Risky Business: Risk Management on the Road to Innovation

1. Risky Business: Risk Management on the Road to Innovation How to Manage Risk in an Innovative Culture April 23, 2009 Bethany Spaulding, CMA, CPA, CCSA, CRP Federal Reserve Bank of St. Louis

2. Federal Reserve System • Twelve Federal Reserve Banks • The St. Louis Reserve Bank • Seven States • Four Offices • St. Louis • Memphis • Little Rock • Louisville

4. St. Louis FRB • Central to America’s economy • Promote stable prices and economic growth • Foster a sound financial system • Support the US Treasury’s financial operations • Provide payment services to financial institutions • Advance economic knowledge, community development and fair access to credit • www.stlouisfed.org

5. Enterprise Risk Management (ERM) • ERM is a process to aid management in identifying and mitigating (or capitalizing on) events that could affect the organization’s ability to meet its goals • “Comfort level” for the board and stakeholders that the full range of risks is understood and managed

6. Destination: Innovation • Enterprise Risk Management supports innovation by providing a strong operating foundation: • Identify risks • Manage risk taking and assess innovative ideas to stay within the organization’s “risk appetite” • Improve the quality and flow of information for decision makers • Focuses attention on the achievement of organizational goals (innovation)

7. Intersection: Risk Management & Innovation • Risk management is notabout eliminating risk • It is about making informed RISK CHOICES • Making good choices can free up resources for innovation • Communication of choices and risks to stakeholders is key • Monitoring for changes in risks supports innovation and agility

8. ERM Components • St. Louis FRB ERM characteristics include: • Commitment • Integration • Stakeholder benefit • Accountability

9. Commitment • Executive ownership • Audit Committee • Management Committee • ERM Advisory Committee • Department/business line management • Risk Officer

10. Integration • Strategic planning • Strengths, weaknesses, opportunities and threats (SWOT) • Environmental factors • Top risks • Organizational performance assessment (Dashboard) • Results of other processes • Business continuity, information security, compliance, projects, self audits

11. Integration

12. Stakeholder Benefit • Enhanced information: • Top risks with trend analysis/cross-divisional risk analysis • SWOT/Environmental assessment • Reports/analysis to stakeholders • Identify risks that lack sufficient mitigations and focus attention on other mitigating activities • Incorporation of best practices • Ad hoc risk evaluation

13. Accountability • Embedded in business areas • Top-down, bottom-up design: • Roles and responsibilities outlined • Departments update risks • Risk discussion required in strategic plan and budget presentations • Periodic monitoring and assessment • Projects, self audits, business continuity, information security • Risk management skills are expected of management

14. Enterprise Risk Management Integration Plan 1 Strategic Plan, Objectives, Environmental Factors, Risks 5 Execute Adjust Processes, Tactics, Controls, Risk Mitigation Strategy, Structure, or Processes Mission Vision Values 2 Culture Education Training 4 Communicate Monitor and Analyze Metrics, Status, Risks, Compliance Metrics, Status, Business Results, Issues, Risks, etc. 3

15. ERM Infrastructure • ERM is integrated into the culture • SWOT - Strengths, Weaknesses, Opportunities, Threats Analysis • Strategic Plan • Risk Appetite • Risks to Strategic Plan/Organization • Project-specific risk assessments • Monitoring of Plan and Risks • Adjustments to Plan and Risk Mitigation • Communication to Stakeholders

16. Environmental Scan (SWOT)

17. Maps & Directions • Strategic Plan • Where are we going? • How does our SWOT analysis inform our plan? • What are our critical success factors to achieve the plan? • Where do we have gaps in SWOT against success factors? • Risk Appetite • What level of risk to our plan and processes are we willing to accept?

18. Roadblocks & Opportunities • Identify risks, their drivers and any environmental factors • What keeps you up at night? • What has to happen to meet your goals? If it doesn’t, then what? • Evaluate potential impact if a risk occurs (see rating scale) • Identify/evaluate controls in place • Evaluate impact and likelihood of the risk occurring after controls • Develop action items where the risk level after controls is not acceptable • Or for taking advantage of an opportunity

19. Common Signage • Strategic Risk • Ability of an organization to achieve its mission or objectives • Operational Risk • Events related to internal and external processes, people and systems • Reputational Risk • An event that could diminish organizational stature, credibility or effectiveness. • Credit Risk • Ability of a borrower, counterparty or customer to meet its financial obligations • Market Risk • Market concerns, asset values

20. Sample Risk Rating Scale

21. Risk Example 1

22. Risk Example 2

23. Strategic Risk Monitoring Organization XXX Strategic Risk Overview XX Quarter 2008

24. Strategic Risks by Category [1]= Indicates trend of the risk Risk before and after controls is a combined view of impact and likelihood.

25. Strategic Risk Detail

26. Innovation & Risk • Risk management is key to innovation • Focuses resources to activities most important to the organization • Identifies key risks to achieving goals (including innovation) • Provides the Board of Directors with enhanced information to make choices about the organization’s direction

27. Questions? Contact Information: Bethany Spaulding 314-444-4681 Bethany.Spaulding@stls.frb.org