System of Documents and Internal Regulations on Operational Risk Management of Vietnam Joint Stock Commercial Bank for Industry and Trade

2.3.1.2. System of documents and internal regulations on operational risk management of Vietnam Joint Stock Commercial Bank for Industry and Trade

Based on the legal framework, the system of policy documents on operational risk management of the State Bank and based on its objectives, strategies and actual business performance in each period, Vietinbank has gradually built a system of documents and internal regulations on appropriate operational risk management, in order to thoroughly grasp the objectives, disseminate regulations on operational risk management for all bank officers and employees to understand and strictly implement. The system of documents and internal regulations on operational risk management of Vietinbank can be generalized as follows:

- Risk Management Framework: Vietinbank issued Decision No. 773/2018/QD-HDB-NHCT64 dated November 30, 2018 regulating the issuance of the Risk Management Framework. This document applies to risk management activities in the Vietinbank system. Accordingly, Vietinbank clearly stipulates the principles of risk management, as a foundation for the system of policy documents, organizational structure and management methodology of key risks; determines the authority and responsibility of units and individuals related to risk management in the Vietinbank system. Risk management policies and risk limits, key risk management steps and specific cases are also detailed in this document.

- Operational Risk Appetite Statement: Vietinbank's operational risk management objectives are documented in the Operational Risk Appetite Statement, which represents Vietinbank's views on risk acceptance levels in each operational activity. This is also the will and leadership viewpoint of the Senior Management Board in operational risk management. In the Operational Risk Appetite Statement, Vietinbank defines operational risk as "an operational risk that has occurred, has caused losses to the Bank (operational risk loss event) or has not caused losses but has the potential to cause losses if there are no timely control measures or measures to overcome and minimize risks (near-loss event)"

Maybe you are interested!

Risks arising at Vietinbank are classified according to specific risks in order to monitor and manage risk risks throughout the bank in a consistent and appropriate manner.

consistent with the characteristics of Vietinbank's business activities in each period and the State Bank's regulations, including: Human resource risks; Tangible asset risks; IT application risks; Policy document risks; Internal information security risks and Customer information security risks; Operational risks; Outsourcing risks; Business interruption risks; Internal fraud risks, External fraud risks, Compliance risks.

- Regulations on operational risk management: Vietinbank also issued Decision No. 804/2018/QD-HDQT-NHCT7 dated December 25, 2018 on promulgating regulations on operational risk management. This document applies to Vietinbank's Head Office, regulating principles on operational risk management, serving as a foundation for the system of policy documents, organizational structure and operational risk management methodology; defining the authority and responsibility of units and individuals related to operational risk management of Vietnam Joint Stock Commercial Bank for Industry and Trade.

Accordingly, Vietinbank develops and specifies in detail the three-line protection model for operational risks and the operational risk management cycle including the following steps: (1) Identify operational risks; (2) Measure and evaluate operational risks; (3) Monitor operational risks; (4) Control operational risks and (5) Report operational risks. At the same time, the operational risk management regulations also define the principles for handling violations of operational risk management and measures to prevent the consequences of these violations.

- Regulations on management of operational risk events: Decision No. 1368/2019/QD-TGĐ-NHCT7 regulates the management of operational risk events in the Vietinbank system. This document applies to all operational risk events occurring at branches and headquarters, stipulates requirements, procedures, and processes for managing operational risk events and defines the authority and responsibility of individuals and units related to the management of operational risk events at Vietinbank.

- Regulations on operational risk management tools: Vietinbank issued the Operational Risk Self-Assessment (RCSA) Process; Loss data collection process

(LDC); Process for establishing and managing key risk indicators (KRI); Regulations on business continuity management (BCM) and Regulations on calculating capital for operational risks. This is a system of detailed documents regulating the content and method of using operational risk management tools at Vietinbank.

In addition to the above system of internal documents, Vietinbank also issues internal policies and standards applicable to its own officers and employees to ensure that operational risks that may violate the regulations of the State Bank and cause damage to the bank are avoided: A set of standards on expertise, professionalism, ethics, and conduct of bank officers and employees are developed and applied throughout the system; Regulations on internal inspection and control of the bank ensure cross-control and vertical control; Regulations on the Risk Profile Management system, according to which head office units propose measures to inspect, supervise, monitor and support branches with high risk levels to minimize the level of impact and frequency of occurrence; Promulgate and adjust regulations, processes, products, documents guiding system operation, handling operations, etc.

