Managing Risk Through Performance MeasurementFIRMA Risk Management Training Conference

Lori Loken-King - SVP

Union Bank, N.A., Operational Risk Management

April 17-22, 2011

2 |

Agenda

• Risk Management & Metrics

• Why Should We Care?

• What Makes a Good Metric?

• Identifying Metrics and Assigning Thresholds

• Analyzing and Reporting the Results

• Some Examples

3 |

Union Bank Profile

• $79 Billion full service commercial bank headquartered in San Francisco, CA• 401 branches in California, Washington, Oregon, and Texas, plus two

international offices

• Markets include consumer, small business, middle market, real estate, corporate, correspondent, and trade finance

• Products include investment and financial management, trust services, private banking, insurance services, and global custody services

• HighMark Capital Management is the bank's investment management subsidiary

• UnionBanc Investment Services is the bank’s broker-dealer subsidiary

• Fully owned by Bank of Tokyo Mitsubishi UFJ, Ltd (BTMU)

• “Opting in” to Basel compliance

• Efficient follower strategy

• Entered parallel April 1, 2011

4 |

Risk Management & Metrics

• “Indicators” provide a means to track changes in risk exposure

• Emerging risks

• Current exposure levels

• Past events that could recur

• Portfolio performance metrics vs. corporate performance metrics – what are we trying to measure?

• Credit risk and market risk vs. operational risk

• Risk measurement or risk management

• Key risk indicators or key performance indicators

5 |

Some Terminology to Consider

• Key risk indicators

• Metrics used to measure the level of exposure to a given risk at a point in time, and to provide early warning of changing risk exposure

• “Leading” indicators

• Key performance indicators

• Metrics used to measure the achievement of performance targets

• “Lagging” indicators

• Key control indicators

• Provide information on whether a control is meeting its intended objective

• “Metrics” – can include all of the above and more

6 |

The Focus on Metrics – Why Should We Care?

• Changing regulatory environment and Basel II

• Benefits of a metrics program

• Provides ongoing understanding of changes in the risk profile

• Aligns the level of risk with risk tolerance / risk appetite, and establishes thresholds for taking action

• When aligned with performance management and reporting, can influence behavior by focusing attention on managing risk to achieve objectives

• Allows continuous monitoring (and possibly continuous auditing) of risks and controls

• Provides an objective, transparent, repeatable process for measuring risk and performance

7 |

Some Challenges

• Aligning metrics to business strategies and objectives can be complicated, as can upward aggregation

• Data overload – too many metrics from disparate sources can blur the picture and sometimes give conflicting results

• Data integrity – inaccurate or incomplete data can lead to incorrect conclusions

• The interpretation of metric measures may be misleading if the correlation to the risk is not appropriate

• Access to data and knowledge of how to use it can encumber the effectiveness of the program

8 |

What Makes a Good Metric?

• To be effective, metrics should be:

• Relevant to the specific object being measured

• Quantifiable to enable comparison to thresholds and triggers

• Meaningful to the intended audience

• Useful as a driver of behavior

• Readily obtainable without significant investment in collection efforts

• Timely to allow for course correction when warranted

9 |

Building Meaningful Metrics

1. Identify your audience

2. Understand your risk and control environment

3. Define what to measure and how

4. Set thresholds and triggers

5. Analyze and report results

10 |

Identify Your Audience

Board of Directors

Executive Management

Business Line Managers

Impacted Personnel

Aud

it &

Com

plia

nce

Risk Appetite

Risk Escalation

Metrics may or may not be relevant or useful to different audiences, so keep the audience in mind when selecting metrics.

11 |

Understand Your Risk And Control Environment

Mo

nit

ori

ng

ControlsRisks

Pro

du

cts,

Pro

cesses &

Delivery C

han

nels

Business Strategies & Objectives

Risk & Control Self Assessment

Understanding the risk and control environment is critical to building a meaningful metrics program that is:

• Aligned to business strategies & objectives

• A meaningful driver of behavior

• Focused on the most critical risks and / or controls

12 |

Define What To Measure And How To Get The Data

• What is the end goal? • Monitoring emerging and environmental risks?• Monitoring residual risk?

