August 26, 2010
Operational Risk Management
In this era of global financial crisis where company after company, economy after economy is plunging into deep crisis, efficient risk management departments have become a necessity. We have seen companies like Fannie Mae & Freddie Mac being taken over by US government, Merrill Lynch being bought by Bank of America and American International Group (AIG) relying on help from US government.
Nassim Talebs prediction of Black Swans is fast becoming a reality with the days of comforts of Greenspans regulatory insulated environment going on the fast wane. While conventional banks are facing crisis Islamic Banks are still growing and making profits. As Warren Buffet once rightly said Risk comes from not knowing what you are doing. Islamic Banking industry cannot sit back and pretend to have divine protection. Risk management professionals need to move fast in order to block arrival of a Black Swan in the Islamic Banking industry. One of the major hubs of Islamic Banking Dubai has already seen a domino which could easily have become a Black Swan. The banking environment is continuously changing. The comfort of an insulated environment offered by regulations in the past is on the fast wane. The resulting uncertainties are calling for proper risk identification, measurement and management. Where as, a well known Shariah Adviser Dr Zubair Usmani views that the Islamic banking industry remained largely unaffected of the US economic downturn because of the principle of lending backed by assets. He emphasized his views by explaining that for example if he sells his mobile to person A, Person A pays money to him and also gets the custody of the mobile phone i.e. asset backed transaction. On the other hand, Islamic Banks are more prone to operational risk than conventional banks.
Operational risk is the risk of loss resulting from inadequate or failed internal processes, people and system or from external events. Such risk is one of the oldest risks in banking that has been managed all along quite informally but of late has suddenly caught everyones attention. This is due to the reaction to the major loss events occurring internally and the push from regulators side.
The great religion Islam also teaches risk management to its followers. For example The Holy Koran depicts the concept in Surah Yusuf: Verse 67: O my children, do not enter capital of Egypt by one gate but go into it by different gates. However know it well that I cannot ward off you ALLAHs will for none other than He has nay authority whatsoever. In Him I have put my trust and all who want to rely upon anyone should put their trust in Him alone.
Operational risk is associated with human error, system failures and inadequate procedures and controls. It is the risk of loss arising from the potential that inadequate information system, technology failures, breaches in internal controls, fraud, unforeseen catastrophes, or other operational problems may result in unexpected losses or reputation problems. Following are the examples of famous operational risk incidents rocking the international financial Institutions:
a) Barings Bank went bankrupt due to amassing of USD 1.3 Billion unreported losses over two years.
b) Sumitomo Corps reputation was severely damaged because of USD 2.6 Billion unreported losses over three years.
c) NatWest markets reputation was damaged as a trader had input erroneous volatilities into an option pricing model.
The number of fraud and forgery cases in the banking industry is on the rise for last few years due to weakened operational risk management. Regulators have taken some steps for the proper monitoring of operational risk management i.e. collecting details of fraud & forgery cases being detected in the banks. It also ensures sound practice for the management of operational risk and also monitors the magnitude and trends of the risk emanating from the failures in control environment and system of the banks. There is a famous quote em>bite off more than you can chew, then chew it i.e. One should plan more than he can do, then do it.
Ordinary people may think people working at Islamic banks are hundred percent fraud and error free. While the result of a survey of nine Pakistani banks dealing in Islamic banking products conducted by MayfairBusinessConsultants.com revealed otherwise. The following figure shows the result of the survey:
It shows that 22% considered human error or fraud as low risk, 33% considered it as medium risk and another 33% considered it as high risk. 44% considered incomplete information as low risk, 22% considered it as medium risk and another 22% considered it as high risk. 11% considered operational disruption as low risk, 33% considered it as medium risk and another 33% considered it as high risk. This means that Pakistani Islamic Banking industry considers human error or fraud and operational disruption as potential operational risks for their banks. Strong risk management policies/ procedures and regular training of the staff can help in overcoming such potential risks.
The first step in the risk management process is to acknowledge the reality of risk. Denial is a common tactic that substitutes deliberate ignorance for thoughtful planning. As per the regulators advice and senior managements acknowledgement of reality of operational risk, a totally independent Operational Risk Management function is required for effective management of operational risks at every bank. The function assesses monitors and reports operational risks as a whole and ensures that the management of operational risk in the bank is carried out as per strategy and policy. To accomplish the task, the function would help establish policies, standards and coordinate various risk management activities. Besides, it would also provide guidance relating to various risk management tools, monitor and handle incidents and prepare reports for the senior management. Banks should initiate Risk Control Self Assessment (RCSA) and Key Risk Indicators (KRI) exercises for monitoring and managing operational risk.
RCSA should form an integral element of a banks overall operational risk management and control framework. The goal of RCSA is to continuously assess changing market and business conditions and evaluate all operational risks impacting the business. The self-assessment process assists in identifying emerging operational risk issues and determining how lines of business should be managed.
KRIs are required to be established for operational risks to ensure the escalation of significant risk issues to appropriate management levels. Regular reviews should be carried out by internal audit, or other qualified parties, to analyze the control environment and test the effectiveness of implemented controls, thereby ensuring business operations are conducted in a controlled manner.
Operational risk management function should then monitor the quantitative/ qualitative aspects periodically and advise the senior management on the potential risks which may arise i.e. ring early warning bells. To cope with the challenge of creating consistent and workable processes for managing operational risks, the banks should adopt a risk management culture that emphasizes at all levels the importance of managing risk as part of each individual's daily activities. Staff and managers should instinctively look for risks and consider their impacts when making effective operational decisions. An effective monitoring process is essential for adequate management of operational risk. Regular monitoring would allow quick detection and correctness of deficiencies in the policies, processes and procedures for managing operational risk. Prompt detection and solution of these deficiencies can substantially reduce the potential frequency and severity of a loss.
Hence we conclude that without anticipation and proper planning of the situation beforehand, Islamic banks would be left in deep lurch (without knowing what to do & what not to do) and probably left relying on artificial assistance from helpful entities. Only their vigilant stance can curtail non performing loans, reduce severity of operational risk events and lead to a superior quality of banking.
Posted by fahadzafar at 05:06 AM
| Comments (0)
