Operational Risk Management and Organisational Risk Culture REPORT PDF

Preview

Summary

Operational Risk Management and Organisational Risk Culture REPORT...

Description

Operational Risk Management and Organisational Risk Culture Bank Operational Risk and Global Operations Management

Veneta Stamenova S1934978 MSc International Banking, Finance and Risk Management

Word count: 1548 17 December 2019

1

“This piece of coursework is my own and original work and has not been submitted elsewhere in fulfillment of the requirements of this or any other award”.

Contents Terms of Reference................................................................................................................................3 Summary (Abstract)...............................................................................................................................3 Introduction...........................................................................................................................................4 Capital-at Risk and methods used in its quantification..........................................................................5 Results...................................................................................................................................................6 Strengths and weaknesses of the Loss Distribution Approach..............................................................9 Risk Culture and the process of embedding Risk Management Framework..........................................9 Conclusion...........................................................................................................................................11 Appendix.............................................................................................................................................12 References...........................................................................................................................................15

2

Terms of Reference “A report submitted in fulfilment of the requirements for the module Bank Operational Risk Management (MMN324977), Department of Finance, Accounting and Risk, Glasgow Caledonian University”.

Summary (Abstract) This report is addressed to the company Chief Risk Officer, who is responsible for managing the risk at a corporate level of the organization which includes all significant risks of the firm including financial, strategic, operational and reputational risks. In order to report the analysis to the CRO, a quantification of the Capital-at Risk will be produced, using the Value at Risk (VaR) measure. The report aims to define operational risk, what a good risk culture consists of and how important this is regarding the behaviour of financial institutions. Moreover, it will critically discuss the Loss Distribution Approach used in modelling operational Capital-at Risk and give suggestions on how the bank can embed operational risk management across its risk framework. Furthermore, it will explain the process of quantifying the Capital-at Risk, using the bank’s Value at Risk and its Expected Loss value.

3

Introduction In the last few decades we have witnessed a number of cases of companies’ failures, most of which were caused due to the lack of effective operational risk management. Blunden & Thirlwell (2013) emphasize that in order to be able to elaborate a good and reasonable operational risk management framework, a well-structured operational risk governance is fundamental. “Proactive management of operational risk is critical to ensuring an organisation responds effectively to ever-changing market conditions and regulatory environments.” (Shochat & Fallen, 2012). Furthermore, Blunden & Thirlwell (2013) point out that an effective operational risk policy contributes to accomplishing the business objectives of the company. In this respect, both quantitative and qualitative methods of managing risk should be taken into account which “will give increased comfort to the board and senior management that risks which impact on the business objectives are being managed effectively” (Blunden and Thirlwell, 2013, p.29).

4

Capital-at Risk and methods used in its quantification Operational risk management usually produces quantitative and qualitative data to generate a report. As Blunden & Thirlwell (2013, p.167) demonstrate, in order to define the economic capital that is required to “support the operational risks to which a firm is subject, as well as to calculate regulatory capital requirements”, the risk analysts calculate capital by eight business lines and seven loss event types provided by the Basel Committee. In our given datasets, we examine a report by a researcher who has used the Value at Risk measure to calculate the Capital-at Risk of the company applying the Loss Distribution Approach (LDA) method. The first thing that the analyst does is to calculate the Mean taking the average data for each Business Line and Loss Event type respectively (Appendix Fig. 1). The second step is to define the Standard Deviation which is a measure of the volatility of a set of data and it is being calculated using the STDEV.S function (Appendix Fig. 2). As the Loss Distribution Approach consists of separately estimating a Frequency distribution for the occurrence of Operational losses and a Severity distribution for the economic impact of the individual losses, the researcher determines the Severity using a Lognormal distribution (Appendix Fig. 3). This is done by using the function RiskLognorm and the combined data of the Mean and Standard deviation of the particular business line. The same is performed with the Frequency loss event, where the risk analyst defines a Poisson Distribution (Appendix Fig. 4). Moving further, as to be able to define the Total loss of the bank, the researcher compounds the data from the loss severity distribution (Lognormal) and the loss 5

