 Tomas Magnusson, Abha Prasad and Ian Storkey In government debt management (DeM), the categores of rsk such as market rsk (exchange rate and nterest rate rsk), credt rsk, refnancng rsk and lqudty rsk are relatvely well known; operatonal rsk s however, less well known and an area that has not been gven much attenton to by government debt managers n developng a rsk management framework. Ths paper ntroduces the concepts of operatonal rsk as appled to government DeM and attempts to present a framework for debt managers to manage operatonal rsks whle undertakng publc debt management operatons. It draws on exstng lterature for operatonal rsk management prncples and practces that have been formulated by the Bank for Internatonal Settlements (BIS) Basel Commttee on Bankng Supervson and the Commttee of Sponsorng Organzatons (COSO). It provdes gudance on developng a framework for assessng rsk exposures from ncdents or events that can adversely mpact on reputaton, fnancal cost, outputs and/or budget varance. 1. INTRODUCTION Operatonal rsk s defned as the rsk of loss resultng from nadequate or faled nternal processes, people and systems or from external events (Basel II, June 2004). In debt management operatons, the categores of rsks, such as market rsk (exchange rate and nterest rate rsk), credt rsk, refnancng rsk and lqudty rsk, are relatvely well known; however operatonal rsk s not. The area has not been gven due attenton to by government debt managers n developng a rsk management framework. A smlar concluson on aspects pertanng to operatonal rsk management s borne out from the early results of the World Bank s assessments usng ts government Debt Management Performance Assessment (DeMPA) tool. 2 The results of the DeMPA exercse ndcate sgnfcant defcences among countres on operatonal rsk management. As at end-december 2009 from among the 27 fnalzed DeMPA reports, almost all of these countres had ether weak or non-exstent frameworks for operatonal rsk management. Among the assessed countres, only one quarter of the countres met wth the mnmum effectveness requrements 3 for debt admnstraton and data securty and only sx percent of countres demonstrated effectve practce for aspects relatng to segregaton of dutes, staff capacty and busness contnuty (these are as covered by the DeMPA tool. The DeMPA ndcators and a more detaled descrpton of the assessment results are presented n Box 1 and Annex 1, respectvely. 1 Ths paper has beneftted from valuable comments and suggestons from Phllp Anderson, Sudarshan Gooptu, Mke Wllams, Mats Flpsson and Leonardo F. Hernandez. Valuable suggestons gven by Lars Jessen and Gregory Horman on an earler draft are gratefully acknowledged. Authors are thankful to Sgne Zekate for her help wth the DeMPA data. The fndngs, nterpretatons, and conclusons are the authors own and should not be attrbuted to the World Bank, ts Executve Board of Drectors, or any of ts member countres. 2 The Debt Management Performance Assessment (DeMPA) ndcator set s a sample of profcences of a Debt Management Unt. These results relate to 27 fnalsed assessments. ( 3 DeMPA ndcators are scored on a scale from A to D. Score C or hgher ndcates that the mnmum requrements for effectve debt management under the DeMPA have been met; whle score D ndcates the absence of the same.

3 Ths paper thus, ntroduces the concepts of operatonal rsk as appled to government debt management (DeM) 4 and attempts to present a framework for debt managers to manage operatonal rsks whle undertakng publc debt management operatons. It draws on exstng lterature for operatonal rsk management prncples and practces that have been formulated by the Bank for Internatonal Settlements (BIS) Basel Commttee on Bankng Supervson, the Commttee of Sponsorng Organzatons (COSO) and the fndngs of the DeMPAs. Box1: The DeMPA Performance Indcators The DeMPA s a set of 15 ndcators (and 35 dmensons) that cover sx core functons of debt management (see table below): 1) governance and strategy development, 2) coordnaton wth macroeconomc polces, 3) borrowng and related fnancng actvtes, 4) cash flow forecastng and cash balance management, 5) operatonal rsk management, and 6) debt records and reportng. Operatonal rsk management s covered by two debt performance ndcators (DPI): DPI-12 Debt Admnstraton and Data Securty, and DPI-13 Segregaton of Dutes, Staff Capacty and Busness Contnuty. DPI-1 DPI-2 DPI-3 DPI-4 DPI-5 DPI-6 DPI-7 DPI-8 DPI-9 DPI-10 DPI-11 DPI-12 DPI-13 DPI-14 DPI-15 Governance and Strategy Development Legal Framework Manageral Structure Debt Management Strategy Evaluaton of Debt Management Operatons Audt Coordnaton wth Macroeconomc Polces Coordnaton wth Fscal Polcy Coordnaton wth Monetary Polcy Borrowng and Related Fnancng Actvtes Domestc Market Borrowng External Borrowng Loan Guarantees, On-Lendng, and Dervatves Cash Flow Forecastng and Cash Balance Management Cash Flow Forecastng and Cash Balance Management Operatonal Rsk Management Debt Admnstraton and Data Securty Segregaton of Dutes, Staff Capacty, and Busness Contnuty Debt Records and Reportng Debt Records Debt Reportng 4 Government debt management s the process of establshng and executng a strategy for managng the government s debt n order to rase the requred amount of fundng, acheve ts rsk and cost objectves, and to meet any other soveregn debt management goals the government may have set, such as developng and mantanng an effcent market for government securtes.

