Principles of Operational Risk Management. Risk Management Frameworks for mitigating Operational Risk.

Principles of Operational Risk Management

Of course, no one wants bad things to happen to their company, their employees, or their clients. Every bad story is something one wants to avoid. Yet, total avoidance or 100% extinguishing of operational risk is a foolish goal. It would be very expensive, if not impossible. For example, one could totally avoid market risk by totally avoiding the market. The result of this strategy would mean no investments in securities, property, or any product that has a “market.” Likewise, one could avoid credit risk by not being in the business of extending credit. The same is true for operational risk. A company could totally avoid operational risk by not having employees, not having processes, and not having clients. That would mean not being in business—a foolish goal for a company.

The management of risk is smarter and more effective. Both COSO and the Basel Committee have issued similar principles with respect to the management of operational risk. While COSO has expanded these principles into objectives and components within its ERM framework, the Basel Committee refers to these concepts as “sound practices.” In any event, these ORM principles from these and other public risk management frameworks fall into four broad categories in the following order:
1. Setting the environment
2. Active management (identify, assess, mitigate)
3. Ongoing monitoring
4. Disclosure

1) A company’s risk control environment sets the tone for the organization. It is the foundation for all other risk management activities. If a company’s board of directors does not worry about the management of risk, then rest assured that the management and employees will not worry about it either. The board of directors and senior management are responsible for setting the appropriate tone for the rest of the company, including integrity, ethical values, and competence, and for approving an ORM framework to be consistently implemented throughout the organization so that all levels of employees know and understand their responsibilities with respect to managing operational risk.

2) Active operational risk management ensures that an organization has in place the means to carry out a comprehensive program to (1) identify risks existing in its processes, systems, and other activities; (2) assess or evaluate the risks identified so that the impact on the organization is fully understood; and (3) mitigate or control the risks, especially those with significant impact, so that the risks are eliminated or reduced to an acceptable level. Vital elements of an ORM program are policies and procedures that address numerous and common control activities, such as authorization, verification, performance review, and segregation of duties.

3) Ongoing monitoring of operational risk is just as important as the monitoring of performance or the monitoring of quality. It should be conducted as a separate activity and should be part of everyday management and supervision. The company’s ORM framework needs to be monitored to ensure that active management is properly working to identify, assess, and reduce risk. Additionally, a company’s risk appetite will change over time and, as a result, the environment and framework would need to be adjusted accordingly.

4) Finally, the disclosure of operational risk information would enable people to carry out their responsibilities. The reporting to senior management of risks identified, assessed, and mitigated would help management determine the potential benefits and costs of changing risk appetites or funding additional control systems or processes. Conversely, the effective communication from senior management to all personnel with regard to a company’s operational risk environment would ensure a clear and consistent message that each person’s role and responsibility for managing operational risk should be taken seriously.

To ensure a more robust anticipatory framework, four changes to the commonly used operational risk framework are necessary:
1. Reorder the Elements and Expand the Function of Monitoring. Active monitoring should take place before active management. One should be monitoring business processes, not only the operational risk framework, as a routine function and not as a result of the identification, assessment, and mitigation of operational risks.
2. Add a New Element to Determine Potential Risks with a Feedback Loop to the Risk Environment. To be proactive, one needs to examine what could occur and not just react to what has occurred. Potential risks should be identified and assessed in order to then determine whether the risk environment needs to be changed.
3. Add Four New Features to the Active Management Element. Managing the risks not only comprises identification, assessment, and mitigation as suggested in the commonly used frameworks. Additional measures include a cost assessment; deciding whether to live with a risk; validating that the risk was indeed mitigated, if risk mitigation was the chosen option; and reporting the risk, status, and validation to senior management.
4. Remove Disclosure as a Single Element and Instead Include It in All Elements. The concept of disclosing or reporting of information is key to risk management. This should occur not only once the active management and monitoring are completed, but during the entire process.

Principles of Operational Risk Management. Risk Management Frameworks for mitigating Operational Risk.

Framework for managing and reducing Operational Risk. Enterprise risk management (ERM). The revised COSO ERM framework.

