Whilst there is a separate section of this manual for reporting, the reporting element for this feature at the Entity Level will be discussed here.
Clicking on "Reports" in the toolbar at the top of the Event Listing screen will bring up the following screen:
Reports
NOTE: all reports produced by the system are presented in a preview screen first, if the report is satisfactory and you wish to print it use the 
icon on the toolbar. DO NOT USE FILE/PRINT command.
Report Output Options
There is also an option to output reports in an alternative format; when the preview report comes up you will see in the toolbar at the top of the screen an "Export" button; if you click on this you will be presented with the following screen:
Simply use the radio buttons to decide which format you would like your report produced in. Note: the PDF format reproduces the formatting displayed on the screen.
Click on the "Reports" button in the heading and you will open up the "Report Selection Menu":
Comprising of 31 reports and charts, the Events Reports shows summaries, details, and trends for an Entities event.
Event details: This report is intended to show the details of every event in the Business Unit or in the organisation as a whole. Clicking on this option will open a pop-up menu:
This allows the user to decide which details for each event they wish to be shown on the report. A simple report, merely using the “Show Description” option will produce a report with the following basic data:
More complex reports are available when more options are selected.
Recoveries: This report shows details, by year, of all recoveries made in respect of event losses; categorized by recovery type:
Event Summary - Net Loss: this report summarises the net losses for all events captured to date:
Event Summary - Gross Loss: this report summarises losses for all events captured to date:
New Risks: this report shows all events that were not assigned to existing risks.
Risk Trend Report: this is one of several reports that helps us move from “we think” to “we know”. For every risk in an Entity, we have documented what we believe the likely impact would be should the risk happen and the likelihood of the risk occurring were no controls to be present. In addition, in the Event Tracking section of the Business Unit we have captured, and verified, data about the actual occurrence of events. This module brings these two sets of data together so as to allow a comparison of what we initially thought might happen with what is happening in reality. The module operates on a 3-year rolling basis with the start point being specified in the Parameters Screen in the box labelled Date to Capture Data Loss. As stated above, only verified incidents are used in this report and these are put into the relevant reporting year based upon the date of the incident.
The selection allows you to produce the report for all risks in the Entity, a specific risk in the Entity, or a specific risk type in the Entity, such as, for example, all high impact, high probability risks:
After making your selection click "Generate Report" in the toolbar at the top of the screen; the system will then combine data and produce an A3 LANDSCAPE report that has two sections:
The left –hand section shows a data table where the range of values for each risk is shown along with the current record of actual incidents. A little more information about how this data set works; the first risk on the report is risk 390 and, were you to look at the risk list you would see that it is described as a Medium Impact, Medium Probability risk. Now, the Entity screen would show that the value range for Medium Impact is 25,001 - 500,000; what the system does is sets a range of likely loss values for this risk based on the Impact and Probability figures:
If the Risk is Medium Impact, Medium Probability, D Actual Environment:
Bottom Range = Entity Min Medium Impact (Entity Screen) * Event Min Medium Frequency (Parameter Screen) * 1 (D Actual Environment equals to 1)
Bottom Range = 25,001 * 3 * 1 = 75,003
Top Range = Entity Max Medium Impact (Entity Screen) * Event Max Medium Frequency (Parameter Screen) * 1 (D Actual Environment equals to 1)
Top Range = 500,000 * 3 * 1 = 1,500,000
To make reviewing the report easier this range has been broken down into 5 bands (levels 1-5). So far, over the 3 years of measurement, 2 incidents have been reported totalling 6,692 this is slightly outside this estimated range of values. This is reflected graphically on the right-hand side of the report:
Armed with this data we can refine our original estimation – moving from “we think” towards “we know”.
Employee Event List: this report shows all employees involved in events for the particular Entity:
Event Discovery Period – the intention behind this report is to show the dates on which an event took place and the date on which it was discovered; the lag between these two dates is shown along with the average time lag. The report is structured so as to group events by risk:
Event Time Series Losses: Because some events can be prolonged, such as internal fraud, whilst others are an instant one-off like an armed robbery, it is important to know how long each type of event remained open for; this is particularly so if you are wanting to do any risk prediction work. This report takes the Event Date (i.e. the date when the event was first recognised) and the End Date (i.e. the date when it was acknowledged that the event had finally ended) and shows the elapsed time between the two. For events relating to the same risk, it also shows the average duration:
Revised Control Score: this report compares a control’s original mitigating strength (as defined in the matrix) with the score assigned following the event investigation:
So, for example, the above report shows that for the risk “ATM fails – mechanical fault” there are 3 controls:
1.IT;
2.Vendor Agreement;
In the “Score” column we can see what the mitigating impact of each of these was considered to be when the matrix was first evaluated; 3’s for the first two and 2 for vendor agreement. Now that event has occurred these scores have been re-evaluated; IT control was rated as only having a 1 in mitigating control strength.
