People, Processes and Risk Flashcards
What were the 2 main developments in the 80’s & 90’s that changed the structure of branch banking?
- Credit Scoring
- The opening of centralised back office processing centres - the tasks that exited branches included:
- Dispatch of customer statements
- Opening & closing accounts
- Setting up, cancelling and amending automated payments
- Clearing suspense accounts
What is the internal customer?
What are the problems with this concept?
The internal customer is someone who relies on a colleague in another part of the org to input to the service which the original colleague provides to the customer.
Problems w/this concept and work being transferred away from a branch when e.g. sorting an error in the setting up of a standard order include:
- The time taken to investigate and remedy increased due to the physical distance between the branch and the place where the work actually takes place
- An argument that as the person completing the work would never face the customer, the motivation to complete the work without error would reduce
- An added difficulty in that either delays or errors in work could now be blamed on the processing centre rather than on an individual. Service Level Agreements was one method used to resolve this. SLAs clearly outline what tasks were to be covered and the timescales within which they would happen.
What is a third party?
What is the potential benefits of using them?
A third party is a person or organisation that provides a service to a company, but is not permanently employed by the company.
The potential benefits of using 3rd parties include:
- The ability to provide businesses with cost and productivity savings
- The business becomes more flexible and able to use the right specialist services at the right time
What are the objectives of an org’s third party policy?
- Ensure that business units, project sponsors and managers are aware of their obligations and requirements when considering entering into an arrangement or initiative with a 3rd party
- Ensure all staff and business units involved in dealing with 3rd parties adopt a fair and consistent approach
- To provide details of the roles and responsibilities of those areas of the business who will become involved when considering entering into an arrangement of inititative with a 3rd party
- To provide a clearly stated approval process for the risks associated with 3rd party initiatives and appropriate approval authorities through completion of the agreed docs
- Ensure that an appropriate risk assessment is undertaken on the suitability of the 3rd party, both for the financial strength and ability to service the businesses clients and meet the orgs long term requirements.
- Ensure that the org complies with & adheres to all regional legal requirements of the regulator of the country in which they intend to enter a 3rd party intitiative
- Ensure that accountabilities and responsibilities are defined clearly and documented, together with an agreed supplier and management strategy
What is risk management?
Risk management is the sum of all actions taken by an individual or organsiation to acceptably mitigate risks that could occur. Organisational risk management does not remove risk completely, rather it seeks to identify potential risks, then put steps in place to minimise these risks and to put measures in place to deal with any potential loss, injury, disadvantage or destruction arising.
What headings can most risks be grouped under?
- Credit risk: e.g. the risk the loan will not repaid. The greater the risk, the greater the potential reward, but the greater the chance of failure
- Market risk: risk of suffering loss due to changes in the market, e.g. interest rates, foreign exchange rates etc.
- Liquidity risk: risk that a business or individual does not have sufficient funds available to meet their debts when they fall due.
- Regulatory risk: risk of material loss, reputational damage or liability arising from a failure to comply properly with the requirements of regulators or with the various Codes of Practice
-
Operational risk: defined by Basel as “the risk of direct/indirect loss resulting from inadequate/failed internal processes, people and systems or from external events”:
- Process risk: risk in processes that are ineffective/inefficient. A balance needs to be struck between the efficiency and effectiveness of these processes and the cost of reducing the risk attached to them.
- People risk: risk of errors due to a lack of knowledge or having inadequate staff etc.
- Systems risk: risk of system failure, data quality and the security of the data held.
- External risk: risks that come from the external environment in which the organisation operates e.g. extreme weather events or change in government etc.
What is the risk management life-cycle?
-
Identify: by
- Workshops: e.g. before commencing a project representatives can outline the proposal and have other attendees assist the identification of any potential risk through the use of their expertise from specialist areas
- Questionnaires: identify high level risks
- Loss data capture and analysis: retrospective identification if a loss has already occurred
- Near miss capture and analysis: need to ensure that there is a culture of reporting near-misses – many don’t for fear of reprisal
-
Assess:
- Likelihood and impact of the risk
- Cause and effect: find root cause, create contingency plans for risks outside of control
- Mitigate: Use an impact and probability grid
- Monitor
What is a risk assessment?
Once the business is clear of the risks it faces, it then decides the probability and impact of the risk.
How should risk mitigation be approached?
Having assessed the probability and impact of the risk, the org can move on to decide how best to mitigate them on an ongoing basis, by continually monitoring risk. This can be done by categorising them according to an impact and probability grid:
- Avoidance: refuse to accept risk e.g. don’t lend money
- Transference: pass risk to another party who’s willing to accept it e.g. car insurance
- Sharing: share the risk with a partner org e.g. share risk with joint venture partner
- Risk reduction: focus on preventation and control e.g. introduce saftey training
- Risk retention: mitigating some of the risk in risk acceptance.
- Voluntary retention: when one does not take positive action to avoid, reduce or transfer risk is voluntarily
- Involuntary retention: takes place when risks are unknowingly retained. When the risk is not recognised, the person exposed retains the consequences of the possible loss without realising that he does so. E.g. being a careful driver but not realising the danger of bad drivers
- Risk Acceptance: It’s worth considering these risks as circumstances can alter and they can become more significant.
What is data management?
Data management is defined by the Data Management Organisation as the development, execution and supervision of plans, policies, programs and practices that control, protect, deliver and enhance the value of data and information assets.
What different systems exist for entering and retrieving data?
- A transaction processing system: to collect and store data from routine transactions
- A management information system: convert data from the transaction processing system into info that the org needs for management purposes
- A decision support system: supports managerial decision making by providing models to process and analyse data.
- Executive information system: info for executives to inform the strategic management of the business
- Data mining: use statistical analysis to uncover hidden trends and relationships in data.
What do orgs desire from data storage?
- The ability to share data and allow many to access it at the same time
- Ease of moving data around the org to those who need it
- Security, the data must be kept safe and backed up as necessary
- The info must be reliable and precise
- Data should be current and up to date
- The data should be fit for purpose and support the decision making processes that it serves
What are the drawbacks with the management of data?
- Redundancy: same info stored in a number of places, if this info changes - how does one change all the info?
- Lack of data control: if data is managed in different ways by different parts of the org, there is a danger of inconsistent approaches
- Poor interfacing: will mean that data can be useless to its users
- Delays: in the current operating environment
- Reality: data must be relevant to the climate in which the firm operates
- Lack of integration: if data is spread out throughout the org, integrating it throughout the firm may be costly and complex
