LEADING WITH GRC. The Return of the ERM Extending Beyond It s Past Scope. Brenda Boultwood, SVP Industry Solutions, MetricStream

Transcription

1 LEADING WITH GRC The Return of the ERM Extending Beyond It s Past Scope Brenda Boultwood, SVP Industry Solutions, MetricStream

2 The Return Of The Jedi Extending beyond its past scope June 7, 2017

3 In Today s Session The Return of the ERM Extending Beyond Its Past Scope Understanding the Growing Scale and Scope for Enterprise Risk Management Programs Identifying and integrating risk data sources to bring together taxonomies Building a Risk Reporting Structure which cascades risk impacts across the long and short run Building a Scalable and Flexible Data Model To Drive Enterprise Risk Management Programs Mining the risk data to identify commonality and build consensus around risk principles

4 4 ERM Programs are growing in scale & scope

5 The Return of the Enterprise Risk Management Extending Scope because the business environment has changed The Growing Scope of Enterprise Risk Management FACING NEW COMPETITION EXPANDING INTO NEW MARKETS LAUNCH NON TRADITIONAL PRODUCTS ECONOMIC/3RD PARTY RISKS OPERATIONAL RISK ORGANIZ ATION DISRUPTIVE BUSINESS MODELS PARABOLIC TECHNOLOGY ADVANCEMENT CONSTANT REGULATORY CHANGE CHANGING CUSTOMER INTERACTIONS SHORTER CUSTOMER ATTENTION SPAN NEW MODES OF INTERACTION KEEPING PACE WITH TECHNOLOGY CHANGING POLITICAL ENVIRONMENT DATA PRIVACY RISK REPUTATIONAL RISK CYBER SECURITY RISKS STRATEGIC RISKS GEO POLITICAL RISK EMERGING REGULATIONS COMPLIANCE RISK

6 The Return of the Enterprise Risk Management Extending Scale The Growing Scale of Enterprise Risk Management TRADITIONAL IMPACT LIKELIHOOD VELOCITY INTERRELATIONSHIP Increasing Larger number of News spreads fast, Multi dimensional Interdependencies Points of Failure due Bad News Even Faster business models leads between Economies to increasing business in a hyper connected to latent relational (and businesses) touch points environment influences EMERGING LEADS TO LEADS TO LEADS TO LEADS TO Larger Impact From Similar Risk Events than in the past Higher Frequency of Similar Risk Events than in the past Certain Risk Event Impact To Catapult Exponentially Unpredictability in terms of impact and frequency *Reference. The Power of Four, KPMG (2016).

7 Extended ERM to integrate information q Multiple Silos of Information q Streamlined review and oversight processes q q q q Large geographically diversified teams Multiple Regulatory Jurisdictions Complicated Business Models Business Unit variations q q q Improved cost rationalisation and optimisation of reporting using a common framework Increased efficiency by using a common language and structure on risks, controls, processes, compliance themes and issues Increased effectiveness in Audit, Risk and Compliance Management

8 8 Where do we start while building an ERM program?

9 Enterprise Risk Management Treat it as a Data Science Problem Lack of Risk Information Leads to Lack of Risk Understanding, Lack of Risk Understanding leads to Uninformed Decision Making, Uninformed decision making is the path of the Dark Side Darth (Risk E)Vader, The Return of the ERM BCBS 239 Should be able to capture and aggregate all material risk data across the organization COMPLETENESS RISK INFORMATIO N INTEGRITY Should have a dictionary of the concepts used, such that data is defined consistently across an organization Should strive towards a single authoritative source for risk data across the organization ACCURACY ADAPTABILITY TIMELINESS Should be able to generate aggregate risk data to meet a broad range of on-demand, ad hoc risk management reporting requests Should be able to generate aggregate and up-to-date risk data in a timely manner while also meeting the principles

10 Enterprise Risk Management There is Data Everywhere BU/FU Region/Coun Legal Ent Appetite Organization Process Controls Risk Events BUSINESS Product Asset Function Risk KRI RISK COMPLIANCE Area of Comp. Standard KPI Scenario AUDIT Requirement Framework Finding Audit Entity Evidence

11 Enterprise Risk Management Mapping the Risk Universe BU/FU Region/Coun Legal Ent Appetite Organization Process Controls Risk Events BUSINESS Product Asset Function Risk KRI RISK COMPLIANCE Area of Comp. Standard KPI Scenario AUDIT Requirement Framework Finding Audit Entity Evidence

12 Enterprise Risk Management Mapping the Risk Data Risk Library Strategic Risk Reputational Risk Appetite Operational Risk IT RIsk Third Party Risk Business Continuity Risk Compliance Risk Risk Events ACCURACY Credit Risk Market Risk Liquidity Risk Federated Risk Taxonomy Single Authoritative Source of Risk Data Controls Risk KRI RISK BCBS 239 COMPLETENESS INTEGRITY ADAPTABILITY Aggregate all material risk data Define a dictionary of the risk concepts Extendible Relational Risk Library KPI Scenario TIMELINESS Real Time Risk Data From Multiple Sources

