OpRisk Europe: FSA condemns operational risk weaknesses

Firms should expect higher requirements in the future, says FSA

London - Financial institutions have failed to properly manage their operational risk in recent years and can expect to be subjected to higher requirements in future, an official from the UK Financial Services Authority (FSA) warned yesterday.

Speaking at the OpRisk Europe conference in London, Frances Allen, team leader in the FSA's prudential risk division, said attention to operational risk had been "sparse" and firms need to up their game to ensure they hold enough capital against operational risk events. "Operational risk inadequacies contributed to the size of some of the losses that occurred... risk managers should be playing a stronger and more independent role in the future," she said.

"Starting with [rogue trader Jérôme Kerviel at] Société Générale, and sadly we know there have been trading events well before then, the flow of operational risk trading events seems endless and many regulators have responded," said Allen. "The immediate impact for the FSA is that there will be more of us assessing risk at high-impact firms; those firms can expect to see us more often and we will be tougher."

She warned that even though many firms have implemented the advanced measurement approach (AMA) to operational risk regulatory capital under Pillar II of Basel II, there has been a failure to hold sufficient capital, with some firms arguing that, because they just had a £10 million fraud event and had provisioned for it, they no longer need to hold that capital. "This is clearly nonsense and not acceptable to us as we need that capital to be there for future fraud losses," warned Allen.

Operational risk management practices are also less well-embedded in business practices than they should be, Allen added, explaining that it is often not compulsory for all staff to even read the operational risk policy.

Allen also identified weaknesses in the use of scenario analysis when firms have insufficient loss data to calculate capital requirements. "It's a useful tool, but we're not the only regulator to observe there are some challenges," said Allen. "For example, how many scenarios do you want? We've seen firms with anything from half a dozen to 3,000. Both beg questions and the right answer is clearly somewhere in the middle."

In other sessions at OpRisk Europe, risk professionals also raised concerns about weaknesses in operational risk management, as well as wider risk management practices, during and before the financial crisis. "Operational risk managers, and risk managers in general have made a mess of things," said Sergio Scandizzo, head of operational risk at the European Investment Bank.

Scandizzo pointed to a number of risk management failings, including a tendency to measure risk first and only manage it later, a belief that risk is the responsibility only of dedicated specialists and weaknesses in mathematical modelling.

His views were shared by John Redwood, chairman of Evercore Pan-Asset Capital Management and a UK member of parliament, in his opening address. "The financial crisis has blown quantified and mathematical models completely out of the water," Redwood said.