Issue #12

The new Zeitgeist?: Operational risk is gaining prominence with regulators, politicians and mainstream media.   News: The red-headed stepchild demands more attention; HSBC fined $1.9 billion for AML failings; Operational Risk Timeline; UBS, RBS brace for Libor-related fines; IIF issues “practitioner’s report” on risk governance; FSA consults on product intervention rules; US-UK propose SIFI solution; Banking Commission grills Barclays; Suitable persons debate reopens; CFTC chief disagrees with Goldman’s fine; Libor overhaul continues.   Talking Capital: Mike Finlay, CEO of RiskBusiness, asks whether there is a need for an alternative regime for calculating regulatory operational risk capital.   How To... Audit Risk Culture: In the twelth of a series of monthly “How to” guides that seek to tackle those more difficult challenges relating to operational risk management, Victoria Tozer-Pennington assesses how to conduct a risk culture audit.   Motivating Through a Crisis: A double-dip recession, civil unrest and rioting in the streets have contributed to the worst economic crisis Greece has ever seen. Konstantinos Karydias, Group OpRisk Officer at Eurobank, shares his personal experience of motivating staff through such a difficult period.   Money Laundering: This month’s scenario involves the deliberate or accidental facilitation of money laundering by the firm relating to funds resulting from criminal activity, taxation evasion or terrorist financing.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Natural Disasters Resulting in Direct Physical Damage: This loss event type covers losses and damage to the firm, its property, premises, assets and systems, as well as losses due to injury to staff or to customers or clients on the firm’s premises, arising directly from natural disasters.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #11

Enough is Enough: Enough is enough - Regulators, disgusted with the scale of operational risk events, are stepping up scrutiny of firms.   News: FSB focuses on operational risk; FSB issues RR guidance; Operational Risk Event Timeline; Banks deny energy market manipulation; Trading operational risk under scrutiny; Firms struggle with ICAAP; Sandy tests New York business continuity.   Culture Club: Jonathan Howitt takes a fresh look at the issue of risk appetite and argues that it is more about culture, not just capital and liquidity.   Ethical Misconduct: Is it your Biggest Risk?: This article forms part of a presentation Annie Searle made early in November 2012 at the Pacific Northwest Enterprise Risk Forum.   Ancient Culture Meets Modern Ethics: With the news that Nomura suffered yet another insider trading breach, The Risk Universe questions the effectiveness of operational risk management and compliance in the region.   How To... Measure Reputational Risk: In the eleventh of a series of monthly “How to” guides that seek to tackle those more difficult challenges relating to operational risk management, Mike Finlay, CEO of RiskBusiness, explains how to create a “reputational risk barometer”.   Core Transaction Capture System Outage: This month’s scenario involves system outages of core transaction capture systems. The results of last month’s fraudulent loan application scenario benchmark are also listed.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Privacy Breach - Employee Data: This is a risk category which tends to be overshadowed by concerns around client and customer confidential information, yet which can be as costly, as embarrassing and potentially more damaging for the firm.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #10

Nothing New Under the Sun: Nothing new under the sun – Hands up all who have been surprised by anything revealed during the UBS rogue trader trial?   News: US regulators take aim at financial crisis perpetrators; KDKE Indonesia launched; Operational risk event timeline; IRM’s risk events survey; Identity crime raises UK fraud; EBA Pillar 3 review released; More US banks to qualify for stress testing; Cyberattacks on the increase; Using social media to look inward; Are “kill switches” the answer to HFT risk?   Balancing Act: The three lines of defence model has become the accepted framework for firms’ management of operational risk, but in practice, some operational risk departments are finding it difficult to balance the requirement to remain independent with the need to help the business manage its own operational risks.   Managing Your Reputation: A survey conducted by KPMG in Germany, shows banks are working to embed reputational risk management into their organisations, albeit with varying progress and success.   How To... Manage Identity Requirements: Dr Stephen Christie looks at the very important issue of identity management – assessing the mistakes made so far and proposing some solutions.   Fraudulent Loan Applications: This month’s scenario involves fraudulent loan applications by individuals or entities, without identity misrepresentation, but who do not intend to repay the money.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Assault and Bodily Harm to Staff: While it may not occur that frequently, assault and bodily harm to staff often causes considerable confusion as to where events should be classified.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #9

