The FSA and operational risk

See the list of related resources at the bottom of this page.

The FSA has produced several documents that are concerned with operational risk, and others that are concerned with systems and controls.

The FSA sometimes distinguishes between operational risk (as part of business risk) and control risk and sometimes doesn't. For example, the guidance was originally intended to be part of a separate module, PROR, and was presented as such in CP97. However, the guidance was completely rewritten, and moved into the systems and controls module (SYSC), in CP142.

Further guidance on operational risk is contained in PS97_115, a policy statement issued after feedback on CP97 and CP115, and in PS140, a policy statement issued after feedback on CP140. PS140 applies to insurers, friendly societies, and Lloyd's.

Operational risk is also mentioned in several of the documents in the "Building a New Regulator" series. These documents set out the overall approach of the FSA, and describe their risk framework and regulatory processes.

A report on how firms are going about the business of introducing operational risk management systems, "Building a framework for operational risk management: the FSA's observations", was published in July 2003. It contains useful information on good practices.

The FSA's new structure for capital requirements, based on the calculated ECR (Enhanced Capital Requirement) which is then modified by the ICG (Individual Capital Guidance), as discussed in CP190 and CP195, means that operational risk will affect the capital that firms need. This will be through the ICG, which although it takes the ECR into account is also influenced by the systems and controls that firms have in place. The FSA say:

The more firms are able to demonstrate that their risk assessment processes capture and quantify all of the issues in our guidance, then the lower we are likely to assess their ICG (and vice versa). This provides an incentive for good risk management.

