Professional Documents
Culture Documents
Risk Management Toolkit PDF
Risk Management Toolkit PDF
Contents
Section 1 Introduction Section 2 Risk definition and language Section 3 Risk appetite 3 7 33
Section 4 Risk governance, roles and responsibilities 51 Section 5 Risk policy Section 6 Risk and control self assessment Section 7 Key risk indicators Section 8 Internal loss events Section 9 External loss data Section 10 Management information Section 11 Stress and scenario testing Section 12 Risk culture 65 93 113 129 143 147 153 169
Introduction
Section 1
1 Introduction
The risk management toolkit
Lloyds has developed a risk management toolkit to help to develop risk management practice across the Lloyds market. The toolkit provides a range of tools, techniques and templates, worked examples, and practical advice for key aspects of risk management. The toolkit supports the Lloyds risk management standards and guidance documents.
Section 1 Introduction
Structure
With exception of section 9 and 12, each component section of the tools is split between four pages covering the following: what is it? explains / defines the aspect of risk management that is discussed in this section; why is it important? discusses why this is a key aspect of robust risk management; some practical steps necessary for implementation highlights some key steps necessary for an organisation to take in order to implement and address this aspect of risk management; and relevant toolkit contents presents the tools and gives a brief explanation of what each tools does / should be used for.
Tool downloads
Lloyds is keen for managing agents and syndicates to use the toolkit to help review and, if necessary, improve their risk management functions, however Lloyds accepts no liability for incorrect use or subsequent risk management failure from use of tools. Risk management is commensurate to the organisation in question and it is important to remember that even if all tools from the toolkit are used, this does not necessarily mean that an organisation will have a perfect risk management function. The last page in each section, the Relevant toolkit contents page contains links to all associated tools. The tools are either in Word or Excel format and a range of tools can be tailored for use by organisations. There are also complete section documents available in Word format for editing and PDF format for printing. These complete section documents can also be found in section homepages along with, where applicable, zip files containing all the section Excel tools. A full PDF version of the toolkit can be found on the toolkit contents page, Risk management toolkit.
Section 1 Introduction
Section introductions
The following a brief introductions to the various sections of the toolkit: Section 2 Risk definition & language: Having a set risk definition and language in an organisation is an important step in providing a consistent framework for the organisation of risk management activity; Section 3 Risk appetite: Articulating the amount of risk taking that is acceptable to the organisation and helping staff to understand the relative significance of the risks faced by the organisation allows for more efficient and effective risk management; Section 4 Risk governance, roles & responsibilities: Effective risk management requires the appropriate definition and assignment of roles, responsibilities, accountabilities and authorities to support managed risk taking. Risk governance is an integral aspect of corporate governance. Section 5 Risk policy: A risk policy sets out the approach to be adopted for the management of risk for a given risk group, which will typically include risk strategy and objectives, articulation of risk definition and language, appetite and the governance structure; Section 6 Risk & control self assessment: A critical part of the risk management process is the regular identification and assessment of the key risks to the business objectives and the key controls which are in place to mitigate those risks. The results are recorded in a risk register, which acts as a central repository of the nature and status of the key business risks and controls; Section 7 Key risk indicators: Using indicators to highlight the level of and potential change in the risk profile of an organisation can help to enable timely action to be taken in respect of risk; Section 8 Internal loss event data: The tracking of actual loss, potential loss and near-miss events can contribute to the assessment and monitoring of risk, enable timely action on issues arising and be a key component of robust risk management; Section 9 External loss data: Drawing on the loss experience of other organisations can give an indication of the size, frequency and sources of losses which could be experienced by organisations, providing a wider frame of reference when assessing potential risk exposures; Section 10 Management information: Every organisation identifies and captures a wide range of information relating to events and activities, both internal and external, which is relevant to managing the organisation. Providing the right information to the right people at the right time enables better, more informed risk taking, as well as more effective monitoring of key risks within the business; Section 11 Stress & scenario tests: Stress tests & scenario analyses help give a better understanding of the significant risks that an organisation potentially faces under extreme conditions and provide input into the determination of capital requirements. Stress tests and scenario analyses are therefore integral elements of an organisations risk management framework; Section 12 Risk culture: Effective risk management requires a risk aware culture, where staff are encouraged and supported, throughout the organisation, to fulfil their risk management responsibilities in an open and honest manner.
Tools
Tool 2.1 Operational risk definition & categorisation Tool 2.2 Operational risk boundary examples Tool 2.3 Franchisor operational risk categorisation Tool 2.4 Basel II framework operational risk categorisation Tool 2.5 Common risk language & glossary
Notwithstanding the wide range in size and sophistication of organisations, it is anticipated that risk definition and language underpins all risk management activity, for all organisations.
1 In its International Convergence of Capital Measurement and Capital Standards (ICCMCS) framework 2 Per the Basel Committee, legal risk includes, but is not limited to, exposure to fines, penalties or punitive damages resulting from FSA actions, as well as private settlements 3 Senior Management Arrangements, Systems and Controls: Operational risk
When an internal issue is at the root of a risk, the focus should be on how to address the issue. This generally involves modifying a business process or enhancing controls to reduce the potential likelihood and impact of a risk event. For example, if miscommunication of critical information caused exposure to a risk, consideration should be given to improving the frequency and quality of communications. When an external event is at the root of exposure to risk, focus should be on how leading indicators of the external event are monitored. For example, while it may be difficult to prevent lightning from striking the Lloyds building, weather can be monitored for early warning signs of lightning and lightning conductors installed.
Example of boundary issues In order to understand the operational risk arising from the controls and processes around insurance risk, agents should first consider the processes in relation to insurance risk. They should then identify the key controls specifically designed to mitigate insurance risk in each area. For example, an agent may address insurance risk with a number of key processes around areas such as underwriting, claims and reserving. The agent may place reliance on a number of key controls in these areas, for example: Underwriting signed and regularly reviewed underwriting authorities for all underwriting personnel; underwriting peer review / regular review of risks written; war business policy and procedures; Claims signed claims authorities and exception reporting; procedures setting out the approach to claims management including service standards, complaints handling and the use of third party experts; procedures for the regular review of dormant or non moving claims; and Reserving periodic actuarial reserve estimation and reporting.
Example of boundary issues In order to understand the operational risk arising from credit risk, agents should first consider the key processes in relation to each counterparty. They should then identify the key controls specifically designed to mitigate credit risk in each area. For example, an agent may address third party credit risk with a number of processes around key areas such as reinsurance strategy, reinsurance purchase, reinsurance recoveries, coverholder / broker approval and outstanding third party balances. The agent may place reliance on a number of key controls in these areas, for example: Credit controls an established credit risk committee, with clear terms of reference, which reviews and updates the credit ratings of reinsurers, brokers and coverholders on a regular basis; controls to ensure that only approved reinsurers are used; controls to ensure that only approved brokers are used; policies regarding the maximum exposure to any one reinsurer, either actual or prospective; controls to monitor exposures and to check that they are within the pre-agreed limits; regular aged debt reporting; controls and procedures in respect of dealing with reinsurer queries; internal audit reviews of controls over third party credit risk; a plan for managing cashflows / liquidity following a major catastrophe; and ongoing management of the relationships with key counterparties.
Example of boundary issues In order to understand the operational risk arising from market risk, agents should consider the processes in place in relation to the components of market risk and the key controls specifically designed to mitigate market risk. For example, an agent will address market risk with a number of processes around areas such as investment strategy, relationships with investment managers, and investment management reporting and monitoring. The agent will place reliance on a number of key controls in these areas, for example: Investment controls formal investment management / custodian mandates and agreements, including details of reporting to be provided and performance benchmarks; annual review of benchmarks and revision in light of changes to business strategy; regular reporting on investment portfolio, including value of the portfolio by investment asset class, sales and purchases made in the period and cash movements; monitoring of the portfolio against the limits established in the investment mandate; regular reconciliation of investment holdings; regular monitoring of the credit worthiness of counterparties and issues; and periodic reviews of controls operated by counterparties.
Example of boundary issues In order to understand the operational risk arising from liquidity risk, agents should consider the processes in place in relation to liquidity risk (the potential gap between cash in flows and cash out flows) and the key controls specifically designed to mitigate liquidity risk. For example, an agent may address liquidity risk with a number of processes around key areas such as cashflow forecasting, credit control and cash calls. The agent may place reliance on a number of key controls in these areas, for example: Finance controls regular formal cashflow forecasting, showing the cash position by month and currency and reflecting the likely effect of an RDS / catastrophe events; monitoring actual levels of liquid assets against a benchmark; the maintenance of sufficient (liquid) assets to meet expected / reasonable changes in regulators financial requirements, or contingency plans to raise sufficient funds; having formal agreements in place for borrowing facilities / funding arrangements; credit control policies and procedures to target outstanding premiums and reinsurance recoveries for collection; and personnel with sufficient skills and knowledge of the cash call process.
Operational risk sub-category Failure by Franchisor to perform key processing functions to required service levels
Description Financial loss, inefficiency, brand damage / reputational loss due to failure by Franchisor to provide key processing functions at the required service levels
Risk components failure in CIL process failure in members' distribution process failure of FPD business planning process failure to adapt processes to changing requirements / environment failure to modernise key processes ineffective market reporting process mismanagement of auction process unsatisfactory management of Trust Funds accounting & settlement project requires change by STFO and hence generates risk
Description
Risk components
Financial loss or damage to brand due to absence or poor management of data ineffective management of information breach of confidentiality of information such as leakage of by the Franchisor commercially / price sensitive information breach of data protection laws data corruption or loss of data inability to perform regulatory / statutory reporting inability to proactively manage Franchise performance inaccurate, untimely or poor quality management information hindering effective decision making / reporting loss of intellectual property multiple data sources / lack of definitive data source for key data reliance on paper documentation reliance on third parties for base data Critical failure or loss of key elements of infrastructure, including systems, communications and physical infrastructure accidents or unintended damage including fire and water damage data failure, including those resulting from hacking of systems and virus attacks failure of critical utilities or other third party services malicious acts or terrorism specific to Lloyd's, both internal and external technical failure widespread acts (denial of access, e.g. transport failure, chemical, biological, nuclear, radiological attack on London, cordon)
Operational risk sub-category Failure of key service providers to deliver service levels to Franchisor
Description Failure of key service providers to deliver service levels to the Franchisor resulting in financial loss or the trading position of the Franchise being adversely affected (Note: excludes Xchanging see risk 34)
Risk components business failure of service provider conflicts of interest within service provider service provider has inadequate governance or resources service providers fail to deliver cost effectiveness service providers have poor systems, procedures and back office processing service providers lack clarity of objectives failure to appropriately manage ongoing litigation failure to comply with FSA requirements (whistle blowing etc.) failure to effectively govern the decision making and governance processes failure to understand risk associated with the decisions made inappropriate or unclear delegations of authorities or approval process inappropriate organisational structure (duplication, or omission of decisions) ineffective business planning and objective setting ineffective management information lack of accountability reporting lines unclear
Operational risk sub-category Failure to define / implement Franchisor culture and competence
Description Failure to establish appropriate culture and competence for the Franchisor
Risk components inconsistent information results in missed opportunities / misalignment of effort HR policies and practice not carried out in accordance with legislation throughout the business failure to develop people to meet individual and business objectives failure to demonstrate core capabilities (management of information, projects, risk, people and relationships) failure to demonstrate core values (flexible, commercial, accountable, excellence, clarity, collaboration) failure to meet FSA training and competence commitments failure to remove poor performers failure to retain the key people / failure to plan succession of key people inability to attract the right people inappropriate allocation of responsibilities inappropriate reward structure (not aligned to objectives of the Franchise) over reliance on key people poor perception of Franchisor culture and competence by franchisees resulting in strained working relationship
Description Failure by Franchisor to communicate effectively to all external stakeholders (including franchisees, market associations, investment analysts, rating agencies, brokers, capital providers, key suppliers, customers, media, regulators, government)
Risk components breakdown in relationship with key stakeholders duplication or misalignment of effort failure to attract or retain capital as a result of inaccurate, incomplete or untimely communication key messages not being delivered appropriately misleading or conflicting messages mismarketing poor media relations culture not regularly reviewed employment not carried out in accordance with legislation failure to appropriately develop the people failure to demonstrate core capabilities (management of information, projects, risk, people and relationships) failure to live appropriate values failure to meet FSA training and competence commitments failure to remove poor performers failure to retain the key people inability to attract the best people inappropriate allocation of responsibilities inappropriate reward structure (not aligned to objectives of the organisation) over reliance on key people
Description Failure of franchisees, Franchisor, brokers or third parties to deliver core insurance business service levels resulting in financial loss or the trading position of the Franchise being adversely affected
Risk components brand undermined by poor policyholder service business lost by Franchise due to poor reputation / process franchisee unable to settle valid claims or reject invalid claims failure of central accounting system failure of central processing failure of Franchisor to deliver regulatory reports inability to force brokers, franchisees or third parties to improve or deliver quality standards lack of viable alternative service provider poor change management fails to identify and/or deliver key improvements signed Premium data not provided to franchisees franchisees unable to deliver policies or collect premiums liquidity issues for franchisees resulting from failure of central accounting system
Failure to execute current strategy through the business planning process, leading to lack of confidence
failure of franchisees and Franchisor departments to align plans with Franchise failure to effectively communicate current strategy failure to execute business plan failure to monitor delivery of business plan objectives failure to translate strategy into an operational business plan
Unauthorised activity
fraud / credit fraud / worthless deposits theft / extortion / embezzlement / robbery misappropriation of assets, malicious destruction of assets, forgery, check kiting, smuggling, account take-over / impersonation / etc. tax non-compliance / evasion (wilful), bribes / kickbacks, Insider trading (not on firm's account) theft / robbery forgery check kiting hacking damage theft of information (w/ monetary loss)
External fraud
Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party
Systems security
Event type category Definition (level 1) Employment practices and workplace safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events
Categories (level 2)
Activity examples (level 3) compensation, benefit, termination issues organised labour activity
Employee relations
Safe environment
general liability (slip and fall, etc.) employee health and safety rules events workers compensation all discrimination types fiduciary breaches / guideline violations suitability / disclosure issues (KYC, etc.) retail consumer disclosure violations breach of privacy aggressive sales account churning misuse of confidential information lender liability antitrust improper trade / market practices market manipulation insider trading (on firms account) unlicensed activity money laundering
Diversity and discrimination Clients, products and business practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product Suitability, disclosure and fiduciary
Product flaws
Activity examples (level 3) failure to investigate client per guidelines exceeding client exposure limits disputes over performance of advisory activities natural disaster losses human losses from external sources (terrorism, vandalism) hardware software telecommunications utility outage / disruptions miscommunication data entry, maintenance or loading error missed deadline or responsibility accounting error / entity attribution error model / system misoperation other task misperformance delivery failure collateral management failure reference data maintenance
Damage to physical assets Business disruption and system failures Execution, delivery and process management
Losses arising from loss or damage to physical assets from natural disaster or other events Losses arising from disruption of business or system failures
Loss from failed transaction processing or process management, from relations with trade counterparties and vendors
failed mandatory reporting obligation inaccurate external report (loss incurred) client permissions / disclaimers missing legal documents missing / incomplete
Categories (level 2) Customer / client account management Trade counterparties Vendors and suppliers
Activity examples (level 3) unapproved access given to accounts incorrect client records (loss incurred) negligent loss or damage of client assets non-client counterparty misperformance misc. non-client counterparty disputes outsourcing vendor disputes
Cause The business condition that allowed a risk to occur. Causes generally fall into two categories: internal problems or external matters. Control A preventative and/or detective activity, intended to manage the inherent risks identified within a business. This will normally relate to management of the potential impact and/or likelihood of risk exposure but may also involve risk transfer, mitigation or elimination. Control activities Policies and procedures that ensure management directives are executed; they ensure necessary actions are taken to address risks to the achievement of corporate objectives. Control environment The operating environment that comprises the integrity and competence of colleagues, management's philosophy and operating style and the way management communicates and delegates responsibility, and develops its people.