4 2. OPERATIONAL RISK FOR GOVERNMENT DEBT MANAGEMENT Government debt management unts (DMUs) are responsble for managng the costs and rsk of the government s debt portfolo, whch s often the largest fnancal portfolo n the country. As such, t s very mportant that DMUs develop polces and procedures to manage the rsks that they face, namely, market rsk (exchange rate and nterest rate rsk), credt rsk, refnancng rsk, lqudty rsk, and operatonal rsk. Ths partly reflects the hgh value of the fnancal transactons nvolved and the consequences of substantal fnancal loss ncludng on debt servce costs. But there s potentally also severe reputatonal and poltcal damage assocated wth operatonal error or falure. There are many hgh profle examples of operatonal rsk management falures n fnancal nsttutons such as Barngs (1995), Dawa Bank (1995), Kdder Peabody (1994), Salomon Inc (1994 and 1996), and Socete Generale (2008) whch lost US$7 bllon due to one trader and lax nternal control. There are few hgh profle cases for governments that have been reported. There are two examples affectng local governments that led to severe reputatonal and poltcal damage for both governments. Frst, the Hammersmth and Fulham Councl n the Unted Kngdom receved a hgh court rulng n 1989 that they dd not have the legal authorty to enter nto dozens of swap contracts totallng about US$9.5 bllon. Whle the local government dd not lose on the swaps (the court s decson cost Brtsh and foregn banks approxmately US$1 bllon n defaulted swap payments), the mpact was sgnfcant for not only Hammersmth and Fulham but also the 77 other local governments as t effectvely termnated any further actvtes n the fnancal markets. The falure to comply wth legal requrements can be classfed as an operatonal rsk management falure. Second, Orange County, a prosperous dstrct n Calforna, declared bankruptcy after sufferng losses of around US$1.6 bllon from dervatves tradng n one of ts prncpal nvestment pools. The pool was ntended to be a conservatve but proftable way of managng the county s cash-flows, and those of 241 assocated local government enttes. Instead, t trggered the largest fnancal falure of a local government n US hstory. Whle the loss was the result of the falure to control or lmt market rsk, operatonal rsk management weaknesses were dentfed as a prmary reason for ths ncdent to occur. Weak operatonal rsk management can also lead to corrupton, evdenced by the Anglo Leasng Affar n Kenya n 2004 that nvolved a suppler s credt wth extremely bad condtons for Kenya. All payments by Kenya were transferred to Anglo Leasng & Fnance Ltd s account wth a small bank n Zurch, and n the end t was dscovered that Anglo Leasng dd not even exst. The scandal resulted n both the Permanent Secretary and the Head of the Debt Management Department havng to resgn. The offcal report by the new Fnancal Secretary concluded that over the years the nsttutonal framework for contractng and managng external commercal loans had collapsed INTERNATIONAL PRINCIPLES Under Basel II (Internatonal Convergence of Captal Measurement and Captal Standards: A Revsed Framework, June 2004), operatonal rsk s defned as the rsk of loss resultng from nadequate or faled nternal processes, people and systems or from external

