英语论文网

h in describing various approaches to operational risk management and, in an audit context, in formulating the key steps to control self-assessment, as the cornerstone of the risk identification process. Yet there is little published guidance on how to perform it effectively and on how to ensure that the resulting map is indeed complete and consistent. In other words, although the term is widely used by bankers, auditors, regulators and consultants alike, and although all these professionals

may even agree on what constitutes an acceptable final product, they will most likely give widely different explanations on how to get such product, the resources needed and the costs involved.

Risk mapping is difficult for a number of reasons, all of which can be summarized by reminding ourselves that ‘the map is not the territory'. No matter how accurate and thorough our analysis is, what really goes on in the business is never exactly what is written in the manual. Here are just a few of the key dimensions:

1 People: Processes are affected by people, and people, no matter how formalized the process is, adapt, interpret and improvise in response to circumstances.

2 Specialization: Very few people really understand a specific business process and its interactions with other people and systems within the bank. When one of these people leaves or is just absent for a while, the potential for an operational failure appears.

3 Processes: Processes change all the time and any mapping becomes obsolete almost overnight after being completed.

In this research, I describe a methodology for the mapping of operational risk with the objective of identifying the risks inherent in the different steps of a business process, selecting the key risk indicators (KRIs) (Hoffman, 2002; Davis and Haubenstock, 2002) and designing the most appropriate control activities. In my approach, therefore, risk mapping is the basis for all the key components of operational risk management - identification, assessment, monitoring/reporting and control/mitigation - as defined by the Basel Committee on Banking Supervision (2003).

There is more than one way to map risks. The most common technique is probably the mapping on a probability/severity chart (Figure 1) so as to identify the key priorities for management. The result in most cases helps to distinguish between high severity/low frequency and high frequency/ low severity losses, but which in general gives no indication as to what management actions to take in order to change the existing risk profile. Another way is to map the risks to the phases of a business activity where they can occur and identify the key risk factors and drivers in the process. This leads to a somewhat more complex result, rich in qualitative information rather than in quantitative assessment, but giving very clear indications as to which parts of the process should be changed in order to make a difference to the overall risk exposure. It also allows for the identification of the KRIs that are more relevant to each risk exposure.

Pursuing the application of KRIs to operational risk assessment is suggested by the need to capture the various issues we find with purely statistical ap本论文由英语论文网提供整理，提供论文代写，英语论文代写，代写论文，代写英语论文，代写留学生论文，代写英文论文，留学生论文代写相关核心关键词搜索。