frequency distribution (Poisson) (Appendix Fig. 5 and 6). Afterwards, in order to be able to measure the level of financial risk within the company, the analyst uses Value at Risk (VaR) statistic which calculates the worst expected loss under normal market conditions. In our given datasets this has been done through the Monte Carlo Simulation which is one of the three approaches to Value at Risk. During the simulation values are sampled at random and we are given a range of possible outcomes. However, to establish the appropriate level of capital to cover unexpected losses we need an adequate confidence level which has been set out by the Basel Committee at 99,9% for one year holding period. From the performed simulation, the researcher has defined the VaR which corresponds to the maximum value (Appendix Fig. 7). Further, the analyst defines the expected loss of the bank which corresponds to the expected value (mean) of the distribution (Appendix Fig. 7). After that, the analyst establishes the unexpected loss which is the difference between Value at Risk and Expected loss value (Appendix Fig. 8). Finally, the last step in the analysis is to determine the Capital charge which is the sum of the Value at Risk quantifications (Appendix Fig. 9).

Results

6

7

8

Strengths and weaknesses of the Loss Distribution Approach In the quantification discussed above, the analyst used the Loss Distribution Approach to calculate “distributions for frequency and severity of OpRisk losses for each event type over a one-year time horizon” (Shevchenko, 2010, p.278). A lot of banks use the LDA in their Advanced Measurement Approach models in order to quantify regulatory or economic capital (De Jongh et al., 2015). However, a few drawbacks could be noticed using this approach. One of them, for instance, is that LDA does not take into account the fact that calculating VaR from different distributions is not correct mathematically (Blunden and Thirlwell, 2013). Additionally, the authors point out that this approach supposes that the company proceeds with its operation in the same manner that it has done in the last few years. Moving further, another drawback is that LDA “implies that past losses are a good indication of future requirements of operational risk capital” which is not completely true as the future can not be based on the past data. (Blunden and Thirlwell, 2013, p.168).

Risk Culture and the process of embedding Risk Management Framework There is not a single definition of Risk Culture, however, it could be defined as “a term describing the values, beliefs, knowledge, attitudes and understanding about risk

9

shared by a group of people with a common purpose, in particular the employees of an organization” (Davidson et al., 2015, p. 178). The authors claim that the Risk Culture plays a fundamental part in identifying the conduct and efficacy in the organization and especially after the financial crisis in 2008, it has increased its influence in the financial sector. Furthermore, they assert that organizational culture has a big impact on the way how people behave at work and this, in turn, “determines how an organisation behaves”. “Culture is primarily about values and behaviours. And values drive value” (Blunden and Thirlwell, 2013). However, Davidson et al. (2019) indicate that in order to be able to embed an effective Risk Culture in the company and not just on theory, still seems a challenging task. In this regard, Blunden and Thirlwell (2013) emphasize that a principal part of a good risk governance and risk culture is “clarity about roles and responsibilities” of the Board and executive directors. Consequently, to achieve this, four basic steps must be implemented in the organization in order to embed an effective risk management framework in the company – “framing the risk, assessing the risk, responding to the risk, and monitoring the risk” (Broad, 2013). In this respect, there are few major elements composing a robust Operational Risk Framework and these are Governance, Risk Appetite, Strategy, Policy and Procedures, Culture and awareness (Girling, 2013). Each of these elements has equal importance, however, a driving role is attributed to the Governance. The author assumes that “governance determines the roles and responsibilities of the head of the operational risk function” and good governance makes sure that an operative risk transparency is in place. Additionally, as Blunden and Thirlwell (2013) indicate, Governance ascertains the three lines of defence and it “holds the whole operational risk framework together” (Girling, 2013). A powerful risk culture and strong relationship in between the three lines of defence, play a fundamental part of an effective operational risk governance (Basel Committee on Banking 10

Supervision, 2011). Furthermore, the Committee states that the Framework should be determined, endorsed and reviewed regularly by the Board of Directors and they also need to make sure that the policies and procedures have been fulfilled efficiently throughout all decision levels. As outlined by Girling (2013), a good operational risk framework has well structured “policies and procedures that reflect the requirements of each of the elements”. Finally, Blunden and Thirlwell (2013) conclude that embedding good strategy and objectives in the firms is of great importance and without some clarity about them, the Board would struggle to manage and mitigate the risk in the organization.

Conclusion In summary, as each organization is unique and differs from one another, an “ideal” risk culture does not exist (Davidson et al., 2015). However, an effective operational risk management can be achieved when the risk is regarded as everyone’s responsibility (Blake, Smith & Mindrum, 2003). By creating a robust plan, assessing the current risk capacities and implementing strategic improvements to reduce or prevent losses, the organizations can mitigate their operational risks (Shochat & Fallen, 2012). Finally, by using the Value at Risk measure, enforcing stress-testing to the companies’ credit portfolios, running simulations and using historical data, management can identify and analyse the nature of the operational risks (Labrecque, 1998).