In general, Vietinbank's system of documents and internal policies on operational risk management is relatively complete and covers most of the bank's activities. However, at present, this system of documents and policies also needs to be reviewed and rebuilt in a more consistent and synchronous manner, avoiding the situation where old and new documents are intertwined, patchwork and not suitable for practice. This is an important factor to help the bank implement operational risk management effectively and scientifically.

2.3.2. Current status of operational risk management at Vietnam Joint Stock Commercial Bank for Industry and Trade from 2015 - 2019

2.3.2.1. Contents of operational risk management at Vietnam Joint Stock Commercial Bank for Industry and Trade

a. Current status of operational risk management organization

The operational risk management organization model with the participation of Blocks/Departments/Divisions at Vietinbank can be described as follows:

Figure 2.2. Organizational structure of Vietinbank's Risk Management

General meeting of shareholders

Board of Control

Department of Internal Audit

Third line of defense

Board of Directors

Risk Management Committee

CEO

Risk Council

Deputy General Director/Director

Department of Natural Resources and Environment

Compliance Management Department

Second line of defense

TCS Unit

clue

TSC focal unit

Branch

First line of defense

(Source: Author's own synthesis)

In there:

First line of defense:

Including Branches, Headquarters Units and related Headquarters Units to implement Risk Management at the unit including identification, measurement, monitoring, control and reporting Risk Management; proposing and establishing Risk Management Measures/actions to minimize risks/implementing remedial measures to address control gaps.

 Responsible for operational risk management in business operations.

 Units: Branches, Lead TSC Units and Related TSC Units.

Second line of defense:

Including Operational Risk Management and Compliance Management Department. In which, Operational Risk Management Department is responsible for managing 8 specific types of Risks, Compliance Management Department is responsible for managing 4 specific types of Risks.

 Responsible for providing operational risk policies, minimum standards and guidelines and ensuring these are followed in business operations.

 The Operational Risk Management Department and the Compliance Management Department are supported by the Risk Council at the executive level.

Third line of defense:

At the 3rd Line of Defense, Vietinbank established a Control Board with an Internal Audit Department under it. The function of the Internal Audit Department with Risk Management is to independently inspect and evaluate compliance and effectiveness of Risk Management, and make recommendations and necessary amendments to increase the effectiveness of Risk Management.

 Provide independent assurance on the integrity of the operational risk model.

 Includes Internal Audit, the entity responsible for independently examining and challenging the control system.

Each department, unit, and Division/Office in the risk management organizational structure at Vietinbank has its own specific and clear functions and tasks, but all operate based on the principle of unified risk management throughout the system, originating from the risk management strategy of the Board of Directors. However, looking at the current situation of recent risks occurring at Vietinbank and the damage they have caused, it can be seen that there are still gaps in risk management in general and the risk management organizational structure in particular, especially in the first line of defense, where the awareness of the staff directly implementing risk management of their unit through professional expertise in business activities has not been highly appreciated.

b. Current status of using operational risk management tools of Vietinbank

The tools currently used by Vietinbank include: Loss Data Collection (LDC); Self-Assessment (RCSA); Key Risk Indicators (KRIs); Business Continuity Management (BCM); Operational Risk Budget. These tools are used to evaluate the effectiveness of the process of implementing QLRRTN, NCS will analyze in depth.

The implementation status of LDC, RCSA, KRIs, BCM and risk capital calculation tools at Vietinbank is as follows:

First, the Loss Data Collection - LDC tool

Collecting loss data is the first step in the bank's risk management process, which is the basis for identifying risks as well as measuring and evaluating risk, and is also the basis for calculating capital for risk according to modern methods.