Resources

Financial Services Authority: The FSA is the regulatory authority for the financial services industry in the UK. Its website at http://www.fsa.gov.uk contains all the public documents produced by the FSA, including consultation papers and the texts of speeches as well as the currently applicable Handbook of rules and guidance.
Restructuring of prudential and systems and controls material in the FSA Handbook: The FSA is restructuring the prudential and systems and controls material in the Handbook, because of the implementation of the Capital Requirements Directive. The details of the restructuring are given in http://www.fsa.gov.uk/pages/About/What/International/PSB/pdf/stages.pdf
Building a framework for operational risk management: the FSAs observations: The FSA published this document in July 2003, as they prepared to implement CP142, the consultation paper on operational risk systems and controls. The documument is the result of discussions the FSA held with 22 firms actively developing risk management systems for operational risk. It describes instances of good practice, and discusses the progress that has been made so far. The main conclusion is that although considerable progress has been made, the industry is still at an early stage of developing operational risk frameworks. The report is available at http://www.fsa.gov.uk/pubs/policy/ps142_2.pdf
PS142_2: Building a framework for operational risk management: the FSA's observations - Feedback on industry practice as we prepare to implement CP142: This Policy statement reports on the main issues arising from Consultation paper 142 ('Operational risk systems and controls') published in July 2002. It can be found at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2003/PS142_2.shtml.
CP140: The Interim Prudential Sourcebooks for Insurers and Friendly Societies and the Lloyd's Sourcebook: Guidance on Systems and Controls: Consultation paper 140 from the FSA sets out guidance on •high-level controls; • risk assessment; • legal risk; • internal audit; • management information; • outsourcing; and • group risk. This guidance will take effect before the Prudential Sourcebook is implemented in 2004. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2002/140.shtml. It was issued in July 2002 and the consultation period ended on 3rd October 2002. PS140 is the result of the consultation.
PS140: The Interim Prudential sourcebooks for Insurers and Friendly Societies and the Lloyd's sourcebook: Guidance on Systems and controls - Feedback on CP140 and 'made' text: Policy statement 140 from the FSA sets out guidance on •high-level controls; • risk assessment; • legal risk; • internal audit; • management information; • outsourcing; and • group risk. This guidance was issued in December 2002 and is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2002/ps140.shtml. It takes effect from 1st February 2003.
PS142: Operational risk systems and controls - Feedback on CP142: This Policy statement reports on the main issues arising from Consultation paper 142 ('Operational risk systems and controls') published in July 2002. It can be found at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2003/ps142.shtml.
PS04/16: Integrated Prudential sourcebook for insurers: This Policy Statement reports on the main issues arising from Consultation Paper 190 (Enhanced capital requirements and individual capital assessments for non-life insurers), Consultation Paper 195 (Enhanced capital requirements and individual capital assessments for life insurers) and the audit and reviewing actuary proposals in Consultation Paper 202 (Insurance regulatory reporting – changes to the publicly available annual return for insurers) and publishes the associated rules and guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2004/04_16.shtml.
CP 142: Operational risk systems and controls: Consultation paper 142 from the FSA contains feedback on the operational risk and systems and controls sections of CP97, and contains new draft guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2002/142.shtml. It was issued in July 2002 and the consultation period ended on 31st October 2002.
PS97_115: Integrated Prudential Sourcebook - Feedback on CP115 (Integrated Prudential Sourcebook - timetable for implementation) and CP97 (Integrated Prudential Sourcebook): This policy statement from the FSA was issued after feedback on CP97 and CP115. It was issued in July 2002 and is available at http://www.fsa.gov.uk/pages/Library/Policy/Policy/2002/ps115_97.shtml.
Building the new regulator: Progress report 2: The Financial Services Authority have issued a series of reports outlining their new risk-based regulatory framework. This report, issued in February 2002, describes their risk-based operating framework and what it means for the firms that they regulate. In particular, it includes (as Appendix B) a probability assessment matrix that provides the risk classification system that they use. Note that the FSA is interested only in risks to their statutory objectives, and that these may not be the same as, for example, risks to shareholder value. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress2.pdf.
Building the new regulator: Progress report 1: This is the first report in the series issued by the Financial Services Authority. It was published in December 2000, and describes the risks to the FSA's statutory objectives and the method of assessing the impact of particular risks. It then goes on to consider how the probability of risks can be assessed. In Appendix 1 it provides five case studies of the impact/probability assessment framework, indicating the regulatory relationships that would be likely for various combinations of impact and probability. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress1.pdf.
The future regulation of insurance: A progress report: Despite its title, this report can be seen as the third in the Building the new Regulator series issued by the Financial Services Authority. It was issued in October 2002. It sets out the regulatory agenda (for insurance firms) for the next few years, and is a result of the so-called Tiner project. It emphasises that firms should realise that the new style of regulation means that they should modernise their governance and risk management frameworks, and their systems and controls. Half a dozen areas of particular concern are highlighted. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress3.pdf.
A new regulator for the new millennium: This is the precursor to the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's statutory objectives and its approach to regulation, including the operating framework and regulatory tools. The report, which was published in January 2000, is available at http://www.fsa.gov.uk/pubs/policy/p29.pdf.
Quantifying operational risk in general insurance companies: A paper presented to the Institute of Actuaries in 2004. The paper is available online from my publications page.
CP97: Integrated Prudential Sourcebook: Consultation paper 97 from the FSA is a massive document, presenting the draft Integrated Prudential Sourcebook. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2001/97.shtml. It was issued in June 2001 and the consultation period ended on 31st December 2001. CP115 was a supplementary CP to CP97. CP97 has been superseded by its feedback documents: PS97_115, CP142, CP143.
CP190: Enhanced capital requirements and individual capital assessments for non-life insurers: Consultation paper 190 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in July 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP190 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/190.shtml
CP195: Enhanced capital requirements and individual capital assessments for life insurers: Consultation paper 195 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in August 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP195 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/195.shtml
Operational Risk. Measurement or Bust!: A working party report presented at GIRO 2003. The report and slides for the presentation are both available online from my publications page.
Operational Risk in General Insurance: A working party (of which I was a member) presented a report on operational risk in general insurance to GIRO 2002. The report and slides for the presentation are both available online from my publications page.
CP143: Integrated Prudential sourcebook - Feedback on chapters of CP97 applicable to insurance firms and supplementary consultation: Consultation paper 143 from the FSA contains feedback on some of CP97. There are two areas on which the FSA is consulting again: credit risk for insurers, and final bonuses on with-profits policies. It is available at http://www.fsa.gov.uk/pages/Library/Policy/CP/2002/143.shtml. It was issued in July 2002 and the consultation period ended on 31st October 2002.
Current consultations at the FSA: The FSA maintain a list of current consultation and discussion papers at http://www.fsa.gov.uk/pages/Library/Policy/CP/current/index.shtml.

