How measured risk becomes money
How the measurement makes money
Each row is one kind of step the committee took once it had the measured figures, with an example from this bank. The yearly effect is the change in the total cost of operational risk against the bank’s original plan, and the rows add up to the total.
Four kinds of money in this case
Every figure on the pages that follow is one of these four, or their sum.
How to read this case
The pages follow the six steps above in order. The Before page shows the register and the matrix. The Method and After pages show how Cardinal measured the same risks and what the figures changed. The Budget page shows what the same budget buys under each ranking, and ends with the test from Cardinal's research. The Controls and Steps pages cover the committee's decisions, and the Money page shows where the bank's choice lands in the accounts. The plan you pick on the Steps page carries through to the Money page.
Terms used in this case
- Operational risk
- The risk of losing money when a process, a system, a person or an outside event fails. A payment sent to the wrong account is one example, and a platform outage is another.
- RCSA
- RCSA stands for risk and control self-assessment. Risk owners meet every quarter, rate each risk on a matrix and record how well its controls work.
- Workshop
- The quarterly RCSA meeting where the risk owners rate each risk on the matrix.
- Risk matrix
- A grid that rates each risk by how likely it is and how much damage it would do. Every cell has a colour, and the colour decides how much attention the risk gets.
- Control
- A check or process that makes a loss less likely or smaller, such as a second person approving a large payment. A key control is one the bank relies on for its financial reporting or a regulatory obligation.
- Expected loss
- The average yearly loss from a risk, with frequent small losses and rare large ones counted together.
- Typical loss
- The middle event, which half of the events stay under. The average loss counts the rare very large events as well, so it runs higher, and the expected loss uses the average.
- Bad-year loss
- The total yearly loss that the bank should expect to exceed about once every twenty years.
- Book of work
- The list of remediation projects the bank could fund this year. Here every risk owner proposed one project, so the list has one for each risk, and the programme the bank had already approved is the hundredth, outside the ranking, so the ranking holds 99 candidates.
- Remediation budget
- The money the bank spends each year on the projects in its book of work. Cardinal’s research calls it the mitigation budget and finds that a bank which ranks its projects by measured size can hand back 60% of it and keep the same protection. That saving applies to this budget alone.
- Budget-equivalent saving
- The share of the remediation budget the bank could hand back and still get the same protection, once it ranks its projects better. It is the headline measure in Cardinal's research, where it averages 60%.
- True size
- What a risk really costs in a year. It exists only because we invented the bank. The last block of the Budget page scores every ranking against it, as Cardinal's research does, and the bank itself sees only the measured figures.
- Rerun
- One of the 600 times we built the case again with different random numbers for the workshop ratings, the comparisons and the tie-breaks, to see how far the result moves.
- Key risk indicator
- A number the bank watches to spot a risk as it grows, such as a count of failed reconciliations. Banks usually shorten it to KRI.
- Total cost of operational risk
- What the bank spends on its controls and projects in a year plus the losses it expects in that year.
The register as the bank ran it
The bank's risk matrix
Each dot is one risk, and the number in the corner counts the risks in the box. The rows rate how likely a risk is and the columns rate how much one event would cost, both after controls. Each band carries a score, from one for Rare likelihood or Low impact up to four for High likelihood or Critical impact, and the bank adds the two scores to set the colour. A total of four or less is green, five is amber and six or more is red.
How a risk gets its place on the matrix and its dollar figure
How the bank turned ratings into dollars
| Likelihood | What the rating means | Frequency used |
|---|
| Impact | Loss per event | Loss used |
|---|
The bank's own figures for one year
The analysis ran in seven steps
Cardinal took the bank's register and measured every risk in dollars. The seven tabs below walk through the work in the order it happened, from collecting the bank's material to agreeing which decisions to consider. A real engagement follows the same steps with the bank's own data.
Where the measured loss sits on the bank's matrix
Risk by risk, the bank's figure next to the measurement
Each row is one risk, sorted by its measured size. The hollow circle marks the bank's figure from its matrix rating and the filled circle marks Cardinal's measurement. A long blue line means the bank underestimated the risk, and a long amber line means it overestimated it. Across is the expected loss in dollars a year, on a logarithmic scale, so each grid line is worth ten times the one before. Click a row to see the details on the right.
The two totals
From five years of losses to the measured figure, $m a year
Five years of records show the risks the bank has already met, at the sizes those five years happened to produce. New risks leave no record at all, and a risk that strikes once in thirty years is usually missing from five years of data. The measurement covers both of these kinds of risk.
Why the bank's figures differ
Each risk sits in the row of the flaw that moved its figure most. The first four rows are the flaws that Cardinal's research builds into every simulated workshop. The next two are conventions of this bank.
Where the records sit above the measurement
The same workshop run many times
How often the ten largest risks come out red, amber or green
How much the headline figures move
Scored against the true sizes, as the research does
Expected loss removed for each size of budget
Across is the yearly remediation budget and up is the expected loss the funded projects remove, both in millions of dollars a year and scored on the true sizes. Each line climbs as more projects fit into the budget. The blue line ranks projects by measured return, the grey line by colour, the dashed line is the best plan possible with perfect knowledge of every risk and the dotted line is a random order. The vertical line marks the budget on the slider, and the green arrow shows the saving, because the measured ranking reaches the colour ranking's height with that much less budget. Move the slider under the chart to try another budget, and the figures above the chart, the two project lists and the very-bad-year bars below all follow it.
Both plans scored on the same sizes
This bank next to Cardinal's research
What each plan does to a very bad year
Each grid line on both axes is worth ten times the one before, so a $300k control and a $10m control fit on one chart. The solid diagonal is break-even, where a control prevents exactly what it costs. The upper dashed line marks controls that prevent ten times what they cost, and the lower one marks controls that prevent a tenth of what they cost. A click on a dot shows what the control does and what the bank decided about it, and the plain blue dots are the controls the committee left as they were, whether key controls or not.
The committee weighed three options and chose the middle one
The measurement changed how the bank ranks its book of work, and it pointed to controls and testing that cost more than they prevent. The Business Control Committee, which decides on controls and projects, looked at three ways to use both, running from taking the savings in cash to reinvesting all of them. The Business Control Officer, whom the bank calls the BCO, is the executive who answers for the controls and approves the smaller steps. Click an option to load it into the list below, or switch single steps on and off to build a plan of your own. Every figure on this page compares a plan with the bank's original plan, which funded the projects for red risks first. Net value is what a plan or a step takes off the yearly cost of operational risk. For a project it is the loss removed less the project's cost, and for a control or testing step it is the spending saved less the loss that comes back. The board has set a limit of $230m on expected loss and a tolerance of $500m on bad-year loss, and every plan has to stay inside both. The confidence figures come from 3,000 simulations, each a rerun of the sums with the risk sizes, control effects and costs drawn afresh from their uncertainty ranges, so a step that pays off in 99% of simulations had a positive net value in 99 runs out of 100.
The list on the left groups the steps by type. The switch adds a step to the plan or takes it out, and a click on the text opens the step's decision record on the right. The bold figure on each step is its net value a year.
The register before and after the steps
For each risk the table shows what the old assessment prescribed, what Cardinal measured and what changed as a result. The last column gives the expected loss after the steps, and the small figure under it is the change from the measured figure. Click a row to see that risk in detail on the After page.
From the steps to the accounts
The table puts the same cost lines side by side, all on Cardinal's measurement. The first column shows the bank before it spends this year's project budget, so the original plan and the chosen plan both start from it. The next column shows the bank with its original remediation plan and the third with the plan the committee chose, and the change column compares the two, so both sides rest on the same figures. The Before page's $250m used the recorded losses of $126m, and this table uses the measured $203m, which is why the first column reads higher. The bank’s matrix figure was its own guess at the same losses, and it appears on the Before page.
The lines are rounded, so a column can differ from its total by $0.1m.
How each group of steps moves the yearly total, $m
The first bar is the measured total with the bank's original plan and the last bar is the total with the chosen plan. Each bar in between shows how much one group of steps changes the total once the groups to its left are already in place, so a group's loss figure here differs a little from the same group's figure on the Steps page, which measures every step against the original plan. The first and last bars split into controls and projects at the top and expected loss at the bottom.
Within the bank's risk appetite
Risk appetite is the level of loss the board has agreed to carry. The black line marks each limit. The wide bar shows the figure with the original plan and the thin bar shows it with the chosen plan.
When each step lands, by quarter after approval
Light bars show the time a step needs to build. The dot marks the quarter it goes live, and the line shows it working from then on.
