McKinseyOnRisk2017 Full Issue Web2717

McKinsey on
Risk
Highlights
12 18 23
Nonfinancial risk today: Protecting your critical From scenario planning

Getting risk and the business digital assets: Not all to stress testing: The next
aligned systems and data are created step for energy companies
equal
Number 2, January 2017

McKinsey on Risk is written by Editorial Board: McKinsey Practice
risk experts and practitioners Kyra Blessing, Richard Bucci, Publications
in McKinseys Global Risk Ral Galamba de Oliveira,
Practice. This publication Maria Martinez, Theodore Editor in Chief:
offers readers insights into Pepanides, Thomas Lucia Rahilly
value-creating strategies Poppensieker, Kayvaun
and the translation of those Rowshankish, Anthony Executive Editors:
strategies into company Santomero, Himanshu Singh, Michael T. Borruso,
performance. Mark Staples Allan Gold, Bill Javetski,
Mark Staples
This issue is available online Manager of Risk External
at McKinsey.com. Comments Relations: Kyra Blessing Copyright 2017 McKinsey &
and requests for copies or Company. All rights reserved.
for permissions to republish Editors: Richard Bucci,
an article can be sent via Mark Staples This publication is not
email to McKinsey_Risk@ intended to be used as
McKinsey.com. Contributing Editors: the basis for trading in the
Lisa Getter, Jonathan Turton shares of any company or
Cover photo: for undertaking any other
kksteven/Getty Images Art Direction and Design: complex or significant
Leff Communications financial transaction without
consulting appropriate
Managing Editors: professional advisers.
Michael T. Borruso,
Venetia Simcock No part of this publication
may be copied or
Editorial Production: redistributed in any form
Elizabeth Brown, Heather without the prior written
Byer, Roger Draper, Torea Frey, consent of McKinsey &
Heather Hanselman, Gwyn Company.
Herbein, Katya Petriwsky,
John C. Sanchez, Dana Sand,
Karen Schenkenfelder,
Sneha Vats, Belinda Yu
Table of contents
3 12 18
Sustainable compliance: Nonfinancial risk today: Protecting your critical

Seven steps toward Getting risk and the business digital assets: Not all systems
effectiveness and efficiency aligned and data are created equal
Banks do not control the Both must be deeply involved Top management must lead an
demand for compliance, but to avoid costly errors. enterprise-wide effort to find
they can optimize the and protect critically important
effectiveness and efficiency data, software, and systems
of their response. as part of an integrated strategy
to achieve digital resilience.
23 29 37
From scenario planning to The evolution of model risk Digital risk: Transforming risk
stress testing: The next step management management for the 2020s
for energy companies An increasing reliance on Significant improvements
Utilities and oil and gas firms models, regulatory challenges, in risk management can
have long used scenario and talent scarcity is driving be gained quickly through
analysis, but extraordinary banks toward a model risk selective digitizationbut
times call for new measures. management organization that capabilities must be test
is both more effective and hardened before release.
value-centric.
Introduction
Welcome to the second issue of McKinsey on Risk, the journal offering McKinseys global perspective and
strategic thinking on risk. Our focus is on the key risk areas that bear upon the performance of the worlds
leading companiesincluding credit risk, enterprise risk management and risk culture, operational risk and
compliance, regulation, trading and balance-sheet risk, data and technology, advanced analytics, and crisis
preparedness and response.
Response to our first issue exceeded expectations and generated strong interest among risk leaders and
senior executives generally. An overarching theme in those articles was the importance of breaking through
siloed approaches to achieve an enterprise-wide view of risk, with the strategic response centered on the
needs of the business. The articles in this issue deepen our commitment to these themes. Areas of focus are
automation and digitizationspecifically, how leading companies are applying technological innovation
to control costs while improving risk effectiveness.
We begin with a consideration of how financial institutions can manage compliance risk sustainably, by
addressing its root causes rather than adding layers of control. A second article takes up a related theme,
focusing on nonfinancial risk and a unified risk-assessment system to help companies avoid or reduce
the impact of failures. The urgent topic of cybersecurity is addressed in the next piece, which argues for
an enterprise-wide approach that prioritizes key risks based on the business and its value chain. Then we
discuss how, in a volatile global environment, energy companies can use stress testing in strategy develop-
ment and to avoid the normalizing biases of traditional financial scenario analysis. Model risk is the topic of
a further piece, which presents insights from McKinseys experience with leading global banks and indicates
an evolutionary path for model risk management toward capturing value. Our final article discusses digital
riskall the technological advances that improve the effectiveness and efficiency of risk management, from
process automation to advanced analytics and machine learning to artificial intelligence and robotics.
We hope you enjoy these articles and find in them ideas worthy of your consideration. Let us know what you
think at McKinsey_Risk@McKinsey.com. You can also view these articles, the previous issue of McKinsey on
Risk, and many others at McKinsey.com and on the McKinsey Insights app.
Ral Galamba de Oliveira

Chair, Global Risk Editorial Board,
for McKinseys Global Risk Practice
2 McKinsey on Risk Number 2, January 2017

olaser/Getty Images
Sustainable compliance: Seven steps

toward effectiveness and efficiency
Banks do not control the demand for compliance, but they can optimize the effectiveness and efficiency of
their response.
Piotr Kaminski, Daniel Mikkelsen, Thomas Poppensieker, and Kate Robu
The cost of regulatory compliance in banking rose dedicated to testing, monitoring, and other oversight
dramatically in the years after the financial crisis. responsibilitiesat the expense, given budget limits,
Some of the increase came from investment in of production resources.
technology, but most of it wasand remainsdriven
by additional staff. The crisis triggered numerous The investments have magnified industry resilience
critical control failures that required immediate and improved the quality of risk management. The
remedy. Institutions responded, appropriately high cost, however, is now coming into focus. At many
enough given the urgency, by adding layers of control. financial institutions, business, compliance, and risk
An idea of what resulted can be seen in a typical practitioners are beginning to question the sustain-
example. At a large universal bank, a quarter of one ability of the resource-intensive approach to managing
business units resources is now dedicated to control, compliance risks. We believe they are asking the
significantly reducing the share focused on the right question. Banks are still adding layers of control
business (Exhibit 1). While the exact numbers will as the remedy of choice for compliance issues. The result
vary by institution and business unit, whats certain is an unwieldy system of overlapping controls that is
is that more resources than ever before are being difficult to automate and does not address the true root
Sustainable compliance: Seven steps toward effectiveness and efficiency 3

Risk 2017
Sustainable compliance
Exhibit 1 of 3
Exhibit 1 More resources than ever before are being dedicated to testing, monitoring, and other
oversight responsibilities.
Breakdown of FTEs1 across lines of defense,2 US banking example
2% 100%
6%
3%
13%
75%
25% of resources are

dedicated to quality control
Production In-line quality- In-business Centralized Audit (third line Total

staff assurance staff quality control quality control of defense)
(first line of (second line of
defense) defense)
1 Full-time equivalents.
2 Figures may not sum, because of rounding.
causes of risk. Arising issues are approached one thousands of entries. Unsurprisingly, separate
at a time and in isolation; remediation efforts are remediation initiatives and audit reports were often
inadequately measured and tracked. directed at the same processes and had the same
underlying causes. These could have been addressed
Fragmented efforts, manual processes, systematically, but individual projects did not have
mountains of data the budget to take that on. Only when the institution
We analyzed the time spent on remediation at took an enterprise-wide view did the case for IT
one global financial institution according to the investment become clear.
importance (materiality) of the issue. We found
that first- and second-line compliance staff were The status quo approach to compliance does not
spending 80 percent of this time on issues of low allow for an integrated view across the enterprise.
or moderate materiality, and only 20 percent on The approach to risk assessment is fragmented:
critical high-risk issues. The issues were approached some risks are covered by multiple assessments
individually, according to an issue log with and others not at all. Nor does a consistent

understanding of the material risks emerge, as 30 percent of the compliance functions capacity
the varying standards of materiality and testing (Exhibit 2). The size of the opportunity depends on
produce conflicting results across the organization. the starting point of the bank: leaner institutions
Compliance, activities relating to banking secrecy will benefit from effectiveness improvements, while
and anti-money laundering (BSA/AML), operational institutions with heavier quality-assurance, control,
risk, third-party risk, and other assessments are and audit structures will additionally benefit from
performed frequently by separate teams applying meaningful efficiency savings.
different approaches, and much effort is expended
in reconciling the outputs. At one large financial One global financial institution recently developed
institution, we found that business leadership a set of initiatives to free up 20 percent of capacity
teams are required to participate in 20 or more risk- in its risk and compliance functions. The starting
assessment activities annually, led by the various point was organizationally heavy: the two second-
control functions. Yet despite all this labor, top line functions accounted for one-third of corporate
management still cannot obtain a reliable view of the function expenses. The resource footprint was
institutions biggest compliance exposures nor on 95 percent concentrated in high-cost metropolitan
the state of controls governing them. areas with very competitive talent markets. At
the same time, effectiveness was inadequate, as
Many leading institutions have tried to shift evidenced by a growing backlog of regulatory issues
compliance frameworks toward a more risk- and audit findings. Risk-management standards,
based approach. They have struggled to escape an including taxonomies and tolerances, varied across
orientation to procedural adherence and refocus on and within lines of defense; shadow testing and
residual risk (outcomes). Metrics present another monitoring activities were being performed by
challenge. Rather than forward-looking measures business lines (the so-called one-and-a-half line of
of risk, many are ill defined and generate data with defense); and modeling, analytics, and reporting
unclear implications. As mountains of details pile up, activities were fragmented across the first and
critical exposures can get lost easily. Legacy controls second lines.
remain in use as new metrics are added. Many
intermediate controls and testing can be removed, The improvement program prioritized initiatives
however, as a recent efficiency effort at a banks that enhanced the effectiveness of compliance and
consumer business demonstrated. The needed risk-management activities and their efficiency,
solution (expanded sample-based quality-assurance to achieve a sustainable operating model to support
testing on executed affidavits) was simpler, less future growth. Better effectiveness was sought
time consuming, and more effective in disclosing by taking a proactive approach to help the business
material exposures. And it was less costly than the manage material risks. Rather than reacting to
existing haphazard system. issues, the bank would diagnose root causes and
translate regulations into operational requirements.
The value in sustainable compliance Effectiveness was further fostered through timely
The aim of a sustainable compliance program is and adequate transparency into the state of risks and
to improve the banks risk profile through a more controls, and increased confidence that no material
effective and efficient compliance function focused risk would be left unattended. The functions became
on the most important risks. The approach both more efficient through the automation of tasks and
centers on material risk and eliminates inefficient controls and easier access to qualified talent. The
activities. In our experience, it can free up to resource footprint was optimized, aligning it with

Risk 2017
Exhibit 2 of 3
Exhibit 2 A program for sustainable compliance can free up to 30% of the functions capacity,
improving the effectiveness of risk management.
Potential impact on total compliance capacity
4% 30%
6%
10%
7%
3%
Harmonize risk- Clarify Optimize Streamline key Implement Total impact

management responsibilities capacity and processes digitization and
standards and governance coverage model advanced
analytics
Impact on
effectiveness
High High Moderate High High