13 Enterprise Risk Management Risk Control Data Model Risk Library Strategic Risk Reputational Risk Appetite Operational Risk IT RIsk Third Party Risk Business Continuity Risk Compliance Risk Risk Events Credit Risk Market Risk Liquidity Risk Controls Metrics Metric Metric Data Perspective Assessment Factor Risk Assessments Risk Assessment Plan Risk Assessment Certification Test Control Testing Self-Assessment / Test Plan Self-Assessment Scenario Analysis Scenario Scenario Workshop Risk KRI KPI RISK Scenario Response Loss Events External Loss Internal Loss Issues Issue Action Regulatory Alerts Regulatory Alert Incidents Incident Investigation Scenario Regulatory Review

14 Enterprise Risk Management Mapping Risk To The Other Universes Risk Library Strategic Risk Reputational Risk Appetite Operational Risk IT RIsk Third Party Risk Business Continuity Risk Compliance Risk Risk Events Credit Risk Market Risk Liquidity Risk Controls Metrics Metric Metric Data Perspective Assessment Factor Risk Assessments Risk Assessment Plan Risk Assessment Certification Test Control Testing Self-Assessment / Test Plan Self-Assessment Scenario Analysis Scenario Scenario Workshop Risk KRI KPI RISK Scenario Response Loss Events External Loss Internal Loss Issues Issue Action Regulatory Alerts Regulatory Alert Incidents Incident Investigation Scenario Regulatory Review

15 Enterprise Risk Management Setting the Business Context BU/FU Region/Coun Legal Ent Appetite Organization Process Controls Risk Events BUSINESS Product Asset Function Risk KRI RISK KPI Scenario

16 Enterprise Risk Management Setting the Regulatory Context BU/FU Region/Coun Legal Ent Appetite Organization Process Controls Risk Events BUSINESS Product Asset Function Risk KRI RISK COMPLIANCE Area of Comp. Standard KPI Requirement Scenario Framework

17 Enterprise Risk Management Aligning with the Audit (3 rd LoD) BU/FU Region/Coun Legal Ent Appetite Organization Process Controls Risk Events BUSINESS Product Asset Function Risk KRI RISK COMPLIANCE Area of Comp. Standard KPI Requirement Scenario Finding AUDIT Audit Entity Evidence Framework

18 18 Now that we have High Quality Risk Data, What Next?

19 Enterprise Risk Management Incorporating All Sources of Risk Data Collaborate on Changes and Subsequent Actions in the Operational Risk Regulatory Framework Collaborate on market information for deign of products in lines with Conduct related regulations Regulatory Feeds News Feeds Operational Risk Management Regional ORM Regulations Emerging Risks Changing Compliance Requirements KRIs Publicly Reported Compliance Failures Emerging Regulatory Consultations Compliance Risk Management Risk/Control Libraries Curate 19 Third Party Ratings Agency Update Third Party Risk Management Metrics Reported Third Party Breaches Audit Analytics Financial Result Announcements Audit Frame Updates Internal Audit Collaborate on Supplier Audits with Regulatory Intelligence on Risk Profiles LEVERAGING THE INTEGRATED PLATFORM FOR CORRELATIVE INTELLIGENCE EXAMPLES ON USE OF CORRELATIVE INTELLIGENCE Collaborate Third Party Assessments with Information from Compliance Updates on Third Party related news

20 Enterprise Risk Management Collaborating Across the Lines of Defense 1 Business Units Operational Risk Framework Business Drivers and Initiatives Business Strategy Risk Tolerance Risk Universe Operational Compliance Third Party IT Other Risks LINES OF DEFENSE 2 Oversight Functions Operational Risk Function Operational Risk Management RCSA Control Test KPI & KRI Loss Mgmt Compliance Management Other ORM Functionality Third Party Risk Management Vendor Assessment SLA Monitoring Compliance Reg Change Mgmt Compliance Risk Rule Mapping Assessments Onboarding Loss Mgmt Other Risk Functions Other TPM Functionality Other Management Assurance Functions 3 Independent Assurance Internal Audit Internal Audit Risk Based Audits Audit Top Risks Spot Testing of Controls Audit of Risk Event Monitoring Issue Management Other Internal Audit Functions COMBINED REPORTING FOR EACH RISK

