NON-FINANCIAL RISK MANAGEMENT - Capgemini

2. Non-Financial Risk: Incident ManagementData availability is fundamental for effectiveincident management. Incident management in Non-Financial Risk Management(NFRM) encompasses the identification, capture, andanalysis of risks and the elaboration of respective actions.The establishment of an effective incident managementsolution promotes faster response to risks, and makes itpossible to proactively address potential vulnerabilities andprevent further incidents. It identifies potential sources ofrisks (e.g., implementation of a new product, outsourcingof services, external incidents, etc.), provides the necessarydata, and triggers subsequent risk assessments in everyimpacted unit. In one word, sound incident managementsimplifies Non-Financial Risk Management. In addition,process efficiency and effectiveness can be increasedthrough the use of new technologies. Data availability is fundamental for effective incidentmanagement. At Capgemini Invent, we are pleased toprovide you with structural recommendations based onthe cross-sector best practices discovered during ourvarious projects across Europe: Common taxonomy: Development of a mutually exclusive and comprehensivelyexhaustive risk taxonomy of actual risk events and aneffective risk identification process; alignment of thetaxonomy with external sources to facilitate the integrationof external data into the internal (incident) database. Governance and organization: This involves establishing a clear structure with explicitownership and responsibilities along the three lines ofdefense. In particular, the responsibilities between the firstand second lines of defense should be clearly articulatedwithin the organization and a permanent control teamshould be created to review the activities and controlsperformed by the first line and to report to both thefirst and second lines in order to permanently monitoroperational risks and promote a sound risk culture. People and culture: This involves living a culture that recognizes the importanceof managing Non-Financial Risks to the extent thateverybody in the organization is aware of the risks triggeredby their activities regardless of whether they are directlyor indirectly affected by them. One of the best practicesto support risk culture is the establishment of a respectiverisk culture entity in the organization. The entity should besponsored by different departments, such as Risk, Legal,Compliance, and HR. Beyond that, the community shouldfoster knowledge sharing, leverage best practices, andencourage actively challenging existing methods.Technology and tools: This involves implementing tools supported by newtechnologies to examine historical data on losses andto identify (potential) correlations and patterns. Newtechnology will also help to maintain a more complete riskinventory and better integrate external data (e.g., such asthe data from ORX).7

In addition to the above-listed prerequisites, incidentmanagement furthers improves when best practices areimplemented: Risk identification and documentation When identifying an incident, a comprehensive picture ofthe incident must be captured. Appropriate governance andorganization, combined with the right people and culture,leverage the identification process. Lastly, a well-developedrisk taxonomy facilitates clear and appropriate categorization. Assessment and documentation of root causes Every identified incident must be analyzed to its root cause.Storing this information in a central database promotesan accelerated initial analysis and makes it possible toproactively reduce incident frequency and solve the rootcause of every NFR problem. Documentation of (potential) impacts of eachincident The impact of each incident to the enterprise is documented,resulting in measurable outcomes, making resultscomparable and improving audit tracking. 8Creation of an action plan The fundamental remediation of historical incidents is asolid basis to prevent potential incidents in the future. Everyremediation action should be defined by considering thelink between the root cause and the (potential) impactof each incident and it should target failing controls andprocesses. Remediation actions can vary, from automatingfailing processes to questioning management bonuses, byrepeatedly incurring incidents. Incident management using modern applications A solid incident management tool supports the above bestpractices and provides a dashboard with customizableoutputs to track and report incidents. Automated mailtriggers include escalation and security processes. To furtherimprove the identification, documentation, and assessmentof incidents, the possibility to couple big data with advancedanalytics. This can be further enhanced by using naturallanguage processing and optical character recognition.Machine learning, APIs, knowledge base, and SLAs supportshould also be facilitated.