11

Appendix

Figure 1 Figure 3

Mean 560 452 610 346 541 593 549 611

Figure 2

Poisson 560 452 610 346 541 593 549 611

12

Figure 4 Figure 5 Figure 6

VaR @99.9% Expected Loss £34,199,786.90 £29,232,147.04 £38,132,093.40 £32,024,391.51 £32,664,362.25 £28,434,164.96 £22,196,262.23 £18,331,067.32 £39,734,164.58 £35,023,684.77 £45,196,367.83 £39,650,644.98 £38,220,538.62 £33,356,648.61 £28,426,606.27 £24,138,416.03

Figure 7

13

Unexpected Loss £7,000,000.00 £6,000,000.00

£6,107,701.89 £5,545,722.85

£5,000,000.00 £4,967,639.86 £4,000,000.00

£4,230,197.29

£4,710,479.81 £3,865,194.91

£4,863,890.01

£4,288,190.24

£3,000,000.00 £2,000,000.00 £1,000,000.00 £0.00

Figure 8

Figure 9

References 14

BASEL COMMITTEE ON BANKING SUPERVISION, 2011. Sound Practices for the Management and Supervision of Operational Risk. [online] [viewed 06 December 2019]. Available from: https://www.bis.org/publ/bcbs195.pdf

BLAKE, H., SMITH, M. and MINDRUM, C., 2003. Managing operational risk. Canadian Underwriter, 70(3), pp. 44-46. [online] [viewed 07 December 2019]. Available from: https://search-proquest-com.gcu.idm.oclc.org/docview/224992567? accountid=15977&rfr_id=info%3Axri%2Fsid%3Aprimo

BLUNDEN, T. & THIRLWELL, J., 2013. Mastering Operational Risk, 2nd Edition. 2nd ed. FT Publishing International.

BROAD, JAMES (2013) Risk Management Framework. 1st edition. Syngress. [online] [viewed 06 December 2019]. Available from: https://learning.oreilly.com/library/view/risk-managementframework/9781597499958/?ar=

DAVI DSON,O. ,MACKENZI E,P. ,WI LKI NSON,M.&BURKE,R. ,2015.Ri s kCul t ur e.El s ev i erI nc .

[online] [viewed 30 November 2019]. Available from: https://www-sciencedirectcom.gcu.idm.oclc.org/science/article/pii/B9780128006337000134

DE JONGH, P.J., DE WET, T., RAUBENHEIMER, H. and VENTER, J.H., 2015. Combining scenario and historical data in the loss distribution approach: a new procedure that incorporates measures of agreement between scenarios and historical data. The Journal of Operational Risk, 10(1), pp. 45-76. [online] [viewed 30 November 2019]. Available from: https://search-

15

proquest-com.gcu.idm.oclc.org/docview/1672921724? OpenUrlRefId=info:xri/sid:primo&accountid=15977

GIRLING, PHILIPPA, (2013) Operational risk Management: a complete guide to a successful operational risk framework. Hoboken, New Jersey: Wiley. [online] [viewed 06 December 2019]. Available from: https://onlinelibrary-wileycom.gcu.idm.oclc.org/doi/pdf/10.1002/9781118755754.ch3

LABRECQUE, T.G., 1998. Risk management: One institution experience. Economic Policy Review - Federal Reserve Bank of New York, 4(3), pp. 237-240. [online] [viewed 07 December 2019]. Available from: https://search-proquestcom.gcu.idm.oclc.org/docview/210392400/7B0D118CD6F54EDBPQ/3?accountid=15977

SHEVCHENKO, PAVEL, 2010. Implementing loss distribution approach for operational risk. Applied Stochastic Models in Business and Industry. 26 (3), pp. 277–307. [online] [viewed 29 November 2019]. Available from: https://onlinelibrary-wileycom.gcu.idm.oclc.org/doi/epdf/10.1002/asmb.812

SHOCHAT, J. and FALLEN, K., 2012. MANAGING OPERATIONAL RISK. Energy Risk, 9(6), pp. 2224,26. [online]. [viewed 23 November 2019]. Available from: https://search-proquestcom.gcu.idm.oclc.org/docview/1012326284/fulltext/51D20255F1CE4BB2PQ/1?accountid=15977

16...