1. Chris Lintern Co-operative Financial Services
Leading the risk profession
Operational Risk & Business Continuity Management - An Effective And Integrated Approach
Chris Lintern
Co-operative Financial Services

2. Introduction & Approach
Chris Lintern
Background in all aspects of Business Continuity Management within Financial Services
Part of central Operational Risk Management Team
Co-operative Financial Services
Includes Co-operative Bank, Co-operative Insurance, Co-operative Investments
Merged last year with Britannia Building Society
Our vision is to be the UK’s most admired financial services business
Approach to this session
Active participation
All views welcome and appreciated

3. Purpose
To share thoughts on the benefits of integrating Operational Risk & Business Continuity
Consider some of the key stakeholders, and the aims, and components for Operational Risk and Business Continuity frameworks
Conclusions

4. What is Operational Risk Management?
Managing the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events (Basel Committee of the Bank of International Settlements)
What is Business Continuity?
A holistic management process that identifies potential threats to an organisation and the impacts to business operations that those threats, if realised, might cause and which provides a framework for building organisational resilience with the capability for an effective response that safeguards the interests of its key stakeholders reputation, brand and value creating activities (BS25999 – British Standard for BCM)

5. Back to Basics
Preventing nasty surprises wherever practical, and having the confidence that your organisation can respond to and mitigate them - if and when they occur
Health & Safety
Key Suppliers / Outsource Partners
System failures
Property & Facilities
Key person dependencies
External threats

6. Historic Positioning of Op Risk & BCM
Focus on “traditional” business continuity – denial of access to premises, or loss of systems
BCM and Operational Risk seen as separate entities
BCM
Operational Risk

7. Synergies between the two
Stakeholders
Framework Components
Intended Outcome
Board
Policy & Procedures
Understanding of appetite
Executive & Senior Management
Supporting documents
Proactive assessment
Operational Management
Plans & Training
Understanding of impact
Other Considerations
Impact on Capital
Impact on Change
Insurance

8. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital

9. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital
Proactive identification of risks
Assessment and evaluation
Scenario analysis

10. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital
Assess controls
CSA process
Review control weaknesses
Track actions
Link control evidence to risks
Review incidents as evidence of control failures

11. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital
Mitigation of operational risks
Crisis Management Team & Plan
Incident Management Teams
Crisis Management Centre
Work-Area Recovery
Disaster Recovery strategy

12. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital
Risk transfer
Placement
Claims Handling
Specific perils e.g. Buildings/Contents, Business Interruption Insurance
Advice & Guidance

13. Operational Risk – Integrated Approach
Control Self-Assessment
Business Continuity
Insurance
Operational Risk Capital
Capital against unexpected losses
Calculation
Planning

14. Operational Risk Components
Purpose
Strategy
3 Year Strategic Plan
External Events
e.g. Weather, Terrorism
Operational Risk Appetite
Vision
Operational Risk Capital
Change agenda
Scenarios
Reporting
Core Processes
Critical Systems
Colleagues
Facilities
Suppliers & Outsource Partners
Control Self-Assessment
Operational Risk
Business Continuity
Insurance Programme
Resilience
Incident & Crisis Management
Top-down Operational Risk Profile
Policies
Key Controls
Work-Area Recovery
Claims
Bottom-up Operational Risk Profile
End-to-end Process view
Disaster Recovery
Incident & Near-Miss Reporting
Operational Risk strategy and plan

15. Operational Risk Components
Purpose
Strategy
3 Year Strategic Plan
External Events
e.g. Weather, Terrorism
Operational Risk Appetite
Vision
Operational Risk Capital
Change agenda
Scenarios
Reporting
Core Processes
Critical Systems
Colleagues
Facilities
Suppliers & Outsource Partners
Control Self-Assessment
Operational Risk
Business Continuity
Insurance Programme
Resilience
Incident & Crisis Management
Top-down Operational Risk Profile
Policies
Key Controls
Work-Area Recovery
Claims
Bottom-up Operational Risk Profile
End-to-end Process view
Disaster Recovery
Incident & Near-Miss Reporting
Operational Risk strategy and plan

16. Embedding the Culture Business buy-in of paramount importance
Incident Management framework known and utilised – importance of exercising
Risk Division seen as involved – not sat in Ivory Towers
Part of the solution, not part of the problem - BC & Op Risk representatives heavily involved in Incident Management
Keep things simple – common language
Linked to the CFS customer promise

17. Incident Framework Crisis Management Team Incident Management Teams
Escalate up
Cascade down
Incident Management Teams
Operational Risk (incl. BCM)
IS Service Continuity
Business units / areas
BC plan owners and Plan co-ordinators

18. Incident Management Team - Structure

19. Integrated Approach

20. Conclusions An effective, and consistent framework
Can be used to define overall risk appetite at Board level
Practical considerations – both areas need policies & procedures
Simple for the business
Aligned to business processes
Crucial that it’s accepted from a cultural perspective within the newly merged organisation
Potential to drive efficiencies and cost-savings

21. Thank You Any Further Questions – Chris.Lintern@cfs.coop