**Introduc on**
* **Context:** The financial services and risk management professions emerged with a
heightened focus on risk management following the Great Financial Crisis (GFC), aiming to
prevent similar events [1].
* **Current Environment:** Post-COVID-19, the financial services sector and risk
management profession face an increasingly vola le geopoli cal and environmental
landscape [2].
* **Enduring Frameworks:** Frameworks developed a er the GFC, such as risk appe tes
and key risk indicators (KRIs), remain valuable in well-managed firms. **Opera onal
resilience** is increasingly integra ng mul ple disciplines, including opera onal risk
management, cybersecurity, and disaster recovery [2].
* **Emerging Focus:** The declara on of a **climate emergency** by many governments
posi ons Environmental, Social, and Corporate Governance (ESG) as a crucial ini a ve for
firms in the 2020s. This chapter specifically focuses on the **climate risk** aspect of ESG as
it is most relevant to opera onal risk management [2]. Risk managers need to incorporate
climate risk into their overall risk management work and framework applica ons [2].
**Overview of Risk Management Frameworks**
* **Persistent Relevance:** Many fundamental elements of risk management, such as
performing risk assessments, understanding risk capacity and appe te, and determining
capital for opera onal loss events, are s ll useful. These are now presented alongside new
obliga ons and best prac ces related to climate risk [3].
* **Governance, Risk, and Compliance (GRC) Frameworks:**
* Risk management should be an integral part of a firm's overall GRC approach [3].
* An en ty (e.g., board, management team) must communicate the value of risk
management, provide challenge and oversight, and ensure adequate resources for risk
management. Failures due to poor governance are well-documented [3].
* **Enron Case Study (Box 1):**
* Once a highly innova ve energy trading company, Enron collapsed into bankruptcy
by the end of 2001 [4].
* Execu ves like Jeffrey Skilling and Andrew Fastow concealed declining profits using
mark-to-market accoun ng and Special Purpose En es (SPEs) [4].
* Audi ng firm Arthur Andersen failed to detect or report the wrongdoing. The
Securi es and Exchange Commission (SEC) inves gated, leading to fraud and conspiracy
convic ons for execu ves [4].
* Enron's bankruptcy devastated employee 401(k) savings and investors, promp ng the
**Sarbanes-Oxley Act** to prevent similar corporate misconduct [4].
* **Embedding Good Risk Management Prac ces:** To embed good risk management,
risk professionals should consider:
* **Engaging with non-execu ve directors:** U lize formal se ngs like board risk
commi ees to scru nize a wide range of risks, ensuring they are not merely "rubber stamps"
[5].
* **Providing good quality management informa on:** Deliver concise and
appropriate informa on to senior leaders to make them allies in high-quality risk
management [6].
* **Tes ng if governance processes are being used:** Ensure that important
organiza onal ma ers (e.g., major acquisi ons, product developments) pass through the
established governance processes [7].
* **Managing outsourcing risks:** Evaluate how risk prac ces extend to outsourced
service providers and address poten al failures from these third par es [8].
* **Ensuring appropriate reward structures:** Design reward systems that incen vize
long-term success and prudent risk management. Create safe and confiden al channels for
internal escala on and **whistleblowing**, as regulators increasingly rely on
whistleblowers for intelligence on corporate wrongdoing [9, 10].
* **Tolera ng eccentricity:** Consider the advice and insights from individuals who
may not conform to the organiza on's culture [11].
* **Risk Assessment, Incidents, and Informa on:**
* Risk managers spend significant me iden fying inherent risks, recognizing and
measuring mi ga ng controls, and ensuring residual risk remains within appe te [11].
* It is crucial to define the firm's **risk capacity** and ensure its **risk appe te** is
comfortably within that capacity [12]. Risk capacity can be defined by profitability/net
earnings, capital, liquidity, and reputa on [12].
* **AIB Rogue Trader Case Study (Box 2):**
* John Rusnak, a currency trader at Allfirst Financial (a U.S. subsidiary of Allied Irish
Banks - AIB), caused approximately $691 million in losses by falsifying trades in 2002. These
losses were absorbed by AIB's profits for that year [12].
* This incident could be seen as AIB exceeding its **risk appe te** but not its **risk
capacity** [12].
