Agenda. Introduction. Well known cases. Regulatory Framework. Operational Risk Management Process

Transcription

1 KPMG g Business Dialogue KPMG Luxembourg, 23rd May 2012 Operational p Sven Muehlenbrock, Head of Financial Management Francesca Messini, FRM, Financial Management Bertrand Segui, Actuary, Financial Management

2 Agenda Introduction Well known cases Regulatory Framework Operational Management Process The benefit to implement an operational risk management framework Hints on implementing an operational risk management and measurement system What is next? KPMG Solution

3 Operational risk in bank, funds and insurance company What did we learn? Barings case The trader Nick Leeson led to a loss of USD 1.4 bio at his employer Barings Plc Bank, that declader bankruptcy, taking a position in derivates. SocGen case The trader Jerome Kerviel led to a loss of EUR 4.9 bio at his employer SocGen, taking a massive unidirectional position in European equity index futures in 2007 and 2008 Unsuitable investments JP Morgan, UBS, Depfa Bank and Deutsche Bank paid approximately USD mio to municipalities of Milan, Italy, for selling complex derivatives inappropriate for inexperienced investors Clients, products and business practices events continue to make up the majority of the top five losses each month. Source: SAS Software

4 Operational risk in bank, funds and insurance company Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes strategic and reputational risk Cause Event (what goes wrong) Impact Internal (process, people and systems) External Fraud Human error in processing transactions Missing a control step Disruption or system failures (hardware, software, telecommunications) Act of sabotage or vandalism from an employee Not compliance with law and regulatory requirements Dispute with employee due to discrimination i i or harassment New service and/or change in the current processes Fraud Act of terrorism and sabotage Customer s claim Near misses Forgone Revenue Repurchase of stuff Fine from authority

5 Agenda Introduction Well known cases Regulatory Framework Operational Management Process The benefit to implement an operational risk management Hints on implementing an operational risk management and measurement system What is next? KPMG Solution

6 Operational risk in bank, funds and insurance company Regulatory framework Bank ManCo and Funds Insurance companies Basel II / III CSSF Circular 07/290 Solvency II CSSF Circular 06/273 CSSF Circular 11/512 AIFMD (RTS) Level 2 implementation measures, CP 52, final advice Pillar 1 Quantitative capital requirements Three-pillar approach Pillar 2 Qualitative supervisory review Pillar 3 Market discipline Own Funds ICAAP Transparency Market Credit Operational Supervisory Review Process (SRP) Own risk and solvency assessment (ORSA) Disclosure requirements Solvency and financial condition report (SFCR)...

7 Operational risk in bank, funds and insurance company Regulatory framework for Banks Basel II, Pillar I: Capital Requirement Advanced Measurement Approach AMA Three approaches: the increase of sophistication is related to the fact that the AMA can be tailormade to the specific bank Basic Indicator Approach BIA Regulatory Capital = Standard Approach* SA Regulatory Capital = GI * BL ( between 12% and %) Average of last 3 years GI * regular reporting and good documentation; ti Regulatory Capital = Internal statistical model - capital charge is equal to the unexpected losses (UL) with 1 year of horizon time and 99.9% of confidence level; effect of insurance up to 20% can be taken into account develop a risk management framework: methods to identify, assess, monitor and control; Collect internal loss data; use external losses; perform scenario analysis and review business environment and internal control factors; validate the model results. board of directors and senior management actively involved; clear role and responsibilities assigned; systematic collection of operational risk data, integrated into the processes; subject to regular review by external auditors and/or supervisors. sophisticat tion * ASA alternative SA 2 BLs based on ptf volume instead of GI

8 Operational risk in bank, funds and insurance company Regulatory framework for AIFM AIFMs shall implement Operational adequate risk management systems in order to AIF AIFM identify, A failure in operation can impact measure and the return of AIF monitor negligence in performing the appropriately Examples: all risks activities of AIFM Failures in trading, relevant to settlement and valuation each AIF services investment Internal or external fraud strategy and Implementation of operational risk to which each Failure in the reconciliation processes performed by management framework AIF is or may fund administration be exposed Additional Own Funds (Directive 2011/61/EU art 15) Etc. Potential liability from professional Hold a professional indemnity insurance

9 Operational risk in bank, funds and insurance company Regulatory framework for AIFM Professional Indemnity Insurance (PII) Additional Own Funds NT QUA QUAL 0.01% * AuM Can be lowered to 0.008% provided AIFM can demonstrate that liability risk is adequately captured, based on historical loss data and minimum historical observation of 3 years Implement an effective internal operational risk management policies and procedures It shall be performed by an independent function Record and make use of historical internal loss data, external data, scenario analysis and factors reflecting internal controls

