Managing Operational Risk Within Your Treasury Environment

AGENDA General points Impact of modern risk transfer Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

Why is Operational Risk a hot topic? It is still the risk responsible for the most spectacular bank failures Barings – Index futures Natwest – Incorrect volatilities used to value cap portfolio AIB – Forex trading What do they have in common? Treasury activities Failure is mostly due to operational risk

“Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events” Operational Risk – What is it? Basel Definition

Where does Operational Risk occur? Derivatives Desk Transaction Before Identify client need Risk Intellectual Capital Key People During Structure Transaction Risk Model Risk Disclosure Legal After Deliver Product Risk Model Risk Business Continuity Reputational Fraud, Processes People, Technology

AGENDA General points Impact of modern risk transfer Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

The Trend. Moving from prevention to active management Tools and technology exist to transfer unwanted risks to other counterparties –Interest rate derivatives –Credit derivatives –Innovative insurance products using derivatives

Implications. Risks are intertwined If the primary objective is to take and manage market risk Incur credit risk (counterparty risk) Incur operational risk (model risk, fraud etc.)

Why does the use of derivatives or structured products increase the operational risk of my business?. Characteristics of these OTC products are described legal documents/contracts Pay-off may be linked to external events –Share prices, Bond Prices –Default of a third party Complex mathematical models are needed to value these instruments Skilled people for Administration and Risk management Appropriate IT solutions end-to-end is scarce

AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

Proven techniques for control and assess Operational Risk – Within the Company. Internal audit –Ensures the quality of risk processes –Ensures compliance with internal policies & procedures Compliance –Ensures compliance of risk processes with external stakeholders such as regulators Straight -Through – Processing Adequately skilled staff

Proven techniques for control and assess Operational Risk - External. Securities Exchanges –Custody systems –Electronic trading systems Settlement Systems

AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

Objective measures for all risks To understand what a business’ most significant risks are, all exposures must be expressed in common terms, e.g., in Rands. What’s my largest exposure? Fraud Legal Risk Model Risk

Concept of Value-at-Risk An estimate of the level of loss on a portfolio, which is expected to be equalled or exceeded with a given, small probability. –Measured in monetary terms –Specific Time horizon –Given level of confidence (99%).

What is Operational VaR? ILLUSTRATIVE Mean Distribution of losses for the bank Unexpected Losses (VaR) Expected Losses (included in costs) Annual aggregate loss (R) Operational Value at Risk (VaR) is the difference between the annual aggregate loss at a selected confidence level and the expected annual loss.

Measure losses from operational risk events in terms of six components, which include first and second order losses. Regulatory Legal Total Operational Loss Business Interruption Reputation Business Replacement Cost direct losses forgone income Categorisation of Operational Risk

Overview of the Statistical/Actuarial Approach The statistical/actuarial approach is based on the theory that historical data can be used to measure the full range of potential exposures each business faces. Frequency of events Mapping quality of control environment to peer group Adjusting for insurance programs Mapping products / service to generic business units Severity of loss Insurance contract Operational VaR = f (Exposure, Relevance, Quality, Transfers)

Internal Loss Data Significant commercial benefits Quantification of operational risk Development of management processes. How do I transform the raw data to make it useable? Convert to the bank’s currency, Adjust for inflation

Loss Data Matrix The loss data are placed in a matrix which is used to calculate the risk profile of each business, i.e., the inherent exposure of each business to each type of risk. Criminal Transaction Processing Technology Retail Banking No. of losses Mean STD. Commercial Banking Trading No. of losses Mean STD. No. of losses Mean STD Loss Data Matrix ILLUSTRATIVE

Severity Severity is initially assumed to follow a Log-normal distribution (based on best-fit analysis of existing loss data). In order to calculate the severity distribution for a cell we need to know the mean and standard deviation (the parameters of the Log-normal distribution) of the losses in each cell. ILLUSTRATIVE Probability Size of Loss Probability

