Managing a multitude of internal and external risks is one of the most significant challenges facing any bank. Increasing transaction volumes, and… [604269]

ACADEMY OF ECONOMIC STUDIES
FABBV – MSBANK

OPERATIONAL RISK IN BANKING

STUDENT: [anonimizat] 2017

Introduction

Managing a multitude of internal and external risks is one of the most significant
challenges facing any bank. Increasing transaction volumes, and the globalization of business,
extended reliance on technology, have introduced higher complexity and uncertainty to banks.
In order to maintain a competitive advantage and to improve overall performance, banks are
seeking a way to understand and proactively manage the risks that can impact their business.
In this respect, it is essential to clearly define the relationship between operational risk
processes and the overall control environment.
Banks survive and pr osper by accepting risks. Risk must be well managed and for the
banking institutions this task has become much more difficult and complex being proved the
changing nature of risk in banking industry and its new implications for bankers and bank
supervisors .
Risk management in banking involves the process of evaluating the risks faced by a
bank and minimizing the costs . Although any risk classification is subjective, we can
distinguish, in essence, two major categories f or banking risks namely: financial ri sk that refers
to losses arising from financial variables and operating risks concerning losses arising from
variables that have impact on the operations of a business (Banks, 2005, p.3).
The financial crisis showed that the organizations, including credi t institutions, have to
reanalyze their risk management process, to identify the weak areas and take the needed
measures for improving risk management process. In Romanian banks, the risk management
process framework remains a priority for the management ( having the responsibility to
implement an effective risk management process).
Operational risk represents an area needing important developments. In the last years,
the Romanian banks registered higher losses caused by operational events. This is why thei r
efforts focus on better managing the operational risk .

Operational risk
Operational risk is not new. The Basel Committee defines the operational risk as "the
risk of direct or indirect loss resulting from inadequate or failed internal processes, people and
systems or from e xternal events" . In the Basel II approach this definition includes legal risk,
but excludes strategic and reputational risk.
The Basel II Accord was issues in 2001. The Basel documents states operational risk as
a distinct cla ss of risk placing it in the category of significant risks. Basel II proposes three
approaches for operational risk management exposure each bank being fre e to adopt any of
them:
 Basic Indicator Approach : the bank needs to hold capital to a fix per centage of a
single indicator;
 Standardized Approach : it is an extension of the previous approach. This approach
requests business lines definition and for each of them the regulatory proposes an
indicator based on which will be d etermined the needed capital;
 Advanced Measurement Approach proposes the use on internal models.
Operational risk is determined by a multitude of factors as for example the complexity
of the bank structure, the geographical dispersion of its activities and units, the complexity,
range of products and services, number of staff and its professional skills, experience and
training and risk management culture as it develops its operational risk management. The
complexity of the activity and its geographical extend are extremely important.
The Basel II Framework envisages that, over time, the o perational risk discipline will
mature and converge towards a narrower band of eff ective risk management and risk
measurement practices. Understanding the current range of observed operati onal risk
management and measurement practices, both within and across geographic regions,
contributes significantly to the efforts to establish consistent supervisory expectations.
Although operational risk management is still a relatively young risk discipline, a
variety of practices have developed in several areas of internal governance, particularly in the
governance structure used to manage operational risk.1 A bank s risk governance structure
should be appropriate for its size and business complexity. The gover nance structure adopted
by many banks relies on three lines of defence – business line management, independent
corporate operational risk function, and independent verification and validation. The
implementation of these three lines of defence varies depen ding on a bank’s risk management
approach and the flexibility provided by national supervisors .
The Basel Committee has actively promoted the adoption and implementation of sound
corporate governance practices by banks. The effective management of operational risk has
always been a fundamental element of banks risk management programm es. However, the
Basel II Framework2 introduced a new dimension in the form of separate capital requirements

1 Committee’s Principles for enhancing corporate governance (October 2010)
2 Operational Risk – Supervisory Guidelines for the Advanced Measurement Approaches, Basel Committee on
Banking Supervision (December 2010)

for operational risk, and expectations for the management o f operational risk as a distinctive
risk discipline.