5 events. The defnton explctly ncludes legal rsk, but excludes strategc and reputaton rsk. 5 Whle ths defnton and sound practces establshed by the Basel Commttee on Bankng Supervson and COSO 6, and usefully elaborated by enttes such as TransConstellaton, 7 have been prmarly desgned for the bankng and fnancal sector, the governng prncples can approprately be appled to government DeM operatons. What s necessary s a framework for managng t that s approprate to the range and nature of government DeM operatons and the operatng envronment, partcularly for low and mddle ncome countres. 8 Awareness of operatonal rsk s low n many countres, or s perceved as somethng applcable only to the prvate sector. Moreover, t attracts lttle attenton by senor management because t s not seen as mportant or a prorty. The problem of course s that operatonal rsk s a wde umbrella, often seen as coverng everythng except for market, credt, refnancng, and lqudty rsks. Unlke market or credt rsk, operatonal rsk s manly endogenous to a DMU. Apart from external events such as natural catastrophes, t s lnked to the busness envronment, nature and complexty of the DMU s actvtes, the processes and systems n place, and the qualty of the management and of the nformaton flows. 9 DMUs are ncreasngly usng dervatves, collateral and nettng arrangements to manage ther exposure to market and credt rsk. Ths may generate other forms of rsk as these transactons are by ther nature complex, whch creates ncreased operatonal complextes and rsks. More mportantly, operatonal rsks are more dffcult to manage as the embedded rsk cannot be captured and measured n the same way as market and credt rsk. In addton, market or credt rsks can be effectvely managed by a relatvely small number of debt managers n the DMU (normally n the front and mddle offce) whereas operatonal rsks must be addressed at all levels across all of government DeM operatons CATEGORIES OF OPERATIONAL RISKS FOR GOVERNMENT DEBT MANAGEMENT The Basel II defnton as quoted above ncludes legal rsk but excludes strategc and reputaton rsk. The strategc and reputaton rsk, however, can be caused by both bad operatonal rsk management and an unexpected consequence of an nformed busness decson. A poor strategc decson due to lack of adequate tranng of staff and lack of system support s an operatonal rsk, whle an nformed strategc decson based on a reasonable cost/rsk analyss that stll resulted n a loss for the government s an ordnary busness rsk. Both can of course affect the reputaton of the government. However, n the former case the 5 Ths defnton was adopted by the Basel Commttee as part of ts work n developng a mnmum regulatory captal charge for operatonal rsk. 6 COSO has developed a management framework whch s used n the TransConstellaton tool. 7 TransConstellaton was establshed n December 2003 as a not-for-proft entty by ndustry leaders n the feld of fnancal-transacton processng, all located n Belgum. The members nclude Euroclear, SWIFT, and The Bank of New York Mellon (Brussels offce). 8 A rsk exposure s a product of two elements: the lkelhood of a rsk event, whch n turn trggers a loss or other mpact (e.g. reputatonal); and the sze of that mpact. 9 Even f the DMU cannot control external events, t can mtgate the damage of these events by good operatonal rsk management, e.g. by havng n place a busness contnuty plan.

6 reputaton wll be more damaged as the government wll be crtczed for not knowng what t s dong, puttng the taxpayer s money at rsk. The categores of operatonal rsks that are relevant for government DeM ncludng examples under each category are set out n the followng table. INFRASTRUCTURE AND TECHNOLOGY FAILURES Power falure Hardware falure Sabotage Data corrupton ncludng vruses LAN/WAN/Intranet/ Internet falure Internal flood (sprnklers, ppes) Voce network falure Theft of equpment Theft of data/nformaton Poor mantenance Accdental damage INCIDENTS WHERE ACCESS TO PREMISES IS DENIED Floodng or a fre concern Health and safety volaton Hazardous chemcals accdent Gas or chemcal leak Industral acton or rot Bomb or terrorst threat Buldng fre or exploson Internal/external flood Sabotage or terrorsm KEY SERVICE PROVIDERS OR RESOURCE FAILURES DEPENDENCIES Falure of key servce provders (telephone, nternet, bankng etc) Thrd party provders (Central Bank and other outsourced operatons) Impact of ncdent on crtcal teams or groups (travel, food posonng, group ncdent) STAFF, MANAGEMENT AND RELATED HUMAN FAILURES Human error (whch may be due to poor tranng or nadequate supervson) Lack of polcy gudance (whch may lead to poor decsons or unauthorzed actvtes) Falure to follow or adhere to admnstratve practces (whch may lead to processng errors) Poor tranng or nadequate supervson (whch may lead to human error or executon of unauthorzed transactons) Poor understandng of rsk envronment (whch may lead to unnecessary or unknown rsks) Key person rsk (whch may lead to human error when key person s absent) Falure to follow code of conduct or conflct of nterest gudelnes Poorly specfed delegatons (whch may lead to executon of unauthorzed transactons) Fraudulent, corrupt or dshonest practces (whch may lead to fnancal loss and poltcal embarrassment) FAILURE TO MEET STATUTORY, LEGAL, HUMAN RESOURCES AND OTHER OBLIGATIONS Legal/statutory oblgatons (e.g. complance wth loan agreements) Reportng oblgatons (e.g. to hgher authortes and nternatonal nsttutons) Management drectves (e.g. nternal polces and procedures) Contractual oblgatons (e.g. debt servce oblgatons) Procedures manuals and delegated authortes Health and safety regulatons (e.g. natonal workplace laws or regulatons) MAJOR NATURAL AND REGIONAL DISASTERS Earthquake Severe floodng Tsunam Volcanc erupton Severe fres Cvl dsturbance or terrorsm Source: Authors complaton