Expected effect on the yearly cost of operational risk, by quarter, $m
Each bar is one quarter, and its darker part is spending the bank stops, on staff, testing and the programme, while its lighter part is losses the bank expects to avoid. Only the first is a budget change, and the second is tracked against actual losses each quarter. The solid line adds the bars up over time, and the figure at its end is the effect after eight quarters, which equals the two first-two-years figures in the panel beside the chart added together. The dashed line does the same for cash, which counts build spending when it happens.
Milestones
The chart spreads each build cost evenly over three years, which accountants call depreciation, and the cash line counts the build spending in the quarter it happens.
Control headcount over time, in full-time staff
The reduction needs no redundancies
The bank's own committees made every decision
Cardinal supplied the measurements, and the bank's existing owners and committees made the decisions. The register, the risk categories, the RCSA calendar and the three lines of defence, which split the work between the business, the risk function and internal audit, all stayed as they were, and the committees made their decisions with better evidence in front of them.
| Type of step | Proposed by | Approved by | Checked and recorded |
|---|---|---|---|
| Fund the book of work by measured return | BCO | Business Control Committee | Finance challenges each project's cost and effect. Any exception to the ranking goes on file with its reason. |
| Retire or simplify a control with a small effect | Control owner | BCO | Operational Risk challenges the proposal, and a decision record with an indicator and a reversal trigger goes on file. |
| Retire or simplify a key control, change a control on one of the ten largest risks, or make any change that moves expected loss by $250k or more | Control owner | Business Control Committee | The same checks apply, and Internal Audit hears about the change. |
| Accept a risk within appetite | Risk owner | BCO | Operational Risk has to agree, and the acceptance goes into a register and comes up for review after 12 months. |
| Stop a programme | Programme sponsor | BCO and change governance | Internal Audit agrees how to close any related audit findings. |
| Change a control that regulation requires | No one can propose removing it, and the only changes allowed make it stronger. | ||
BCO stands for Business Control Officer, the executive who answers for the controls in the business. Fifteen of the bank's 44 main controls are key controls, which the bank relies on for its financial reporting.
Rules the bank agreed before seeing any numbers
- The bank takes no step unless it is at least 80% confident that the step pays off, and it needs 90% before it retires or simplifies a control.
- The book of work follows measured return. The committee may fund a project out of order for resilience or a regulatory commitment, and it records the reason.
- A control's effect only counts when separate evidence backs it, from a test, an exception log or a measurement with the control switched off.
- Expected loss and bad-year loss stay within the risk appetite after every step.
- The bank can reverse any step because each retire, simplify or accept step carries an indicator and a trigger that reopens the decision.
- Cardinal re-measures the register every quarter and the bank checks each step against the new figures, with the matrix ratings kept alongside for comparison.
A pilot on one of your registers
We propose a pilot on one defined Payments risk register, with Cardinal's measurements set next to your current RCSA ratings. It produces the same before-and-after view as this case from your own data. The pilot takes twelve weeks from the first data transfer to the first steps in committee.
Measure the register
We load your register, control list, book of work and loss events and measure the likelihood and cost of every risk. We then check the results against the losses you already know about.
Test the numbers
Your process owners and Operational Risk challenge any comparison or reference risk that looks wrong. We gather evidence for control effects from your test results and exception logs.
Compare the two views
We set the measurement against your RCSA ratings, scenario analysis and loss history, risk by risk, and rank your book of work both ways.
Take the first steps
Decision records for the first candidates go through your existing committees. Indicators and a quarterly re-measurement follow.
What we need from you
- Your current Payments register with its RCSA ratings, the control list, the book of work and the loss events, in whatever form they exist today.
- Test results and exception logs for the controls in scope.
- Two challenge sessions for each process area and one decision session with the BCO.
What you get
- Every risk in dollars next to its RCSA rating, with its likelihood, its cost if it happens, its expected loss and an uncertainty range, plus the bad-year loss of the whole register, as on the After page, for your register.
- Your book of work ranked by measured return, with the budget-equivalent saving against your current ranking, as on the Budget page.
- A ledger of your controls that sets each control's cost against the loss it prevents, as on the Controls page.
- Decision records for the first candidate steps, ready for your committees, as on the Steps page.
What we invented for this case and what comes from Cardinal
We invented everything about the bank for this case. The method, the kinds of output and the research results come from Cardinal.