Risk Techniques

Many techniques and methods used for managing and reducing operational risk have been recommended and written about over the past 20 years. Each one has its benefits and can be used for better understanding operational risk and reducing potential losses. Here are some:

Enterprise risk management (ERM) is an expansion of the original COSO framework as a way to explain management of operational risk. It contains four objectives for a company and for an organization within a company:
1. Strategic. The high-level goals and objectives of the organization.
2. Operations. The appropriate use of an organization’s resources, taking both effectiveness and efficiency into account.
3. Reporting. The reliability of the reporting by the organization, whether it would be internal reporting of a division to corporate headquarters or reporting by the company to its shareholders or regulators.
4. Compliance with applicable laws and regulations. This is especially important for global or U.S. national companies, where regional and local laws are different and need to be adhered to in order to stay in business within that regional or local jurisdiction.

The original COSO framework contained four principles: setting the environment; monitoring the process; active risk management through identification, assessment, and mitigation; and disclosure. Rather than using these four principles, the revised COSO ERM framework employed eight components that work together. These eight components link back to the original four COSO principles and conform to the principles of Basel II and the control principles embraced by SOX 404:
1. Internal environment is how the organization sets the tone and risk appetite of an organization, not different from the original principle of setting the environment.
2. Objective setting is to set up objectives in line with the organization’s risk appetite, not different from, and actually a component of, setting the environment.
3. Event identification refers to identifying both internal and external events that affect the organization’s risk objectives, which is a key component of the active risk management principle.
4. Risk assessment, the next component of the active risk management principle, refers to the analysis and understanding of these events and what risk they present to the organization.
5. Risk response, the third and final component of active risk management, is the decision of what to do about the risk, including actions to take to mitigate or compensate for the risk, or determining ways to reduce or even share the cost of the risk, or perhaps accept the risk within the risk appetite of the organization.
6. Control activities are a component of the risk response, to ensure that there are plans in place to implement whatever response was determined.
7. Information and communication is similar to, and perhaps broader than, the original principle of disclosure, in that it takes into account the communication of valuable instructions or information for people inside and external to the organization with regard to their roles and responsibilities for particular risk objectives and risk responses.
8. Monitoring, just like the original principle of monitoring, is the ongoing process of reviewing and evaluating processes and business activities.

Insurance is a form of risk management used to hedge against a potential loss. Thus, rather than trying to develop and implement an ORM framework, a company could instead purchase insurance for losses from operational risks. One would likely find that the cost of determining how much insurance is needed plus the cost of the actual insurance is greater than the cost of developing and implementing an ORM framework. In addition, the use of risk management information systems (RMISs) is typical in insurance-related businesses. Yet, the concepts can be applied to all businesses—that is, the use of computerized systems to help with the reporting of identified risks, risk assessments, and risk control activities.

Framework for managing and reducing Operational Risk. Enterprise risk management (ERM). The revised COSO ERM framework.

The ART of Risk Management—Alternative Risk Transfer, Capital Structure, and the Convergence of Insurance and Capital Markets

A Vocabulary of Risk

Basic Primer on the Vocabulary of Risk
Risk can be defined as any source of randomness that may have an adverse impact on the market value of a corporation’s assets net of liabilities, on its earnings, and/or on its raw cash flows.

? Financial risk: a financial event that can give rise to unexpected reductions in a firm’s cash flows, value, or earnings, the amount of which is determined by the movement in one or more financial asset prices
? Peril: a natural, man-made, or economic situation that may cause a personal or property loss
? Accident: an unexpected loss of resources arising from a peril
? Hazard: something that increases the probability of a loss arising from a peril

A) Financial Risks

A financial risk is a source of potential unexpected losses for a firm that will arise because of some adverse change in market conditions, the financial condition of an obligor to the firm, or the financial condition of the firm itself. Financial risk can impact a company’s cash flows, accounting earnings, and/or value (i.e., asset and liability market values). Importantly, the amount of money a firm loses from financial risks that are realized usually depends on the behavior of one or more “market-determined” prices. Five specific types of financial risk are discussed below[2]:
1. Market risk
2. Funding risk
3. Market liquidity risk
4. Credit risk
5. Legal risk


Market Risk
Market risk arises from the event of a change in some market-determined asset price, reference rate (e.g., LIBOR), or index, usually classified based on the asset class whose price changes are impacting the exposure in question. Common forms of asset class-based market risk include interest rate risk, exchange rate risk, commodity price risk (through input purchases or output sales), and equity price risk.

