Operational Risk in the Spotlight Four Trends Making Operational Risk a Top Priority for Banks
Total Page:16
File Type:pdf, Size:1020Kb
Operational Risk in the Spotlight Four Trends Making Operational Risk a Top Priority for Banks By Brian Gregory www.wolterskluwerfs.com Mitigating operational risk is becoming a priority for banks that want to avoid penalties, reduce the likelihood of regulatory investigations and rebuild tarnished reputations. That’s prompting a step-change in the way operational risk is viewed and managed – moving away from a siloed, backward-looking approach, and towards a culture in which operational risk is managed proactively, strategically and on an organization-wide basis. Operational Risk in the Spotlight – Four Trends Making Operational Risk a Top Priority for Banks The growing importance of operational risk Ten years ago, if you looked at a UK In those days, operational risk was a This paper looks at four trends driving bank’s fi nancial statements, you relatively minor consideration – not an increased focus on operational risk. something to be managed, calculated and It explores the dangers for fi nancial wouldn’t see a lot of ink devoted to disclosed in the same manner as credit institutions that continue to manage things like conduct risk or IT risk. and market risk. Very few institutions operational risk in a siloed, ad-hoc and made a concerted organization-wide backward-looking manner. And it sets out effort to identify areas of operational risk, the many benefi ts for institutions that can understand its impact, or put in proactive manage operational risk in a strategic way measures to mitigate it. – and demonstrate convincingly that they are doing so. But all that has changed. Today, a bank’s ability to understand and manage operational risk is a key factor for commercial success – and the penalties for failing to manage it are growing in size and impact. What is Operational Risk? The Basel Committee defi nes operational risk as the risk of loss resulting from inadequate or failed processes, people and systems or from external events. This defi nition includes legal risk, but excludes strategic and reputational risk. Legal risk includes, but is not limited to, exposure to fi nes, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. 3 www.wolterskluwerfs.com Trend #1: Increasing fi nancial penalties One of the most powerful arguments Commenting on a further round of Those words may have sent chills down for stepping up operational risk misconduct fi nes in 2014, Tracey many Chief Risk Offi cers’ spines, since banks McDermott, then the FCA’s director of are instituting ever more complex automated management is the size of modern- enforcement and fi nancial crime, clearly systems, connecting ever more devices to day regulatory fi nes for operational signalled the FCA’s continuing willingness them, entrusting ever more sensitive data to penalize fi rms that fail to institute strong to the cloud, and outsourcing ever more failings. Between them, the twin operational risk management: “This is systems to third parties. scandals of PPI mis-selling and not about having armies of compliance staff ticking boxes. It is about fi rms Even where no fi nes are involved, glitches in interest-rate rigging contributed to understanding, and managing, the risks these complex, inter-related systems can be a massive £42bn in penalties issued their conduct might pose to markets. If highly damaging to the business. In August they fail to do so they will continue to face 2015, for example, BNY Mellon found itself by the UK’s Financial Conduct signifi cant regulatory and reputational unable to value billions of dollars of mutual 1 Authority between 2009 and 2014. costs.” and exchange-traded funds due to a failure in a valuation system run by a third party. 5 Other regulators have been equally fi rm. Following its investigation of Deutsche Various facets of information systems rank Bank’s role in the Libor and associated high on risk practitioners’ worry lists. A survey rate-rigging scandals, the German regulator by Risk.net revealed that IT risks, outsourcing BaFin found the bank’s Global Head of GFFX risks and cyber-security risks rank at #8, #6 “specifi cally responsible for organizational and #1 respectively on the list of top 10 and procedural defi cits concerning IBOR operational risk concerns for 2016. submissions, together with general failures in risk management, internal monitoring and Step up operational risk management to business culture,” according to Forbes. 