7 2.3. PRINCIPLES APPROPRIATE TO GOVERNMENT DEBT MANAGEMENT It s useful to consder the prncples for operatonal rsk management wthn the context of the legal and manageral structure that shapes and drects the operatons of the DMU. It ncludes the legslaton that defnes goals, authortes, and accountabltes. It also embodes the management framework, coverng ssues such as the formulaton and mplementaton of a debt management strategy, operatonal procedures, qualty assurance practces, and reportng responsbltes. The governance structure for operatonal rsk management may be qute extensve wth an operatonal rsk commttee, audt commttee, a management commttee, and an advsory or decson-makng board. An ntegral part of any framework wll be the prncples for operatonal rsk management. The followng sets out the prncples that mght apply to government DeM operatons. These are based on prncples developed for the bankng sector set out as sound practce by the Basel Commttee on Bankng Supervson at the Bank for Internatonal Settlements (2003). The same, mutats mutands, are applcable for government debt management offces/unts that also operate n the fnancal markets. DEVELOPING AN APPROPRIATE RISK MANAGEMENT ENVIRONMENT PRINCIPLE 1 The Head of the DMU and/or members of the decson-makng board (f ths exsts) should be aware of the major aspects of debt management operatonal rsks as a dstnct rsk category that should be managed, and the Head of the DMU (or the board) should approve and perodcally revew the operatonal rsk management framework applcable to all government DeM operatons. The framework should provde a defnton of operatonal rsk and lay down the prncples of how operatonal rsk s to be dentfed, assessed, montored, and controlled/mtgated. PRINCIPLE 2 The Head of the DMU and/or members of the decson-makng board (f ths exsts) should ensure that the operatonal rsk management framework s subject to effectve and comprehensve nternal audt by operatonally ndependent, approprately traned and competent staff. The nternal audt functon should not be drectly responsble for operatonal rsk management (refer Prncple 8). PRINCIPLE 3 Senor management across all government DeM operatons should have responsblty for mplementng the operatonal rsk management framework approved by the Head of the DMU and/or the decson-makng board (f ths exsts). The framework should be consstently mplemented throughout all DeM operatons, and all levels of staff should understand ther responsbltes wth respect to operatonal rsk management. Senor management should also have responsblty for developng polces, processes and procedures for managng operatonal rsk across all DeM actvtes, processes and systems.

8 RISK MANAGEMENT: IDENTIFICATION, ASSESSMENT, MONITORING, AND MITIGATION / CONTROL PRINCIPLE 4 The DMU should dentfy and assess operatonal rsk exposures nherent n all actvtes, processes and systems. 10 The debt managers should also ensure that before new actvtes, processes and systems are ntroduced or undertaken, the operatonal rsk nherent n them s subject to adequate assessment and managed approprately. PRINCIPLE 5 The DMU should mplement a process to regularly montor operatonal rsk profles and materal rsk exposures. There should be regular reportng of pertnent nformaton to the Head of the DMU, and members of the decson-makng board (f ths exsts) that supports the proactve management of operatonal rsk. PRINCIPLE 6 The DMU should have polces, processes and procedures to control and/or mtgate materal operatonal rsks. The DMU should perodcally revew ther operatonal rsk profle and should adjust ther rsk lmtaton and control strateges n the context of the government s overall debt and rsk management strategy. PRINCIPLE 7 The DMU should have n place contngency and busness contnuty plans to ensure ts ablty to operate on an ongong bass and lmt losses n the event of any 11 busness dsrupton. ROLE OF INTERNAL AND EXTERNAL AUDITORS PRINCIPLE 8 Internal and external audtors should ndependently examne and assess the DMU s framework for dentfyng, assessng, montorng and controllng/mtgatng materal operatonal rsks. External audtors should ndependently conduct, drectly or ndrectly, regular evaluaton of DeM polces, procedures and practces related to operatonal rsks. ROLE OF DISCLOSURE PRINCIPLE 9 The DMU should make suffcent publc dsclosure to allow the Mnster of Fnance and government as well as market partcpants to assess ther approach to operatonal rsk management. Ths should nclude a statement settng out the DMU s approach to managng operatonal rsk and the publcaton of the external audtor s report on a revew of operatonal rsk management polces, procedures and practces. 10 The focus should be on materal or mportant actvtes, processes and systems wthout wastng too much tme on unessental or less mportant actvtes, processes and systems. 11 An unnterruptable power supply (UPS) may n practce be more relevant than a dsaster recovery ste, although countres really need both.

