CHAPTER 3
The Operational Risk Framework
This chapter introduces the important elements that are recommended for an operational risk framework. These elements include the foundations of governance, risk appetite, culture and awareness, and policy and procedure; the building blocks of data collection including loss data, risk and control self-assessment, scenario analysis, and key risk indicators; and the final capstones of calculation of capital and reporting.
OVERVIEW OF THE OPERATIONAL RISK FRAMEWORK
As discussed in Chapter 1, an operational risk program should ensure that operational risk is identified, assessed, monitored, controlled, and mitigated.
If a fintech or bank can successfully establish and maintain these elements, then it has the opportunity to avoid unnecessary operational risk and its resulting financial and reputational damage.
The Basel Committee on Banking Supervision's 2021 “Revisions to the Principles for the Sound Management of Operational Risk”1 provides helpful guidelines for best practices for operational risk departments. When meeting these standards, an operational risk framework needs to be developed that will fit with the culture of the bank or fintech and reflect best practice in the industry.
The main data building blocks of an operational risk framework are:
- Loss data collection.
- Risk and control self-assessment.
- Scenario analysis.
- Key risk indicators.
FIGURE 3.1 Operational Risk Framework
The framework must also address governance, provide policies and procedures, drive culture change, and respond to and inform risk appetite. In addition, the framework should feed data into any capital modeling and should feed data and analysis into risk reporting.
Figure 3.1 illustrates a possible framework that includes all of these elements.
Each element is important, but the timing of implementation and the relative weight of each element in the framework will vary depending on the culture of the firm and its regulatory and business drivers. The following chapters will consider each of these elements, their practical application, the tools that are available, and critical factors for their successful implementation.
THE FOUNDATIONS OF THE FRAMEWORK
Two elements drive the design and acceptance of the operational risk framework as a whole, and it is important to start with these. These two elements are governance and culture and awareness.
Governance
Governance determines the roles and responsibilities of the head of the operational risk function and the team that manages the framework, the committees that oversee and make key decisions about risk management, the operational risk managers in lines of business, and every employee who may encounter operational risk.
In order to develop an operational risk framework that is effective, an appropriate governance structure must be carefully considered at the outset. Governance should also be revisited at least annually, to check whether it is still working as intended. Good governance enables the escalation of risk and ensures that risk transparency is effective through all of the layers of operational risk management that may exist.
Governance holds the whole operational risk framework together. In Chapter 4 we explore the various aspects of governance, including who should own the operational risk function and what the operational risk function should own.
Culture and Awareness
Once governance has been addressed, the next step in developing an operational risk framework is to proactively tackle culture and awareness. While it may be tempting to jump into developing the building blocks of operational risk management, such as loss data collection and risk and control self-assessment, those building blocks will only be successful if sufficient time and energy has been spent on culture and awareness.
The implementation of a successful operational risk framework requires winning over the hearts and minds of the employees of the firm. Spotting operational risks is a developed skill. While the risks exist in all lines of business, it takes the right tone at the top, training, and awareness to identify the risks. Operational risk can arise in any corner of the firm, and it can result in best practice responses, or it may be met with indifference. The response will depend on the work that has been done in the area of culture and awareness. In Chapter 5, we look at various aspects of this essential activity, including training, marketing, and building a brand for the operational risk function.
Policies and Procedures
The next foundational element of the framework is policies and procedures. There was a time, not that long ago, when banks and financial institutions did not take their policy and procedure programs very seriously. Today, that has changed dramatically under the watchful eye of the regulators. Firms are expected to have clear, actionable, and measurable policies and procedures.
Indeed, today all banks pay close attention to writing and actively managing their policies and procedures, and regulators expect a robust policy and procedure framework to be in place. While formal policies and procedures are less well established in fintechs, there is a growing emphasis on these formal documents, and they are often required from investors and third parties during due diligence.
A well-managed policy framework allows lines of business increased flexibility because the rules of the road are clearly articulated and are not ambiguous. Having well-managed policies and procedures gives a financial firm increased autonomy because it is influential in building trust with industry regulators. A good operational risk framework will have well-documented policies and procedures that reflect the requirements of each of the elements.
In Chapter 6, we look at examples of standard policies and procedures and discuss best practices in how to design, implement, maintain, and track these documents.
THE FOUR DATA BUILDING BLOCKS
With governance, culture and awareness, and policy and procedures holding the framework together, we can now turn to the four main pieces of work that are needed in order to have an effective operational risk framework: loss data collection, risk and control self-assessment, scenario analysis, and key risk indicators.
Loss Data Collection
Two types of loss data are key to the framework: internal loss data, which occurs within the firm, and external loss data, which occurs outside the firm.
Internal Loss Data
Operational risk management and measurement require access to data on events that have already occurred in the firm and in the industry, and loss data collection is the first of four activities that form the heart of an operational risk framework. The firm's own data is referred to as internal loss data, while industry data is referred to as external loss data.
Developing an effective set of internal loss data is often the first major task faced when building out an operational risk framework. Basel III requires a firm to build its capital calculation from its internal loss profile. Therefore, loss data collection needs to be effectively established to ensure that good-quality data is in place.
If loss data collection is started before appropriate governance is established and before culture and awareness have been addressed, then the data collected is likely to be lower quality.
We look into regulatory requirements and best practices in internal loss data collection in Chapter 7.
