Governance structures and leading. central banks

Transcription

1 Governance structures and leading practices for risk management in central banks Helena Tejero, Division Head, Risks & Processes, Bank of Spain Central Bank Governance Forum 2014 IMF / Hawkamah, Dubai, United Arab Emirates December 8, 2014 FEDERAL RESERVE BANK OF PHILADELPHIA Today s agenda International Operational Risk Working Group (IORWG) Overview Central Banks Risk Governance Structures Central Banks Risk Practices Conclusions The views herein are the personal views of the speaker and do not necessarily represent the views of either the IORWG members or the Bank of Spain. 1

2 International Operational Risk Working Group 2 International Operational Risk Working Group (IORWG) Overview Leadership: Chaired by the Federal Reserve Bank of Philadelphia and the Bank of Spain. Objectives: Share best practices. Innovate new frameworks and methodologies. Generate genuine interest on ORM*. Membership Representatives: Risk representatives from central banks and monetary/supervisory authorities across the world. Membership Benefits: Knowledge sharing, networking opportunities, and research topics with other central banks through global expert groups participation. Conferences organized: I. Spain, 2006 II. United States, 2007 III. Denmark, 2009 IV. France, 2008 V. Brazil, 2010 VI. Thailand, 2011 VII. Sweden, 2012 VIII.Morocco, 2013 IX. Israel, 2014 X. South Africa (planned for 2015) Information channels: IORWG website ( Regular alerts to members. (*) ORM stands for Operational Risk Management 3

3 In October 2005, 18 institutions agreed to be part of the IORWG Canada United States of America Mexico Dominican Costa Rica Republic Colombia El Salvador Ecuador Brazil Bolivia Chile Argentina Estonia Latvia Lithuaniai Norway Sweden Denmark ECB Switzerland The Netherlands Poland Ireland UK Bulgaria Azerbaijan Germany Greece Belgium Austria Luxembourg France Curaçao Spain Portugal Jordan Morocco Israel Italy Uganda Malta Malaysia International India Singapore (Bank for International Malawi Madagascar Settlements, BIS) South Africa Australia Uruguay Angola Korea Japan Hong Kong Thailand Philippines Indonesia 59 members in New Zealand 4 IORWG Collaboration Efforts Expert Group Process: Expert Group studies: 35 completed to date, e.g. last year s topics: ORM Trends and Best Practices (Phase II). Risk Culture and Awareness. Incident Management and Reporting. ORM Interdependencies with Management of Other Enterprise Risks. Existing Governance Structures in the Area of Risk Management. Risk Repository (Phase IV) topics will focus on continuing work associated with trends and best practices, reporting, advancement of the risk repository, information and cyber security, training practices and building a maturity model. Research topics use industry literature, conduct member surveys, profile central bank practices in greater detail and summarize results at the conference (4-5 month effort). Use breakout groups on expert group topics to further discuss key items and report back to the group. 5

4 Risk Governance Structures 6 Three lines of defense model Central banks governance structures generally rely on three lines of defense by which governing bodies and senior management in their responsibility for risk management framework are served by the following lines : business line management Owners of risk. Responsible for identifying and managing g the risks inherent in the products, activities, processes and systems for which they are accountable. risk management function Responsible for providing the risk framework and for independently overseeing risk-taking activities bank-wide. internal audit function Responsible for independently opining on the overall appropriateness and adequacy of the framework and the associated governance processes. 7

5 Board / board subcommittee Ultimate responsibility for risk management is generally assigned to the governing bodies (e.g. governor, board, executive committee). The board or a subcommittee of the board is often responsible for providing oversight and direction with regard to risk management (in some Central Banks (CBs), oversight is provided by the governor or a RMC* at the executive level). (*) RMC stands for Risk Management Committee Common subcommittees: The audit committee and, to a much hlesser extent, t the risk oversight committee. Common duties : Ensure the establishment and maintenance of the framework. Provide oversight over the program Review reports activities and status of risk management, risk profile, key risks, response to the most significant risks. Improve the focus and dialogue on risk, challenge and dig deeper into emerging risks 8 Committees involved in the risk governance Four different approaches 1 2 The Board does not delegate the The Board delegates to an risk oversight responsibilities to a executive sub-committee which is sub-committee. responsible for all risks and in The Board is supported by existing some cases for operational risks committees, with a broad mandate, only. not dedicated to risk issues. 3 4 The Board delegates to a board The Board delegates to a board subcommittee. sub-committee. In addition a RMC has an In addition there are: executive role establish and - RMC (executive risk committee) maintain the risk management and framework. - Specialized Risk Committees. Note: an Audit Committee generally exists in all approaches. 9