3. Risk Culture: from Reactive to PreemptiveOrganizations with a preemptive risk culture are betterequipped to mitigate, minimize, and avoid risks due tothe proactivity and risk awareness of their associates. The recent evolution of risk culture Most companies have extensive experience with riskmanagement, and financial institutions firmly belong inthis group. However, the 2008 financial crisis demonstratedthat financial institutions had behavioral shortcomings withrespect to how risk and internal controls were measured andapplied – often in contrast to formal process protocols. Thisbehavior led to unimaginable consequences and contributedto the deepening of the financial crisis. Regulators deviseda number of post-financial crisis measures to close this gap,including a formal guidance on how financial institutionsmust maintain a risk culture. Many chief level executives regard this evolution as a genuineopportunity to make their organizations more sustainableand resilient in the face of future crises. They engaged inserious self-assessment of their risk cultures, determinedwhere deficiencies existed, and then began the long-termprograms necessary to transform their organization’sbehaviors related to risk. By doing so, COOs, CROs, CEOs andboards became proactive in discussing the internal tradeoffsfor risk and control. By setting up the top management tonecommunicated to internal stakeholders giving directionto the overall organizational risk culture, they managed tomake the cultural aspects of risk issues more visible, betterunderstood, and more widely accepted across the entireorganization. The top management tone also allowed themthe opportunity to reestablish credibility with regulatorsand the public while they continued to fulfill their essentialmandate within the economy. Financial institutions thusformalized company preemptive cultures centered aroundself-awareness of risk. This risk awareness is the coreinstrument designed to ensure their overall stability andsustainability into the future. Risk culture is the combinationof the awareness, behavior, competencies, and expertiseexercised within the context of the technologies and dataquality used to perform daily tasks. Preemptive risk culture stresses the proactivity of internalstakeholders by enabling them through well-communicatedrisk governance mechanism. The aforementionedproactivity is further empowered by clearly defined riskmanagement processes. The pandemic and risk culture The pandemic is resulting in a global economic recessionthat could lead to permanent shifts in competition acrossthe global business landscape. Although it is too soon toknow how a recovery will play out, we do know that firmswith mature risk cultures are better equipped to navigatethe economic downturn to ensure their survival. Weexpect risk culture maturity to receive increased attentionfrom regulators in the upcoming months. Consequently,organizations should focus their attention to enhancetheir risk culture, thus ensuring competitiveness andregulatory compliance. Risk culture in dynamically changing world The development of preemptive risk culture in all types ofcompanies – not only limited to financial institutions – willbe immensely valuable in helping companies adapt tothe dynamically and continuously changing operationalecosystem. Our experience in improving risk culture hasled us to conclude the following key findings that indicate amature risk culture setup: 1.Review and update risk appetite statement in alignmentwith corporate strategy. 2.Set up a risk governance mechanism that promotesself-awareness, track risk metrics, and hold employeesaccountable in conjunction to incentivizing them toproactively operate with enhanced risk awareness. 3.Design risk management processes and seekaccreditation such as IEC 31010:2019 & ISO 31000:2018(relevant for FS and non-FS). 4.Improve risk processes continuously, communicate andeducate employees about risk awareness. 5.Enhance operational efficiency to ensure highdata quality leading to better risk identification,measurement, and assurance. 6.Proactively invest in risk management IT systems toincrease resilience to unidentified risks and visibility intracking identified risks.9