* Years later, during the Irish Banking Crisis, AIB incurred significant losses from
property and construc on investments. The Irish government injected €21 billion, indica ng
the bank had exceeded both its risk appe te and risk capacity [13].
* Effec ve risk assessment involves both top-down and bo om-up approaches. Using Key
Risk Indicators (KRIs) and learning from risk incidents helps measure and improve a firm's
risk profile [14].
* **Risk Capital:**
* **Opera onal risk capital** is the amount of capital a firm must hold to protect against
poten al losses from opera onal risks (inadequate/failed internal processes, people,
systems, or external events) [15].
* The required capital depends on the complexity and riskiness of opera ons and
inherent opera onal risk levels [15].
* **Basel II Accord** (mid-2000s) introduced approaches like the **Advanced
Measurement Approach (AMA)**, which allowed banks to quan fy risk management
investments for lower capital requirements. However, the GFC revealed AMA's shortcomings
in covering losses and predic ng conduct risk-related fines [16].
* In 2017, the **Basel Commi ee on Banking Supervision (BCBS)** finalized the **new
standardized approach (SA)** for opera onal risk capital, a non-model based method that
replaces all three exis ng Pillar 1 approaches. This new SA came into effect in January 2023
[16-18].
* **Resilience:**
* Opera onal resilience has been a regulatory concern in the 21st century due to outages
at financial services providers like RBS [19].
* **COVID-19 and Resilience (Box 3):**
* The COVID-19 pandemic (iden fied Dec 2019, declared March 2020) significantly
impacted global health, economies, and socie es. Lockdowns and remote work exposed the
fragility of the financial system [20].
* Organiza ons with prior investments in remote-working capabili es were be er
prepared and demonstrated resilience [21].
* The pandemic highlighted the need for organiza ons to update opera onal risk
management and resilience plans, inves ng in new technologies to prepare for future
disrup ons [21].
* Upcoming chapters will address emerging obliga ons for opera onal risk and cyber
resilience [21].
**ESG and Climate Risk**
* **ESG Overview:**
* Environmental, Social, and Corporate Governance (ESG) emerged as investors began
considering the sustainability and ethical impact of their investments [22].
* ESG ra ngs (e.g., from Ins tu onal Shareholder Services - ISS) incen vize firms to adapt
their ac vi es [22].
* **Environmental factors** relate to a firm's impact on the environment (e.g., carbon
emissions, promo ng nature diversity). Investors priori ze organiza ons reducing their
carbon footprint. Climate change impacts, such as damage from weather events, are
considered opera onal risks [23].
* **Social factors** involve an organiza on's impact on society (e.g., rela onships with
employees, suppliers, communi es). Investors seek firms promo ng diversity, inclusion,
employee well-being, and social responsibility (e.g., encouraging employees in
community/charitable events) [24].
* **Governance factors** pertain to internal management and control structures (e.g.,
board composi on, execu ve compensa on, risk management prac ces). Diversity within
boards is seen as leading to be er governed companies [25].
* Good ESG policies make firms preferred employers, suppliers, and investments, making
ESG a mainstream concern for individuals [26].
* **Nike and ESG (Box 4):**
* Nike faced cri cism in the 1990s for "sweatshops" and water pollu on [27].
* In response, Nike set ambi ous targets to reduce water usage, eliminate supply chain
waste, establish responsible leather sourcing, and remove hazardous chemicals [27].
* For social responsibility, Nike launched ini a ves to promote gender and racial
diversity internally and support underserved popula ons' access to sports [28].
* These efforts led to numerous industry awards for ESG awareness and con nued
growth in revenue, profits, and share price [28].
* **Climate Risk:**
* **Climate risk** refers to the increasing impacts businesses and society face due to
climate change [29].
* **Physical impacts** (e.g., extreme weather, droughts, sea level rise) cause damage to
physical assets, supply chain disrup ons, and health impacts. Physical climate risk is
considered the most relevant part of ESG for opera onal risk management [29, 30]. Such
risks have always been part of risk management (e.g., Basel categories of damage to physical
assets, business disrup on), but climate change necessitates more targeted responses than
tradi onal BCP/DR [30].