Consistent Correct testing- Broader talent Automation of Reports focused
language and coverage model pool controls and on factors that
taxonomies for material risks work flow will guide
across enterprise Concentration of management
End of duplicate skilled resources Standardized decisions
Single inventory testing of risks performing response to
of material risks and processes similar tasks material risk Standard data
assessments architecture (and
Clear roles and
BCBS 2391
responsibilities Better responsive-
compliance)
for all lines of ness to business
defense needs
1 Basel Committee on Banking Supervisions regulation number 239.
business and strategic needs. Resource allocation Building it: Seven steps to sustainable
could then focus on material risks, boosting staff compliance
productivity. Nonessential work was minimized, Compliance practitioners point out that compliance
including the remediation of low-materiality activities are triggered by regulatory requirements
risks. Testing, reporting, and other activities were and by how well businesses manage regulatory
rationalized across the three lines of defense; risks. Regulatory demands, they argue, are outside
duplication, especially in the control functions (such the control of the compliance function, while the
as remediation tracking and risk identification and adroit management of regulatory risks takes time
assessment), was largely eliminated. to mature. In our view, the key to sustainable

compliance is how well the compliance function privacyand then provide technical expertise as
responds to these demands. Below we lay out seven business lines translate those requirements into
practical steps that institutions can take to move operational procedures, practices, and controls.
closer to sustainable compliance. Compliance also needs to define requirements for
training and certification (including in general
1. Transform frontline units into a true first line areas such as product design and usage and fair
of defense. and nondiscriminatory treatment), and ensure
At many institutions, frontline units have that they are met by all relevant stakeholders. The
outsourced a significant portion of their execution of control, such as authorizing accounts
compliance responsibilities to the second line of or approving new products, should, however, be
defense, relying on the compliance function for embedded in the first-line processes. The second
everyday compliance-related business and control line will focus on independent approval and risk-
decisions. At other institutions, both lines of based testing to ensure that controls do indeed work
defense are involved in similar activities, leading as intended.
to duplication and fragmentation of effort. These
two faulty approaches are avoided when roles and As the second line, the compliance function defines
responsibilities are appropriately defined. There and monitors control standards; the complementary
is real value in having a strong first line of defense role for the first line is to manage those controls more
handling everyday business and in-line control strategically. Accordingly, the control office in each
activities. The role of the second line varies based business unit organizes how the front line manages
on the type of compliance requirements. Some its control environmentthe front line reviews the
regulations can be translated into a set of clear business setup against the controls in the context of
operational requirementsthis is called rules- the inherent risk profile and business complexity.
based compliance. Other regulations, such as When global banks streamline their business footprint
consumer protections, reflect regulatory intent for (for example, by offering products across markets
a desired outcome. This is called principles-based or the customer portfolio), the related business
compliance, which does not easily convert into processes and systems become essential in managing
specific operational and control requirements. the inherent risk profile.
For rules-based compliance, the second line needs 2. De-risk and reengineer business and
to define clear standards and shift in-line execution compliance processes.
and approval (such as consumer disclosures) to The demand for compliance resources can be
the first line of defense. For principles-based significantly reduced by reengineering labor-
compliance, some decisions (such as the suitability intensive activities for core compliance processes,
of marketing materials) need to be embedded in such as onboarding or transaction approvals. For
the first line with adequate training, certification, control breaches, root-cause analysis is critically
and monitoring. Conduct risk in retail banking, for important. This will ensure that the true underlying
example, will present challenges in defining first- drivers will be revealed for effective, lasting
and second-line roles and testing and monitoring remediation. Further similar breachesand the
responsibilities. The compliance function will consumption of further resources, such as the
need to clearly articulate regulatory requirements addition of more checkersare eliminated by the
for disclosures, adverse action, advertising, and automation and redesign of the exposure areas. An

additional important measure is the development of Nevertheless, the time spent on each compliance
consolidated risk-assessment requirements across demand must be differentiated according to the
control functions for key business decisions. This banks highest sensitivities and biggest risks in
way, duplicate functional controlssuch as legal, noncompliance. Time and resources, that is, should
BSA/AML, information security, and compliance be allocated to the risks that matter most. Usually
requirements for new clientscan be eliminated and at the top of the list are finance laws and customer
businesses freed from repetitive requests. and market conduct.
For one wealth-management company, automation Detailed adjustments can be made in the frequency
of know-your-customer (KYC) controls reduced the of testing and sample sizes, depending on the
turnaround time for the new-customer-onboarding level of inherent exposure in a given operational
process from five or six days for the most complex area. Moreover, testing and remediation activities
institutional accounts to 24 hours. The cost of can be risk-ranked and embedded in resource-
KYC was reduced by more than 70 percent and the and investment-allocation processes. Compliance
customer experience dramatically enhanced. These priorities can then be regularly reassessed to
savings of time and money were possible because account for new risks, defective controls, and
the institution tackled KYC requirements, along business or regulatory changes.
with credit-process digitization, as an integrated
reengineering and automation program. The Ongoing prioritization based on risk requires that
initiative was built on the understanding that the organizations objectively measure residual risk
end-to-end process is no faster than its weakest link exposures and know where in the business process
which is often the compliance requirements. controls can potentially fail. Understanding where
the critical breakpoints occur in business processes
3. Optimize the compliance operating model. and having a manageable set of quantitative,
The compliance resources needed to support the forward-looking metrics for each process breakpoint
business units can be configured most effectively are critical capabilities. For risks that are difficult
and efficiently by consolidating subject-matter to quantify (such as internal conduct or fair and
expertise and core activities in centers of excellence responsible banking), banks can develop qualitative
and utilities. This will help ensure that the best risk markers. Trends in staffing levels or changes in
expertise is applied across channels in business- business processes and technology often correlate
unit-facing compliance teams. Additionally, the with increased risk. Even if quantitative metrics that
opportunity in optimizing the location strategy for directly measure residual risk cannot be defined,
compliance is often sizable. A new look at location qualitative tracking of these trends can alert the
could lead to lower structural costs for compliance institution about potentially increased exposure.
and offer access to global talent markets to tackle With AML compliance, for example, some exposures
the challenges posed by talent scarcity in traditional can be measured through quantitative key risk
locations. A diversified geographic footprint also indicators, while others will require qualitative risk
ensures greater resilience in the face of adverse markers (Exhibit 3).
business or market events.
5. Actively manage controls and management-
4. Focus on what matters. information systems.
Compliance with laws, rules, and regulations The portfolio of controls needs to be actively
is viewed by banks as a zero-tolerance activity. managed over the life cycle of each control. Old

Risk 2017
Exhibit 3 of 3
Exhibit 3 The effectiveness of anti-money-laundering controls can be measured by quantitative

key risk indicators or qualitative risk markers.
KRI example Risk marker
Requirements Key risk indicators (KRIs) or risk markers Residual risk Test questions
Customer risk New customers not risk-rated appropriately or Medium Customer due-diligence
assessment in a timely manner requirements obtained
and risk appropriately rated?
High-risk customers not reviewed appropriately If high risk, was customer
or in timely manner added to high-risk log?
Report filing Customer-transaction reports (CTRs) High Was assessment of

money-laundering risk
Monetary-instrument logs completed in time?
Suspicious-activity reports (SARs)
Customer New customers not provided with CIP notice Low

identification at or before account opening
program (CIP)
New accounts with inadequate verification of
identity
Existing customers without timely, complete,

or correct due-diligence review
Employee Reporting forms (SARs, CTRs, CTR exemptions) Medium Risk marker indicates
incentives completed by the same employee who misaligned incentives due to
made the decision to file the reports or grant lack of segregation of duties
the exemptions
Volume of CTRs in relation to volume of

exemptions (did additional exemptions
significantly reduce CTR filings?)
Growth in higher-risk operations1 without Risk marker indicates

proportional increase in CTRs and SARs operations are outgrowing
capabilities of compliance
program (training, onboarding,
monitoring)
1 Higher-risk-customer examples: foreign financial institutions, deposit brokers, cash-intensive businesses, nongovernment organizations.
Higher-risk-product examples: ATMs, private banking, foreign-correspondent accounts, trade finance, foreign exchange.
Source: FDIC, BSA/AML Office of Foreign Assets Control regulation; Federal Financial Institutions Examination Council, BSA/AML
Examination Manual
controls, testing strategies, and management- helps ensure that material risks are not missed.
information systems (MIS) should be discontinued Many controls are redundant or obsoletesuch as
quickly when no longer needed or when deemed reports for a particular issue that no longer exists.
ineffective. Clearing away unneeded controls Others have been added to old processes where
saves compliance and business resources and underlying problems have not been remediated.

The result is layers of detective controls but few quality-control team and external attorneys. This
preventative controls. For many activities, controls triple-checking was replaced by quality tollgates
are overabundant and it is unclear which are the much earlier in the process and automated data pulls
key controls that truly make a difference. A bank that prevented errors. That eliminated most of
can have hundreds of mostly weak controls in its the rework and expensive back-and-forth communi-
trading chains without understanding that 20 are cations by attorneys, production, and the quality-
the most important (and should be perfected and control team.
tightly monitored to mitigate risk). Finally, controls
are often ineffective because they are insufficiently 6. Optimize testing and monitoring activities.
understood and consequently undermanaged (for Duplication and overlap should also be eliminated
example, supervisors may not understand their roles from testing and risk-assessment programs, including
and control responsibilities). BSA/AML, operational risk, IT risk, and first-
line-of-defense activities. Furthermore, monitoring
Markets businesses are a particularly challenging and testing standards need to be aligned with
area for managing controls. These involve many compliance standards in the first line of defense.
frontline and middle- and back-office units, as well These should be clearly tied to the inventory of
as risk and finance. We have encountered situations material risks, associated key risk indicators, risk
where more than 500 controls are in place, from markers, and MIS. These measures will provide
supervisory controls in the front office to extensive a clear line of sight to the risks the organization
reconciliation and reporting controls. A source of should focus on, what is being measured, and how
the challenge is the separation between units where the information will be used to make manage-
risks emerge and those in charge of the controls. ment decisions and prioritize resources.
For example, frontline conduct risk may arise from
ill-defined trader mandates or trade and booking Having eliminated overlap, banks can streamline
data structures, while control responsibility rests the remaining testing and monitoring activities. For
with middle- and back-office units. These units, like rules-based compliance, subjective assessments
compliance or control and settlement, might react can be replaced with objective measures of residual
by adding layers of control without identifying and riskactual defect rates for critical regulations.
addressing root causes upstream. Meanwhile, manual testing methods should, where
possible, be replaced with system-driven exception
By rationalizing the control portfolio, most banks reporting, such as timeliness and accuracy of
will be able to reduce monitoring and testing customer disclosures based on time stamps and
activities significantly. The remaining controls figures in the system of record. Advanced analytics
should then be automated, where this is possible can be deployed to analyze financial, operational,
(such as system checks or work flow). In-line quality and control performance and identify patterns and
controls, such as document-quality tollgates, can hot spots. This level of automation of manual tasks
replace manual checkers for controls that cannot be can provide an early warning of failing controls,
fully automated. obviating headaches down the road. For monitoring
and testing activities requiring manual intervention,
For example, according to a legacy requirement a testing utility can be created to standardize tests
of a consumer business unit at one bank, post- and improve load balancing. This will help ensure
underwriting quality control of all new loan that capacity is utilized efficiently and according to
applications was performed by both an internal target quality standards.

7. Effectively manage supervisory and audit issues. analysis should accompany such plans and help
At many banks, remediation of supervisory prioritize automation projects across the portfolio
and audit issues accounts for a large part of the of remediation activities. Many banks would also
compliance budget and the related change-the-bank benefit from comprehensive management reporting
budget. In most cases, banks handle supervisory to measure the cost and effectiveness of remediation
and audit issues individually. Each major finding activities and make the best possible use of subject-
results in a separate project, and little thought is matter experts and technology budgets to buy down
given to related control issues and root causes. In the risks.
our experience, the attendant costs of this approach
can be significantly reduced by moving to a more Effective remediation governancewith clear
integrated portfolio-management approach. responsibilities and effective implementation
monitoringcan also reduce complexity and lower
Projects need to be managed on two dimensions: the costs. This means clearly delineating responsibilities
underlying issues and the affected business areas. for all remediation activities among the compliance
Supervisory issues related to client onboarding in function, business lines, and other control functions.
the commercial-banking business unit, for example,
need to be consolidated to avoid duplicating
enhancements of core business processes. Effective
KYC management for global banks in fact requires a The cost of regulatory compliance in financial
centralized, cross-division view of customers and services has spiked over the past decade. In
their business activities. Without this view, suspect particular, resources in the first and second lines
activities could escape detection, or inconsistent of defense have expanded dramatically. As a result,
client onboarding approaches and decisions may the industry has become more resilient and the
result. To address related BSA/AML issues, further- quality of risk management has improved. The
more, banks will likely require a comprehensive current resource-intensive approach to managing
and integrated approach to control design, to avoid compliance is not, however, sustainable in the long
uncoordinated technology efforts. run. While the demand for compliance activities is
largely out of banks control, these seven practical
Supervisors rightly value an adequate focus on the steps can optimize how banks respond to that
root causes of issues. Banks that have this focus are demand and allow meaningful progress toward a
able to design changes to core business processes sustainable compliance function over time.
that stop issues from arising in the first place. When
issues are addressed individually, the solution is Piotr Kaminski is a senior partner in McKinseys New
often to put in place additional layers of manual York office, Daniel Mikkelsen is a senior partner in
controls. Root-cause analysis helps an institution the London office, Thomas Poppensieker is a senior
become more resilient in its business environment partner in the Munich office, and Kate Robu is a partner
while reducing reliance on costly manual controls. in the Chicago office.
Where manual controls are still required to plug Copyright 2017 McKinsey & Company.
an existing gap, banks need to develop plans to All rights reserved.
automate them and/or redesign the underlying
business process. Appropriate cost-benefit

Mint Images/Getty Images
Nonfinancial risk today:

