Issue #24

Editor's Letter - Governance and compliance: Making headlines this month is the passage of the Volcker rule and the increased compliance burden.   News: Volcker Rule approved; RBS ordered to review business practices; Industry calls for cyber legislation; Natwest suffers outage and cyberattack; Bank of England again warns of cyber threats; EU fines eight banks; Comms monitoring gets serious; ESAs publish products guidance; FCA fines LloydsTSB and BoS for inadequate incentive schemes; IOR publishes risk culture sound practices paper.   Downfall: There are many recent examples of governance failings leading to bank crises, often ending in the resignation of chairman and CEO. The Risk Universe asks whether this is always the best course of action.   Spotlight - Under pressure: From chief executives to the lowest level intern, working in the cut throat world of global finance can take its toll on mental health. Following several high-profile resignations and indeed suicides, Victoria Tozer-Pennington takes a closer look at the operational risk impact of stress in the workplace.   How To... Recognise and manage stress in employees: Dr Genevieve von Lob examines the signs of stress and how to best manage stressed employees.   Rating cyber risk vendors: As the cyber threat continues to increase, firms are seeking qualified cyber risk rating firms to help risk managers understand the state of cyber risk to extended corporate networks.   Sharing Scenarios - Loss of key staff: This month’s scenario looks at the risks related to the loss of key staff that have unique skills and/or knowledge who cannot be replaced.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Staff poaching by external party: RiskBusiness International’s Mike Finlay takes a look at what often becomes a very contentious issue between rival firms, namely poaching staff from a competitor.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #23

Editor's Letter - Big Brother is watching: Traders’ instant messages mined for proof of market manipulation.   News: Trading book review paper precursor to op risk framework changes; Rabobank agrees $1bn LIBOR fine; EC to fine banks for EURIBOR abuses; FX manipulation investigations gather pace; US seeks to strengthen AML laws; Mexico fines banks over bond trades; Walmart hit by technical error; Quantam Dawn 2 deemed a success; London test follows; HSBC credit card glitch angers consumers; Knight Capital fined $12m; Survey finds firms have little understanding of legal risk; BSI publishes governance standard; FCA finds areas of improvement for asset managers; BSI publishes governace standards; OCC issues guidelines for bank consultants.   Vendor risk and intellectual property: The Risk Universe columnist Annie Searle addresses the very important operational risk of third-party vendor management.   Spotlight - Frontline operational risk management in the oil & gas industry: Leveraging a more holistic understanding of risk to lower operational risk and improve production efficiency.   Gen 2 Models: The important role of structured scenario analysis in building models that deliver value to the business and comply with regulatory requirements.   How To... Establish an executive protection programme: Mike Finlay, CEO of RiskBusiness, assesses how to establish an executive protection programme.   Sharing Scenarios - Tiger robbery: This month’s scenario involves tiger kidnapping, which involves the kidnapping of a person to force them to commit an act, usually illegal, on the behalf of the captors.   Risk Classifications - Kidnapping, Hostages and Extortion: This month we analyse the classification of incidents relating to kidnapping and extortion.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #22

Editor's Letter - More manipulation: As more Libor scandal fines emerge, regulators are now investigating firms for alleged manipulation of the foreign exchange markets.operational risk yet industry moves toward artificial intelligence and machine learning techniques.   News: JPMorgan exits businesses with high operational risk; Whale of a fine for JPMorgan; ICAP Europe fine for LIBOR failings; Complaints fall at UK firms; FINMA launches FX probe; PRA loses top risk personnel; UK firms’ PPI handling criticised; Cybercrime legislation on the way; UK to build resilience to cyber-attacks; Supervisor publishes operational risk circular   Gen 2 Models: Evangelos Sekeris, director, operational risk at Aon, and former regulator, shares his views on the evolution of operational risk models.   Spotlight - Culture engineering: What constitutes a good risk culture remains unclear for most firms regardless of some motivations by international regulators to promote “good” risk culture. A new report assesses the fuzzy concept of risk culture as well as the current regulatory and political agenda.   How To... Implement a GRC framework: Ellen Davis, Director, Workflow Proposition Marketing at Thomson Reuters, takes a fresh approach to the GRC framework debate.   The LIBOR Scandal: A new paper examines the LIBOR scandal from a systemic operational risk perspective and suggests better people risk management could counter many of the issues raised.   Sharing Scenarios - ATM or PoS card skimming: This month’s scenario looks at the use of devices to capture encrypted data off cards in executing fraudulent transactions.   Risk Classifications - Hostile work environment - senior and subordinate: Indicators of inappropriate culture within the firm, namely instances of senior to subordinate bullying, harassment and intimidation.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #21