21 Enterprise Risk Management Collaborating Across Risk Portfolios Third Party Risk Management Contract Compliance Risk Ratings and Intelligence Forms and Integral Part of Third Party Contract Negotiations Risk intelligence generated from the tracking of risk metrics feeds into the definition of contract SLAs and assist in tracking the compliance with SLAs Risk Assessment and Mitigation Integrated Risk Assessments with Collaboration of Dual Perspective Risk Assessments for risks attributed to third party relationships are conducted in collaboration across Third Party and Operation Risk Units Risk Metrics and Intelligence Due Diligence and Continuous Monitoring Map Loss & Risk Events To Third Party Performance Monitoring Mechanism Losses and Risk events are mapped to Third Parties to build a mechanism to track third party failures and lapses Risk Control Self Assessments Performance Management Incorporating Issues Identified During Operational Risk Assessments in Third Party Performance Management Issues identified during the operational risk assessments is integrated in the balanced scorecard based assessment of Vendor Performance Issue and Action Management Loss Management Enterprise Risk Management 21

22 Enterprise Risk Management 3 Core Principles of Every Successful ERM Program Empower People to manage their Risk Management tasks with ease; enable swift, intelligent business decisions Embed Risk Management seamlessly and deeply into the organization s culture and DNA Predictive Insights to analyze and prescriptively solve future challenges in Governance, Risk and Compliance Functions 22

23 23 Risk Data is being collected but what do we with this risk data?

24 Enterprise Risk Management Provide CRO, CEOs and Boards Complete Risk Visibility Executive dashboards capturing: Residual risk trend Risk exposure by objectives, risks, etc. Metric breaches by threshold category Control effectiveness status Issue status by organization Residual heat maps for rolled up risks

25 Enterprise Risk Management The Risk Data Can Answer These Questions What Has Happened Why Did It Happened What is Happening What is likely to happen What has to be done MetricStream Focus Areas Cognitive Intelligence Pattern Recognition through visualizing and Identifying apparent and latent trends in historical data Algorithmic Intelligence Establishing Causal Relationships and Contagions between diverse events and data sets Augmented Intelligence Natural Language Processing and Machine Learning to augment human decision making Anticipatory Intelligence Predictive modeling of deep historical data and selfoptimized learning models Assistive Intelligence Contextual Virtual Intelligent Assistance at every point of judgement based decision making Hindsight You Are Here Foresight Descriptive Analytics Insight Predictive Analytics 25

26 Enterprise Risk Management How Can The Risk Data Answer These Questions What Has Happened Aggregate Information with data modeling Identify & Visualize Patterns & Exceptions What is likely to happen Data mining for detecting patterns Forecasting identifying trends and likelihoods Why Did It Happened Drill Down and Roll Up of Information Data Validation for Hypotheses What is Happening Collecting and categorizing data Proactive feedback loops What has to be done Scenarios and Constraints Modeling Focus on relational decision optimization Hindsight You Are Here Foresight Descriptive Analytics Insight Predictive Analytics 26

27 Enterprise Risk Management Identifying Common Themes Using NLP End Users BI Systems ERP/ DBMS Custom Dynamic Results Business Users et al Simple Natural Language Search Interface Intuitively, Iteratively Explore and Analyse In User Speak. MetricStream Apps MetricStream-NLP Applications Metadata Level Parsing, Aggregation Connectors Fine grain security & access control et al Legacy & Proprietary Systems Corporate / Governance Semantic Knowledge Models APP DBA Virtualisation Layers NLP Strategy End User Queries using simple natural language search interface. Rapid Visualisation of Data for efficient decision making Automates Query Fulfillment (code, blend, prep, curate, extract, create cubes & marts, collate). Reduces resource need and response time to seconds/minutes vs hours/days Can read, pull, analyse from other tool outputs. Intelligently connects to all existing & future data sources Data stored across multiple disparate databases Primary Data Enterprise Primary Data Sources Multiple data sources, generating structured and unstructured data

28 Algorithmic Intelligence Use Case and Future Direction MetricStream Correlation Engine Focused on Correlating Trends and Discovering Causality Use Case Under Consideration Credit Rating and Risk Based Pricing Correlating credit ratings to default probability Calculating risk based clusters for consumer loans Correlating price premiums to risk based clusters Estimating price premiums by risk categories Future Direction Macro-economic factor analysis Integrated Stress Testing Capital Sensitivity Qualitative Factor Impact Analysis

29 In Today s Session The Return of the ERM Understanding the Growing Scale and Scope for Enterprise Risk Management Programs Extending Beyond Its Past Scope Building a Scalable and Flexible Data Model To Drive Enterprise Risk Management Programs Identifying and integrating risk data sources to bring together taxonomies Building a Risk Reporting Structure which cascades risk impacts across the long and short run Mining the risk data to identify commonality and build consensus around risk principles

30 May the force be with you Thank You! GRC for High Performers GRC Summit 2017 All Rights Reserved

31 Thank You! Continue the conversation online #GRCSummit 2017 MetricStream, Inc. All Performers Rights Reserved. GRC for High GRC Summit 2017 All Rights Reserved