Tag: GRC News

IMG_0345

GRC Academy in Oman

, , , , , ,

The GRC Academy and OBA organized a 3-day CERMP certification course in Muscat, Oman.

The program was delivered by Global Risk Clinic with the support of the Oman Banks Association at the OBA’s offices in Muscat, Oman. The course was designed to deliver the fundamentals of Enterprise Risk Management (ERM) and an understanding of advanced ERM topics. A number of bankers participated in this course that was held at the OBA office located in Muscat, Oman.

OBA Academy is part of the Oman Banks Association. It focuses on educating the Omani banking community on global trends, recent developments, and best practices by working closely with international and reputable resources such as the Global Risk Clinic, to share their knowledge and expertise with senior banking executives and decision-makers. Over the last couple of years, OBA and GRC Academy delivered about 12 courses together in Muscat, around Enterprise Risk Management. The OBA itself has also delivered other courses such as Environment Social Governance (ESG), commercial law, data protection, consumer protection, cybersecurity, customer service, and value added tax.

The Global Risk Clinic and OBA are planning a 1-day event around Cyber Security and Anti-Money Laundering in September 2023, in Muscat. The event will be followed by a panel discussion and live entertainment.

Oman Banks Association is a non-profit professional association created to represent the banking sector, promote Omani banking activities, coordinate with regulators on matters of policy and strategy, and support banking excellence in Oman.

This article was published in one of Oman’s biggest business news websites, Zawya. Find the article here.

Learn more about our CERMP in Oman course here.

Relaunch

GRC Relaunch

, ,

We are glad to announce the opening of the Global Risk Clinic (GRC) Advisory. In the past, our focus has been on non-financial risk management. With the addition of more advisors and expertise we now offer advisory services to cover all aspects of Governance, Risk and Compliance.

 

Why use Global Risk Clinic (GRC)


GRC is a global boutique advisory aimed at providing value to financial institutions across the globe. We provide immediate, tailored, and cost-efficient value driven advisory to our customers by leveraging internal expertise to develop scalable and simple solutions.

Global Experience: We utilize highly experienced and educated executive level advisors who have spent decades in key roles with global institutions. Read about some of our advisors here

Pace: Our advisors work in an expedited fashion and aim at delivering immediate value and results to our customers. Typically, a GRC assessment with recommendations can be completed within a week.

Team Delivery: We work as one organism and leverage experience in a dynamic team environment. Our team spirit and collaborative culture results in cost efficient solutions which can be run smoothly long after completion and handover.

Scalability: As a team we have a significant experience tailoring solutions to organizations of all sizes and industries.


Ongoing Advice And Interim Positions

We provide ongoing advice as well as available experienced resources for interim positions.

Recruitment: We can evaluate and optimize your current resources, educate or locate new talents

Automation: Our tools aid our customers to automate business processes in keeping on track with implementation of governance, risk and compliance. Read about our proprietary system here

 

Additional Services

As our advisors have experience beyond Governance, Risk, and Compliance we can offer services in the following areas:

Asset management Industry: Our team have experience in all aspects of the asset management industry including the development of strategy and asset distribution approach.

Artificial Intelligence: Last but not least we can assist with customer centric automation processes and cloud strategy.

riskappetite

Risk Appetite Framework

, ,

GRC advisors are receiving questions on an ongoing basis about risk appetite. Regulators across the globe and most recently in Asia, have started focusing on a clearly defined risk appetite framework. The following takes you through a simple explanation of an approach to risk appetite. 

 

Risk Appetite is just one building block in the overall Enterprise Risk Management framework.

CLICK HERE to view a short video of GRC’s CEO, Michael Jensen, presenting this framework.

 

What is risk appetite?

Risk appetite is the amount of risk an organization is willing to take on to achieve its strategy. The appetite framework should guide the organization in day to day decision making. Risk appetite should be linked directly to the overall strategy and cover all aspects of the business and all risk disciplines.

Who determines risk appetite?

