ORM4801/202/0/2011

STREPIESKODE BAR CODE

UNISA P248(A)

DEPARTMENT OF FINANCE AND RISK MANAGEMENT AND BANKING

OPERATIONAL RISK MANAGEMENT ORM4801 TUTORIAL LETTER 202/2011

CONTENTS 1 INTRODUCTION 2 SUGGESTED SOLUTION TO ASSIGNMENT 3 CONCLUDING REMARKS

ORM4801/202

Dear Student 1 INTRODUCTION

The purpose of this tutorial letter is to provide you with a proposed solution to the second assignment. 2 SUGGESTED SOLUTION TO THE ASSIGNMENT [100] Due date: 3 October 2011

ASSIGNMENT 02

The purpose of this assignment is to test your knowledge and understanding of typical operational risk management functions and process. Lecturer: Prof J Young Background You have been appointed as the operational risk manager at a senior level as part of the executive team of the XPC Petroleum Company. Currently, there are no risk managers or any risk management framework in place for the company. The XPC used to be a parastatal of the South African Government, meaning it received an annual subsidy as part of its operating budget. However, it was decided to privatise as the Companys profit margin allowed it to become independent and the overseas business looked promising. The initial stock and equipment was bought from the Government for R4.8bn, which must be paid off in instalments of R20m per month over 20 years. The XPCs main business includes the buying of crude oil from Saudi Arabia, storing it in tanks and selling it to larger oil companies in Africa. The newly built site is situated off the coast at Mossel Bay close to the current tanks of another company. There are currently 4 large tanks of which one tank is not always fully utilised. The tankers from Saudi Arabia anchors in the bay and then the oil are pumped from a platform to the four tanks. The pipeline is currently visible where it emerges from the shore into the secured areas of the tanks. The crude oil is transported on a weekly basis by large oil trucks to Cape Town, where the clients of XPC receive the oil. As such, the oil is the responsibility of XPC from the point it is pumped from the oil tankers into the tanks until the clients take ownership of the oil in Cape Town.

ORM4801/202

The crude oil is pumped from a Saudi Arabian tanker into a holding tank on a monthly basis. The oil tankers carry a load of 2 million litres of oil, while the holding tanks have a capacity of 20 million litres each. Each truck can transport 25,000 litres at a time. The Company has 4 oil transport trucks. The Company must ensure that 2 million litres oil be transported to Cape Town per month where the oil is sold for R2000.00 per barrel (R20.00 per litre). Company Information # 1 Oil price R500.00 per barrel 1Barrel = 100 litres R5.00 per litre 2 Staff component Top management: 20 Senior management: 50 Blue collar workers: 80 3 4 5 Staff costs Selling price per barrel of crude oil by XPC Transport costs per truck load (Insurance of R500.00 included) 6 7 8 9 Maintenance cost of pipeline and tanks General Admin Government loan Value of a transport truck R6m pa R20m per month R2.0 million R1.2m pa R10 000.00 R54m pa R2000.00 (R20.00 per litre of oil)

In order to get to know the Company from a risk management perspective, you decided to draft an income and expenditure statement based on the above information.

ORM4801/202

1. Complete the following proposed income and expenditure statement for XPC to determine a rough estimate if the Company will make a profit or loss (10 Marks): Proposed Income & Expenditure statement for XPC per annum INCOME (2 marks) Oil sold (2m litre per month x 12 @ R20.00 p/litre) R480.0m

EXPENDITURE (7 marks) R430.8m Cost of purchased oil Staff Costs Admin Costs Maintenance Transport Costs Government Loan Profit/(Loss) (1 mark) R120.0m R 54.0m R 6.0m R 1.2m R 9.6m R 240m R 49.2m

You decided to give attention to the financial risks at a later stage. According to your experience and certain worldwide developments, risk management became a focus point for most companies. 2. Briefly analyse the reasons/drivers behind the more focused approach to operational risk management (10 Marks) (study guide p.5) Technology developments which transformed the risk from manual processes to systems risk; Growth in e-commerce that opened doors for external fraudsters such as hacking into systems; Increased use of outsourcing contracts; Increase in mergers and joint ventures; More sophisticated products to achieve a competitive advantage; and Increased use of financial instruments to optimise the market and credit risk exposures, but which may in turn result in other forms of risk (1 mark per comment with a maximum of 5)

