FRM二级基础段培训项目：操作风险与弹性（打印版）.docx

FrameworkOperational Risk andResiliencyTopicWeightingsinIfRMPart11SessionNO.1Content%2020201.iquidityandTreasuryRiskMeasurementandStudySession415ManagementRiskManagementandInvestmentManagement15CurrentlssuesinFinancialMai'ket2-3B亏W创新I旨fl!1:OperationalRiskManagemcnt(CHl-CHG)Part2:ModelRiskandDataQuality(CHT-CHll)Part3:EconomicCapitalManagementandotherrelatedissues(CH12-CH18)Part4:TheBaselAccord(CH19-CH22)ReSiiienCe(CH23-CH26)专业.创新1笆值OperationalRiskManagement4-313有城，由IlhIraPrinciplesfortheSoundManagementofOperationalRiskS-313Chapter1MWe三IMFramework1.ThreeLinesofDefense2.11PrinciplesofOperationalRiskManagement与U.S1.ThreeLinesofDefenseBusinesslinemanagementBusinesslinemanagementisresponsibleforidentifyingandmanagingtherisksinherentintheproducts,activities,processesandsystemsforwhichitisaccountableFunctionallyindependentcorporateoperationalriskfunction(CORF).IncludetheODerationaliskmeasurementandeoortinQDnxessesriskComnliHoesandresponsibilityforboard叩OrIing.Challengethebusinesslines'inputsto,andoutputsfrom,thebank'sriskmanagementriskmeasurementandreportingsystems.Independentreviewandchallengeofthebank'soperationalriskmanagementcontrols,processesandsystems.ThisreviewmaybedonebyauditorbystaffindependentoftheprocessorsystemunderrevievlbutmayalsoinvolvesuitablyQUalifiedexternalDanieS7313SUf-Stw-Ira2.11PrinciplesofOperationalRiskManagement>11PrinciplesFundamentalPrinciplesofOperationalRiskManagement/Principle1,2Governance/Principle3,45Riskmanagementenvironment，Principle6,7,8l9Businessresiliencyandcontinuity，Principle10Roleofdisclosure8-313/Principle11Ket三.2.11PrinciplesofOperationalRiskManagementAFundamentalPrinciplesofOperationalRiskManagementPrinciple1:TheboardofdirectorsshouldtaketheleadinestablishingdStrongriskmanagementculture./TheboardshouldestablishacodeofconductoranethicspolicyPrincipleZBanksshoulddevelop,implementandmaintainaFrameworkthatisfullyintegratedintothebank'soverallriskmanagementprocesses.TheFrameworkforoperationalriskmanagementchosenbyanindividualbankwilldependonaQnqeOffactors,indudinqitsnatureSiZBComdexityandIiSkprofile./较取2021年冲刺押Sj资料务必加微信：XUebajUn888s2.11PrinciplesofOperationalRiskManagement>Governance(Confd)Principle3:Theboardofdirectorsshouldestablish.HDDroveandDeriOdiCalIVeviewtheFramewok/Establishamgt.culture,andrelatedsupportingprocessesdevelopcomprehensive,dynamicoversightandcontrolenvironments/Provideseniormgt.witclearguidance/EnsuretheFrameworkissubjecttoeffectiveindependentreviewbyauditorotherappropriat(?lytrainedparties/Ensurethata$bestpracticeisavailingthemseh/esoftheseadvances/EstablishclearlinesofmgtresponsibilityandaccountabilityPrinciple4:Theboardofdirectorsshould叩PIoVeandreviewariskGDDetiteandtoleranceStatementforoperationalrisk.m”3-ra2.11PrinciplesofOperationalRiskManagement>GovernancePrinciple5:Seniormanagementshoulddevelopforapprovalbytheboardofdirectorsadear,effectiveGndrobustQoVernarKestructurewithwelldefined,transparentandconsistentlinesofresponsibility./Establishandmaintainrobustchallengesmechanismsandeffectiveissue-resolutionprocesses./Translatetheoperationalriskmgt.Frameworkintospecificpoliciesandprocedures./Clearlyassignauthority,responsibilityandreportingrelationshipstoencourageandmaintainaccountability./Ensurethemgt.oversightprocessisappropriate./Ensurestaffformanagingdiferentriskscrdinateandcommunicateeffective./Ensurethatthebankactivitiesareconductedbystaffwiththenecessaryexperience,technicalcapabilitiesandaccesstoresources./ThemanagersofCORFshouldbeofsufficientstaturetoperformtheirdutieseffectively.11313WeI.2.11PrinciplesofOperationalRiskManagement>Riskmanagementenvironment(Contd)Principle6:SeniormgtshouldensuretheidentificationandassessmentOftheODerationalriskinherentinallmaterialproducts,activities,processesandsystemstomakesuretheinherentrisksandincentivesarewellunderstood.ExamplesofToolsusedtoIdentifyandAssessOperationalRisk/AUditFindingS/InternalZExternaILossDataCollectionandAnalysisRiskSelfAssessment(RSA)orRiskControlSelfAssessments(RCSA)/BusinessProcessMapping:Identifythekeystepsinbusinessprocesses,activitiesandorganizationalfunctions./RiskandPerformanceIndicators:KeyRiskIndicators(KRls)/ScenarioAnalysisSWrSlWit2.11PrinciplesofOperationalRiskManagement>Riskmanagementenvironment(Cont*d)Principle7:Seniormgt.shouldensurethatthereisanapprovalProCOSSforallnewproducts,activities,processesandsystemsthatfullyassessesoperationalrisk.Thereviewandapprovalprocessshouldconsider:/lherentrisksinthenewDrodUCtSerViC巳Oract/changestothebank'soperationalriskprofileandappetiteandtolerance,includingtheriskOfexistingproductsoractivities;，thenecessarycontrols,riskmanagementprocesses,and谭mitkationSgteaies:/theresidualrisk;，ChangeSIorelevantriskHvesholdsOrlimits:and13-313/theproceduresandmetricstomeasure,monitor;andmanagetheriskofthenewproductoractivity.三-Mr*tra2.11PrinciplesofOperationalRiskManagement>RiskmanagementenvironmentPrinciple8:Seniormgt.shouldimDlementaDKKeSStoreularlvmonitorODerationdlriskDK)filesandmaterialR)(DOsuresU)lossesincludinganappropriatereportingmechanisms.Principle9:BanksshouldhaveaStrOnCOntrolenvironmentthatutilisespolicies,processesandSyStenis;appropriateinternalcontrols;andappropriateriskmitigationand/ortransferstrategies.EffectiveControlEnvironmentManagingTechnologyRisk(sameasotheroperationalrisk)14-313ManagingOutsourcingRiskwe三ta2.11PrinciplesofOperationalRiskManagementFeaturesofanEffectiveControlEnvironmentAneffectivecontrolenvironmentrequiresapmopriateSegregationOfduties己nddudlCOntroLInaddition,banksshouldensurethatothertraditionalinternalcontrols:/dearlyestablishedauthoritiesand/orprocessesforapproval;/closemonitoringofadherencetoassignedriskthresholdsCxlimits:/SdfeqUdrdSforaccessto,anduseOtbankassetsandrecords;/appropriateStaffingIeVelandUainingtomaintainexpertise;/ongoingprocessestoidentifybusinesslinesorproductswherereturns叩Pear to be OUt Ofline With 心Sonable e:ZtiQn5：/regularVerifiEiQnandreconcilictiocOftransactionsandaccounts;and/aVdCationPOlieythatprovidesforofficersandemployeesbeingabsentfromtheirdutiesforaperiodofnotlessthantwoconsecutiveweeks.2.11PrinciplesofOperationalRiskManagementTomanageOutsourcingRisk,bankshouldhaveproceduresfordeterminingWhetherandhowactivitiesCanbeoutsourced:processesforconductingduediligencetoSeleetPOtentialSerViCeproviders:soundstructuringoftheoutsourcingarrangementincludingOWnerShioandCoMidentiaIityOfdataasWellasterminationrights:programsformanagingandmonitoringtheriskswithintheoutsourcingarrangementincludingthefinarlCOnditionOftheSerViCeprc>5der:establishmentofaneffectivecontrolenvironmentdtthebankandtheSerViCeprovider;developmentofviablecontingencyplans:16-313executionofcomprehensivecontractsand/orservicelevelagreementswithadearallocctiorOfresponsibilitiesbetweentheOUtSoUrCingProViderandthebank.SdTMrtra2.11PrinciplesofOperationalRiskManagement>BusinessResiliencyandContinuityPrinciple10:Banksshouldhavebusinessresiliencyandcontinuityplans.