Getting risk and the business aligned
Both must be deeply involved to avoid costly errors.
Joseba Eceiza, Piotr Kaminski, and Thomas Poppensieker
Ask senior managers at any company if they have evidence that appropriate controls are in place.
nonfinancial risk under control, and the answer is They are usually not embedded in the business
likely to be yes. But as managers of companies in but are instead delegated to risk and compliance
automotive, banking, oil and gas, pharmaceuticals, departments, which have a limited understanding
and many other sectors can attest, the reality is of how to manage risk and compliance within the
often very different. And as personal liability for business context.
corporate actions takes hold, board membersboth
executive and nonexecutiveare on the hook not In other cases, the business takes all the responsibility
just for their personal involvement in risk- and for managing risk, but without any link to the com-
compliance-related issues but also more broadly panys formal compliance, risk, and control frame-
for the companys whole risk profile and enterprise- work. Quality control, for example, is embedded in
wide compliance. the day-to-day management of manufacturing organi-
zations, but those responsible are not involved in
Nonfinancial risk1 has typically been addressed determining enterprise risk, leaving a major gap.
by one-off showcase initiatives based on a specific
regulation or requirement, and left to experts in Both shortfalls have led companies from all sectors
each field. What principles exist typically focus to be caught off guard when failures occur. And
on adhering to formal standards and providing those failures have led to catastrophic incidents

and destroyed shareholder value time and again. Key objectives of a well-founded framework
Over the past 15 years, companies around the Risk managers may argue that the basic principles
world have ended up in dire predicaments through of R&CM are well established, and indeed enshrined,
such control failures. In all these cases, the formal in industry standards. The concepts may be broadly
risk-management approach has been criticized for known, but they are applied in such a scattered
being insufficient. In concrete terms, litigation and fashion that they are not fit for purpose. A board that
settlement of nonfinancial risk-control failures have wants to get on top of nonfinancial risk management
cost the financial-services and corporate sectors needs to have three clear objectives:
several hundred billion dollars over the past ten
yearsand that does not include the additional It must facilitate better decision making.
impact of reputational damage. A robust R&CM framework should help
management better understand the companys
The impact on management has been just as risk profile so that it can make informed
significant, including damaged reputations and decisions, such as where to accept risk and
personal prosecution, not only where senior where to mitigate it in the context of overall
management has been directly linked to wrongdoing risk appetite and risk strategy. The framework
but also where it was found not to have established needs to help businesses prioritize the risks and
a robust approach to risk and control management.2 controls to address, based on their likelihood
As this article will explain, there is a better wayone and potential impact on the business. It should
that needs to be adopted before a major incident form the basis for continuous risk management
occurs, and not after. through a business view on value chains,
processes, and embedded risks and controls.
Risk matters, but not in isolation
Leading companies have established frameworks It must provide evidence for internal and
for risk and control management (R&CM) that external stakeholders of the adequacy of the
help management balance the risk-management controls that are in place (or that should be
imperatives and the needs of the businessin other implemented), and it should clarify who is
words, an approach to risk that accurately reflects responsible for what regarding risk ownership
the business context, while ensuring that risk and and control execution. This gives senior
compliance management is embedded across management a way to assess the effectiveness
the entire organization. This means going beyond of the organization, delegate responsibilities,
implementing yet another checklist or improving and address legal implications.
the links between business units. It requires an
explicit management dialogue about nonfinancial It must reinforce an adequate risk and
riskabout where it can occur and how it is being compliance culture that should be as deeply
mitigatedand extends to questioning where embedded into a companys management
the cost of control may be too high, given the value approach as revenue and cost management.
at stake. For many companies, this implies a full
cultural transformation, so that a new set of risk- The resourcing and costs of the R&CM approach
management processes can be as effective as should be aligned with the companys structure,
possible. Until that changes, the same mistakes will business model, and risk profile. For example, an
be repeated year after year, and companies will oil and gas company might choose to focus on
be at risk as the threat to their value is overlooked. regulatory and counterparty risks in markets where
it operates, while financial firms might target
Nonfinancial risk today: Getting risk and the business aligned 13

product mis-selling. The approach should also resources are focused where they will have the
provide guidance on the efficiency of the control greatest impact and that duplicative controls are
environment as much as its effectiveness, by showing, removed. In automotive, for instance, quality control
for instance, the gap between the inherent risk and is vital in production processes, but not all processes
the residual risk after the control is implemented. are equally important; therefore, it is important to
invest in controls where both the likelihood of a risk
The business case for R&CM event and the resulting impact are highest.
Assessing, managing, and mitigating risk must
be justifiable on business grounds. Running an Aside from cherry-picking the most critical controls,
effective and efficient R&CM, in our experience, an R&CM framework that has a unified and aggregated
can deliver a payoff of more than ten times the risk-assessment system immediately makes the
investment. There is no doubt that implementing control function more efficient and cost effective.
R&CM is beneficial for companies across all This is essential when 5 percent of the workforce can
industries. It can help reduce losses and the cost be employed in control-related activities.
of control, which together should more than offset
the up-front investment needed to set up the Identifying key risks also helps ensure the right
methodology and the recurring costs of maintaining insurance policies are in place. In addition, those
it. And regulators approve, too. policies should be more efficient and cheaper,
because risk identification is more targeted and
Cut your losses because it becomes clear how specific controls help
Organizations typically experience five types of mitigate risk.
losses from nonfinancial risk: recurring low-severity
losses (such as credit-card fraud); one-off, high- Keep setup costs low
severity losses (for instance, senior-management Setting up an R&CM framework is typically a
wrongdoing); regulatory fines; the imposition multiyear effort, but strong management focus
of greater capital requirements for banks; and will ensure maximum effectiveness and efficiency.
reputational damage (where examples are legion). Furthermore, consolidating different control
frameworks can deliver significant synergies
A sound R&CM framework helps to reduce these from aligned management processes, system
losses by ensuring the right controls are in place. For consolidation, and integrated reporting. Most
example, a company might develop a coordinated important, setting up a robust R&CM framework
plan with its telecom providers to prevent and permits a sharper focus on identifying and
counter distributed denial-of-service attacks, or take mitigating risk, through an objective fact base and
out insurance against cyberattacks. Preventing or clearer policy standards. If set up properly, it also
reducing the impact of risk also reduces remediation provides all the evidence required for the formal
costssuch as the cost of reviewing thousands of reporting to the risk or audit committees under
files or of setting up call centers to handle customer COSO, ICS, ERM, or CMS standards.3
complaints. R&CM also helps reduce regulatory fines
and can help smooth the conversation with supervisors. The regulatory benefits
A strong R&CM approach not only makes good
Spend less on mitigation business senseits also becoming more of a legal
At the heart of a strong R&CM framework is the requirement. Several international regulators
prioritizing of risks and controls. This means that are pushing for clearer definitions of, and better

connections among, the first line of defense (the Clear risk definitions need to be shared across the
business), the second line (the risk and compliance company in order to identify which risks to actively
functions), and the third line (internal audit). manage and monitor.
This three-lines-of-defense model is increasingly
used as a way of explaining the relationship Exactly the same problem applies to controls. For
among these functions and as a guide to how example, identity control and access-management
responsibilities should be divided. control might mean the same thing in the same
company, but if that is not recognized, then their
How to get it right relevance could be underestimated.
The key components of a best-practice R&CM
approach revolve around unified taxonomies, The challenge is to ensure that the taxonomy is at the
assessment tools, data and reporting toolsand right level of granularity to help identify risk, but not
ultimately the process that ensures the framework so granular that it becomes unwieldy.
becomes part of the whole companys day-to-day life.
Map the risk
Get everyone talking the same language Once everyone is using the same language, the
Very few companies have a truly unified way of company can then identify where material risk for
talking about risk or controls. Comparable risks the organization exists.
may never be recognized as such, simply because
they are described differently by different parts of A groupwide process map that represents the
the business. This can be as simple as, for example, companys business model is a good starting point.
identifying employee behavior and employee Companies often struggle to find the right level of
conduct as identical, when, in fact, the two are never granularity in process maps: too high a level (for
linkedand thus the total risk level is misreported. example, eight or nine processes for the entire

institution), and the maps are of limited value; too management decision making within the business
granular (for instance, more than 100,000 processes and instead only serves as a way for compliance
at one European bank), and the effort required or risk functions to document the weaknesses that
to create and maintain them is too burdensome. it identifies.
Mapping at the value-chain level is typically a good
way to begin, and then, over time, the exercise can Leading players, therefore, undertake a fact-based
become more granular. control assessment: they find out which controls
are used to mitigate which specific risks, determine
At an automotive manufacturer, for example, how effective and efficient they are, and link them
the first step was to identify and define specific to the policies and operating procedures that clarify
compliance requirements by country (such as control standards, accountabilities, and training
emissions, certification, and safety) and to understand and communication that ensures the organization is
their importance for car models across their life fully aware of the risks. The assessment should draw
cycle. These were then mapped into the companys on multiple sources of data, such as internal and
processes (from R&D to manufacturing), taking into external loss and incident data, audit-review results,
account the complex structure of the supply chain, supervisory findings, key risk indicators, and key
which involved dozens of nodes and locations. control indicators.
Using the map and the risk taxonomy, therefore, a Report backand act
business can profile the risk in each process and To make sense of the assessments, management
assess both the probability and severity. This must have a consistent view of nonfinancial risks
information is aggregated from the R&CM unit level and the underlying controls, with systematic
to the enterprise level. reporting to the board. This requires an integrated
management-information system. Typically,
Understand the controls these are bespoke versions of externally available
Knowing which risks exist is only half the equation. packages that broadly match the companys specific
The other half is knowing how to mitigate them. R&CM requirements, or internally developed
Organizations struggle to tie controls to risks for platforms. When selecting commercial packages,
many reasons, which range from unclear definitions companies must be careful not to tailor them to a point
of controls to a limited understanding of how where system upgrades become difficult to manage.
effective the controls actually are. This means that
the business reviews hundreds of controls. But Where identified risks fall outside the companys
without a clear view on which are the most relevant risk appetite, concise and action-oriented risk and
and effective, no clear management perspective on control reporting recommends where, how, and
the overall control strategy will be developed. To when the risk is mitigated. The actions might range
take an extreme example, in a nuclear-power plant, from redesigning the entire control environment
controls that monitor the performance of the core to reinforcing supervisory responsibilities, or even
should have a much higher priority than controls removing the product or process that is creating the
that focus on avoiding outages on steam turbines risk. Ultimately, the reporting, based on the risk and
through preventative maintenance. Both matter, but control assessments, should enable the company
not to the same extent. to prioritize controls, based on specific context. Of
course, any change to a control must happen within
If an organization assembles only a list of controls, the organizations existing control framework in
with no hierarchy, then that list is useless for order to retain clear accountability.

Run the process company-wide ... and keep running it As senior managements personal liability for
As we saw at the start, the R&CM framework must corporate risk increases, the traditional way of
be applied across the entire company, otherwise tackling nonfinancial risk management could
individual units, functions, or people can leave many facing uncomfortable times in front of
inadvertently create enormous risk. The process their boards, their regulators, and quite possibly
also needs to be aligned with both the companys their courts. A new framework for risk and control
management and accountability structure and its management is neededone that is cost effective
fundamental business processes and value chains. and explicitly ties risk to business value, and one
This way it can identify individual risk by area as that helps management have a fruitful conversation
well as control dependencies across the value chains with stakeholders.
(which extends to outsourcing arrangements via
third parties). The risk and control management approach outlined
here achieves this. By bringing the business into the risk-
Business units are prone to receiving overlapping management discussion, corporate risk changes from
requests to assess the risk of particular processes a topic that someone else worries about to being a key-
and assets from different risk-management groups stone of every employees role in the organization.
(for example, cyber risk, or operational risk). By
coordinating and sharing information, the oper-
1 For the purposes of this article, nonfinancial risk is broadly
ational impact of participating in the R&CM
defined as all risk that is not balance sheet related (for example,
processes is reduced, which leads to higher-quality excluding credit, foreign-exchange, commodity-price, and
risk information. Nevertheless, organizations can liquidity risk). Nonfinancial risk comprises compliance risk (for
end up running hundreds of workshops each year instance, the requirement to adhere to all relevant rules and
regulations) and operational risk (such as process, production,
as they attempt to identify risk and controls, and
technology, and cyber risk).
therefore clearly defined process and expectations 2 This is reflected by the business judgement rule, which
for business units and control functions are crucial. requires company management to establish processes
Careful planning of R&CM entities and identifying regarding risk and compliance that are in line with industry
practices for a business model of this complexity.
those with similar profiles (such as all sales or 3 COSO: Committee of Sponsoring Organizations of the
production units) becomes paramount. Treadway Commission; ICS: frameworks for the internal control
system; ERM: enterprise risk management; CMS: compliance-
An annual risk-assessment exercise will never be management system.
sufficient; whats needed are both trigger-based

assessments when incidents occur, when certain Joseba Eceiza is a partner in McKinseys Madrid office,
indicators breach thresholds or processes change, Piotr Kaminski is a senior partner in the New York
and ongoing monitoring. The model needs to be office, and Thomas Poppensieker is a senior partner in
the Munich office.
particularly strong given the interaction between
the business-division risk owners who identify and
Copyright 2017 McKinsey & Company.
assess the risks (the first line of defense) and the
All rights reserved.
control functions that challenge the results (the
second line of defense).