Causes, elements and solutions for operational risk management

The operational risks can be generated by different causes as for example: business
disruption and systems failures, processes failure, compliance gaps, failing controls, people
behaviour (internal and external fraud, abuse etc), damage to physical assets, employment
practices and workplace safety. These risks ma y be increased by poor training, inadequate
controls, poor staffing resources, or other factors.
Most operational risks arise from one of three sources3:
1. People risk : Incompetency or wrong posting of personnel and misuse of powers
2. Information technology risk: The failure of the information technology system, the
hacking of the computer network by outsiders, and the programming errors that can take
place any time and can cause loss to the bank
3. Process -related risks: Possibilities of errors in information p rocessing, data transmission,
data retrieval, and inaccuracy of result or output

Each bank is a dynamic organism, knowing permanent growth (in order to increase or
conserve its position in the market), developing new products and services more complex,
operating in a dynamic regulatory, financial and economic environment as the Romanian one.
The implemented policies, processes and procedures should include principles for how
operational risk is to be identified, measured, monitored, and controlled across the bank. T he
business lines managers are responsible for day -to-day management of operational risk within
each business unit. But all these managers must have a clear understanding of the banks’
policies and procedures and they must ensure an effective i mplementation of those policies in
their units’ activities. There must be ensured a unique approach in operational risk management
so that all operational events to get the most appropriate response and the risk events to be
reported and aggregate in terms of number and loss at the bank level. But the awareness of the
risks in general and operational risk in particular, must characterize each member of the staff.
The implementation4 of the operational risk framework within each line of business should
reflect the scope of that business and its inherent operational complexity and operational risk
profile. It also must facilitate the collection of data on operational risk events.

3 http://marketrealist.c om/2014/09/operational -risk-risk-banking -transactions/
4 Operational Risk – Supervisory Guidelines for the Advanced Measurement Approaches, Basel Committee on
Banking Supervision (December 2010).

Specialists5 in operational risk management consider that “a key problem often
separating operational risk from the rest of the business is that it is often viewed as a distinct
risk type rather than being seen as the executional element of all risk types, i.e. from c redit and
market risk to those risk types falling within the accepted definition of operational risk such as
fraud and business disruption” and that is important “to understand that operational risk exists
across all risk categories and that operational ri sk assessment is simply a vehicle for the
continual improvement of controls governing the management of all other risk types”.
Elements in the operational risk management process :
1. Appr opriate policies and procedures
2. Efforts to identify and measure o perational risk;
3. Effective monitoring and reporting the operational risk events and their impact;
4. A sound system of internal controls ensuring the limitation of the operational risk events;
5. Adequate testing and verification of the operational ris k framework and continuous
improvement of the operational risk framework.

Solution for operational risk management
 Creating a system for collecting data related to operational incidents;
 Establishing a set o hey risk indicators;
 Establishing the potential operational risk that can occur;
 Designing and implementing adequate controls for the potential operational risk;
 Periodical test on the implemented controls, reporting controls’ failure and taking
measures for controls’ improv ement.

Information related on operational risk must be summa rize and reported periodically.
Financial impact will be reported to senior executive managers, at the moment of discovery, in
order to be established the most e ffective response actions.
Operational risk managem ent reports should summarize:
– Operational risk loss experience at the organization level, business lines, and event –
type basis;
– Operational risk exposure;
– Changes in relevant risk and control assess ments;
– Management assessment of early warning elements signalling an in creased risk of
future losses;
– Exception reporting;
– Operational risk causal factors.

5 PricewaterhouseCoopers, Operational risk management. Embed ding operational risk management: the real
use test, at http://www.pwc.com/gx/en/banking -capital -markets/operational -riskmanagement.

Conclusion

The bank, being a dynamic organism and operating in a changing environment is
exposed to increasing and diversified risks. Risk management is a challenge for all the banks
and must be understood and perform as an ongoing process.
Operational risk exists across other types of risks. In this respect, it is very important to
clearly delimitate loss events gene rated by operational risk by the ones generated by other
significant risks as credit and market risks.
The banks are aware that it is a stringent need for their operational risk management
improvement. This implies the implementation of the advanced approaches. This process is
complex and requires expertise and dedicated processes and IT solutions. Even if the efforts
are considerable, the benefits of the advanced approaches use will be reflected in the trends of
loss events and capital adequacy amoun ts.

Bibliography

1. Operational Risk – Supervisory Guidelines for the Advanced Measurement
Approaches, Basel Committee on Banking Supervision
2. PricewaterhouseCoopers, Operational risk management. Embedding operational risk
management: the real us e test, at http:// www.pwc.com/gx/en/banking -capital –
markets/operational -riskmanagement
3. http://marketrealist.com/2014/09/operational -risk-risk-banking -transactions /
4. http://studyres.com/doc/21590349/managing -operational -risk-in-banks -victoria -stanciu