The Golden Age: A Golden Age: Supervisors berate complexity of Basel rules and seek a return to basics.   News: Back to basics; Backlash grows against algo trading; Operational risk event timeline; FSA proposes multiple client money pools; BlackRock fined for client money breach; Insurers lag behind on the use of insurance; FCA’s crusade on bonuses; Lloyds braces for misselling fine; Whistleblowing retaliation rising; IRS awards whistleblower $104m.   Opinion - Were he a cookie, he’d be a fortune cookie: Howard Stein shares his views on the argument to reinstate Glass-Steagal and too-big-to-fail.   Losses Never Die: As firms, in the UK and Europe at least, amass the required five years of operational risk loss data, questions surrounding the treatment of older operational risk loss data for capital modelling purposes are beginning to emerge, with varying responses.   Imperfections and Things Going Wrong: Philippa Girling assesses the success of the London 2012 Olympics from an operational risk management point of view.   How To... Manage Incentives: Incentive management is a crucial issue for all parties involved in the risk management of organisations. Ariane Chapelle proposes the MESAR model as an original approach to managing incentives.   Fraudulent Payments: The scenario involves fraudulent payments, which includes staff transferring funds or creating fictitious payments in order to embezzle funds, as well as collusion by staff with external parties to embezzle funds. Plus, the results of last month’s benchmarking exercise.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Misrepresentation and Concealment of Facts: Deliberate acts of misrepresentation or the concealment of facts which adversely affect decisions made by the firm.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #8

Inadequate Risk Measures: The near-collapse of Knight Capital Group is proof, if any were still needed, that it is operational risk loss events that sink firms.   News: A Black Knight event; Standard Chartered settles for $340m; Confidence declines in banks ability to fight fraud; LIBOR – the Wheatley Review; US banks step up push-back on Basel III; New computer virus discovered; CRD IV implementation delayed for several months; Risk appetite a concern for OSFI; Money laundering regulatory burden eased; SCRA failings at Capital One; Nomura fallout continues; Market manipulation at Porsche.   Putting The Brakes On: Knight Capital Group lost $440 million when its new algorithmic trading system malfunctioned on August 1. The near death of one company has polarised regulators’ attention on the future of algorithmic and high-frequency trading.   Culture: The subprime mortgage crisis, foreclosure practices, interest rate rigging, miss-selling payment protection insurance and interest rate swaps, money laundering breaches… the list goes on. This article asks whether banking culture is fundamentally broken and systemic.   How To... Manage Conduct Risk: Confusion reigns over precisely what Conduct Risk is and who should be responsible for it. This is a simple how to guide on how to approach conduct risk management.   Data Entry Error: This month’s scenario includes incorrect data entry by employees at the point of instruction for a client or when executing trades for the firm. Otherwise know as “fat finger” errors.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to the CEO detailing some of the issues they have always wanted to raise.   Transaction Data Capture and Input Errors: How to classify events arising from the erroneous entry of data or failure to correctly capture transaction details by mistake at the point of customer or client instruction or when executing transactions for the firm.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #7

It Could be You: It could be you: Events at Natwest, Barclays and HSBC show no bank is immune.   News: Libor scandal deepens; Traders understated losses at JPMorgan; Compliance dept given new teeth at HSBC; Unethical and illegal practices rife, says survey; Lessons learnt from the Natwest outage; GSK handed record $3billion fine; Solving the risk appetite problem.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Opinion - A Diamond in the rough: Howard Stein, ex-MD of Operational Risk of Citigroup’s Global Corporate and Investment Bank, shares his views on Liborgate.   Not an Exact Science: Spurred by Andrew Haldane’s speech that criticised models as unfit for purpose, John Thirwell shares his opinion of current modelling techniques.   Come Together: New regional loss data consortia emerge in response to local demand, while existing consortia beef up functionality for their members. Victoria Tozer-Pennington reports.   Managing Risks from Strategy to Execution: Spyro Karetsos, who leads the Enterprise Risk Management team at Vanguard, explains how he has developed an ERM program.   Reflections on the Lost Bank: Through a review of Kristen Grind’s book on the history behind the failure of WaMu, Annie Searle, looks at how the intersection of people, process, systems and external events often lead to financial loss without proper risk management.   Inappropriate Corporate Governance: This month the scenario examines involves inadequate, inappropriate or weak corporate governance structures, processes or oversight.   Ensuring Robust Governance: The Risk Universe sets out a roadmap to implementing robust governance throughout the organisation.   Classifying Governance or SOX Violations: Recent events at Barclays and JPMorgan Chase have highlighted governance failings but classification can be difficult in this area.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #6

