What Will Wreck The Trek

How must Financial Institutions Plan and prepare when charting a journey towards operational risk management?

---

People, Process and Technology, the Operations Ecosystem, is fast evolving, and posing new challenges and risks for the senior management.  Time and again the robustness of an organization’s machinery is undergoing a test of its design, its capability maturity and its operating effectiveness.  Recent and recurring market and industry risk events have re-emphasized the need for Indian Financial Institutions to recognize their failures resulting from sub-standard business practices and inadequate technology investments, and to position renewed energies into Operational Risk Management. 

Highlights of few select events from the recent past are as follows:

• Axis Bank suspends more employees and files several Suspicious Transaction Reports (STRs) over violation of Anti Money Laundering (AML) and Know Your Customer (KYC) norms in a racket of illegally exchanging demonetised currency notes
• IRDAI slaps a penalty of INR 35 lakhs on Bharti AXA General Insurance for breach of Outsourcing and Corporate Governance guidelines . . company was soliciting business with unauthorised entities
• RBI slaps INR 27 crore penalty on 13 banks for FEMA violations and lapses in KYC rules; INR 5 crore penalty alone on Bank of Baroda . . deficiencies and failures noted in internal control AML machinery
• Gross NPAs of banks nearly double to INR 629,000 crore . . State Bank of India leading the list with its gross bad loans soaring to INR 100,000 crore
• Cybercrime in India up 300% in 3 years; 30 million across the nation fell victim to online frauds . . financial losses resulting from cyber-crime rise beyond $4 billion, annually
• NSDL’s negligence in reporting Cyber Breach disappoints SEBI . . a detailed inquiry by the regulator revealed ‘very weak security controls’
• 25 banks penalized a total fine of INR 60 crore for flouting money laundering and KYC norms; RBI cancels 56 NBFC licenses to operate business
• Poor risk management system and persisting issues with the treatment of collateral

• Compromised Independence of RBI . . when the RBI signed off on demonetisation, its central board had the lowest number of directors in 15 years and only three truly independent directors
• RBI tightens NBFC rules; NPA norms on par with banks . . NBFCs to make submission on non-performing assets (NPA) and capital adequacy ratios
• NBFCs require higher minimum capital, have less time to declare bad loans, and a board-approved fit and proper criteria for appointment of directors
• RBI plans to procure an Audit Management and Risk Monitoring System (AMRMS) to efficiently facilitate its Internal Audit and Risk Monitoring functions
• RBI asks banks to strengthen their internal audit mechanisms and perform a thorough review of data security measures
• SEBI issues guidelines asking companies and government to appoint at least one woman director on their boards . . to ensure gender diversity on high-table under corporate governance norms
• Government appoints 3 Directors on RBI Central Board as part-time Non-Official Directors for more transparency
• Conduct of business – a key priority – awaits RBI guidance for assessment and standard implementation

In a previous article on this subject – Mind The Gap – we elaborated on the boundaries between operational risk with conduct risk in context to the changing regulatory landscape in UK.  Understanding these risk boundaries is not a complex process but implementing an organization-wide methodology "consistently" is a significant task.  Mature markets in the western economies continue to explore and develop scalable and sustainable models to embed a culture of risk management. 

Financial Institutions in India have made varying degrees of effort and resource investments in developing policies, processes and controls, followed by periodic self-assessments of risks and controls.  While a few have exercised rigor in performing comprehensive risk impact assessment studies, most others have bought themselves a ready reckoner, a checklist, that acts as a handbook to meet regulator’s expectations.  Organizations who perceive this as a problem of non-compliance with policies and procedures continuously make additional investments in cultivating a culture of absolute compliance. 

However, quantification of effort and investment for exercising control over operations and realizing efficiencies remains a difficult challenge.  Only a handful organizations have chosen the path of evaluating their investment to perform an integrated analysis of operational performance and risk management for greater good of their business, to drive efficiencies and to optimize costs.  Reviewing the recent risk and regulatory events in India and the maturity of risk management practices followed by Indian Financial institutions, we recognize the need for defining essential capabilities that form part of an operational risk management framework.

Let’s begin by examining the key elements of an operational risk management framework.

Copyright © Profisor Services Pvt. Ltd. 2015.  All rights reserved. This document is subject to contract and contains confidential and proprietary information.

---

"There are many pitfalls in the journey Towards effective operational risk management that will ‘Wreck Your Trek’ . . . . knowing them ahead of time will certainly help in planning for the rough phases and managing the challenges more confidently."

---

Where does one start?  What are the key enablers of operational risk management?  What is the role for technology?  What are the necessary capabilities?  How should one develop capabilities?  How does one test the level of maturity?  What mature practices from western economies offer ready learning?  Answers to these and many related questions will offer insights into challenges, hurdles, which most financial institutions encounter in their efforts to embed an effective operational risk culture.

With that aim in mind we present you the typical journey, articulating in detail the best practices, success factors, potential issues, causes of inefficiencies and industry-wide challenges at every stage of the process - from ORM Enablers to Risk & Control Self Assessment (RCSA), Key Risk Indicator (KRI) & Risk Events to Stress Testing and to Capital Management.

Insightful Journey Into Effective Operational Risk Management

Copyright © Profisor Services Pvt. Ltd. 2015.  All rights reserved. This document is subject to contract and contains confidential and proprietary information.

While the above info-graph offers learning opportunity, in our experience, organizations always benefit from engaging with proficient advisors to determine an approach for robust capability development to effective operational risk management.

Remember, resources are scarce and any wasteful investments will adversely impact your operational losses!