Control objective The primary goals of an internal control system. As defined by the Basel Committee on Banking Supervision, an internal control system can be expected to provide reasonable assurance of achieving the following four control objectives: safeguarding of assets; economy / effectiveness of process; compliance with laws and regulations; and integrity / reliability of data.
Control rating A score achieved through the risk and control self-assessment (RCSA) process that provides an indication of how the current control effectiveness is perceived. Correlation A random event can have a different probability of occurring if a second random event has occurred. In this case, the events are dependent. If the probability is not affected by whether the other event takes place, the events are independent. Correlation is a simple measure of dependence. Other more complex measures exist. Credit risk The risk of loss if another party fails to perform its obligations or fails to perform them in a timely fashion. For syndicates the key counterparties are reinsurers, brokers, insureds, reinsureds, coverholders and investment counterparties. Diversification Because losses are not completely dependent, generally less capital is needed at a given confidence level for a pooled portfolio than for the separate components of the portfolio considered alone. The degree to which this happens is called diversification. Diversification depends heavily on the correlation of the parts of the portfolio and also on the way risk is measured. Economic capital Represents the level of capital required to protect against unexpected losses, such that the markets underwriting liabilities can be met and our credit rating maintained. Enterprise risk management A structured and disciplined risk management approach considering strategy, process, people, technology and knowledge with the purpose of continually evaluating and managing risks to business strategies and objectives on an enterprise-wide basis. Enterprise risk management is a continuous activity that aggregates and integrates risk management activities across all types of risk in order to achieve maximum riskadjusted returns. Escalation triggers A process whereby immediate reporting is instigated upon a particular indicator or variable moving outside an agreed range. Group risk The potential impact of risk events, of any nature, arising in or from membership of a corporate group. Individual Capital Assessment (ICA) Capital assessment performed by a managing agent under PRU 1.2.26R, LLD 18.2.1R, PRU 2.3 and LLD 19.4.1R(1) in respect of each syndicate managed by it. Impact The effect that the risk would have on the organisations ability to successfully achieve its objectives if the risk occurred.
In-Control The term used to describe a business area that understands its risk profile, has assessed the risks and, where it has been concluded that risks are under control, knows what the controls are and that they are working. Where risks have been assessed as not being under control, the business area knows the factors contributing to this and has plans to manage, mitigate or eliminate the contributing factors. Inherent risk The risk in a business or process before the effect of any risk mitigation, control or transfer activities. Insurance risk The risk of loss arising from the inherent uncertainties as to the occurrence, amount and timing of insurance liabilities. Internal control The system of control, financial or otherwise, established by the management of an agent in order to: carry on the business of the agent in an orderly and efficient manner; ensure adherence to management policies; safeguard the assets of the agent and other assets for which the agent is responsible; and secure as far as possible the completeness and accuracy of the agents records.
Internal loss database A database which records: Potential losses An incident that has been discovered, that may or may not ultimately result in a financial loss; Near misses An incident that was discovered through means other than standard operating practices and through good fortune or focused management action has resulted in nil or positive financial impact; and Actual losses An incident that has resulted in a negative financial impact.
KCI (Key control indicator) A measure of the performance of a specific control. Deterioration in KCIs can show an increase in residual risk. KCIs tend to be relevant to a particular control activity. KRI (Key risk indicator) A key risk indicator is a measure of the status of an identified risk within a business, by measuring defined risk events. Likelihood The probability that exposure to a risk will occur. Liquidity risk The risk that sufficient financial resources are not maintained to meet liabilities as they fall due. Market risk The risk that arises from fluctuations in values of, or income from, assets or interest or exchange rates. Material In general terms, a material issue is one involving actual or potential significant financial loss or reputational damage, which has been or needs to be escalated to the Board of Directors or Board Committee level. Mitigation To moderate or decrease the likelihood or potential impact of exposure to a risk. Modelling Creation, parameterisation and interpretation of a representation of the syndicates business. Usually includes probability assumptions and simulation (stochastic model).
Operational risk The risk of loss resulting from inadequate or failed internal processes, people or systems, or from external events. Procedure A formal system or process set out to achieve policy or operational aims. Process map The major steps in any process, usually portrayed as a flow chart, and depicting the inputs and outputs for each step in the process. Key controls may be depicted as process steps. Suppliers and customers of each process may also be identified. Quantification of risk The determination of the scale of risk by the allocation of a metric, such as sterling cost, or impact on share price, relative to the frequency of occurrence. Most often, risk is quantified by reference to its potential impact on an organisation e.g. loss of earnings, damage to profit, volatility of results and the likelihood of its occurrence. Quantification can be derived from a combination of methodologies that can be qualitative in nature particularly used in areas where the scarcity of needed data makes risk more difficult to measure, such as operational risk or quantitative used where precise measurement and statistical analysis is possible. Regulatory risk The risk of loss arising from the organisations dealings with both UK and overseas regulators. Residual risk The potential impact and likelihood of an identified risk exposure, considering the effect of the existing (but excluding planned) controls. Risk The potential for loss or failure to meet business objectives as a consequence of internal or external events. Risk appetite The expression of the level of acceptable and/or unacceptable risk as defined by the Board of Directors and senior management. Risk appetite reflects Lloyds willingness to take on risk as derived from its capacity to bear risk and the philosophy or attitude toward risk taking. Risk capacity (or tolerance) The amount of risk, in aggregate, that an organisation is able to bear. Risk bearing capacity generally includes available capital, ability to raise capital and the capacity and strength of operational processes and related governance. Risk category (or risk group / risk sub-group) Risks identified can be grouped in order to facilitate monitoring and reporting e.g. Insurance, Credit, Operational. Risk components Examples of causes, effects and examples of the risk issue and instances when it may have occurred in the past. This may include process failures or inadequacies that may, in combination, result in the risk event occurring. The list of components under any one risk would normally be illustrative rather than exhaustive. Risk description (or definition) A detailed articulation of a risk, designed to give clearer understanding of the risk. Risk effect The consequence that the risk has to the company. The effect can be measured on a qualitative (high, low) or quantitative manner (dollar amount, number of transactions impacted). Risk event A high level articulation of risk and potential or actual exposure often used in risk registers / portfolios.
Risk framework The overarching, unifying approach and process for the management of risk within an organisation, which is often expressed diagrammatically. The framework includes all the key building blocks for risk management which typically include a common language for risk, the organisations risk policy and appetite, identification and assessment of risk, monitoring and assurance of risk and of the risk management process and reporting. Risk map The visual representation of risk (which has been identified through a risk assessment exercise) in a way that allows priority ranking. This representation often takes the form of a two-dimensional grid with frequency (or likelihood of occurrence) on one axis, and severity (or degree of impact) on the other axis; the risks that fall in the high-frequency / highseverity quadrant are given priority risk management attention. Risk policy Documented approach and rules to be followed in relation to a particular area or issue that has been agreed by the Board or a properly delegated committee. Risk register A schedule or table capturing the list of significant risks facing the organisation. Self-Assessment A process whereby each business / functional area proactively identifies the significant risks it is potentially exposed to, estimates the potential impact and likelihood, assesses the quality of control, and determines a mitigation plan for identified risks that are high and controls that need improving. Stress and scenario tests Stress and scenario tests are carried out to determine the expected financial and non financial consequences of adverse circumstances and events arising within the relevant time horizon. Stress tests are generally defined with reference to movements in key financial parameters (such as interest rates, asset values or liability values), whereas scenario tests may make reference to the cause of the adverse developments (such as a material natural catastrophe or major industrial incident). Threshold Represents a level of exposure that can be exceeded, but which, when exceeded, will trigger some form of timely response. Unexpected loss Loss that is not budgeted for (expected) and is absorbed or buffered by an attributed amount of economic capital.
Section Break
Risk Appetite
Section 3
Tools
Tool 3.1 Key questions to consider when setting risk appetite Tool 3.2 Example appetite articulation via qualitative statements Tool 3.3 Example appetite articulation via quantitative statements Tool 3.4 Example appetite articulation via key risk indicators Tool 3.5 Examples of high level articulation of risk appetite Tool 3.6 Examples of low level articulation of risk appetite
3 Risk appetite
What is risk appetite?
Risk appetite reflects the amount of risk taking that is acceptable to an organisation. As a result, risk appetite refers to the organisations attitude towards risk taking and whether it is willing and able to tolerate either a high or a low level of exposure to specific risks or risk groups. As the diagram below illustrates, risk appetite, first and foremost, is a function of the organisations capacity to bear risk and of its attitude towards managed risk taking. Risk appetite can also be viewed as assigned or allocated risk capacity.
Risk capacity
(need to consider what capital is available, ability to raise capital, strength of operational processes and strength of operating culture)
Risk appetite
Qualitative statements
Why is it important?
Among other things, risk appetite plays an important part in supporting risk assessment, monitoring and control activities. It does this by helping staff to understand the relative significance of the risks faced by the organisation and thereby better prioritises risk monitoring and control activities. Risk appetite plays a key role in maximising return on capital invested as it acts as a driver for allocation of capital to identified risks. The better the understanding of risk appetite, the more efficient the allocation of capital across the organisation. Risk appetite should be a function of the capacity to bear risk and should not exceed it. Constraints on risk appetite include the capital which needs to be maintained to support a target rating agencys rating and regulatory capital requirements. It is important to note that businesses trading at Lloyds are subject to a number of guidelines in respect of risk appetite, through the operation of the Franchise guidelines.
Section 3 Risk appetite a limit reflects the absolute maximum level of exposure that is acceptable for a particular risk (i.e. it represents a level of exposure that should not normally be exceeded); in contrast a threshold represents a level of exposure which, with appropriate approvals, can be exceeded, but which, when exceeded, will trigger some form of response (e.g. additional capital or expenditure on risk control, reporting the situation to senior management, etc.);
secondly, as a resource allocation tool, risk appetite helps determine the degree of control that needs to be applied to a particular risk. For example: if current exposure to a particular risk is considered to be acceptable there is usually little value, other than for efficiency reasons, in changing the extent of control (either in terms of using tighter controls or by increasing capital or the amount invested in risk control); in contrast, where current exposure to a particular risk is considered unacceptable, an agent may decide that it needs to invest more capital and introduce more rigorous controls.
There are a number of additional benefits of articulating risk appetite: risk appetite is an essential element of risk governance and provides a framework for the business to operate within, as it provides clear boundaries regarding what is and is not acceptable to the organisation; articulating risk appetite leaves room for creativity within acceptable limits and reduces the possibility of exposure to unpleasant incidents due to a lack of awareness; provides a framework for considering and approving risk taking levels and activities that are outside the current appetite for risk; and assists in the identification and prioritisation of areas where additional resources or controls may be necessary to bring the risk into line with the stated risk appetite.