ORM4801/202

The CEO of the company told you to provide a proposal on the general risk management function of a risk manager. He also requires an indication of what the role of internal audit should be in terms of risk management. 3. Determine the typical role and responsibilities of a risk manager and distinguish the role of the risk manager and internal audit. Approach your discussion in terms of the following primary components: Governance, Strategic planning, Risk control and Reporting. (15 Marks) Study guide p.46 49 & Tutorial letter 101 The roles and responsibilities of a group risk management function could be summarised as follows: Governance (3 marks) o Coordinating risk management policies and standards on behalf of the board of directors. o Research and development of risk management practices. o Coordinate risk management training. Strategic planning (2 marks) o Provide risk-related information and expertise during strategic planning processes. o Coordinate all risk information as a basis to determine the overall risk profile and the risk appetite. Risk control (2 marks) o Monitoring the implementation of risk policies and standards. o Monitoring the use of risk management practices. Reporting (3 marks) o Consolidate risk reports to the board of directors/risk committees. o Consolidate all risk information on a centralised basis on behalf of the organisation. o Coordinate the risk reports to various stakeholders such as the regulator. Internal audit provides an overall assurance on the adequacy of operational risk management. This should also include the examination of controls concerning the capturing of data. Internal audit would typically also review the adequacy and effectiveness of the processes for monitoring risk management processes. (2 marks) The relationship between internal audit and risk management has positive effects, as there is scope to create incremental value from the interaction between the two areas. Operational risk managers, for example, internal audit scores as proxies theis level of operational An initial evaluation of the riskuse management situation indicated thatfor there not an risk in a business. They also use the scores to monitor and report on the progress of embedded risk management framework inissues. the Company. components of a risk the business units in resolving internal audit Internal The audit departments, intypical turn, use results of operational risk self-assessments to provide the focus of internal audits and review management framework are a risk management culture, risk strategy, risk management the effectiveness of operational risk management practices. (2 marks) structure and risk management process. These components must be addressed to ensure It is important that internal audit, risk management and internal control managers all the effective development of risk management for the Company. concentrate on key risks to the organisation in order to achieve effective control measures. A primary function of internal audit is also to examine the risk control systems. In many organisations internal audit has moved from the compliance function to playing a major integrating role in risk management, in that they could act as facilitators and mentors to management and exercise influence over the adoption of leading practice regarding operational risk management. (1 mark)

ORM4801/202

Establishing a risk management culture for the organisation can be regarded as one of the key components of a risk management framework. This will create a risk-awareness in the company. However, to embed a risk management culture, there are a number of key requirements which you need to advise top management on. 4. Argue the requirements needed for embedding a risk management culture for XPC Company (10 Marks) Hussain p.110 116 & 212 - 214 1. Top management need to demonstrate through word and action that they consider risk management a high priority. Oversight responsibility needs to be communicated to all staff. 2. Organisational line of responsibility and authority need to be established. 3. A cross-functional view of risk must be taken to break down organisational and functional barriers. The enterprise-wide nature of risk management must be adopted taking into account management styles and skill requirements. 4. The measurement of risk and exposure on an enterprise-wide basis is a key component of effective risk management. 5. A clear set of corporate objectives and strategies which include an acceptable approach towards risk management should be established. The gains from managing risk should be clear and measurable. 6. Financial and non-financial incentives must be created aligned with the risk management objectives. 7. Training and support for risk management must be provided. 8. Remuneration of staff must be market-related. 9. Risk managers should be regarded as a valuable resource which can provide independent, objective input on matters arising from business strategies. 10. Risk management is not a once off function a continuous management function and the emphasis of risk management must move from losing money to that of making money being proactive could prevent losses and risk events from occurring.

5. As part of the Companys risk management framework, identify and argue 5 core principles which will form part of the operational risk management culture of the Company (10) Young p.34 41

1. 2. 3. 4. 5.

Total involvement of all employees in risk management. Upward reporting process with the aim of disclosure or decision required. Downward communication on risk management decisions Risk ownership the line/business managers are regarded as the risk owners. Common risk language Student can discuss any 5 core principles of an ops risk management culture (2 marks each)

ORM4801/202

After communicating with the operations manager, you came to the conclusion that operational risk is one of the major risks for the Company. However, it is important that a common definition be formulated for the Company. 6. Analyse a definition for operational risk for the XPC Company. (10 marks) Study guide p. 20 21 Ops risk is the risk of losses due to inadequate or failed internal processes, systems and people and external events. This can include legal risk, but excludes reputational and strategic risk. (6 marks) The factors for ops risk are clear in order to make it possible to be measured. As soon as it can be measured it can be managed effectively. (1 mark) It includes legal risk as legal risk can be measured in terms of losses suffered in terms of penalties and fines as a result of breaches of contracts and regulations for example. (1 mark) It usually excludes reputational and strategic risks as these risks are difficult to measure and thus to manage as a specific risk type. (2 marks)