Control Impact Summary: this report shows how effectively each control that has been used in an Event Screen entry has performed; it shows the average performance over time against the score the control was given when it was used in scoring the original matrix. For example:
In the above case, control 60 – Record Creation is checked – was used 1 time in Event Screens relating to risk 30 – Wrong data entered into the system. The effectiveness assigned to it in the event averaged 3, as is shown in the penultimate column of the report. In this Business Unit, the original matrix scored the control with an effectiveness of 4 against this risk; so, some rethinking can now be done!
Tip: when using these average scores remember that the score in the matrix is not always the one you want to compare to; if the control has been tested the scores may have been decremented if the control is not fully deployed. |
Control Effectiveness: this report is designed to show the importance of each control in an Entity by detailing the number of incidents in which the control featured and the severity of those incidents; so:
This graph shows us that control 50 featured in 3 events, all of which were of low severity. While controls 210, 310, and 320 featured in 1 event each, all of high severity.
Control Asset Effectiveness: This report shows the effect of an individual control in an Entity over the assets impacted, or potentially impacted by events. To run this report, select control(s) from the drop-down list and check the relevant box(s), as the following window:
Once you select the control, the report will look like this:
This report is reflecting the fact that, in the Business Unit “Cards Function (Post Testing)”, control number 20 – Branch Controls – has been identified by the system as being involved in mitigating 6 events (in the Control Impact Summary report we will see that they relate to risks 10 (4 times), 390 and 210); the “assets” attached to these risks are Cash and Reputation and the likely impact of each is Medium for cash and low for reputation. So, pulling all that together the graph shows control 20 being enlisted in the mitigation of a Cash/profitability event on 5 occasions, all of Medium severity; and being enlisted in the mitigation of 1 potential threat to Goodwill, with a Low impact.
Event Distribution: Over time it is important to know how the severity of actual events compares to the estimated likely severity (Impact) input to the system when the individual risks were first set up. This report summarises this data:
Event Chart: The purpose of this report is to summarize, by year, the loss data for the business. When you click on this tab you are presented with the following selection screen:
Make your selections and click on "Generate Report" button; this will produce:
Events Exceeds Appetite
This report highlights all events that exceed the business unit’s appetite level defined in the entity screen.
Basel Reports: these reports are all relevant to our banking clients; if you did not specify your Basel requirements when the system was set up this option will not be available. The + besides this heading brings the suite of reports live:
Basel Individual Incident List: as stated earlier, CGC’s approach to managing Operational Risks from a Basel Capital Accord perspective is to treat such risks as part of the overall risk portfolio and then provide specific reporting capabilities to filter out and report on such risks. This and the following 9 reports show this filtering and reporting capability.
Assume an Entity, say, Cards Function, has 50 risks and 20 of those also relate to the Basel Accord; incidents will be recorded against all 50 risks however only some of the risks, and therefore some of the incidents, will be of relevance when reporting against the Basel Accord; by running this
Basel Individual Incident List report only the incidents that relate to risks that have been assigned to a Basel Risk get reported upon:
Basel Actual Incident Summary: this report details the totals of each Basel category of the risks on the earlier report:
Basel Category/Business Line Number of Actual Losses: this report summarises, by Basel Line of Business and Basel Risk Category, the verified incidents that have been recorded on the database:
Note: for data to get recorded on this report the incident has to have been verified AND all of the Basel data has to have been completed for the risk to which the incident relates.
Basel Category/Business Line Number of Losses: this is an identical report to the last one but it includes “near misses” as well as actual events:
Basel Category/Business Line Actual Net Losses and Business Line Net Losses: these two reports are identical to the previous two reports except they have the value of incidents in place of the number of incidents:
Basel Category/Business Line Gross Losses: this report is in the same format as the earlier reports but it shows, for each Business Line, the value of Gross Losses and Maximum Losses.
Event Losses Basel Level I: click on this heading to bring up the selection menu:
Here you have a choice; you can either produce a report of Accumulated Losses or Comparative Losses.
Accumulated Losses: this report will show, by Basel Risk category the accumulated losses for a specified period; use the dropdown menus to specify the period:
Comparative Losses: clicking on this provides you with another menu:
Major Operational Risk Losses – this report is designed to show losses, by Business Line, above a pre-determined level. After clicking on the heading, the following screen appears:
You must inset in the Gross Loss box the value that you wish the report to work with; so, if you want to view all events => 5,000, insert this into the box and click on "Generate report" button to produce the report.