process based risk management
DESCRIPTION
Process-based Risk Management presentation on the BACEE CONFERENCE ON OPERATIONAL RISK IN BANKS 2009, Budapest. Péter Fehér, Corvinno Technology Transfer CenterTRANSCRIPT
ProcessProcess--basedbased RiskRisk ManagementManagementBeyond Compliance
Why is it so important?
People
Operational Risk Management
EnvironmentEnvironment
TechnologyProcess
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 3
Loss event categories
Business
Disruption &
System FailuresClients, products
and business
practices
Damage to
Physical Assets
External Fraud
Internal Fraud
Loss
Ris
k
Physical Assets
Employment
practices and
workplace
safety
Execution,
Delivery &
Process
Management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 4
Pro
cess
Ris
k
Risks in processes
• Payment, settlement, reconciliation, modeling, pricing, capacity…
• Dealing with vendors and suppliers, including oursourcingsuppliers, including oursourcing
• Documentation requirements
• Internal and external complianceissues
• Customer management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 5
Current ORM Challenges
• Focusing more on compliance and less on risk management
• Risk management• Risk management
– Low visibility, hidden risks
– High complexity
– Interdependency
– High impact
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 6
Process classification
• Operational risk should be examined in all level
Management Strategy, Controlling, SHRM
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 7
Business Lines
Value adding activities
Support, back office
IT, HR, Legal, Finance…
Process problems
• Do not exist
• If exist, were not documented
• If exist, documented, are not followedare not followed
• If exist, documented and followed, are not measured and controlled
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 8
Process-based RiskManagement ApproachManagement Approach
Integrating risk and processmanagement
RiskProcess
Process-based risk management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 10
RiskProcess
Risk-based process management
Process and risk
• Integrates tasks and resources
– Human
– Technical solutions
– Information (documents, databases)– Information (documents, databases)
• Records cross-unit processes
• Manages responsibilities
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 11
Helps to identify hidden risks!
Process and risk
• Loss related to a specific process or activity
– Process based risk management
• Inadeqate performance of a process or a service
– Outage of business services– Outage of business services
– Outage of IT services
– Incident management
– Business continuity management
• ( and )
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 12
Corpo
rate
finan
ce
Tradin
g an
d sale
s
Retail b
ankin
g
Commer
cial b
ankin
g
Paymen
t and
settle
ment
Agenc
y ser
vices
Asset
man
agem
ent
Retail b
roke
rage
Internal Fraud
External Fraud
Execution, Delivery & Process Management
Employment practices and workplace safety
Damage to Physical Assets
Clients, products and business practices
Business Disruption & System Failures
Üzleti kategóriák
Veszteség kategóriák
Osztályok
Business Disruption & System Failures
Emberek
Folyamatok
TechnológiaKülső tényezők
Key Risk Indicator 1
Key Risk Indicator 2
Key Risk Indicator 3
Risk 1
Risk 2
Risk 3
Process-based risk management
• Who, what, when, how
• Resources
Identifying and modelling processes
• What could prevent us to perform this task?
• What requires for achieving quality results?
Risk identification and assessment • What requires for achieving quality results?and assessment
• Can’t eliminate every risk
• Embedded controls
Control planning and deployment
• As a tool for risk management
• As a tool for organisational efficiency
Process development
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 14
Process modelling
Process map
Process model
Organisational model
Documents
IT Systems
Products
Risks and Controls
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 15
Risk analysis
• Related to
– Activity
– Resources
• Human• Human
• IT
• Information
• Where and Why?
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 16
Process Models created by the ADONIS system.
Risk assessment
• Experts
– Previous experiences
– Existing knowledge
• Collected historical data• Collected historical data
• Quantifying expected loss
• Indicators (KPI, KRI)
• Modelling risk
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 17
Risk overview
• Summarising risks
• Analysing interdependencies
• Scenario analysis:
– Exceptional events– Exceptional events
– Simulations based on processmodel
– Capacities, trends, pathanalysis
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 18
Controls
• Activity or process
• Ideal control: preventive and automatic
• Human accountability and responsibility
• Workflow• Workflow
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 19
Process Models created by the ADONIS system.
Process development
• Tool for risk management
• Developing general controls
• Combining with process management requirements– Time
– Quality
– Resources
• Achievable objectives– Where are we now (AS-IS)?
– Where do we want to go (TO-BE)?
• Output can be a policy
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 20
Challenges
• Developing the process-based approach requires a systematic approach
• Conscious business process management is a requirementrequirement
• Continuous maintenance is required
• Cooperation of front-office and back-office
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 21
Summary
• Why use the process-based approach?
– Measurement of losses is not risk management
– Helps to identify hidden and soft risks
– Helps to analyse risks is details– Helps to analyse risks is details
– Controls processes and risks
– Can involve every stakeholder in the development
– Provides the possibility of conscious risk management
2009.05.11. Péter Fehér - Corvinno Technology Transfer Center 22
Thank You!
Péter Fehér
Corvinno Technology Transfer CenterH-1093 Budapest, Közraktár utca 12/a.
Tel/Fax: 06 1 210 80 62 http://www.corvinno.com