• How to identify compliance risks in the business • How to involve risk management in compliance management • Integrating compliance risks with useful management tools

1. Exploring the Relationship Between Risk & Compliance Presented By: John Cyriac CEO ComplianceTrack.Com 100 Pall Mall, London SW1Y 5NQ Presented To: Compliance Asia 2009 May 26,27, 2009 Grand Hyatt Singapore

13. COSO –Enterprise Risk Management “ 41% are using a COSO-based approach for ORM”. Chartis Research (2007) Approaches to Compliance: Integrated Approach

21. Case Study: Step 2 Identify Risks Clients, Regulators, Suppliers, Competitors External dependency Quantity (system capacity), Quality (incorrect market information), Criticality (critical application), Failure (infrastructure breakdown) Technology Quantity (existing process can handle all instances), Quality (appropriate processes), Criticality (appropriate process unavailable), Failure Process Quantity(Sufficient Staff), Quality (Competent Staff), Criticality (key staff), Failure (unauthorized behaviour) People Risk factor Risk Driver

22. Identify risks in the process Case Study: Step 2 This could be the first activity. Steps mentioned in this presentation is only for clarity. Delayed Settlements Direct financial loss Inability to settle deal in planned market parameters Clients, Regulators, Suppliers, Competitors External dependency KRI Loss Risk Risk Factor Risk Driver

26. Compliance Data mapping [1] Indicator below Threshold is scored 1 = acceptable. Indicator above Threshold, but below Limit, is scored 2 = acceptable, but to watch. Indicator above Limit is scored 3 = unacceptable. Case Study: Step 4 1 2 48 24 5 2 0 8 Delayed Settlement Weight Scores [1] Limit Threshold Evolution (%) Value Above limit Above threshold Indicator

27. Quantify the Risk: Forward looking Identify the weightings for each of the indicators for each of the business lines & calculate aggregate loss indicator ( Every indicator is normalized, i.e. expressed on a common [0, 1] range by using a transformation ) (example for the indicator a): Reference: Scandizzo, Sergio (2005) Case Study: Step 5

28. Quantify the Risk: Backward looking Case Study: Step 6 Event: Deal settlement concluded after the threshold of 48 hours and the risk is materialized The Compliance Officer anyway considers this event in his normal line of duty. However, if the event is recorded in an appropriate manner, that can give the necessary internal loss data

32. Policy Management Management Tool

33. Policy Creation Management Tool

34. Policy Distribution Management Tool

35. Policy Training and Affirmation Management Tool

36. Policy Reports Management Tool

37. Compliance Monitoring Management Tool

38. Compliance Test Creation Management Tool

39. Compliance Test and Data Collection Management Tool

40. Compliance Reporting & Traceability Management Tool

42. Towards a resilient enterprise Integrated Compliance Silo Approach – Compliance Risk Alone Compliance Level Desired level