Enabling technology underwriting system implementation of limits, thresholds, KRIs and/or other expressions of appetite
Time Board extending the business planning process to articulate clearly the risk appetite business unit managers cascade and interpret board appetite for each business unit and functional area, e.g. via workshops, as part of business plan roll out overall implementation time an integral part of business planning cycle and performance monitoring process
Direct / indirect costs Board and senior management time integral part of business planning and performance monitoring process IT staff time for programming limits, thresholds etc. risk management time proposals for risk appetite, facilitation of appetite setting, documentation, review and monitoring internal audit / external consultants review, technical support, assistance and assurance over appetite setting and resetting
Notwithstanding the wide range in size and sophistication of organisations, it is anticipated that setting risk appetite should be an integral part of the business planning process, including roll out and monitoring against plans, for all organisations.
acceptable costs of: risk control and risk financing (of retained losses); and risk management administration.
Is the expression of appetite clear in respect of what risks you are willing to accept and what risks are you unwilling to accept? Has risk appetite been communicated in a way that is readily understood by managers and staff? How are you measuring performance against stated risk appetite? Does the measurement and reporting of risk relate to stated risk appetite? What can be improved about the current risk appetite setting process and the way in which performance is measured? What limits or thresholds are most relevant for each risk and control? e.g. reserving e.g. staff turnover e.g. reporting / escalation at what point?
Limits
Limits may be set by the Board for operational risk outcomes: example aggregate limit total annual operational risk losses, arising from both expected and unexpected events, is not to exceed [TBD]m; example single event limit no single unexpected operational risk loss in a single year should exceed [TBD]m.
Thresholds
Thresholds may be set, above which specific requirements are identified for the management, escalation and approval of the risk and/or incident. For example, thresholds could be set according to what level is deemed acceptable, tolerable and unacceptable, and a red, amber, green approach applied. The benefit of the traffic light approach is that it can be easily used to determine practical ranges of acceptability, tolerability and unacceptability. Exposures that are in the: green range are acceptable and probably do not need to change; amber range may be tolerated but need to be monitored closely to ensure that the level of exposure does not worsen; and red range are unacceptable, and will require an immediate response to ensure that they are reduced or eliminated. This is illustrated in the diagram below: Acceptable Tolerable Unacceptable
Worked examples
Examples of expressing risk appetite numerically include: yearly (or quarterly) loss amounts (for example, the total levels of internal fraud losses) that are acceptable, tolerable and unacceptable in the specified period; the number of operational risk events that are acceptable, tolerable and unacceptable in a given year (or quarter); the size of any one single operational loss that is acceptable, tolerable and unacceptable; the size of any one single operational loss that is tolerable or which would be unacceptable in a given time period (say over a 10, 20 or 50 year period, etc.); the degree to which operational loss levels or the number of operational risk events can increase in a given year (for example, an increase of 5% in external fraud losses might be acceptable, 10% tolerable and 15% unacceptable); and the level of an individual key risk indicator that is acceptable, tolerable and unacceptable in a given year.
method of deriving may be subjective; some facilitates monitoring areas may find it difficult to define and relate thresholds can potentially factor in to thresholds reputational impacts e.g. regulatory, customer etc permits assessment of relative significance of breaches permits aggregation and comparison flexible. As the organisation matures and / or the risk profile changes thresholds can be adjusted to provide the right level of Board oversight Examples of where numerical expression may be difficult to derive include: media and reputation effects; regulatory interest and the potential for intervention; the effect that an operational risk event could have on the organisations customers; the effect that an operational event could have on staff (in terms of morale, turnover etc.); and opportunity costs in terms of diverted management resources to deal with loss events.
These are discussed in more detail in the KRI section (7) of the toolkit.
Worked example
A key risk indicator for monitoring the development of resourcing risks in respect of staff levels is staff turnover levels: below 24% No risk. The risk is not materialising and we are comfortable with the level of staff turnover. No escalation or treatment required; above 24% Potential risk. The risk is a concern and HR would be expected to monitor actively, establish causes and actions. Escalation required to raise awareness but explanatory report not required; and above 28% Risk. Action and escalation with explanatory report required.
Processes
ABC has a low operational risk appetite for process failure zero tolerance of business outside plan and RI programme zero tolerance for high priority internal audit / regulator issues no single operational risk loss to exceed 50,000 / year annual aggregate operational risk losses not to exceed 100,000 / year ABC is Turnbull compliant no more than 2 IT system outages / month for more than 1 hour no more than 1 IT virus caused outage / month for more than 1 hour zero tolerance of IT & data security breaches effective and tested DRP to be in place tolerate up to 20% gross RDS exposure against capacity tolerate up to 5% final net RDS exposure against capacity very low appetite for business outages effective and tested BCP arrangements in place responding to outages 30 minutes to 3 months in duration
Systems
External events
Reputational
very low appetite for reputational risk ABC takes immediate action to resolve policyholder complaints UK and overseas regulator concerns high priority internal and external audit concerns ABC actively contributes to the community ABC seeks contract certainty prior to written risks incepting zero appetite for legal action against the organisation ABC complies with all relevant legislation ABC actively monitors its business strategy against: insurance cycle and class rating changes political, regulatory and economic environment changes ABC actively manages change
Legal
Strategic
recruitment screening for all potential recruits CPD and training development to be met less than 20% staff turnover less than 5% sickness rates per division less than 5% average use of contract staff 100% referral rates where appropriate succession plans in place for all staff zero fraud or theft tolerated full disclosure of conflicts of interest required less than 5% of complaints referred to Ombudsman
Cause Processes
Potential causes Basic underwriting processes inadequate risk capture not complete, accurate and timely (i.e. risk recording system / copy slips, declarations and endorsements / long term contracts / aggregates) slips not underwritten within authority (agent & Lloyds) / signatures & stamps controlled failed referral process / reporting lines and authority limits inappropriate underwriting guidelines not followed or inadequate underwriting objectives unclear or inappropriate (for class underwriters) Underwriting review lack of detailed, inexperienced or untimely peer review (including endorsements) ineffective underwriting meetings (updates on developments) inadequate supervision and performance review of class underwriters
100% slips recorded within 24 hours less than 2% slip entry error rate 100% endorsements recorded 100% aggregates (or proxy for max aggregate) recorded within 24 hours 100% of slips underwritten within authority 100% referral where appropriate 100% underwriting guidelines to be followed, subject to referral
100% of slips with more than 1m premium or more than 10m exposure to be peer reviewed within 10 days quarterly underwriting review of all accounts technical underwriting review if class loss ratios are more than 20% above expected
Cause
Potential causes Monitoring of underwriting performance against plan not reviewed (including premium income) exception reports inadequate, untimely or not reviewed outstanding premiums not reported or chased large claims not reviewed performance not reviewed (at contract level) aggregates not up to date and monitored outstanding facultative reinsurance recoveries not chased wording not finalised or issued
zero tolerance of business written outside approved plan and reinsurance programme zero tolerance of class premium income greater than 110% of business plan all premium and reinsurance debt more than 90 days outstanding to be chased all claims over 10m to be reviewed all non-moving claims to be reviewed every 6 months all contracts with loss ratio greater than 110% to be investigated, (subject to de-minims 1m premium) all exposures to be recorded within 1 month of underwriting less than 100 binders to be written, with minimum income 100k zero tolerance of outstanding wordings over 1 month 75% of major contracts to be independently reviewed within 1 month of underwriting internal audit to review all key businesses processes over a rolling 2 year period compliance review to cover all key business areas annually key business issues to be considered by the Board or sub delegated to an approved sub committee
Agency level underwriting controls independent review covered the class compliance monitoring covered the class (inc. internal audit / other reviews) Board reporting of major issues (via monitoring committee / active underwriter)
Placement of reinsurance programme all reinsurance order forms and cover insufficient scrutiny of reinsurers notes to be reviewed against quotes requirements errors on reinsurance order forms, 100% accuracy on reinsurance e.g. through lack of scrutiny orders and cover notes errors on cover notes undetected the Board monitors the progress of through lack of scrutiny (against placement order) partial or revised placements not communicated to management or underwriters
Cause
Potential causes Agency level reinsurance purchase controls lack of clear guidelines / authorities for individuals purchasing reinsurance lack of guidelines on acceptable security (including exotic / financial reinsurance) and maximum exposures to reinsurers lack of monitoring of exposures, amounts due, disputes and delinquency of reinsurers lack of reinsurance erosion reporting to management Claims processes Board / management uninformed of significant claims / disputes / complaints lack of referral where underwriters are solely responsible for adjusting claims which they underwrite themselves lack of regular reconciliation between Xchanging and the reserves held by the syndicate lack of monitoring the progression of claims advice or reserves administrative delays in processing claims payments and reporting to reinsurers delayed / omitted collection note issue / reinsurance recoveries lack of chasing outstanding debts / review of doubtful debt provisions unresolved dispute with actuaries or accountants Liquidity processes lack of regular cash flow forecasts produced, e.g. monthly, by currency, by year of account lack of consideration of cash needs for RDS scenarios and other major losses lack of contingency planning for potential or expected cash shortfalls lack of regular cash flow reporting to the Board / senior management
set authorities for staff reinsurance purchase set limits on our exposures to reinsurers (e.g. less than 10% premium to be placed with 1 reinsurer) maintain up to date security ratings for reinsurers monitor all material exposures / recoveries from reinsurers / erosion of reinsurance
100% material claims / disputes / complaints reported to senior management / Board second adjustor review for material claims greater than 10m monthly reconciliation of claims reserves all claims advice reviewed within 2 days pay claims promptly, on presentation of appropriate evidence of claim all collection notes issued within 30 days all outstanding debts chased after 90 days zero appetite for ongoing dispute with syndicate actuaries or accountants
undertake monthly cash flow forecasting for all material currencies forecast potential and expected cash needs for RDS scenarios and other material losses established contingency plans for all potential or expected cash shortfalls quarterly reporting of cash flow forecast and shortfalls to the Board
Cause
Potential causes Generic process failures manual errors inadequate segregation of duties inaccurate / incomplete management information inadequate functionality / supporting software inadequate / inappropriate polices process failure affecting insureds / intermediaries
less than 2% manual input errors no underwriting staff to have access to accounting system MI and exception reporting to be produced and reviewed within 2 days of month end IT system queries to be responded to within 24 hours established policies in place for all key processes complaints resolved within 1 month of receipt zero tolerance for adverse press comment zero tolerance of outstanding external and internal audit / compliance / regulatory report points no more than 1 IT system outage per month zero tolerance of IT security breaches no more than 1 IT virus caused outage per month zero tolerance for IT supplier failure no more than 1 day a year tolerance for server failure 100% testing of IT disaster recovery procedures and systems
Systems
IT outage hardware or software failure network / telecommunications failure third party IT provider failure inadequate virus protection inadequate system security / information risk management insufficient processing capacity other system error insufficient / untested business continuity processes inadequate update / release management Natural or man made disaster local terrorist attack / other external event power outage
External events
less than 24 hours IT system outage following a disaster event less than 24 hours non availability of office facilities following a disaster event no failure tolerated from outsource providers zero appetite for fraud zero appetite for IT system security breaches
Supplier failure third party provider failure External theft or fraud fraud external breach of system security
Cause Reputational
zero tolerance of regulator action / concerns zero tolerance of outstanding Lloyds operational risk review points raised 99% of slips to be LMP compliant first time all wordings to be agreed prior to inception no tolerance of business outside plan or reinsurance programme, without prior authorisation
Legal
Strategic
Changes from business plan business written outside plan or reinsurance programme
Section Break
tools
Tool 4.1 Example risk governance framework Tool 4.2 The three lines of defence model Tool 4.3 Example roles and responsibilities Tool 4.4 Example roles of a Chief Risk Officer Tool 4.5 Example risk governance principles
In summary, risk governance is the system for directing and controlling the management of risk within the organisation.
Why is it important?
Having clear roles and responsibilities for all relevant parties: clarifies which parties are responsible for accepting and managing risk and setting the parameters for managed risk taking; clarifies how the organisation will balance business opportunities against the cost, risk and upside potential of risk taking; and provides a basis for objective risk adjusted performance measurement and management.
Notwithstanding the wide range in size and sophistication of organisations, it is anticipated that risk governance underpins all risk management activity, for all organisations. The example roles for a Chief Risk Officer and example risk governance principles however, are more likely to be of interest to larger organisations.
Oversight
Board
Escalation
Executive Committee
Co-ordination
Ownership
Business Departments
Business Departments
Assurance
Internal Audit
Internal Audit
In this illustrative model, each party has the following roles: The Board, on the top of the pyramid, has the ultimate accountability for the risk and related control environment, and is responsible for approving and reviewing risk policies; The Executive Committee is responsible for reviewing and challenging risk information and escalating issues to the Board; The Risk Management Division is responsible for the facilitation and co-ordination of risk management activity across the organisation; Business Departments are the risk-takers and are responsible for identifying, assessing, measuring, monitoring and reporting risk associated with their businesses or functions; and Internal Audit is responsible for independently assessing the effectiveness of risk management processes and practices and for providing timely objective assurance on the control of risk.
NB: It is possible to view risk management as providing pro-active control over risk and internal audit as providing more reactive control over risk.
