Operational risk management should ensure consistent implementation and sustained performance of an institution’s operational risk framework. What ties all these individual pieces together is the stewardship of the operational risk management function. The components discussed above, including the quantitative model, make up the significant components of the CCAR operational risk framework. Moving forward with the operational risk framework The governance function should also include review and challenge across the different aspects of the CCAR operational risk loss estimation process.
This structure is required to accommodate the escalation of issues to leadership, establish a conflict resolution process, and install continuous process improvement. The approach to estimating and stressing operational risk losses and ensuring all the individual components function efficiently requires a clearly designed governance structure supported by appropriate personnel. Subject matter specialist (SMS) workshops to refine loss estimates from the previous components.A legal loss component to estimate potential litigation losses.Scenario analysis for estimating losses related to forward-looking idiosyncratic events.A quantitative model that uses historical data and attempts to model operational risk and macroeconomic relationships.To confirm compliance with regulatory requirements, institutions have broken down the operational risk loss estimation processes to logical components. The success of CCAR depends on the effectiveness of how upstream operational risk framework controls have been designed, monitored, and challenged. This ensures alignment between CCAR material risks and storylines and the actual risk profile and loss experience of the institution. These assessments help institutions identify material operational risks that potentially could go on to be significant influencers of operational losses. Material risks so identified are used in scenario analysis to estimate forward-looking events with low likelihood but that are plausible with high severity and impact.Īn efficient and effective CCAR process should be grounded in and leverage the existing operational risk management framework. Many institutions have set up risk and control self-assessment (RCSA) to regularly evaluate the inherent risks present within: Risk identification should include triggers that institutions use to identify potential control failures that may result in operational losses.Īt regular intervals, the identified risks and controls are required to be evaluated for effectiveness. This step is where business managers identify, own, and manage operational risks and the controls that mitigate the identified risks. The first step toward managing operational risk begins as part of the first line of defense. But they still require institutions to look at their internal loss history and identify a correlation with macro-economic scenarios and events.
Regulators are gradually becoming more open to looking at qualitative approaches to estimate forward-looking losses. Many institutions have designed their operational risk estimation frameworks to consider both historical and forward-looking approaches.
Overall operational risk framework considerations