Pdf a Review of the State of the Art in Quantifying Operational Risk

Welcome to Take a chance.internet'south almanac ranking of the tiptop op risks for 2020, based on a survey of operational run a risk practitioners across the earth and in-depth interviews with respondents.

Equally in years past, there'southward no bully secret to the methodology: Take a chance.internet'south team gets in bear on with 100 principal risk officers, heads of operational risk and senior practitioners at financial services firms, including banks, insurers, nugget managers and infrastructure providers, and asks them to listing their five most pressing op risk concerns for the year ahead. The results are then weighted and aggregated, and are presented in brief below and analysed in depth in 10 accompanying articles.

As before, the survey focuses on broad categories of take a chance concern, rather than specific potential loss events. The survey is inherently qualitative and subjective; the weighted list of concerns it produces should be read equally an industrywide attempt to relay and share worries anonymously, non as a how-to guide.

For a note on the touch on of the coronavirus, navigate to the last chapter, geopolitical take chances.

Equally ever, Risk.net invites feedback on the guide and its contents – delight send all views to tom.osborn [at] run a risk.net. Thank you for reading.

Profiles by Costas Mourselas, Steve Marlin, James Ryder, Alexander Campbell and Aileen Chuang. Editing by Alex Krohn, Joan O ' Neill and Tom Osborn.

1: It disruption

Click hither for full article and analysis

When customers are all of a sudden unable to access their coin because of a paralysing cyber attack or a critical IT systems failure, the consequences for a bank's profitability and reputation are clear.

Respondents to this year's Run a risk.net survey of peak op risks written report a two-pronged take a chance to systems and It operations. Offset, the threat from hostile hacking groups and even nation states laying siege to a banking concern'southward defences: alienation attempts but have to be successful once to sow widespread chaos. Second, banks must upgrade or patch ageing Information technology systems to stay competitive, and, in doing so, they tin can expose themselves to cyber attacks or adept old-fashioned outages.

"Whenever I talk to my cyber guys, they say the threats are evolving, becoming more than clear most where they target," says the group head of operational risk at a European bank.

In the face of increasingly sophisticated cyber attacks, the US Federal Reserve is mulling whether to compel financial firms to submit data on cyber incidents. Banks have traditionally been nervous near sharing information about cyber threats, and sources worry that information could leak out, painting a bullseye on other firms.

Some other target could be systemically important financial market infrastructure providers (FMIs) such as immigration houses and settlement providers, on which the functioning of many markets depends. The chief risk officeholder of ane of the largest FMIs tells Risk.cyberspace he spends almost of his fourth dimension worrying well-nigh non-default risks, and that he's "peculiarly worried" near risks stemming from cyber attacks.

In this year's survey, It failure has been considered alongside IT disruption, where last year the categories were considered separately. Although the drivers and adventure management of the problems are very different, the consequences – the loss of critical services leading to parts or all of an system being unable to function – end up looking much the same.

Both concerns also feed into resilience risk – debuting in fifth place this year – which considers the consequences of an outage or failure in the context of irresolute regulatory expectations around how and when a firm can return to operations, as well equally the consequences of that outage for other firms that depend upon its services, and the role it plays within the financial organization as a whole.

It failure specifically addresses the opportunity cost of declining to practise business concern and the consequences, including permanent impairment to a business firm's reputation, which tin final well into the hereafter.

2: Information compromise

Click here for total article and analysis

Sitting atop a trove of personal data, banks make tempting targets for hackers looking to make mischief, criminal rings out to collar data for cash, even cyber terrorists bent on holding banks to ransom.

While the operations and reputation of any bank swivel on accurate and secure data, the possibility of breaches, disclosure or destruction of data seems to exist growing. A handful of expensive and embarrassing incidents in the past year highlight the threat, with assailants relentlessly probing for chinks in depository financial institution cyber defences.

"The threats continue to evolve. You have an increased demand to be in forepart of it," says an operational hazard executive at a large North American depository financial institution. "We saw the big Upper-case letter One breach, and then information technology's certainly not going abroad."

Last July, Capital One, the U.s.a. credit menu giant, said a hacker had penetrated the bank'south firewall and got agree of the personal data of 100 million credit menu applicants as well equally 140,000 social security numbers and 80,000 bank business relationship numbers of existing credit card customers. The incident could cost Capital One equally much equally $150 meg in customer notifications, legal fees and technology upgrades, it said.

