PARRONTCHAT BIRD SUPPLIES

Risk Management

Operational Risk Management Awareness

The term Operational Risk Management (ORM) is not new. It has been tossed about in businesses across North America for the last several years. ORM and the oft associated term Enterprise Risk Management (ERM) have generally been used as corporate buzzwords, business culture idioms referenced in board meetings and articulated during presentations. Recent developments, such as the creation of the Sarbanes-Oxley (SOX) Act in 2002 in response to growing financial scandals in the U.S., have brought Operational Risk Management, Enterprise Risk Management and related concepts from the backrooms to the forefront of corporate America.

The inescapable reality is that every single day businesses incur losses and experience operational disruptions due to failures by employees, incorrect implementation of processes and technologies as well as wilful disobedience to internal controls. These losses may be manifest in the form of uncollectible receivables from disappointed clients, lost sales due to call centre failures or unproductive employee downtime when computer systems are unavailable, or a host of other potential problems. While most businesses have developed ad hoc methods of dealing with such losses in the past, legislation (such as SOX and the Basel Accord) has made standardized compliance procedures much more complex. Thankfully, just as these new rules have given rise to increased awareness of ORM/ERM, new tools (including Risk Management software) have been developed to aid compliance efforts.

The new regime of Sarbanes-Oxley, under the direction of the Public Company Accounting Oversight Board (PCAOB) which is in turn accountable to the Security and Exchange Commission (SEC), has undoubtedly benefited the business world by providing a foundation from which to decrease corporate fraud. However, the complexity and associated technical, labour and administrative costs posed to business is also considerable. The realities of both individually large and collectively mundane errors resulting in loss, as well as the newly regulated reporting of those losses, affect virtually all areas of every business each and every day. Therefore, it is in each company's best interest to simultaneously find ways to cut losses while keeping regulatory compliance costs down. Hence the rebirth of Operational Risk Management/Enterprise Risk Management and the new demand for Risk Management software solutions.

Traditionally, few operational losses were measured in any accounting system, and rarely were the loss incidents tracked and analyzed in any way; the time and paperwork required to do so was simply daunting. Because there was no standard legislation in place, any Risk Management software tools were often proprietary and slightly more than electronic log books at best. New technologies and attitudes have allowed loss incidents to be seen as more predictable and able to be grouped into risk categories. Proper analysis of these incidents can result in attribution to root causes which aids in mitigation. Even this beginning leads to dramatically reduced costs while achieving huge gains and strategic advantages from well crafted Operational Risk Management policies and Enterprise Risk Management procedures.

Changes in legislation, technology and attitudes related to ORM/ERM have produced not just economic gains, they have led directly to re-invigorated business innovation and even created improvements in the quality of life. For example, safety, quality and environmental related loss incidents have proven to be not only manageable and avoidable, but sound management of these issues has conferred greater advantage on those who succeeded while driving many who did not adapt out of business. While large scale corruption may have brought about regulatory changes, these changes have spurred a re-visioning of Enterprise Risk Management. Advanced Risk Management software has allowed business to more directly mitigate losses. This has resulted in a cleaner, more efficient and more competitive business environment.

In the post-SOX environment, the same social and political pressures on organizations are present. Improved attitudes and tools have encouraged the proliferation of sound Operational Risk Management to the economic and strategic benefit of those properly prepared for the journey. To find out how Paisley Consulting can help your company on that journey, whether through the provision of powerful Risk Management software or expert consultation on Enterprise Risk Management, visit www.paisleyconsulting.com.

About the Author

Joe Armstrong writes about Enterprise & Operational Risk Management for http://www.paisleyconsulting.com .

Risk Management - Seinfeld

Risk Management Framework

Risk management is the process of identifying, prioritising, assessing, analysing mitigating and controlling risk.  Regulatory challenges have been driving risk management in recent years.

Risk management process should involve the appointment of a risk manager who will be responsible and accountable for the design and development of the risk management framework and oversees the implementation of the framework by the business units. The risk manager carries out the ongoing monitoring and reporting to the executive management and the Board explaining the business risks and the effectiveness and efficiency of the risk management practice.  The risk manager recommends changes to the risk appetite or risk tolerance of the company.

Risk management should remain relevant and be adding measurable value to the business.  Components of risks should be expressed in the simplest form possible so that it will not be overcomplicated for others in the business to understand.

Risk identification

The types of risks to which the business is exposed should be identified.  The classification must be relevant to the underlying nature of the business.  It may not be a quick process to consider and identify the risks inherent in a company, but the value of such an exercise should not be underestimated.  The analysis will direct senior management to areas of exposure, and serve as a tool to ensure active tackling of all identified threats to the company.

The following headings should act as prompts for the company but this is not exhaustive, these are just the low hanging fruits:

Credit risk, Market risk, Liquidity risk, Operational risk, Compliance risk, Regulatory risk, Reputation risk, Litigation risk, Outsourcing risk, Technological risk, Fraud and other fiduciary risk, Foreign exchange risk, Concentration risk, key personnel risk, strategy risk, product risk.

Risk Mitigation

Credit Risk.

