Implementing an Operational Risk Appetite (ORA) framework is inevitable if you are trying to achieve any of the following. 1. An integrated GRC (Governance, Risk & Compliance) approach 2. An Enterprise Risk Management (ERM) programme 3. Get ROI from your BASEL II or Solvency II compliance investments

1. Operational Risk Appetite Presented by: Institute of Operational Risk October 29, 2009 Why? What? How? John Cyriac

5. The ‘Why’ of ORA Survey result for “Why should an organization define its Operational Risk Appetite limit?” Survey result for the question- “The main use of having an Operational Risk Appetite limit is to influence control investments. Do you agree?”

9. The ‘What’ of ORA Response to the survey question – “Operational Risk Appetite – Are you happy with the terminology?” Response to the survey question – “Operational Risk Appetite for a business unit is the residual risk as perceived by the business. Do you agree?”

10. Some definitions of risk appetite “ The broad-based amount of risk a company or other entity is willing to accept in pursuit of its mission or vision” – Basel Committee “ Risk appetite sets out the level of risk that the bank is willing to take in pursuit of its business objectives” – Barclays Bank “ Risk appetite is an expression of the maximum level of residual risk that the group is prepared to accept in order to deliver its business objectives and is assessed against regular (often daily) controls and stress testing to ensure that the limits are not compromised in abnormal circumstances” - The Royal Bank of Scotland Group The ‘What’ of ORA ::

13. The ‘What’ of ORA :: Operational Risk Appetite sets out the level of residual operational risk tolerated by an organisation in the pursuit of its business objectives ORA Definition

15. The ‘How’ of ORA Answer to the survey question: - “A successful Operational Risk Appetite framework needs a combination of top-down and bottom-up approaches to reduce the gap between board level and business level views on appetite. Do you agree with this statement?”

16. Overview of top-down risk appetite framework The ‘How’ of ORA :: Dimensions of risk appetite for OR Expected performance, and performance at stressed levels Expected loss – combination of market, credit & operational risks

20. ORA Implementation The ‘How’ of ORA :: Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT RCSA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action

21. ORA Implementation The ‘How’ of ORA :: Output for ORA Inputs Responsibility Frequency Action Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA ORA – minimum level of performance for OR Risk Performance Target(RPT) – a value less than ORA as a target to achieve by wise ORM ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Reports on OR budget utilization Key Risk Scenario OR Quarterly Capital Model Reports Events PRO Monthly Int & Ext Loss data KI reports Thresholds for ORA & RPT, Reporting standards for escalation and control KI O Based on KI KI Measure Agreed investment plan for controls Total risk appetite, budget for investment in controls BUO Annual B Plan Scheduled control improvement projects Thresholds for Key Indicators for ORA and RPT DRACA, Internal Audit Recommendations, ORA & RPT B.U & PRO Annual Budget controls ORA, Risk Performance Target(RPT) –ORA & RPT split for business unit/principal risk owners High frequency, low impact loss history, expected volume growth, budgeted OR loss by the board OR Annual ORA Indication of budgeted OR loss Capital models from different risk types and strategic constraints of the board FD Annual Total RA Output for ORA Inputs Responsibility Frequency Action