Independent assurance
Audit committee
Business units
External audit
The three lines of defence framework operates as follows: staff in the first line of defence have direct responsibility for the management and control of risk (i.e. staff and management working within or managing operational business units and the Board); staff in the second line of defence co-ordinate, facilitate and oversee the effectiveness and integrity of the risk management framework (i.e. the risk committee and risk management division); and staff in the third line of defence provide independent assurance and challenge across all business functions in respect of the integrity and effectiveness of the risk management framework (i.e. internal and external audit).
Risk committee
The risk committee is a sub-committee of the board and oversees the development, implementation and maintenance of risk management across the business as follows: proposes the approach to risk management proposes risk policies proposes risk appetite monitors compliance with risk policies monitors the adequacy of controls monitors the overall risk profile against appetite escalates issues reports to Board oversight and challenge of risk management does not make decisions (may do so where delegated authority)
Responsibilities The Chief Risk Officer leads the development and implementation of risk management across the business (more detailed terms of reference attached): develops risk management strategy, principles, framework and policy implements appropriate risk management processes and methodologies advises and coaches management and business units on risk management monitors the application and effectiveness of risk management processes coordinates appropriate and timely delivery of risk management information The risk management function leads the development and implementation of risk management across the business. The risk management function: drafts risk policies and risk management standards develops and implements the risk framework develops and distributes tools, techniques, methodologies, common risk language, risk framework, analysis, reporting, communication and training coordination, aggregation, facilitation and enabling function monitors the overall risk profile, including accumulations of risk, trends, and risks from internal and external market changes escalates high priority issues to senior management and Board collates, challenges and reports on aggregate risk profile, control effectiveness and actions taken to risk committee and Board own risks and controls assess risks and the effectiveness of controls in line with documented risk policy design, operate and monitor a suitable system of control manage and review risks as part of day to day business activity
Business units
Audit committee
The audit committee is a sub-committee of the Board, which: monitors and reviews the activities of internal audit, ensuring that internal audit has the necessary resources and access to information to perform its role ensures that the financial activities of the business are subject to independent review and external audit, appointing the external auditor and monitoring the independence, objectivity, effectiveness and cost effectiveness of the audit reviews the half-year and annual financial statements and other formal announcements on financial performance and principal regulatory returns before submission to the Board
Responsibilities Provides assurance to the Board that risk is being managed and that controls are working effectively. Internal audit: monitors effectiveness of the risk management processes tests controls validates risk information and risk reporting identifies corrective actions liaises with the risk management department reports to the audit committee and Board Reports on risk and control process failings, including corporate governance weaknesses, if identified during the external audit
External audit
provides overall leadership, vision and direction for risk management throughout the business develops company risk management strategy and framework instils risk management principles and raises awareness of risk management develops risk management policy statements develops a commercial and cost effective business wide approach to risk management guides the risk committee and Board through the formulation of risk strategy, appetite, policies, delegated authorities and limit structures develops a culture of managed risk taking
leads development, selection, implementation, validation and maintenance of processes, procedures and systems for risk management develops, with Finance, processes for determining, allocating, monitoring and managing capital requirements and measuring risk adjusted performance manages the activities of the risk management function, ensuring adequacy of resource coordination of different risk management areas preparation of manuals / guidelines reviewing risk management standards / guidelines formation and support of risk management committee structures and processes design of self assessment procedures for business units setting up a committee to look at the wording of contracts developing corporate emergency procedures, developing health and safety standards and performance improvement programmes
Advice and coaching to management and business units on risk management
informed and objective challenge to executive line management on risk management techniques for risk identification change management addressing HR risks investment proposals contractual terms and conditions (warranties, indemnities, insurance aspects) disaster recovery insurance matters, reducing the cost of insurance institute training courses site surveys / inspections build awareness of continuity risks encourage preparation of continuity plans
Monitors the application and effectiveness of risk management processes approving risk financing strategies ensuring particular risks are being managed identifies examples of good practice identification of (under managed) risks ensuring escalation processes are working ensuring identified corrective action is followed through take account of internal audit findings over risk management systems and practice
bench-marking studies
provision of management information on risk management, including loss statistics identifies, escalates and oversees the resolution of risk management issues reports quarterly to the Board on the management of risk and aggregate risk profile produces in-house publications advises on sources of good practice and (outside) expertise maintains effective working relationships with internal and external stakeholders, including regulators
This table is based on Ward, S. (2001). Exploring the role of the corporate risk manager. Risk Management:
an international journal, 5(4), 7-23
Tool 4.5 Example risk governance principles Institutional investors investors should make considered use of their vote, be ready to enter into a dialogue with companies and should give due weight to all factors when evaluating a companys governance arrangements.
Companies listed on the London Stock Exchange have to report on how they apply the principles of the code and either confirm that they have complied throughout the financial year with the code provisions or, where they do not, provide an explanation.
deliver high levels of service to brokers and policyholders in accordance with set service standards, systems and protocols; prepare high quality business plans, in accordance with the relevant guidelines, with a view to achieving the Boards long term profitability targets; operate and underwrite in accordance with agreed business plans; accurately report syndicate performance in a timely manner and understand the factors which may have affected syndicate performance; notify senior management, in good time, of any matters which may have a material effect on the business, managed syndicates or on Lloyds as a whole; and protect the confidentiality of information, not to be disclosed, throughout the business.
Section Break
Risk policy
Section 5
Tools
Tool 5.1 Example risk policy template Tool 5.2 Example comprehensive risk policy Tool 5.3 Example corporate social responsibility policy
5 RISK POLICY
What is a risk policy?
A risk policy formally outlines an organisations risk management strategy and objectives for a given risk class and documents the roles, responsibilities, accountabilities and authorities that support the approach and processes adopted to achieve those objectives. It encompasses the following areas: a common risk language, including risk definitions and their categorisation; key principles to guide risk based decision-making; an articulation of risk appetite illustrating the level of acceptable risk taking (risk limits and thresholds which are derived from appetite, and which may change frequently, would normally be documented in a separate standard which relates to the policy); and the risk governance framework, including accountabilities, roles and responsibilities for oversight committees (at the management or Board levels), business units, divisions and departments which take risk, the risk policy and supporting functions (e.g. the risk management function) and internal audit (which provides timely, objective assurance about the management and control of risk).
Why is it important?
A risk policy is important as it: outlines the organisations approach to a specific risk class for the benefit of all stakeholders; and provides for clear, unambiguous accountability for the various participants in the overall management of risk.
Notwithstanding the wide range in size and sophistication of organisations, it is anticipated that risk policies underpin all risk management activity, for all organisations.
Please note that Lloyd's has developed its own corporate social responsibility policy, from which the above tool 5.3 has been derived. For further details, please contact Vicky Mirfin, Manager, Lloyd's Community Affairs.
Dispensations
what happens when the policy is not complied with (i.e. the process for dealing with and approving any exceptions to the policy) what criteria should be used for reporting any instances of non-compliance to the Board
Objectives
sets out the objectives of operational risk management explains how operational risk will be embedded within the organisational operating culture explains the management of potential and actual risk exposures and incidents in line with good practice principles
Risk appetite
the organisations expression of risk appetite based on its capacity to bear or take on risk explains the qualitative and quantitative statements, limits and thresholds, or key risk indicators used in the expression of risk appetite
Guiding principles
basic assumptions made and principles to be followed by the organisation with respect to operational risk management
Section 3: Execution
Operational risk management methodologies (note that all of the following are required for a robust operational risk management framework)
Economic capital
explains the link between operational risk management and the capital assessed to cushion against unexpected losses arising from operational risk
Disclosure
explains the basic standards to be adhered to with respect to operational risk management
ABC Managing Agent Ltd Operational Risk Policy Statement Version 1.0 June 2005
Document history
Created by Name A. N. Other Date 10/06/05 Department / role ORM / Manager Version 1.0
Distribution list
All ABC staff
Introduction
This policy statement outlines ABCs strategy and objectives for operational risk management and the approach and processes by which ABC achieves those objectives. The policy takes account of and is consistent with operational risk policy guidance issued by the FSA in the Integrated Prudential Sourcebook: Prudential Systems and Controls Operational Risk (PRU 6.1). This policy has been approved by the Board of Directors and is applicable to all business units and functional areas, including the underwriting, claims and reserving teams, finance, risk management, legal services, personnel, operations and compliance divisions of ABC. All managers and staff are expected to abide by the policies and rules set out in this policy statement.
Level 1 Processes
Level 2 inadequate processing control premiums / claims inadequate control over outsourced activities IT / finance failure of outsource provider inadequate segregation of duties inaccurate / incomplete management information inadequate supporting software inadequate / inappropriate polices inaccurate / incomplete trading data failure in corporate governance hardware failure software failure network / telecommunications failure third party IT provider failure inadequate virus protection inadequate system security / information management insufficient processing capacity insufficient / untested disaster recovery processes inadequate system upgrade management natural disaster / catastrophic loss man made disaster / catastrophic loss third party / supplier failure external theft or fraud external breach of system security terrorist attack / denial of access to building power outage breach of overseas licences by coverholder US or other overseas regulatory action identify theft / abuse of brand rating downgrade corruption, intimidation or coercion of staff failure to comply with UK legislation regulatory breach, fine, bad press insurance & reinsurance policy dispute dispute over service level agreements public and employers liability breach of fiduciary duty change in law / failure to interpret law correctly adverse insurance cycle developments technological developments in trading platform and distribution adverse political developments adverse developments in the wider economy failure to manage change failure to deliver business strategy
Systems
External events
Reputational
Legal
Strategic
Unauthorised deviation
All unauthorised deviations from the standards set out in this policy statement are reported to the risk committee, risk management function and the Board. Depending on the nature and severity of non-compliance, the issue may be considered to be a matter of disciplinary conduct.
Governance
ABC has adopted a three lines of defence governance framework, as illustrated and explained below:
1st line of defence management control 2nd line of defence methodologies 3rd line of defence Independent assurance
ABC Board
Risk committee
Audit committee
Business units
The three lines of defence framework operates as follows: staff in the first line of defence have direct responsibility for the management and control of operational risk (i.e. staff and management working within or managing operational business units and the Board); staff in the second line of defence co-ordinate, facilitate and oversee the effectiveness and integrity of ABCs operational risk management framework (i.e. the risk committee and risk management division); and staff in the third line of defence provide independent assurance and challenge across all business functions in respect of the integrity and effectiveness of the operational risk management framework (i.e. internal and external audit).
Roles and responsibilities for each of these functions and parties are described in detail below. Stakeholder The Board Roles and responsibilities sets business strategy sets risk appetite agrees risk policy, in alignment with strategy sets governance structure sets risk management framework makes business decisions delegates actions defines the methodology by which risk management is reviewed obtains assurance on risk management effectiveness & compliance with set risk policy reports to stakeholders on risk management approves public disclosures
Roles and responsibilities proposes the approach to risk management proposes risk policies proposes risk appetite monitors compliance with risk policies monitors the adequacy of controls monitors the overall risk profile against appetite escalates issues reports to Board of Directors oversight and challenge of risk management does not make decisions (unless delegated authority)
develops risk management strategy, principles, framework and policy implements appropriate risk management processes and methodologies advises and coaches management and business units on risk management monitors the application and effectiveness of risk management processes co-ordinates appropriate and timely delivery of risk management information drafts risk policies defines risk management standards develops and distributes tools, techniques, methodologies, common risk language, risk framework, analysis, reporting, communication and training coordination, aggregation, facilitation and enabling function reports on aggregate risk profile, control effectiveness and corrective actions taken own business risks and controls identify, assess and accept risks underwriting design, operate and monitor suitable internal controls manage and review risks follow policy for risk management operate the business within set risk appetite & tolerances
Business units
Audit committee
monitors and reviews the activities of internal audit, ensuring that internal audit has the necessary resources and access to information to perform its role ensures that the financial activities of the business are subject to independent review and external audit, appointing the external auditor and monitoring the independence, objectivity, effectiveness and cost effectiveness of the audit reviews the half-year and annual financial statements and other formal announcements on financial performance and principal regulatory returns before submission to the Board
Roles and responsibilities monitors effectiveness of risk management processes tests controls validates risk information and risk reporting identifies corrective actions liases with risk management department reports to the audit committee and Board
External audit
reports on risk and control process failings, including corporate governance weaknesses, if identified during the external audit
Objectives
ABCs objectives for operational risk management are as follows: all significant operational risks are identified, measured, assessed, prioritised, managed, monitored and treated in a consistent and effective manner across the organisation; appropriate and reliable risk management tools (including key risk indicators, loss databases, risk and control self assessments and stress and scenario testing) are deployed to support operational risk management, particularly management reporting, decision making and capital assessment; all directors, management and staff are accountable for managing operational risk in line with the roles and responsibilities set out in this policy; compliance with all relevant legislation, regulatory requirements, guidance and codes of practice; and key stakeholders receive timely, dependable assurance that the organisation is managing the significant operational risks to its business.
Guiding principles
ABC has adopted the following principles to guide decision making throughout the organisation: ABC conducts its business with integrity and observes high standards of market conduct; ABC conducts its business with due skill, care and diligence; ABC organises and controls its affairs responsibly and effectively with sound risk management systems and procedures. ABC treats its policyholders fairly and communicates with them in a way which is clear, fair and not misleading; ABC manages conflicts of interest fairly, both between itself and its policyholders and between policyholders; ABC manages operational risk in a cost effective manner, subject to compliance with applicable legislation and regulatory requirements and effective management of operational risk exposures; ABCs staff all play an active role in the management of operational risk; and ABC deals with its regulators and other supervisory bodies in an open and co-operative way, making full and open disclosure of operational risk events where appropriate.
