FUNDAMENTALS OF OPERATIONAL RISK IMT 589 WINTER QUARTER

FUNDAMENTALS OF OPERATIONAL RISK IMT 589– WINTER QUARTER 2013 UNIVERSITY OF WASHINGTON

WELCOME • Office hours are Wednesdays from 3: 30 -4: 25 pm in MGH Commons or by appointment off campus • Please review syllabus carefully for policies on • Academic Integrity and Proper Citations • Copyright • Privacy • Schedule and Assignments • Standard Manuscript Format (posted by Annie) • All assignments submitted from Canvas. Any announcements or discussions can also be handled from Canvas. 2

RISK AND THE FLU • To avoid the flu, avoid touching common surfaces with your hands. • Wash your hands frequently – and carry hand sanitizer if you can. • If you have a cough or sneeze, cover it with your elbow. • If you have a cough or sneeze and decide to come to class, then please sit away from other students. • If you are too sick to come to class, please send me a note. 3

MY BACKGROUND • 10 years at Washington Mutual -- from enterprise architect to oversight for enterprise operational risk services. • My firm has MSIM interns who write and publish on operational risk. • I am author of one book for general public and editor of a second for operational risk executives and managers. • Current work focuses on four private and two public critical infrastructure sectors: banking and finance, energy, IT, communications, public health and emergency services. • CV and other details are on the i. School’s faculty page. • @anniesearle = Twitter www. anniesearle. com 4

MY EXPECTATIONS • That you will be present and participate actively. • That you’ll monitor the world over the next 10 weeks and bring in examples of operational risk you see. • That you will complete all assignments and show me what you are learning as we go. • That your papers will not simply be an assemblage of research you have done, but will have your own conclusions and recommendations as well. • That your final written presentation will be of such quality and so polished that it could be published. 5

FRAMEWORK AND FORMAT As envisioned, each class will consist of three parts: • 90 minute lecture, during which I expect to be asked questions or to clarify remarks I am making – lecture will be focused primarily on the reading assignments. Its Power. Point will be posted after class on the website. • 10 minute break • 70 minute “Real World” example with discussion and application of principles in the lecture, with the discussions facilitated by you. 6

LECTURES • The lectures make sense if you have read the assignment in advance of the class. • The material is dense. Leave yourself enough time. • No Excuses book is the foundational text for this course, supplemented by the case studies in Operational Risk Management. I’ve added a few items to the Readings section that will also be helpful. [Example would be “Inside Job” film on 2008 financial meltdown. ] • Each you will facilitate one of the Real World discussions. 7

“REAL WORLD” DISCUSSIONS • • • Today Jan 16 Jan 23 Jan 30 Enron, Anderson and JPMorgan Chase--Annie British Petroleum Oil Spill--Kelly Ethics: Insider Trading/Insider Fraud--Divya Hurricane Sandy Power Issues & 2003 East Coast Power Failure--Jason Feb 6 Financial Sector Meltdown 2008 --Christina Feb 13 Hurricane Katrina--Patrick Feb 20 Earthquakes: Haiti, Chile, Japan--Yutong Feb 27 Terrorism Internal and External: Oklahoma City bombing and 9/1 --Glenn March 6 Cyber Threats and Cyber Legislation--Rashmi 8

OF SPECIAL NOTE • Your final project includes both a longer paper and a power point executive summary of the paper. Those oral presentations will be made in Week 10. • We have five outside guest speakers starting January 30 th. Please familiarize yourself with their biographies, posted on the site, and prepare at least one question to ask each speaker. • I will be inviting other faculty members and outside experts to hear the final presentations. 9

WHAT IS OPERATIONAL RISK? WEEK 1 10

MAIN TEXT = “NO EXCUSES” • I chose the book because there are not many texts that provide such an overview of both operational risk and business process management, tying the two together. • First chapter compress most of the history of operational risk, discussing internal controls via the Treadway Commission, then Basel Commission, then Sarbanes. Oxley (SOX) and the SEC. • Abkowitz book contains succinctly-written case studies that add to the “real world” examples we’ll be discussing each week. 11

“OPERATIONAL RISK= UNEXPECTED RISK” – DICKSTEIN & FLAST • Operational risk was early on the province of accounting institutions because it dealt with financial loss from fraudulent reporting. • The term was first used officially in 1991 by the Treadway Commission (COSO). • Basel Committee defines operational risk as • “The risk of loss resulting from inadequate or failed internal processes, people, and system or from external events. ” (21) Though the Basel definition was created for banks, most businesses and governments use it as well. 12

OPERATIONAL RISK FAILURES = ONE OR MORE OF THESE AREAS (22) • People – human error, failure to follow procedures • Process – no procedure or bad procedures • Systems – breakdown of automated processes, especially in technology infrastructure • External – Mother Nature, critical dependencies on other sectors, vendors Enterprise risk management sets tone from the top via the risk control environment, then it’s a cycle: Actively manage (identify, assess, mitigate) Monitor on ongoing basis Disclose issues or control failures or gaps (39) 13

TYPES OF OPERATIONAL RISK (34 -38) • Internal fraud • External fraud • Legal/liability • Regulatory noncompliance • Processing errors • Physical security • Information security • System failures • Disaster recovery/ business continuity • Inappropriate business practices • Reputation/brand* 14

REAL WORLD EXAMPLES • Earthquakes • • Haiti Chile Japan Pacific Northwest • Volcanic ash • East Coast power grid failure • Joplin tornadoes • Times Square bomb • BP Gulf oil spill • Hurricane Katrina • 2008, 2011 Mumbai hotel bombs • Financial trading • Leeson/Barings, Galleon, Soc. Gen, MH • Stewart, Bosky 15