External Loss Data
Operational risk events that have occurred in the industry (but outside the firm) are very important in understanding the operational risk faced by the firm. Therefore, the collection and analysis of external loss data is a key element in an effective loss data program.
External data help inform risk and control self-assessment and scenario analysis and are often an important component in effective reporting.
We look at sources and uses of external loss data in Chapter 8.
Risk and Control Self-Assessment
The second of the four main building blocks of operational risk management activity is risk and control self-assessment (RCSA). Risks and controls are identified and assessed through RCSA, with a view to controlling and mitigating any unacceptable risks.
While loss data tells us what has already happened, RCSA is designed to help us to understand what additional potential risks we face today. Loss data are backward-looking, but RCSA looks at risk levels now and in the future.
RCSA often becomes the most important part of the framework because it proactively addresses the requirements that we first looked at in Chapter 1. Those requirements are that the operational risk framework should identify, assess, control, and mitigate risk.
While loss data allow us to identify and assess risks that have occurred and to consider how to control and mitigate those risks in the future, RCSA allows us to identify all risks, not just those that have already materialized. Loss data is about hindsight. Risk and control self-assessment is about foresight. In Chapter 10, we look at various methodologies and best practices for RCSA.
Scenario Analysis
The third activity in the framework is scenario analysis. Unlike risk and control self-assessment, scenario analysis is only looking for rare, catastrophic risks. It is focused on identifying plausible risks that are so large as to be potentially fatal or severely destructive to a firm.
Scenario analysis stresses the operational risk framework and pushes participants to think outside their comfort zone. RCSA centers on discussions of the risks that are faced and the controls that are in place, whereas scenario analysis requires participants to consider what could happen if there were to be a serious failure of controls or a previously unassessed combination of risks.
Scenario analysis is a challenging area, and was a key element in the Basel II AMA capital calculation approach. Many firms struggled with meeting the AMA regulatory requirements while retaining business value in the process. The simplification of capital calculation in Basel III removed scenario analysis from the calculation, and it is now used as risk management tool rather than as a capital input. We look at alternative approaches to scenario analysis and the uses of scenario analysis in operational risk management and measurement in Chapter 11.
Key Risk Indicators
The final building block of operational risk data gathering are key risk indicators. Operational risk practitioners sometimes use the terms key risk indicator and metric interchangeably; however, understanding the difference between a metric and a true key risk indicator is important. Metrics provide an important monitoring function across the framework: they can be attached to loss data and to risks or controls in RCSA and can provide useful input to scenario analysis.
A key risk indicator, in comparison, predicts that a risk is changing and allows for proactive intervention. It is difficult to find metrics that are true key risk indicators or that can be combined to form a key risk indicator, because many metrics are simply counting exceptions or measuring performance, rather than measuring an increase or decrease in risk levels. We consider the challenges of developing key risk indicators in Chapter 9, where we also discuss best practices in metrics.
MEASUREMENT AND MODELING
The calculation of operational risk capital is a critical element in the operational risk framework. Under Basel III the operational risk capital requirement is determined by the product of a business indicator component (BIC) and an internal loss multiplier (ILM). The BIC is dependent on the size and complexity of the bank and the ILM is based on the internal loss experience of the bank. However, the original Basel II capital methods are still in place at the time of this writing, and the various capital calculation approaches are discussed in Chapter 12.
REPORTING
All of the above elements feed into operational risk reporting. Without effective reporting, the operational risk framework is a factory that is busy making data widgets that are not used. Reporting gathers all the information that has been collected and analyzed in the loss data program, the RCSA program, the scenario analysis program, the metrics program, and the capital modeling program and puts it to use.
The quality of reporting is critical to the success of an operational risk framework. Reporting that leaves its audience asking “so what?” is of little value. Reporting that asks its audience to think or say or do something is of great value.
In Chapter 13, we explore ways to provide reporting that is not merely data gathering, but instead provides risk analysis and risk transparency and leads to better business decision making.
RISK APPETITE
Finally, the whole framework is held together by risk appetite. It is difficult, but not impossible, to express a risk appetite for operational risk. It often takes time for an operational risk framework to mature to the stage where risk appetite can be effectively discussed and agreed upon.
While governance is the first pillar or support for the framework, risk appetite is its equal partner. Effective governance requires a clear articulation of risk appetite, and risk appetite can be set only when strong governance is in place. In Chapter 14, we explore ways that a risk appetite can be set and applied for operational risk.
KEY POINTS
The main building blocks of an operational risk framework are:
- The foundations
- Governance
- Culture and awareness
- Policy and procedure
- The four data elements
- Loss data collection, including
- Internal loss data
- External loss data
- Risk and control self-assessment
- Scenario analysis
- Key risk indicators
- Loss data collection, including
- The key outputs
- Measurement and modeling
- Reporting
- The framework operates under the firm's stated risk appetite.
REVIEW QUESTIONS
- Which of the following is least likely to be part of an operational risk framework?
- Loss data collection
- Risk and control self-assessment
- Counterparty credit assessment
- Scenario analysis
- Which of the following is the best description of a robust operational risk framework?
- It collects all operational risk losses that occur within the firm.
- It provides effective tools to identify, assess, control, and mitigate operational risk.
- It produces a capital calculation of operational risk.
- It is based on a framework that has been successful at another firm.
NOTE
- 1 Risk Management Group of the Basel Committee on Banking Supervision, “Revisions to the Principles for the Sound Management of Operational Risk,” March 2021. Retrieved from www.bis.org/bcbs/publ/d515.pdf.