Chris Lintern Co-operative Financial Services Leading the risk profession Operational Risk & Business Continuity Management - An Effective And Integrated Approach Chris Lintern Co-operative Financial Services

Introduction & Approach Chris Lintern Background in all aspects of Business Continuity Management within Financial Services Part of central Operational Risk Management Team Co-operative Financial Services Includes Co-operative Bank, Co-operative Insurance, Co-operative Investments Merged last year with Britannia Building Society Our vision is to be the UK’s most admired financial services business Approach to this session Active participation All views welcome and appreciated

Purpose To share thoughts on the benefits of integrating Operational Risk & Business Continuity Consider some of the key stakeholders, and the aims, and components for Operational Risk and Business Continuity frameworks Conclusions

What is Operational Risk Management? Managing the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events (Basel Committee of the Bank of International Settlements) What is Business Continuity? A holistic management process that identifies potential threats to an organisation and the impacts to business operations that those threats, if realised, might cause and which provides a framework for building organisational resilience with the capability for an effective response that safeguards the interests of its key stakeholders reputation, brand and value creating activities (BS25999 – British Standard for BCM)

Back to Basics Preventing nasty surprises wherever practical, and having the confidence that your organisation can respond to and mitigate them - if and when they occur Health & Safety Key Suppliers / Outsource Partners System failures Property & Facilities Key person dependencies External threats

Historic Positioning of Op Risk & BCM Focus on “traditional” business continuity – denial of access to premises, or loss of systems BCM and Operational Risk seen as separate entities BCM Operational Risk

Synergies between the two Stakeholders Framework Components Intended Outcome Board Policy & Procedures Understanding of appetite Executive & Senior Management Supporting documents Proactive assessment Operational Management Plans & Training Understanding of impact Other Considerations Impact on Capital Impact on Change Insurance

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital Proactive identification of risks Assessment and evaluation Scenario analysis

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital Assess controls CSA process Review control weaknesses Track actions Link control evidence to risks Review incidents as evidence of control failures

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital Mitigation of operational risks Crisis Management Team & Plan Incident Management Teams Crisis Management Centre Work-Area Recovery Disaster Recovery strategy

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital Risk transfer Placement Claims Handling Specific perils e.g. Buildings/Contents, Business Interruption Insurance Advice & Guidance

Operational Risk – Integrated Approach Control Self-Assessment Business Continuity Insurance Operational Risk Capital Capital against unexpected losses Calculation Planning

Operational Risk Components Purpose Strategy 3 Year Strategic Plan External Events e.g. Weather, Terrorism Operational Risk Appetite Vision Operational Risk Capital Change agenda Scenarios Reporting Core Processes Critical Systems Colleagues Facilities Suppliers & Outsource Partners Control Self-Assessment Operational Risk Business Continuity Insurance Programme Resilience Incident & Crisis Management Top-down Operational Risk Profile Policies Key Controls Work-Area Recovery Claims Bottom-up Operational Risk Profile End-to-end Process view Disaster Recovery Incident & Near-Miss Reporting Operational Risk strategy and plan

Operational Risk Components Purpose Strategy 3 Year Strategic Plan External Events e.g. Weather, Terrorism Operational Risk Appetite Vision Operational Risk Capital Change agenda Scenarios Reporting Core Processes Critical Systems Colleagues Facilities Suppliers & Outsource Partners Control Self-Assessment Operational Risk Business Continuity Insurance Programme Resilience Incident & Crisis Management Top-down Operational Risk Profile Policies Key Controls Work-Area Recovery Claims Bottom-up Operational Risk Profile End-to-end Process view Disaster Recovery Incident & Near-Miss Reporting Operational Risk strategy and plan

Embedding the Culture Business buy-in of paramount importance Incident Management framework known and utilised – importance of exercising Risk Division seen as involved – not sat in Ivory Towers Part of the solution, not part of the problem - BC & Op Risk representatives heavily involved in Incident Management Keep things simple – common language Linked to the CFS customer promise

Incident Framework Crisis Management Team Incident Management Teams Escalate up Cascade down Incident Management Teams Operational Risk (incl. BCM) IS Service Continuity Business units / areas BC plan owners and Plan co-ordinators

Incident Management Team - Structure

Integrated Approach

Conclusions An effective, and consistent framework Can be used to define overall risk appetite at Board level Practical considerations – both areas need policies & procedures Simple for the business Aligned to business processes Crucial that it’s accepted from a cultural perspective within the newly merged organisation Potential to drive efficiencies and cost-savings

Thank You Any Further Questions – Chris.Lintern@cfs.coop