1. Managing Operational Risk Within Your Treasury Environment

2. AGENDA General points Impact of modern risk transfer Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

3. Why is Operational Risk a hot topic? It is still the risk responsible for the most spectacular bank failures Barings – Index futures Natwest – Incorrect volatilities used to value cap portfolio AIB – Forex trading What do they have in common? Treasury activities Failure is mostly due to operational risk

4. “Operational risk is the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events” Operational Risk – What is it? Basel Definition

5. Where does Operational Risk occur? Derivatives Desk Transaction Before Identify client need Risk Intellectual Capital Key People During Structure Transaction Risk Model Risk Disclosure Legal After Deliver Product Risk Model Risk Business Continuity Reputational Fraud, Processes People, Technology

6. AGENDA General points Impact of modern risk transfer Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

7. The Trend. Moving from prevention to active management Tools and technology exist to transfer unwanted risks to other counterparties –Interest rate derivatives –Credit derivatives –Innovative insurance products using derivatives

8. Implications. Risks are intertwined If the primary objective is to take and manage market risk Incur credit risk (counterparty risk) Incur operational risk (model risk, fraud etc.)

9. Why does the use of derivatives or structured products increase the operational risk of my business?. Characteristics of these OTC products are described legal documents/contracts Pay-off may be linked to external events –Share prices, Bond Prices –Default of a third party Complex mathematical models are needed to value these instruments Skilled people for Administration and Risk management Appropriate IT solutions end-to-end is scarce

10. AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

11. Proven techniques for control and assess Operational Risk – Within the Company. Internal audit –Ensures the quality of risk processes –Ensures compliance with internal policies & procedures Compliance –Ensures compliance of risk processes with external stakeholders such as regulators Straight -Through – Processing Adequately skilled staff

12. Proven techniques for control and assess Operational Risk - External. Securities Exchanges –Custody systems –Electronic trading systems Settlement Systems

13. AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

14. Objective measures for all risks To understand what a business’ most significant risks are, all exposures must be expressed in common terms, e.g., in Rands. What’s my largest exposure? Fraud Legal Risk Model Risk

15. Concept of Value-at-Risk An estimate of the level of loss on a portfolio, which is expected to be equalled or exceeded with a given, small probability. –Measured in monetary terms –Specific Time horizon –Given level of confidence (99%).

16. What is Operational VaR? ILLUSTRATIVE Mean Distribution of losses for the bank Unexpected Losses (VaR) Expected Losses (included in costs) Annual aggregate loss (R) Operational Value at Risk (VaR) is the difference between the annual aggregate loss at a selected confidence level and the expected annual loss.

17. Measure losses from operational risk events in terms of six components, which include first and second order losses. Regulatory Legal Total Operational Loss Business Interruption Reputation Business Replacement Cost direct losses forgone income Categorisation of Operational Risk

18. Overview of the Statistical/Actuarial Approach The statistical/actuarial approach is based on the theory that historical data can be used to measure the full range of potential exposures each business faces. Frequency of events Mapping quality of control environment to peer group Adjusting for insurance programs Mapping products / service to generic business units Severity of loss +5 -5 100 0 Insurance contract Operational VaR = f (Exposure, Relevance, Quality, Transfers)

19. Internal Loss Data Significant commercial benefits Quantification of operational risk Development of management processes. How do I transform the raw data to make it useable? Convert to the bank’s currency, Adjust for inflation

20. Loss Data Matrix The loss data are placed in a matrix which is used to calculate the risk profile of each business, i.e., the inherent exposure of each business to each type of risk. Criminal Transaction Processing Technology Retail Banking No. of losses Mean STD. Commercial Banking Trading No. of losses Mean STD. No. of losses Mean STD. 54 2 3 Loss Data Matrix ILLUSTRATIVE 21 3 6 11 1.5 4 21 0.4 0.3 31 2.2 2.6 11 1.2 0.6 18 0.2 0.4 70 2.4 4.1 11 1.2 3.6

21. Severity Severity is initially assumed to follow a Log-normal distribution (based on best-fit analysis of existing loss data). In order to calculate the severity distribution for a cell we need to know the mean and standard deviation (the parameters of the Log-normal distribution) of the losses in each cell. ILLUSTRATIVE Probability Size of Loss Probability

22. Severity In most cases internal data is incomplete. One can therefore use “anchor cells” - internal data cells that appear to have a sufficient number of small, medium and large losses and external data relationships to populate cells that do not have sufficient data. ILLUSTRATIVE Anchor cell Criminal Transaction Processing Technology Retail Banking No. of loss Mean STD. Commercial Banking Trading No. of loss Mean STD. No. of loss Mean STD. 11 1.2 3.6 11 1.2 0.6 0 21 0.4 0.3 1 0.2 0.4 11 1.5 4 3 2.2 2.6 0 54 2 3 Internal Loss Data Matrix To be populated by anchor cell(s) and external data

