Key Risk Indicators - Changing the Reference Points
1 like424 views
1. Behaviour-based metrics and qualitative risk assessments are difficult to define and quantify but provide important insights about an organization's risk culture and compliance maturity. 2. Emerging regulatory requirements are increasing in number and scope, requiring firms to implement horizon scanning to understand changing rules. 3. A proposed compliance assessment approach uses a dynamic set of key risk indicators, benchmarking, sensitivity analysis and monitoring to provide a transparent and strategic view of compliance weaknesses and improvement impacts over time.
Key Risk Indicators - Changing the Reference Points
- 1. Key Risk Indicators: Changing the Reference Points
- 2. KRIs & Navigating the Regulatory Landscape 1. Behaviour-based Metrics 2. Multi-jurisdictional Horizon Scanning 3. Measuring Compliance Maturity
- 4. “Behaviour-regulation” is politically fashionable • Loosely defined (“it’s what I say it is”) – easy to prosecute • More significantly… Populist Low-cost Lucrative
- 5. Expert Assumptions v. Behavioural Findings Is it true that… • More detailed risk data reports will improve our decision-making? • Balanced scorecards and KPIs improve risk culture? • “Crackdowns” create improvements in conduct? • “Tone at the top” determines risk culture and compliance? • Staff’s first loyalty is to their employer brand? Source: Dr Roger Miles
- 6. Econometric v Behavioural view What we’d like risks to be: • Items we can define, quantify, model • Manageable by us, via routine operating tasks • A good fit with our models / assumptions What they may really be: • Qualitative, slippery - can’t quantify • Demanding a strategic management view • External factors, new influences, breaking assumptions So… reconceive Compliance as scalar, not binary • ‘Yes / No’ (false clarity) answers not possible • Instead scale: progress, commitment & responsiveness
- 7. Why Behaviour is Hard to Calibrate Dynamic • changing in individuals • changing in social groups More qualitative than quantitative • opinions, judgments, perceptions • …… maturity continuum Needs external calibration • not just what we do… • what do customers expect, tolerate – today? • what does Risk Culture mean for us?
- 8. What Actually Happens? • Observation is Key! • be “relentlessly empirical” • start with real peoples’ everyday interactions (not “the system”) • jargon-free reporting style (“Friends and Family” test) Example: Employee Overconfidence Detector • Reveals: levels of certainty gaps between actual and claimed expertise - low knowledge with high self-belief - high knowledge with low self-belief • Removes culture of ‘casual non-compliance’ / ‘local rules’ knowledge level certainty level
- 9. New Metrics for “good behaviour” • Responsiveness – How able (propensity) to learn, react, adapt? • Empathy – How able (receptivity) to appreciate… • the regulator’s view? • the customer’s view? • other employees’ view (above / below)?
- 12. 800M 300M The “Regulatory Enterprise” Accelerates Since 2009 54,000 regulatory documents have been published from 130 regulatory bodies in the G20 countries alone. 2009 to 2015 Forecast to 2020
- 13. Chemistry in the 1850’s
- 14. Periodic Table of Elements Dmitri Mendeleev
- 15. Modern Day Periodic Table of Elements
- 16. B T # S ! Breach type Transaction Volume Frequency Severity Risk Exposure C Scope of change FS Regulatory Periodic Table
- 17. MiFID II – Projected Risk Exposure Dissemination Client Asset/ Cash Mis-selling & suitability 96 144 54
- 18. Protection Against Regulatory Blind Spots
- 20. Intelligent Knowledge Generation Data / Information Sources Big-Data Information & Knowledge Base 1 2 3 Internal Client Data Sources Manual Capture External Consulting & Audit Big-Data Analysis & Knowledge Generation Smart Rating Service Benchmark Service Analysis / Sensitivity Service Market Intelligence Service Intelligent Data Selection Service Business Value Services Compliance Monitoring Conduct Risk Monitoring Cyber Risk Monitoring Insurance Monitoring Service / Process Monitoring Strategy Monitoring Supply Chain Monitoring Benchmark Data Analysis Result Data Market Data Industry Data Data & Information Web-Crawling Dydon International