>Roleofdisclosure17-313Prindple11:Abank'spublicdisclosuresshouldallowstakeholderstoassessitsapproachtooperationalriskmanagement3出a三."EnterpriseRiskManagementChapter2&3sii-a三mFramework19-313-s-tra1.ERMDefinitions2.WhyERMworks?3.ImplementationofERM4.Tl)eChiefRiskOfficer1.ERMDefinitionsATwomajordefinitionsofERMCommitteeofSponsoringOrganizationsoftheTreadwayCommission(COSO):/"ERMisaprocess,effectedbyanentity'sboardofdirectors,managementandotherpersonnel,appliedinstrategysettingandacrosstheenterprise,designedtoidentifypotentialeventsthatmayaffecttheentity,andmanagerisktobewithinitsappetite,toprovidereasonableassuranceregardingtheachievementofentityobjectives；InternationalOrganizationofStandardization(ISO31000):20-313/Riskisthe"effectofuncertaintyonobjectives"andriskmanagementrefersto'coordinatedactivitiestodirectandcontrolanorganizationwithregardtorisk."Wal三ta1.ERMDefinitionsAAuthor'sopinionWhiletheCOSOandISOdefinitionsprovideusefulconcepts,itisimportantthatERMisdefinedasavalueaddedfunction:Riskisavariablethatcancausedeviationfromanexpectedoutcome.ERMisacomprehensiveandintegratedframeworkformanagingkeyrisksinordertoachievebusinessobjectives,minimizeunexpectedearningsvolatility,andmaximizefirmvalue.>Acorporationcanmanageriskseither:OneriskataIimelargelycompartmentalized,decentralized,orEnterpriseriskmanagement(ERM)AllnsksVieWedtogetherWithinaCoordinatedandSgtegiCframework.2.WhyERMworks?>CreateShareholderValuebothattheMacroandtheMicroLevelAttheMacrolevel/ERMenablesseniormanagementtoquantifyandmanagetheriskreturntradeoffthatfacestheentirefirm.ThishelpsmaintainaccesstoCaPitalmarkets,implementStQtegyandbusinessPlarL/Byreducingnon-coreexposures,ERMeffectivelyenablescompaniestotakemorestrategicbusinessriskandtotakegreateradvantageoftheopportunitiesintheircorebusiness.AttheMicrolevelWell-designedERMsystemensuresthatallmaterialrisksareOWned("becomesawayoflifeformanagersandemployees-)./Operatingmanagersandemployeescanevaluaterisk-returntradeoff.22313sum-a三-ra2.WhyERMworks?>ERMisallaboutintegration,inthreeways:enterpriseriskmanagementrequiresanintegratedriskorganizationenterpriseriskmanagementrequirestheintegrationofrisktransferstrategies23-313enterpriseriskmanagementrequirestheintegrationofriskmanagementintothebusinessprocessesofacompany吨e三2.WhyERMworks?AThreeBenefitsToERMOrganizationalEffectiveness/Variousfunctionsworkcohesivelyandefficiently.RiskReportingTimelyandrelevantriskrepcrtingBusinessPerformance/Marketvalueimprovement/Lowerearningsvolatility./Increasedearnings./Improvedshareholdervalue.Sli-SHi-IIfl3.ImplementationofERM>ConceptualFrameworkofanERMSystem(Confd)Determinefirm'sriskappetite(levelofacceptablerisk):WhenQedIlratnsGreUSedastheDnmarVIndKatoroffinancialsk,thermdeterminesanoptimalortargetratingbasedonitsskappetiteandthestofreducingitsprobabilityofnancaldistress.®Estimatecapitalrequirement:Grventhefirm,stargetrating,managementestimatestheam。UmOfCaDnalrequiredtosupportthenskofitsoperations.Determinemixofcapitalandrisk:Managementdeterminestheoptimalcombinationofcapitalandriskthatsexpectedtoyedjtstargetrating.Foragivenamountofcapital,managementcanalteritsriskthroughhedgingandprojectselection.Decentralize:Topmanagementdecertrakzestherisk。