Managing Operational Risk Within Your Treasury Environment

1
Managing Operational Risk Within Your Treasury
Environment
2
AGENDA

• General points
• Impact of modern risk transfer
• Proven techniques to control and assess
  operational risk
• Objective approach to managing operational risk
• Exploiting operational VaR

3
Why is Operational Risk a hot topic?

• It is still the risk responsible for the most
  spectacular bank failures
• Barings Index futures
• Natwest Incorrect volatilities used to value
  cap portfolio
• AIB Forex trading
• What do they have in common?
• Treasury activities
• Failure is mostly due to operational risk

4
Operational Risk What is it?
Basel Definition
Operational risk is the risk of direct or
indirect loss resulting from inadequate or
failed internal processes, people and systems or
from external events
5
Where does Operational Risk occur?
Derivatives Desk Transaction
After Deliver Product
Before Identify client need
During Structure Transaction
Risk Model Risk Business Continuity
Risk Model Risk Disclosure Legal
Risk Intellectual Capital Key People
Fraud, Processes People, Technology
Reputational
6
AGENDA

• General points
• Impact of modern risk transfer
• Proven techniques to control and assess
  operational risk
• Objective approach to managing operational risk
• Exploiting operational VaR

7
The Trend

• Moving from prevention to active management
• Tools and technology exist to transfer unwanted
  risks to other counterparties
• Interest rate derivatives
• Credit derivatives
• Innovative insurance products using derivatives

.
8
Implications
Risks are intertwined
.

• If the primary objective is to take and manage
  market risk
• Incur credit risk (counterparty risk)
• Incur operational risk (model risk, fraud etc.)

9
Why does the use of derivatives or structured
products increase the operational risk of my
business?

• Characteristics of these OTC products are
  described legal documents/contracts
• Pay-off may be linked to external events
• Share prices, Bond Prices
• Default of a third party
• Complex mathematical models are needed to value
  these instruments
• Skilled people for Administration and Risk
  management
• Appropriate IT solutions end-to-end is scarce

.
10
AGENDA

• General points
• Impact of modern risk transfer techniques
• Proven techniques to control and assess
  operational risk
• Objective approach to managing operational risk
• Exploiting operational VaR

11
Proven techniques for control and assess
Operational Risk Within the Company

• Internal audit
• Ensures the quality of risk processes
• Ensures compliance with internal policies
  procedures
• Compliance
• Ensures compliance of risk processes with
  external stakeholders such as regulators
• Straight -Through Processing
• Adequately skilled staff

.
12
Proven techniques for control and assess
Operational Risk - External

• Securities Exchanges
• Custody systems
• Electronic trading systems
• Settlement Systems

.
13
AGENDA

• General points
• Impact of modern risk transfer techniques
• Proven techniques to control and assess
  operational risk
• Objective approach to managing operational risk
• Exploiting operational VaR

14
Objective measures for all risks
To understand what a business most significant
risks are, all exposures must be expressed in
common terms, e.g., in Rands.
Whats my largest exposure?
Legal Risk
Fraud
15
Concept of Value-at-Risk

• An estimate of the level of loss on a portfolio,
  which is expected to be equalled or exceeded with
  a given, small probability.
• Measured in monetary terms
• Specific Time horizon
• Given level of confidence (99)

.
16
What is Operational VaR?
Operational Value at Risk (VaR) is the difference
between the annual aggregate loss at a selected
confidence level and the expected annual loss.
Distribution of losses for the bank
Expected Losses (included in costs)
Unexpected Losses (VaR)
Mean
Annual aggregate loss (R)
17
Categorisation of Operational Risk
Measure losses from operational risk events in
terms of six components, which include first and
second order losses.
Replacement Cost
direct losses
Legal
Total Operational Loss

Regulatory
Business
forgone income
Reputation
Business Interruption


18
Overview of the Statistical/Actuarial Approach
Operational VaR f (Exposure,
Relevance, Quality, Transfers)
Frequency of events
Adjusting for insurance programs
Mapping products / service to generic business
units
Mapping quality of control environment to peer
group
Severity of loss
The statistical/actuarial approach is based on
the theory that historical data can be used to
measure the full range of potential exposures
each business faces.
19
Internal Loss Data

• Significant commercial benefits
• Quantification of operational risk
• Development of management processes.
• How do I transform the raw data to make it
  useable?
• Convert to the banks currency,
• Adjust for inflation

20
Loss Data Matrix
Loss Data Matrix
11 1.2 0.6
54 2 3
11 1.2 3.6
21 3 6
21 0.4 0.3
18 0.2 0.4
11 1.5 4
31 2.2 2.6
70 2.4 4.1
The loss data are placed in a matrix which is
used to calculate the risk profile of each
business, i.e., the inherent exposure of each
business to each type of risk.
21
Severity
Probability
Size of Loss
Probability
Severity is initially assumed to follow a
Log-normal distribution (based on best-fit
analysis of existing loss data). In order to
calculate the severity distribution for a cell we
need to know the mean and standard deviation (the
parameters of the Log-normal distribution) of the
losses in each cell.
Size of Loss
22
Severity
Internal Loss Data Matrix
Transaction Processing
Criminal
Technology
No. of lossMean STD.
11 1.2 3.6
11 1.2 0.6

