Best practice

It is currently unclear what best practice actually consists of because of the embryonic
nature of the operational risk function. This section will put forward an up-todate
view of best practice reviewing older studies such as survey by the British key issues of operational risk and profile what the authors consider to be best
practice (see Table 13.5)
At a recent ISDA meeting on Operational Risk in London (February 1999) Fred Bell
and Colin Plenderleith described the approach to operational risk management at
the Royal Bank of Scotland plc. The Royal Bank of Scotland is a diversified group,
active in UK banking and insurance. They offer services to personal customers that
include bank and savings accounts, credit cards and mortgages, life assurance
and innovative investment products, motor and home insurance. Their business
customers range from small businesses to large corporates. As well as lending,
leasing, structured finance and development capital, they offer money market, foreign
exchange and derivative products. They are active in telephone and electronic
banking – all the business of Direct Line is conducted by telephone. Outside the UK
their US subsidiary, Citizens Financial Group, is a leading bank in New England.
The bank sees the following as the key benefits to the business of investing in
operational risk management:
Ω Raised awareness of the need for better operational risk management
Ω Clearer identification of business unit risk profiles
Ω Better resource allocation
Ω More accurate product pricing
Ω A means of optimizing capital allocation
Ω Ultimately, improving shareholder value
To address operational risk a Head of Group Operational Risk reports to the
Director, Group Risk alongside the Head of Group Credit Risk and Head of Group
Market Risk. RBS categorizes operational risk as follows:
Ω Process; e.g. error, fraud, complexity, capacity, MIS
Ω People; e.g. integrity, competence, management
Ω Systems; e.g. integrity, confidentiality, availability
Ω Business environment; e.g. regulation, legal, natural disaster
Ω Business strategy; e.g. change management, projects
The RBS operational risk framework is solidly based upon the following:
Ω Setting corporate standards
Ω Communication of those standards
Ω A clearly defined organizational structure
Ω Analysis and monitoring of operational risks
Ω Application of technology to facilitate operational risk management
Ω Supply of tools and techniques to the business units which will add value to their
management of operational risks
In the opinion of the author, the Royal Bank of Scotland are, among a small
number of banks, setting standards of best practice in their approach to managing
operational risk for both UK banks in particular and generally for ‘universal’ banks
across the world. The main advantage of their approach is that it is easily understood
by the businesses and links corporate governance ‘top-down’ standard setting to
‘bottom-up’ operational issue resolution within each business by supplying tools and
techniques to facilitate the better management of risk. However, the approach
currently taken by RBS is to adopt a ‘qualitative approach’ by using measures of risk which they call ‘Key Risk Indicators’, KRIs. The further step of quantifying the
potential for unexpected loss in relation to these KRIs has, so far, not been taken.
Dr Jack King of Algorithmics believes that the following are the success criteria for
a successful operational risk framework:
Ω Includes provision for the calculation of a relevant capital requirement for
operations
Ω Provides incentives for increased operational efficiency
Ω Supports decision-making process for operations using scenarios
Ω Assures avoidance of major losses due to operations
Ω Generates a measure that is compatible with market and credit risk
Ω Can be validated through methods such as back testing
Ω Includes sufficient reporting for proper management and regulation.
It is difficult to satisfy these success criteria without taking a more quantitative
approach to operational risk management. Qualitative measures such as volumes,
number of customer complaints, nostro breaks, need to be translated to financial
losses to enable this to take place. However, once the ‘operational risk management
process’ has been implemented adopting the RBS approach quantitative modeling
can be used to calibrate the decisions made under a qualitative framework.