The Most Important Risk: The OCC is right to say operational risk is the most important risk facing firms.   News: US approves Basel III; Insurers overlook importance of operational risk appetite; ING handed record fine for money laundering; EU releases Living Wills draft directive; Spectre of pan-EU regulator resurrected; JPMoby-Dick and its reluctant voyage on the Pequod; Dimon admits mistakes; Can HR spot future rogue traders?; EU adopts Cybercrime report; UK issues financial reform bill.   The Regulators’ View of Operational Risk: As the new Comptroller of the Currency sets out his devotion to operational risk management, the Federal Reserve takes a more balance approach.   Making Sense of it All: Effective data aggregation and reporting are complex challenges for all financial firms, but they pose a particular problem for large, global banks. The Risk Universe takes a look at the challenges.   How To... Aggregate Risk Data: Aggregating operational risk data is a complex challenge but this guide sets broad steps to help firms approach the difficult task.   Taking Risk to New Heights: Information security is of primary importance to Boeing and ensuring the safety of that information in 70 locations around the world, requires strong risk management.   Model Parameterisation or Input Issues: This month’s scenario looks at errors, assumptions or input’s into firm’s actuarial, economic or financial models, caused by inexperienced staff or by incorrect parameters.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Great Expectations: As this year will mean the second or even third submission of a firm’s Internal Capital Adequacy Assessment Process (Icaap), regulators are expecting improvements.   End-user Developed Application Errors – Model Error: This month: How to classify model malfunctions or errors, including incorrect macros, spreadsheet formulas, rounding errors and calculation errors.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #5

News: HSBC USA investigated for money laundering failings; JP Morgan’s trading loss; FINRA fines four banks for ETF supervisory failings; U regulatory round-up; Wise move by Nasdaq; FSA Bans MSIEu Chairman.   Sitting on the Boundary: Although boundary risks in banking are a problem, it could be argued insurers face an even more difficult challenge of classifying insurance and operational boundary risks, writes Mike Finlay.   Shareholder Spring: Investors are taking a stand over excessive board and executive pay as share values plummet. But how far is this the dawn of a new era of accountability for boards and senior managers? Victoria Tozer-Pennington reports.   Re-classifying Boundary Risks: The financial crisis demonstrated that for too long operational risk events have been wrongly classified as credit risk events. Ellen Davis reports.   How much Operational Risk is there in Credit?: Nasreen al Qaseer and Hansruedi Schütter present findings from original research into the extent operational risk events are wrongly classified as credit risk.   Operational Risk Essentials - Starting from Scratch: Elena Pykhova, chair of the Operational Risk Committee within the Association of Foreign Banks, goes back to basics.   Credit Application Due Diligence Failures: This month's scenario involves failing to undertake appropriate levels of due diligence and checking during the assessment of a credit facility application. Also find the results from last month's scenario benchmarks.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Legal Risk: True Transparency or Not?: One risk manager shares his views on the challenges of accounting for legal risk losses.   Risk Classifications - Internal Credit Approval Fraud: This month's classification column explores a risk category which is often a source of debate as to whether it constitutes credit risk or operational risk.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #4

Everything's Fine: Fines for failing in systems and controls have been steadily rising. Firms would be well served to initiate reviews of their existing systems to identify any shortcomings in advance of any regulatory probe.   News: APRA demands increase in op risk Pillar 1 capital; Goldman fined for ‘trading huddles’; G30 calls for corporate governance shake-up; Investment banks derided for poor ABC controls; MAS to enhance capital rules for insurers; EU seeks to cap executive pay; EU calls for tougher rules on insider trading; Basel Committee progress report.   People Power: Does the head of HR report to the CRO? And if not, why not? Mike Finlay takes a fresh look at the 'people' element in the definition of operational risk.   Reinventing Risk Assessments: Disillusioned with past risk control self assessments, operational risk managers are implementing more holistic projects to create a total view of the firm's risk exposure. Victoria Tozer-Pennington reports.   Inadequate or Defective Customer or Client Onboarding Procedures: The scenario this month involves the failure of a firm to ensure appropriate customer or client onboarding.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   The Fallout from Living Wills: Banks completing resolution and recovery plans fully expect regulators to force changes. Victoria Tozer-Pennington reports.   Anti-Money Laundering : A Very Real Risk: The record fine handed out to Coutts by the FSA for anti-money laundering breaches has bought home the importance of keeping AML systems and controls up to date. Nick Matthews and Emily Benson investigate.   How To... Avoid a Fine for Bribery System and Control Failures: Emma O'Kane and Leonie Munro of Eversheds set out how to avoid a regulatory fine for failings in bribery and corruption systems and controls.   Combating Money Laundering: RiskBusiness' Mike Finlay explores anti-money laundering failures and breaches - a risk category which has recently made news headlines for all the wrong reasons.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #3