Delta is the risk that the value of an exposure will deteriorate as the price or value of some underlying risk factor changes, all else being equal. A bond is affected by changes in interest rates, so the interest rate is the risk factor. When interest rates rise, bond prices fall. In the bond world, this delta is called “duration.” Other examples of delta include the sensitivity of a forward purchase/sale of foreign exchange to a small change in the exchange rate, the sensitivity of a commodity delivery contract to the change in the underlying commodity price, and the variability of a futures or options contract on the S&P 500 stock index to a small change in the prices of any S&P 500 stocks.

Gamma is the risk that delta will change when the value of an underlying risk factor changes. It is sometimes referred to as “convexity risk” or “rate of change” risk. Returning to the bond example, bond prices fall as interest rates rise, but the amount of the price change depends on the level of interest rates. Large interest rate increases may cause larger bond price declines than small interest rate increases.

The risk that volatility changes in the underlying risk factor will cause a change in the value of an exposure goes by many names. Vega, lambda, kappa, and tau are among them. For purchased options (longs), declines in volatility pose the risk. Less volatility means there is a smaller chance that the option held will expire profitably. For options written (short), lower volatility increases the odds for profits by reducing the opportunities for unprofitable exercise against the short to occur.

Theta measures the risk to certain exposures due only to the passage of time. Insurance, for example, is an asset that “decays” or “wastes” over time. For every day that passes on an unused insurance policy, there is one less day for the insurance contract to become valuable.

Finally, rho is the risk that the interest rates which are used to discount future cash flows in present value calculations will change and impose unexpected losses on the firm. For many exposures, the discount rate is the borrowing or lending rate that corresponds to the maturity of the contract. For other contracts, such as swaps, a yield curve is used to discount cash flows, and hence any shifts in the level of any of several interest rates may affect cash flows.

Yet another market risk—correlation risk—is the risk of an unexpected change in the correlation of two factors affecting the value of a contract. We must be careful here to distinguish between basis risk, or correlation risk arising from the combination of a derivatives contract with another asset or portfolio, and correlation risk affecting a single asset held in isolation or in a portfolio.

Funding Risk
Funding risk occurs in the event that cash inflows and current balances are insufficient to cover cash outflow requirements, often necessitating costly asset liquidation to generate temporary cash inflows. Most firms, both financial and nonfinancial, have liquidity plans designed to manage funding risks.

The distinctions between pure funding risk and market risk are subtle, as the two are clearly related. Market risk can be viewed as the risk of changes in the value of a bundle of cash flows when adverse market events occur. But value is just defined as the discounted NPV of future cash flows. Funding risk is based on the risk of cash flows when they occur in time. For the purpose of comparing liquidity risk at one time to liquidity risk at another, discounting to an NPV serves no purpose. On the contrary, all that is relevant is cash balances per period. Market risk, by contrast, deals with cash flow risks in any period, because all future cash flows ultimately affect the current NPV of the asset or liability in question.

Market Liquidity Risk
Market liquidity risk is the risk that volatile markets will inhibit the liquidation of losing transactions and/or the establishment of new transactions to hedge existing market risk exposures. Suppose a firm has negotiated an agreement with a bank to purchase British pounds for Deutsche marks (Dmark) three months from now. If the British pound experiences a massive and rapid depreciation vis-à-vis the Dmark—as happened in September 1992 when the European Monetary System’s exchange rate mechanism imploded on “Black Wednesday”—the currency purchase agreement will decline rapidly in value.

The firm in this case may attempt to neutralize its original agreement or enter into an offsetting contract. If the agreement is left unhedged or the counterparty to any offsetting contract defaults, volatility may be so high that a new hedge cannot be initiated at a favorable price, even using liquid exchange-traded futures on pounds and Dmarks. The firm’s market risk is thus exacerbated by market liquidity risk.

Credit Risk
Credit risk is the risk of the actual or possible nonperformance by an obligor to the firm. Credit risk usually comes in four forms:
1. Presettlement credit risk arises from the potential for an obligor to default on a transaction prior to the initiation of the settlement of that transaction.
2. Settlement risk is specifically associated with the failure of a firm during the settlement window, or the time period between the confirmation of a transaction and the final settlement of that transaction.
3. Migration or downgrade risk is the risk that the increase in the market’s perception of a default at a firm causes a decline in the value of the claims issued by that firm.
4. Spread risk is the risk that deteriorations in general corporate credit quality will affect the claim issued by a given firm.

Settlement risk, by contrast, arises after the transaction has entered the settlement process and one party defaults.