Risk appetite
The Board articulates statements of operational risk appetite, namely the amount of risk that is acceptable and/or unacceptable to ABC: divisional heads and business unit managers interpret and cascade down more detailed expressions of appetite / limits for their division / business function; and underwriting divisions / business functions interpret, apply and operate within these more detailed statements of appetite, with guidance from the risk management function.
ABC articulates its risk appetite via a combination of qualitative statements; limits and thresholds above which specific requirements are identified for escalation and approval; and key risk indicators with identified tolerance levels and escalation points. The Boards high level statement of operational risk appetite is set out below.
ABC Board level articulation ABC employs sufficient, suitably skilled and experienced staff staff roles and responsibilities are clearly defined staff performance is reviewed and training needs met ABC is an equal opportunities employer ABC has zero appetite for fraudulent activity potential conflicts of interest are avoided and/or disclosed
ABC Board level articulation ABC has a low operational risk appetite for process failure zero tolerance of business outside plan and RI programme zero tolerance for high priority internal audit / regulator issues no single operational risk loss to exceed 50,000 / year annual aggregate operational risk losses not to exceed 100,000 / year ABC is Turnbull compliant no more than 2 IT system outages / month for more than 1 hour no more than 1 IT virus caused outage / month for more than 1 hour zero tolerance of IT & data security breaches effective and tested DRP to be in place tolerate up to 20% gross RDS exposure against capacity tolerate up to 5% final net RDS exposure against capacity very low appetite for business outages effective and tested BCP arrangements in place responding to outages 30 minutes to 3 months in duration
Systems
External events
Reputational
very low appetite for reputational risk ABC takes immediate action to resolve: policyholder complaints UK and overseas regulator concerns high priority internal and external audit concerns ABC actively contributes to the community ABC seeks contract certainty prior to written risks incepting zero appetite for legal action against the organisation ABC complies with all relevant legislation ABC actively monitors its business strategy against: insurance cycle and class rating changes political, regulatory and economic environment changes ABC actively manages change
Legal
Strategic
The results are reported as part of quarterly management reporting, collated by the risk management function.
Tool 5.2 Example comprehensive risk policy operational risk ABC has applied the following thresholds for loss event recording: Event type Actual loss Potential loss Near miss Any Reporting to risk committee Monthly Monthly Monthly Immediately Threshold amount > 10,000 > 50,000 > 25,000 > 100,000
Sources of loss events may arise from: new risks to ABC; and a lack of control or control failure surrounding a known risk.
In either case, loss events should be fed into the next self assessment exercise to identify any corrective action which may be necessary.
Scenario analysis results are also an important input to the determination of ABCs regulatory and economic capital for operational risk in ABCs business (see section Capital assessment).
Management information
ABCs risk management function oversees the collation, aggregation, and analysis of business unit management information and challenges it prior to submission to the risk committee and the Board. ABC requires monthly management information from each business unit in respect of: loss events, near misses and potential losses; key risk indicators; risk profile; new or significantly changed risk exposures; key risks with significant control weaknesses; deviations from the risk policy; and overdue agreed action for treating significant risks.
ABC requires immediate escalation to the risk committee and Board in the following instances: unauthorised deviations from any of the standards set out in this risk policy statement; and likely or actual breaches of thresholds agreed by the risk committee, ABC Board and risk management function.
Capital assessment
ABC uses scenario analysis as an important input to the determination of the amount of regulatory and economic capital required to support the level of operational risk in its business: the ABC risk categorisation is initially mapped to the risk groups defined by the FSA for the purposes of the capital assessment; a reasonable set of realistically possible severe events is then identified, drawing on the ABC risk framework, risk register, executive management and subject matter experts from relevant business units; the impact and probability of the various risk scenarios is then assessed, including the direct and indirect effects and the impact of control failures, via facilitated assessment workshops; wider ripple or knock on effects are then considered when quantifying the overall effects of each risk scenario (e.g. a large loss event which leads to reinsurer failure); scenario test results are then aggregated for operational risk in order to deal with correlation effects between the scenarios, by means of a correlation matrix, i.e.: each risk scenario test is considered and quantified in isolation and a correlation matrix is then specified between scenarios (for example, senior management judgementally allocating a high/medium/low correlation). The results are then aggregated to provide input to determining an overall capital figure for operational risk; and as a separate exercise, the overall results for each risk group are aggregated via a second correlation matrix, to help derive an overall capital assessment number.
The capital assessment methodology is addressed in more detail in ABCs Individual Capital Assessment 2005.
Marketplace policy
ABC is regulated by the FSA and, as such, must comply with a variety of FSA requirements. ABC seeks to ensure that these are adhered to within its business. All employees within ABC are expected to act in a manner which is consistent with the FSAs Principles for Business (see below). 1 2 3 4 5 6 7 Integrity Skill, care and diligence Management and control Financial prudence Market conduct Customers' interests Communications with clients Conflicts of interest A firm must conduct its business with integrity A firm must conduct its business with due skill, care and diligence A firm must take reasonable care to organise and control its affairs responsibly and effectively with adequate risk management systems A firm must maintain adequate financial resources A firm must observe proper standards of market conduct A firm must pay due regard to the interests of its customers and treat them fairly A firm must pay due regard to the information needs of its clients, and communicate information to them in a way which is clear, fair and not misleading A firm must manage conflicts of interest fairly, both between itself and its customers and between a customer and another client
8 9
A firm must take reasonable care to ensure the suitability of its Customers: relationships of trust advice and discretionary decisions for any customer who is entitled to rely upon its judgment A firm must arrange adequate protection for clients' assets when it is responsible for them A firm must deal with its regulators in an open and co-operative way, and must disclose to the FSA appropriately anything relating to the firm of which the FSA would reasonably expect notice
Tool 5.3 Example corporate social responsibility policy ABC also plays a role in ensuring full compliance with all relevant laws and regulations. Within ABC there is active promotion of awareness and understanding of a variety of policies aimed at protecting the interests of our customers and monitoring of compliance with these policies. It is expected that all business units would adopt measures to ensure full compliance with all relevant laws and regulations. The areas covered by these policies include: client confidentiality and handling of sensitive information (Data Protection Act); promotional communications to ensure they are fair, clear and not misleading; whistle blowing (reporting on concerns relating to possible wrongdoing or malpractice); financial crime (money laundering, advance fee fraud, suspicious transactions); and conflicts of interest (accepting and giving of gifts or benefits).
ABC monitors and deals with complaints concerning insurance policies to seek a reduction of such complaints. As a responsible organisation, ABC strives for clear communications with all its customers and is committed to providing a more financially intelligible and transparent market. To this end we are moving towards annual accounting which will be in place during 2005.
Workplace policy
ABC recognises that the ultimate source of value of the organisation lies with its employees. ABC is committed to treating its employees with fairness, respect and integrity. ABC has in place a set of policies relating to the treatment of its employees. They cover the following areas:
Recruitment
ABCs recruitment policy is to ensure we recruit the highest quality people having regard to both immediate and future needs. ABC will recruit from within the organisation where possible and will give fair consideration to all applicants regardless of ethnic origin, religion, nationality, sex, sexual orientation, age or marital status. ABC will also ensure full and fair consideration is given to applications from disabled people having regard to ability rather than disability. We do not just avoid discrimination as required by law but adopt policies and practices that treat as irrelevant all factors which do not genuinely affect a persons ability to undertake a particular job.
Remuneration
ABC is committed to rewarding its people fairly and to providing remuneration which will attract, retain and motivate the high calibre people the business requires. ABC recognises that employees all have different benefit needs and priorities at different stages in their lives and careers and provides a flexible benefits programme with this in mind. ABCs remuneration policy is based on providing a package of rewards (salary plus benefits) which is competitive, fair and flexible. The remuneration policy is regularly monitored by means of external remuneration surveys. Decisions on remuneration are based on rewards for performance and not a position in a hierarchy. ABC ensures employees understand the criteria by which rewards are determined and reviewed.
Job security
ABC is sympathetic to the need for job security amongst its workforce. ABCs policy is to avoid redundancy occurring whenever possible and to make employees redundant only when their position no longer exists and redeployment procedures have been followed without success. Where redundancy is inevitable, ABC will give employees as much warning as possible.
Grievances
The aim of the ABC grievance procedure is to resolve grievances quickly and informally where possible. Employees with any cause for concern or complaint are encouraged to raise the issue, particularly in the case of alleged discrimination or harassment on the grounds of race, sex, disability or otherwise.
Environment policy
ABC recognises that its business activities have an impact on the environment and that it has a clear responsibility to manage this impact as effectively as possible. The aim of ABCs environment policy is to provide guidance for business units so that they are able to protect and improve the environment locally. In turn, this will impact on environmental conditions nationally and indeed globally in line with ABCs commitment to good environmental practice and innovation. The policy addresses a number of ABCs activities that impact on the environment:
Energy
ABC is committed to reduce the use of energy, water and other natural resources and implement regular maintenance and improvement programs to ensure that the buildings operate at their optimal environmental efficiency.
Waste
The reduction of waste is a key objective. Where possible, waste materials are recycled and separated for collection by specialist organisations. Where waste cannot be recycled, the disposal is in strict compliance with the law and according to the best practicable environmental option.
Built environment
The management of buildings is best engineering practice to minimise any risks to human health and to the environment. ABCs property services maintain clean drinkable water and the supply of air to the offices to a high standard, while minimising any hazardous effects from emissions or materials.
Catering
Catering services ensure that food is produced within the statutory food hygiene regulations and that the storage of food meets the mandatory requirements. Caterers take all reasonable precautions to ensure that none of their food contains genetically modified ingredients. Where possible and with regard to economic constraints, caterers source their products from environmentally caring foodstuffs such as tuna fish caught in dolphin friendly nets, free range eggs, etc.
Procurement
Suppliers are encouraged to minimise the amount of packaging used on incoming goods and to use biodegradable or recyclable materials or reusable systems, e.g. recyclable paper. The purchase of timber and timber products are from legal and sustainable managed sources.
Transport
ABCs vehicles comply with emission regulations, and the use of alternative types of low polluting transport as a means of travelling to the building is encouraged.
Communication
Property services will communicate openly with staff, tenants and users of the premises to encourage them to support the environmental policy and involve them in relevant environmental initiatives.
Community policy
ABC takes its responsibilities to the wider community seriously and believes that the success of ABC is affected by the health and prosperity of the communities of which it is a part on a local, national and international level. ABC supports wide-ranging charitable involvement in the local community. ABC is committed to facilitating the community involvement and charitable giving through providing staff resource to co-ordinate the schemes.
Charitable Funding
ABC supports the charitable activity of its employees through a dedicated charity budget which is managed and administered by a charitable committee. The charitable committee has a specific set of aims which are determined by its members. The members of the committee are drawn from across ABC.
Tool 5.3 Example corporate social responsibility policy ABC also encourages charitable giving amongst its employees by running a payroll giving scheme and covering the administrative costs of that, ensuring that all monies donated go directly to employees chosen charities. More information on the ABC Community Programme and its charitable donations can be found at ABC.com.
Section Break
tools
Tool 6.1 Self assessment methodology Tool 6.2 Self assessment cycle of activity Tool 6.3 Roles and responsibilities Tool 6.4 Risk assessment criteria Tool 6.5 Control assessment criteria Tool 6.6 Risk assessment template Tool 6.7 Excel spreadsheet template for risk assessment Tool 6.8 Risk assessment output Tool 6.9 Risk profile tool Tool 6.10 Risk register tool Tool 6.11 Underwriting process maps Tool 6.12 Binding authority process map
The output of the self assessment will have most meaning if it reflects and highlights the key business risks (e.g. the top 10 risks) which the Senior Management and Directors are worried about, and does not miss the wood for the trees through excessive detail.
Why is it important?
The results of self assessment enable management to: understand the risks inherent in key business processes and the business objectives; evaluate the effectiveness of internal controls; assess the risk profile against risk appetite; provide internal audit with prioritised areas of work; and agree action plans to address risks in excess of the agreed risk appetite (for example, to address identified weaknesses in internal control or risk management).
It is important to note that rapid change or rapid business growth will have a significant impact on the risk profile of the business.
Enabling technology appropriate risk management software (may be Excel, Access or similar, may be bespoke risk management software / product) to assess and record various risks and controls
Time will depend on the size of an organisation, the level of detail, type of risk, etc. time to hold training / familiarisation sessions before any workshops, workshops for appropriate groups, review and analysis of results, playback and amendment, etc.
Direct / indirect costs risk management function for workshops, training, etc. appropriate management and committee time to discuss major risks to the organisation systems capability and support
It is important to remember that risk and control self assessment should be commensurate to the business. As one key risk my be critical to a small organisation, the same risk may be of low impact to a larger firm and should require less focus during a risk and control self assessment.
Risk identification
The initial risk identification stage seeks to identify the sources and root causes of key risks which may affect the business objectives, examples of which may include (for operational risk): a change in existing products, processes or key staff; development of new products or processes; new projects or initiatives; and a potential terrorist attack affecting the business premises.
