Challenges of Linking Operational Risk Data Sophie Dupré, Head of Organisational Risk - Barings The opinions expressed are personal opinions and may change as subsequent conditions vary. The information and opinions contained in this material are derived from proprietary and non-proprietary sources deemed by Barings to be reliable, are not necessarily all inclusive and are not guaranteed as to accuracy.  Reliance upon information in this material is at the sole discretion of the reader. CONFIDENTIAL BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data The challenges How can Operational Risk help the Business manage operational risk? How can they add value? One answer is: by supporting the ongoing identification and measurement of risk through the effective use of operational risk data. As Operational Risk practices mature, organisations acquire greater volumes and more complex data. BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data Data gathering Actions Internal losses/events Issues External events Audit reports Key Risk Indicators • The report should be made in ARC Logics within 5 business days of the incident resolution date. Risk and control self assessment Risk Reviews Key Risk register BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data Linkage Quantity is not quality: rubbish in, rubbish out How to make sense of all this data? Data needs to be organised: Linkage Incident reports, internal or external, and risk indicators should be mapped to risks, which in turns link to processes. Business RCSAs should be undertaken on those same risks with reference to this risk data. With these links in place, it is easier to identify when risks are changing. Incidents are no longer a series of errors but points to inefficient processes and prompt the re-assessment of risks. Risk indicators breaches no longer need to be assessed in isolation.   BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data Data linkage Assessment of risks Risk and control library External events • The report should be made in ARC Logics within 5 business days of the incident resolution date. Issues and actions Risk Indicators Internal loss/events BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

External Data Where do we get it from? How do we know it’s reliable? What do we use it for? How do we make it relevant to our business? How do we make sense of it? Sometimes v big numbers……

Making Sense of Operational Risk Data Aggregation Once data is organised by linking to the Risk and Control Library, it helps identifying the areas of concerns and change. But this is not the full answer. Linkage is not fully efficient without classification and aggregation. Categorisation and aggregation Risks should be aggregated across business areas and into risk categories such as top/key risks. There are many ways, from the simplest to the more complex, to aggregate risks. Average or median sub-risk Weighted average of sub-risks Highest risk materiality (combination of impact and probability) across sub-risks Addition of risk materialities   BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data Data linkage and aggregation Risk Profile Classification and aggregation Assessment of risks Risk and control library • The report should be made in ARC Logics within 5 business days of the incident resolution date. External events Issues and actions Risk Indicators Internal loss/events BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE

Making Sense of Operational Risk Data The path to ‘’enlightenment’’ Data collection Quality checking Organise & Manage Information Insight/ Knowledge Requirements Needs to be timely; Needs to be accurate; Needs to be appropriately recorded. Support and control Usage test – can it be used? Provide guidelines and examples (what good data looks like) Provide regular training Audit the quality of data periodically or regularly (e.g. loss/event report sign-off) Risk and control taxonomy Analysis and recommendations Forward looking Improved decision making Provide assurance that risks are being identified and managed efficiently Direct resources to areas of highest risk / Prioritise efforts Reporting Accuracy Timeliness Relevant content Configurability Trend Analysis Relevant to the business Rigorously enforced Used to categorise all risk data Incidents must be reported by the area where it was discovered as soon as it is identified and no later than the close of business day after discovery. • The report should be made in ARC Logics within 5 business days of the incident resolution date. Risk System Aggregation and skills To unlock the full potential of operational risk data, the key is: Classification and aggregation; and Business knowledge and risk experience. Forms and templates ensure consistent reporting Data input validation improves data completeness and accuracy Approval workflow enables audit and oversight Libraries and taxonomies ensure consistent classification Reminders and calendars improves timeliness BISLDCLS\CORPORATE\COMPLIANCE-RISK\NONE