In this yr's Top 10, data management, a discrete category in previous top ten lists, has been folded into information compromise to form a unmarried topic. Although the causes and preventions are different – 1 requires protecting a firm'due south data from external malicious attack, the other the risks of mismanaging or mislaying data internally – the fiscal and reputational harm can be the same. Last twelvemonth, information management was eighth on the listing.

The risks are manifest: almost a twelvemonth ago, U.k. authorities fined Goldman Sachs and UBS millions for transaction reporting lapses, while Citi was penalised in the US for prudential reporting lapses. Data mismanagement underpinned all these cases.

3: Theft and fraud

Click here for total commodity and assay

Theft and fraud jumps to tertiary in this year's survey – a sign of both its ubiquity for fiscal institutions of all types, from the largest global lenders to eight-person hedge funds, and likely a function of its role in five of the 10 largest reported operational hazard losses of 2019.

Many of the most severe frauds reported last year, particularly in emerging markets, diameter a similar characteristic: namely, the aid of an inside operative working for a bank. That leads ane respondent to dub this just "insider run a risk". It was also the case for 2018's biggest fraud loss – an eye-watering $12 billion hitting for Chinese insurer Anbang.

Internal fraud incidents can also have a long tail. Wells Fargo's legacy losses relating to its 'ghost account' fraud scandal besides increased throughout 2019, with the total bill for settlements and restitutions already topping several billion dollars and counting – not to mention the long-term impact on the bank's op risk uppercase requirements.

Theft and fraud losses are too closely linked to the drive to automate processes and systems. A senior risk managing director at a global bank points out that automation of client authentication, for case, gives criminals the chance to use stolen data to fool robot gatekeepers.

"The situation [with automation] is improving, but the threats are increasing. It's similar the two sides are growing together," says the risk manager.

While the march of progress may produce all sorts of convoluted, tech-axial crime, naturally theft and fraud can even so take place in a more than mundane fashion. Before this month, Citi was widely reported to take suspended a senior bond trader after he was accused of stealing food from the business firm's canteen in London.

four: Outsourcing and third-political party gamble

Click here for full article and analysis

Big banks take decided there are many things it is not worth their while to practice in-house. So they contract them out. And that has birthed a whole new anxiety: third-party risk, or the possibility of getting trunk-slammed by bug at a vendor – cyber infiltrators, ability failures and disreputable behaviour among the most common.

And then at that place are the vendor's own third-party vendors. At that bespeak, third-political party gamble splits into quaternary-, fifth-, etc, -party chance – a radiating swimming of ever less visible odds. On this yr'south top 10 op take chances listing, tertiary-party came in fourth place, moving upwardly from sixth terminal year.

Banks don't believe their thicket of vendors take risk management – particularly cyber security – well-nigh seriously plenty, with one respondent to this twelvemonth's survey calling them the "weakest link in the organization".

The hazard posed past fourth- and fifth-parties was much discussed by op take chances managers last twelvemonth, equally the European Banking Dominance set new guidelines that significantly raised the bar for scrutiny of vendors, besides every bit their suppliers of critical services. The EBA at present expects banks to negotiate audit and access rights for fourth parties working with their vendors.

European op risk managers privately say this is wishful thinking – getting even basic information to assess the security of those subcontractors is difficult.​

5: Resilience risk

Click here for total article and analysis

When a broker can't execute a trade because of a system meltdown, or a customer tin't go coin out of a cash machine, they don't ponder whether the bank in question has set its risk appetite correctly. They but want to know when they can go their merchandise done, or their cash in hand.

Resilience, the ability to get operations and services upwardly and running after a disruption – Information technology snafus, cyber attack, bungled third-party supplies, cataclysmic weather or any other hazard – is a new entrant to the acme 10 op risks, and makes its debut at fifth place.

Several forces are at work in elevating the topic. The growing complexity of banking and the interwoven nature of the fiscal system, both at present rooted in technology, have combined to make resilience a subject area of boardroom discussion.

"I definitely encounter it as a risk in its ain right at the moment – and I think that volition remain the instance for the next three years at least," says a senior op risk manager at a large European bank.