Editor's Letter - Existential operational risk: Cybercrime named as existential operational risk yet industry moves toward artificial intelligence and machine learning techniques.   News: Cybercrime again highlighted as a prime operational risk; EU banking union inches closer; Tougher sanctions for financial markets manipulation; Fed criticises firms’ capital planning; IRHPs cost UK banks £500k; CFTC proposes HFT risk controls; US exchanges to introduce kill switches; AXA fined for advice failings; Shadow banking oversight to be tightened; Compensation reform needs more work; Progress made on disclosures; Current UK operational risk modelling practices – survey results.   Remembering 9/11: The Risk Universe columnist Annie Searle remembers the events of 9/11 and asks whether the lessons learned have also been remembered.   Spotlight - Shadow banking in china: In this article, a group of students from HKUST Risk Management and Business Intelligence examine the scale of shadow banking in China and its systemic implications for the rest of the world.   How To... Improve ID security: Facial recognition software is one way financial services firms can improve ID security and help deter online fraudsters.   Intelligent Modelling: Victoria Tozer-Pennington investigates the benefits of applying artificial intelligence and machine learning techniques to operational risk management and modelling.   Sharing Scenarios - Collateral management failures: This month’s scenario involves the failure to record a perfect lien over items provided as collateral against debt obligations.   Risk Classifications - Collateral management errors: This category concerns costs and losses arising from errors, mistakes and omissions relating to collateral against obligations due to the firm.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to their CEO detailing some of the issues they have always wanted to raise.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #20

Editor's Letter - Model behaviour: Operational risk modelling seems to be back in vogue.   News: RBS fined £5.6m for misreporting; PRA consults on strengthening capital standards horizon; Barclays refuses to pay fine; JP Morgan agree to pay FERC fine; BP responds to FERC market manipulation allegations; UBS settles SEC charges of misleading CDO investors; UBS Americas reaches £885m settlement with FHFA; UBS France fined €10 million; Bank of America charged with RMBS fraud; Juggernaut hedge fund fined; Fax blunder costs BoS £75k; Guaranty Trust Bank fined for AML failures; FINRA fines Oppenheimer for AML violations.   Spotlight - Powering up: Power market manipulation has been making headlines of late since FERC has been flexing its muscles and imposing large fines to send a message that any suspicion of manipulation is being investigated and will be severely punished.   How To... Manage process, risk and control instance records: The benefits of managing process, risk and control records and why taxonomies alone are not enough.   State of Play: First generation operational risk models were built before the financial crisis, firms are becoming aware of the need to review and evolve their internal models. Victoria Tozer-Pennington examines current practices in relation to operational risk model governance, use and validation.   Sharing Scenarios - Misselling: This month’s scenario looks at misselling, including deliberate attempts to mislead customers as well as negligence in ensuring their full understanding of a transaction or product.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Client or customer privacy breach: This category includes the accidental, negligent or unauthorised use of, disclosure of or leakage of confidential client or customer data in the firm’s possession.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #19

Editor's Letter - Frustration Reigns: Firms are left frustrated by the lack of clear rules and definitions from regulators.   News: Simple, not simplistic; Approved persons regime has failed, says UK Government; BCBS consults on the sound management of AML; China accuses GSK of bribery and corruption; Apple guilty of violating antitrust laws; FCA criticises trade finance firms; EU proposes Single Resolution Mechanism; UK insurer fined for £2.8mpoor complaints handling; US approves final regulatory capital rule: proposes new leverage ratio; Cybercrime is a systemic risk, says IOSCO.   Spotlight - Déjà vu: A senior operational risk manager shares his thoughts on the emergence of conduct risk management and why lessons need to be drawn from the past, specifically the evolution of operational risk management.   How To... Use behavioural science techniques: As operational risks are all caused by people, it is logical that firms and regulators are seeking to incorporate behavioural science techniques to help better analyse the human element present in risk events in a bid to help prevent similar and related events from re-occurring.   A vision for contingency management: Peter Smith, Project Risk Management expert and member of the Institute of Risk Management, outlines his vision for contingency management within profit making companies.   Sharing Scenarios - Theft of client or customer data: This month the scenario covers the theft of client or customer data and its use for criminal purposes. Also find the benchmarks to last month’s scenario that assessed the impact of incomplete or unavailable consolidated exposure information.   Letter to the Editor: A The Risk Universe subscriber shares his thoughts on the How to article from the June issue that looked at how to quantify a potential legal exposure.   Risk Classifications - Internal identity theft without system intrusion: Mike Finlay, CEO of RiskBusiness International, looks at the inevitable risk of staff stealing client and customer personal or identity data.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #18