9 3. OPERATIONAL RISK MANAGEMENT FRAMEWORK Developng an operatonal rsk management framework can be an evolutonary process as t wll take tme and effort to not only dentfy and understand the rsks but also the mtgaton technques n an envronment that s constantly changng. There s no need to try to do everythng perfectly from the outset. The framework can be developed and appled ncrementally as technques mprove and DMU staff begn to understand the rsks and mtgaton technques. For the framework to succeed, t s extremely mportant to develop a culture of rsk awareness across the DMU and ensure that all staff are nvolved n developng and mplementng the framework. The frst stage nvolves senor management understandng and sgnallng to all staff n the DMU the mportance attached to operatonal rsk management and the need for ther partcpaton and ongong cooperaton. The prncples as outlned above that wll be followed n the management of operatonal rsk need to be made clear to all staff and embedded nto day-to-day DeM operatons. Each lne manager needs to be made responsble for operatonal rsk management n ther own busness area. It s advsable that a rsk champon from the mddle offce be apponted to take overall responsblty for operatonal rsk management. The rsk champon wll lead and gude the process across the DMU, coordnate reportng to senor management, and develop the approprate operatonal rsk management polces and procedures and control envronment. Ideally the rsk champon would have relevant background or experence, although ths wll often not be possble. There are, however, opportuntes for professonal tranng n operatonal rsk management and busness contnuty plannng whch could be consdered. Once the structure has been establshed, the development and mantenance of an operatonal rsk management framework for a DMU should follow a sx-step process: 1. Understand and document busness actvtes 2. Identfy, assess and measure rsks 3. Develop rsk management strateges 4. Implement capabltes 5. Montor performance 6. Contnuous mprovement The sx-step process ncludng ongong reportng and contnuous mprovement s demonstrated n the followng dagram.

10 Establsh Rsk Management Structure Understand & Document Busness Actvtes Contnuous Improvement Identfy, Assess & Measure Rsks Ongong Reportng Montor Performance Develop Rsk Management Strateges Implement Capabltes 3.1. UNDERSTAND AND DOCUMENT BUSINESS ACTIVITIES The frst step s to understand DeM operatons by breakng down the man DeM functons nto actvtes, processes or systems, each wth a stated objectve for each busness area. Ths can be done by convenng workshops and branstormng sessons for each DeM functon to fully understand the actvtes, processes and systems and dentfy the key rsks that mght mpact on DeM operatons. Process maps and process-flow analyss can be used along wth exstng procedure manuals to understand DeM operatons. The rsk champon should oversee ths process to ensure a common understandng and consstency of approach and termnology. Ths should be at a level that wll balance the amount of detal and usefulness to senor management and the overall process. Ths can be brought together n documentaton that sets out actvtes, processes and systems together wth the rsks faced by the DMU whch s then used to desgn processes and control ponts that mtgate the assessed rsks n steps 2 and 3, and the documentaton that s prepared n step 4.

11 3.2. IDENTIFY, ASSESS AND MEASURE RISKS For the second step, t s mportant to nvolve everyone responsble for DeM operatons, ncludng the more junor staff, as t helps to develop a rsk understandng and a rsk culture wthn the DMU. Agan, ths can be done by convenng workshops and branstormng sessons for each DeM functon. For each category of operatonal rsk set out above, the DMU should assess the rsk exposures n terms of reputaton, fnancal loss and/or mpact on outputs or budget varance as a result of an ncdent or event affectng ther operatons. Ths requres separately assessng the probablty and the mpact, for example usng a combnaton of Very- Hgh/Hgh/Medum/Low Probablty and Very-Hgh/Hgh/Medum/Low Impact from a reputaton, fnancal cost and budget perspectve as shown n the followng table. Low Impact Medum Impact Hgh Impact Very-Hgh Impact Very-Hgh Probablty (almost certan) Hgh Probablty (probable) Medum Probablty (possble) Low Probablty (remote) VHpL VHpM VHpH VHpVH HpL HpM HpH HpVH MpL MpM MpH MpVH LpL LpM LpH LpVH Dependng on ts rsk tolerance level, the DMU may wsh to also nclude the Medum Probablty/Medum Impact combnatons and Low Probablty/Very-Hgh Impact assessment, where the mpact could be extreme ether n reputaton, fnancal cost or budget terms. Not all operatonal rsks wll be of equal mportance for each DMU as ths wll be a country specfc judgement. Therefore, the followng practcal gudelnes are provded to assst n characterzng the mpacts across the full range of DeM operatons.

