Operational Risk on Everyone

1
Operational Risk on Everyones Desk The RADAR
System
Operational Risk June 2002
2
OR Clients Services
Page 1
3
Control Management Process
Page 2
4
Value Added Program
OR Committees
Risk Advisory
Self-Assessment
Loss Data Collation
KRI Reporting
Proactive Value-Added Reactive Passive
Potential Loss
Audit Follow-Up
Project Sign-Off
Data Repository
Status Report
Data Intensity
Page 3
5
System Architecture
Page 4
6
Process Model
We must have a consistent framework the data
model is the risk map
Page 5
7
Participation
What is a loss ? Theres no debate once it is
internally owned and authorised
RADAR Workflow Principles

• ? Errors Loss Data
• Anyone in the bank can identify an incident
• Investigation requires specialist control
  groups
• 3 managers as a minimum sign off each incident
  
• Email notification and senior management
  alerts
• Validation routing managed by control groups
• Risk Indicators ?
• Central KRI specifications, also some user
  defined
• Any department can establish its own reporting
  stream
• Newspaper style workflow reporters, editors,
  readers
• Anyone can write an OR Report for their user
  rights

Page 6
8
Categories
What is a loss ? We need a lot of descriptive
fields around the basic categories

• Errors and Loss Data
• fully parameterisable, multi-entity,
  multi-lingual, local views naming
• direct/indirect loss effect types,
  multi-select, entered by investigator
• causal reason codes, primary/secondary,
  entered by error owner
• causal process point, expected/unexpected,
  entered by error owner
• recoveries, contributing parties, entered by
  authoriser
• Basel event categories, mapped by system,
  checked by validator
• error accounts, cost centres, control process,
  checked by validator
• online help and support facility
• Risk Indicators
• shared parameters/categories with loss
  platform
• volume, exception, risk exception, error
  measures
• multiple measure types count, value,
  duration, score
• mandatory/optional data fields, high/med/low
  criticality
• control processes, function reported by and
  reported for

RADAR Parameters
Page 7
9
Functionality
No-one uses a system unless theres something in
it for them

• Errors and Loss Data Multi-Currency PL
  Calculations ?
• Cash Equity buy/sell amount and price
• Cash Bonds as above plus interest accruals
• Equity-Linked as above plus conversion
  ratios
• Futures and Options as above plus commission
• Interest Claims and Funding
  rate/daycount/amount
• Freeform pl multiple effect types, user
  notes, attach file
• Risk Indicators Data Management ?
• Product/Process/System Mapping by KRI, org
  unit, location
• Multidimensional data entry and bulk data
  upload
• Data Locking and submission management
• Issues and action management

RADAR User Tools
Page 8
10
Reporting
Its all about risk awareness .. if we can just
put Operational Risk on everyones desk

• ? Errors Loss Data
• Incident Search and data feed facility
• League table reporting with incident drill
  down
• Advanced power user reporting and data extract
• Simple graphing and data analysis via data
  extract
• ? Risk Indicators
• Report templates including scorecard style
• Measure/issue selection incl. prior
  period/benchmarks
• Editable draft reports with OR commentary
  facility
• HTML PDF reports, data trending/graphing/dril
  ldown
• Integrated reporting of KRIs, loss data and
  self-assessment

RADAR Reporting
Page 9
11
Loss Data Appendix Screenshots
Operational Risk June 2002
12
Loss Categorisation
Causal Categories Sample Loss Effects
Direct Cost Indirect Costs
Lost Clients/Deals, Damaged Reputation, Cost
to Rehire/Lock-in Corporate Memory Loss, Failed
Initiatives, Staff Morale, Ongoing
Ability to Rehire One-off Developer/Support
Costs Business Disruption, Damaged
Reputation, Opportunity Cost of
Management Time/Focus Asset/Facility
Replacement Costs Project
Write-downs, Write-offs Opportunity Cost of
Management Time/Focus Trading
Errors Funding Costs Regulatory Risk,
Reputational Damage Penalties/Fines
Cost to Cover Supply Failure Business
Disruption, Regulatory/Reputation Risk
Asset/Facility Replacement Costs Business
Disruption, Damaged Reputation
Human Capital
IT Applications
Infrastructure
Management
Procedures Controls
External Services
External Damage
Page 11
13
Loss Data Workflow
Loss Data Workflow
Stage Owner
Stage Description