Editor's Letter: The trouble with data.   News: Operational risk and cyber risks pose greatest threat; Immature approach to cyber risk; OCC seeks to raise awareness of cyber risk; Microsoft cyber-fraud sting; Regulators target digital currency; Risk director guidelines released; Another PPI mess; The end of the BIA?   Book Review - Risk and Governance: Sergio Scandizzo maintains that risk management and corporate governance are inextricably linked and calls on boards to focus on risk management.   If You Ask Me - Every Wall is a Door: The Risk Universe columnist Annie Searle shares questions posed to her by new students of operational risk that pose some home truths for the industry.   Spotlight - People: the hidden risk: Sandra Quinn addresses the importance of people risk management, which is often overlooked by firms.   Phantoms of the Dealing Rooms: Sebastian Fritz-Morgenthal and Hagen Rafeld examine what mandatory measures are required in financial institutions to detect rogue traders earlier.   How To... Quantify a potential legal exposure: With many firms facing legal action due to incidences of mis-selling, recent research by Loo Hong Jim Bryan seeks to determine the likely outcome using a statistical model based on empirical evidence.   Sharing Scenarios - Incomplete or unavailable consolidated exposure information: This month’s scenario assess incomplete information on current or projected consolidated exposures that affect decision making. Also find out the benchmarks to last month’s Sharing Scenarios.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Unauthorised Execution of Transactions: The execution of trades and transactions outside of the individual’s permitted mandate, license or approved trading responsibilities.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #17

Editor's Letter: Are firms doing enough to rebuild public trust?   News: New recruits shun banking; New bill seeks to end TBTF; Global cyber heist; APRA to replace risk management rules; FINRA fines three firms for AML failings; Kenya launches mobile money laundering crackdown; FCA fines EFG Private Bank for AML failures; FINMA gets new enforcement powers; PRA boss derides Solvency II; #OpUSA fails to deliver; FERC proposes new cyber security standards; EU investigates possible oil-price manipulation.   News Opinion - Conduct risk: TCF on steroids?: Based on the sold-out attendance at a recent breakfast briefing on conduct risk management, it is fair to say that all firms are taking the new Financial Conduct Authority’s powers seriously.   Spotlight - Learning from loss: Peru will require banks to share their operational risk loss data in a national database. Regulators from SBS, journeyed to the UK and Europe on a fact-finding mission to learn from other established loss data consortia.   How To... Conduct effective complaints root cause analysis: As complaints increase and are made public, it is essential that firms have effective complaints root cause analysis systems in place as part of a broader complaints handling process.   Sharing Scenarios - Oversight failures in product development and project management: This month scenario features the failure to create and implement appropriate policies and controls to ensure that new products and new projects achieve the intended business goals.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Commercial practices or conduct breach by third parties: The negative affect aggressive or improper business practice by competitors have on the firm in terms of losses incurred or foregone business opportunities.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #16

Editor's Letter - Back on the radar: Operational risk capital adequacy approaches made at priority at the Basel Committee.   News: New LDCE planned; MF Global report blames Corzine; CFPB releases complaints data; The Salz Review; Citi ordered to improve AML controls; FCA outlines key risks; UK issues benchmark supervision proposals; Canadian SIBs to hold an extra 1% capital; APRA issues Pillar 3 consultation; Goldman’s hit by rogue trader fine; RBS faces fine for outage, DBS still paying fine; The failure of HBOS; Bitcoin and AML.   Spotlight - All Change: Deadlines provided by the Financial Stability Board have given a new urgency to SIGOR’s work on all approaches for operational risk capital.   Business As Usual: London’s insurance community is irritated at interminable delays to the EU’s Solvency II project. But after heavy compliance costs already incurred by trying to lead the risk management pack, has frustration turned insurers against internal models?   How To... Establish a Meaningful ERM Programme: Mike Finlay, CEO of RiskBusiness International, sets out a beginner’s guide to Enterprise Risk Management (ERM).   Sharing Scenarios - Credit Approval Abuse: This month’s scenario involves the unauthorised approval of credit facility applications of a higher value than the staff member is authorised to approve or those that fail to meet credit policy requirements.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - External Credit Fraud – Collateral and Guarantees: This month’s data classification explores an external fraud issue that highlights the boundary issues between credit risk and operational risk.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #15