1. No credit facility.  Receive your cash before you hand over the assets or receive assets before you hand over your cash.
2. Only deal with counterparties and clients that are regulated or recommended.
3. Credit check counterparties with credit agencies for default.
4. Check rating of counterparties at rating agencies.
5. Cash deposits are held with high 'A' rated banks.
6. Loan to be payable early.
7. Loan is secured on quality collateral. 
8. Draft legal agreements to ensure prompt payment and action for delay or non payment.
9. Fees are deducted from client account - set-off /netting rights
10. Daily matching and reconciliation of trades.
11. Segregation of client money
12. Open a position with initial deposit monitor automated real time marked to market position credit profit and debit losses automatically, if outside margin, make margin call for fund injection or reduce exposure, close out position if market movement continues to erode the position.
13. Analyse the current exposure, current replacement cost of the contract by asking “what would it cost to replace the deal in the market, if the counterparty were to default today?”.
14. Analyse the potential exposure likely replacement cost of the contract by  asking “what is an estimate of the maximum likely replacement cost of the contract, if the counterparty defaults in the future?”.

 Market Risk                                                                                                       

1. Set maximum amount you are prepared to invest in the market.
2. Set stop loss for maximum fall in market you can accept.
3. Set stop loss for maximum rise so as to preserve your profit.

 Liquidity Risk

1. Overdraft facility
2. Equity financing – easy injection of funds from your investors
3. Cash payable on demand from debtors
4. Predictable inflow and out flow of cash

 Concentration risk

1. Set concentration limit not more that 25% of total assets in one counterparty

 Operational Risk

1. Risk database
2. Maintain error register
3. Disaster recovery test/BCP
4. Verification of client identity checks
5. Service level agreement checks
6. Insurance claims promptly made.
7. Staff deputies appointment – no overreliance on one person
8. Training and competence of staff
9. Fraud – 4 eyes, holiday, limits, password, and segregation, preparer of statement is not authoriser.
10. IT system efficiency test
11. Information security
12. Legal risk – review agreements
13. Regulatory risk – interpreter regulations and implement
14. Electronic trading to reduce error

Risk analysis

Once the company has completed a process of risk identification, it is likely that there will be a daunting list of risk issues that are, or should be, addressed by the company. The next stage of the process will be to catalogue the risk that the company faces across the business and examine the likely probability of a particular risk being encountered and the likely impact.  Look at the likelihood of occurrence and the consequences or impact if the event does occur i.e. the frequency and severity. 

Ideally, analysis should be done by event data so as to make it scientific, so that a design model can be created pushing analytic methods to the absolute limit.  Look at the number of losses and the number of complaints and litigations.  If however the company does not have enough historic data to use to measure loss, the analysis would have to be done by applying judgement based on experience and insight of senior management into the business model and operational infrastructure.  This process will require discussion between those who have an interest in the issues.

Risk retention

Effective risk management, if embedded into the company’s strategic and operational processes, provides the framework to overcome uncertainty, to help management determine and agree an acceptable level of risk and opportunity.  The challenge, however, is to determine how much risk the business is prepared to accept.  When certain risks are accepted there then has to be an allocation of capital that will be used to absorb and accommodate the risk. 

An accurate measure of risk would help in determining the amount of capital required so that the company is not overly conservative and there is no overestimation in a situation where balance sheet is thin so there is no over-allocation of capital. In the same token, risk managers must ensure that the capital does not underestimate risk. Regulatory capital requirements may need to be covered between 3 to 5 times to cater for risks.  The company has to consider assess to capital and ability to raise capital from shareholders and the market condition for raising capital.

Risk transfer

The whole concept of insurance is based on risk.  The insurer transfers risk off the company’s balance sheet and on to their balance sheet in return for a payment of a premium.  Professional indemnity insurance, liability insurance, error & omission insurance, fraud & fidelity insurance are useful covers that transfer risk.

It is important to ensure that the insurer is solid with good credit record and that it pays claims promptly and provides quality service.  The company should also ensure that it can survive the period between the making of a claim and receiving settlement. Another way of transfer is the outsourcing of custodian activities to banks so that client assets can be held by those banks.  Guarantee from a parent company also gives financial backing and comfort in the event of financial insolvency and a bail out to protect the reputation of the group as a whole.

Risk control

Having process and procedures in place to ensure that the affairs of the company are managed in an efficient manner with an eye on risk exposures.  Use compliance team to monitor compliance with rules and regulation, internal audit to give assurance of effectiveness of control measures, legal support to properly draft contractual language, product approval process for quality, portfolio risk and performance management, self–assessment process, staff training and development, incentive structure that enables staff to consider how much risk they take to make money. Structuring deals with risk in mind, proactive culture rather than reactive, aligning risk appetite or tolerance to strategy.

Risk avoidance

The company may determine that it would avoid certain strategy or exit certain types of business to avoid the risk involved e.g. not using derivatives.  The risk manager should be able to say ‘no’ to activities that exposes the company to significant risk, explain reasons for saying ‘no’ and obtain acceptance of their position explaining all options that has been considered in reaching that conclusion.

Conclusion

A robust risk management framework with all the necessary data, analytics and tools will enhance the opportunity and capability to grow value linking growth and risk with return and minimising operational surprises and losses.

 

 

 

 

About the Author

Risk Management $99 Risk Management

Risk Accounting and Risk Management for Accountants $65.64 Risk Accounting and Risk Management for Accountants

Risk Management in Electronic Banking $75.83 Risk Management in Electronic Banking

Fundamentals of Enterprise Risk Management $52.14 Fundamentals of Enterprise Risk Management

Strategic Risk Management Practice $84.63 Strategic Risk Management Practice

Post-Crisis Risk Management $48.7 Post-Crisis Risk Management

Risk, Strategy, and Management $86.02 Risk, Strategy, and Management