The need for effective operational risk management is more acute than ever. Events such as the global financial crisis or the COVID-19 pandemic highlight the far-reaching impacts of operational risk and the consequences of management failure. In the light of these and numerous other events organisations have to ensure that their policies, procedures, and processes for the management of operational risk meet the needs of their stakeholders.
For the financial sector, The Basel Committee in its document “Revisions to the Principles for the Sound Management ofOperational Risk” (March 2021) indicated in principle 6 that “Senior management should ensure the identification and assessment of the operational risk inherent in all material products, activities, processes and systems to make sure the inherent risks and incentives are well understood”. The document further adds that “Using operational risk event data and risk and control assessments, banks often develop metrics to assess and monitor their operational risk exposure. These metrics may be simple indicators, such as event counts, or result from more sophisticated exposure models when appropriate. Metrics provide early warning information to monitor ongoing performance of the business and the control environment, and to report the operational risk profile. Effective metrics clearly link to the associated operational risks and controls. Monitoring metrics and related trends through time against agreed thresholds or limits provides valuable information for risk management and reporting purposes.”
The Committee of Sponsoring Organizations of the Treadway Commission (COSO) in its document released in December,2010 “Developing Key Risk Indicators to Strengthen Enterprise Risk Management”, defined KRIs as “metrics used by organizations to provide an early signal of increasing risk exposures in various areas of the enterprise”.
While implementing the Basel recommendations on operational risk management framework ( ORMF) , regulators have highlighted Key Risk Indicators ( KRIs) As one of the tools that may be used for the identification and measurement of operational risk.
Developing KRIs as part of ORMF
Key /Operational risk indicators are measurable metrics that provide a proxy for operational risk exposure. A change in the value of a metric signals that a particular risk exposure may be changing, that it may be increasing or decreasing in probability or impact, or that a risk event may be about to occur very soon.
There are two main approaches which Management should use when developing their KRIs
The top-down approach: This approach starts with Manager who selects the KRIs that are to be monitored across the bank functions.
The bottom-up approach: This approach allows the selection and monitoring to be conducted at the business unit level focusing on a product, a process, or a channel.
Depending upon materiality and context, either approach can be used. However, the linkages with other parts of ORMF ( importantly the self assessments) must be maintained.
The desirable characteristics of the KRIs are – relevance, measurability, Collectability, consistency and of a predictive nature.
Implementation of KRIs
Implementation starts with selection of KRIs. The best place to start is to identify processes with high residual ( post-control) risks. This is part of the RCSA ( self assessment) process. Nonetheless, High level risks related to theprocess/function/division identified from different sources such as RCSA, loss incident reports, audit findings, customer complaints, etc. may be assessed and relevant monitoring metric developed. To be effective for the ORMF, for each KRIs being monitored, threshold value/ values must be established, where an action must be taken if the KRIs’ value breaches the threshold. This can take the form of a cap or floor or a traffic light / zone arrangement where as soon as the KRIs value exceeds the threshold value, the escalation process starts. The threshold can be an absolute number or value, percentage, ratio or other derived value.
The KRIs must be monitored at periodic frequency depending upon organization need and reviewed and adjusted based on need. Any breach of threshold should lead to escalation to appropriate level of management and relevant action taken based on the actions.
KRIs are therefore key component of ORMF to prevent operational losses in an organization. KRIs must be chosen carefully and must be effective in preventing operational failures and losses. It is therefore necessary to develop a set of KRIs either at business unit level or function level to improve its usefulness.
Kris can be diverse, as processes differ from one business activity to another as well as over time. With digitalization and adoption of artificial intelligence, KRIs are expected to undergo transformation.
Some examples of KRIs may include –
Percentage of employees who have not received training for more than one year to the total number of employees ; Attrition Rates; Prolonged Vacancy Rate; Dormant account activation without approval; Unresolved reconciliation differences in accounts, Unresolved customer complaints ; Number of unplanned system failures ; Percentage of non updated KYC s; accounts with incomplete documentation ; Missing Physical Documents; cash mismatch; Error in data entry; Error in Remittance; Number of Successful intrusion attempt detected; No. of credit card frauds suffered; No. of ATM cash mismatched detected.
It is important that KRIs are linked to Risk assessments so that once KRIs breach relevant thresholds , they can be linked to processes and controls seamlessly and controls improved to reduce residual risks. It is also important to identify KRI shortcomings when operational losses are discovered and reviewed. If no KRI are available that can be linked to material losses, newer KRIs should be included.
KRIs are certainly an important component of the three pillars of ORMF- namely RCSA, KRI and Loss Databases. The RCSA is forward looking ( operational risk events that can happen in future) , the Loss database is a compendium of past operational failures ( it looks back into the past). The Key Risk Indicators ( KRIs) indicate the present level of operational risk in an organization. Therefore they are the most relevant and actionable component of the ORMF. KRIs also serve as a bridge that links RCSA and Loss data and strengthens the ORMF.
Leave a Reply