2 avoid penalties Penalties for operational failings have “ Our data shows that the Small wonder, then, that senior risk reached a level where they are having a practitioners agreed in December 2015 material impact on fi rms’ profi tability and regulator means business. The that misconduct was their second biggest ability to deliver shareholder value. There’s £819 million in fi nes recorded operational risk concern for the coming year.3 a clear argument for stepping up the focus on operational risk management, to the for the fi rst six months of 2015 IT risks are climbing the agenda point where it becomes an integral aspect compares to just £335 million And misconduct isn’t the only failing of of risk management and evidence of good people, processes and systems to attract governance across the organization. for all of 2013.” hefty fi nes in recent times. In 2015 the Prudential Regulation Authority (PRA) Mary Stevens, Manager of Regulatory stunned the industry by issuing its fi rst ever Analysis, Wolters Kluwer Financial fi nancial penalty – £14m to Royal Bank of Scotland, NatWest and Ulster Bank for Services 1. Financial Conduct Authority, FCA fi nes fi ve banks a major IT systems failure that in 2012 £1.1 billion for FX failings and announces industry- prevented customers from accessing their wide remediation programme, 12 November 2014 accounts. 2. Forbes, The Willful Blindness Of Deutsche Bank’s Management, 18 July 2015 3. Risk.net, Top 10 Operational Risks for 2016, On that occasion, the PRA found the incident December 2015 was caused by “the failure of the banks to 4. Bank of England, Prudential Regulation Authority have the proper controls in place to identify fi nes Royal Bank of Scotland, Natwest Bank and Ulster Bank £14 million for IT failures, November and manage exposure to the IT risks within 2014 their business.” 4 5. Financial Times, BNY Mellon close to resolving software glitch, 31 August 2915 4 Operational Risk in the Spotlight – Four Trends Making Operational Risk a Top Priority for Banks Trend #2: Growing emphasis on personal accountability If the scale of recent fi nes wasn’t The Certifi cation Regime, meanwhile, extends If an operational failure occurs enough to drive this message home to that level of accountability to “other staff who could pose a risk of signifi cant harm to and senior management cannot CROs and CCOs, the developments of the fi rm or any of its customers”. Everyone prove they took reasonable the 7th March 2016 ought to be. who falls under these regimes is obliged to abide by the regulators’ Conduct Rules, steps to prevent it, they may be which “aim to hold individuals working at all That day saw the introduction of the Senior personally fi ned or even banned levels in banking to appropriate standards of Managers Regime (SMR) and Certifi cation conduct.” 6 from the industry. Regime (CR); a dual-pronged effort on the part of the fi nancial industry regulators Co-operative hints at what’s to come to instil a stronger culture of operational The Co-operative Bank’s experience hints at accountability at the most senior levels in what may be in store under the SMR and CR. UK banks. In 2015, the bank’s former CEO and its former head of corporate and business banking were Echoing the 2002 US Sarbanes-Oxley both personally fi ned and banned from the Act, introduced in the wake of the Enron industry, following widespread failures of scandal, the SMR makes senior executives governance at the bank. and non-executives personally responsible for strategic decision-making across the organization. If an operational failure occurs and senior management cannot prove they took reasonable steps to prevent it, they may be personally fi ned or even banned from the industry. It is up to the regulator to decide whether the steps taken were “reasonable” or not. 5 www.wolterskluwerfs.com Issuing the penalties, PRA chief executive Senior executives must have a robust 6. Financial Conduct Authority, FCA publishes fi nal Andrew Bailey made the link between poor review of risk exposure rules to make those in the banking sector more governance at individual banks and the Under the Senior Managers’ Regime, accountable, stability of the fi nancial sector as a whole. ignorance of what’s going on in the 7 July 2015 “Banks that are not well governed have the organization is no longer any defense. That 7. Bank of England, PRA takes enforcement action against former Co-op Bank individuals, 15 January potential to pose a threat to UK fi nancial makes it essential for senior executives 2016 stability,” he said. “The actions of Mr. Tootell to have a robust and accurate view of the and Mr. Anderson posed an unacceptable organization’s operational risk exposure, and threat to the safety and soundness of the of the controls in place to prevent incidents Coop Bank, which is why we have decided occurring. a prohibition is appropriate in these cases. This action makes clear that there are Moreover, it requires senior executives serious consequences for senior individuals to testify that adequate controls are in who fall short of the PRA’s expectations.” 7 place and are adhered to, and that a strong culture of governance is present throughout the organization.