Hoxton/Tom Merton/Getty Images
Protecting your critical digital

assets: Not all systems and data are
created equal
Top management must lead an enterprise-wide effort to find and protect critically important data, software,
and systems as part of an integrated strategy to achieve digital resilience.
Piotr Kaminski, Chris Rezek, Wolf Richter, and Marc Sorel
The idea that some assets are extraordinaryof the perimeter of business operations and are applied
critical importance to a companymust be at the disjointedly across different parts of the organization.
heart of an effective strategy to protect against
cyber threats. Because in an increasingly digitized Our research and experience suggest that the next
world, protecting everything equally is not an option. wave of innovationcustomer applications, business
The digital business model is, however, entirely processes, technology structures, and cybersecurity
dependent on trust. If the customer interface is not defensesmust be based on a business and technical
secure, the risk can become existential. System approach that prioritizes the protection of critical
breaches great and small have more than doubled information assets. We call the approach digital
in the past five years, and the attacks have grown resilience, a cross-functional strategy that identifies
in sophistication and complexity. Most large and assesses all vulnerabilities, defines goals on an
enterprises now recognize the severity of the issue enterprise-wide basis, and works out how best to
but still treat it as a technical and control problem deliver them. A primary dimension of digital resilience
even while acknowledging that their defenses will is the identification and protection of the organi-
not likely keep pace with future attacks. These zations digital crown jewelsthe data, systems, and
defenses, furthermore, are often designed to protect software applications that are essential to operations.

Burgeoning vulnerabilities, finite resources, seized control of its systems. An aerospace-systems
fragmented priorities manufacturer, on the other hand, needs to protect
In determining the priority assets to protect, intellectual property first and foremost, from
organizations will confront external and internal systems designs to process methodologies. A financial-
challenges. Businesses, IT groups, and risk functions services company requires few controls for its
often have conflicting agendas and unclear working marketing materials but is vulnerable to fraudulent
relationships. As a result, many organizations transactions; its M&A database, furthermore, will
attempt to apply the same cyber-risk controls every- need the best protection money can buy. Attackers
where and equally, often wasting time and money can be individuals or organizations, such as
but in some places not spending enough. Others apply criminal syndicates or governments with significant
sectional protections that leave some vital information resources at their command. The attacks can be
assets vulnerable while focusing too closely on less simple or sophisticated, the objectives varying from
critical ones. Cybersecurity budgets, meanwhile, immediate financial reward to competitive or even
compete for limited funds with technology investments geopolitical advantage.
intended to make the organization more competitive.
The new tech investments, furthermore, can bring Cybersecurity spending: When more is less
additional vulnerabilities. In the face of such diverse threats, companies often
decide to spend more on cybersecurity, but they are
The work to prioritize assets and risks, evaluate not sure how they should go about it.
controls, and develop remediation plans can be a
tedious, labor-intensive affair. Specialists must A global financial-services company left
review thousands of risks and controls and then cybersecurity investments mainly to the
make ratings based on individual judgment. Some discretion of the chief information-security
organizations mistakenly approach this work as officer (CISO), within certain budget
a compliance exercise rather than a crucial business constraints. The security team was isolated
process. Without prioritization, however, the from business leaders, and resulting controls
organization will struggle to deploy resources effec- were not focused on the information that the
tively to reduce information-security risk. Dangers, business felt was most important to protect.
meanwhile, will mount, and boards of directors will
be unable to evaluate the security of the enterprise A healthcare provider made patient data its only
or whether the additional investment is paying off. priority. Other areas were neglected, such as
confidential financial data relevant to big-dollar
All data and systems are not created equal negotiations and protections against other risks
In any given enterprise, some of the data, systems, such as alterations to internal data.
and applications are more critical than others. Some
are more exposed to risk, and some are more likely to A global mining concern focused on protecting
be targeted. Critical assets and sensitivity levels also its production and exploration data but failed to
vary widely across sectors. For hospital systems, for separate proprietary information from infor-
example, the most sensitive asset is typically patient mation that could be reconstructed from public
information; other data such as how the emergency sources. Thus, broadly available information
room is functioning may even be publically available. was being protected using resources that could
Risks to priority data include breach, theft, and even have been shifted to high-value data like internal
ransomrecall that a Los Angeles hospital paid a communications on business negotiations.
$17,000 Bitcoin ransom to a hacker that had
Protecting your critical digital assets: Not all systems and data are created equal 19
These examples illustrate the need for a unified, the business and its value chain. The CISOs
enterprise-wide approach to cyber risk, involving team, particularly when it is part of the IT
the business and the risk, IT, and cybersecurity organization, tends to begin with a list of
groups. The leaders of these groups must begin applications, systems, and databases, and
to work together, identifying and protecting the then develop a view of risks. There are two
organizations critical digital assets as a priority. major flaws to this approach. First, it often
The process of addressing cyber risk will also have misses key risks because these can emerge
to become technologically enabled, through the as systems work in combination. Second, the
implementation of work-flow-management systems. context is too technical to engage the business
Cybersecurity investment must be a key part of the in decision making on changes and investments.
business budget cycle, and investment decisions By beginning with the business, the team
must be more evidence based and sensitive to changes. encourages stakeholder engagement naturally,
increasing the likelihood that systemic
The business-back, enterprise-wide approach exposures will be identified.
The key point is to start with the business problem,
which requires a consideration of the whole The CISO must actively lead. In addition to
enterprise, and then to prioritize critical risks. This being a facilitator for the businesss point of
work should be conducted by an enterprise-wide view, the CISO should bring his or her own view
team composed of key individuals from the business, of the companys most important assets and
including those in product development, and the risks. By actively engaging the business leaders
cybersecurity, IT, and risk functions. The teams and other stakeholders as full thought partners,
main tasks are to determine which information the CISO will help establish the important
assets are priorities for protection, how likely it is relationships for fully informed decision making
that they will be attacked, and how to protect them. on investments and resource allocation. The
To function, the team must successfully engage role of the CISO may thus change dramatically,
the leaders of several domains. They need to work and the role description and skill profile should
together to discover what is most importantno be adjusted accordingly.
mean challenge in itself. The best way to get started
is to found the team on the agreement that cyber risks Focus on how an information asset can be
will be determined and prioritized on an enterprise- compromised. If an information asset is
wide business back basis. In other words, the team exposed by a system being breached, the
will first of all serve the enterprise. Critical risks, vulnerability of this system should be
including the impact of various threats and the likeli- considered, even if the systems primary
hood of occurrence, will be evaluated according to purpose does not relate to this information asset.
the dangers they pose to the business as a whole.
Focus on prioritization, not perfect
Guiding principles quantification. The team needs only enough
The following principles can help keep companies information to make decisions on priority
on track as they take the unified approach to assets. It does not need highly precise risk
prioritizing digital assets and risk: quantificationsthese would be difficult to
produce and would not make a difference in
Start with the business and its value chain. deciding between investment options.
The effort should be grounded in a view of

Go deeper where needed. The same level of 1. Identify and map digital assets, including data,
analysis is not needed to quantify all risks. systems, and applications, across the business
Only for particularly high-impact or complex value chain. This can be accelerated by applying
risks should the team invest in deeper analyses. a generalized-sector value chain and a common
It should then decide on and acquire the taxonomy for information assets and then
information needed to make more informed customizing these to the organization.
investment decisions.
2. Assess risks for each asset, using surveys and
Take the attackers view. Risk reviews and executive workshops. By basing this analysis
vulnerability analyses must not focus solely on the business importance of the asset, the
on the value of the information to the company organization will have identified its crown jewels.
and the ascertainable gaps in its defenses.
The profiles of potential attackers are also 3. Identify potential attackers, the availability of
important: Who wants the organizations assets to users, and current controls and security
information? What skills do they possess? measures protecting the systems through which
Thinking about likely attackers can help identify access can be gained to the assets, using similar
new gaps and direct investment to protect surveys and workshops as in step two.
the information that is most valuable to the
most capable foes. 4. Locate where security is weakest around
crown-jewel assets and identify the controls that
A flexible systematic process with a should be in place to protect them, by comparing
designed platform the results of these assessments using dashboards.
The object of the enterprise-wide approach is to
identify and remediate gaps in existing control 5. Create a set of initiatives to address the high-
and security systems affecting critical assets. The priority risks and control gaps. Implementation
solution, in our experience, will be an end-to-end will involve a multiyear plan, including
process, likely requiring multiple development timelines for follow-up reviews. Once the initial
iterations, including a detailed account of hundreds assessment is complete, this plan becomes a
of assets. A work-flow system and asset database living document, regularly refreshed to reflect
would be an ideal tool for supporting this complex new data, systems, applications, risks, and mapping,
process, allowing focus on prioritizing risks. A as well as progress to remediate known vulner-
flexible, scalable, and secure online application abilities (see sidebar, An institutions progress).
can be easy to use while managing all the inventory
and mapping data, the rigorous risk and control The process promotes cyber-risk transparency,
evaluations, sector-specific methodologies, and answering key stakeholder questions: What are
rationales for each risk level. The platform can also our inherent information risks? Where is our
support detailed data to be used when needed as organization vulnerable? How big (and where) is the
the team undertakes analysis of the priority assets residual exposure? What remediation actions should
and gaps and makes the recommendations that will we prioritize? How do we know if what we did is
shape remediation initiatives. working? Information-risk trade-offs can be defined
based on a perspective on value at risk across the
In developing this approach, consider the following company. This helps the C-suite and board discuss
five key steps: information-security risk using measures such as
Protecting your critical digital assets: Not all systems and data are created equal 21
An institutions progress
One financial institution that used the approach team was now able to identify the critical information
described in this article was able to identify and assets based on potential risk impact. The level of
remediate gaps in its control and security systems control in each system was also evaluated, as the
affecting critical assets. The change program began team mapped information assets to the systems and
with a risk assessment that highlighted several applications where they reside and isolated gaps
issues. Business and IT priorities on cybersecurity between current and needed controls.
spending were found to be somewhat out of
alignment, while communication on risks and risk The critical data assets requiring additional
appetite between risk management and businesses protection were identified globally and by business
was less than optimal. The lack of agreement among unit. The systems and applications holding critical
stakeholder groups consequently stalled progress on data that needed remediation could then be
a mitigation plan for cyber risk. addressed. The team developed a series of detailed
scenarios to reveal system vulnerabilities and help
In response, the company established a unified stakeholders understand what could happen in a
group that developed a work plan to protect breach. A comprehensive set of prioritized initiatives
critical data. The team inventoried all systems and and a multiyear implementation plan was then created.
applications in all business units, validating the results The data resulting from this process are continually
with key stakeholders to ensure completeness. They updated and provide guidance in budgeting decisions
then identified critical data and performed a risk and board reviews on an ongoing basis.
assessment with input from the stakeholders. The
enterprise value, providing transparency on what They face the tough task of fully protecting their
risks they are willing to accept and why. most important assets while not stifling business
innovation. To achieve this balance, the business, IT,
Results inform budget and investment decisions, risk, and other functions will have to work together
helping to satisfy both regulatory and shareholder toward the same enterprise-wide endto secure
expectations. With investments targeted to best the crown jewels so that senior leaders can
protect the most sensitive digital assets, costs are confidently focus on innovation and growth.
held down as the digital resilience of the organi-
zation is elevated. To build digital resilience into Piotr Kaminski is a senior partner in McKinseys New
their operations, furthermore, the process can York office, Chris Rezek is a senior expert in the Boston
help organizations create periodic assessments office, Wolf Richter is a partner in the Berlin office, and
to highlight trends and new gaps. Risk managers Marc Sorel is a consultant in the Washington, DC, office.
can then develop new initiatives prioritized to the
enterprises global needs. The authors wish to thank Oliver Bevan and Rich Cracknell
for their contributions to this article.

Organizations in sectors with higher digital maturity
will benefit the most from this approach, including
financial services, manufacturing, and healthcare.