Rebranding Operational Risk?: Rebranding is rarely a success nor does it usually improve the thing it is rebranding. Operational Risk has been replaced by Conduct Risk and it is the role of the FCA to mitigate this.   News: Four banks fail US stress test; Retail Conduct Risk Outlook shows future focus; Double blow for Goldmans; Banks brace for another scandal; RBS hands back parts of ABN Amro; CFTC acts to secure client funds; Charades-playing banker fined for improper conduct; Banking banana skins; ETF settlement fails under SEC investigation   Inherently Flawed from the Bottom Up: Bottom up risk assessments chew up time and resources for little benefit, says Jonathan Howitt, better to focus on the top down perspective.   Opening the Door on Hedge Fund Infrastructure: Shaken by recent events such as Madoff and the broader financial crisis, investors are demanding hedge funds demonstrate greater and more robust operational infrastructure.   Giving the Right Advice: The scenario this month involves the provision of inadequate, incorrect or inappropriate advice by the firm or a member of staff to customers and clients.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   On Your Marks...: Businesses have been advised to arm themselves with robust inbound voice continuity plans ahead of London 2012. Andrew Bale, CEO of Resilient Networks investigates.   A Question of Conduct: Regulators are focused on improving the conduct of financial services firms and as such, managing 'conduct risk' needs to be priority. Ellen Davis reports.   How To... Incorporate BEFs into Pillar 1 Calculations: Mike Finlay, CEO of RiskBusiness International Limited sets out an easy to follow, step-by-step guide to incorporating business environment factors into your Pillar 1 calculations for operational risk.   Debt Recovery Practices: RiskBusiness' Mike Finlay explores impermissible debt collection practices - a risk category which is repeatedly in the news, particularly in the US in the area of mortgage foreclosures.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #2

A Missed Opportunity: It is clear with Solvency II that insurers are repeating all of the same mistakes the banks made. Insurers should engage with their regulators sooner rather than later.   News: Addressing the cyber threat by BITS; Tools emerge to track reputational risk; Pressure mounts to use internal model for op risk; Four ex-Credit Suisse traders charged.   Special Report - MF Global – A lesson for CROs: MF Global is being viewed as the poster child for the inadequacy of the chief risk officer. Warnings from both former and current CROs went unheeded by the MF Global board.   History Repeating: Those ignorant of history are doomed to repeat it and yet despite this oft-quoted warning, insurers are failing to learn the lessons of Basel II. Victoria Tozer-Pennington reports.   The Hidden Operational Risk - Settlement Fails: The number of settlement fails is growing substantially and threatens the stability of the market.   Client Money Segregation Failure: This month the scenario involves the failure by a firm to clearly segregate client money from the firm's own funds.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Social Climbing: Social media is a powerful marketing tool when done right but it can also be a source of significant risk.   Fraud Rising to the Top: In such a stressed economic environment, with job cuts being made in the bank office and middle management, opportunities are being created for employees and managers under pressure to commit fraud.   How To... Perform an Outsourcing Risk Assessment: Mike Finlay, CEO of RiskBusiness International Limited sets out an easy to follow, step-by-step guide to establishing the processes required to manage outsourcing requirements.   Here's a Little Something for Yourself: RiskBusiness International Limited's Mike Finlay explores the accepting of bribes by employees - a risk category which has recently been the subject of new legislation and considerable media debate.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.

Issue #1

A Breath of Fresh Air: Editor Victoria Tozer-Pennington introduces and explains The Risk Universe to readers.   News: Solvency II-type risk framework proposed for pension funds; UK crackdown on pay; Olympus scandal; AMA model changes; UAE Central Bank in cyber-attack   Cybercrime - The New Normal: A cyberwar is currently being waged between nations and financial services firms are increasingly being caught in the cross-fire or attacked as specific targets. To operate business as usual in this new environment, firms need to get serious about cyber security. Victoria Tozer-Pennington reports.   Managing Op Risk in the Arab Spring: Heightened geopolitical risk in the Middle East region increases the importance of factoring sound situational analyses into any operational risk assessment.   Denial of Service (DoS) Attack: Every month The Risk Universe will present a scenario on one of the most relevant operational risk incidents. This month the scenario involves a Denial of Service attack which is a growing and very real threat to financial service firms. Readers are invited to assess and submit their responses.   Preparing for a Collapse: Governments, investors and banks are all preparing for a substantial change in the make up of the Eurozone. Victoria Tozer-Pennington investigates the main operational risks in such a scenario.   How To... Design a Robust Operational Risk Appetite Statement: In the first of a series of monthly 'How to' guides that seek to tackle those more difficult challenges relating to operational risk management, Andrew Smart, CEO of Manigent, sets out an easy to follow, step-by-step guide to setting a robust operational risk appetite statement.   Sigor Moves to Change Gross Income Measure: Regulators agree gross income is a flawed measure for calculating operational risk capital, but they are struggling to agree on what to replace it with. Ellen Davis reports.   Dear CEO: Every month an anonymous chief risk officer of a financial services firm writes a letter to his CEO detailing some of the issues he has always wanted to raise.   Making Sense out of Data Classification: In this, the first of a regular feature on data classification issues and guidelines, RiskBusiness International Limited's Mike Finlay explores external malicious acts involving systems intrusions - a risk category which has seen frequent mention throughout this issue of The Risk Universe.   Classified: Find all your job advertisements here alongside information on upcoming industry events and The Risk Universe monthly comic.