Operational Risk Management

Operational Risk

Management

Founded in 1807, John Wiley & Sons is the oldest independent publish￾ing company in the United States. With offices in North America, Europe,

Australia, and Asia, Wiley is globally committed to developing and marketing

print and electronic products and services for our customers’ professional

and personal knowledge and understanding.

The Wiley Finance series contains books written specifically for finance

and investment professionals as well as sophisticated individual investors

and their financial advisors. Book topics range from portfolio manage￾ment to e-commerce, risk management, financial engineering, valuation and

financial instrument analysis, as well as much more.

For a list of available titles, visit our Web site at www.WileyFinance.com.

Operational Risk

Management

A Complete Guide to a Successful

Operational Risk Framework

Philippa Girling

Cover design: Wiley

Copyright © 2013 by Philippa Girling. All rights reserved.

Published by John Wiley & Sons, Inc., Hoboken, New Jersey.

Published simultaneously in Canada.

No part of this publication may be reproduced, stored in a retrieval system, or transmitted

in any form or by any means, electronic, mechanical, photocopying, recording, scanning, or

otherwise, except as permitted under Section 107 or 108 of the 1976 United States Copyright

Act, without either the prior written permission of the Publisher, or authorization through

payment of the appropriate per-copy fee to the Copyright Clearance Center, Inc., 222

Rosewood Drive, Danvers, MA 01923, (978) 750-8400, fax (978) 646-8600, or on the Web

at www.copyright.com. Requests to the Publisher for permission should be addressed to the

Permissions Department, John Wiley & Sons, Inc., 111 River Street, Hoboken, NJ 07030,

(201) 748-6011, fax (201) 748-6008, or online at http://www.wiley.com/go/permissions.

Limit of Liability/Disclaimer of Warranty: While the publisher and author have used their

best efforts in preparing this book, they make no representations or warranties with respect

to the accuracy or completeness of the contents of this book and specifically disclaim any

implied warranties of merchantability or fitness for a particular purpose. No warranty may

be created or extended by sales representatives or written sales materials. The advice and

strategies contained herein may not be suitable for your situation. You should consult with a

professional where appropriate. Neither the publisher nor author shall be liable for any loss

of profit or any other commercial damages, including but not limited to special, incidental,

consequential, or other damages.

For general information on our other products and services or for technical support, please

contact our Customer Care Department within the United States at (800) 762-2974, outside

the United States at (317) 572-3993 or fax (317) 572-4002.

Wiley publishes in a variety of print and electronic formats and by print-on-demand. Some

material included with standard print versions of this book may not be included in e-books or

in print-on-demand. If this book refers to media such as a CD or DVD that is not included in

the version you purchased, you may download this material at http://booksupport.wiley.com.

For more information about Wiley products, visit www.wiley.com.

Library of Congress Cataloging-in-Publication Data:

 ISBN 9781118532454 (Hardcover)

 ISBN 9781118744642 (ePDF)

 ISBN 9781118744789 (ePub)

Printed in the United States of America

10 9 8 7 6 5 4 3 2 1

For my husband, Joe; my daughters, Leah, Holly, and Tegwen;

and my step-daughters, Hayley and Allison.

Thank you all for helping me to balance risk and reward every day.

vii

Preface ix

Acknowledgments xi

Chapter 1

Definition and Drivers of Operational Risk 1

Chapter 2

The Regulatory Push 15

Chapter 3

The Operational Risk Framework 33

Chapter 4

Operational Risk Governance 41

Chapter 5

Culture and Awareness 63

Chapter 6

Policies and Procedures 77

Chapter 7

Internal Loss Data 89

Chapter 8

External Loss Data 121

Chapter 9

Business Environment Internal Control Factors: Key Risk Indicators 141

Chapter 10

Risk and Control Self-Assessments 155

Contents

viii Contents

Chapter 11

Scenario Analysis 173

Chapter 12

Capital Modeling 189

Chapter 13

Reporting 219

Chapter 14

Risk Appetite 237

Chapter 15

Reputational Risk and Operational Risk 255

Chapter 16

Operational Risk and Convergence 269

Chapter 17

Best Practices in Related Risk Management Activities 281

Chapter 18

Case Studies 291

Appendix: Answers to Review Questions 309

About the Author 317

About the Website 319

Index 321

ix

The evolution of operational risk over the past 10 years has given rise to a

new profession: the operational risk manager. This book equips the student

or practitioner of operational risk with all of the framework elements that are

needed in order to establish a successful operational risk framework.

While best practices and regulatory guidelines are readily available for

both the qualitative and the quantitative elements of operational risk, many

firms are still struggling with the practical implementation of operational risk

frameworks. This book provides real‐life examples of successful methods and

tools while facing head‐on the cultural challenges that are prevalent in this field.

Today, chief risk officers are finding themselves facing the daunting task

of providing assurances to senior management and to board members that

operational risks are being effectively managed and mitigated. Traditional

market and credit risk approaches offer only partial effectiveness in the op￾erational risk field, and this book explores the unique qualitative aspects of

operational risk management.

This book also provides insight into some of the (often notorious) op￾erational risk events that have occurred in the past 10 years, with analysis

of the JPMorgan Whale event, the UBS and Société Générale unauthorized

trading scandals, the Knight Capital technology misstep and the manage￾ment of operational risk at the 2012 London Olympics.

The author explores how the regulatory framework has evolved over

the past few years in response to these events and in response to the recent

economic crises and proposes effective approaches to meet both global regu￾latory expectations and the industry’s risk management goals.

The framework proposed provides practical steps to ensure effective

identification, assessment, monitoring, and mitigation of operational risks.

In starker terms, how can you find it, size it, watch it, and kill it (or choose

to accept it)?

Operational risk is an elusive risk category, but it can be managed using

best practices that have grown up in the industry in the past few years. This

book provides both the new and the experienced operational risk profes￾sional with tools and best practices to implement a successful operational

risk framework and to embed operational risk management more deeply in

their firms.

Preface

xi

Thank you to my agent, John Wright, for his engagement, support, and

encouragement, and to Bill Falloon at Wiley & Sons for taking me on as

a new author and for welcoming me into the Wiley community. Thank you

to the whole Wiley & Sons team, especially my editors, Meg Freeborn and

Stacey Fischkelta for their careful and diligent shepherding of the manu￾script and Tiffany Charbonier for her book design.

Thank you to Cathy Hampson, Jon Holland, Nicole Hubert, Lorinda

Opsahl‐Ong, Ilya Rozenfeld, David Silverman, Mark Taylor, Jedediah

Turner, and Jan Voigts—my friends, colleagues, and peers, who generously

agreed to review portions of this book and to provide their thoughts and

suggestions. This is a much stronger work as a result of your excellent in￾sight and in‐depth knowledge of the field of operational risk. I am grateful

to you all for taking time to review and improve the manuscript when you

are very busy managing operational risk on a daily basis. Any remaining

weaknesses and errors in the book are entirely my own doing.

Thank you to both ORX and IBM Algo First for providing external

loss data for analysis with a generous spirit and remarkable efficiency.

Thank you to Penelope Vance for coaching me through the entire pro￾cess and for asking all of the right questions at the right time.

Thank you to GARP for generously allowing the reuse of content that I

wrote for one of their course textbooks.

Finally, a special thank you to my children, Leah, Holly, Tegwen, Hayley,

and Allison for their patience with me as I wrote, and to my husband, Joe,

for his constant encouragement that I could, and should, write this book.

Acknowledgments

Operational Risk

Management