54 2 3
Retail Banking
1 0.2 0.4
21 0.4 0.3
No. of lossMean STD.
0
Commercial Banking
Anchor cell
11 1.5 4
No. of lossMean STD.
3 2.2 2.6
0
Trading
In most cases internal data is incomplete. One
can therefore use anchor cells - internal data
cells that appear to have a sufficient number of
small, medium and large losses and external data
relationships to populate cells that do not have
sufficient data.
To be populated by anchor cell(s) and external
data
23
Why use external loss data ?
External data is necessary here
Number of events
Size of loss
SMALL LOSSES - MANY INTERNAL DATAPOINTS
MEDIUM LOSSES - SOME INTERNAL DATAPOINTS
LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS
24
Frequency
Retail Banking
Frequency is assumed to follow a Poisson
distribution. Mean frequency for each cell is
calculated using a weighted average of internal
and external data.
25
Frequency
Retail Banking Criminal Frequency Distribution
Retail Banking Criminal Severity Distribution
Probability
Probability
Size of loss (R)
Number of events
The end result is a customized set of frequency
and severity distributions for each business
unit, for each risk category.

26
AGENDA

• General points
• Impact of modern risk transfer techniques
• Proven techniques to control and assess
  operational risk
• Objective approach to managing operational risk
• Exploiting operational VaR

27
Operational VaR Value Proposition

• Create objective measure
• Expected Losses (Cost of operational failure)
• Unexpected losses (Largest exposures)
• Provide framework for cost-benefit analysis
• Link controls to performance measurement
• Quantifying Operational Risk Capital
• Link to shareholder value
• Rationalise Insurance Programs

28
Sample Operational Risk Report
Private Banking
Retail Banking
Asset Management
Investment Banking
Trading Sales
VaR (000 )
UnauthorizedActivities
Sales Practices
Technology
Criminal
Management Processes
TransactionProcessing
Disasters
Unit Name
First Second Third Fourth
168 161 153 145
168 161 153 145
33 32 30 29
33 32 30 29
33 32 30 29
33 32 30 29
106 101 96 91
Disasters
Quality Score
UnauthorizedActivities
SalesPractices
Technology
Criminal
Management Processes
TransactionProcessing
Unit Name
First Second Third Fourth
50 60 75 90
50 60 75 90
50 60 75 90
50 60 75 90
50 60 75 90
50 60 75 90
50 60 75 90
18
Percent of Firm Capital
Risk Capital
82
29
VaR Comparison
VaR is primarily driven by low frequency, high
severity risks. Thus, some businesses which
experience high annual losses may have a
relatively low VaR.
Probability
Distribution of losses for Business Unit A
Distribution of losses for Business Unit B
99th percentile B
99th percentile A
VaR A
VaR B
Mean A
Mean B
Annual aggregate loss ()
30
RAROC
Calculate the operational risk capital needed in
RAROC processes.
Risk Adjusted Returns
RAROC
Capital for Unexpected Losses Credit Risk Market
Risk Insurance Risk Operational Risk
Medium
Probability
Low
10m
R1billion
Operational VaR


31
Cost Benefit Analysis
Tool to help a business cost justify investments
or risk transfers that will reduce operational
risks.
Issue
Trading and Sales Department considers
purchasing a new state-of-the-art computer
system for transaction processing. Cost R18.0
million
New
Net
Quality Score
Current
Estimate
Change
Unauthorized Act.
62
67
5
Sales Practices
64
66
2
Human Resources
36
38
2
Cost Benefit Analysis
Criminal
88
88
-
Management Prs.
54
55
1
VaR savings R36M Hurdle Rate
15 Annual benefit R5.4M VaR cost savings
Cost of New System over 5 years
R27M gt R18M
Trans. Processing
44
53
9
Disasters
67
68
1
Technology
68
74
8
External
75
75
-
Total Change
28
Capital
VaR Estimate
R378
R342
-R36

32
Insurance Analysis
Medium
Issue
Without Insurance
Whether to purchase a rogue trader insurance
policy with excess of R50 million. Cost
R0.8million
Probability
Low
50m
200m
1billion
Potential Loss
Cost Benefit Analysis
Medium
With Insurance
VaR savings R6.0M Hurdle Rate
15 Annual Benefit R 0.9M VaR cost
savings Cost of Insurance
R0.9M gt R 0.8M
Probability
Low
R50m
R 1billion
Potential Loss

Capital
VaR Estimate
R80
R74
-R6


33
The Challenge
pwc
34
Managing Operational Risk Within Your Treasury
Environment