Legal Risk
Legal risk is the risk that a firm will incur a loss if a contract it thought was enforceable actually is not. The Global Derivatives Study Group (1993) identified several sources of legal risk for innovative financial instruments that often are associated with risk management, including conflicts between oral contract formation and the statutes of frauds in certain countries and jurisdictions, the capacity of certain entities (e.g., municipalities) to enter into certain types of transactions, the enforceability of “close-out netting,” and the legality of financial instruments. In addition, unexpected changes in laws and regulations can expose firms to potential losses as well.

Legal risk is classified here as a financial risk because this particular incarnation of risk results in losses that usually are driven in size and economic importance by changes in market prices. A netting agreement that is unenforceable in insolvency, for example, could lead to cherry-picking losses whose total amounts are based on market price movements.



Perils, Accidents, and Hazards

A peril is a natural, man-made, or economic “situation” that can cause an unexpected loss for a firm, the size of which is usually not based on the realization of one or more financial variables. A peril thus is essentially a nonfinancial risk.

An accident is a specific negative event arising from a peril that gives rise to a loss and is usually considered “unintentional.”

A hazard is something that increases the probability of a peril-related loss occurring, whether intentional or not.

Consider the peril to a firm of having its employees sustain on-the-job injuries. A related accident would be the unintended opening of a valve on some storage tank at a firm. A hazard could be alcohol or drugs that make an employee more likely to open the value, the presence of corrosive chemicals in the tank that dissolve the valve seals, and the like.

Different types of perils that firms typically face in their business operations include the following[4]:
? Production—unexpected changes in the demand for products sold, increases in input costs, failures of marketing
? Operational—failures in processes, people, or systems
? Social—adverse changes in social policy (e.g., political incorrectness of a product sold), strained labor relations, changes in fashions and tastes, etc.
? Political—unexpected changes in government, nationalization of resources, war, etc.
? Legal—tort and product liability and other liabilities whose exposures are not driven by financial variables
? Physical—destruction or theft of assets in place, impairment of asset functionality, equipment or mechanical failure, chemical-related perils, energy-related perils
? Environmental—flood, fire, windstorm, hailstorm, earthquake, cyclone, etc.

Outreville (1998) provides some examples of hazards that increase the probability of loss for different perils:
? Human—fatigue, ingnorance, carelessness, smoking
? Environmental—weather, noise
? Mechanical—weight, stability, speed
? Energy—electrical, radiation
? Chemical—toxicity, flammability, combustability



Production Perils
Production-related perils cover any perils that threaten a firm’s ability to carry out its normal business activities as expected, usually resulting from changes to the supply or demand for the firm’s product or to the physical production process. Shocks to a firm’s cost or demand functions, for example, can precipitate a loss of value owing to production risks. Three other production-related perils include customer loss risk, supply chain risk, and reputation risk.

At the core of risks facing a business is the risk that the business loses its customers, either because a competitor attracts them away or because they no longer demand the products and services the firm is selling at the prices it is quoting. Customer loss risk thus encompasses pricing risk, or the risk that firms misestimate either the level or the structure of prices for their customers.

Many nonfinancial firms also face risks from adverse events that may occur at any point along a physical “supply chain” (the chain that connects inputs to the firm’s production process to its outputs). Problems may arise at any juncture. Consider, for example, a firm that grows wheat, mills it into flour, and exports the flour to bread makers around the world. Problems could arise at origination from disease, bad weather, insects, vandalism, or any number of other factors that prevent the crop from being grown and brought in according to schedule (both time and quantity). At the transformation stage, equipment breakdowns could occur, contamination of the grain is a possibility, and losses of product during transportation are a consideration. And so on. In short, the firm faces some form of inventory or product risk at every stage here.

A third major production-related peril faced by virtually all firms is the risk of a loss to their brand name capital or reputation that can translate into reduced revenues, increased expenses, and fewer customers—hence its classification as a type of production peril. Reputation risk can arise when a firm acts negligently or is simply perceived to act negligently—as Exxon was perceived following the Valdez, Alaska, oil disaster.

Reputation risk also can arise from poor public relations management of external crises, whether or not the crises are the direct fault of the company. A plane crash due to bad weather, for example, can still impose major adverse reputation effects on both the airline and the aircraft manufacturer if the public relations dimension of the disaster is not handled properly.

Finally, reputation risk can arise when a firm simply fails to honor its commitments. An insurance company that regularly tries to avoid paying out claims even when the claims are unambiguous and legitimate, for example, will quickly find itself short of customers.