Danita Delimont/Getty Images
From scenario planning to

stress testing: The next step for
energy companies
Utilities and oil and gas firms have long used scenario analysis, but extraordinary times call for new measures.
Sven Heiligtag, Susanne Maurenbrecher, and Niklas Niemann
Strategic and financial scenario analysis has a long, most resemble their current experience. Extreme
venerable history at energy companies. Shell Oil scenarios are deemed a waste of time because they
popularized the technique in the 1970s, and almost wont happen or, if they do, all bets are off. But this
all of them have adopted it as a vital part of their approach leaves companies dangerously exposed to
decision-making processes. But as executives know dramatic changes.
well, scenario planning has its pitfalls; 40 percent
of the leaders we surveyed in 2013 said that it didnt Consider the shocks and disruptions of recent
meet their expectations. Often, companies fall prey years. The 2010 Deepwater Horizon disaster had
to one of several tendencies, such as availability or far-reaching effects on the oil companies involved,
stability bias, that hinder the exercise and produce and many others. The 2011 Fukushima earthquake
unusable results. and tsunami upended nuclear policy in Japan
and elsewhere, changing the industrys structure.
Energy companies are finding that in todays Geopolitical shocks have upset the plans of energy
volatile world, one flaw of scenario planning is companies in too many countries to name. Most
particularly acute: when business leaders consider recently, the rise of antiglobalization sentiment has
a range of scenarios, they tend to chop the tails thrown a new wrench into energy planning.
off the distribution and zero in on those that
From scenario planning to stress testing: The next step for energy companies 23
Its hard to overstate the consequences of events like consider some previously overlooked sources of
these. Take the German experience of Energiewende, stress, the potential magnitude of their impact, and
the nations transition to sustainable energy. To the adequacy of the companys risk-bearing capacity
predict the effects on electricity prices, most energy to absorb them. Stress testing should be only one
companies relied on the classic scenariosa base element of a risk-management system, but done well,
case, with best and worst cases that skewed slightly it can be a tool to build the resilience that todays
to either side. However, the Fukushima disaster environment requires.
vastly accelerated the switch to renewables. The
price of power tanked by more than 50 percentfar What extreme means
worse than the gloomiest projections (Exhibit 1). The Companies need to be bold as they imagine
effect has been devastating: power producers had to extreme scenarios; almost nothing is too strange or
write off tens of billions of euros. ridiculous to consider. To show the range of ideas
that energy firms might contemplate, we offer five
Enter stress testing extreme scenarios covering several kinds of risk,
At most companies, scenario analysis looks for the from compliance and legal risk to business-model
likely development of core risk factors over time. disruption to full-bore crisis.
That approach can work well in an era of gradual
change. But at times like the present, it is extreme Energy for free
risks, not the everyday ones, that should most Real-time energy-consumption data are increasingly
concern energy companies. Likewise, it is the prospect seen as crucial for a knowledge of customers and
of chaotic overnight change, not gradual shifts, that their behavior patterns. Smart meters can identify
should keep energy executives awake at night. the appliances in operation. Combining data sets
on electricity use, heating use, and mobility could
Enter stress testing, a form of scenario planning provide even more detailed insights. Data-driven
focused on the tails of the distribution. Scenario companies such as Amazon might challenge
planning and stress testing are methodologically incumbent utilities by offering energy for free in
identical; they differ only in the likelihood of the exchange for personal data. In this scenario, utilities
scenarios they consider. Stress testing therefore lose the customer relationship and are reduced to
requires a shift in mind-sets. In todays environment, mere suppliers of commoditized power. Given the
the sum of low-probability events quickly adds up negotiating power, agility, and customer-centricity
to a high probability that one of them will actually of digital giants, margins erode significantly.
happen. The banking industry offers an example:
the financial system has become so volatile, and A decentralized energy landscape
subject to so many unexpected disruptions, that New entrants focus on serving customers in a
regulators now require banks to conduct compre- completely decentralized energy regime, bundling
hensive stress tests. solar photovoltaic rooftop systems with power-
to-heat technologies, powerful batteries, and
Lets be clear: stress testing will not prevent stress. electric cars. An integrated solution and a strong,
Nor can it identify, with total confidence, precisely emotionally compelling brand (such as Teslas)
which stressful scenarios might play out in the help these attackers to reduce residual demand
futureespecially those that feature unknown for grid-based power substantially and to capture
unknowns. But it can help senior executives to the customer relationship. As in the first scenario,

Risk 2017
Stress Testing
Exhibit 1 of 2
Exhibit 1 German power prices far underperformed even the low-price scenario.
German wholesale power prices, 200815,

/MWh
90
87 High-price scenario
80
75 Business-as-usual
70 scenario
60
50 51 Low-price scenario
40
30
22 Actual price
20
10
2008 2009 2010 2011 2012 2013 2014 2015 2016 Energiewende
targets for share of
Fukushima, 26% 30% 32% power produced by
March 2011 renewable sources
Source: BBC; European Energy Exchange; Umweltbundesamt; McKinsey analysis
utilities are reduced to suppliers of commodity organization: top leaders knew that analyses and
power, infrastructure operators, and backup impact assessments had intentionally been skewed.
providers. Volumes and margins shrink quickly in As a result, all energy companies suffer a loss of
the wholesale and retail businesses, and generation public and political trust. They are then subjected to
assets lose value rapidly. intense scrutiny of their assets and processes, and
this leads to increased regulation, massive penalties,
An emissions fraud and personal liability in the form of substantial fines
A data leak reveals that a power company and imprisonment.
has manipulated processes affecting human
healthsay, flue-gas purification at a coal plant A cyberattack on critical infrastructure
or the handling and disposal of wasteand has Popular movies have frequently exploited the idea
thus emitted substantially more pollution than that the infrastructure of modern life is vulnerable
allowed. Subsequent investigation shows that the to well-staged cyberattacks. But the real-world
manipulation was deeply anchored within the Stuxnet virus succeeded better than anything out
of Hollywood in proving that power plants and the profits and losses, balance sheet, and cash
other nuclear assets can indeed be sabotaged. A flow of a hypothetical utility for each of several
cyberattack that takes critical infrastructure offline business segments: generation, renewables, trading,
is more probable than ever now that power and distribution, and retail. After modeling the effects of
gas grids, street lighting, and traffic control are a scenario separately for each business, we combined
more and more connected; the Internet of Things them to show the effect on the enterprise. To be clear
is beginning to reach into every home and building; on the overall effects, you must understand, in detail,
and autonomous, connected vehicles are set to that the scenarios have specific impacts on different
emerge over the next few years. In such a scenario, business units.
terrorists hack into the distribution network and
shut down national power systems or even make Exhibit 2 offers a heat map of these effects, highlighting
key assets malfunction or self-destruct. Public trust the areas of greatest impact. For example, it shows
would disappear, and energy companies would be that the energy-for-free and decentralized-energy-
subject to enormous pressure from regulators. Those landscape scenarios would of course have a direct
deemed vulnerable to further attacks might even and massive impact on revenues, leading to a
lose their operating licenses. substantial loss of equity and an increase in net
debt. On the other hand, an emissions fraud
Radical price transparency or cyberattack would have almost no relevance for
Price-comparison websites, such as Verivox in revenuesbut equity would suffer substantially.
Germany, have established a strong position in
several European countries. They greatly increase This exhibit also highlights the key drivers of these
price transparency in retail markets for power, gas, effects: for example, in the energy-for-free scenario,
mobile telecommunications, banking, auto rentals, B2C volumes and market share would decline
and broadband, so retail customers change suppliers sharply, and retail prices would fall by 5 percent.
more frequently. In a transparency scenario, price- In an emissions-fraud scenario, operating and
comparison portals help customers to change their maintenance costs would soar by 50 percent, and
electricity and gas providers regularlyfor example, utilities would pay regulatory penalties of up to
by acting as energy agents or through an automated 5 percent of revenues. If a cyberattack should take
process that selects the cheapest offer at the end of a down a national grid, affected utilities would have to
contract. Verivox recently announced the first steps write off 5 percent of their physical assets; to replace
in such a process. them, they would boost their budgets for property,
plant, and equipment by 7.5 percent. Earnings would
With such rapid churn, utilities may lose many crash, though the effect would be milder after taxes
customerseven some who have never indicated and depreciation.
any desire to change their suppliers. Once again,
companies might be reduced to providers of The financial implications would be considerable
commoditized electricity. Retail margins would across the scenarios, though none would necessarily
wilt in the face of the negotiating power, agility, and bankrupt a company. Significant profit and
customer-centricity of energy agents. liquidity risks appear, especially in the generation
and retail businesses. In the absence of successful
Assess the stress countermeasures, all five scenarios lead to
To understand the potential impact of these five negative recurring earnings before interest and
extreme scenarios, we modeled their effects on taxes, revealing major risks for the sustainability

of the current business portfolio. Furthermore, the Better preparation, such as stronger analytics
scenarios suggest a 10 to 60 percent drop in equity and more transparent reporting, can help identify
and a 5 to 40 percent increase in net debtwhich problems such as legal fraud or cyber vulnerabilities
might trigger liquidity concerns. and help companies negotiate with regulators. The
Risk 2017 German government, for example, asked utilities
Get ready
Stress to improve resilience
Testing to stress test their balance sheets and cash flows
Of course,
Exhibit 2 utilities
of 2 can forestall or mitigate many of for a planned change in the disposal and storage
the effects of stress. Hedging and insurance offer of nuclear waste. As a result of the tests, the
some protection. Establishing a crisis-response government took responsibility for these activities.
team is a no-regrets move for most companies.
Exhibit 2 Stress tests show the material impact of a scenario.
Impact <5% Impact <15% Impact >15%
Effects of extreme scenarios on finances of hypothetical utility Key scenario drivers
Capital
Revenue EBITDA1 EBIT2 expenditures Equity Net debt
Revenue set at 100; all other financial

Current 100 13 2 6 18 34 indicators indexed to revenue
Total volume/market share decrease

Energy in B2C segment by 2575%
for free 8394 912 50 6 1116 3641
Reduction of retail prices by 5%
B2C volume decreases by 2050%

Shutdown of underutilized plants
Decentralized 8293 1213 7 2 6 914 3538 and 510% write-off of grid and
generation assets
Decrease of wholesale prices by 510%
O&M3 costs in generation increase 50%

Emissions 100 9 9 9 7 48
One-off penalty: 5% of total revenue
fraud 0.5 billion cost for external services
No customer loss in B2C retail business
5% PP&E4 one-off write-offs

7.5% PP&E one-off investment
Cyberattack 99 8 6 10 10 43 10% increase in grid field-crew expenses
No customer loss in B2C retail business
Reduction of retail prices by 15%

Price 20% loss of B2C customers
transparency 92 9 3 6 13 39 20% staff reduction, with severance
payments of 150% of annual salaries
1Earnings before interest, taxes, depreciation, and amortization.

2Earnings before interest and taxes.
3
Operations and maintenance.
4 Plant, power, and equipment.
Source: McKinsey analysis
A cyberattack taking critical infrastructure offline is now
more probable, as power and gas grids, street lighting, and
traffic control are highly connected.
Energy companies should also monitor external The strategy function is stress testings natural
developments closely. Today, many utilities are owner, as part of the main strategic-planning
watching the development of battery costs, since if process and linked to financial planning. The
they fall sharply, as they have in solar photovoltaics, businesses should offer input much as they do today.
generation and retail businesses would be Decision-making groups (such as the executive,
vulnerable. Some utilities are partnering with or strategy, or investment committees) should use
investing in battery companies. Many long-term stress-test results in their work, integrating the new
strategic options are available, including nimble capability into the organization. The traditionally
resource allocation and the transformation of strong links among strategy, finance, and operations
companies into digital utilities. should insure smooth integration and interaction.
All these techniques for building resilience are well Sven Heiligtag is a partner in McKinseys Hamburg
covered elsewhere. Our point is that only by building office, where Susanne Maurenbrecher is a consultant;
a stress-testing capability can a company know Niklas Niemann is a consultant in the Cologne office.
where to focus its efforts for resilience. Leaders need
to make stress testing an integral part of the DNA Copyright 2017 McKinsey & Company.
of decision making. They can start by defining a
set of suitable stress tests in two ways: conducting
a thorough review of the business system (to see
around corners) and questioning basic assumptions.
Then they can quantify the potential impact of any
risks and assess the resilience of the company and its
individual business units.
Adding a stress-testing capability isnt onerous.

