Operational Risk and the New Regulatory Landscape [RMA Journal, The]

**In an interview conducted this May in London, Neeta Atkar, former group operational risk director at Lloyds Banking Group, discussed operational risk practices with RMA Journal editor Kathleen M. Beans and RMA relationship consultant Mark Heaton. Atkar has served on RMA's Operational Risk Council and was a speaker at GCOR in May.

RMA Journal: Regulatory issues are a dominant concern today. How do you think operational risk will evolve in the wake of Basel III?

Atkar: That's a difficult question. Clearly, there will be material capital implications that typically grab the headlines. When it comes to operational risk, whilst capital is a given, I believe that since operational risks are typically less easy to quantify, the focus ought to be on improving risk management rather than on seeking to make risk measurement ever more complicated. So, whilst risk measurement is necessary, it's not sufficient when it comes to operational risk.

On the measurement side, the industry is far from determining if the complexity that modeling brings to operational risk actually provides value. Rather than building complexity into operational risk modeling techniques, the focus should shift back to managing operational risk. You need skilled subject-matter experts-not always risk specialists-who understand the risks.

RMAJ: Do you think Basel III will move more toward management?

Atkar: Not necessarily on operational risk. For instance, the recent Basel paper on the treatment of insurance to mitigate operational risks proposes arguably a more complicated approach than currently exists. That approach might be appropriate when there are solid foundations on which to build, but we're not there yet on operational risk models.

RMAJ: In light of the recent credit crisis and the resulting attention on credit issues, have you been able to keep the focus on improving operational risk within your organization?

Atkar: Yes, very much so. In early 2009, Lloyds bought Halifax Bank of Scotland [HBOS] and, in the first year of that acquisition, the primary focus was quite rightly on managing the credit risk exposures arising from the legacy books. However, alongside that, the group embarked on a three-year integration program, which is purely and simply about operational risks. It's about integrating people, processes, and systems. So it's still very high up the management agenda.

RMAJ: What can operational risk practitioners learn from the recent crisis?

Atkar: For risk practitioners generally, the key learning is to work across risk boundaries-to avoid working in silos and to properly understand the various levers that drive the risks across the balance sheet as a whole. The regulatory language in Basel to some extent encourages risk practitioners to operate in silos. Part of the problem, and I say this with my ex-regulatory hat on, is that, over time, people fail to understand how the mainstream risks such as credit and operational risk interact and the impact they collectively have on, for example, capital and liquidity. So if risk practitioners collectively learned anything, it is to look at portfolios and at risks much more holistically. Risk management needs to be driven by more than regulatory language.

RMAJ: Operational risk management programs are about 10 years old and still evolving. Are you satisfied with the programs in place today at Lloyds?

Atkar: I am, to an extent. As I said, the integration program has been useful in maintaining the focus on operational risk. However, there still are business managers and leaders who don't understand what risk practitioners mean when they talk about operational risk, and yet they are good at managing the risks that arise from their operations. So if we're ever truly to get to a place where business leaders welcome the need to manage their operational risks, risk practitioners need to start talking their language and also demonstrate the true cost of poor control on the bottom line.

Defining operational risk in a regulatory construct in some ways did not help promote the benefits of managing operational risks. Firms, not just banks, have always managed operational risk; they've just never called it that.

Now, in Lloyds, we're trying to flip the language back into business-speak to get more traction with the businesses. We don't want to pretend that they necessarily manage their risks using the Basel operational risk categories because they don't. They look at their end-to-end processes, and they understand their key control weaknesses. As risk practitioners, we need to understand how to help them understand their risks rather than necessarily understand a taxonomy of operational risks.

RMAJ: Have you ever brought in operational risk expertise from other industries?

Atkar: We have. For example, very obviously, we can learn from the people who are working on our integration program who know how to run operations in different industries.

If I could start with a blank sheet of paper, I would staff an operational risk function with a number of operations people, whether from banking or any other industry. You need people who understand how operations work rather than only risk people who will typically bring a different perspective.

RMAJ: Within the context of new product development and emerging risks, does your operational risk practice intersect with development and execution of business strategy?

Atkar: At a granular level, yes. For example, operational risks are considered when new products are developed and scenarios are developed to assess emerging risks. And, of course, I've mentioned our integration program where, as a strategy, clear operational risks were and continue to be considered. We're clear on our tolerance for operational failures. There is, however, probably still room for improvement when it comes to wider strategy considerations.

RMAJ: What can operational risk managers do to increase their value to the business lines and to senior management and the board?

Atkar: As a general statement, operational risk managers need to understand the businesses they interact with better than they typically do. Either we need to recruit the right people into the discipline, or they need to get out there and understand what's going on. That's the only way that operational risk managers will ultimately gain credibility with senior business leaders. It tends to be easier for credit risk managers because of the relationship between risk and credit approval. Operational risk is more of a generalist risk discipline, so an operational risk manager is unlikely, for example, to have expertise in the range of risks that sit within the operational risk umbrella.