Operational Perils
“the risk of loss resulting from inadequate or failed internal processes, people, and systems or from external events.”

Examples of losses that can be attributed to operational risk include failed securities trades, settlement errors in funds transfers, stolen or damaged physical assets, damages awarded in court proceedings against the firm, penalties and fines assessed by member associations or regulators, irrecoverable or erroneous funds and asset transfers, unbudgeted personnel costs, and negligence or fraud.

Operational perils also can sometimes be considered as a type of financial risk if the operational losses are driven by market, credit, or liquidity risks. The failure of Barings to catch the huge position buildup by rogue trader Nick Leeson was in some sense an operational risk management failure. It was a failure of processes (internal audit and control), people (Leeson was defrauding the firm and others), and systems (a consolidated global position-keeping system would have revealed Leeson’s rogue positions). But in the end, Barings went bust because Leeson’s positions went underwater as a result of their market risk. Operational risk management may have failed to catch the process, personnel, and systems problem, but market risk sank the firm.



Core versus Noncore Risks

The core risks facing a firm may be defined as those risks that the firm is in business to bear and manage so that it can earn returns in excess of the risk-free rate.

Noncore risks, by contrast, are risks to which a firm’s primary business exposes it but that the firm does not necessarily need to retain in order to engage in its primary business line.

The firm may well be exposed to noncore risks, but it may not wish to remain exposed to those risks. Core risks, by contrast, are those risks the firm is literally in business not to get rid of.

Core and noncore risks are sometimes today called “business” and “financial” risks, respectively.

Knight defined noncore risks as “risks,” or situations in which the randomness facing a firm can be expressed in terms of specific, numerical probabilities. These probabilities may be objective (as in a lottery) or subjective (as in a horse race), but they must be quantifiable. Because they can be quantified, they can be managed.

Unlike risk, Knight defined “uncertainty” as situations when a firm faces some randomness that cannot be expressed in terms of the probabilities of alternative outcomes. This was “core risk” in Knight’s eyes, or the risks about which only the firm in question had some perceived special insight. To Knight, uncertainty was the source of all major profits and losses to businesses. Lord J.M. Keynes agreed, choosing the term “animal spirits” to describe essentially the same phenomenon.

A major distinction between core and noncore risk—Knightian uncertainty and risk—is driven purely by information. Those factors about which a firm perceives itself as having some comparative informational advantage will be those factors on which the business concentrates for its core business cash flows. Risks about which the firm has comparatively less information will be those risks more likely to be hedged, diversified away, insured, or controlled in some other fashion.

The distinction between core and noncore risk clearly rests on a slippery slope. Not only does it vary from one firm to the next, but it also depends not on the quality of information the firm actually has but rather on the firm’s perceived comparative advantage in digesting that information. Perceptions, of course, can be wrong. Businesses fail, after all, with an almost comforting degree of regularity. Without business failures, one might tend to suspect the market is not working quite right. Accordingly, the preponderance of actual business failures clearly means that some firms thought they had a better handle on information than they did, whether that information concerns market demand for their products, their competitors, or their costs.

Retained versus Transferred Risks
A major purpose of distinguishing between risk—especially core versus noncore risks—is to help a firm make its retention decision.

The retained risk or retention of a firm is the agglomeration of risks—core and noncore—to which the firm is naturally exposed in the conduct of its business that the firm decides to bear rather than to shift to another market participant.

Transferred risk, by contrast, is any risk to which a firm is exposed that a firm decides it is not in the business of bearing and decides to transfer to another market participant.

The decision whether to retain or transfer a given risk is essentially a determination by the firm’s shareholders of whether they want to absorb any realized losses arising from the risk in question or whether they would prefer to have the equity holders of another firm absorb those losses. A core factor to firms in making this determination will, of course, be the benefit/cost trade-off—whether the benefit of transferring the risk is above the cost at the margin. The cost of risk transfer can include both the opportunity cost of forgone profits or positive returns, the pure transaction costs of the risk transfer, and/or the price that the firm may have to pay to induce the equity holders of another corporation to assume the risk the firm is trying to transfer away.


For more Information:
Risk Management, Risk Transfer, Financial Risks, Business Risks, Legal Risk

The ART of Risk Management—Alternative Risk Transfer, Capital Structure, and the Convergence of Insurance and Capital Markets