The owner of any organization determines the amount of risk the organization is willing to take on board. In public companies the board of directors determines the amount of risk the organization is willing to take on board.

How is it established?

Typically, the person or area responsible for the risk framework (E.g.., the Chief Risk Officer) drafts a risk appetite proposal for the board of directors to discuss. Once the board of directors have established a clear appetite framework, the person or areas responsible for the implementation will report to the board (in larger organizations through a risk committee) on the risk profile and potential breaches to the established appetite levels on an ongoing basis. Depending on severity, the board of directors might have to be alerted immediately.
In GRC’s experience, successful implementation of a risk appetite framework is correlated to the amount of input received from the organization. The front line in the organization has an inherent view of appetite and are more likely to respond positively to tolerance levels if this view is incorporated into the draft appetite presented to the board. Subject matter experts are more likely to agree with breaches and escalation if they have been part of establishing tolerance levels.

When is it updated?

A risk appetite framework is dynamic and can be updated on an ongoing basis. At a minimum the board of directors should endorse their approach to risk appetite on an annual basis.

How is it used?

Risk appetite guides all employees in making day to day decisions and establishes clear guidelines for when mistakes should be escalated.

Level of detail

An organization should be able to express its view on risk taking at a very high level. This means writing an appetite framework on a couple of pages in a language understood by everybody. As the framework is utilized additional detail can be added to fit the area in question. Each area of an organization can develop an appetite framework which fits into the overall group wide framework.

Qualitative Statements and Clear Escalation Thresholds

In addition to qualitative risk appetite statements, quantitative escalation thresholds for breaches (for example operational losses) are incorporated in the framework to ensure that the Board of Directors are being notified before a critical level of loss is reached and ensures that action plans are being established on a timely basis. The below provides an example of a risk appetite framework for operational risk only.

risk appetite

Top Down Approach coupled with bottom up information 

As mentioned above, in addition to the risk appetite statements it is key that information on key risk indicators, loss data, mitigation actions and project, customer satisfaction and audit remarks are included in the discussion and assessment of local tolerance for operational risks.

risk appetite

Monitoring  

Loss data and other indicators should be monitored daily and on a rolling average basis. Loss data and other indications should be monitored on a dashboard or in a system.  

Both Gross and net losses (total loss before and after mitigation factors such as insurance or refunding) as well as gains must be monitored and assessed, even when mitigation actions are deemed sufficient.  Though no economic impact might arise each mistake presents a potential learning opportunity.  

Reporting 

Board of Directors is notified when losses exceed the individual thresholds for each category and/or for a single loss breaching the individual threshold. The board of directors might determine that some event types should be escalated regardless of amounts. For instance, intentional internal fraud might require immediate escalation though no financial impact occurred.  

Though no breaches to accumulated or single loss thresholds have occurred risk committees and the board of directors will still receive reporting on an ongoing basis.  

Thresholds could be lowered as you move from the board of directors to the risk committees and further down in the organization. The Chief Risk Officer might require immediate reporting of all losses above a certain lower threshold. 

Additional Tips

Establish a group covering all main areas of the organization to establish a risk appetite proposal or vet a proposal to a framework with internal stakeholders.  

Clear ownership: As with other aspects of a risk management framework clear ownership is key to the success. For example, it should be clear who reports on losses from each business area.  

Pilot a framework: As the board of directors might be a bit gun-shy about establishing escalation thresholds a risk framework could be established in a test/pilot mode while the board of directors and the organization in general gets used to a new framework.  

Use data already available: Typically, loss data and other indicators are already available in the organization and simply must be accumulated and simplified to prove a high-level overview.  

Ask yourself: How often do I want to escalate? Look at historical data and establish initial thresholds based on the frequency of breaches.  

Benchmark: Compare your risk appetite framework and loss data to like organizations.  

Bring in a GRC advisor to establish a risk appetite framework. As we have developed multiple appetite frameworks we will be able to guide you through the process tailor a framework which suits your organization in an objective fashion.

 

Get in contact