Some banks have moved quickly on the outcome: last year, HSBC hired Cameron 'Buck' Rogers, the Banking concern of England's cyber risk main, as its offset caput of resilience risk, while LCH, the largest immigration business firm of over-the-counter derivatives, formed a dedicated resilience department. Fears have arisen in the banking earth that a cyber attack on a clearing house, for instance, could reverberate throughout the industry.

Regulators are taking a closer look. The Basel Commission on Banking Supervision established a working grouping in 2018 with the aim of including a discussion of resilience metrics in an update of its principles on operational risk and, ultimately, to create a set of metrics for the industry.

The Federal Reserve is also understood to be preparing a policy paper on the subject field. A New York Fed report in January said a disruption at any of the five most active US banks would effect in significant spillover to other banks, affecting 38% of the network on boilerplate.

6: Organisational change

Click here for total commodity and analysis

I large European bank simply calls it "alter risk". It refers to the kinks that may ascend as a bank or business firm reshuffles its operations for whatever number of reasons. This year, the biggest of them is the need to proceed up with the unstinting pace of technology.

The relentless lunge to the latest technology is being watched closely. Even so much they invest, firms cannot responsibly move equally fast as tech companies – simply they do have to motility.

Plenty could go wrong. Conversions of this sort, new projects and procedures – such as the long-overdue overhaul of domain models, for example – and the hatching of new enterprises often mean more piece of work for employees who are already under pressure level.

"Banks are re-engineering many core processes and leveraging fintech solutions, but time to market is brusk," says an op run a risk head at an international bank. "Agile development makes it difficult for take a chance [teams] to catch up and ensure that risks are being properly addressed."

But the organisational change category takes in more than the onrush of tech: changes in business strategy, teething issues with new management, shake-ups, onboardings and anything else that could send waves through a company.

When a bank shrinks instead of expanding, that as well requires attention. Downsizings that put multitudes of people on the street tin hollow out morale and ramp upward the workloads of those still at their desks. Recently, HSBC announced it would slash 15% of its global workforce – 35,000 people. Deutsche Bank, in its restructuring effort, announced it would cutting 18,000 jobs by 2022. Cost-cutting, mostly a sign of lower profits, can be accompanied by reputational risk, especially when accompanied by extensive task culls.

7: Comport risk

Click hither for full article and analysis

Conduct risk returns to this year'south Top 10 Op Risks, although it's never really been away. The category is an aggregation of two primal subsets of the take a chance – mis-selling and unauthorised trading – which accept appeared repeatedly in previous years.

"We still have non moved away from the number one hazard: conduct," says an op hazard caput at a U.k. bank, nearly the financial industry. "Conduct by its nature tends to take some time to be identified, and then often takes a long time to manifest itself in outflows from fines or restitution. Yous can't rest on your laurels."

Gauging the scale of the problem through gamble modelling is notoriously hard: the seemingly sporadic nature of big conduct losses, with depression levels of clothing losses punctuated by extreme instances of plush wrongdoing, makes it difficult to parse datasets to deliver credible conduct value-at-gamble figures.

In a recent high-profile loss, a rogue trader at a subsidiary of Mitsubishi Corporation placed a series of unauthorised trades in crude oil derivatives starting in January 2019. The trading firm discovered the positions in August – simply besides late. The bets had already racked up $320 million in losses.

Firms' focus on conduct has been sharpened by the implementation of a number of regulations, among them the UK's Senior Managers and Certification Government, which was expanded in December to cover some 50,000 regulated firms. The UK Financial Conduct Authority disclosed in September it had a pipeline of investigations for "serious" breaches of the code.

eight: Regulatory risk

Click here for total article and analysis

​Regulatory chance slips dorsum a few places to rank at 8th in this year's Acme 10 – a function, perhaps, of a slowdown in the printing press of rulemakings that have reshaped the postal service-crisis financial landscape.

The bedding down of reforms to derivatives markets, fiscal accounting practices, regulatory reporting and stress-testing requirements – the listing goes on – doesn't brand compliance with them easy, however. Given the breadth and volume of new sets of rules, the potential for mis-steps and misinterpretation is manifest.

"Increasing regulatory and compliance requirements – in the form of both new rules and amendments to existing rulesets – as well as intense regulatory scrutiny, is a perennial claiming," says the head of op risk at one global bank.