Companies will probably need one or two additional
researchers to complement their current market-
intelligence and analytics teams. In all likelihood,
the scenario-planning models currently in use can
be repurposed for stress tests.

polygraphus/Getty Images
The evolution of model risk

management
An increasing reliance on models, regulatory challenges, and talent scarcity is driving banks toward a model
risk management organization that is both more effective and value-centric.
Ignacio Crespo, Pankaj Kumar, Peter Noteboom, and Marc Taymans
The number of models is rising dramatically planning, and asset-liquidity management. Big
10 to 25 percent annually at large institutionsas data and advanced analytics are opening new areas
banks utilize models for an ever-widening scope of for more sophisticated modelssuch as customer
decision making. More complex models are being relationship management or anti-money laundering
created with advanced-analytics techniques, such and fraud detection.
as machine learning, to achieve higher performance
standards. A typical large bank can now expect The promise and wider application of models
the number of models included within its model risk have brought into focus the need for an efficient
management (MRM) framework to continue to MRM function, to ensure the development and
increase substantially. validation of high-quality models across the
whole organizationeventually beyond risk itself.
Among the model types that are proliferating are Financial institutions have already invested millions
those designed to meet regulatory requirements, in developing and deploying sophisticated MRM
such as capital provisioning and stress testing. But frameworks. In analyzing these investments, we
importantly, many of the new models are designed to have discovered the ways that MRM is evolving
achieve business needs, including pricing, strategic and the best practices for building a systematically
The evolution of model risk management 29

value-based MRM function (see sidebar, Insights which is the potential for adverse consequences
from benchmarking and MRM best practices). This from decisions based on incorrect or misused model
article summarizes our findings. outputs and reports. SR 11-7 explicitly addresses
incorrect model outputs, taking account of all errors
Model risk and regulatory scrutiny at any point from design through implementation.
The stakes in managing model risk have never been It also requires that decision makers understand
higher. When things go wrong, consequences can the limitations of a model and avoid using it in ways
be severe. With digitization and automation, more inconsistent with the original intent. The European
models are being integrated into business processes, Banking Authoritys Supervisory Review and
exposing institutions to greater model risk and Evaluation Process, meanwhile, requires that model
consequent operational losses. The risk lies equally risk be identified, mapped, tested, and reviewed.
in defective models and model misuse. A defective Model risk is assessed as a material risk to capital,
model caused one leading financial institution to and institutions are asked to quantify it accordingly.
suffer losses of several hundred million dollars when If the institution is unable to calculate capital needs
a coding error distorted the flow of information from for a specific risk, then a comprehensible lump-sum
the risk model to the portfolio-optimization process. buffer must be fixed.
Incorrect use of models can cause as much (or
greater) harm. A global bank misused a risk-hedging The potential value in mature MRM
tool in a highly aggressive manner and, as a result, The value of sophisticated MRM extends well
passed its value-at-risk limits for nearly a week. The beyond the satisfaction of regulatory regimes. But
bank eventually detected the risk, but because how can banks ensure that their MRM frameworks
the risk model it used was inadequately governed are capturing this value thoroughly? To find the
and validated, it only adjusted control parameters answer, we must first look more closely at the value
rather than change its investment strategy. The con- at stake. Effective MRM can improve an institutions
sequent loss ran into the billions. Another global earnings through cost reduction, loss avoidance, and
bank was found in violation of European banking capital improvement. Cost reduction and loss avoid-
rules and fined hundreds of millions of dollars after ance come mainly from increased operational and
it misused a calculation model for counterparty- process efficiency in model development and validation,
risk capital requirements. including the elimination of defective models.
Events like these at top institutions have focused Capital improvement comes mainly from the
financial-industry attention on model risk. reduction of undue capital buffers and add-ons.
Supervisors on both sides of the Atlantic decided When supervisors feel an institutions MRM is
that additional controls were needed and began inadequate, they request add-ons. An improved
applying specific requirements for model risk MRM function that puts regulators in a more
management on banks and insurers. In April 2011, comfortable position leads to a reduction of these
the US Board of Governors of the Federal Reserve penalties. (The benefit is similar to remediation
System published the Supervisory Guidance on for noncompliance.) Capital inefficiency is also
Model Risk Management (SR 11-7). This document the result of excessive modeler conservatism. To
provided an early definition of model risk that deal with uncertainty, modelers tend to make
subsequently became standard in the industry: conservative assumptions at different points
The use of models invariably presents model risk, in the models. The assumptions and attending

Insights from benchmarking and MRM
best practices
Model risk management (MRM) was addressed in the United States, we found that variation takes
as a top-of-mind concern by leading global banks between one and 17 weeks. For both US and EU
in recent surveys and roundtables conducted in banks, pass/fail rates vary widely by model. The
Europe and the United States by McKinsey and Risk scope of MRM activities varies widely as well,
Dynamics. The overall number of models varied especially for ongoing model monitoring and model
widely, ranging from 100 to 3,000 per bank; the implementation. With respect to governance,
number of full-time equivalents (FTEs) dedicated most of the MRM groups report directly to the chief
to MRM and validation is also highly variable, with risk officer (CRO), or to his or her direct report;
European banks dedicating an average of 8 FTEs the boards of these banks typically discuss MRM in
per 100 billion of assets, while for US banks this at least six meetings per bank.
average is 19. MRM groups have grown considerably
in recent years, and that growth is expected to In probing the model risk management terrain more
Risk 2017
continue. Most banks said they still rely heavily on the closely, our research identified important trends
Evolution of model
support of external risk management
consultants for validation. The and defined a model life cycle, from planning and
Exhibit (Sidebar)
time period for validation varies, depending on model development through model use, risk appetite,
intensity. For European banks, model validation can and policies.1 Our research also revealed the key
take anywhere from a few days to 30 weeks, whereas questions on the agenda of chief risk officers (exhibit),
Exhibit CROs can address the model life cycle with key questions about model risk management.
Questions for chief risk officers (CROs)
Model planning and development

Inmodel development, what is the relationship between the corporation
and its functions and business units?
Model control Model use,
risk appetite, Model validation
and monitoring For validation, what is the level of centralization and reporting?
and policies
Is the outsourcing of validations an adequate practice? How should
outsourcing be managed?
Model implementation
Governance What models are within the scope of model risk management?
Model Do they include regulatory and nonregulatory models?
Model
and standards How should models be prioritized (model tiering)?
planning
implemen- and
tation develop- Model control and monitoring
ment Isthe control unit independent of the validation unit?
How can compliance with the line-of-defense framework be ensured?
Model use, risk appetite, and policies

Model validation
Is a model risk appetite in place?
Is model risk being quantified systematically?
Is top management aware of the importance and potential issues
of model risk management (MRM)?
How is the MRM organization designed, and who is in charge of
each of its parts?

and the extent to which these questions are being parameters, and what the model is used for. The level
addressed in some of the most important areas. of validation is located along a continuum, with high-
risk models prioritized for full validation and models
Model planning and development of low risk assigned light validation. In the majority of
Model planning should be well coordinated across banks we surveyed, validation is highly centralized
the whole bank. While taking great care to main- and situated in the risk organization. Outsourcing is
tain the independence of validation, the model- increasing at both European and US institutions, as a
development group should work closely with result of talent constraints.
validation, an approach that controls costs by
reducing the number of iterations and overall Most US banks have strengthened the independence
development time. of validation, with the head reporting directly to
the CRO. In the United States, material models
Banks are increasingly centralizing model planning have to be validated in great detail, with systematic
and development, with best-practice institutions replication and the use of challenger models.
setting up centers of excellenceadvanced- This approach is not uniformly applied in Europe,
analytics centers acting as service providers to where conceptual validations are still accepted in
business units. They have created three location many cases. Likewise, model implementation
models: a local model with the bulk of the work (in operational and production systems) is not
close to model owners, each of them with dedicated validated consistently across EU banks.
teams; a hybrid model; and a centralized model,
with the bulk of the work performed in the dedicated Control and monitoring
corporate center. In the United States, the Federal Reserve is strict
about proper deployment of the three lines of
As talent demands rise, the highly specialized defense, with all stakeholders playing their roles:
skills needed to develop and validate models are model developers need to continuously monitor their
becoming increasingly scarce. Nearly three-quarters models; validation must make periodic reviews and
of banks said they are understaffed in MRM, so the audits, relying on the right level of rigor and skills. In
importance of adjusting the model risk function to Europe, implementation of the three lines remains
favor talent acquisition and retention has become less defined. The regulatory focus is mainly on
pronounced. Banks are now developing talent regulatory models, as opposed to the US approach,
solutions combining flexible and scalable resourcing where proper control is expected for all material
with an outsourcing component. models, whatever their type. Consequently, in the
European Union, few banks have a control and
Validation governance unit in charge of MRM policies and
Best-practice institutions are classifying models appetite; in the United States, nearly all banks have
(model tiering) using a combination of quantitative an MRM unit.
and qualitative criteria, including materiality and risk
exposure (potential financial loss), and regulatory Model use, risk appetite, and policies
impact. Models are typically prioritized for validation In accordance with best practices, approximately
based on complexity and risk associated with model half the surveyed banks have integrated model
failure or misuse. Model risk is defined according to risk within their risk-appetite statement, either as
potential impact (materiality), uncertainty of model a separate element or within nonfinancial risks.

Only around 20 percent, however, use specific key model ownership is held by users, representing
performance indicators for model risk, mainly based the preferred option for institutions that are more
on model performance and open validation findings advanced in model management, allowing a better
on models. engagement of business on data and modeling
assumptions. Risk committees authorize model-use
All banks have a model governance framework in exceptions in around 70 percent of cases.
place, but 60 percent of the group uses it for the
1
main models only (such as internal ratings based The research was performed by McKinsey Risk Dynamics,
which specializes in model risk and validation.
or stress testing). Half of the survey group has a
model risk policy. For 60 percent of the group,
conservatism are often implicit and not well docu- able to align model investments with business risks
mented or justified. The opacity leads to haphazard and priorities. By reducing model risk and managing
application of conservatism across several components its impact, MRM can also reduce some P&L volatility.
of the model and can be costly. Good MRM and The overall effect heightens model transparency and
proper validation increases model transparency (on institutional risk culture. The resources released
model uncertainties and related assumptions) and by cost reductions can then be reallocated to high-
allows for better judgments from senior management priority decision-making models.
on where and how much conservatism is needed.
Systematic cost reduction can only be achieved with
This approach typically leads to the levels of an end-to-end approach to MRM. Such an approach
conservatism being presented explicitly, at precise seeks to optimize and automate key modeling
and well-defined locations in models, in the form processes, which can reduce model-related costs
of overlays subject to management oversight. As by 20 to 30 percent. To take one example, banks
a result, the total level of conservatism is usually are increasingly seeking to manage the model-
reduced, as end users better understand model validation budget, which has been rising because
uncertainties and the dynamics of model outcomes. of larger model inventories, increasing quality and
They can then more clearly define the most relevant consistency requirements, and higher talent costs. A
mitigation strategies, including revisions of policies pathway has been found in the industrialization of
governing model use. validation processes, which use lean fundamentals
and an optimized model-validation approach.
Profit and loss
With respect to improvement in profit and loss (P&L), Prioritization (savings: 30 percent). Models
MRM reduces rising modeling costs, addressing for validation are prioritized based on factors
fragmented model ownership and processes caused such as their importance in business decisions.
by high numbers of complex models. This can save Validation intensity is customized by model tiers
millions. At one global bank, the capital budget for to improve speed and efficiency. Likewise, model
models increased sevenfold in four years, rising tiers are used to define the resource strategy and
from 7 million to 51 million. By gaining a better governance approach.
understanding of the model landscape, banks are

Portfolio-management office and supporting discussed as having three stages: building the elements
tools (savings: 25 percent). Inefficiency can of the foundation, implementing a robust MRM
be reduced at each stage of the validation program, and capturing the value from it (Exhibit 1).
process, with predefined processes, tools,
and governance mechanisms. These include Building the foundational elements
development and submission standards as The initial phase is mainly about setting up the
well as validation plans and playbooks. basic infrastructure for model validation. This
includes the policies for MRM objectives and scope,
Testing and coding (savings: 25 percent). the models themselves, and the management of
Automation of well-defined and repetitive model risk through the model life cycle. Further
validation tasks, such as standardized testing policies determine model validation and annual
or model replication, can further lower costs. review. Model inventory is also determined, based
on the defined characteristics of the model to be
captured and a process to identify all models and
The evolution toward capturing value nonmodels used in the bank. Reports for internal
systematically and external stakeholders can then be generated
To manage the P&L, capital, and regulatory from the inventory. It is important to note, however,
Risk 2017
challenges to their institutions advantage, leading that the industry still has no standard of what should
Evolution of model risk management
banks are moving toward a robust MRM framework be defined as a model. Since banks differ on this
Exhibit 1 of 2
that deploys all available tools to capture efficiencies basic definition, there are large disparities in model-
and value. The path to sophisticated model risk inventory statistics.
management is evolutionaryit can be usefully
Exhibit 1 Model risk management has three evolutionary stages.

Stage 3
Stage 2 Capturing value
Stage 1 Implementation and
execution
Foundational elements
Objectives Buildfoundation elements Implement robust MRM Gainefficiencies and

for model risk extract value from MRM
management (MRM)
Key elements MRM policy MRM policy Center of excellence for

Model inventory Control and process model development
Manual work-flow tool Training for stakeholders Industrialized validation
Model governance Automated work-flow tool Transparency in model quality
and standards Process-efficiency tracking
MRM organization Optimized resource
Governance team management
Validation team
Most North American banks are in stage 2 of MRM evolution, while many European peers are still in stage 1.

