Operational Risk and Regulatory Compliance in US and European Financial Services

TABLE OF CONTENTS
CHAPTER 1 EXECUTIVE SUMMARY 3
Introduction / market context 3
Areas impacted and where efforts are focused 3
Approach, progress and barriers in compliance efforts 4
Target IT framework for enterprise operational risk management 6
The future decoded 7
OpRisk’s broader reach covers a multitude of sins - an opportunity assessment 7
Strategic trends and implications 8
Action points for financial institutions 9
Action points for vendors 11
Conclusion - OpRisk functions to evolve from an internal regulator to a risk advisor role? 12
CHAPTER 2 INTRODUCTION 20
CHAPTER 3 MARKET CONTEXT 21
Operational risk in the context of emerging regulations 21
Sarbanes-Oxley (SOX) 21
Basel II 22
Other regulations 23
Business drivers 24
Operational risk categorization and priority areas 26
Operational risk management lifecycle 28
Operational risk initiatives 29
Areas impacted and where efforts are focused 29
Approach, progress and barriers in compliance efforts 31
Target IT framework for enterprise operational risk management 35
CHAPTER 4 THE FUTURE DECODED 38
Overall OpRisk spending is small in relative terms, but real opportunities lie in operational improvement initiatives 38
US operational risk spending 39
Europe operational risk spending 40
Basel II OpRisk software spend gradual but may undergo renewal from 2005 41
European Basel II (OpRisk) and financial reporting spend by source 41
US Basel II (OpRisk) and SOX spending by source 43
OpRisk’s broader reach covers a multitude of sins - an opportunity assessment 45
Resiliency, business continuity and crisis management 45
External fraud 46
Post-trade processing and settlement 47
IT security 47
Integrity of financial reporting 48
Compliant market practices 49
Operational risk capital allocation (Basel II and economic capital) 49
CHAPTER 5 COMPETITIVE DYNAMICS 51
Operational risk management - solution chain and coverage 51
Strategic developments and implications 53
Basel II and Sarbanes-Oxley (SOX) 54
Outsourcing and operational risk 55
Action points for financial institutions 56
Action points for vendors 60
CHAPTER 6 APPENDIX 65
Definitions 65
Relevant readings 69
SPP writing team 69

LIST OF TABLES
Table 1: Overall operational risk (Basel II and SOX) - US vs Europe, 2002-2006 38
Table 2: Europe - total OpRisk spend by source (Basel II & financial reporting / SOX), 2002-2006 41
Table 3: Europe - total OpRisk spend by source (Basel II only), 2002-2006 42
Table 4: US OpRisk spend by source (Basel II and SOX), 2002-2006 43
Table 5: US OpRisk spend by source (financial reporting / SOX only), 2002-2006 44


LIST OF FIGURES
Figure 1: Operational risk initiatives 4
Figure 2: Target IT framework for enterprise operational risk 6
Figure 3: Operational risk - opportunities for technology 7
Figure 4: Evolution of operational risk management 8
Figure 5: Operational risk linkages with other risks 9
Figure 6: Integrating loss data, assessments, risk indicators & remedial actions 10
Figure 7: Operational risk group’s evolving future role? 13
Figure 8: Basel II overview 22
Figure 9: Basel II Operational Risk 23
Figure 10: Approach for addressing operational risk 26
Figure 11: Operational risk management lifecycle 28
Figure 12: Operational risk initiatives 29
Figure 13: Operational risk organization 32
Figure 14: Target IT framework for enterprise operational risk 35
Figure 15: Overall operational risk (Basel II and SOX) - US vs Europe, 2002-2006 38
Figure 16: US OpRisk spending, 2002-2006 39
Figure 17: Europe OpRisk spending, 2002-2006 40
Figure 18: Europe - total OpRisk spend by source (Basel II & financial reporting / SOX), 2002-2006 41
Figure 19: US OpRisk spend by source (Basel II and SOX), 2002-2006 43
Figure 20: US OpRisk spend by source (financial reporting / SOX only), 2002-2006 44
Figure 21: Operational risk - opportunities for technology 45
Figure 22: Operational risk solution chain and coverage 51
Figure 23: Evolution of operational risk management 53
Figure 24: Basel II vs SOX - areas of overlap 54
Figure 25: Historical vs predictive KRIs 56
Figure 27: Operational risk linkages with other risks 57
Figure 28: Linking up loss data, assessments, risk indicators & remedial actions 58