In practical terms, there are several common methods of identifying the key risks: self assessment questionnaires this is a bottom-up approach, whereby business managers identify and assess the areas that present most risk to the business as a whole. A standard self assessment questionnaire, with instructions, is provided to the managers and staff best placed to understand the key risks and the results are compiled by the risk management function. Care is needed to achieve consistency in ratings across business units and to manage poor response rates. Regular communication between the business managers and risk management function can help mitigate these weaknesses.
process and risk mapping this is a systematic and analytical approach which considers the major steps in key business processes as a prompt to identify the major risks. It may be performed at either a high or low level to identify what can go wrong with key business processes and results in a visual portrayal of the key risks and controls, for example by means of a flow chart. Care is needed not to exclude risks arising from interdependencies between different processes.
facilitated workshops a series of workshops is undertaken to consider each business risk category and involves those staff who are best placed to understand the risk category i.e. the company experts for that risk. Relevant material (see below) is circulated in advance for review and, with the aid of a facilitator, a structured discussion takes place in which the group seeks to reach a consensus on the key risks faced by the business.
The methods described above are not mutually exclusive and can be used in combination. The simplest option is a self assessment questionnaire, while a more sophisticated approach is process mapping. In practice, a combination of a top-down and bottom-up approach to risk identification is needed, with a combination of both executive management and business unit identification and assessment of the key risks. The nature of risks identified will also differ depending on the business level, i.e. department, division, senior management or board level.
Tool 6.1 Self assessment methodology Supporting material which may assist the various risk assessment approaches above includes: business goals and objectives; business risk appetite; process and risk maps; loss event data; key risk indicator data; risk event categorisation and causation analysis; prior risk assessments; regulatory reports; audit reports; and prior risk management plans.
Risk assessment
In order to be meaningful to management, identified risks need to be prioritised and considered against the current control environment: the use of standard risk assessment templates provides a helpful structure for this process, for example, assisting staff to consider the risk descriptions, causes and drivers, different types of risk effects and the most appropriate risk owner; standard criteria for assessment are helpful in order to aggregate the results across risk classes, for example risks may be assessed for probability and impact; risks may be assessed on an inherent basis (before the controls are applied), or on a residual basis (after controls have been applied). However, in practice it can be difficult to disregard the controls in place in order to make an inherent risk assessment. Whichever approach is adopted, most value will be obtained if: there is clear prioritisation of risks, identifying the more significant risks which should be the focus of board attention; and there is clear identification of those areas where the business is very reliant on the effectiveness of its controls.
the measurement of inherent and residual risk may also be undertaken by stress and scenario testing.
It is important to allocate ownership of risks to owners with the authority and resources to manage them effectively. The owner may delegate these tasks to others as and when appropriate, but remains accountable for the completion of the assessments.
Control evaluation
Once identified and prioritised, the risks may be considered against the current control environment in order to understand the residual risk profile of the franchisee: the use of standard control assessment templates provides helpful structure to this process (see attached risk profile tool with example self assessment template); standard criteria for assessment are necessary in order to aggregate the results, for example, controls may be assessed for their design and performance; controls may be preventative or detective, for example, the use of recruitment criteria is a preventative control and quarterly staff reviews are a detective control. It is helpful to consider the balance of preventative and detective controls in place against key risks, given that preventing losses is more effective than detecting them once they have occurred: front line prevent controls are high level controls aimed at preventing risk causes from occurring at a very early stage. Examples might include the business planning process, franchise guidelines or admissions criteria; back stop detect controls are a less frequent type of detect control and would typically be carried out on a monthly or quarterly basis. Both the issues identified and the remedial action prompted by back stop controls can be relatively serious due to the potential time lag since the risk event. Examples may include various quarterly reviews, reinsurance debtors return or a review of solvency deficits.
it is important to allocate ownership of controls to capable owners with the authority and resources to manage them effectively. The owner may delegate these tasks to others as and when appropriate, but remains accountable for their completion; the resulting risk profile of scored residual risks may then be reviewed against the risk appetite and, if the level of risk exposure is higher than the franchisee appetite for any risks, mitigation strategies / action plans may be developed to reduce the level of risk, for example by reducing the risk exposure (e.g. writing less business through delegated authorities) or by implementing additional controls (e.g. more frequent audit review); and the action plans may then be agreed by management and reported against as part of ongoing management reporting. This will ensure that the exposure is limited and that there is cost / benefit in the mitigation strategy.
Review
Identification
Report
Assessment
Assurance
Control / mitigate
The identification, assessment, monitoring and control of risk are continuous processes. Risk identification the process begins with the identification of risks and an analysis of the nature of each risk. Everyone within the organisation is involved at this stage of risk management, whether for new or existing risks. The aim is for all employees to be aware of the risks to the business objectives and to be able to highlight any new risks that may be developing over time or changes in existing risk levels such that they are reported and responded to appropriately. Risk assessment following on is the assessment of the likely frequency and severity of risks, by means of qualitative or quantitative measurement. This stage of the cycle is likely to involve the participation of the risk owners. Risk mitigation the level of each risk must then be transferred or controlled down to a satisfactory level. This stage will not only involve both risk and control owners but also many other departments that are involved in undertaking control activities. Assurance once the key business risks have been identified, assessed and are subject to controls throughout various parts of the business, it is important to obtain confirmation that these activities are being performed as expected and that the risk and control scoring is valid. Typically, assurance is provided over risks and controls by resources which are independent of line management, e.g. Internal Audit. Reporting relevant information for each key risk should be seen by the right people at the right time across the business. This information is most likely to be provided by risk and control owners as they are closest to the issues and should be reported on a regular, timely and consistent basis. Reporting is often consolidated or reviewed by a risk management department and then escalated up to senior management. This will typically include qualitative or quantitative measures of risk, depending on the nature of the risk, for example: aggregate RDS property damage exposures are typically reported on a quantitative basis, drawing on a range of commercially available modelling tools; and operational risk may be typically reported by means of qualitative and quantitative measures.
This approach to the scoring of risks can be difficult due to the non-financial nature of the definitions, however, the assessment involves a judgmental assessment of the most appropriate score. The assessments may be done either at an inherent level (before the application of controls) or residual level (after the application of controls). Adopting an inherent and residual level assessment will provide more insight into the nature of the risks and control strategy adopted. Example parameters for assessing probability and impact are as follows: Probability likelihood that the risk will occur within the next 12 months based on the scoring 1 to 4 and your own management experience and intuition 1 2 3 4 A B C D < 5% likelihood 5% to 25% likelihood 25% to 50% likelihood > 50% likelihood No material impact Material impact, no significant lasting risk to organisation Significant risk to organisation Potential organisation failure
Impact the level to which the risk would affect the ability of the business to deliver its strategy and objectives based on the scoring A to D
performance considers the way in which the control is operated in practice; if it is applied when it should be and in the way intended by its designer. If the performance is not rated as good, an explanation should be given and a decision taken as to whether to accept the level of risk or to re-engineer the control to improve the performance.
Example parameters for assessing design and performance are as follows: Design how well the control should work in theory, if it is always applied in the way intended Green Yellow Amber Red designed to reduce risk entirely designed to reduce most aspects of risk designed to reduce some area of risk very limited or badly designed, even where used correctly provides little or no protection control is always applied as intended control is generally operational but on occasions is not applied as intended control is sometimes applied correctly control is not applied or applied incorrectly
Performance the way in which the control is Green operated in practice, if it is applied when it should be and in the way intended by its designer Yellow
Amber Red
The assessment is split between impact and likelihood. In completing these columns, the risk owner should consider the impact of the risk occurring (i.e. the financial implication) and the likelihood (i.e. the expected frequency of the risk materialising) based on thresholds. The thresholds given below are for illustrative purposes only. Impact Rating 1 2 3 4 5 Definition Insignificant Minor Moderate High Very high Monetary Impact < 5k 5k 50k 50k 500k 500k 5,000k > 5,000k
Likelihood Rating 1 2 3 4 5 Definition Remote Unlikely Possible Likely Frequent Frequency Once in every 20+ years Once in every 5-20 years Once in every 1-5 years Once a year More than once per year
Tool 6.6 Risk assessment template Once the initial assessment of risk has been carried out, further assessments should be completed: control details of the control activities should be added. All relevant controls should be noted that reduce impact, likelihood or both. Non-control related mitigations, such as insurance, should also be detailed; residual risk the risk should be re-assessed following application of the identified control measures using the same impact and likelihood scales as for inherent risk. The ratings should reflect the actual risk faced by the business, given the existing control environment; assessment of risk mitigation / controls once the effect of introducing the control measure has been taken into account, the business can assess the effectiveness of the control(s) itself. One example classification is provided below: Risk mitigation assessment Rating 1 2 3 4 5 Definition Ineffective Deficient Adequate Effective Excessive Description Fundamental deficiencies exist in risk mitigation / controls Deficiencies exist in risk mitigation / controls Minor weaknesses exist in risk mitigation / controls Risk mitigation / controls are considered sufficient Opportunities exist to streamline risk mitigation / controls
It should be noted that it is possible for the mitigation to be classed as excessive. In such a situation, the cost of risk control outweighs the benefit of the reduced risk, in which case the measure may be streamlined. Following this: target an indication of the target residual risk (i.e. risk appetite) may be entered, against which the residual risk may be compared; action where the risk mitigation measure is assessed as ineffective or deficient, i.e. in cases where the residual risk is considered too great to be acceptable, an action plan should be devised to address the weakness. This plan should have clear deliverables and target dates.
1 Impact 1 Likelihood # 2
Pre control
Post control
Accepting (5)
Tools
Tool 7.1 Frequently asked questions on KRIs Tool 7.2 Illustration of a KRI for staff turnover Tool 7.3 Roles and responsibilities for KRIs Tool 7.4 Major steps necessary to generate KRIs Tool 7.5 Insurance specific operational risk KRIs Tool 7.6 Generic operational risk KRIs Tool 7.7 A KRI tool
KRIs then are measures which indicate the level of and changes in an organisations risk profile. This is achieved by focusing KRIs on the root causes of potentially significant risk events and exposures, as illustrated below.
Cause1
Effect1
Cause2
Risk event
Effect2
Cause3
Effect3
Detective controls
The key attributes of KRIs are that they: highlight current risk levels by providing a measure of the status of an identified risk and the effectiveness of its control. Risk indicators can provide information which gives a useful ongoing view of the underlying behaviour of the risk profile1; highlight trends and changes in risk level by monitoring changes in risk between formal risk and control assessments; provide early warning signals through predictive risk indicators which highlight changes in the risk environment, control effectiveness and potential risk issues, before they crystallise and result in loss or other exposure;
1 Another type of indicator is a key control indicator (KCI), which is a measure of the effectiveness (e.g. design and performance) of a specific control. Deterioration in KCIs can show an increase in residual risk impact or likelihood. KCIs are relevant to a particular control activity(s).
Section 7 Key risk indicators enable actions that prevent or minimise material loss or incident by prompting timely action on early warning signals; and express escalation criteria for risk management by using thresholds to convert raw indicator data into meaningful risk ratings to aid effective decision making.
Key risk indicators can be classified into two categories, namely: specific indicators, which relate to particular processes within a franchisee, such as the number of reconciling items in a given area; and environmental indicators, which impact the franchisee as a whole, for example, business volume.
Establish KRIs
Risk examples
Risk causes
Risk indicators
Staff turnover ratios
Average time to fill Protect staff Poaching by competitors Low job satisfaction Exit interview summaries Inadequate skills and education Poor performance of staff % job offers accepted Benchmark salaries against industry standard Low staff morale Staff survey summaries No of applicants per vacancy No of staff not completing their probationary period
Inability to recruit
People Risk
Inability to retain
The following are considerations in the selection of KRIs: ideally determined for many of the significant risks identified in the risk and control self assessment (self assessment) process; can provide early warning signals to trigger actions that reduce potential risk exposures; some indicators are meaningless on their own and need to be combined with other KRIs. In many cases, it is a group of KRIs that will provide the best management information for a meaningful assessment;
Section 7 Key risk indicators can indicate past, current and projected level of risks and can be used as a criteria to monitor, escalate and manage risk and related actions; and KRIs relevance and change in importance over time.
The appropriate frequency of reporting and monitoring of each identified indicator is also an important consideration. The following (non exhaustive list) provides some sources of information that can help to identify significant risks and aid in KRI identification: historical internal loss events; risk and control self assessment results; internal / external audit findings; regulatory inspection findings; and workshops / discussions with business functions e.g. Human resources (including staff turnover statistics).
Risk appetite setting one of the methods to articulate risk appetite, particularly for operational related risk, is through the setting of tolerance and escalation levels for key risk indicators; Regulatory compliance identification and management of KRIs is an area of regulatory focus; and Capital calculation data from established KRIs can be used as one of the inputs into operational risk capital calculations.
Section 7 Key risk indicators Given the above, the following guidance is intended to help organisations understand what is involved from a practical standpoint to implement this KRI section: Staff resource and skills business unit workshops to identify the important key risk indicators, drawing on senior business unit managers and expert staff, facilitated by risk management IT programming resource to develop and integrate KRI reporting briefing of senior management and committees internal auditor or external consultant review to provide technical assistance and support and assurance that KRIs are focussed on key areas and are robustly implemented, such that they support risk monitoring and decision making
Enabling technology MS Excel and/or Access software bespoke operational risk software (developed in house or from third party vendors)
Time initial workshops and IT implementation 3 to 6 months iteration, refinement and assurance over selected KRIs 3 months overall expected implementation time 6 to 12 months
Direct / indirect costs management and staff time per 2 to 3 hour workshops IT staff time for programming risk management time facilitation, documentation and review internal audit / external consultants for support, quality assurance, technical review and independent assurance
Given the differences in scale, sophistication and resources between franchisees, the capacity to establish KRIs, to monitor and react to KRI information, and the overall number of KRIs will vary significantly across organisations. It is therefore anticipated that this section would be of relevance to organisations as follows: Large / composite highly relevant: expected to be in use for business unit management reporting; Medium / multi-line highly relevant: expected to be generally in use for business unit management information; and Small / mono line relevant: but with less extensive KRI reporting.