IN OTHER WORDS • Risk management is the identification, assessment and prioritization of risks (ISO 31000); • Enterprise risk management can include the coordinated and economical application of resources to • Minimize • Monitor • Control …the probability and/or impact of unfortunate events (loss) or to maximize the realization of opportunities (profit). 16

THE RISK CONTINUUM= IMPACT X LIKELIHOOD 17

BUSINESS PROCESS MANAGEMENT= MONITOR AND MANAGE • Authors quote BPTrends: “refers to aligning processes with an organization’s strategic goals designing and implementing process architectures, establishing process measurement systems that align with organizational goals, and educating and organizing managers so that they will manage processes effectively. (52) • Gartner : “a management practice that provides for governance of a business process environment toward the goal of improving agility and business performance” (52) 18

BPM EVOLUTION OVER THE YEARS • • TQC = total quality control TQM = total quality management CPI = continuous process improvement BPI = business process improvement ERP = enterprise resource planning BPR = business process redesign CRM = customer relationship management BPM = business process management (53) 19

SCIENTIFIC PARADIGMS (53 -59) • Thomas Kuhn, “Structure of Scientific Revolutions” • Introduction of these various BPM approaches, with rise, peak and decline in rate of adoption, resemble the life cycles of scientific paradigms • Kuhn argues that the life cycle of a scientific paradigm includes examples of actual practice • “ law, theory, application and instrumentation” (53) • Some of the historic evolution we see in BPM is more scientific than other elements. Standards have played a large role, as has the Six Sigma methodology. 20

SIX SIGMA METHODOLOGY • Originally designed for optimizing manufacturing processes, Six Sigma has been adopted since by many industries • Five steps (DMAIC) to streamline and measure processes in this methodology parallel those used in the practice of operational risk management. • • • Define Measure Analyze Improve Control 21

A RANGE OF BP FRAMEWORKS • Universal Process Classification Scheme (Anderson’s Knowledgespace 1998 -2002). Disappeared along with the firm. ) • 1992 Process Classification Framework (PCF) is part of Open Standards Benchmarking Collaborative. See decomposed example (61) • 1991 work that resulted in MIT Process Handbook • Supply Chain Operations Reference (SCOR) • IT Infrastructure Library (ITIL) • ERP and CRM software that can be customized 22

ENHANCED BPM CYCLE (65 -70) • This is the cycle that Dickstein & Flast recommend. • Design/redesign identify where and when a gap is found • Model/simulate map the process(es) involved then perform a walk-through to ensure everything connected • Deploy/execute/monitor • Create Standard Operating Procedure for manual processes • Test/develop/deploy new or updated software for automated • Monitor as long as it is in production, either real time or random or ad hoc, depending upon the situation. Ideally, monitoring is a byproduct of the automation. • Analyze results using actual v expected (service level measurement with KPIs or SLMs. • BPM IS CONTINUOUS PROCESS IMPROVEMENT 23

10 MINUTE BREAK 24

REAL WORLD: ENRON 2001 • Drawn from wikipedia , http: //en. wikipedia. org/wiki/Enron • “Enron Corporation was an American energy, commodities, and services company based in Houston, Texas. • Before its 2001 bankruptcy Enron employed approximately 20, 000 staff and was one of the world's leading electricity, natural gas, communications, and pulp and paper companies, with claimed revenues of nearly $101 billion in 2000. ” • Key executives made public false statements about the condition of Enron. • End of 2001 – “it was revealed that its reported financial condition was sustained substantially by institutionalized, systematic, and creatively planned accounting fraud, known as the "Enron scandal". Enron has since become a popular symbol of willful corporate fraud and corruption. • The scandal also brought into question the accounting practices and activities of many corporations throughout the United States and was a factor in the creation of the Sarbanes –Oxley Act of 2002. ” 25

REAL WORLD: JPMORGAN CHASE 2012 • JPMC had no treasurer in place to oversee the Chief Investment Office for five months…previous treasurer had expressed concern about size of the bets (NYT, FT, Bloomberg) • Chief Investment Officer contracted Lyme Disease and was out of office on sick leave – in house fighting in her absence (NYT) • Irvin Goldman, who was installed as chief risk officer for the Chief Investment Office this past February before being relieved of his duties this month, suffered between $10 million and $15 million in losses on one bet in 2008 in his prior role as a trader for the bank, these people said. J. P. Morgan halted Mr. Goldman's trading in late 2008 and put him on leave when it learned that regulators were separately probing trading practices at Cantor Fitzgerald, where Mr. Goldman had served as an executive until late 2007, the people said (WSJ). 26

REAL WORLD: JPMORGAN CHASE 2012 • It caused a crisis of confidence in CEO Jamie Dimon, which in turn has caused the stock to lose value. • It shook the banking sector as well as regulators, since JPMC has been opposed to most portions of the Volcker Rule and has resisted much of the new regulation around Dodd Frank. • It shows dramatically how operational risk can burst into flames, particularly when executives (Dimon, Ina Drew) take their eyes off operations – she moved up to the 42 nd floor, a good metaphor for what happened. 27

QUESTIONS 28

NEXT WEEK • Read “No Excuses” Chapters 4 -6 and be sure you reread Chapters 1 -3. • Read also Abkowitz, Chapter 5 • Let me know if you have suggestions for class Chapters 4 -6: Integrating Process & Risk Frameworks Aligning Risk Appetite with Business Goals Determining Potential Risk of Business Processes 29