University of Nottingham Validity of the People Risk Framework
Total Page：16
File Type：pdf, Size：1020Kb
University of Nottingham Validity of the People Risk Framework: Evidence from the FSA Xenia Chrysostomou MSc Risk Management Validity of the People Risk Framework: Evidence from the FSA by Xenia Chrysostomou 2013 A Dissertation presented in part consideration for the degree of “MSc Risk Management” Abstract The recent Global Financial Crisis was the ultimate manifestation for the recognition and appreciation of people risk, one of the dimensions constituting operational risk, highlighting the necessity of people risk management within the financial industry. In recognition of the magnitude of its impact, ‘people risk’ became a ’hot’ topic amongst the financial regulators, which resulted in the stipulation of assigning capital reserves, exclusively dedicated to its coverage. However, the nature of people risk is attached with the impediment of broadness and diversity, which leaves operational risk managers victims of uncertainty of its unidentified boundaries. With the purpose of analysing people risk, and capturing its scope, McConnell (2008) has developed a theoretical framework consisting of four ‘escalating’ dimensions, namely; incident, individual, institution and industry. The aim of this paper is to examine the extent to which this theoretical framework is applicable in practice, by conducting a qualitative content analysis using the Financial Services Advisory Final Notices imposed on banks and insurance firms as evidence. The investigation attempts to find whether there is a correlation between the theoretical framework and the ‘real’ evidence, in order to evaluate its validity. The analysis finds that, in fact, there is evidence assuring its validity, yet there is room for improvements for more accurate outcomes. The study recommends that the framework should expand the dimensions constituting the framework. Possible suggestions are to include additional dimensions in relation to system and process risk, and the ‘Three lines of defence’ model. Keywords: People Risk, People Risk Framework, Operational Risk, Operational Risk Management, Organisational Culture Table of Contents Acknowledgements ..................................................................................................................i 1. Introduction ....................................................................................................................1 2. Literature Review .........................................................................................................6 2.1. Introduction ................................................................................................................6 2.2. The role of Financial Services in the Market .....................................................6 2.2.1. What Financial Institutions do .......................................................................9 2.2.2. How they Operate ........................................................................................... 11 2.2.3. Comparison of Banks and Insurers ............................................................ 13 2.3. The Rise of OpRisk .............................................................................................. 16 2.3.1. Business Operations Model and OpRisk.................................................... 18 2.4. OpRisk and Regulation .......................................................................................... 22 2.5. OpRisk Management and People Risk Management ..................................... 26 2.6 People Risk Framework ............................................................................................. 38 3. Methodology and Data Collection ....................................................................... 42 3.1. Introduction .............................................................................................................. 42 3.2. Aims and Objectives ............................................................................................... 42 3.3. Method ........................................................................................................................ 43 3.4. Source ......................................................................................................................... 45 3.5. Sample Criteria ........................................................................................................ 45 3.6. Data ............................................................................................................................. 46 3.7. Descriptive Analysis................................................................................................ 47 3.8. Data Collection and Analysis Technique........................................................... 48 4. Findings ........................................................................................................................... 50 4.1. Introduction .............................................................................................................. 50 4.2. Incident ...................................................................................................................... 51 4.3. Individual ................................................................................................................... 56 4.4. Institution .................................................................................................................. 59 4.5. Industry ...................................................................................................................... 62 4.6. Evaluation of the Framework............................................................................... 64 5. Conclusion and Recommendations .................................................................... 66 6. References...................................................................................................................... 70 7. Appendices ..................................................................................................................... 75 Appendix 1: Brief Description of the Final Notices in the sample ........................... 75 Appendix 2: Description of the Principles Breached .................................................... 77 Appendix 3: Analysis of the Data- Evidence on the four Dimensions .................... 78 Appendix 4: Reaction to an Incident .............................................................................. 103 Appendix 5: Causes of Behaviour and Employee Intentions .................................. 104 Appendix 6: Causes of Failure at the Institution Level............................................. 105 Appendix 7: Impact of People Behaviour in the Industry........................................ 106 Acknowledgements I would like to take this opportunity to thank all the people who have contributed in any way to the completion of this dissertation. Particularly, I would like to express the deepest appreciation to my supervisor Dr. Cormac Bryce for his guidance, support, patience and enthusiasm for the project that kept me motivated. I also want to thank my extended family and friends who supported me and kept me motivated throughout the whole process. Special thanks to Michael John Epaminondou for his invaluable assistance and support, and who helped me stay focused until the end. Finally, I want to express my deepest appreciation to my parents, Chrysostomos and Christina, for making all this possible, and to whom I dedicate this project. Xenia Chrysostomou i 1. Introduction Operational risk (OpRisk) is the contemporary risk category which characterises the risk of losses arising from anything but credit and market risk, such as, fraud, system and process failures, natural disasters, employee errors, information losses, lawsuits and computer hacking (Moosa, 2007). OpRisk has been introduced in the financial sector as a result of the collapse of Barings Bank in 1995; even Nick Leeson, the rogue trader responsible for this collapse, has been characterised as the ‘true author’ and ‘unwitting inventor’ of OpRisk (Power, 2005). This operational loss event proved to be a ‘defining moment’ for the financial regulation, since it introduced OpRisk as a distinct form of financial risk, and for the first time it was required that banks should measure, manage, and allocate capital to it (Bryce, et. al, Forthcoming). However, despite the increasing awareness raised within the financial sector about the severe consequences of this type of risk, over the last decade, OpRisk management failures kept remaining the cause of major business failures and financial scandals. Inevitably, these losses which cost billions of dollars, have led to the spur of an ongoing interest paid to OpRisk by media, financial regulators, supervisors, executives, and the public. Such operational loss events include; Daiwa in 1995 and AIB in 2002 as a result of undetected illegal trading; Bernard Madoff’s Ponzi scheme in 2008; Socitété Generale in 2008 and UBS in 2011 due to rogue trading; and PPI scandals (1990s, 2011). Even though these events have provoked regulatory developments to quantify, manage, disclose and capture OpRisk, operational losses keep surfacing across the financial industry even until today, with the GFC being the most recent, designating new deficits in OpRisk management practices in place (Sturm, 2013). In effect, the recent Global Financial Crisis (GFC) ‘shook the regulatory system’. This is because, despite the previous attempts of Basel II (the accord of banking regulation)