- 21. Excellence in Insurance Benchmarks Firm and Market Risk Information Relevance of Information Relevant Not Relevant Definition Key Focus Areas Identified Weak-Points Relevance Filter Mathematical Systems Scoring Fuzzy Logic Rule Based Aggregation Neural Nets Dydon International
- 22. Aggr. Level n Aggr. Level 3 Aggr. Level 2 Indicator Level 1 Input Base Values Track Causal Links and Maturity Quality of GRC Framework Num. News Reports on Corp. Culture Corp. Training Level CoC Corp. Training Level GRC Int. Whistle blower Mgt Audit Employee Culture Neg. News Reports on Culture CoC Program Training Level CoC GRC / Culture/ CoC Initiatives Reputation Risk Quality of CoC Program Whistle- blower Ratio Neg. News Reports Employee Culture Compliance Rating 1 2 3 4 5 6 GRC Framework Training Level GRC Audit Rating Empl. Culture Corporate Training Level Corporate Culture
- 23. Aggr. Level n Aggr. Level 3 Aggr. Level 2 Indicator Level 1 Input Base Values Identify Weak Points, Benchmark Base Value 2 Base Value 3 Base Value 4 Base Value 5 Base Value 6 Base Value .. Base Value n Base Value 1 1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6 1 …. n 1 …. n 1 …. n 1 …. n 1 …. n 1 2 3 4 5 6 Aggregation of Indicators via: - math. Formula - Rule Aggregation - Fuzzy Logic Aggregation of Indicators via: - math. Formula - Rule Aggregation - Fuzzy Logic Full Comprehensibility of Aggregation Result Full Comprehensibil ity of Aggregation Result Find current weak points Aggregation Result Benchmark 2.8 Benchmark to Peer Group or Industry
- 24. Aggr. Level n Aggr. Level 3 Aggr. Level 2 Indicator Level 1 Input Base Values Monitor Improvements Base Value 2 Base Value 3 Base Value 4 Base Value 5 Base Value 6 Base Value .. Base Value n Base Value 1 1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6 1 …. n 1 …. n 1 …. n 1 …. n 1 …. n 1 2 3 4 5 6 Aggregation of Indicators via: - math. Formula - Rule Aggregation - Fuzzy Logic Aggregation of Indicators via: - math. Formula - Rule Aggregation - Fuzzy Logic Aggregation Result Transparent sensitivity of impact Variation of Input Values Variation of Input Sensitivity Analysis 1 Transparent sensitivity of impact Sensitivity Impact Understanding Benchmark 2.8
- 25. Aggr. Level n Aggr. Level 3 Aggr. Level 2 Indicator Level 1 Input Base Values 25 Compare Improvement Sensitivities Base Value 2 Base Value 3 Base Value 4 Base Value 5 Base Value 6 Base Value .. Base Value n Base Value 1 1 2 3 4 5 6 1 2 3 4 5 6 1 2 3 4 5 6 1 …. n 1 …. n 1 …. n 1 …. n 1 …. n 1 2 3 4 5 6 Improvement via sensitivity 1 Variation of Input Sensitivity Analysis 2 Improvement via Sensitivity 1 Improvement via sensitivity 1 Improvement via sensitivity 1 Improvement via Sensitivity 2 Benchmark 2.8 Original Rating Result without Improvements
- 26. Proactively Managing Personal Risk Answers questions such as: What is my personal risk? Is our compliance effort adequate? Where are our weak points? Which improvement would have best impact? How’s our compliance v. our peer benchmarks? What do we get for our spend on compliance (ROC)? How efficient and effective are our efforts? Transparent Cause & Affect Identify Weaknesses Link to Market Information Informed & Focused Investments Reduce Personal Liability
- 28. Assemble Dynamic Key Risk Indicators SENSE • Scanning processes • Observation • Sense-making SEIZE • Revise policies/actions • Reshape business/risk models • Review decision making SHIFT • Governance/structure • Beyond best practices • Strategy & Risk alignment
- 29. Tony Moroney | Managing Director Berkeley Research Group, LLC 6 New Street Square, 15th Floor | London, EC4A 3BF D +44 (0) 20 3597 5167 | M +353 87 2556947 tmoroney@thinkbrg.com | thinkbrg.com The views and opinions expressed are those of the author and do not necessarily reflect the opinions, position, or policy of Berkeley Research Group, LLC or its other employees, affiliates and clients. All graphs are illustrative only and should not be relied on. 29 Thank You