For example, when given thresholds are breached there will be a requirement to escalate to an appropriate level of management: Below 24% No risk. The organisation is comfortable with the level of staff turnover. No escalation or treatment required. Above 24% Potential risk. The risk is a concern and HR would be expected to monitor actively and establish causes and actions. Escalation required raising awareness but explanatory report not required. Above 28% Significant risk. Action and escalation with explanatory report required. Staff turnover KRI % 0 24 24 28 > 28 Thresholds can be used alongside targets set by management. These could be flexed over time as objectives / strategy and risk appetite develop. These targets will help drive the desired behaviour and outcomes and improve the organisations operational risk profile over time. Risk level
Risk management Provide guidance and challenge the selection of KRIs and thresholds Monthly reporting on KRI breaches Ad-hoc escalation reporting to Board Identify trends across the business
Internal audit Provide validation / independent assurance around the KRI process Incorporate outputs into audit plan
Setting of thresholds Monitor position against targets and limits Escalate breaches to operational risk management
Set up submissions
2 This structure follows the Three lines of defence approach used in the governance section of the toolkit with respect to roles and responsibilities within a risk management function.
1 Inventory exists
2 Assess KRI
Root Causes File not received by BP Complete file not received by BP BP credits to wrong cardholder account BP credits incorrect amount Overall Rating
9 3 0 0 2.10
1 1 1 3 1.50
1 1 0 1 0.60
3 Design
10
4 Validate
0 0.0%
5.0%
10.0%
15.0%
Weighting
35.0%
40.0%
F10 Flowdown
5 Develop KRI
Flowdown
What type of graphical or other reporting should I use to monitor these KRIs?
4.00%
*A s of the w eek ending 11/30/2001, Fraud is r esponsible for F10 f low dow n.
3.50%
+3 Std Dev
3.00%
+2 Std Dev
2.50%
+1 Std Dev
2.00%
M ean
1.50%
-1 Std Dev
1.00%
-2 Std Dev
0.50%
-3 Std Dev
0.00%
6 Establish KRI
What actions do I need to take to implement these KRIs? e.g. source data collection
Week Ending
The following diagram illustrates the need for a balanced range of KRI perspectives in order to monitor a significant risk, for example, LMP slip compliance. Risk event LMP slip standards are not adhered to.
Volume driver
Causal driver
(individuals not following procedure)
Processes
Basic underwriting process percentage slips recorded within 24 hours percentage slip entry error rate percentage endorsements recorded percentage aggregates (or proxy for max aggregate) recorded within 24 hours percentage of slips underwritten within authority percentage referral where appropriate percentage underwriting guidelines to be followed, subject to referral Underwriting review percentage of slips with greater than 1m premium or 10m exposure to be peer reviewed within 10 days Monitoring of underwriting number of premium and reinsurance debt greater than 90 days outstanding number of claims greater than 10m to be reviewed number of non-moving claims to be reviewed every 6 months number of contracts greater than 110% loss ratio to be investigated, (subject to de-minims 1m premium) number of exposures not recorded within 1 month of underwriting number of less than 100 binders not written, with minimum income 100k number of outstanding wordings greater than 1 month Agency level underwriting controls percentage of major contracts to be independently reviewed within 1 month of underwriting Placement of reinsurance programme percentage of reinsurance order forms and cover notes reviewed against requirements per month percentage accuracy on reinsurance orders and cover notes per month
Risk category
Example key risk indicator Agency level reinsurance purchase controls percentage set limits on exposures to reinsurers (e.g. less than 10% premium to be placed with 1 reinsurer) elapsed days since security ratings for reinsurers last measured number of material exposures / recoveries from reinsurers / erosion of reinsurance per month / year Claims processes percentage material claims / disputes / complaints reported to senior management / Board per month number of second adjustor review for material claims greater than 10m per month / year number of monthly reconciliation breaks of claims reserves percentage of claims advices reviewed within 2 days percentage of collection notes issued within 30 days percentage of outstanding debts chased after 90 days number of ongoing disputes with syndicate actuaries or accountants per month / year Liquidity processes percentage contingency plans for potential or expected cash shortfalls Generic process failures percentage manual input errors per month number underwriting staff with access to accounting system percentage of management information and exception reporting produced and reviewed within 2 days of month end percentage of IT system queries responded to within 24 hours percentage of complaints resolved within 1 month of receipt number of adverse press comment(s) per month / year number of outstanding external and internal audit / compliance / regulatory report points
Systems
number of IT system outages per month number of IT security breaches per month / year number of IT virus caused outage per month / year number of IT supplier failure incidents per month / year number of 1 day server failures per month / year number of tested IT disaster recovery procedures and systems per year
External events
number of incidents of third party provider failure, from outsource providers per month / year number of successful external fraud incidents per month / year number of IT system security breaches per month / year number of regulator action / concerns per month / year number of outstanding Lloyds operational risk review points raised
Processes
number / percentage of accounts with outstanding / incomplete customer documentation number / percentage of unauthorised customer accounts opened number / percentage of customer accounts with significant change in volume / value of transactions number of incidents reported to the Money Laundering Reporting Officer number / percentage of customer accounts with unusual transactions number and nature of limit breaches number of new products market share by product customer intake / retention / churn by product versus budget significant revenue variance by product number of new products / new products awaiting approval / unapproved products projected transaction processing volumes versus capacity percentage change in transaction volumes percentage of total transactions handled number / value / age of processing exceptions processing exceptions as a percentage of transaction volumes number of customer complaints number of compliance / regulatory breaches
Risk category
Example key risk indicator budgeted versus actual FTE within customer & account servicing / moving money / collections supplier performance versus SLA number of unreconciled accounts number / value / age of unreconciled items
Systems
number and type of security violations number of virus incidents systems usage versus capacity systems downtime number, type and severity of system incidents / SLA breaches number of system upgrades / version releases number of open system change requests number of help desk calls virus incidents number of outstanding business continuity plans utility performance statistics
External events
number of overdue tests / maintenance of detection & suppression mechanisms number of outstanding disaster recovery plans number of overdue disaster recovery plan tests number and nature of physical security incidents
tools
Tool 8.1 Internal loss event data requirements Tool 8.2 Basel II framework detailed loss event type classification for operational risk Tool 8.3 Internal loss event data collection template Tool 8.4 Internal loss event database tool
Sources of loss events can be considered in two ways: as a result of a new risk to the organisation, leading to a loss event; or as a result of a lack of control or control failure surrounding an already identified risk.
Robust risk management relies on a sufficient volume and quality of data if analysis is to be meaningful and decision making effective, therefore, the integrity of data is important in any loss event database. As a first step, loss event thresholds should be assigned to actual, potential and near miss loss events. Loss events exceeding these thresholds may then be tracked and recorded in an internal loss event database. A download from the General Ledger can provide a means of reconciling losses on a periodic basis e.g. monthly.
1 Please refer to External loss data section of the toolkit (9) for use of external loss database information and suppliers.
Increased transparency
Identifies key sources & costs of risks Facilitates escalation of issues Enables prioritisation of activities Enables reduction / mitigation of key sources or risk Facilitates process of continual improvements
External stakeholders
Demonstrates risk losses are being identified and managed appropriately Aligns overall risk management practices to peer group comparisons
Financial benefits
Cost identification and reduction Reduction of regulatory capital requirements for risk Supports cost / benefit analysis of improvements / controls
Regulatory compliance
Complies with regulatory requirements
Internal stakeholders
Improves knowledge and understanding of risk losses Enables oversight and resolution of losses Validates control effectiveness and enables corrective action Mitigates future incidents and avoid repeat incidents
Enables future progression to more advanced approaches to calculation of regulatory capital requirements
Enabling technology MS Excel and/or Access software bespoke operational risk software (developed in house or from third party vendors)
Time initial requirements workshop(s) and IT implementation 3 to 6 months iteration, refinement and assurance of loss data and supporting process 3 months overall expected implementation time 6 to 9 months, then ongoing
Direct / indirect costs management and staff time IT staff time for programming risk management time for facilitation, documentation and review internal audit / external consultants for support, quality assurance, technical review and independent assurance
In view of the wide range in size and sophistication of businesses, it is anticipated that this section would be of relevance to organisations in the following manner: large / composite (highly relevant) expected to be in use for business unit management reporting medium / multi-line (relevant) depending on contract volume, expected to be in use for business unit management reporting small / mono line (potentially) less relevant depending on contract volume
Incident detected
Yes
No
Near miss
Closed
Actual loss
Closed
Potential loss
Open
Actual loss
Open
2 This tool replicates tool 2.4. A breakdown of potential causes of operational risk by category can be found in the Risk definition and language section of the toolkit.
3 The example internal loss database and management information (Worked example 2) detailed in this section considers only the key fields of data, for illustrative purposes.
TOOL 8.2 BASEL II FRAMEWORK Detailed loss event type classification for OPERATIONAL RISK
Basel II framework Detailed loss event type classification (operational risk)
The following table sets out the Basel II loss event categorisation for operational risk in order to provide a helpful point of reference. Event type category Definition (level 1) Internal fraud Losses due to acts of a type intended to defraud, misappropriate property or circumvent regulations, the law or company policy, excluding diversity / discrimination events, which involves at least one internal party
Activity examples (level 3) transactions not reported (intentional) transaction type unauthorised (w/ monetary loss) mismarking of position (intentional)
fraud / credit fraud / worthless deposits theft / extortion / embezzlement / robbery misappropriation of assets, malicious destruction of assets, forgery, check kiting, smuggling, account take-over / impersonation / etc. tax non-compliance / evasion (wilful), bribes / kickbacks, Insider trading (not on firm's account) theft / robbery forgery check kiting hacking damage theft of information (w/ monetary loss)
External fraud
Losses due to acts of a type intended to defraud, misappropriate property or circumvent the law, by a third party
Systems security
Event type category Definition (level 1) Employment practices and workplace safety Losses arising from acts inconsistent with employment, health or safety laws or agreements, from payment of personal injury claims, or from diversity / discrimination events
Activity examples (level 3) compensation, benefit, termination issues organised labour activity
Safe environment
general liability (slip and fall, etc.) employee health and safety rules events workers compensation all discrimination types fiduciary breaches / guideline violations suitability / disclosure issues (KYC, etc.) retail consumer disclosure violations breach of privacy aggressive sales account churning misuse of confidential information lender liability antitrust improper trade / market practices market manipulation insider trading (on firms account) unlicensed activity money laundering
Diversity and discrimination Clients, products and business practices Losses arising from an unintentional or negligent failure to meet a professional obligation to specific clients (including fiduciary and suitability requirements), or from the nature or design of a product Suitability, disclosure and fiduciary
Product flaws
Activity examples (level 3) failure to investigate client per guidelines exceeding client exposure limits disputes over performance of advisory activities natural disaster losses human losses from external sources (terrorism, vandalism) hardware software telecommunications utility outage / disruptions miscommunication data entry, maintenance or loading error missed deadline or responsibility accounting error / entity attribution error model / system misoperation other task misperformance delivery failure collateral management failure reference data maintenance
Damage to physical assets Business disruption and system failures Execution, delivery and process management
Losses arising from loss or damage to physical assets from natural disaster or other events Losses arising from disruption of business or system failures
Loss from failed transaction processing or process management, from relations with trade counterparties and vendors
failed mandatory reporting obligation inaccurate external report (loss incurred) client permissions / disclaimers missing legal documents missing / incomplete
Categories (level 2) Customer / client account management Trade counterparties Vendors and suppliers
Activity examples (level 3) unapproved access given to accounts incorrect client records (loss incurred) negligent loss or damage of client assets non-client counterparty misperformance misc. non-client counterparty disputes outsourcing vendor disputes
Section Break
At present, the most directly relevant external loss data sources are provided by the data consortia being established by ORX and the ABI (see below).
ABI Operational Loss Consortium (OLC) ABI use Basel loss event type categorisation within their database and provide a robust / secure data repository for users database aims to provide an industry database of quality operational loss event information to enhance both quantitative and qualitative understanding of operational risk for insurers ABIs objectives include: providing a quantifiable input into ICA modelling; challenge to internal risk identification; identification of risk areas; and provision of benchmarks.
ABI collate, host and distribute reporting. A reporting suite enables members to access pre-defined reports, create reports in a secure environment, and benchmark themselves against other consortium members
The Fitch first database has around 5000 loss events recorded on it and is categorised in the following way: Corporate Finance Corporate Finance Underwriting Corporate Finance Mergers & Acquisitions
Trading & Sales Trading & Sales Equities Trading & Sales Fixed Income Trading & Sales Foreign Exchange Trading & Sales Commodities
Section 9 External loss data Retail Banking Commercial Banking Payment & Settlement Agency Services
Asset Management Asset Management Retail Brokerage Asset Management Private Banking
one of the key limitations of this database is that it is populated with public events rather than data sharing via a consortium as a result little is known about each organisation involved. This in turn makes the process of testing, in terms of relevance, scale and completeness, more difficult
For further information on the data consortia outlined here, please contact Andrew Gurney, Lloyds Risk Analysis at [email protected] or 020 7327 6194.
