Non-financial Risk Management in the Financial Industry

Similarly, the statement, “The Bank continuously monitors its compliance performance and initiates remedial actions as required” might entail that all risk categories with residual risk higher than ‘low’ will be subject to continuous monitoring and will be addressed by specific action plans, whose extent will vary depending on the severity of the residual risk observed.

In addition to the overarching statement, it can be useful for financial institutions to expressly outline prohibited activities where zero-tolerance policy applies (Figure 2).

The second level of RAF defines measurable metrics and related tolerance thresholds, each triggering different escalation levels in case of a breach.

There are two common approaches for the definition of Level 2 metrics:

Use of operational losses as a comprehensive metric for all non-financial risks.

Use of risk assessment outcomes (for the different non-financial risk types) as an introductory metric that enables deep dives on specific non-financial risks.

The second approach is more commonly found in leading banks, using residual risk generated from risk assessment as the primary metric. This approach is in line with feedback collected by the ECB and has the following key advantages [9]:

Comprehensiveness, given its ability to capture jointly intrinsic characteristics (inherent risk) and effectiveness of controls in place (controls’ adequacy).

Maturity, thanks to evolution over recent years of risk assessment methodologies, which cover a wide range of non-financial risk areas, as well as the use of advanced measurement methods.

Data Availability, because of the consolidation over-time of reliable and high-quality input sources as well as the possibility of accessing data with sufficient historical depth.

Modularity, thanks to the possibility of breaking down the aggregated metric and focusing on single non-financial risk areas (see also Section 3.4 below).

In the paragraphs below, we describe the approaches adopted by primary industry players for the setting of thresholds respectively for a Level 2 metric based on operational losses and for another Level 2 metric based on risk assessment.

In the case of a Level 2 metric based on operational losses, the identification of relevant thresholds can take into consideration:

Internal data capturing losses registered in past years and connected to a specific non-financial risk type.

Benchmark data relating to comparable peers.

Top management input reflecting preferences and expectations.

Top players often rely on a combination of the above-mentioned input sources, as exemplified below (aggregated example).

Starting from peers’ tolerance levels for operational losses connected to compliance risks (both as absolute values and as a percentage of gross operating income), the bank in this example then carried out a detailed historical analysis of its own internal losses. As result, thresholds were defined as follows:

Target: set to be below median of distribution.

Caution: set to be above mean and exceeded only once in the past five years.

Limit: set to be above mean and exceeded only once in the past ten years.

The bank in this example allowed for thresholds to be changed by +/- 10% based on managerial judgement.

Among the main advantages of using risk assessment as second level metric, it is possible to provide a holistic overview of a broad set of non-financial risks and to prioritise the riskiest.

A top-down risk assessment of all non-financial risks will allow the institution to prioritise risk types for which the caution or limit thresholds are exceeded (e.g. in the example above AML/CFT, anti-bribery and corruption have a critical or significant residual risk, above the limit threshold). A bottom-up risk assessment analysis can follow, to identify i) underlying factors that led to a breach of the threshold (e.g. products vs. client geography vs. distribution channel) and ii) the entities or divisions most accountable.

To complement the Level 2 metrics, some players have introduced a synthetic indicator across all non-financial risks. The synthetic metric is calculated by aggregating the different residual risks with a quadratic weighting formula to over-weight elevated risk levels. The same escalation actions described before can be activated on this aggregated metric.

Level 3 cascades the RAF down to the business lines and entity level via specific Key Risk Indicators (KRIs), which allow for the early detection of potential deviation from risk appetite objectives, facilitating timely intervention.