RMAJ: Would it be beneficial for business people to spend time in operational risk?

Atkar: Yes, there needs to be much more cross-fertilization. That's true of other control functions as well, where they and the customer-facing businesses would both benefit from people moving between the two. Even if they are seconded for just a short term, it's valuable experience.

RMAJ: Within Lloyds, is there a graduate scheme for risk in general from which operational risk can benefit?

Atkar: The bank has a graduate scheme, and there is an opportunity for graduates to work in one of the control functions during one of their four six-month rotations. Generally, the feedback from those who have spent time in risk has been very positive, particularly if they have already spent time in a customer-facing function.

RMAJ: How do you plan for natural disasters, terrorism, and pandemics?

Atkar: We rely heavily on scenario analysis. Within the AMA [advanced measurement approach] models of both HBOS and Lloyds TSB, scenarios are key. We require businesses to do scenario planning at least once a year and, at least once a year, we undertake a group-wide scenario exercise. For example, as we are a sponsor of the 2012 Olympic Games in London, we would typically develop a scenario plan for that. We have in the past undertaken a pandemic scenario. And, of course, we contribute to the Financial Services Authority's annual exercises.

We manage major incidences through a robust structure, using a body of people who make up the Group Incident Operation Committee, which works very well.

RMAJ: What keeps you awake at night?

Atkar: A key risk for all industries, as we've seen recently, is information security. No matter how robust a company's defenses are, there are those who seem able to overcome them. I also worry about the speed with which any reputational issues can become global within a matter of seconds through social networking sites. Again, in other industries, we've seen how relatively small issues can become major reputational risks.

RMAJ: How do you define a success in operational risk and how is it measured?

Atkar: At a very high level, the board has a quantitative risk appetite statement. We measure the global amount we would be willing to lose through operational failures, as well as how big any one of those losses might be. So we have a cap on the total amount and a cap on any one material event. Lower down in the organization, we want to ensure that we minimize loss from poor control. So, the idea is that if you're compliant with policy, your control environment is broadly the right control environment. There's still work to do here.

Success in operational risk is hard to determine other than through measuring the cost of poor control. Whilst material operational risk events are clearly captured, less material ones often are not clearly identified or recorded. Until you get absolute visibility of every piece of poor control and what it's costing you, you will never really know whether you are managing the risk as well as you could.

RMAJ: Is Europe more positioned on the U.S. operational risk model or the U.K.?

Atkar: Clearly, the U.K. and U.S. took different approaches to the approval of operational risk models-with perhaps the U.S. being more cautious and placing weight on different inputs such as internal control factors, whereas the Europeans have been much more willing to introduce scenarios. I'm not saying one approach is better than the other; they are just different.

RMAJ: What do you think the North American bankers can learn from the Europeans?

Atkar: It would be arrogant for me to say that they could learn anything from us, and vice versa. We tend to operate differently. One thing I think we could all improve upon is this relationship between the regulatory operational risk language and the way the business operates in practice. For example, I'm a fan of identifying risks and control on a process-led view, rather than a risk category-led view. Starting with a construct that is a regulatory rather than a business one is not always the most appropriate way to embed good risk management practices.

RMAJ: Can you discuss the value you find in participating in RMA's GCOR, both for yourself and your institution?

Atkar: On a personal level, participating in RMA's Operational Risk Council has given me an insight into how the U.S. agenda is developing in respect to operational risk. It is quite different and very interesting, particularly at the AMA level.

The bank also has found its RMA involvement beneficial within both operational risk and credit risk. One of my colleagues was heavily involved in RMA's risk appetite work, and that involvement has informed our risk appetite for operational risk. As the only U.K. bank involved in some of the discussions, it's been great to share what we're doing. As a bank that is less global than some of our U.K. peers, it gives us an insight into what happens overseas.

Neeta Atkar began her career as a graduate at the Bank of England, where she performed in a range of generalist banking roles. She became a banking regulator for a short time when her position later moved to the Financial Services Authority. She then held risk roles in consulting and also for three large U.K. financial services firms, in both banking and insurance.

During her four years with Lloyds, Atkar's predominate responsibility was operational risk, although she also has worked in regulation and compliance. She has recently been named chief risk officer for Project Verde, the business that Lloyds is selling to meet its commitments to the European Commission.

If we're ever truly to get to a place where business leaders welcome the need to manage their operational risks, risk practitioners need to start talking their language and also demonstrate the true cost of poor control on the bottom line.

Until you get absolute visibility of every piece of poor control and what it's costing you, you will never really know whether you are managing the risk as well as you could.