The process of collecting loss data at Vietinbank is well-established and quite strict, through the issuance of Decision No. 368/2019/QD-TGĐ-NHCT7 dated October 25, 2019 on the Regulations on management of SKRRTN. Accordingly, the RRTN Management Department is the focal point, coordinating with the IT Center to develop and deploy software to identify and collect loss information of SKRRTN in the entire system. Branches and units of the Head Office proactively detect, monitor and regularly update the SKRRTN list according to the main areas of responsibility on the Risk Profile (RP), coordinate with the RRTN Management Department and focal units of the Head Office to measure, evaluate and review RRTN.

SKRRTN are collected and declared in the system with very detailed information such as description, unit, date of occurrence, date of detection, which business, what is the cause, loss data, how to fix it... Loss data is controlled by the unit's control department and approved by the specialized QLRRTN focal department and the QLRRTN Department.

Figure 2.3. Loss Data Collection (LDC)

(Source: [40])

Loss data of SKRRTN as prescribed by Vietinbank must be collected for all products, regulated business activities, business processes, IT systems and other management systems. Collection of loss data of SKRRTN must be done through internal and external factors of the bank and classified according to: (i) Business; (ii) Specific types of RRTN as prescribed by Vietinbank; (iii) RRTN cases as prescribed by the State Bank.

When collecting loss data of SKRRTN, Vietinbank also stipulates that it is necessary to properly record SKRRTN losses, accordingly, it is necessary to determine information related to (i) Total loss value; (ii) Recovery value; (iii) Net loss value; (iv) Non-financial impact directly related to SKRRTN.

Data collection, loss measurement synthesis and reporting of SKRRTN at Vietinbank are carried out periodically, weekly, monthly and quarterly as well as when unusual SKRRTN arise. SKRRTN are collected and built into specific categories in each period. It can be said that the LDC tool is effectively and specifically applied at Vietinbank, is an effective tool for data storage, creating a foundation for the bank to provide solutions to ensure effective risk management.

Second, the Risk Control Self Assessment - RCSA tool:

In addition to the LDC tool, RCSA is also a useful tool that Vietinbank regularly applies in the risk management process to identify and evaluate risk. RCSA is implemented across all business units at the Head Office and Branches. RCSA implementation is continuously innovated and updated regularly with the selected method being interviews with units at the Head Office.

RCSA has been applied to most departments such as: Human Resources, Treasury, Cards, Ebanking, IT, Treasury...

Vietinbank has issued a decision on the Procedure for Self-Assessment of Operational Risks and Control Measures in the Banking System. Accordingly, the implementation of RCSA includes the following steps:

- Step 1: Determine the workflow for implementing RCSA

- Step 2: Plan to implement RCSA

- Step 3: Approve RCSA implementation plan

Also according to the regulations, when implementing RCSA, it is necessary to select work streams and determine the expected start and end time of the RCSA process for each selected work stream. The Deputy General Director/Director of the business/operational division approves the RCSA implementation plan after reaching an agreement with the Risk Management Department. The Risk Management Department synthesizes the RCSA implementation plan for the entire company and submits it to the Director of Risk Management and the General Director for approval. The steps to implement RCSA are described in Figure 2.5 below.

Figure 2.4. RCSA implementation process

Prepare

Perform

Monitor

Identify RRTN

RR Assessment - Identify and Evaluate BPKS Effectiveness

Action Plan

Report

Assess the level of internal RR

Determine BPKS

Evaluate the effectiveness of the remaining BPKS RR

-RCSA planning

-Agree on workflow goals

- Collect information and documents

- Unify related units

-Determine workflow

-Recognize RRTN

latent in every step of work

1. Assess the level of internal RR

-Ranking RR based on the likelihood and impact of RR

-Select important risks, determine the origin of risks and classify risks

- Identify the unit at risk

2. Determine BPKS

- Identify the BPKS corresponding to each identified important RRTN

- Determine the BKS design unit and the implementation unit 3. Evaluate the effectiveness of BPKS

-Evaluate the effectiveness of BPKS based on design and implementation

4. Determine the remaining RR level

-Remaining RR rating after evaluating the effectiveness of BPKS

Propose action plans

Report on RRTN categories,

RRTN map,

Trends and Action Plans

- Adjust RRTN portfolio

based on LDC, KRI.

-Re-evaluate the effectiveness of BPKS

-Monitoring the implementation of action plans

(Source: [40])

Comment