Operational Risk Management

Definitions

Operational risk (OpRisk)has been defined by the Basel Committee on Banking Supervision as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events.

Management of Operational Risk means and includes identification, assessment, monitoring and control/mitigation of this risk.

Causes of OpRisk

· Internal fraud · External fraud· Employment practices and workplace safety· Clients, products and business practices. · Damage to physical assets. · Business disruption and system failures · Execution, delivery and process management

Causes of OpRisk

· Highly Automated Technology · Emergence of E- Commerce · Emergence of banks acting as very large

volume service providers· Outsourcing · Large-scale acquisitions, mergers, de-mergers

and consolidations · Engagement in risk mitigation techniques

giving rise to legal risk

Contributors to OpRisk People Risk Process Risk

– Transaction Risk– Documentation/contract risk.– Operational Control Risk– Model Risk

Systems Risk– Technology Risk-– MIS Risk.

Legal and Regulatory Risk Event Risk

OpRisk Management process

• Appropriate policies and procedures• Efforts to identify and measure operational risk• Effective monitoring and reporting• A sound system of internal controls, and• Appropriate testing and verification of the

Operational Risk Framework

Concept of Gross Income• The Basel Committee has allowed each relevant

national supervisor to define gross income. RBI defines gross income as follows,

• Gross income = Net profit (+) Provisions & Contingencies (+) operating expenses (Schedule 16) (-) profit on sale of HTM investments (-) income from insurance (-) extraordinary / irregular item of income (+) loss on sale of HTM investments

Computation of Capital Charge

Operational Risk

StandardizedCapital change based on single risk indicator

Foundation Capital based on business lines and industry standards

AdvancedCapital based on business lines and internally calculated standards

OpRisk ApproachesApproach Basic Indicator Standardized Advanced

Measurement

Calculation of Capital charge

Average of Gross Income for three years as indicator

Capital charge equals 15% of the indicator

Gross income per regulatory line as indicator

Depending on business line 12, 15 or 18 % of the indictor as capital charge

Total capital charge equals sum of charge per business line

Capital charge equals internally generated measures based on, Internal loss data External loss data Scenario analysis Business environment and internal control factors

Recognition of risk mitigation (upto 20%)

OpRisk ApproachesApproach Basic Indicator Standardized Advanced

Measurement

Qualifying criteria

No specific criteria

Compliance with the Basel Committee’s “Sound Practices for the Management and Supervision of Operational Risk” recommended

Active involvement of Board of directors and Senior management

Existence of OpRisk Management function

Sound OpRisk Management system

Systematic tracking of loss data

Same as standardized plus

Measurement integrated into day-to-day risk management

Review of management and measurement processes by internal/external auditor

Numerous quantitative standards—in particular 3-5

years of historic data

Standardized Approach--Capital Charge

Corporate finance Gross income b1

Trading and sales Gross income b2

Retail banking Gross income b3 Commercial banking Gross income

b4 Payment and settlement Gross

income b5

Agency services Gross income b6

Asset management Gross income b7

Retail brokerage Gross income b8

18 18 12

15

18 15 12 12

Recognizing/Assessing Risk Events(i) Experience - The event has occurred in the past

(ii) Judgment - Business logic suggests that it is a risk

(iii) Intuition - Events where appropriate measures saved the institution in the nick of time

(iv) Linked Events - This event resulted in a loss resulting from other risk type (credit, market etc.)

(v) Regulatory requirement

ASSESSMENT Self assessment Risk mapping Key Risk indicators

Factors: Assessing Potential risk areas

(i) Staff related factors such as productivity, expertise, turnover

(ii) Extent of activity outsourced

(iii) Process clarity, complexity, changes

(iv) IT Indices

(v) Audit Scores

(vi) Expected changes or spurts in volumes

Risk Measurement: Basis

(i) Total number of risk events

(ii) Total financial reversals

(iii) Net financial impact

(iv) Exposure: Based on expected increase in volumes

(v) Total number of customer claims paid out

(vi) IT indices: Uptime etc.

(vii) Office Accounts Status: such as changes in balances

Monitoring Operational Risk--Issues

Operational loss events

Identification of appropriate indicators

Frequency of monitoring and reporting

MIS

Business line identification

Corporate finance, Trading and sales,

Retail banking, Commercial banking,

Payment and settlement , Agency services,

Asset management, and Retail brokerage.

OpRisk Management & Data Needs

Data Types Transactional Operational/CRM Analytical Risk management Economy/Industry

Data Collected Loss Event Data Causal Data Loss Effect Key Risk Indicators (KRIs) Proxies Risk Inventories Structured Self Assessment

Data External Data

Management tasks Decision whether control for risk minimization or

bear Risk mitigation tools as complementary to control Investment in technology and Information security Outsourcing policy-- development and adoption Impact of operational break downs and loss---intra

and outside bank Business Continuity plans and testing Review of Business Continuity plans

Organisational Set-up

Board of Directors Risk Management Committee of the Board Operational Risk Management Committee Operational Risk Management Department Operational Risk Managers Support Group for operational risk

management