Operational Risk Governce Good
Operational Risk Governce Good
Operational Risk Governce Good
Випуск 38
УДК 336.71
O. B. Afanasyeva, Ph. D. in Economics,
D. O. Riabichenko, Ph. D. student,
Ukrainian Academy of Banking of the National Bank of Ukraine
This paper analyses key documents of Basel Committee which concern operational risk
governance and identifies the interconnectedness between risk source, type of the event leading
to losses, loss type and its distribution by business lines. The comparative characteristic of the
main operational risk governance stages is provided and the relationships between governance
bodies are overviewed.
Keywords: operational risk, corporate governance, Basel Committee on Banking
Supervision, board of directors.
Problem statement. Due to financial crisis events in recent years the
successful operation of financial institutions in rapidly changeable circumstances
depends on the ability to appreciate correctly and assume risks. Risk governance
that has always been pressing became so called “problem of today”. In this light
the Board of Directors and bank’s management take the responsibility for active
promotion of changes in the corporate culture that helps to consider decision
concerning risk-taking and risk appetite measuring.
The other important issue applies to organization of risk governance in the
bank in the most effective way. In accordance with Basel Committee Principles for
Enhancing Corporate Governance (dated 2010) this function is recommended to be
referred to Chief Risk Officer (CRO). This executive is supposed to be
independent and have interaction with other chief executives, including
communication with the Board of Directors. So, it explains the necessity of
definition of effective organizational system of CRO subordination to the CEO and
Board, and also link startup between corporate governance and risk governance
inside the bank.
Not in question the fact that operational risk factors have rising influence on
banking performance. Thus, frauds, human errors, omissions or sabotages can
seriously lessen bank profits and blacken image. Corporate governance of the
bank should be focused on identification, warning and non-admission of reaching
destructive level operational risk by means of having an influence upon
processes, technologies and people. These are the main sources of considered bank
risk.
Operational risk has emerged as top priority for financial institutions in recent
years. This is partly due to an increasing emphasis by supervisory authorities who
are pressing for increasingly stringent regulations and more punitive measures for
non-compliance. It is also due to the clear evidence of the harm that non-
compliance can do to a company’s reputation.
Electronic copy
Electronic copy available
available at:
at:https://ssrn.com/abstract=2538612
http://ssrn.com/abstract=2538612
Збірник наукових праць. 2014. Випуск 38
52
Electronic copy
Electronic copy available
available at:
at:https://ssrn.com/abstract=2538612
http://ssrn.com/abstract=2538612
Збірник наукових праць. 2014. Випуск 38
The January 2012 issue of the Operational Risk & Regulation magazine
mentions a list of the top ten loss events for financial services companies in 2011,
based on information from SAS OpRisk Global Data (Table 1).
Operational risk value has considerably increased lately under the influence
of financial markets globalization, development of IT in banks – enhancement of
electronic calculations systems, remote customer service and interbank
information communications. Operational risks became the reason of the loudest
scandals in the financial world. Systematizing of such categories as a risk source,
type of the event leading to losses, and loss type is presented in Figure 1.
53
Asset Management
Legal Liability
Employment Practices and Workplace Safety
Loss of Damage to Assets
Service Levels
Damage to Physical Assets
Foregone Income
Implicit
According to Basel committee approach there are four major sources of risk:
people, systems, processes and external factors. In case of “white stains” in
operational risk management, interaction of this sources leads to generation of
events which may cause increase of losses in case of their realization. Types of
losses can be divided into measurable and non-measurable and should be
reallocated to corresponding business lines.
The operational risk is closely connected with other risks; particularly it is
capable to lead to large direct and indirect losses of bank with influence of market
risk and credit risk (Table 2).
54
So, the operating risk management problem is more actual first of all because
of existence of close connection between all of banks’ risks. When constructing the
organizational and functional structure it is necessary to consider integrated
approach of risk-management system in bank.
Basel committee recommendations are a directing vector for financial
institutions of the majority countries. As a result of the analysis, the basic
supervisor documents concerning management of operational risk have been
divided into 4 groups:
corporate governance issues;
general aspects and Basel I, II, III;
regulation of the AMA;
influence on the other aspects of banking activity.