* **Transi on risk** concerns "stranded assets" and impacts from shi ing to a low-
carbon economy, changes in policy/regula on, and evolving consumer preferences [31].
* **Transi on Risk Case Study (Box 5):**
* The coal industry faces increased regulatory, financial, and reputa onal scru ny due
to global efforts to shi to a low-carbon economy (e.g., carbon taxes, emissions trading,
Paris Agreement) [31].
* Investors and financial ins tu ons are pressured to integrate climate risk into
investment and lending decisions, leading to withdrawals from fossil fuel investments. Many
coal companies have faced significant challenges and closures, resul ng in "stranded assets"
[31].
* Organiza ons are urged to assess and develop strategies to manage and mi gate
climate risks [32].
* **Task Force on Climate-related Financial Disclosures (TCFD) (Box 6):**
* Established in 2015 by the Financial Stability Board (FSB), TCFD is a global ini a ve to
develop voluntary, climate-related risk disclosures [32].
* Its work is based on **four key pillars**:
* **Governance:** Companies must disclose board oversight of climate-related risks
and opportuni es [33].
* **Strategy:** Companies must disclose actual and poten al impacts of climate-
related risks and opportuni es on business, strategy, and financial planning [33].
* **Risk management:** Companies must disclose how they iden fy, assess, and
manage climate-related risks [33].
* **Metrics and targets:** Companies must disclose the metrics and targets used to
assess and manage relevant climate-related risks and opportuni es [34].
* TCFD recommenda ons are voluntary but widely adopted as best prac ce for climate
risk repor ng [34].
* **Integra ng Physical Climate Risk into the Risk Management Framework:**
* **Risk Governance and Risk Management Framework:** Governance defines policies
and procedures for decision-making [35]. Boards should integrate physical climate risk into
the risk management framework, including risk appe te and policies [35]. This requires
communica on, updated policies (defining physical and transi on risk), and updates to risk
capacity and appe te. New threats to firm resources (capital, profits, liquidity, reputa on)
from physical climate risk must be considered, poten ally through stress tes ng [36].
* **Risk Assessment:** A founda onal program for opera onal risks, including physical
climate risk, using both top-down and bo om-up approaches [37].
* **Bo om-up:** Map how assets (premises, people) might be impacted. Built on
exis ng Business Con nuity Planning (BCP) / Disaster Recovery (DR) approaches [37].
* **Top-down:** Workshops and scenario analysis for new risks like sea level rise or
dras c flooding, aided by mapping tools. Mi ga on measures include improving
infrastructure, diversifying supply chains, and reloca ng vulnerable assets. Track physical
climate risks from iden fica on to control assessment, issue tracking, and ac on plan
execu on [38].
* Third-party service providers in remote/global loca ons are a significant area of risk
due to extreme weather events [38].
* **Risk Informa on and Risk Incidents:**
* A key challenge is iden fying relevant data and sources for physical climate risk (e.g.,
sea levels, projected rise, climate data) [39].
* Develop **Key Risk Indicators (KRIs)** related to physical climate risk and link them
to the firm's risk appe te [39].
* The opera onal risk func on should inves gate large/complex opera onal risk
losses, iden fying and prescribing in policies any related to physical climate risk. Recognizing
physical climate risk incidents can serve as a KRI [40].
* **Risk Capital:**
* While focusing on the new SA for opera onal risk capital, data sources from older
approaches like **external loss data (ELD)** and **scenario data (SD)** remain useful for
physical climate risk [41].
* Scenarios are valuable for forward-looking assessment of low probability/high impact
events, especially for medium to long-term impacts, combining with ELD or consor um data
[41, 42].
* **Opera onal Resilience:** This concept can unify all aspects of physical climate risk
management. Opera onal resilience is the ability to iden fy, prepare for, respond to, adapt
to, and recover from opera onal disrup ons [42]. Understanding physical climate risk and its
impacts aids a firm in achieving its opera onal resilience goals by focusing on important
customer services, how they might be impacted, and maintaining outages within acceptable
tolerances [42, 43].
**Summary**
* **ESG risk** is projected to grow and evolve, with **climate change** remaining a
primary concern. Its impact is expected to intensify [43].
* Businesses and investors will increasingly focus on mi ga ng both **transi on risks**
and **physical climate risks** [43].