12 Assessment Impact Very-Hgh Hgh Medum Low of Reputatonal Impact Source: Authors complaton Loss of stakeholder confdence Loss of market confdence Loss of trust, e.g. from prmary dealers Extensve meda coverage Hgh-level mnsteral enqury [or resgnaton] Straned stakeholder relatonshps Temporary loss of market confdence Moderate meda coverage Mnsteral enqury Increased stakeholder attenton Market confdence not affected Mnor, f any, meda attenton Major attenton wthn mnstry/dmu Stakeholder and market relatonshps ntact No meda coverage Internal mnstry/dmu enqury Fnancal Loss Impact Reported n government s fnancal statements Sgnfcant amount of tme spent dealng wth ssue (.e. greater than 30 persondays) Reported to mnster Large amount of tme spent dealng wth ssue (.e. between 20 and 30 person-days) Reported to the entty responsble for montorng the DMU Moderate amount of tme spent dealng wth ssue (.e. between 10 and 20 person-days) Included n nternal monthly reports Mnmal amount of tme spent dealng wth ssue (.e. less than 10 persondays) Impact on Outputs or Budget Varance Sgnfcant delay n achevng outputs Sgnfcant debt servce budget varance (.e. greater than 10%) Large delay n achevng outputs Large debt servce budget varance (.e. between 5% and 10%) Moderate delay n achevng outputs Moderate debt servce budget varance (.e. between 3% and 5%) Lttle or no delay n achevng outputs Lttle or no debt servce budget varance (.e. less than 3%) The outcome of the assessment wll be a hgh-level summary of rsks that wll be consstent across the full range of DeM operatons, as a way of dentfyng prortes for senor management. The assessment technque can be flexble n that t can ntally be undertaken n a broad brush way and mproved over tme as experence develops, partcularly when there s a hstory of loss-event data DEVELOP RISK MANAGEMENT STRATEGIES In step three, the DMU should develop operatonal rsk management strateges that concentrate on mprovng reslence and ensurng mtgaton technques are put n place for those areas dentfed as havng a combnaton of Very-Hgh/Hgh Probablty and Very- Hgh/Hgh Impact. For these areas, the DMU should select the most cost effectve and sutable rsk treatment approach for each DeM functon usng one or more of the followng:

13 preventon or avodance, where the probablty of an event occurrng s reduced or elmnated (e.g. nstall back-up power generators, use more than one telecom provder, tran staff, or mplement fraud preventon polces and procedures) transference, where rsks are passed to thrd partes (e.g. nsurance or outsourcng wth rsk management ncorporated n servce level agreements) contanment, where the potental mpact of an event occurrng s lmted n the early stages usng controls or other technques (e.g. mplement fraud detecton polces and procedures, put n place escalaton procedures so that management can respond mmedately should an event begn to escalate, or have more than one person to perform a partcular task or actvty) acceptance and recovery, where an event or dsrupton mght well occur but DeM operatons can be resumed successfully (e.g. have n place a dsaster recovery plan that s regularly tested at a recovery locaton) The rsk champon should then report to senor management on the greatest exposures, the rsk management technques to mtgate, control, or lmt the rsks, the actons that are recommended to address the greatest exposures, and an estmate of costs. Senor management can then assess the cost-rsk trade-off before makng decsons or seekng approval from hgher level (the decson-makng board), f ths exsts. As an example, f the DMU s subject to frequent power outages, t may be deemed suffcent gven the cost to nstall an unnterruptble power supply (UPS) rather than nstall a much more expensve back-up power generator. 12 However, f DeM operatons become more actve and contnuty of busness becomes more crtcal, t may be suffcent to justfy the expense of an emergency generator gven the potental mpact from power outages. Ths s often the case n low or mddle ncome countres where the Central Bank wll have an emergency power generator whereas the Mnstry of Fnance wll not. The rsk assessment and operatonal rsk management strategy approved can be documented n the DeM operatonal rsk management plan. A busness contnuty or dsaster recovery plan can be ncorporated n the plan or mantaned as a separate document IMPLEMENT CAPABILITIES The rsk champon can oversee the mplementaton of measures approved by senor management and ncorporate nto the wder rsk management montorng and control polces and procedures for the DMU. Ths process may comprse, among others: tranng program for DeM lne managers and staff to understand ther roles and responsbltes n complance wth the operatonal rsk management polces and procedures, and possbly ntroducng rsk-reducton objectves for each member of the DMU rasng awareness wth external partes to cover all actvtes external to the DMU (e.g., IT department of the Mnstry of Fnance, Central Bank and other thrd party 12 But a UPS wll only last for a short tme so there s a trade off between the UPS and a backup generator whch depends on the rsk of a long rather than short outage (power cut).