Governance and standards are also part of the MRM institutions, most respondents (76 percent) identified
infrastructure. Two levels of governance are set up: incomplete or poor quality of model submissions as
one covering the steps of the model life cycle and the largest barrier for their validation timelines.1
one for the board and senior management. At this Model owners need to understand the models they
point, the MRM function will mainly consist of a use, as they shall be responsible for errors in decisions
small governance team and a team of validators. The based on those models.
governance team defines and maintains standards
for model development, inventory, and validation. One of the best ways to improve model quality is
It also defines stakeholder roles, including skills, with a center of excellence for model development,
responsibilities, and the people who will fill them. set up as an internal service provider on a pay-per-
The validation team conducts technical validation of use basis. Centers of excellence enable best-practice
the models. Most institutions build an MRM work- sharing and advanced analytics across business
flow tool for the MRM processes. units, capturing enterprise-wide efficiencies. The
approach increases model transparency and reduces
Implementing a robust program the risk of delays, as center managers apply such
With foundational elements in place, banks can then tools as control dashboards and checkpoints to
build an MRM program that creates transparency reduce rework.
for senior stakeholders on the model risk to the
bank. Once model-development standards have Process automation defines MRM maturity, as
been established, for example, the MRM program model development, validation, and resource manage-
can be embedded across all development teams. ment are industrialized (Exhibit 2). Validation
Leading banks have created detailed templates for is led by a project-management office setting
development, validation, and annual review, as timelines, allocating resources, and applying model-
well as online training modules for all stakeholders. submission standards. Models are prioritized
They often use scorecards to monitor the evolution according to their importance in business decisions.
of model risk exposure across the institution. An onshore validation factory reviews, tests, and
revises models. It can be supported by an off-
A fundamental objective is to ensure high-quality, shore group for data validation, standards tests and
prioritized submissions. Model submissions missing sensitivity analysis, initial documentation,
key components such as data, feeder models, or and review of model monitoring and reporting. The
monitoring plans reduce efficiency and increase industrial approach to validation ensures that
delivery time. Efficiency can be meaningfully models across the organization attain the highest
enhanced if all submissions adhere to standards established standards and that the greatest value is
before the validation process begins. Models captured in their deployment.
are prioritized based on their importance to the
business, outcome of prior validation, and potential The standards-based approach to model inventory
for regulatory scrutiny. and validation enhances transparency around
model quality. Process efficiency is also monitored,
Gaining efficiencies and extracting value as key metrics keep track of the models in validation
In the mature stage, the MRM function seeks and the time to completion. The validation work-
efficiencies and value, reducing the cost of managing flow system improves the model-validation factory,
model risk while ensuring that models are of the whose enterprise-wide reach enables efficient
highest quality. In our survey of leading financial resource deployment, with cross-team resource

Risk 2017
Evolution of model risk management
Exhibit 2 of 2
Exhibit 2 Industrialized model validation defines mature model risk management.
2. Model-validation factory: Project-management office (PMO)
PMO team develops and manages Factory is supported by tools

Validation
calendar Validationplaybook
Resource allocation Testing routines and code
Model submission standards Documentation and reporting templates
Technology (work-flow system) Benchmarks and other industry data
3. Onshore validation factory
Tier 1
Model 1. Model
Conceptual Data Testing Documentation Communication Ongoing
Tier 2 review validation design and and report with model monitoring
inventory prioritization creation developers and reporting
execution
Tier 3
4. Offshore validation factory
Data Testing and Initial Monitoring

validation execution documentation and reporting
Data-source Model Documentation Including review
review and replication, testing and of monitoring
data-quality standard discussion of plan, and
testing testing, and results monitoring and
sensitivity reporting
analysis performance
sharing and a clear view of validator capabilities and to create the most value amid costly and highly
model characteristics. consequential operations. The sooner institutions
get started in building value-based MRM on an
Consistent standards for model planning and develop- enterprise-wide basis, the sooner they will be able to
ment allow institutions to develop more accurate get ahead of the rising costs and get the most value
models with fewer resources and in less time. In our from their models.
experience, up to 15 percent of MRM resources can
be conserved. Similarly, streamlining the model- 1 Many fewer respondents cited a lack of sufficient
validation organization can save up to 25 percent in resources (14 percent) and the need to validate each model
costs. With the significant regulatory spending now comprehensively (10 percent).
being demanded of institutions on both sides of
Ignacio Crespo is an associate partner in McKinseys
the Atlantic, these savings are not only welcome but
Madrid office, Pankaj Kumar is an associate partner
also necessary.
in the New York office, where Peter Noteboom is a
partner, and Marc Taymans is a managing partner in
McKinseys Risk Dynamics group.
The contours of a mature stage of model risk Copyright 2017 McKinsey & Company.
management have only lately become clear. We now All rights reserved.
know where the MRM function has to go in order

Agsandrew/Getty Images
Digital risk: Transforming risk

management for the 2020s
Significant improvements in risk management can be gained quickly through selective digitizationbut
capabilities must be test hardened before release.
Saptarshi Ganguly, Holger Harreis, Ben Margolis, and Kayvaun Rowshankish
Digitization has become deeply embedded in banking Experience shows that the structural changes
strategy, as nearly all businesses and activities needed to bring costs down and improve
have been slated for digital transformations. The effectiveness in risk can be accomplished much like
significant advantages of digitization, with respect digital transformations in other parts of the bank.
to customer experience, revenue, and cost, have The distinguishing context of the risk environment,
become increasingly compelling. The momentum however, has important implications. First, risk
to adopt the new technologies and operating practitioners in most regulatory jurisdictions have
models needed to capture these benefits continues to been under extreme pressure to meet evolving
build. The risk function, which has seen significant regulatory requirements and have had little time
growth in costs over the past decade, should be for much else. Second, chief risk officers have been
no exception. Indeed, we are starting to see digital wary of the test-and-learn approaches characteristic
transformations in risk create real business of digital transformation, as the cost of errors in the
value by improving efficiency and the quality of risk risk environment can be unacceptably high. As a
decisions. A digitized risk function also provides result, progress in digitizing risk processes has been
better monitoring and control and more effective particularly slow.
regulatory compliance.
Digital risk: Transforming risk management for the 2020s 37

This status quo may be about to change, however, Data, analytics, and IT architecture are the
as global banking leaders begin to recognize how key enablers for digital risk management. Highly
substantial value can be unlocked with a targeted fragmented IT and data architectures cannot provide
digital agenda for risk featuring fit-for-purpose an efficient or effective framework for digital risk.
modular approaches. In addition to the objective A clear institutional commitment is thus required
of capturing value, this agenda incorporates risk- to define a data vision, upgrade risk data, establish
specific goals. These include ensuring the ongoing robust data governance, enhance data quality and
effectiveness of the control environment and metadata, and build the right data architecture.
helping the risk function apply technology to better Fortunately, processes and analytics techniques can
address regulatory expectations in key areas now support these goals with modern technology
like risk measurement, aggregation, and reporting. in several key areas, including big data platforms,
the cloud, machine learning, artificial intelligence,
What is digital risk? and natural-language processing.
Digital risk is a term encompassing all digital
enablements that improve risk effectiveness and The organization and operating model will require
efficiencyespecially process automation, decision new capabilities to drive rapid digitization. Although
automation, and digitized monitoring and early risk innovation takes place in a very specific, highly
warning. The approach uses work-flow automation, sensitive area, risk practitioners still need to
optical-character recognition, advanced analytics create a robust culture of innovation. This means
(including machine learning and artificial putting in place the right talent and nurturing an
intelligence), and new data sources, as well as the innovative test and learn mind-set. Governance
application of robotics to processes and interfaces. processes must enable nimble responses to a fast-
Essentially, digital risk implies a concerted moving technological and regulatory environment.
adjustment of processes, data, analytics and IT, and Managing this culture of innovation in a way that is
the overall organizational setup, including talent appropriate for risk constitutes a key challenge for
and culture. the digitized risk function.
Three dimensions of change: Processes, data, Adapting digital change to the risk context
organization Most institutions are digitizing their risk functions
To realize the full benefits of process and decision at a relatively slow pace, taking modular approaches
automation, banks need to ensure that systems, to targeted areas. A few have undertaken large-
processes, and behaviors are appropriately fitted scale transformation, achieving significant and
for their intended purpose. In the risk environment, sustainable advances in both efficiency and effective-
prioritized use cases are isolated in such areas as ness. Either way, in the risk context, care must be
credit underwriting, stress testing, operational risk, taken when adapting test-and-learn pilots commonly
compliance, and control. In most banks, current used in digital transformations in other parts of
processes have developed organically, without a the bank. Robust controls must be applied to such
clearly designed end state, so process flows are not pilots, as the tolerance for bugs and errors in risk
always rational and efficient. Operational structures is necessarily very low. When digitizing processes
will need to be redesigned before automation and relating to comprehensive capital analysis and
decision support can be accordingly enabled. review (CCAR), for example, solutions cannot be

introduced into production before thorough testing reduce operating costs for risk activities by 20 to
has convinced designers and practitioners of their 30 percent. The state of risk management at most
complete reliability and effectiveness. In certain global, multiregional, and regional banks is
other risk areassuch as monitoring and early- abundant with opportunity. Current processes are
warning systems in commercial credit riskbanks resource intensive and insufficiently effective, as
can use test-and-learn approaches effectively. indicated by average annual fines above $400 million
Risk 2017
for compliance risk activities alone (Exhibit 1).
Digital Risk
Sizing the opportunity
Exhibit 1 of 3
Our experience suggests that by improving the The potential benefits of digital risk initiatives
efficiency and effectiveness of current risk- include efficiency and productivity gains, enhanced
management approaches, digital risk initiatives can risk effectiveness, and revenue gains. The benefits of
Exhibit 1 Digital risk management can significantly reduce losses and fines in core risk areas.
Impact from digitization: High Medium Low
Representative global bank Representative regional bank
Losses Losses
2015, Fines, 200915, $ million 2015, Fines, 200915, $ million
Risk areas $ billion Year avg. Top decile $ billion Year avg. Top decile
Credit
risk 2040 3050 600+ 35 510 150+
Operational
300600 4,500+ 1020 225+
risk
24 0.20.3
Compliance
400600 1,850+ 1530 350+
risk
Market and
liquidity risk <0.5 75150 500+ <0.1 2040 300+
Stress
testing NA NA NA NA NA NA
The greatest financial opportunities from digitization for both universal and regional
banks are in the areas of operational and compliance risk
Note: Credit risk losses are gross charge-offs; operational and compliance risk losses do not include opportunity costs (such as unearned
revenue due to operational risk events); the average total yearly fines are given for banks fined at least once in the period 200915.
Source: Bank holding company Y9C reporting forms; Financial Times bank-fines data; McKinsey analysis

greater efficiency and productivity include possible To protect revenue in consumer credit, digital risk
cost reductions of 25 percent or more in end-to- strengthens customer retention. It improves the
end credit processes and operational risk, through customer experience with real-time decisions,
deeper automation and analytics. Risk effectiveness self-service credit applications, and instant credit
can be strengthened with superior transparency, approvals. The improvements are enabled through
gained through better management and regulatory integration with third parties for credit adjudication
reporting and the greater accuracy of model outputs and the use of dynamic risk-adjusted pricing
due to better data. Revenue lift can be achieved and limit setting. One European bank is exploring
through better pricing or an enhanced customer the potential for digital risk to expand revenue
and frontline experiencefor example, by reducing in consumer credit within the same risk appetite.
the know-your-customer (KYC) cycle time from one Digitized credit processes will permit faster
week to under one day, or the mortgage-application decision making than the competition while the
process to under 30 minutes, from 10 to 12 days. bank maintains its superior risk assessment.
Improved employee satisfaction can also be achieved
through focusing talent on high-value activities. Value is also created by improving risk assessment.
Advanced analytics and machine-learning tools can
Target risk processes: Credit risk, stress increase the accuracy of credit risk models used for
testing, and operational risk and compliance credit approvals, portfolio monitoring, and workouts.
The possible action areas for digital risk are It can also reduce the frequency of judgment-based
extensive, but in our view three specific areas are errors. The integration of new data sources enables
optimal for near-term efforts: credit risk, stress better insights for credit decisions, while real-time
testing, and operational risk and compliance. data processing, reporting, and monitoring further
Alhough no one bank has fully digitized all three of improve overall risk-management capabilities.
these areas, we are seeing leading banks prioritize Operational costs are also reduced as credit processes
digital initiatives to realize discrete parts of the total are digitized. A greater share of time and resources
savings available. The following discussion is based can be dedicated to value-added activities, as inputs
on actual digital risk initiatives across risk types and outputs become standardized and paperless.
and processes.
In addition to improving default predictions, we
Credit risk have seen credit risk improvements in these areas
Credit delivery is hampered by manual processes for creating a revenue lift of 5 to 10 percent and lowering
data collection, underwriting, and documentation, costs by 15 to 20 percent (Exhibit 2).
as well as data issues affecting risk performance
and slow cycle times affecting the customer Stress testing, including CCAR
experience. Digital credit risk management uses Banks find that significant value can be captured
automation, connectivity, and digital delivery and through a targeted digitization effort for stress
decision making to alleviate these pain points. testing, including CCAR. The current approach
Value is created in three ways: by protecting is highly manual, fragmented, and sequential,
revenue, improving risk assessments, and reducing presenting challenges with data quality, aggregation,
operational costs. and reporting time frames and capacity. The

