大浩浩的笔记课堂——FRM考试学习笔记110

C.Operational Risk

C.操作风险

Topic 39Principles for the Sound Management of Operational Risk

1.Lines of defense:

Common industry practice for sound operational risk governance often relies on 3 lines of defence:

⑴business line management(BLM):

This management can identify and manage the risks in the products,activities,processes and systems.

⑵an independent corporate operational risk management function(CORF):

This function may include the operational risk measurement and reporting processes,risk committees and responsibility for board reporting.

⑶an independent review of operational risk and risk management(IR):

This interview may be done by audit or by staff independent of the process or system.

2.Principles for the management of operational risk:

⑴fundamental principles of operational risk management:

①principle 1:

The board of directors should take the lead in establishing a strong risk management culture:

The board of directors and senior management should establish a corporate culture that is guided by strong risk management and that supports and provides appropriate standards and incentives for professional and responsible behavior.In this regard,it is the responsibility of the board of directors to ensure that a strong operational risk management culture exists throughout the whole organization.

②principle 2:

Banks should develop,implement and maintain frameworkthat is fully integrated into the bank´s overall risk management process:

A.The framework is the descriptions of the operational risk management assessment tools,reporting lines,and accountabilities.

B.The framework must be documentations in the board of directors approved policies.

C.The framework for operational risk management chosen by an individual bank will depend on a range of favors,including its nature,size,complexity and risk profile.

⑵governance:

①the board of directors:

A.principle 3:

The board of directors shouldestablish,approveand periodically reviewthe framework:

The board of directors should oversee senior management to ensure that the policies,processes and systems are implemented efficiency at all decision levels.

B.principle 4:

The board of directors should approve and reviewa risk appetite and tolerance statement for operational risk that articulates the nature,types and levels of operational risk that the bank is willing to assume.

②senior management:

principle 5:

Senior management should develop for approval by the board of directors a clear,effective and robust governance structurewith well defined,transparent and consistent lines of responsibility:

Senior management is responsible for consistently implementing and maintaining throughout the organization policies,process and systems for managing operational risk in all of the bank´s material products,activities,process and systems consistent with the risk appetite and tolerance.(committee structure/composition/operation)

⑷risk management environment:

①identification and assessment:

A.principle 6:

Senior management should ensure the identification and assessment of the operational riskinherent in all material products,activities,processes and systems to make sure the inherent risk and incentives are well understood.

B.principle 7:

Senior management should ensure that there is an approval process for all new products,activities,process and systems that fully assesses operational risk.

②monitoring and reporting:

principle 8:

Senior management should implement a process to regularly monitoroperational risk profiles and material exposures to losses:

Appropriate reporting mechanisms should be in place at the board,senior management and business line levels that support proactive management of operational risk.

③control and mitigation:

principle 9:

Banks should have a strong controlenvironment:

That utilizes policies,processes and systems;appropriate internal controls;and appropriate risk mitigation and/or transfer strategies.

·特别注意！

·An effective control environment is including a control environment,risk assessment,control activities,information＆communication,monitoring activities.

④business resiliency and continuity:

principle 10:

Banks should have business resiliency and continuity plans in places to ensure an ability to operate on an ongoing basis and limit losses in the event of severe business disruption.

⑤role of disclosure:

principle 11:

A bank´s public disclosures should allow stockholders to assess its approach to operational risk management.

3.The role of the board and senior management:

⑴role of the board should:

①Establish a code of conduct or an ethics policy.

②Establish a management culture,and supporting processes,to understand the nature and scope of the operational risk,and develop comprehensive,dynamic oversight and control environments.

③Provide senior management with clear guidance and direction.

④Regularly review the framework.

⑤Ensure the framework is subject to effective independent review.

⑥Ensure that as best practice evolves management.

⑦Establish clear lines of management responsibility and accountability.

⑧In approving and reviewing the risk appetite and tolerance,the board should consider all relevant risks.

⑵role of the senior management should:

①Establish and maintain robust challenges mechanisms and effective issue-resolution processes.

②Translate the operational risk management framework established by the board into specific policies and procedures.

③Clearly assign authority,responsibility and reporting relationships.

④Ensure the management oversight process is appropriate.

⑤Ensure staff for managing operational risk coordinate and communicate effectively.

⑥Ensure that the bank activities are conducted by staff with the necessary experience.

⑦The managers of CORF should be of sufficient stature.

4.Operational risk management framework:

⑴definition:

The framework should be comprehensively and appropriately documented in board of directors approved policies and should include definitions of operational risk and operational loss.

⑵tools:

Tools for identifying and assessing operational risk:

①audit findings

②internal loss data collection and analysis

③risk assessments/risk self-assessment(RSA)

④business process mapping

⑤risk and performance indicators:

A.key risk indicators(KRIs)

B.key performance indicators(KPIs)

⑥scenario analysis

⑦measurement

⑧comparative analysis

⑶features:

Features of an effective control environment:

In addition to segregation of duties and dual control,banks should ensure that other traditional internal controls are in place.

⑷risks:

managing technology risk and outscoring risk:

①technology risk:

A.definition:

The use of technology exposes a bank to strategic risk,operational risk and reputational risks and the possibility of material financial loss.

B.characteristic:

Technology can be used to mitigate operational risk but it introduces its own risks.The Basel Committee recommends an integrated approach to identify,measuring,monitoring,and managing technology risks.Technology risk management tolls are similar to those suggested for operational risk management.

②outsourcing risk:

A.definition:

Outsourcing is the use of a third party,either an affiliate within a corporate group or an unaffiliated external entity,to perform activities on behalf of the bank.

B.characteristic:

Outsourcing involves the use of third parties to perform activities or functions for the firm.Outsourcing may reduce costs,provide expertise,expand bank offerings and/or improve bank services.The board of directors and senior management must understand the operational risks that are introduced as a result of outsourcing.

·特别注意！

·The Basel Committee does not explicitly establishing polices for restitution in the event of failure on the part of the outside services providers.

大浩浩的笔记课堂之FRM考试学习笔记合集