Management information
Section 10
tools
Tool 10.1 Example reporting matrix Tool 10.2 Example management information reporting tool
10 MANAGEMENT INFORMATION
What is management information?
Every business identifies and captures a wide range of information relating to external, as well as internal, events and activities which is relevant to managing the business. This information is delivered to management and staff in a form and timeframe that enables them to carry out their risk management, measurement and other responsibilities1. It is an ongoing challenge to provide sufficiently detailed and appropriate information to the different levels of management such that the key issues may be quickly understood, but not so detailed that the issues are obscured.
actual losses, potential losses and near miss events; the business risk profile, including new and changed exposures to key risks; significant control weaknesses (which affect significant risks); key risk indicators, including trend analysis; and progress on action plans to deal with significant risks or control weaknesses.
Besides routine reporting, an escalation process to alert senior management of significant issues is also important, for example, in respect of breaches of authorities, limits, thresholds, risk policy or risk appetite.
Why is it important?
Providing the right information to the right people at the right time leads to better identification and prioritisation of risks and opportunities, which in turn leads to better, more informed decision making. This makes it more likely that the business will achieve its objectives. Timely, accurate and complete management information assists managers to:
understand the significant risks which make up the risk profile of the business and how it is changing over time; determine whether the business risk exposures are being managed in accordance with the risk appetite and policy set by the Board; identify opportunities to exploit the upside of risk taking; and
monitor actions being taken to deal with the downside unacceptable exposures and known control failures. Organisations may therefore consider it important that the timeliness, accuracy and completeness of management information be subject to routine quality assurance and periodic independent review, for example by internal audit.
1 COSO Framework, Enterprise Risk Management Integrated Framework, p 67 commentary on Information and Communication
the purpose of the report; who the recipients of any given report might be; how often such reports, ideally would be produced; and what they should do with the report (i.e. from a practical standpoint, they would use the operational risk information to run the business better).
It is important to note that for small businesses, not all of the attached reporting examples may be practical and affordable to systematically produce.
Tool 10.1 Example reporting matrix: contains suggested content, recipients and frequency for risk management reporting; Tool 10.2 Example management information reporting tool: an illustrative management information pack, which sets out a range of example reporting formats for operational risk, which businesses may draw upon where applicable to their business, including: summary reporting; risk profile reporting; loss event reporting and graphs; key risk indicator reporting; and control assessment reporting.
Board
Risk Committee
Business heads
tools
Tool 11.1 Key steps in stress and scenario testing Tool 11.2 Suggested workshop participants Tool 11.3 Scenario generation Tool 11.4 Potential stress and scenario tests Tool 11.5 Example template for stress and scenario tests Tool 11.6 Example template for use in a stress and scenario workshop Tool 11.7 Aggregation tool method for standardising and aggregating
Stress testing and scenario analysis are therefore integral elements of an organisations risk management framework. Potential scenarios may be derived in a variety of ways, drawing on stochastic models; analysis or repetition of historic events; or hypothetical events.
FSA requirements
It is important to note that the FSA has imposed requirements on insurers2 to carry out stress testing and scenario analysis for each major source of risk (i.e. each risk group) appropriate to the nature of those sources of risk (PRU 1.2.34-36G), in particular: taking reasonable steps to identify an appropriate range of realistic adverse circumstances and events in which the risk identified crystallises; estimate the financial resources the firm would need in each of the circumstances and events considered in order to be able to meet its liabilities as they fall due; and tests should be carried out at least annually (or potentially more often if appropriate).
1 This section draws on the GIRO Working Party Quantifying Operational Risk in General Insurance Companies. 2 The FSA issued DP05/2 Stress Testing in May 2005 which provides feedback in respect of stress testing and scenario analysis from a recent survey of large and more complex firms. The toolkit is consistent with DP05/02.
Section 11 Stress & scenario testing The nature of these losses is illustrated below:
Extreme events (preparedness) Losses so remote that capital is not provided to cover them
Cost 0 500 Expected loss Economic capital = Difference 2000 2,500 Total loss incurred
It should be noted that: economic capital is held to cover unexpected losses to a specified level of confidence (e.g. to support an A rating); and regulatory capital is the minimum level of capital required by the FSA to cover unexpected losses to a 200 year level of confidence (i.e. to support the ICA).
It is important to note that guidance in this section is intended to help organisations understand and undertake stress and scenario testing. It is not intended to contradict or add to the requirements set out in the 2006 ICA guidance document or provide guidance on stochastic modelling approaches
Tool 11.1 Key steps in stress & scenario testing dependencies and ripple effects an assessment of any possible interrelationships between the various scenarios; and sensitivity to key factors in the scenario test.
The following are six examples of completed operational risk scenarios: damage to physical assets and denial of physical and logical access due to a terrorist bomb; failure of a key outsource provider to perform; organisation business practice or product flaws flawed wording in document; improper business or market practice e.g. failure to execute strategy or deliver essential process change on a timely basis; financial crime significant internal or external crime; and pension fund deficit caused by incorrect mortality assumptions and adverse market movement.
Individuals from the following areas may be considered as key participants: risk owners individuals who perform risk self assessments and who are responsible for identified risks; senior management representation providing a big picture view of potential operational risk scenarios; human resources representation where people / staff related scenarios have been identified, e.g. internal fraud; IT representation; business continuity planning representation applicable if a separate function exists; and finance representation.
Consideration could be given to segmenting workshops into scenario generation and scenario evaluation making better use of time and adding most value for each of the relevant participants.
Identify concerns
Select the concerns that could lead to large losses and/or reputational damage
Given the key concerns, what event would result in a serious financial and/or reputational impact?
Concerns
Potential events
Scenario generation
Could different concerns lead to loss events with greater financial cost and other, e.g. reputational, impacts?
Example concerns for operational risk may include: potential control failures control can fail over time, even when rated highly in the risk and control self assessment (self assessment) process; changes in the performance of the business processes (including controls), systems, staffing or infrastructure; changes in the business processes, systems, staffing or infrastructure contained in business plans;
Tool 11.3 Scenario generation an illustration & examples changes in the type of business undertaken; and changes in the business environment.
Example operational risk events may include: specific events that could have a significant impact on the organisation (e.g. system outage, fire, flood), including consideration of the most likely underlying causes of these events (e.g. a system upgrade could be a potential cause of an IT system failure / outage); relevant trends in business plans which may add to / detract from concerns; use and challenge of any available internal / external databases where applicable; and media articles reflecting on the blockbuster loss event experiences of other financial institutions.
Lloyds building plus 500m major water environment supply destroyed / contamination damaged / denial of access Thames surge
both occurred during weekend period and City was re-opened by Monday morning cost of repairs from 1993 Bishopsgate bomb estimated 1bn 9/11 WTC disaster Cantor Fitzgerald
damage to organisations' offices relocation of "Underwriting Room" relocation of key staff to alternative sites
Event
Scenario options
Physical effects loss of physical assets (e.g. PCs) and operational assets (e.g. IT systems / processes / data / documentation) financial cost of rebuild / repair over and above insurance provision extensive data / document recovery process required casualties e.g. employees / Market staff / visitors loss of intellectual assets and underwriting talent inability to underwrite due to lack of skilled people and appropriate systems delayed / reduced capability to provide key processing functions to Market prolonged operational inefficiencies
pressure on Lloyds solvency pressure on Lloyds security rating reputational damage / loss of market place / industry credibility
TOOL 11.6 Example template for use in a stress & scenario workshop
This is an Excel tool that can be used to help an organisation complete a stress and scenario test workshop. This tool can be found in the Stress and scenario testing section (11) of the toolkit. The data in this template is illustrative and for example purposes only. The tool has been designed to highlight the areas of information deemed important when designing stress and scenario tests.
Section Break
Risk culture
Section 12
12 risk culture
What is risk culture?
The FSA defines risk culture as the following: a firm's risk culture encompasses the general awareness, attitude and behaviour of its employees to risk and the management of risk within the organisation
Where do I start?
Context-setting What sort of organisation is it? What are the main types of risk faced? What magnitude are the most significant risks likely to be?
Objectives What are the objectives of the organisation? Make sure these are clearly agreed and articulated. What are the objectives of risk management in the organisation? Are you doing it for the business benefit, as a result of regulatory requirements, or pressure from other stakeholders?
Stakeholders Who are the significant stakeholders? What are their needs? What sort of relationship do you have with them? How do you want to manage those relationships?
Whats already done? Dont re-invent the wheel. A large part of many peoples jobs is managing risks but it is likely that it will be called something else. Speak to people. Ask them what they do and why.
Whos going to do it? Risk management is the responsibility of everyone, but the risk management co-ordination and support function is likely to be done by an individual (risk manager) or team (risk management department).
Where do you start? 3 vital stages: convince yourself make sure that you understand what you intend, test it locally; convince supporters e.g. consultation, participation, information, pilot more widely (some of these need to be within the senior management team); and convince adversaries look for gaps, overlaps, easy wins, long term projects and have a staged roll out. This is very difficult to embed (rather than impose) in one go in an organisation of any size.
Tips for embedding and implementing risk culture High level sponsorship a must
Why? it sets the tone across the organisation, and enables appropriate resource and importance to be given to risk management to develop the positive and aware attitude to risk amongst senior managers, which then filters down
What do you need? active support of the Managing Director / Chief Executive Officer risk champions amongst the senior management group support for the embedding initiative from the senior management group
What happens if you dont have it? lack of understanding and enthusiasm will be the norm threatened feeling as a department / practice lack of buy-in at the top makes embedding impossible
Practical tips on how to develop and maintain it: clear, concise, and early individual briefings and consultation with directors and senior managers; clear, strong, repeated messages using common terminology coming from the senior management team, particularly the Chief Executive Officer, are extremely powerful and work particularly well when combined with repeats of the messages later. To this end, the provision of suitable messages and sound bites for the Chief Executive Officer to use is an extremely effective tool; explain the benefits to be gained from risk management; emphasise the benefits that will appeal to them (better / easier decision making, more effective meetings, better measurement); show them the benefits that others are enjoying, especially competitors; build on what already exists. Enhancement and adaptation of what already exists is almost always more palatable and easier to buy in to than wholesale change. Be prepared to recommend such change if that is the right thing to do; make appropriate staff accountable for risks, for controls, for action plans and link it to performance appraisal and reward; and get risk management mentioned in the organisation business plan, and annual report and accounts as something the company supports and does.
involve lots of people at all stages of the risk management cycle, including objective-setting, risk identification and risk and control self assessment; risk must become part of day to day activities and core processes. Every project, business plan and workstream must include considerations of the risks involved and the risks they are addressing; risk management is not something that can be done effectively by the risk manager or risk management department in isolation. The risk manager should identify, harness and build on the expertise that exists within the organisation. There is a dual benefit to be utilised: people in the organisation (rather than the risk manager) know the business best. They are therefore in the strongest position to have the appropriate answers, therefore benefiting risk management; those people in the organisation therefore feel involved and have a better understanding of what risk management is and how it is part of their responsibility.
encourage people to manage their own risks, with risk managers acting as a support mechanism; document and communicate risk management roles and responsibilities; include risk management in personal objectives; develop risk-based recognition and reward initiatives; recruit on attitude as well as experience; written code of ethics to reinforce values.
Failure to achieve these will result in people acting against the stated aims of the organisation, confusion, wasted effort and unnecessary conflicts. It is important that everyone is pointing in the same direction, and that the direction is the right direction.
Section 12 Risk culture Practical tips on how to develop and maintain training and awareness: include risk management objectives in department and personal objectives, appraisal, pay & rewards; questionnaires can be used to assess level of awareness and understanding, and also act as an advertisement, raising the profile of risk management; training is tailored to specific needs of departments, teams, individuals. Training must be ongoing, not just one-off. There is a need to keep training programs up to date with developments (and new recruits); encourage, and create opportunities for, training and development; reference sources (library, bulletins / newsletters, briefing notes, risk champions, etc.). Not only should some or all of these be in place, but everyone should know where to find it and who they can turn to for advice and support; if appropriate, develop risk management pages on the local intranet; encourage the use of role models as ambassadors for risk management and culture change; recognise that there is a wide range of perceptions about risk. Individual psychology, past experience, individual risk appetite, organisational roles and group dynamics influence peoples perceptions and decision-making with respect to risk; user groups, and local experts or risk champions may be helpful; and develop a dedicated risk management helpline, as this may also be useful.
Communications
regular communications keep everyone informed of developments, but also serve as a gentle reminder, keeping risk management from slipping to the back of peoples minds; encourage and facilitate meetings, seminars, workshops; ensure that risk is an integral part of Board agendas; communicate expectations of individuals and departments with respect to risk; agree and publish a risk assessment and reporting timetable; develop and communicate escalation procedures for risk issues; commonly agreed and understood terminology and language should be published, communicated, publicised and readily accessible. This facilitates clear communications and helps to minimise confusion and misunderstanding; ensure constancy and consistency of approach, i.e. it is seen and experienced over and over again; and a risk manager can help draft communications for other individuals and departments that include key messages on risk.