A fourth dimension-honoured way of staying on superlative of such headaches is to poach those who wrote the rules: UBS hired the head of banking supervision at Switzerland'southward Finma, the banking company'southward master supervisor, every bit its caput of regulatory affairs last year.

Advances in artificial intelligence stand for some other source of regulatory risk. Adventure managers highlighted the vital importance of ensuring transparency as AI systems get more than widely used. While AI involvement in decision-making increases, whether for trading or in customer-facing roles, the pressure level to show that its decisions are unbiased and well founded grows, besides – even as the software, and therefore the chore of explaining information technology, becomes more complex.

9: Talent risk

Click here for full article and analysis

Talent chance appears in the top 10 for the 2d time in three years – unwelcome show for banks and other financial firms of the struggle to recruit and retain the right calibre of staff and deploy them where they're needed, in an era of dramatic headcount reductions.

As banks shed jobs, it forces them to recollect more about how they manage talent risk, says a global op run a risk caput at a US banking company. Operating with a leaner business model has forced his business firm to recognise more quickly where it does or doesn't take specific skill sets and juggle resource accordingly, he says. At the same time, a shift in its business organization mix or modify in regulatory priorities tin leave the firm exposed.

Within the hazard function itself, the IT skills to keep up with digitalisation are in short supply, hiking the risk to banks, says one op take a chance caput at a global bank. "Traditional ways of managing operational take a chance need to change, and the skills to place and manage digital risk are even so in evolution, but business concern is digitalising at a neat speed," he says.

Every bit Basel III moves from rancorous rule-writing to total-on implementation, banks are hunting for experienced talents to lead their efforts. Bank of America, for example, recently hired one of Deutsche Banking company'southward most prominent risk analytics executives to lead strategic marketplace risk regulatory programmes, such equally the Fundamental Review of the Trading Book.

ten: Geopolitical adventure

Click here for full article and analysis

Surveys of this type are always in danger of being speedily overtaken by events. In the category of geopolitical take chances, that can happen before the ink is even dry.

As February drew to a close, the coronavirus left markets reeling from their worst newspaper losses since the crisis, with governments scrambling to codify a cohesive response. When the survey was conducted in early January, the virus drew scarcely a mention from respondents, a handful of whom, based in the Asia-Pacific region, flagged it as a blip on the radar.

With the virus likely to contribute to a global economic slowdown, this will trigger wider operational risks – making loan fraud more likely every bit credit markets deteriorate, for example, or increasing cases of internal fraud as front-office staff struggle to hit targets.

Geopolitical risk continues to manifest itself in enough of other ways, as well, such every bit regulatory dubiety. Brexit, which likewise featured in the 2019 Top 10, continues to be an important concern for the financial sector. Almost 4 years after the U.k. voted to leave the European Marriage, in that location is still no EU-Uk trade bargain in place, pregnant a lack of clarity on equivalence betwixt UK and Eu regulators, and on the ability of UK firms to trade in the European union afterward full separation at the end of 2020.

Bated from whatever tariffs will somewhen use to a Brexited UK, the US regime has imposed a raft of trade barriers on countries over the by three years. Survey respondents pointed out the increased compliance brunt this involves, every bit well every bit the likelihood of sanctions-evading transactions. Fines for sanctions violations reached $xix.9 billion between 2009 and 2019, stressing the need for effective know-your-customer procedures.

Some other US election is due in Nov this twelvemonth. The 2016 poll brought regulatory uncertainty as the two candidates differed significantly on fiscal regulation. And while Donald Trump is less of an unknown quantity this time around, Nov is likely once again to nowadays a choice between different regulatory and economic policies.

Climate change, leading the listing of emerging global threats, does not appear on this year'due south listing of superlative operational risks, merely has ascended to the level of a strategic risk for many institutions. Many survey respondents cited disruption from climate change protests and the credit and reputational risks of association with legacy fossil-fuel industry every bit concerns. The model chance involved in adapting to the new threats to lending and mortgage businesses posed by climate-related disasters such as floods and wildfires is also a worry for banks.

Click here for the 2019 survey

leehinte1940.blogspot.com

Source: https://www.risk.net/risk-management/7450731/top-10-operational-risks-for-2020

Share this post