Severity In most cases internal data is incomplete. One can therefore use “anchor cells” - internal data cells that appear to have a sufficient number of small, medium and large losses and external data relationships to populate cells that do not have sufficient data. ILLUSTRATIVE Anchor cell Criminal Transaction Processing Technology Retail Banking No. of loss Mean STD. Commercial Banking Trading No. of loss Mean STD. No. of loss Mean STD Internal Loss Data Matrix To be populated by anchor cell(s) and external data

Why use external loss data ? SMALL LOSSES - MANY INTERNAL DATAPOINTS MEDIUM LOSSES - SOME INTERNAL DATAPOINTS LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS Size of loss Number of events External data is necessary here ILLUSTRATIVE

Frequency Frequency is assumed to follow a Poisson distribution. Mean frequency for each cell is calculated using a weighted average of internal and external data. Internal business unit event count External business unit event count External all financial data event count External all data event count Weighted (annual) average frequency Criminal Transaction Processing Technology Unauthorized Activities Sales Practices ILLUSTRATIVE Retail Banking

The end result is a customized set of frequency and severity distributions for each business unit, for each risk category. Probability Retail Banking Criminal Severity Distribution ILLUSTRATIVE Size of loss (R) Number of events Probability Retail Banking Criminal Frequency Distribution Frequency

AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

Operational VaR – Value Proposition Create objective measure –Expected Losses (Cost of operational failure) –Unexpected losses (Largest exposures) Provide framework for cost-benefit analysis Link controls to performance measurement –Quantifying Operational Risk Capital –Link to shareholder value Rationalise Insurance Programs

Trading & Sales Investment Banking Asset Management Retail Banking Private Banking 82% 18% Percent of Firm Capital Risk Capital First Second Third Fourth First Second Third Fourth Unauthorized Activities Unauthorized Activities Sales Practices Sales Practices Technology Technology Criminal Criminal Management Processes Management Processes Transaction Processing Transaction Processing Disasters Disasters ILLUSTRATIVE Unit Name VaR (‘000 $) Unit Name Quality Score Sample Operational Risk Report

VaR Comparison VaR is primarily driven by low frequency, high severity risks. Thus, some businesses which experience high annual losses may have a relatively low VaR. Probability Mean AMean B 99th percentile B 99th percentile A Distribution of losses for Business Unit A Distribution of losses for Business Unit B Annual aggregate loss ($) VaR A VaR B ILLUSTRATIVE

Calculate the operational risk capital needed in RAROC processes. Risk Adjusted Returns Operational VaR Probability Low Medium $10m R1billion Capital for Unexpected Losses Credit Risk Market Risk Insurance Risk Operational Risk RAROC = RAROC

Tool to help a business cost justify investments or risk transfers that will reduce operational risks. VaR savings R36M Hurdle Rate 15% Annual benefit R5.4M VaR cost savings Cost of New System over 5 years R27M > R18M ILLUSTRATIVE Trading and Sales Department considers purchasing a new state-of-the-art computer system for transaction processing. Cost = R18.0 million Cost Benefit Analysis Issue Quality ScoreCurrent New Estimate Net Change Unauthorized Act Sales Practices64662 Human Resources36382 Criminal88 - Management Prs Trans. Processing44539 Disasters67681 Technology68748 External75 - Total Change = +28 Capital VaR EstimateR378R342-R36 Cost Benefit Analysis

VaR savings R6.0M Hurdle Rate 15% Annual Benefit R 0.9M VaR cost savings Cost of Insurance R0.9M > R 0.8M Potential Loss Probability Low Medium 1billion Potential Loss Probability Low Medium R50m Without Insurance With Insurance Whether to purchase a rogue trader insurance policy with excess of R50 million. Cost = R0.8million Issue ILLUSTRATIVE R 1billion 50m 200m Capital VaR EstimateR80R74-R6 Insurance Analysis

The Challenge Hazard Compliance & Prevention Operating Performance Strategic Initiatives Opportunity Uncertainty / Variance ABC pwc

Managing Operational Risk Within Your Treasury Environment