14 provders) of the operatonal rsk management framework and seek ther cooperaton n montorng and reportng and, where possble, requrng these servce provders to meet the same operatonal rsk management standards as the DMU 13 ntroducng operatonal rsk management nto servce level agreements or a memorandum of understandng wth thrd party provders and contracts wth external supplers (explanng n practcal terms the sgnfcance of such procedures) developng control tools that are documented n procedures, techncal and other manuals and montored by the DMU rsk montorng and complance unt ncludng the rsk champon and/or nternal audt developng reportng requrements, partcularly to senor management, of sgnfcant ncdents or exceptons and the process of revew to ensure that these are not repeated developng, mantanng and annual testng of the busness contnuty and dsaster recovery plan 3.5. MONITOR PERFORMANCE The montorng process assesses the presence and functonng of the operatonal rsk management polces and procedures over tme through a combnaton of ongong montorng actvtes and specfc evaluatons. Ongong montorng occurs n the normal course of DeM operatons; t s the responsblty n the frst nstance of lne managers, wth coordnatng responsblty assgned to the mddle offce/rsk montorng and complance unt/rsk champon. 14 The scope and frequency of specfc evaluatons depends on an assessment of rsk and the effectveness of ongong montorng procedures. The specfc evaluatons could be undertaken by external audt. It s necessary to report regularly to senor management on the rsk profle, dentfyng areas that are mprovng or deteroratng, and prortes for mtgatng acton. An mportant element of montorng performance s reportng of ncdents or exceptons to senor management, normally as part of a rsk montorng and complance report. For serous ncdents or events, t may be necessary to dentfy badly managed rsks and the acton needed to avod repeatng such ncdents. Many ncdents may often be the fault of management falng to develop an adequate control envronment rather than the ndvduals that may be deemed drectly responsble ndeed for ths to work effectvely a no blame culture s mportant. One course of acton s to dentfy whch lne manager has the lead responsblty for managng and controllng each of the dentfed rsks, and then ask each lne manager to report perodcally on the rsks for whch they are responsble, whether these have ncreased or reduced, and whether and what acton should be taken. In ths way, the lne managers are nvolved n the process whch ensures buy-n of the busness areas across all DeM operatons. The mddle offce/rsk montorng and complance unt/rsk champon wll be responsble for collectng the reports together wth the preparaton of excepton/error reports, 13 For example, n the UK, the Debt Management Offce (DMO) requres the Bank of England s nternal audtors to comment to the DMO on the Bank s nternal control regme. Also, DMUs are begnnng to develop servce level agreements wth the Mnstry of Fnance IT functon, whch nclude arrangements for handlng specfc events should they arse. 14 It s common that the montorng and complance unt s part of the mddle offce.

15 and summarsng the key ponts and man rsk drvers. Changes n the rsk profle snce the last montorng assessment should be noted. The report would go on to make recommendatons for consderaton by senor management CONTINUOUS IMPROVEMENT As was noted earler, operatonal rsk management can be mproved over tme as experence develops, partcularly when there s a hstory of ncdents or events and ther mpact n terms of reputaton, fnancal loss and budget. It may also be valuable to learn from other DMUs through ongong montorng and communcaton channels. The sx-step process should be revsted on an annual bass, although the frst step may just nvolve an update of the busness actvtes, processes and systems reflectng changes from the prevous assessment. DMUs n countres such as Australa, Denmark, France, New Zealand, Sweden and the Unted Kngdom have set out ther polces for managng operatonal rsk on ther webstes and/or n ther annual reports. Ther experences show that operatonal polces and procedures that are embedded n day-to-day DeM operatons together wth ongong montorng and reportng by a mddle offce, rsk montorng and complance unt or rsk champon n the DMU are the key to successful management of operatonal rsk.

