Non-financial Risk Management in the Financial Industry

the relevant business functions are involved and informed in a timely manner, in order to focus attention on the critical situation and induce a more prudential approach, even before the design and adoption of remedial actions;

potential remedial actions are proposed and jointly defined with the impacted structures/divisions/entities;

agreed remedial actions are promptly activated and monitored;

further points of attention are escalated to relevant senior management;

the indicator is subject to periodic updates and monitoring by internal control functions;

after completion, the remedial action is reviewed by internal audits before the actions are closed.

The institution’s management bodies are responsible for validating the methodology and are constantly informed about threshold breaches. Many advanced institutions have developed aggregated and consolidated risk appetite dashboards, in which they monitor the risk exposure and limits with respect to the firm’s appetite for non-financial risks. These dashboards are regularly presented to the group-wide risk committee (e.g. monthly, quarterly) as well as to the management board and the supervisory board (at least quarterly for larger institutions) to support monitoring and to provide an overview of the institution’s risk profile.

Upon identification of “caution” or “limit” threshold breaches, four types of actions are typically undertaken:

1 the root cause is investigated;

2 findings are issued;

3 remedial actions are designed and launched;

4 the risk source (e.g. the division or legal entity) is put under enhanced monitoring, including a periodic reporting.

Based on the adopted metrics and indicators, entities shall define criteria to determine the severity of breaches and the priority of related remedial actions.

1 – Large Italian Banking GroupThe compliance unit of a large European banking group defined the following criteria to assess the severity level of the remedial actions to be implemented after a threshold breach:

Prior to issuing findings in case of breaches, it should be taken into consideration whether analogous prescriptions have been identified by other sources (e.g. internal audit, risk assessments) and whether there are mitigating actions already ongoing to prevent duplication and promote synergic approaches. Potential remedial measures could be, for example, the review and potential reinforcement of second-level controls, the provision of additional training, the activation of a temporary task force to remedy a backlog of alerts or establishment of steering committees to monitor the remedial progress.

The risk owner for the respective area in which the breach occurred should be identified through the risk matrix within the organisational structure – and is thus the subject responsible for compliance with the external regulations/internal rules. The risk owner, in turn, must define the owners of the implementation of each remedial action to be undertaken.

Clear deadlines should be defined, and their related progress be monitored periodically. Furthermore, there should be clear rules for the definition and management of the due dates (e.g. maximum remedial action time span based on the severity of the related findings; rules and process for re-planning, also consistent with gap severity).

Furthermore, the issues that led to the breaches should be investigated and adequate actions should be taken, which can include cutbacks or the freezing of variable remuneration, up to the termination of employment.

Fußnoten:

[1]SSG 2009.

[2]Ibid.; Bank for International Settlements 2010; Single Supervisory Mechanism 2016.

[3]SSG 2010.

[4]FSB 2013a.

[5]ECB 2018a.

[6]Single Supervisory Mechanism 2016.

[7]FSB 2013a.

[8]ACAMS 2015.

[9]Feedbacks collected during FIRM Compliance roundtable organised by the ECB (Frankfurt, 16 September 2020).

[10]FSB 2013a.

[11]Ibid.

[12]FSB 2013a, 2013b; ECB 2018a.

[13]Single Supervisory Mechanism 2016.

[14]EBA 2017, 2020a.

[15]Single Supervisory Mechanism 2016.

Текст предоставлен ООО «ЛитРес».

Прочитайте эту книгу целиком, купив полную легальную версию на ЛитРес.

Безопасно оплатить книгу можно банковской картой Visa, MasterCard, Maestro, со счета мобильного телефона, с платежного терминала, в салоне МТС или Связной, через PayPal, WebMoney, Яндекс.Деньги, QIWI Кошелек, бонусными картами или другим удобным Вам способом.