Sound Practices for the Management and Supervision of Operational Risk
In December 2001, the Bank for International Settlements published the Sound Practices paper, for comment by 31 March 2002. It sets out 10 broad principles which, when implemented, would ensure that operational risks should be properly identified, managed, measured and reported. Further, senior management and Board responsibilities have in part been clarified.
Generally Risk Reward Limited welcomes the paper and the comments that follow should be taken in the context of our belief that compliance with these principles would add significant value to any financial services firm.
Our comments are as follows:
- Whilst the paper restricts itself to operational risk, the comments would also appear to apply to other forms of risk. Indeed applying these concepts to a holistic risk environment would add additional levels of benefit.
- A number of comments are made regarding risk tolerance with regard to operational risk. This is an area where there is only limited information currently available on which assumptions may be based. It is our view that additional guidance could usefully be added highlighting the importance of the risk-reward relationship and its impact on such risk tolerance. Further risk tolerance is likely to change with the impact of both internal and external events.
- Principle 4 to 7 make comments regarding “Banks” as opposed to “senior management” or “Board”. Since a “Bank” is a corporate entity, it cannot take responsibility for the actions as set out. Instead the responsibilities should be assigned to either the Board, or senior management or officers of the company, as appropriate.
- Principle 4 suggests a monthly or quarterly review of the risk position as being appropriate. It is our view that with the rapid movements of financial markets, such reviews should be more frequent and that in a number of areas intra-day and daily monitoring would be more appropriate.
- Principles 8 and 9 relate to the roles of supervisors and could be moved to a separate paper. Of greater note is that these paragraphs appear to provide new requirements for the management of institutions to comply with, yet such matters have not been explicitly set out in Principles 1 through 7.
- Principle 10 requires Banks to make public exposure such that market participants to assess their operational risk exposure. Whilst the FRAG 21 report in the UK could form a basis for such a report, the level of disclosure considered appropriate must be carefully considered to avoid unnecessary concerns being raised
Yours sincerely,
Dennis W Cox
Managing Director