23. Why use external loss data ? SMALL LOSSES - MANY INTERNAL DATAPOINTS MEDIUM LOSSES - SOME INTERNAL DATAPOINTS LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS LARGE LOSSES - VERY FEW INTERNAL DATAPOINTS Size of loss Number of events External data is necessary here ILLUSTRATIVE

24. Frequency Frequency is assumed to follow a Poisson distribution. Mean frequency for each cell is calculated using a weighted average of internal and external data. Internal business unit event count External business unit event count External all financial data event count External all data event count Weighted (annual) average frequency Criminal 14 123 422 1216 3.2 Transaction Processing 11 109 312 835 2.4 Technology 21 214 614 2327 5.2 Unauthorized Activities 23 213 424 1123 3.1 Sales Practices 21 102 211 612 1.5 ILLUSTRATIVE Retail Banking

25. The end result is a customized set of frequency and severity distributions for each business unit, for each risk category. Probability Retail Banking Criminal Severity Distribution ILLUSTRATIVE Size of loss (R) Number of events Probability Retail Banking Criminal Frequency Distribution Frequency

26. AGENDA General points Impact of modern risk transfer techniques Proven techniques to control and assess operational risk Objective approach to managing operational risk Exploiting operational VaR

27. Operational VaR – Value Proposition Create objective measure –Expected Losses (Cost of operational failure) –Unexpected losses (Largest exposures) Provide framework for cost-benefit analysis Link controls to performance measurement –Quantifying Operational Risk Capital –Link to shareholder value Rationalise Insurance Programs

28. Trading & Sales Investment Banking Asset Management Retail Banking Private Banking 82% 18% Percent of Firm Capital Risk Capital First Second Third Fourth First Second Third Fourth Unauthorized Activities 168 161 153 145 Unauthorized Activities 50 60 75 90 Sales Practices 168 161 153 145 Sales Practices 50 60 75 90 Technology 33 32 30 29 Technology 50 60 75 90 Criminal 33 32 30 29 Criminal 50 60 75 90 Management Processes 33 32 30 29 Management Processes 50 60 75 90 Transaction Processing 33 32 30 29 Transaction Processing 50 60 75 90 Disasters 106 101 96 91 Disasters 50 60 75 90 ILLUSTRATIVE Unit Name VaR (‘000 $) Unit Name Quality Score Sample Operational Risk Report

29. VaR Comparison VaR is primarily driven by low frequency, high severity risks. Thus, some businesses which experience high annual losses may have a relatively low VaR. Probability Mean AMean B 99th percentile B 99th percentile A Distribution of losses for Business Unit A Distribution of losses for Business Unit B Annual aggregate loss ($) VaR A VaR B ILLUSTRATIVE

30. Calculate the operational risk capital needed in RAROC processes. Risk Adjusted Returns Operational VaR Probability Low Medium $10m R1billion Capital for Unexpected Losses Credit Risk Market Risk Insurance Risk Operational Risk RAROC = RAROC

31. Tool to help a business cost justify investments or risk transfers that will reduce operational risks. VaR savings R36M Hurdle Rate 15% Annual benefit R5.4M VaR cost savings Cost of New System over 5 years R27M > R18M ILLUSTRATIVE Trading and Sales Department considers purchasing a new state-of-the-art computer system for transaction processing. Cost = R18.0 million Cost Benefit Analysis Issue Quality ScoreCurrent New Estimate Net Change Unauthorized Act.62675 Sales Practices64662 Human Resources36382 Criminal88 - Management Prs.54551 Trans. Processing44539 Disasters67681 Technology68748 External75 - Total Change = +28 Capital VaR EstimateR378R342-R36 Cost Benefit Analysis

32. VaR savings R6.0M Hurdle Rate 15% Annual Benefit R 0.9M VaR cost savings Cost of Insurance R0.9M > R 0.8M Potential Loss Probability Low Medium 1billion Potential Loss Probability Low Medium R50m Without Insurance With Insurance Whether to purchase a rogue trader insurance policy with excess of R50 million. Cost = R0.8million Issue ILLUSTRATIVE R 1billion 50m 200m Capital VaR EstimateR80R74-R6 Insurance Analysis

33. The Challenge Hazard Compliance & Prevention Operating Performance Strategic Initiatives Opportunity Uncertainty / Variance ABC pwc

34. Managing Operational Risk Within Your Treasury Environment