Innovative RiskManagmentRisk Minimization/AvoidanceOptimal RiskMgmt ProcessesSecuring BusinessViabilityImproved RiskMgmt ControlsEstablishing end-2-end preemptive risk cultureRisk AssuranceStrategyRisk ApetiteDesign & BuildImproveRisk ReportingRisk Mgmt Decision(Avoid, Minimize or Mitigate)Risk Measurement& AnalysisRisk PeopleTechnologyCorporatestrategyRisk ApetiteStatementStatutory / Standards / PoiliciesBusinessstrategyRisk LimitsSystems & Technology InfrastructureRoles &ResponsibiltiesCapabilities / Competencies / CapacityGRC functionProcess / Procedures / ControlsGovernance / PeopleCIPTop Mgmt ToneCommunicateEducate ProactivityKPIs/ AccountabilityIncentivizeLearnPeople &MindsetChangeTransformation &RiskAwarnessData foundationNext steps – and validation for a solid preemptiverisk culture The concept of the risk culture should be a core part of acompany’s strategy. Companies can benefit from actingon the lessons learned by financial institutions in the 2008financial crisis and be proactive given the reactions taken byregulators to curb the behavioral shortcomings of financialinstitutions. Many financial institutions are already at thebeginning of the risk culture journey and we are expecting anincrease in efforts to enhance risk culture maturity to copewith market changes. 10First, a functioning preemptive risk culture enablesthe entire corporation to solve risk problems andtake actions at an individual level. In an economicenvironment where the full scope of risks is not known,this capability will become a vital asset to bolster thefirm’s ability to react to disruption. Second, organizations that establish a maturepreemptive risk culture can better manage their risksand reduce risk of failure, even when they must deal withextreme unexpected events. Third, building a mature preemptive risk culture is adynamic and continuous process that requires time,patience, and effort, but it offers long-lasting resilienceduring times of financial stress. Fourth, to build an organization that is stable andsustainable over a long period of time, risk cultureis essential. Even outside the scope of the currentpandemic, recent years have seen an increase in naturaldisasters, incidences of cyberattacks and data breachesthat are becoming more and more prevalent. Fifth, in a business system that is set up to anticipateas much as possible and be flexible with procedureswhen the worst happens, coping mechanisms withinrisk cultures become second nature for employees andmanagers alike. Preemptive risk culture would not only enable organizationsto resiliently thrive within uncertain and constantly changingenvironment, but it would rather create a competitiveadvantage providing an edge of swiftly and efficientlyswaying through unfavorable market movements whetherexogenous or endogenous.

4. The changing face of Operatinal RiskThe risks facing financial services players aremultiply-ing and evolving. Creating a dynamicand proactive risk culture is essential to preventserious losses.In shortFrom the ever-present threat of cyber-attack, to theunexpected and sudden impact of a global pandemic,operational risk is a fact of life in the financial industry. Andwhile oper-ational risk management is critical, the practice isstill in its infancy.Despite this immaturity, its relevance is highlighted by thecontinuous revisions and re -views published by the BaselCommittee on Banking Supervision (the Committee). Theirmore recent being the publication of a consultative paperwith proposed updates to the Principles for the SoundManagement of Operational Risk (PSMOR), as well as thenewly minted Principles for Operational Resilience (POR),both in 2020.Operational Risk ManagementFramework (ORMF)Identification and assessmentof operational risksAdditions and changes to the Principles for the SoundManagement of Operational Risk include: More details to each specification in each principle Fleshed out roles and responsibilities of the board of directors and senior management A fully new principle on Information andCommunication Technology (ICT)The Principles for Operational Resilience aim to:Both documents are at the forefront of current affairs in thisindustry and offer a glimpse of the regulatory challengesfinancial institutions will face in the future. In this article, weoffer an overview of the updates and new principles, andconsider the impact on Finance, Risk and Compliance (FRC)functions.Risk culture Improve banks’ ability to deliver critical operationsthrough disruptions Strengthen banks’ ability to absorb operational riskrelated eventsThe PSMOR: and then there were twelveSince the adoption of the PSMOR in 2011, the operationalrisks faced by financial institutions have increased andevolved. The current consultative paper addresses thischanged landscape in the following twelve principles:Board of directors:implementation ORMFChange managementControl and mitigationSenior managementMonitoring and reportingBusiness continuityICTDisclosureThe following additions are impending:The BCBS has published a paper on cyber security. Expanded requirements on risk culture, code ofconduct, and ethical be-haviorThe following changes were proposed: Explicit delineations of the roles and responsibilities ofthe board, senior management and the three lines ofdefense A comprehensive non-exhaustive list of tools to identifyand assess opera-tional risks, such as operational riskevent data, self-assessments, event data and scenarioanalyses A new principle (principle 10) addressing theimplementation of sound ICT: its aims, its maintenance,and the roles and responsibilities related to them A request for the inclusion of a standardized and fullydeveloped Operational Risk Management Framework(ORMF). A call for clear-cut definitions of processes and controlsregarding the re-view and approval for new products,processes, and systems and that these should bemonitored by a dedicated change manager Demands for the analysis of severe but plausibledisruption scenarios and the corresponding businesscontinuity planning (e.g.: thresholds, business impactanalysis, discovery and recovery procedures)11

