Risk Identification

Question 1

What are the stages of the risk management life cycle?

Answer 1

1. Risk Identification
2. Risk Assessment – probability and impact
3. Risk Mitigation – how to mitigate a risk to an acceptable level
4. Monitoring and Reporting – reporting should show the status of risks

Question 2

What are the Prudential Regulation Authority (PRA) operational risk guidelines cover?

Answer 2

• Consideration of a firm’s customers, products and activities - including sources of business and volume of transactions
• The design implementation and operation of end-to-end processes and systems
• The risk culture of the firm
• The operating environment

Question 3

What risks must be reported to the PRA?

Answer 3

• Significant failures in systems and controls
• Significant operational loss
• Intention to enter into, or significantly change a material outsourcing arrangement

Question 4

What risks can be reported to the PRA?

Answer 4

• Significant operational exposures
• Invocation of a business continuity plan
• Significant changes to an organisation, infrastructure or business operating environment

Question 5

How should a bank be structured to manage risk?

Answer 5

• Board of Directors – ultimately responsible for the risk management framework
  
  • Functions within the firm – some risk responsibilities will be delegated to employees
  • Monitoring systems – the board will monitor delegated authorities
    
    • Internal Audit
    • Risk Reporting Function
    • External Audit

Question 6

What is the importance of risk management?

Answer 6

• Provide information to help management make informed risk decisions
• Understand the links between operational risks
• Provide a basis for risk measurement and assessment
• Set boundaries between risk types
• Develop a common language for risk management to enable clear communication

Question 7

What issues are associated to self-assessed risk identification?

Answer 7

Once a risk has been compiled, managers make their own assessment of their exposure to each risk on a regular basis. However this is:

• Subjective and open to abuse/manipulation
• Difficult to apply consistently across various business units and multiple locations

Question 8

What is Residual Risk?

Answer 8

(Inherent risk) x (Control risk) = Residual risk

• Inherent risk - risk related to the nature of the activities being undertaken
• Control risk – the risk that errors in transactions will not be prevented, detected and corrected by the internal control systems
• Residual risk – can never be reduced to zero – it is not possible to make profits w/o taking risk

Question 9

What is Risk Appetite?

Answer 9

Risk appetite is the amount of risk exposure that an org is willing to accept/retain. Risk appetite is distributed among liquidity, strategic, credit, market and ops risks. It is important that it is realistic.

Question 10

How is risk appetite determined?

Answer 10

• Where should resources be allocated to minimise risk exposure – why?
• What level of risk exposure requires immediate action – why?
• What level of risk exposure requires a formal response strategy – why?
• What past events have occurred and at what level were they managed – why?

Question 11

How is risk appetite quantified?

Answer 11

• Decide on the key metrics
• Back test the data over time
• Look for consistency
• Discuss with key officers
• Attempt to reach consensus
• Communicate the decision

Question 12

How does one manage risk appetite?

Answer 12

Risk appetite is managed by referencing it to set thresholds –a specific definition of what constitutes acceptable risk for each expression of appetite.

Question 13

How does risk appetite relate to capital?

Answer 13

• Risk appetite is the context of regulatory capital requirements – e.g. Basel
• Risk appetite must be optimised to maximise shareholder value

Question 14

What is the management aim for different risks in relation to their risk appetite threshold?

Answer 14

• Market and credit risk are likely to be up to the stated level under the risk appetite analysis
• Operational risk is likely to be mitigated downwards