Risk 2017
Digital Risk
Exhibit 2 of 3
Exhibit 2 An integrated digital risk program for consumer credit can protect revenue, improve risk
assessments, and reduce operational costs.
Improvement potential: High (10%+) Medium (510%) Low (05%)
Digital credit risk value map
Revenue Cost Cost of risk

Credit risk value chain improvement reduction mitigation
Appetite and limit setting Strategies and policies
Sales and planning

Front office, customer
contact Pricing
Analysis
Scoring and rating

Credit analysis
and decision
Work flow
Application
Decision making
Contracts and documents

Back office/loan
administration Collateral management
Issue identification
Monitoring/early-
warning system Action recommendation
Workout strategies
Collection and
restructuring Restructuring
Report generation
Reporting
Insights/analysis
Work-flow support
processes are prime candidates for digital automation Templates and outputs are standardized, and
and work-flow tools. golden sources for data are designated. The
resulting process becomes increasingly transparent
The underlying stress-testing process is the starting and effective. Process optimization is supported
point. The improvement program will aim at by digital-automation initiatives for data loading,
optimizing resources. Dedication of resources will overlays, Y14A reports, and the end-to-end review
be prioritized based on materiality of risk. and challenge process. Real-time visualization and
Institutions can achieve additional efficiency through sensitivity analysis are digitally enabled as part
parallel processing, centralization, and cross- of the transformation. In addition to optimizing
training of staff, as well as better calendaring. stress testing directly, banks are also looking for

opportunities to harmonize the data, processes, and operational risk and compliance controls and
decision-making models with business planning. activities. In anti-money laundering (AML), for
example, processes and data have become unwieldy,
We have seen digitization in CCAR and stress testing costs have skyrocketed, and efforts have become
bring significant cost improvements andeven more ineffective. Significant opportunities to increase the
importantfree up capacity so that experts can effectiveness and efficiency of AML operations lie
apply more insight and improve the quality and use in thorough end-to-end streamlining of the alert-
of outputs (Exhibit 3). generation and case-investigation processes.
Risk 2017
Digital Riskrisk and compliance
Operational In alert generation, digital risk improvements ensure
Exhibit 3 of 3banks, manual processes and
At many global that reference data available for use in the analytic
fragmented systems have proliferated across engine is of high quality. Advanced-analytics tools
Exhibit 3 There are many ways digitization can improve efficiency and effectiveness of
comprehensive capital analysis and review (CCAR) and stress testing.
High impact Medium impact Low impact
Core CCAR elements Supporting activities How to digitize
Risk assessment Implementation of tool to collect and

Risk identification Risk aggregation and reporting aggregate risks
Forecast development Appification of scenario syndication

Scenario Macro forecasts by lines of business, senior executives,
and board
Data preparation Adoption of end-to-end data-hosting

Data, models, Model development solution and model-development
and forecasting
environment
Jump-off data and forecast execution Automated aggregation engine with feeds
Aggregation and Aggregation and schedule construction from model-development environment
reporting
Review and challenge Creation of dynamic review-and-

challenge app
Implementation of control-monitoring
Internal controls
and attestation tool
Adoption of work-flow, tracking,

Documentation aggregation, and storage tool

such as machine learning are used to test and at direct revenue improvement; proof of this impact
refine the case-segmentation variables and support from digital risk programs is more elusive, since
auto-adjudication where possible. In addition, risk is an enabling function. Faster turnaround
digitization and work-flow tools can support smart times for loan applications is a typical digital risk
investigations and automated filing of suspicious- improvement. This will likely drive higher lending
activity reports, an improvement that enhances the volumes and, consequently, increased revenueeven
productivity of the investigation units. if the correlation cannot be precisely determined.
Given the indirect impact on revenue, digital risk
Our experience of digital risk initiatives in AML programs should focus primarily on reducing risk
is that they invariably improve effectiveness and and cost. The exception is digital credit, where the
efficiency, typically in the range of 20 to 25 percent. case for revenue lift will be clearer.
The overall impact of such improvement is even
greater, however, given the large cost base of this Designing a program
function across institutions and the risk of not An effective digital risk program begins with chief
identifying bad actors. risk officers asking the right questionsthose that
point the institution toward specific initiatives for
Digital risk is different digital innovation. Can we reduce the time needed
A digital risk program must be designed in for structured credit approvals to a few minutes?
recognition of those aspects of the risk function that How can we increase straight-through processing
distinguish it from other functions, such as frontline rates? How can we improve the efficiency and
digital sales. For risk, regulators will not accept streamlining of KYC activities to reduce pain points
the characteristic approaches of traditional digital in the account-opening process? How can we make
transformations. Live launches of minimum viable CCAR less sequential and resource intensive? How
products to be tested and refined in production is can we improve the timeliness of reporting to meet
not an appropriate path for most risk activities. regulatory objectives? What value can we extract
Most approaches to digitization focus on improving from better use of internal data? What is the
the customer experience. Digital risk will involve incremental benefit of including new data sources?
some actual external customers, such as in credit The answers will help shape initiatives, which will
delivery, but in most areas the focus will be on be prioritized according to current resource-allocation
internal customers, stakeholders, and regulators. levels, losses and regulatory fines, and implementation
Moreover, digital risk is never a self-contained considerations, such as investment and time.
effortit will depend on data from all businesses
and functions. Development thus proceeds at a Digital risk programs can incorporate the familiar
pace limited by the careful management of these design features of digital transformations, such
interdependencies. Innovative approaches such as as zero-based process and interface redesign and
agile and digital labs provide effective options to an agile framework. The testing and refinement,
implement solutions incrementally. however, takes place entirely within a controlled
environment. The design approach, which can be
Direct impact will be felt in cost and risk reduction modular, must also be comprehensive, based on a
While digital risk offers clear opportunities for thorough review of risk activities, appetite, and policies.
significant cost reduction, the impact on revenue
is less obvious but implicitly understood by leaders. The designs cannot be migrated into production
Frontline digital transformations are often aimed until they have been thoroughly tested and

syndicated, often with regulatory bodies. Because In the third stage, where the innovation is
of its highly sensitive environment, risk is digitized introduced into production, the organization focuses
end to end over a longer timeline than is seen in on change management. In itself, this is no different
customer-service areas. Specific capabilities are from typical digitization programs in other business
developed to completion and released discretely, so areas. The focus is on embedding the design into the
that risk management across the enterprise is built operating model and continuing to invest in digital
incrementally, with short-term benefits. capabilities to build momentum for further launches.
Having the right talent in place, whether drawn from
The anatomy of a transformation internal or external sources, is the key to a successful
A digital risk program can get a running start transition to digital risk.
by capturing high-value opportunities first. The
anatomy of the transformation will resemble that of
other digital transformations, with the usual three
stages: 1) priority initiatives are identified according The path to digital risk will be a multiyear journey,
to the value at stake and the feasibility for near-term but financial institutions can begin to capture
implementation, 2) digital solutions are designed to significant value within a few months, launching
capture that value and tested and revised according tailored initiatives for high-value targets. As the
to stakeholder input, and 3) the improvement risk function becomes progressively digitized, it will
is introduced into production, with continued be able to achieve higher levels of efficiency,
capability building to embed the design, engineering, effectiveness, and accuracy. In the future, risk manage-
and change management into the operating model ment will be a lean and agile discipline, relieving cost
and invest in the right capabilities and mind-sets. pressures, improving regulatory compliance, and
contributing to the banks ability to meet escalating
The opportunities identified in stage one are competitive challenges. The first steps toward that
matched in stage two with digital and other solutions future can be made today.
that will reduce waste and optimize resources while
improving standardization and quality. These Saptarshi Ganguly is a partner in McKinseys Boston
solutions will involve work-flow automation, digital office, Holger Harreis is a partner in the Dsseldorf
interfaces, and the use of advanced analytics and office, and Ben Margolis is an associate partner in
machine learning. The technology design may use a the New York office, where Kayvaun Rowshankish is
a partner.
two speed architecture to support fast innovation
in IT while allowing the main IT infrastructure to
operate normally. New functionality is rigorously
tested prior to migration into production, to ensure
a smooth, error-free transition for critical risk
functions. Iterative test-and-learn processes take
place within environments featuring higher control
standards than typical elsewhere. Stakeholder
feedback and often regulator syndication are
obtained prior to production release.

January 2017
Designed by Global Editorial Services
Copyright McKinsey & Company
This McKinsey Practice Publication

meets the Forest Stewardship
Council (FSC) chain-of-custody
standards. The paper used in
this publication is certified as being
produced in an environmentally
responsible, socially beneficial, and
economically viable way.
Printed in the United States of America.

McKinseyOnRisk2017 Full Issue Web2717

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

McKinseyOnRisk2017 Full Issue Web2717

Uploaded by

Copyright:

Available Formats

McKinsey on

Nonfinancial risk today: Protecting your critical From scenario planning

Number 2, January 2017

Sustainable compliance: Nonfinancial risk today: Protecting your critical

Ral Galamba de Oliveira

2 McKinsey on Risk Number 2, January 2017

Sustainable compliance: Seven steps

Piotr Kaminski, Daniel Mikkelsen, Thomas Poppensieker, and Kate Robu

Sustainable compliance: Seven steps toward effectiveness and efficiency 3

Breakdown of FTEs1 across lines of defense,2 US banking example

25% of resources are

Production In-line quality- In-business Centralized Audit (third line Total

4 McKinsey on Risk Number 2, January 2017

Sustainable compliance: Seven steps toward effectiveness and efficiency 5

Potential impact on total compliance capacity

Harmonize risk- Clarify Optimize Streamline key Implement Total impact

High High Moderate High High

1 Basel Committee on Banking Supervisions regulation number 239.

6 McKinsey on Risk Number 2, January 2017

Sustainable compliance: Seven steps toward effectiveness and efficiency 7

8 McKinsey on Risk Number 2, January 2017

Exhibit 3 The effectiveness of anti-money-laundering controls can be measured by quantitative

KRI example Risk marker

Report filing Customer-transaction reports (CTRs) High Was assessment of

Suspicious-activity reports (SARs)

Customer New customers not provided with CIP notice Low

Existing customers without timely, complete,

Volume of CTRs in relation to volume of

Growth in higher-risk operations1 without Risk marker indicates

Sustainable compliance: Seven steps toward effectiveness and efficiency 9

10 McKinsey on Risk Number 2, January 2017

Sustainable compliance: Seven steps toward effectiveness and efficiency 11

Nonfinancial risk today:

Joseba Eceiza, Piotr Kaminski, and Thomas Poppensieker

12 McKinsey on Risk Number 2, January 2017

Nonfinancial risk today: Getting risk and the business aligned 13

14 McKinsey on Risk Number 2, January 2017

Nonfinancial risk today: Getting risk and the business aligned 15

16 McKinsey on Risk Number 2, January 2017

sufficient; whats needed are both trigger-based

Nonfinancial risk today: Getting risk and the business aligned 17

Protecting your critical digital

Piotr Kaminski, Chris Rezek, Wolf Richter, and Marc Sorel

18 McKinsey on Risk Number 2, January 2017

20 McKinsey on Risk Number 2, January 2017

Copyright 2017 McKinsey & Company.

22 McKinsey on Risk Number 2, January 2017

From scenario planning to

Sven Heiligtag, Susanne Maurenbrecher, and Niklas Niemann

24 McKinsey on Risk Number 2, January 2017

German wholesale power prices, 200815,

Source: BBC; European Energy Exchange; Umweltbundesamt; McKinsey analysis

26 McKinsey on Risk Number 2, January 2017

Exhibit 2 Stress tests show the material impact of a scenario.

Impact <5% Impact <15% Impact >15%

Effects of extreme scenarios on finances of hypothetical utility Key scenario drivers

Revenue set at 100; all other financial

Total volume/market share decrease

B2C volume decreases by 2050%

O&M3 costs in generation increase 50%

5% PP&E4 one-off write-offs

Reduction of retail prices by 15%

payments of 150% of annual salaries

1Earnings before interest, taxes, depreciation, and amortization.