Editor's Letter - Whatever Next?: The Senate report into the London Whale losses at JP Morgan makes for grim, but unsurprising, reading.   News: Senate harpoons JPMorgan: Banks hit by another wave of cyberattacks; AML Compliance in focus; Banker pay in disarray; Industry hits out at Solvency II interim measures; Banks fail because of operational risk; SEC levies record fine for insider trading.   Spotlight - Virtual Wallets: Banking and payment technology is rapidly evolving. Paying for goods with a smartphone is convenient for the customer but what are the risks?   Straight Talking: Carlos Montalvo Rebuelta, executive director of EIOPA, speaks about those Solvency II delays and how firms can extract the business benefit of the new rules and implement a risk-based solvency regime for insurers   How To... Manage Emerging Risks: Although many firms identify and manage emerging risks, few employ a formal process to ensure oversight of these emerging threats to the firm. Mike Finlay suggests a methodical approach to managing emerging risks.   Perfect Pitch : Writing for Executives: Operational risk managers are adept at identifying risks and the best way to mitigate them. However, mitigation techniques usually require funds to implement, which means pitching to senior management. Annie Searle suggests some tips for getting your proposal heard.   Sharing Scenarios - Rogue Trading: A perennial problem in the trading and dealing rooms of every financial institution which has proven over time to reoccur time and time again, even when firms have decided that it just cannot happen here.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Skimming and Electronic Eavesdropping: The use of electronic monitoring equipment to detect, intercept and record personal information.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #14

Editor's Letter - Instant not private: Instant messaging evidence has once again been exposed as the vehicle for condemning traders at RBS for fixing Libor rates.   News: The Libor “cartel”; South Africa shifts to twin-peaks regulation; EBA issues Living Wills guidance; Deutsche Bank settles with FERC; Tribunal upholds Swift Trade fine; IIF urges regulatory coordination; Counting the cost of mis-selling.   Opinion - That that is, is: Howard Stein shares his views on the perceived advantages of ringfencing retail banking operations.   Spotlight - Breaking up the banks: German, France, the UK and the US have all put in motion legislation for separating banks’ investment activities from the retail areas of the group. Regardless of lobbyists claims this will not solve the “too-big-to-fail” problem, ringfencing is here to stay and firms need to be prepared.   Managing cloud computing risks: New technology is perhaps the most in need of stringent risk management, cloud technology specifically heightens operational risk exposure and its encroachment into large scale organisations – welcome or not – is happening and firms need to be prepared.   Sharing scenarios - Inadequate oversight on the sales practices of authorised distribution channels and representatives: This month’s scenario looks at the inadequate oversight of sales practices by distributors and representatives. Also find out last month’s scenario industry benchmark.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk classifications - Market or trading rules violations: Classifying losses stemming from market or trading rule violations, which has been highlighted by what is becoming known as the “IBORs Scandal”.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #13

New Year; New Challenges: Billion-dollar fines are forcing firms to refocus their compliance efforts.   News: OSFI scrutinises firms’ operational risk; BCBS principles for risk data aggregation and risk reporting; Global Risks Report 2013; US regulators censure JPMorgan’s controls; Lloyds hit by rogue trader scam.   Spotlight - Poles Apart: Firms are focused on ensuring regulatory compliance, which has led to the merging of operational risk management with compliance. The debate over the relationship between risk and compliance has re-emerged.   Dana Air: Could Better Operational Risk Management Have Helped?: The fatal crash of Dana Air Flight 992 on June 3, 2012 in Lagos, which killed all on board and ten people on the ground, has reopened the debate on aircraft safety in Nigeria and Africa more broadly.   How To... Defend Against a DDoS Attack: The “How to” article this month sets out ways for firms to protect against this increased risk and ensure that any infrastructure vulnerabilities are identified and secured.   Top Ten Operational Risks for 2013: With US banks coming under sustained cyber-attacks towards the end of 2012, it is unsurprising to see cybercrime and IT security topping the top ten operational risk rankings for 2013.   Sharing Scenarios - Damage or destruction of property and facilities arising from natural disasters: This month’s scenario involves damage to the firm’s property, business premises or facilities caused by some form of natural disaster.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Risk Classifications - Discriminatory Employment Policies and Practices: Classifying losses stemming from discriminatory corporate policies, procedures and practices in personnel decision-making, including hiring, compensation, promotion and termination.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.