Operational Risk Appetite Operational Excellence Catherine van Doorslaer

Operational Risk Appetite & Operational Excellence Catherine van Doorslaer Operational Risk Manager at ING Belgium

Catherine van Doorslaer – Short Bio • 1990 -1996: – University degrees (Namur, Leuven, Louvain-la. Neuve) in Economics and International Politics • 1997 - 2000: Banca Monte Paschi Belgio • 2000 -2003: ING Credit Risk Analyst • 2003 -2014: ING Operational Risk Manager – – Set up of ORM framework within ING Belgium Team Manager for ORMers (Business Advisory) Scenario Analysis and Risk Assessment Entreprise Risk Management 2

Agenda • ING Belgium in 2 slides • Operational Risk – A young discipline with a lot of dilemmas – Risk Cartography : Risk & Event dilemma – Completeness : The pixel dilemma – Risk Appetite • Operational Risk vs Operational Excellence • Operational Risk – Sharing some trends – Image & Social media – Controls & Communication – Cybercrime • Need for some “industry approach” – Physical security – The next challenge? 3

Online channels made easier Home’Bank: new accounts overview Tablet: launch of ‘Smart Banking’ Home’Bank Plus: sign a business credit online Mobile: ordering ING Visa Classic with ‘My. ING. be’ 5

ORM – a young discipline Risks of a bank Credit Risk Market Risk « Operational risks » Basel 1 (1988) Credit Risk Market Risk Basel 1 (1995) Credit Risk Market Risk Operat. Risk Basel 2 (2004) Residual risk 6

Basel II • Context – The increased competitive environment has pushed the various industries to venture into new markets and new products which has increased the complexity of their operations and consequently their risk profile. A deeper analysis of all risks is a necessity. Adequate management and supervision of operational risks is one of the big challenge within the banking industry. – 9/11 has put increased focus on Financial Economic Crime (FEC) a. o. terrorism financing (Compliance) – Financial crisis has put the focus on operational risks with an increased attention to fraud related risks • Definition of Operational Risk – The Basel Committee defined operational risk as “the risk of loss resulting from inadequate or failed internal processes, people and systems, or from external events”. The definition includes legal risk but excludes strategic and reputational risk. The nevertheless, the latest is often included by banks (case of ING). 7

Basel II • Basel II – Capital Measurement – Basic approach • 15 % of income – Standardised approach • capital = * gross income per business line, with between 12% and 18% depending on business line (Corporate Finance, Trading, Retail, …) – Advanced Measurement Approach • Need for compliance with quantitative & qualitative standards, such as incident reporting history of 5 years, independent ORM function, implication of Senior Management, written policies and procedures and active day-to-day ORM – 4 quantitative building elements – – 8 Internal Loss data External Loss data Scenario Analysis Business Environment & Internal Control Factors Operation al & Complianc e Risk

Basel II – Next to this definition, the Basel Committee defined (7) operational risk events that are commonly considered as having the potential to result in substantial losses and that help to refine the definition of Operational Risk: • • Internal Fraud External Fraud Employment practices and Work place safety Clients, products and Business Practices Damage to physical assets Business disruption of system failures Execution, delivery and process management – Institutions can adapt these categories to build their own model. 9

ORM – Risk & Event Dilemma • Literature – All guides related to Operational Risk advises you to start by establishing your « risk cartography » based on existing processes – Identify the possible events (impact/likelihood) to prioritize your risk mitigation/management activities Whatever the root cause… you’ve lost your building! That’s the risk… 10

ORM – Risk & Event Dilemma • Each event can be placed on a impact/likelihood matrix • At the end how will you evaluate the overall risk independently from the cause… Our approach: • • Be sufficiently alert in defining the most probable event. Agree on impact. Define an « average » likelihood in order to have something realistic vs experience and expectations Yearly expected loss as a 2 nd check 11

ORM – Completeness – The pixel dilemma • All organizations are more and more complex • After the bank crisis, all parties (regulators, external auditors, … board of directors, …) want to have a complete view on all risks at a very granular level • Two dilemmas to handle : 12

ORM – Completeness – The pixel dilemma – Keep the overview despite an increasing number of risk points 13

ORM – Completeness – The pixel dilemma – Avoid to make a risk appear (absurdly) bigger than it is 14

ORM – Completeness – The pixel dilemma 15

ORM – Completeness – The pixel dilemma Risk Management vs Risk Measurement 16

ORM – Completeness – The pixel dilemma Our approach: • • Standard Risk Library Detailed issue & action tracking but aggregated measurement and test results (e. g at value chain level) 17

Risk appetite • Where do you place your call for action? – Keep business aligned – Risk Profile / max Hit / 1 in 10 / Scenario – Integrate the Pixel dilemma in the picture Our approach: • • • Relates to gross income at entity level Based mainly on risk profile but other concepts are now being integrated Attention given to scenario but in separate view Split between risk area still to be fine-tuned Some recurring discussions • Discussion on profile vs incidents • Losses vs behaviour • How to quantify (& measure) the reputational risk… 18

Operational Risk & Operational Excellence • Still seen as two separate (and parallel) journeys… and often perceived as the best enemies • Operational Excellence focuses mainly on Processing ensuring an acceptable “Processing Risk” often without looking at the other risk (Lean, 6 S, . . . ) Our approach : • 10 Risk areas • Compliance, Control, Personal & Physical Security, Internal Fraud, External Fraud, Unauthorized Activity, Employment Practice Risk, Processing Risk, Business Continuity Risk, IT Risk • Bringing both together is a key factor for success and long term savings 19

Operational Risk & Operational Excellence • As reducing one risk will increase another one… you best have to find the right balance as from the beginning and regularly re-challenge this balance as environment is also changing – Need an holistic view on the risks… – Many saving programs lead to serious investments once the holistic view is taken Example: • • Payment Name & Address Check Following the law can not be enough… • Solution? ERM • Identify and manage risk across the End-to-End Process 20

Operational Risk & Operational Excellence • Imagine that you improve the following process with the fuel consumption as only focus… 21

Operational Risk – Sharing some trends & feelings • Image & Social Media – Incidents are known by the whole community – Social media is used to complain with exponential exposure – Image/Reputational impact is huge Our approach: • • • Proactive follow-up of discussions about our company Dedicated team to ensure proper communication Pro-active media scripts part of incident management 22

Operational Risk – Sharing some trends & feelings • Controls & Communication Case: In 2010, ING Belgium has been targeted by fraudster due to a higher default limit on their debit card (weekly limit vs day limit). Analysis of the incidents has shown that people above 60 were also specifically targeted. As temporary solution, it has been decided to reduce the default limit of this group of clients. Wrong communication lead to strong reactions in the media and complaints related to discrimination. Control was right but was not sustainable due to wrong communication… In the meantime default daily limit (applicable for all customers) has been implemented without any reaction. 23

Operational Risk – Sharing some trends & feelings • Cybercrime – Global risks requiring an industry broad approach (e. g. awareness) Case study: • Awareness campaign built with Febelfin (Association of Belgian Banks) 24

Operational Risk – Sharing some trends & feelings 25

Operational Risk – Sharing some trends & feelings • Physical security challenge – Staff & Clients – Human become more and more the easiest “point of failure” – Reduction of cash has lead to soften the physical protection… is this right? 26

Thanks for your attention