HN
Already since Basel II (banking area) and Solvency (insurance area) people are talking about incident and loss management. The main focus is to be able to calculate the expected loss value. Based on this calculation it is possible to estimate the corresponding need of equity that has to be saved to cover the losses. This means that the actual losses have to be aligned with the actual risk capital and the risk assessments have to be checked because of the incurred losses/near losses. This way the risk assessments of already recognized risks can be improved or new risks are detected. As a result of this risk analysis, controls and measures to mitigate the risk can be defined. The benefit is obvious: The better I can estimate the expected loss values and control my risks, the less money has to be saved for covering incurred losses.
The lately released module of ARIS Risk & Compliance Manager (ARCM) exactly supports this procedure. Let me explain you with a simple example how it works:
Step 1: Identification of incidents
The first step is to identify the incident. A loss or a near loss is seen as the result of an incident. In our example let’s assume we are a production company and there was a fire in our production hall. This “fire incident” now can be documented in ARCM with a description, with the occurrence and discovery date (in our case it’s the same of course) and some more information (e.g. some classifications that are needed for Basel II). Furthermore it is possible to define which organizational units, processes, application system types or financial statement items (to show the impact on the balance sheet) are affected by the incident and a first estimation of the overall loss can be given.
Step 2: Calculation of losses
In the next step the loss that resulted from our “fire incident” can be documented. So on the one side of course there is a physical damage in our production hall but on the other side our company also may have to pay a contract penalty because we couldn’t deliver our product to a customer in time. So our “fire incident” resulted in two different losses. Within the detailed description of our loss I decide for example if it was a direct or an indirect loss, a near loss or even a gain. Additionally there is now the possibility to define the exact value of the loss. In this case there is a difference between the gross and the net value because in our example we may have had a fire insurance that covers a part of our loss. This means that the net value is less than the gross value.
Step 3: Checking of risk assessments
In the last step I assign the loss to one or more risks. In our example I could assign the loss of the damaged production hall to the” risk of fire” and the loss because of the contract penalty to the “risk of production downtime” or I could assign both losses to the” risk of fire”. This depends on my personal decision of course. In our example I wouldn’t assign both of them to the” risk of fire”. The reason is that in the end of the year I want to know the sum of all losses connected to the “risk of fire” to decide about the capital amount of my fire insurance (which doesn’t cover the losses of a contract penalty). Besides this assigning possibility to a risk I can assign the loss also to different financial statement items as well as to different processes, organizational units and/or application systems.
Step 4: Definition of controls and measures
With all the incidents/losses documented, estimated and assigned there are now various evaluation possibilities such as losses per risk, losses per financial statement item, losses for a particular period of time etc. which are the basis for the decision about controls and measures to mitigate the risks. This way a continuous improvement of our risk and control management can be guaranteed.
An overview of the example can be found here:
.PNG)