• Form Originator at Control Process Point

• Enter basic incident details
• Can be entered by any RADAR user
• Details passed to central control group

• Restricted Access Control by independent
  function
• Fin Control
• Risk Control
• Ops Control

• Investigation validation of incident details
• Independent calculation of profit/loss impact
• Allocation of error to an Owner

• Incident Owner e.g. trader, salesman, officer

• Review incident details
• Explain causes of error
• Accept nominate authoriser

• Level 1Desk Head
• Level 2 Head of Trading
• Level 3 Head of Business

• Review incident details comment
• Sign off on validity of incident
• No of authorisers dependent on size

• Restricted Access Investigator or other members
  of Control Group

• Validation of incident categorisation
• Validate correct authorisation level

Page 12
14
Main Menu
Page 13
15
Online Help Support
Page 14
16
Parameterisation Control Groups
Page 15
17
Parameterisation Loss Categories
Page 16
18
Identify
Page 17
19
Investigate Cash Equity
Page 18
20
Investigate Interest Claim
Investigate Interest Claim
Page 19
21
Investigate Funding Details
Page 20
22
Investigate Freeform PL
Page 21
23
Owner Accept
Owner Accept
Page 22
24
Authorise
Authorise
Page 23
25
Management Alerts
Page 24
26
Validate
Page 25
27
Routing, Void, Reassign
Page 26
28
Multi-Entity
Page 27
29
Search
Page 28
30
League Table Reporting
Page 29
31
Advanced Reporting
Page 30
32
Loss Data Reports
Loss data can be analysed against any of the
dimensions of the RADAR Process Model
Page 31
33
KRI Appendix Screenshots
Operational Risk June 2002
34
KRI Categorisation
Causal Categories Sample Key Risk
Indicators Volume Exception Risk
Exception Staff Key Leavers/Joiners Discipl
inary Cases Systems Helpdesk Calls
Downtime Duration Enhancement
Requests Change Releases System
Bugs New/Deleted Accounts Firewall Changes
Policy Breaches Servers System
Dependencies Firecalls Premises
Capacity Occupancy Rate Engineering
Incidents Projects Milestones
Missed Scrapped Projects Decisions
Announced Decisions Pending Negative
Media/Press Audits Conducted Audit
Issues Overdue Issues Trade
Volumes Current Breaks Breaks gt30
days Exposure Limits Limit Breaches Managed
Positions Stat/Reg Reports Targets
Missed Restated Reports Ext
Suppliers SLAs Outstanding SLA
Breaches Firewall Traffic Firewall
Alerts Virus/Hacker Attacks Physical
Exposure BCP Invocations Insurance
Claims Indemnity Exposure Complaints/Investig
ations Lawsuits
Human Capital
IT Applications
Infrastructure
Management
Procedures Controls
External Services
External Damage
Page 33
35
Risk Indicator Workflow
Risk Indicator Workflow
Access Rights
Stage Description

• OR Editors

• Define/set up new mandatory/optional KRIs
• Classify measure or issue type and nature
• Associate products, processes, org units

• OR Editors

• Define submissions for functions/locations
• Assign KRI submissions to reporter groups
• Raise/manage submissions for time periods

• Reporter Groups

• Enter data individually or via bulk upload
• Enter commentary/issues and criticality
• Lock data submissions once complete

• Editor Groups

• Produce OR reports and scorecards
• Select optional data and issues
• Add or edit OR commentary

• Reader Groups

• Receive/read reports
• Query and drill down capability

Page 34
36
KRI Set Up
KRI Set Up
Page 35
37
Process Mapping
Page 36
38
KRI Submissions
KRI Submissions
Page 37
39
Submission Details
Page 38
40
KRI Data Entry
KRI Data Entry
Page 39
41
Multi-Dimensional Data Entry
Multi-Dimensional Data Entry
Page 40
42
Bulk Data Entry
Bulk Data Entry
Page 41
43
Issues Actions
Issues Actions
Page 42
44
Manage Submissions
Page 43
45
Report Templates
Page 44
46
Report Writing
Page 45
47
Measures Selection
Page 46
48
Review Edit
Review Edit
Page 47
49
KRI Reporting
KRI Reporting
Page 48
50
Data Drilldown
Page 49
51
Integrated Reporting
Actual loss risk indicator data validate
self-assessment loss estimates KRI benchmarks
KRI Benchmarks Self Assessment Loss Estimates
Actual Monthly RIsk Indicators Loss Data
Page 50