6 Governance (cont.) Governance is often not well documented or understood; responsibilities, particularly advisory roles, are not consistently applied. How governance relationships work in practice is not always consistent t with charter documentation. Formal guidance needs to be provided to ensure committees are consistently established, operated, and reviewed. Structure, roles, and decision rights across bodies are interpreted differently. Complex or undefined governance can result in confusion regarding accountability and prolonged decision making. This can increase operational risk and can lead to reputational risk. Conduct self-assessments of governance practices 10 Operational risk function Most CBs have centralized independent ORM unit; several have centralized compliance units. In some cases, the functions are combined with other risk and control-related disciplines, e.g. Business continuity, IT security. Usually deals with legal, reputational and compliance risks. To a lesser extent with financial and strategic risks. Sample of central banks have on average 4 full-time equivalent in risk units. Main responsibilities: Provide risk management methodologies. Facilitate and consolidate the results of risk assessments. Assisting in developing processes and controls. Track risk incidents and report on mitigation. Coordinate reporting board, RMC and senior management. Provide guidance and training. Few include the operational risk measurement. Challenge the business lines outputs from risk management activities 11

7 Internal audit Central banks have an independent internal audit unit from 1 st and 2 nd line of defense. Although h some ORM programs were/are still launched and championed by the internal audit. Main responsibilities: Verify that the risk framework has been implemented as intended and is functioning appropriately. Assess the effectiveness of the bank s operational risk management controls, processes and systems, as well as governance. Review the management and reporting of key risks. Ensure independence of risk management and internal audit although they may collaborate in activities such as awareness programs 12 Interdependencies Generally the tendency of disciplines is to operate in silos due mainly to a weak governance structure and immature risk culture. The greatest t extent t of alignment with ORM is associated with business continuity, and IT and information security risks. There is also high interaction, meetings, exchange of reports with the internal audit unit. Building a common risk taxonomy, using the same process map, exchange of information, In a few cases, permanent access to ORM/IA databases. Challenges with aligning ORM with other disciplines - Get acceptance for an integrated approach - Overcome differences in terminologies and views regarding approaches and methodologies e.g. IT framework too technical and granular to integrate 13

8 Risk Practices 14 Central Banks ORM current status Generally ORM programs are fully or almost fully implemented in CBs. Most ORM frameworks are internally developed. Also some refer to COSO, ESCB, ISO or Basel standards. d Common ORM framework for all areas across the central bank. Different frameworks in few central banks still co-exist. ERM approach is not generally implemented. Although major integration is seen in risk reporting. Central banks follow a standardized phased approach for risk management procedure: risk identification, assessment, responding to, reporting on and monitoring. Most banks use different IT solutions (mainly SharePoint, MS Office or internally developed) for different ORM activities, some do not use any tools. The use of an integrated IT tool to support the whole risk management procedure is rare (often cost prohibitive). 15

9 Central banks ORM practices [Non exhaustive] Risk k appetite/ tolerance KRIs Risk Risk awareness Scenario identification and culture analysis - ORM development + Risk and control self assessment Impactful/ value- added reports Incident reporting Risk quantification 16 Developing and reviewing central banks risk appetite/tolerance Risk Appetite Risk Appetite is defined as the amount of risk, on a broad level, that an organization is willing to accept in the pursuit of its mission, vision, business objectives and overall strategic goals. Approved at the senior level, embraced by the board, easy to communicate and embedded and understood at all levels. Set clear boundaries qualitative statements and quantitative measures. Reportable: through monitoring, action defined for any breaches (escalation, review, approval). Risk Tolerance Risk Tolerance is a series of limits which may either be set as not to be breached, or as an alert mechanism. While risk appetite is broad, risk tolerance is tactical and operational. Tolerances form part of the risk appetite framework for specific risks, by guiding operational areas for appropriate risk taking and select the types of controls which are needed to ensure that limits are not exceeded. 17

