Showing the value add of ERM at FirstRand Bank

1
Showing the value add of ERM at FirstRand
Bank Why, How we (try to) do it and an
example.. Jan Lubbe Enterprise Risk Management
FirstRand Bank
2
Presentation overview
1
Background
2
Why do we need to show value?
3
How we (try) to show value
4
The RUBIK3 experience
3
Presentation overview
1
Background
2
Why do we need to show value?
3
How we (try) to show value
4
The RUBIK3 experience
4
BackgroundWho we are

• Owner-manager culture

• Group
• Support

• Retail
• Commercial
• Corporate

• Asset Based Finance
• Personal Loans

• Trading
• Investment Banking

• ERM
• Finance Audit
• Compliance
• Balance Sheet Mgmt

5
BackgroundCommittee Structure
BOARD COMMITTEES
Audit Committee
Risk Committee
Credit Committee
Large Exposures Credit Committee
SUB-COMMITTEES OF THE RISK COMMITTEE
Credit Risk Committee
Assets Liability Committee
Market Risk Committee
Operational Risk Committee
Risk committees of the subsidiaries and divisions
Wesbank
RMB
FNB
Group Support
Risk Committees of Business Units
6
BackgroundDeployed Risk Managers and Operational
Risk Committees
7
BackgroundStructure of Enterprise Risk Management
CEO
Head COO
ERM
Operational Risk Management
Financial Risk Governance
Strategic Risk Governance
IT Shared Services

• Business Continuity
• Information Risk
• Risk Insurance
• OR Governance
• Forensics
• Project Risk

• Financial risk oversight
• Credit risk control
• Market risk control

• Strategic risk oversight
• International expansion oversight
• Annual report
• RD

• Programme Management
• Infrastructure
• MIS

8
Presentation overview
1
Background
2
Why do we need to show value?
3
How we (try) to show value
4
The RUBIK3 experience
9
Why do we need to show value?

• What do non-risk managers think about us?
• Should we try to show value?
• Is there hope?????
• Two important lessons for FirstRand

10
Why do we need to show value?What do non-risk
managers think about us?
Managing risks has always been an important
element of running any enterprise, although the
link to value creation has not always been
clear. ERM From Compliance to Value (P. Shimpi)
Financial Executive Jul/Aug 2005
The bad news is that about half of the
respondents believe their risk management
capabilities are subpar. The state of risk
management in the United States Protiviti
Consulting fs newsletter vol 2, issue 6, 2007
The rise in volume and complexities of risks is
complicated by the fact that many of the
techniques used by boards and senior executives
are dated, lack sophistication, and are often ad
hoc. This further expands an expectations gap
between what stakeholders expect boards and
senior executives to do regarding enterprise wide
risk management and what they actually are
doing. Creating and Protecting Value (MS
Beasley) Strategic Finance May 2007
11
Why do we need to show value?Should we try to
show value?
When asked about the impact of such poor
planning, 93 of respondents identified a red
face and damage to their own personal reputation
as the main threat. Survey "face loss" is risk
managers' top threat. Reactions, 09535640,
May2007, Vol. 27, Issue 5
WE COST MONEY
12
Why do we need to show value? Should we try to
show value?
Cost charge-out models
Spaghetti model
Franchise fee model
Doesnt matter which charge out model you use,
ERM needs to show value! (because we cost
money) Lubbe, 2007
13
Why do we need to show value?Is there hope?
The fact remains that ERM presents a tremendous
opportunity for many risk managers to make a
valuable contribution to their companies and to
create a more meaningful role for themselves
within the organization. So my advice to risk
managers is this Now may be a good time to
determine whether you want to "lead, follow or
get out of the way! ERM A Fork In The Road For
Risk Managers (JR Branham) National Underwriter
April 2006
The goal of ERM is to increase the likelihood
that an organization will achieve its objectives
by managing risks to be within the stakeholders
appetite for risk. ERM done correctly should
ultimately not only protect but also create
stakeholder value. Creating and Protecting Value
(MS Beasley) Strategic Finance May 2007
14
Why do we need to show value?Is there hope?
The broader your responsibility, the more the
finger can be pointed back to that one person
when anything goes wrong. But, having said that,
the idea of a CRO is only a threat to those risk
managers who dont want to grow
intellectually. Slowing economy puts heat on risk
managers (S Friedman) National Underwriter May
2001
Sometimes, you've got to accept the blame to get
credit. Conversely, when the solutions offered by
risk management are successful, you've got to
take credit - raise your profile. Tips for
winning respect for risk management efforts. By
Wojcik, Joanne, Business Insurance, 00076864,
4/21/2003, Vol. 37, Issue 16
15
Why do we need to show value?Two important
lessons for FirstRand
Ultimately, ERM is about communication. Senior
management must have well-developed, current
information and credible insights to communicate
the basis for its actions in both good times and
bad. ERM From Compliance to Value (P. Shimpi)
Financial Executive Jul/Aug 2005
It's essential that risk managers communicate
regularly with upper management, so there are no
surprises. Tips for winning respect for risk
management efforts. By Wojcik, Joanne, Business
Insurance, 00076864, 4/21/2003, Vol. 37, Issue 16
16
Why do we need to show value?Two important
lessons for FirstRand
Risk managers who want to lead their
organizations' ERM effort have to find a way to
grab senior management's attention. ERM an
opportunity for risk managers. By Lenckus, Dave,
Business Insurance, 00076864, 5/22/2006, Vol. 40,
Issue 21
The top performers are more likely to use a
variety of risk management best practices
including rigorously deploying a formal risk
management policy, a formal risk assessment
process and risk monitoring and reporting across
the organisation. The state of risk management in
the United States Protiviti Consulting fs
newsletter vol 2, issue 6, 2007
17
Presentation overview
1
Background
2
Why do we need to show value?
3
How we (try) to show value
4
The RUBIK3 experience
18
How we (try) to show value