The POR: brace for impactThe Principles for Operational Resilience were developedand proposed by the Committee to mitigate operationalrisks and to strengthen operational resilience in this industry.The latest updates aim to enable banks to deliver criticaloperations through disruption. Their objectives are asfollows:Promote a principles-based approach toimproving operational resilience – the abilityof a bank to deliver critical operations throughdisruption.Reflect any initial lessons learned from theimpact of the Covid-19 pandemic.Ensure that existing risk managementframeworks, business continuity plans, andthird-party dependency-managementare implemented consistently withinthe organization.The seven newly designed POR address many criticalincidents faced by financial institu-tions, amongst them theCovid-19 pandemic and a rise in cyber-attacks. The scope liesprimarily within:1.Governance2.Operational risk management3.Business continuity planning and testing4.Mapping interconnections and interdependencies5.Third-party dependency management6.Incident management7.ICT including cyber securityWith respect to ICT, the Committee sets requirementson how the physical and logical design of informationtechnology and communication systems need to be met bybanks. This includes the individual hardware and softwarecomponents, relevant data and the operating environment.Additionally, a documented ICT policy incorporating theincreas-ing issue of cyber security is expected from banks.When suggesting these principles, the Committeeconsidered third-party activities where failure would leadto the disruption of vital services. This was especially thecase with regard to major institutions with a high marketshare and globally interconnected opera-tions whereconsequences might represent a serious potential for dangerin terms of the non -functioning of the real economy and forfinancial instability.12Moreover, the POR require that banks reflect on any initiallessons learned from the im-pact of Covid-19 in order toimprove the pain points in their operations. Simultaneously,banks should ensure that their existing risk managementframeworks, business continuity plans, and third-partydependency-management are implemented consistentlywithin the organization.How will these changes affect the FRC function?There are three distinct challenges: risk culture, roles andresponsibilities and risk assessment.Risk culture includes setting standards and incentives forprofessional behavior. Roles and responsibilities refer toexplicitly delineating the roles and responsibilities of theboard and senior management, as well as the three linesof defense, by which we refer to a widely used model formanaging risk. Risk assessment comprises choosing andset-ting up the tools to identify and assess operational risks(e.g. event data, self-assessments, and scenario analyses).Responding to these challenges can require fun-damentalchanges both operationally and institutionally.At Capgemini Invent, we have many years of expertise inhelping financial intuitions en-sure regulatory compliancethroughout all corporate functions on a global level. Wehave drawn on this experience to develop enhanced riskmanagement solutions to tackling the three key challenges:Risk Culture: The concept of a risk cultureshould be a core part of a company’s strategy.Firms need to establish a mature preemptive riskculture to better manage their risks and reducerisks of failure, even when they are dealing withextreme unexpected events. The building of a risk culture is adynamic and ongoing process, which enables organizations toresiliently thrive within an uncertain and constantly changingenvironment. Getting this right can create a competitiveadvantage by providing the agility to quickly and efficientlynavigate through unfavorable market conditions, whetherexternal or internal to the financial industry. Find moredetails about our preemptive risk culture concept in our RiskCulture Blog.Roles and responsibilities: Understandingboth current and future roles and responsibilitiesin an organization is the first step in a businessoptimization process. Organizations need tobe clear on their degree of compliance withthe recently introduced Basel Committee on BankingSupervision (BCBS) requirements. To support our clientswith this, we have developed an extensive governmentaland organizational assessment providing guidance onensuring a compli-ant corporate structure. The CapgeminiInvent governmental and organizational assessment usescustomized questions to examine any compliance gap andhelps to prioritize remedial actions with the key stakeholders.

Risk assessment: The BCBS formulatedspecific risk management measures as part ofits ICT policy, including access controls, criticalinformation asset protection and identitymanagement, to ensure that appropriate riskmitigation strategies are in place. ICT, and cyber security inparticular, is embedded in an evolving threat land-scape. Arecent study highlights the extent of the average lossesfor dif

increased Non-Financial risks and provide best practices from European financial institutions. 1. "Non-Financial Risk: Be a pioneer in key areas before you lead the list of fines" - Impact of Non-Financial Risk Management on financial institutions and main trends on the market -Erekle Tolordava and Hans Lohrmann 2.