10 Risk appetite/tolerance experiences Experiences There is evidence of the gap between the financial system and central banks regarding the understanding di and management of the concept The concept of Risk Appetite / Tolerance has not yet been embraced in CBs because of the reputational impact and the conservative profile of the CBs Nevertheless, generally CBs have incorporated some elements of risk appetite into their framework; different levels of maturity are noticed. Expressed as a statement, embedded in policies or part of risk matrix. Some CBs publish their risk appetite on their main website to illustrate to the public how their risk framework works. Introducing a clear distinction between appetite and tolerance should be the first step. Risk (all types of) appetite shall be more formally documented. 18 Central banks risk culture / awareness This topic remains the most challenging for IORWG central banks, as it is and will be the core driver of the business areas motivation to manage risks. ik Few central banks rank culture as excellent; almost 70% see culture as good and more than 20% as inadequate. Generally staff in key functions have the appropriate level of skills, knowledge and experience to enable sound risk management practices. Senior management and key business heads have been trained in most cases. Training to all staff is in place only in some central banks. Risk awareness activities are regularly performed: Monthly/quarterly risk bulletins, newsletters, quizzes to staff. Periodic incident reporting. Risk articles in the quarterly Bank magazine. 19

11 Central banks risk culture / awareness (cont.) Risk awareness activities are regularly performed (cont.): Risk awareness week and other activities. Monthly departmental/ business unit awareness. Risk management workshops. Monthly risk managers meetings. Displaying messages or banners that promote a strong risk culture in strategic areas. Playing recorded risk messages in the elevators. Key levers for risk culture fostering: Strong support from board and senior management. ORM training. Increased communication/cooperation with board, senior management, business areas and staff. Enhanced risk methodology (clear and practical). Fostering a risk aware culture at all levels of the organization 20 Risk reporting practice Most common components: Risk Control Self Assessments. Incident Reporting. Business Continuity Management. Market and credit risks. Top organizational risks. Risk Tolerance. Emerging Risks. To a lesser extent: KRIs. Project risks. Scenario Analysis. Liquidity risks. KPIs. Most popular scoring method used is risk matrices. Impact Likelihood 21

12 Risk reporting practice (cont.) Receiver Frequency Media Content Risk Reporting Board or dedicated risk management committee Senior management/business areas for information, also internal audit At least annually for approval Frequent reporting on dedicated risks/incidents Usually hard copy, some via Include additional presentations Only a few provide information to all staff Most focus only on operational risk - Major risks, mitigation, risk heat map, major incidents Overview to Board/risk management committee about the risk profile of the Bank 22 Risk reporting practice (cont.) Risk reporting remains a key challenge for central banks: how to create impactful and value-added reports along with data limitations? Characteristics Key tools Frequency Accuracy Appropriateness Comprehensiveness Timeliness Truthfulness Leading Indicators Forward Looking Dashboards and Heat maps Lagging indicators and incident reports trend analysis Identification of thresholds and trigger points 23

13 Incident management & reporting practice Only some central banks have a mature practice in place. There are still many central banks at an early stage and few have no formal process implemented yet. Incident management and reporting procedure: Most CBs utilize standardized templates. Reporting includes near misses. For the grading of the incidents most of the CBs use a scale of 1 to 5 Only a few CBs work with financial thresholds. Generally decentralized submission from business areas to ORM function. Incidents are analyzed by the business units and/or ORM function and appropriate action plans are agreed on. In the majority of the CBs, the business unit is in charge of any action plan follow up and the reporting. 24 Incident management & reporting practice (cont.) Major challenges As regards the procedure, clear guidelines and a process description are needed. d As regards the awareness, there are major challenges to overcome: Overall Bank s risk awareness and culture. Shame culture or blame game. Get a strong support from senior management. Timeliness of reporting by business area. Technical difficulties: Evaluation of financial impact is sometimes difficult. Difficulties in determining a near miss. Quality of the reports and the level of details. 25

14 Conclusions 26 Concluding remarks Central banks governance structures often rely on three lines of defense; a range of practice exists relating to the implementation of those. The board or a subcommittee of the board is often responsible for providing oversight and direction to risk management. How should we improve the focus and dialogue on risk? Risk committees are generally in place to support board and senior management s risk management responsibilities. Are the RMCs operating effectively? Most central banks have a centralized independent unit dealing with ORM. How should we substantiate an independent review of the business lines outputs? The greatest extent of alignment with ORM is associated with business continuity and IT and information security risks. There is also high interaction, meetings, exchange of reports with internal audit. How should we evolve into an enterprise-wide/integrated risk management? 27

15 Concluding remarks (cont.) Generally ORM programmes are fully or almost fully implemented in central banks. How should we shorten or expedite the implementation ti journey for newcomers? Few ORM techniques are mature. Some techniques still need to improve: Risk appetite shall be more formally documented. Continue enhancement of risk awareness / culture. Improve quality of risk information. Enhance incident reporting from a procedural, cultural and technical point of view. Few techniques are still at infancy: KRIs, Scenario Analysis and Risk Quantification. 28 Thank you for your attention Helena Tejero helena.tejero@bde.es IORWG iorwg@bde.es 29