DItaltradeOffwiththehelpofacapitalallocationandperformanceevaluationsystemthatmotivatesmanagersthroughouttheorganizationtomakeoptimalinvestmentandoperatingdecisions.25T13WQl斯II®3.ImplementationofERMDeterminetheOptimalAmountofRiskwithinERMbytargetingCreditRatingArticulateRiskAppetite:Thefirmdefinesitsrating-equivalentleveloffinancialdistress(eg.,wedefinefinancialdistressasoccurringWhenOUrbondratingfallstoBaaorbelow)andsetsatargetprobabilityofdistress(e.g.,wewanttomaintaina1%chanceofdistress).SpecifyTransitionMatrixtoLocatedCurrentTargetCreditRating:Thenthefirmcanuseatransitionmatrixtodetermineitsoptimal,currentbondrating(e.g.,ifourcurrentratingisA,wewillhavea1%changeoffallingtoBaa,whichiswhatwedeterminedtobetheleveloffinancialdistress)26-313BasedonTargetCreditRating.SolveforOptimalEquityCushion:Finally,afterdeterminingtheappropriatecurrentbondratingthefirmcanusetheMertonmodeltodeterminetheequitycushionconsistentwiththeimpliedprobabilityofdefault三r3三3.ImplementationofERM>7componentsofERM1.CorporateOowmncEatiIMIehtop-downriskmangmnl2. U ManagementBuinM atrlgyalignment3. PortfOMCMgmttTHnk nd ct IWt MfUnd manager4. Rttk TranfrTrnlr outOOnOBotrVtVd .Inefficient risk*6. Ra ArwtfyticsDviop dvncdenlytiel tool6.DteandTechnologyRMoUroMEtegratadataandyimcabllitiM7.SUkho4drsM1a9fnnlImproverisktrnprncyIorByBtakeboICtre+3ImplementationofERMChallengeswhenimplementingER:M(Confd)InventoryofRisksPayattentiontoliquidityreputational,strategicrisksandSoonEconoIniCValueVerSUSAccountingPetiormanceStablecashflowv.svolatileaccountingearningsAggregatingRisksMeasuringRisksriskbeyondVaRmeasureRegulatoryversusEconomicCapitaKdiscussedlater)28-313ProblematicwhenRCexceedsEQthedifferenceiscalledstrandedcapital亏重创新沼值+Implementationof!ERM-AggregatingRisksDifferentdistributionsOrthreerisksMarketrisk:haveanormal(<ratIdastsymmetrical)distributionCreditrisk:haveanasymmetricdistribution,Operationalrisk:haveanasymmctricHistrihutionLugenumberscfsmalllossetfidsomechanceOfhrgeloesothatthedi±lribuLind*OPeratiQnallosstshasalongfattail:IssueswithCorrelationinRiskAcrossthefirmtheeisdiversificalionacrossriskcategories:fim-wideVaRislessthanthesumofthemarketriskCreditriSkandOperationalriskVaRstheforc<relationstoincreaseinKghlystressedenvironments.二；一：；：+4.TheChiefRiskOffiderCROISReSPOnSibleForProvidinqtheoverallleadershipforenterpriseriskmanagementEstablishinganintegratedriskmanagemcntframeworkforallaspectsofrisks.Developingriskmanagementpolicieincludingthequantificationofthefirm,sriskappetiteXhroughspecificrisklimitsImplementingasetofriskindicatorsandreport¾includinglossesandincident、keyriskexposureandearlywarningidicatorsAllocatingeconomiccapitaltoblusinessactivitiesCommUnicatingthecompanysriskproletokeystakeholdersDevelopingtheanalyticalsystcms»anddatamanagemeritcapabilitiestosupporttheriskmanagementprogra4.TheChiefRiskOfficerAReportingTheheadsofindividualriskdepartmentreporttotheCRO.TheCROreportstotheCFOorCEO.Adotted-linereportingrelationshipbetweentheCROandtheboard.31-313yj酶Ira4.TheChiefRiskOfficerAAnIdealCRO'sSuperbSkillsTheleadershipskills.Toconvertskepticsintobelievers.Thestewardshiptosafeguardthecompany'sassets.Havingthetechnicalskills.Havingconsultingskills.32-313三6三.raExercise11>Theseveritydistributionofoperationallossesusuallyhasthefollowingshape:A.B.CD.SymmetricalwithshorttailsLong-tailedtotherightUniformSymmetricalwithlongtails>CorrectAnswer:Bsyu-MfimuBImpIementingRobustRiskAppetiteFrameworkstoStrengthenFinancialInstitutions34-313Chapter4il-Framework1.BestPracticesinRAF2.KeyChallengesinImplementingRAF3.KeyLessonsLearnedFromCases!.BestPracticesinRAFAConvergenceexperienceinriskappetiteframework(Cont,d)SuccessfulimplementationishihlvdependentOnRffeCtiVRinteractionsamonallkovstakeholders,includingBoardmembers,seniormanagementtheriskmanagementfunction,andtheoperatingbusinesses.Puttinginplacea