Monitoring and Evaluation Quiz

EastWest Bank Management Development Program: Module 5 - Risk Monitoring

• Program offered by EastWest Bank
• Module 5 is titled Risk Monitoring
• Instructor: Atty. Mara Villegas
• Presented through CORE (Continuing Real-World Education)

Agenda

• A. Risk Management Information System: Introduces the risk management information system
• B. Risk Management Communication Guidelines: Outlines guidelines for clear communication regarding risk management.
• C. Data for Stakeholders: Discusses how data are presented to stakeholders.
• D. Methods in Horizon Scanning: Covers various methods involved in horizon scanning

Icebreaker: Risk Response Simulation: Safeguarding the Bank

• Objective: To enhance understanding of identifying, monitoring, and controlling risks in a banking environment through practical scenarios.
• Instructions: Divide class into groups of 3-4. Assign scenarios based on different risk types faced by banks. Identify the specific risk. Propose monitoring metrics and early warning indicators. Develop a detailed control and mitigation strategy. Outline an escalation and communication plan.

Scenario #1: Cybersecurity Risk

• Description: A phishing attack compromises an employee's credentials, giving hackers access to sensitive customer data (account numbers and transaction history).
• Key Questions: How to detect and monitor such breaches? What steps should be taken to control the risk and prevent further damage? How to handle communication with customers and regulatory agencies?

Scenario #2: Credit Risk

• Description: The bank observes a 20% increase in non-performing loans (NPLs) within its small business loan portfolio, attributed to an economic slowdown.
• Key Questions: What metrics will help to monitor this risk early? What policies or strategies can be implemented to mitigate the impact of NPLs? How to balance customer retention with risk management?

Scenario #3: Market Risk

• Description: A sudden hike in interest rates leads to a significant drop in the value of the bank's fixed-income investment portfolio.
• Key Questions: How to monitor this risk on a daily/weekly basis? What risk control measures should be in place to minimize the impact? How to revise investment strategies in response?

Scenario #4: Operational Risk

• Description: A critical system outage occurs in the bank's online transaction platform, resulting in delayed payments and frustrated customers.
• Key Questions: What indicators should have flagged this risk in advance? How to manage customer relations and minimize reputational damage? What long-term controls should be implemented to avoid recurrence?

Scenario #5: Regulatory or Compliance Risk

• Description: The central bank issues new anti-money laundering (AML) guidelines, requiring significant updates to the bank's reporting and monitoring systems. Current systems are outdated.
• Key Questions: How to monitor compliance with the new guidelines? What steps are needed to align internal systems with regulatory requirements? How to address potential penalties or fines during the transition period?

Scenario #6: Fraud Risk

• Description: A noticeable rise in fraudulent credit card transactions originating from a specific region, suggesting internal collusion.
• Key Questions: What measures should be taken to monitor and detect fraudulent activity? How to investigate and address potential internal threats? What systems/controls can reduce fraud exposure?

Risk Identification

• Describe the Risk: This step involves identifying the risk, causes and impact.
• Key Metrics to Monitor: Determining how the identified risks will be monitored.
• Tools and Systems: Identifying the correct tools and systems available for the monitoring process.

Risk Mitigation and Control

• Proposed Mitigation Strategies: The immediate steps to take in response to a risk.
• Preventive Controls: The measures put in place to avoid a specific risk.
• Contingency Plan: A backup plan in the event of risk escalation.

Escalation and Communication Plan

• Escalation Protocol: Procedures used to notify necessary personnel regarding the risk.
• Customer Communication: Procedures used in communicating with customers.
• Lessons Learned & Long-term Measures: Strategies to improve the handling of future risks.

Team Member Roles

• Definition of roles: Defining responsibilities for each team member in response to risk.

Risk Management Information System (RMIS)

• Definition: A crucial tool for organizations in today's rapidly evolving business landscape, a comprehensive software that collects, analyzes, and manages risk and insurance data related to organizations.
• Purpose: Real-time information enables organizations to make informed/timely decisions addressing risks, mitigating threats, and improving opportunities. Identifies potential pitfalls before financial impact.

Purpose of RMIS

• Record risk details with priorities and changes.
• Record risk treatments and related resource requirements.
• Record incidents and lessons learned.
• Track accountability for risks.
• Track progress and record risk treatment actions.
• Allow progress checks against risk plans.
• Allow monitoring and assurance activity.

Expecting Risk

• Key types of risk are listed.

Propose Risk Management

• A flow chart illustrating processes to be followed in risk management.

Risk Management Performance System

• Risk management and performance measurement must be linked in order to consider supply chain partners, define and guide the overall risk profile, and shape strategic direction.

Awareness

• Risk management team must be aware of risks.
• Stakeholders must be aware of risk management process requirements

Skills

• Stakeholders need risk management skills.
• Identify skills of indirectly connected personnel.

Culture

• Risk management process must comply with the company culture and mission/vision.
• No stakeholder should feel uncomfortable with the process.