• Challenges
• Lesson learnt
• Result

19
How we (try) to show valueChallenges

• Different aspects are considered Value Add
• Some see result as important
• Some see activities as important
• In progress projects are not specified yet an
  inordinate amount of work is being done on many
  of these projects (often multi-year projects)
• Work done is taken for granted by individuals
  themselves
• Different formats of reporting
• Graphic
• Percentages
• Numbers
• Words!

20
How we (try) to show valueLessons learnt

• Make it someones responsibility to co-ordinate
• Reporting needs to be relative (e.g. over time
  vs a benchmark or target)
• Decide on communication mechanisms (e.g. formal
  monthly report intranet newsletters plasma
  screens)
• Link to strategic objectives
• Different levels with click-thru

21
How we (try) to show valueResult High level
dashboard

• Brag dashboard communicated up and down

22
How we (try) to show valueResult Plasma screen

• WEEKLY updates

Rubik Integrated reporting phase II launched!!!
23
Presentation overview
1
Background
2
Why do we need to show value?
3
How we (try) to show value
4
The RUBIK3 experience
24
The Rubik3 experience
Where we want to be
Where we were

• Integrated
• Automated
• Exception-based
• Focused where you need it at whatever level you
  need it

• Manual
• Fragmented
• Difficult to compare / validate

25
The Rubik3 experience

• Now that the easy bit is done (i.e. the
  daydream)
• How do we tie together risk information from
  different sources, across the same risk type
• ???

26
The Rubik3 experience

• A picture is worth a 1000 words

Reporting level
Interface level
Data level
Loss System
Insurance Systems
IT Governance self-assessment
IT incident System
Key Risk Indicator System
Business Continuity Planning
External Loss info
Audit Findings
Risk self-Assessment
Compliance Systems
27
The Rubik3 experience
28
The Rubik3 experience
29
The Rubik3 experience
30
NEXT
31
(No Transcript)
32
(No Transcript)
33
(No Transcript)
34
(No Transcript)
35
(No Transcript)
36
(No Transcript)
37
(No Transcript)
38
(No Transcript)
39
The RUBIK3 experience

• Lessons learnt
• A cool name always helps!
• Its not about the IT, but the IT is vitally
  important!
• Having the end in mind (i.e. show me exactly what
  you want)
• Do it for the right reason (governance vs. use
  it!)
• Ensure risk committees, senior management and
  risk managers get what they want
• Training! (183 areas trained)
• Multi-year project keep momentum going.. and
  show value add..

40
The RUBIK3 experience

• Celebrate your successes
• Doing a good job round here, is like wetting
  yourself while wearing a dark suit you get a
  warm feeling but no-one else seems to notice
• -Robin Williams

41
THANK YOU