16 REFERENCES Bank for Internatonal Settlements (2003), Sound Practces for the Management and Supervson of Operatonal Rsk, Basel Commttee on Bankng Supervson [ Commttee of Sponsorng Organzatons (COSO) of the Treadway Commsson (2008), Internal Control Integrated Framework: Gudance on Montorng Internal Control Systems [ TransConstellaton (2007), Best Practces n Qualtatve Operatonal Rsk Management: The ORM Reference Gude [ TransConstellaton (2007), Roadmap to Operatonal Rsk Management Success: The ORM Maturty Benchmark [ World Bank (2007), Debt Management Performance Assessment (DeMPA) Tool [ World Bank (2007), Gude to the Debt Management Performance Assessment (DeMPA) Tool [

17 ANNEX 1: RESULTS FROM THE DEMPA EXERCISE 15 The DeMPA ndcators that relate to the assessment of operatonal rsk management n debt management operatons are: DPI-12 coverng debt admnstraton and data securty assesses the avalablty and qualty of documented procedures for () processng of debt servce, () debt data recordng and valdaton, and () controllng access to the central government debt recordng/management, as well as the secure storage of debt recordng/management system backups. DPI-13 coverng segregaton of dutes, staff capacty and busness contnuty assesses () the segregaton of dutes for some key functons, () presence of a rsk montorng and complance functon, () staff capacty and human resource management, and (v) presence of an operatonal rsk management plan ncludng busness contnuty and dsaster recovery arrangements. The experence wth undertakng the DeMPA assessments across 27 developng countres (as at end-december 2009) shows that most of these countres do not meet the mnmum requrements n these two areas. As shown n Chart 1 only 22 percent of countres met the mnmum requrements for DPI-12 Debt Admnstraton and Data Securty whle only 11 percent met wth the mnmum effectveness requrements on DPI-13 Segregaton of Dutes, Staff Capacty and Busness Contnuty. Chart 1: DeMPA Results on Operatonal Rsk Management Operatonal Rsk Management 22 DPI-12 Debt Admnstraton and Data Securty DeMPA score C< (% of total scored countres) 11 DPI-13 Segregaton of Dutes, Staff Capacty and BCP Source: DeMPA results Chart 2 ndcates that that less than a quarter of countres meet the mnmum requrements for the frst, thrd and fourth dmensons of DPI-12, whch requre documented procedures for processng debt servce, controllng access to central government debt recordng, management. Several countres were defcent n storage of debt management system backups and records n a secure locaton. Only few countres demonstrated sound practce n ths area by takng daly backups and storng them n a secure locaton. 15 Results are based on early results from 27 fnalzed DeMPA reports.

18 Chart 2: DeMPA Results on Debt Admnstraton and Data Securty Dsaggregated by Dmensons DPI-12-1 DPI-12-2 DPI-12-3 DPI-12-4 DPI-12-1 Avalablty and qualty of documented procedures for the processng of debt servce DPI-12-2 Avalablty and qualty of DPI-12-3 Avalablty and qualty of documented procedures for debt documented procedures for data recordng and valdaton, as controllng access to the central gov. well as storng of agreements and debt recordng. mng. system debt admnstraton DPI-12-4 Frequency and off-ste, secure storage of debt recordng/ mng. System backups. Source: DeMPA database, authors calculatons Lkewse, Chart 3 ndcates that most of the assessed countres had weak debt management staff capacty; only one thrd met the mnmum requrements for the dmenson that examned whether staff are adequately traned wth formal job descrptons. Twenty-two percent of the sample countres had clear separaton between the debt managers wth the authorty to negotate and contract debt, and staff whch would servce debt payments and those whch would record and account other debt related transactons. Moreover, only 19 percent countres met the mnmum requrements for the thrd dmenson of ths ndcator and had busness contnuty and dsaster recovery plan n place (Chart 3). Chart 3: DeMPA Results on Segregaton of Dutes, Staff Capacty and Busness Contnuty Dsaggregated by Dmensons DPI-13-1 DPI-13-2 DPI-13-3 Source: DeMPA database, authors calculatons Durng assessment mssons, t was clear that the concept of operatonal rsk and how ths should be dentfed, assessed, montored, and where necessary controlled/mtgated s not well known or understood. Ths s partcularly the case n the Mnstry of Fnance. The Central Bank often had a better understandng, whch n part s due to the need to meet wth the BIS and other nternatonal complance requrements. More mportantly, none of the assessed countres have establshed a rsk montorng and complance functon for oversght of government debt management. Ths clearly dentfes a need to: () buld awareness of operatonal rsk and how to dentfy, assess, montor and where necessary control/mtgate those areas that can mpact government DeM operatons from a cost and/or reputaton rsk perspectve; () buld capacty n rsk montorng and complance for government DeM operatons.