	:: About :: Blog :: Notes :: All topics :: All links :: Publications :: Downloads :: Contact Related topics: Financial Services Authority Operational Risk ARROW risk assessment framework The FSA and risk based capital Future regulation of insurance briefing Risk management process Enterprise risk management Risk maps Software Risk Risk classification User-developed software Risk identification Read my blog. Is your software use Competent, Complacent or Compromised? Take my 30 second quiz now, and find out! Read past issues of my newsletter. Tools download a simple code profiler for Excel VBA. Automated spreadsheet testing, documentation and more. Download now, or find out more at http://www.xlsior.com. Search WWW Search louisepryor.com
The FSA and operational risk Themes: Operational Risk FSA See the list of related resources at the bottom of this page. The FSA has produced several documents that are concerned with operational risk, and others that are concerned with systems and controls. The FSA sometimes distinguishes between operational risk (as part of business risk) and control risk and sometimes doesn't. For example, the guidance was originally intended to be part of a separate module, PROR, and was presented as such in CP97. However, the guidance was completely rewritten, and moved into the systems and controls module (SYSC), in CP142. Further guidance on operational risk is contained in PS97_115, a policy statement issued after feedback on CP97 and CP115, and in PS140, a policy statement issued after feedback on CP140. PS140 applies to insurers, friendly societies, and Lloyd's. Operational risk is also mentioned in several of the documents in the "Building a New Regulator" series. These documents set out the overall approach of the FSA, and describe their risk framework and regulatory processes. A report on how firms are going about the business of introducing operational risk management systems, "Building a framework for operational risk management: the FSA's observations", was published in July 2003. It contains useful information on good practices. The FSA's new structure for capital requirements, based on the calculated ECR (Enhanced Capital Requirement) which is then modified by the ICG (Individual Capital Guidance), as discussed in CP190 and CP195, means that operational risk will affect the capital that firms need. This will be through the ICG, which although it takes the ECR into account is also influenced by the systems and controls that firms have in place. The FSA say: The more firms are able to demonstrate that their risk assessment processes capture and quantify all of the issues in our guidance, then the lower we are likely to assess their ICG (and vice versa). This provides an incentive for good risk management. Resources Financial Services Authority The FSA is the regulatory authority for the financial services industry in the UK. Its website at http://www.fsa.gov.uk contains all the public documents produced by the FSA, including consultation papers and the texts of speeches as well as the currently applicable Handbook of rules and guidance. Restructuring of prudential and systems and controls material in the FSA Handbook The FSA is restructuring the prudential and systems and controls material in the Handbook, because of the implementation of the Capital Requirements Directive. The details of the restructuring are given in http://www.fsa.gov.uk/pages/About/What/International/PSB/pdf/stages.pdf Building a framework for operational risk management: the FSAs observations The FSA published this document in July 2003, as they prepared to implement CP142, the consultation paper on operational risk systems and controls. The documument is the result of discussions the FSA held with 22 firms actively developing risk management systems for operational risk. It describes instances of good practice, and discusses the progress that has been made so far. The main conclusion is that although considerable progress has been made, the industry is still at an early stage of developing operational risk frameworks. The report is available at http://www.fsa.gov.uk/pubs/policy/ps142_2.pdf PS142_2: Building a framework for operational risk management: the FSA's observations - Feedback on industry practice as we prepare to implement CP142 This Policy statement reports on the main issues arising from Consultation paper 142 ('Operational risk systems and controls') published in July 2002. It can be found at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2003/PS142_2.shtml. CP140: The Interim Prudential Sourcebooks for Insurers and Friendly Societies and the Lloyd's Sourcebook: Guidance on Systems and Controls Consultation paper 140 from the FSA sets out guidance on •high-level controls; • risk assessment; • legal risk; • internal audit; • management information; • outsourcing; and • group risk. This guidance will take effect before the Prudential Sourcebook is implemented in 2004. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2002/140.shtml. It was issued in July 2002 and the consultation period ended on 3rd October 2002. PS140 is the result of the consultation. PS140: The Interim Prudential sourcebooks for Insurers and Friendly Societies and the Lloyd's sourcebook: Guidance on Systems and controls - Feedback on CP140 and 'made' text Policy statement 140 from the FSA sets out guidance on •high-level controls; • risk assessment; • legal risk; • internal audit; • management information; • outsourcing; and • group risk. This guidance was issued in December 2002 and is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2002/ps140.shtml. It takes effect from 1st February 2003. PS142: Operational risk systems and controls - Feedback on CP142 This Policy statement reports on the main issues arising from Consultation paper 142 ('Operational risk systems and controls') published in July 2002. It can be found at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2003/ps142.shtml. PS04/16: Integrated Prudential sourcebook for insurers This Policy Statement reports on the main issues arising from Consultation Paper 190 (Enhanced capital requirements and individual capital assessments for non-life insurers), Consultation Paper 195 (Enhanced capital requirements and individual capital assessments for life insurers) and the audit and reviewing actuary proposals in Consultation Paper 202 (Insurance regulatory reporting – changes to the publicly available annual return for insurers) and publishes the associated rules and guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/Policy/2004/04_16.shtml. CP 142: Operational risk systems and controls Consultation paper 142 from the FSA contains feedback on the operational risk and systems and controls sections of CP97, and contains new draft guidance. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2002/142.shtml. It was issued in July 2002 and the consultation period ended on 31st October 2002. PS97_115: Integrated Prudential Sourcebook - Feedback on CP115 (Integrated Prudential Sourcebook - timetable for implementation) and CP97 (Integrated Prudential Sourcebook) This policy statement from the FSA was issued after feedback on CP97 and CP115. It was issued in July 2002 and is available at http://www.fsa.gov.uk/pages/Library/Policy/Policy/2002/ps115_97.shtml. Building the new regulator: Progress report 2 The Financial Services Authority have issued a series of reports outlining their new risk-based regulatory framework. This report, issued in February 2002, describes their risk-based operating framework and what it means for the firms that they regulate. In particular, it includes (as Appendix B) a probability assessment matrix that provides the risk classification system that they use. Note that the FSA is interested only in risks to their statutory objectives, and that these may not be the same as, for example, risks to shareholder value. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress2.pdf. Building the new regulator: Progress report 1 This is the first report in the series issued by the Financial Services Authority. It was published in December 2000, and describes the risks to the FSA's statutory objectives and the method of assessing the impact of particular risks. It then goes on to consider how the probability of risks can be assessed. In Appendix 1 it provides five case studies of the impact/probability assessment framework, indicating the regulatory relationships that would be likely for various combinations of impact and probability. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress1.pdf. The future regulation of insurance: A progress report Despite its title, this report can be seen as the third in the Building the new Regulator series issued by the Financial Services Authority. It was issued in October 2002. It sets out the regulatory agenda (for insurance firms) for the next few years, and is a result of the so-called Tiner project. It emphasises that firms should realise that the new style of regulation means that they should modernise their governance and risk management frameworks, and their systems and controls. Half a dozen areas of particular concern are highlighted. The report is available at http://www.fsa.gov.uk/pubs/policy/bnr_progress3.pdf. A new regulator for the new millennium This is the precursor to the Building the new Regulator series of reports issued by the Financial Services Authority. It describes the FSA's statutory objectives and its approach to regulation, including the operating framework and regulatory tools. The report, which was published in January 2000, is available at http://www.fsa.gov.uk/pubs/policy/p29.pdf. Quantifying operational risk in general insurance companies A paper presented to the Institute of Actuaries in 2004. The paper is available online from my publications page. CP97: Integrated Prudential Sourcebook Consultation paper 97 from the FSA is a massive document, presenting the draft Integrated Prudential Sourcebook. It is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2001/97.shtml. It was issued in June 2001 and the consultation period ended on 31st December 2001. CP115 was a supplementary CP to CP97. CP97 has been superseded by its feedback documents: PS97_115, CP142, CP143. CP190: Enhanced capital requirements and individual capital assessments for non-life insurers Consultation paper 190 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in July 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP190 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/190.shtml CP195: Enhanced capital requirements and individual capital assessments for life insurers Consultation paper 195 from the FSA discusses how capitial requirements will be determined for non-life insurers. It was issued in August 2003, and the consultation period ended on 30 November 2003. The overall effect of the proposals will be to introduce a new risk-based minimum requirement, the ECR (Enhanced Capital Requirement), and the concept of ICG (Individual Capital Guidance) which will take into account both the ECR and the systems and controls that firms have in place. CP195 is available at http://www.fsa.gov.uk/Pages/Library/Policy/CP/2003/195.shtml Operational Risk. Measurement or Bust! A working party report presented at GIRO 2003. The report and slides for the presentation are both available online from my publications page. Operational Risk in General Insurance A working party (of which I was a member) presented a report on operational risk in general insurance to GIRO 2002. The report and slides for the presentation are both available online from my publications page. CP143: Integrated Prudential sourcebook - Feedback on chapters of CP97 applicable to insurance firms and supplementary consultation Consultation paper 143 from the FSA contains feedback on some of CP97. There are two areas on which the FSA is consulting again: credit risk for insurers, and final bonuses on with-profits policies. It is available at http://www.fsa.gov.uk/pages/Library/Policy/CP/2002/143.shtml. It was issued in July 2002 and the consultation period ended on 31st October 2002. Current consultations at the FSA The FSA maintain a list of current consultation and discussion papers at http://www.fsa.gov.uk/pages/Library/Policy/CP/current/index.shtml.
Copyright © 2003-2008 Louise Pryor. All rights reserved. Site developed by Louise Pryor. Louise Pryor is no longer practising as a consultant — the site is maintained as an archive, and is not updated.