Basel Committee on Banking Supervision throughout long time works over
development of appropriate methods of corporate governance in banking sector.
The first document has been published in 1999, and in 2006 it has been reviewed
and republished in the form of Principles [3] which, in turn, are formulated on a
basis and in development of the document of Organization for Economic Cooperation
and Development in edition of 2004 [11].
In the Basel committee document (2006) key aspects of corporate
governance had been formulated:
the board of directors should actively participate in the statement of
strategy of the credit organization;
authority division must be set up and maintained clearly;
policies of remuneration payment should correspond to long-term
objectives of credit organization;
adequate risk management in case of insufficient transparency of credit
operations must be provided.
Since publication of these recommendations a number of cases of deviation
from Principles of effective corporate governance had been revealed. Many of
these cases were visually shown during financial crisis which has begun in 2007.
It is necessary to admit inappropriate control on activities of executives from
board of directors, inappropriate risk management, deliberate complication or
55
56
Monitoring and Reporting (1), Control and Mitigation (1), Business Resiliency
and Continuity (1)), Role of Disclosure (1).
The document “Operational risk transfer across financial sectors” [8] issued
in August 2003 puts on practical aspects of management and includes such basic
elements as definition of the term, events that lead to losses (Internal fraud,
External fraud, Employment practices and workplace safety, Clients, products and
business practices, Damage to physical assets, Business disruption and system
failures, Execution, delivery and process management). It can be stated that
recommendations from this document have been included to Basel II soon. The
Accord defines operational risk as “the risk of loss resulting from inadequate or
failed internal processes, people and systems or from external events” [5]. Basel II
gives special place to operational risks because they position the 2nd place by the
amount of losses in the activity of European banks between credit (1 st place) and
market (3rd place) risks. Considering this, the document reasonably recommends to
deal operational risk as an individual risk category that should be maintained by the
definite amount of bank equity capital called “economic capital for operational risk”.
The document includes recommendations concerning methods of capital assessment
for operational risk (BIA, TSA (ASA), AMA) and appropriate criteria for these
methods.
One must admit that Basel III (December 2010) did not introduce innovations
into operational risk management: banks are still recommended to be guided by
prior approach.
The most absolute method in this context is AMA. Its application gives to
banks definite level of latitude and flexibility, but at the time with the aim of
trespasses or abuses non-admission Basel Committee has issued a number of
significant papers regulating the AMA implementation.
The last group of Basel Committee documents in the area of operational
risk is related to its impact on the other spheres of banking activity: FX
transactions (“Supervisory Guidance for Managing Settlement Risk in Foreign
Exchange Transactions” (September 2000), updated consultative version was
published in August 2012 – “Supervisory guidance for managing risks associated
with the settlement of foreign exchange transactions”), outsourcing (“Outsourcing
in Financial Services” (February 2005)), business continuity (“High-level
principles for business continuity” (August 2006)).
This group of documents is not aimed at direct control of operational risk, but
contains implicit recommendations to its governance. The fact of existence of this
type of papers confirms the hypothesis that bank risks don’t appear singly and
are inseparably linked both between each other, and with other aspects of
banking activity. That is why, the complex approach to bank risks governance is
the only effective way out.
Mechanism of operational risk governance is a set of stages and procedures
implemented sequentially to reach defined aims. Although the list of stages differ
among different approaches (Table 3), it must be admitted that differences are
evoked by tasks of scientific investigation, but the essence is common.
57
58
Bodies
of defence
First line
CEO CRO
Governance
59
Exchange Listed Company Manual or other applicable law and includes absence
of management or financial responsibility, absence of any privileges concerning
deposit, loan, investment or other activity within the bank or its subsidiaries.
Risk Committee is responsible for reviewing bank risk governance strategies
and procedures, and providing suggestions to the Board of Directors; reviewing the
bank’s major operational risk activities; monitoring the implementation of the
bank’s risk governance strategies and procedures; regularly assessing the duty
performance of risk management and internal control by the senior management
and departments of the bank, including regularly hearing their reports and
requesting improvements; monitoring compliance with operational risk-related
regulatory requirements.
In a number of financial institutes in a structure of Board of Directors there is
Audit Committee responsible also for risk oversight. It substitutes Risk Committee
in governance of financial risks, so the point is that it is also important for
providing effectiveness of banking activity to account and supervise all types of
risks, but not only financial. That explains the actuality of Risk Committees in
the Board.