• Define metrics that align to organizational risks• Consider top down vs. bottom up approaches• Use event root cause analysis• Consider internal and external loss data• Involve subject matter experts

• How many is enough? How many is too many?

• How will the metric be measured?• Is the data readily available? If not, can it be mined?• Is the data reliable? Has it been validated?• How frequently should the data be extracted?

13 |

Set Thresholds And Triggers

-20

0

20

40

60

80

100

120

1 2 3 4 5 6 7 8 9 10 11 12

Sample Metric for Triggers and Thresholds Risk thresholds may indicate a metric is out of tolerance

requiring corrective actions or change of course

Trigger points are set to determine when strategies may need to be revised or controls may need to be more closely

monitored.

Data is monitored over time against expected

results

Note: The terms threshold and trigger are sometimes used interchangeably – this is one way to approach them.

14 |

Analyze & Report Results

• Data is useless without the analysis of what it means• Data becomes meaningful when compared to trends over time,

established triggers and thresholds, expected results, etc.• Remember the goal is to drive behavior and improve risk

management

• Reporting may differ by audience – some things to consider:• Report metrics in the context of expected results versus actual

results to make them meaningful• Timeliness is critical to allow for course correction or corrective

actions• Reporting should clearly show what, if any, action is expected

15 |

Union Bank Approach to Operational Risk Metrics

• Top Down Perspective Focused on the Operational Risk Capital Model and the AMA elements

• Operational Risk Capital

• Internal Losses

• Business Environment & Internal Control Factors

• Scenario Analysis

• Bottom Up Perspective Focused on Specific Business Risks

Identify Key Risks

Define Risk Metrics

Establish Thresholds

Monitor Triggers

ReportResults

16 |

Union Bank Sample Reports – Operational RiskOPERATIONAL CAPITAL (ECONOMIC CAPITAL IN $M) RCSAs (RESIDUAL RISK HEAT MAP)

6

5 1

4 2 Tolerance

3 10 9

2 4 13 1

1 5 1

1 2 3 4

OPERATIONAL LOSSES (NET LOSSES IN $K) SCENARIO ANALYSIS (BY EVENT TYPE $M)

Quarterly Results Annual Results

$0

$500

$1,000

$1,500

$2,000

$2,500

2010-Q2 2010-Q3 2010-Q4 2011-Q1

Budget

$100k+

Under $100k

$0

$20

$40

$60

$80

$100

$120

$140

$160

2010-Q3 2010-Q4 2011-Q1

Indirect

Direct

$-

$500

$1,000

$1,500

$2,000

$2,500

PYTD CYTD

Total capital of$137M in 1Q11 has been increasing steadily due to both internal and external loss profile. Im

pact

Likelihood

There are no high residual risks of the 46 total risks at 1Q11. 23 of the risks were rated as high inherent.

Frequency

Current quarter losses are trending lower than the same period last year. There have been no losses exceeding $100k for the current quarter and only one loss exceeding $10,000 related to trade error adjustments in Dept Z.

$

$10

$20

$30

$40

$50

$60

$70

$80

0.00% 1.00% 2.00% 3.00% 4.00% 5.00%

Se

veri

ty in

Mill

ion

s

Top Scenarios by Worst Case Severity

Business Disruption and System Failures

Clients, Products and Business Practices

Execution, Delivery and Process Management

External Fraud

Internal Fraud

Largest scenario of $75M considers a premise where a large fund breaks the buck as a result of errors in the stress test model.

17 |

Union Bank Sample Reports – Key Metrics

Key OpRisk MetricsBusiness Unit Description & Rating Explanation (including action plans)

Legend Out of Tolerance Within Tolerance

Retail Banking Sample Metric 1 Rating Explanation of why the metric is out of tolerance and what the business is doing about it

Sample Metric 1 explanation

Wealth Management Sample Metric 2 Rating

Sample Metric 2 explanation

UBIS Sample Metric 3 Rating Watch list item - Explanation of what is driving the risk change and whether there is a need for correction action

Sample Metric 3 explanation

18 |

Questions