10 Operational risk in bank, funds and insurance company Regulatory framework for Insurance companies Under Solvency II, there are two ways to calculate the exposure to operational risk Standard Formula Internal / Semi internal model Advantage: - Simple to implement and fast calculation - Doesn t require to create sophisticated models - Already approved by the regulator Inconvenients: - The formula is deterministic and doesn t fit to every business - The calibration has been done on the whole insurance market and may be totally inappropriate for specific insurance of reinsurance companies leading to potential overestimation i of the capital charge - The formula remains static and doesn t integrate any update of the company s historical losses

11 Regulatory framework for Insurance companies Solvency I balance sheet / The lack of risk management Excess of capital ASSETS In book value Solvency Margin Required (SMR) Technical Provisions Capital In non-life: SMR In life: Max ( 18 %. P M 16 %. P 50 M ;26 %. P 35 M 23 %. P 35 SMR 4%. P 2%. ycapit 50 M al ) NO RISK MANAGEMENT The operational risk had NO impact on the solvency margin

12 Regulatory framework for Insurance companies The standard formula approach Market Health Default Life Non-life Intangible 12

13 Regulatory framework for Insurance companies The standard formula approach BSCR Market Health Default Life Non-life Intangible 13

14 Regulatory framework for Insurance companies The standard formula approach SCR Adj BSCR Operational Market Health Default Life Non-life Intangible 14

15 Regulatory framework for Insurance companies The standard formula approach SCR Adj BSCR Operational Market Health Default Life Non-life Intangible In the context of the standard formula, the operational risk is a function of the BSCR: Operational = Min ( 30% x BSCR ; Op ) + 25% Exp UL Where: - Op is a charge for all business other than Unit Linked products (simple formula expressed as a % of premium and a % of the technical provisions) - Exp UL represents the expenses incurred the last 12 months in respect with UL products

16 Agenda Introduction Well known cases Regulatory Framework Operational Management Process The benefit to implement an operational risk management framework Hints on implementing an operational risk management and measurement system What is next? KPMG Solution

17 Operational risk in bank, funds and insurance company The benefit to implement an operational risk management framework Implement an advanced operational risk management approach is much more that capital relief!! It is not just fulfil some regulatory capital obligations!!! Go deeper to the end of the things, understanding the root cause Make operational risk very concrete and keep it alive Employees start using it for their day-to-day risk management, embedded in the business

18 Operational risk in bank, funds and insurance company Pay attention to the invisible part of the iceberg In some cases, operational risk is the cause of the exposure to other risks type. Silo mentality results in lack of understanding of operational risk as di driver for other risk ktypes. Some of the well-known n examples are the market-related operational risk events which are often associated with rouge trading, unauthorized, leverage operations or complex instruments and new products. Credit Market risk Model risk Operational Business Liquidityidit risk

19 The Benefit for the institution to implement an operational risk management Sound evaluation of all the processes It is integrated and interfere with the business of the institution. Private Banking & Asset management Internal Audit Back Office Operational Management function has a global picture of the risk profile of the entire institution. tion Legal Operational Function Front Office Complian-ce Accounting HR, IT, Facility

20 The Benefit for the institution to implement an operational risk management Implement an operational risk management framework To create value for the management of operational risk, the actual risk exposure must be aligned with the overall risk appetite of the institution Operational Management Framework Governan nce and Orga anization Policy & Strategy Management Identification & Monitoring Reporting Assessment Culture and Awareness Operational Policy, Strategy & Procedures

21 The Benefit for the institution to implement an operational risk management Have a sound view: past + future thinking the unthinkable Operational management process is based on the relationship among various instruments Operational Management Reporting Measurement and Modeling of Capital charge External Loss Data Internal Loss Data Business Environment (KRI) Control Factors Scenario Analysis BACKward-looking PRESENT-looking FORward-looking Process Mapping

22 Operational Management Process Identification The detection of any event which potentially triggers a Policy & material business impact, or which h represents a Strategy modification of the risk profile, must be done as early as possible (timely) and could be initiated by: Claims from customers or incidents Management Key Indicators breaches Identification & Monitoring External Losses Change of business New regulatory requirement Internal / External Audit finding Reporting Assessment New product / project Scenario Analysis Etc... All risks as well as root causes of losses are identified and mapped to the bank s risk classification (Basel II Event Type) and the potential impact estimated (how, where, how much)

23 Operational Management Process Identification Identify an operational risks means at the same time identify its root cause Internal Fraud External Fraud Employment Practices and Workplace Safety Clients, Products and Business Practices Damage to Physical Assets Business Disruption and System Failures Execution, Delivery and Process Management Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity/ discrimination events, which involves at least one internal party Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party (theft, hacking damage, etc.) Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events diversity Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product. Losses arising from loss or damage to physical assets from natural disaster or other events (terrorism, vandalism). Losses arising from disruption of business or system failures (hardware, software, telecommunications) Losses from failed transaction processing or process management, from relations with trade counterparties and vendors (miscommunication, wrong data entry/ handling, delivery failures, negligent loss of clients assets, etc.)