In order to ensure an effective operational risk management approach, it is imperative to establish a formal risk management process. 7. Illustrate by means of a diagram a risk management process for the XPC Company, clearly indicating the components of the process (10 marks)

Risk Identification

Monitoring

Risk Financing

Risk Management

Risk Evaluation

Risk Control Monitoring

ORM4801/202

An initial evaluation of the total setup and operations of the Company indicated a number of issues which must be addressed from a risk management perspective. From the media you learned that the community is unhappy with the Company as it may have a negative impact on the environment. Possible oil leaks could pollute the beaches and negatively influence the marine life. As such, the community is demanding action/answers from the Company in this regard. Furthermore the pipeline, which is visible on the beach, is easily accessible and anyone could interfere with the effective operation of pumping oil to the tanks. Due to a low pay increase for blue collar workers, the competition is recruiting these workers at a higher compensation rate, which is negatively influencing the Companys staff turnover (currently 15%). An acceptable rate for staff turnover is 3%. Another problem detected was the high frequency of electricity outages. As a result the Company is losing critical management information which has a negative effect on business decisions. 8. Based on the given information, Identify 5 inherent operational risk exposures for the XPC Company and formulate a control measure for each risk exposure/threat. (15 marks 3 marks per risk and the control measures) Study guide p. 43 46 # 1 Operational Risk Unhappiness of the community the Control Measure Establish a liaison in order to communicate with community in order to identify their complaints and regularly provide feedback to resolve their issues. 2 Oil pollution of beaches Develop early warning systems which will alert management of oil leaks in order to proactively prevent it. Regular 3 Access to the pipeline and documented inspections and maintenance. Develop a plan which will restrict/prevent access to the pipeline without influencing the access of the community to the beach. Employ security guards to guard the pipeline. Consider moving the pipeline below ground.

ORM4801/202

Loss of staff

Recommend to top management (HR) to review the current compensation packages of blue collar staff in order to reduce the staff turnover to 3%

Electricity outages

Recommend that the Company acquire backup generators and uninterrupted power supply to ensure that the electricity outages do not negatively influence the Companys management information

The Operational Value-At-Risk forms an important part of determining risk mitigating and control measures. 9. Calculate the monthly Operational-Value-at-Risk (OpVaR) for the Company for transporting the oil from Mossel Bay to Cape Town and indicate how you would reduce the effect of a potential risk event during this operating process. (10 Marks) Tutorial letter 202 OPVaR 1. Value of the trucks: 4 x R2.0 million = R8.0 million (1.5 marks) 2. Value of the oil per truck load: 25000 litre x R20.00 per litre = R 500 000 (1.5 marks) 3. 2 million litres must be transported every month. Number of truck loads: 2 million/25000 = 80 trips per month (2 marks) 4. Total value of the oil being transported per month: R500 000 x 80 = R40 million (1.5 marks) 5. Operational Value at Risk (OPVaR) per month: Total value of trucks R8 million + Total value of oil R40 million = R48 million (2.5 marks) Third-party Insurance is a very important method which the company can use to reduce the risk exposure should a risk event occur, for example, a road accident involving the trucks. (1 mark)

(Note: Keep in mind that the above is a suggested solution only and emphasises the important facts of the assignment. Marks can also be given for additional facts which will contribute to the completeness of the assignment).

10

ORM4801/202

References Basel Committee on Banking Supervision. 2003. Sound Practices for the Management and Supervision of Operational Risk. February 2003. Bank for International Settlements. Committee of Sponsoring Organizations (COSO) of the Treadway Commission. (1992). Internal Control-Integrated Framework. Jersey City: American Institute of certified Public Accountants. King Committee and Commission on Corporate Governance. (2002). King 2 Report on Corporate Governance for South Africa. Draft for Public Comment. Pretoria: Institute of Directors in Southern Africa. Young, J. (2006). Operational Risk Management: The practical application of a qualitative approach. Pretoria Van Schaik Publishers. CONCLUDING REMARKS

I recommend that you compare your answers with the suggested solutions and understand the various approaches and concepts. This will add to your learning process and assist you in preparing for the exam. The exam will consist of multi-choice questions and an analysis of a case study based on theory and practical implications of managing operational risk. Answers must be based on facts and not long unnecessary discussions. It will be a 3 hour exam (100 marks). I wish you all the best with your studies and preparations for the next assignment and exam. Best regards Prof J. Young DEPARTMENT OF FINANCE, RISK MANAGEMENT AND BANKING

UNISA 2011