Process

• Whether the risk management method adheres to contractual, procurement, and management practices.

Confidence

• Consider stakeholder confidence in risk management.
• Gather feedback and incorporate ideas into the risk management system.

Applications

• Evaluate the efficiency of the risk management system on daily operations.

Risk Review

• The Group Risk Manager will manage the risk process, including the rollout of the risk management program (periodically).
• Project Risk Management will be conducted similar to Corporate Risk Management, and the Project Manager is responsible for risk management

Analyzing the Risk Management System

• Determine whether the system minimized risks and maximized efficiency.
• How the system complied with the bank’s operations.
• What solutions were employed to manage the risk.
• Identify any necessary amendments or improvements for the system.
• Prioritize any needed changes or modifications.
• Evaluate emerging risks needing attention.
• Identify necessary implementations to address new risks.

Recording the Monitoring Process

• Record details from the Risk Monitoring process for easy reference and for spotting system defects, preparing for future risks.

Risk Management Communication Guidelines

• Audience Dynamics: The subject experts and the general public play a key role in risk communication; it’s a two-way exchange of information and opinions.
• Traditional vs. Current Practices: Traditional communication is a “tell” process; Current is more of a multi-directional/dynamic process which is key in crises.
• Integration w/Company Culture: Know your stakeholders, make them partners in managing risk, foster two-way communication, listen to feedback, frequently assess stakeholder relationships, and determine lessons learned.
• Return on Investment: Risk communication leads to better plans, greater goodwill, better stakeholder relations, fewer issues, less damaging rumors.
• Identifying Our Audience – Frequency – Approvals: Considerations for identifying the target audience, frequency of communication, approval process for communications.
• Presenting the Plan – Communication Approach: How to make the plan in terms of style and content
• Risk Management Communication Plans (internal/external): Charts to guide process planning for both internal and external audiences involved.

Data for Stakeholders

• A set of presentations detailing methods of storytelling with data, types of data visualizations and charts (line charts, bar charts, stacked bar charts, pie/doughnut charts, area charts, combination charts, scatter plot), the PESTLE model for analysis, the flow of goods & services, GDP (Gross Domestic Product) considerations, Benchmarking (including advantages, disadvantages, features), Competitive Strategy, and a thorough overview of Business & Strategy and Strategy Management. Includes slides for important topics such as The Flow of Goods and Services (Macroeconomic Indicators), Indicators of Country’s Aggregate Output (Macroeconomic Indicators), and sections on Setting up Risk Indicators, Keeping Track, Monitoring vs. Evaluation.

Methods In Horizon Scanning

• Definition of Horizon Scanning: Reading a range of information (academic, news etc.) and identifying changes and trends, through interviews and workshops.
• Different Frameworks: Using frameworks like PESTLE (Political, Economic, Societal, Technological, Environmental, Legal ) to identify signals of change in various domains.
• Steps for Horizon Scanning: Identifying horizon scan hits, clustering themes, establishing relationships, and outlining analysis for further steps to be taken.
• Benefits of Horizon Scanning: Identifying change drivers to be prepared, identify and test assumptions about the future.
• Limitations of Horizon Scanning: Cognitive biases, interpretation required, and information may not be readily understandable.
• Example of Horizon Scanning: JP Morgan’s use of economic indicators and geopolitical developments to advise clients.

Incident Response

• Goals: Confirm whether an incident occurred, minimize disruption, promote accumulation of accurate information, project privacy rights, provide accurate reports, allow legal action against perpetrators, protect reputation, educate senior management.
• Incident Prioritization: System for prioritizing incidents based on impact (people vs service) and severity (time).
• Incident Severity Levels: Extreme, High, Medium, Low, Insignificant. Descriptions and impacts of each level are detailed.
• Team Responsibilities: Outlines various roles (Incident Response Lead, Liaison, Legal, Investor Relations, Public Relations, IT Ops, IT Security, Loss Prevention) and their responsibilities and contact information.
• Incident Management Communication Plan: Charts to outline communication strategies, channels, and timeframes based on incident severity.
• Risk Matrix (Likelihood and Consequences): A matrix to map incident likelihood and consequences to various response levels (Insignificant, Minor, Moderate, Major, Critical).
• Incident Management Process Flow: Diagram of how an incident progresses through identification, logging, categorization, notification, diagnosis, resolution, and closure.
• Time Guidelines: Specifies the time limit for responding to incidents based on severity (3-low, 2-medium, 1-high).
• Incident Management Best Practices: Covers areas like Accessibility, Communication, Automation, and Motivating Agents.
• Plan of Action (Reaction, Recovery, and Reporting): Details steps for responding to critical incidents, recovery procedures, and reporting requirements.

Test your knowledge on the principles and practices of monitoring and evaluation. This quiz covers data visualization, the importance of stakeholder involvement, and key concepts required for effective evaluation. Assess your understanding of the critical steps in the monitoring process.