24 Operational Management Process Identification The instruments usually used in order to identify ex ante, and then monitor and calculate the exposure to operational risk are: External Loss Data Internal Loss Data Business Environment (KRI) Control Factors Scenario Analysis BACKward-looking PRESENT-looking FORward-looking! In the regulation these instruments are identified as the key building blocks of risk measurements, BUT it does not elaborate on how to put them together. Institutions have the tasks of finding the most appropriate way!

25 Operational Management Process Assessment The Operational Function assesses the Policy & Strategy risk exposure both in qualitative and quantitative term. The assessment of an incident or a potential risk aims at quantifying the risk in financial Management Identification terms using either ih simple or sophisticated i & Monitoring methodologies like simulation using Monte Carlo approach. Reporting Assessment Think the unthinkable! Integrate the backward-looking view with the forward-looking

26 Operational Assessment with LDA Model Overview The most popular method in the industry to satisfy the highest standards is the loss distribution approach (LDA) INPUT Adjustments: KRI, mitigation factors (i.e. insurance, ect) OUTPUT External losses Frequency Distribution Loss Distribution Body Tail Internal losses Body Severity Distribution Monte Carlo Simulation Scenario data Expected Loss 99.5 /99.9% Quantile Tail

27 Example of internal module simulation We consider an insurance company with following characteristics: 50 years old Historical loss data well documented: * 3 fraud events Losses in the range * 5 lawsuit actions Losses in the range * 2 vandalism Losses in the range * 7 damages to physical assets Losses in the range Step 1: Inputs Convert those events into scenarios: Range of loss severity (EUR) Frequency (years) Scenario /50 Scenario /50 = 1/10 Scenario /50 = 1/25 Scenario /50 As the number of losses may remain an insufficient basis, one more scenario deemed relevant can be added: *T Terrorism attack Scenario /200

28 Example of internal module simulation Step 2: We translate the severity information into a scale distribution of severity and we fit the best parametric distribution Frequencies 1 0 Losses (Severity) Step 3 We suppose than severity and frequency are two independent d random variables and we simulate them independently Excel sheet

29 Operational Management Process Reporting Enhance senior management awareness of operational risk: it is put on the agenda Management & Monitoring Policy & Strategy Identification The BoD and Senior Management are timely and soundly informed about material risks and change of the actual risk profile of the bank, covering causes, potential early mitigation measures, assessment and recommendation, in order to take the appropriate action. Reporting Assessment BoD Senior Management Operational Management Function Unit A Unit B Unit C

30 Operational Management Process Reporting Benefit of having in place a timely reporting and escalation process: Internal view External view Enhance awareness of risk Increase reputation versus competitors More informed decisions making Reduce exposure to reputational risk through timely management of operational incidents Clearly defined procedures for Improve communication and action and remedial steps in the disclosure to external stakeholders event of material breaches like: Supervisors Auditors Rating agencies Clients Shareholders

31 Operational Management Process Management and Monitoring The Operational Management function should support the BoD in taking the most appropriate mitigation action based on the reported information Management & Monitoring Policy & Strategy Identification High Severity / Low Frequency events Insurance policies & Self Insurance Derivatives hedging (cat options and cat bonds) Reporting Assessment H severity L TRANSFER AVOID ACCEPT MITIGATE frequency H Limitation or stop of product / project Change investment type High Frequency / Low Severity events Enhancement of internal controls Business Continuity Planning (systems, supplier, staff and workspace)

32 Hints on implementing a operational risk management and measurement system Data integrity: use of external loss data, which require a mapping or scaling to the firm s own data poor-quality of internal loss data creeping into model assumptions Perform scenario analysis using a bottom-up approach Increase the operational risk culture in the firm Do not ignore tools like Key Indicators (KRIs) for monitoring operational risk Standard IT tool to centrally collect all data (for instance internal losses, breaches, external losses, findings, etc.) and related information (mitigation actions taken, procedures) Advanced approaches: stress testing & sensitivity analysis in the scope of model validation

33 What is next? Top 10 operational risk concern for 2012 and beyond Fraud and insider risk Disaster recovery and business continuity Miss-selling Regulatory compliance Online security Model risk Sanctions and money laundering Ongoing updates: for bank AMA model change Policy (EBA GL 45; CSSF Circular 12/535) Looking for more sensible approaches under discussion the alfa and beta indicators used in the BIA and SA for banks replace the Gross Income as indicator

34 KPMG Solutions Impact study (cost-benefit analysis) Assistance in enhancing the risk management framework KPMG Assistance in the implementation of advance models and in obtaining regulatory approval Assistance in operational risk modeling