Chief Risk Officer (CRO) stands for senior executive with the primary
responsibility – risk governance and elaboration of risk management strategy. CRO
regularly presents the report to the Board of Directors that sums up the problems
and perspectives concerning risk dealing. CRO carries out operational risk oversight
activities (which cooperate closely with other risks supervision) to maintain a
strict risk control and to help ensure that risk capital is enforced wisely.
The analysis of the main trends of improving CRO activity especially after
global financial crisis allows us to define the following requirements for
enhancement of risk framework within banking institutions:
1. Reporting of the CRO to CEO and directly to the Board. Figure 3 presents
the most common ways of CRO subordination. According to
investigations banks perform significantly better in the financial crisis.
II. CRO → CFO About 28–30 % of executives primarily responsible for risk
2. The fulfillment of previous issue enables the access of the CRO to the Board
of Directors. This factor promotes decision-making process, shortens time
for important tasks implementation in crisis periods.
3. CRO should have specific set of skills that includes sufficient experience and
qualifications, banking market and product knowledge, mastery of risk
60
61
8. Operational risk transfer across financial sectors [Electronic resource] // Basel Committee
on Banking Supervision. – 2003. – Access mode : http://www.bis.org/ publ/joint06.htm.
9. Principles for enhancing corporate governance [Electronic resource] // Basel Committee
on Banking Supervision. – 2010. – Access mode : http://www.bis.org/ publ/bcbs176.htm.
10. Principles for the Sound Management of Operational Risk [Electronic resource] // Basel
Committee on Banking Supervision. – 2011. – Access mode : http://www.bis.org/
publ/bcbs195.htm.
11. Principles of Corporate Governance [Electronic resource] // OECD. – 2004. – Access mode :
http://www.oecd.org/dataoecd/32/18/31557724.pdf.
12. Risk Governance at Large Banks. Have Any Lessons Been Learned? [Electronic resource] //
Moody’s Investor Service. – 2010. – Access mode : http://www.garp.org/
media/58854/riskgovernanceatlargebanks_01182010.pdf.
13. Risk Management for Electronic Banking and Electronic Money Activities [Electronic
resource] // Basel Committee on Banking Supervision. – 1998. – Access mode :
www.bis.org publ bcbsc215.pdf.
14. Risks in Computer and Telecommunication Systems [Electronic resource] // Basel
Committee on Banking Supervision. – 1989. – Access mode : http://www.bis.org/
publ/bcbsc136.htm.
15. Robinson S. Effective management of operational risk / S. Robinson, J. Rowland // Financial
Services. – 2006. – № 2. – Р. 10–13.
16. Sound Practices for Management and Supervision of Operational Risk [Electronic resource]
// Basel Committee on Banking Supervision. – 2003. – Access mode :
http://www.bis.org/publ/bcbs96.htm.
17. Tattam D. A Short Guide to Operational Risk / D. Tattam. – London : Gower Publishing,
2012. – 256 p.
18. Thonabauer G. Operational Risk Management G. Thonabauer, B. Nösslinger. – Vienna :
Oesterreichische Nationalbank, 2006. – 115 p.
19. Wahler B. Process-Managing Operational Risk: Developing a Concept for Adapting Process
Management to the Needs of Operational Risk in the Basel II-Framework / B. Wahler // Risk
Management Journal. – 2012. – № 4. – Р. 45–54.
20. Моделювання оцінки операційного ризику комерційного банку монографія [О. С.
Дмитрова, К. Г. Гончарова, О. В. Меренкова та ін.] ; за заг. ред. С. О. Дмитрова. – Суми
ДВНЗ “УАБС НБУ”, 2010. – 264 с.
Отримано 30.08.2013
Анотація
У статті проведено аналіз основних документів Базельського комітету,
що стосуються управління операційним ризиком, та визначено взаємозв’язок
між джерелами ризику, типами подій, що призводять до втрат, і розподілом
цих втрат за бізнес-напрямками. Наведено порівняльну характеристику етапів
управління операційним ризиком та охарактеризовано взаємозв’язки між
суб’єктами управління.
62