Playing partners: historically, Wachovia Corp. had looked at risk by line of business. After its merger with First Union, management decided to develop a more holistic approach. Finding the most effective solution was as complex a process as the merger itself—but well worth the effort

Risk & Insurance, April 15, 2004 by Carrie Ruddy

A corporate-wide view of operational risk is a relatively new discipline in the financial services industry. Operational risk is broad, pervasive and complex--including losses incurred from human error, failed processes, inadequate systems or external events. Failure to manage operational risk appropriately can result in financial loss, negative customer impact and significant damage to a firm's reputation.

Wachovia Corp., the fourth largest banking corporation in the nation, has been lauded for its effective management of operational risk during the First Union and Wachovia bank merger announced in 2001. The company decided to proactively manage the risks associated with the large and complex merger in a way that would minimize customer impact and continue to build shareholder value.

"Today's Wachovia is financially strong and focused on execution," says Ken Thompson, Wachovia chairman and CEO. "Our deliberate integration activities for the past two and a half years have allowed us to build the company we envisioned and position it for the future."

The bank merger also gave Wachovia an opportunity to build a strong and independent risk management arm to oversee governance processes for credit, market and operational risk. A major piece of this work was creating a framework to manage operational risk at the enterprise level, including governance structure, processes and technology infrastructure.

A HOLISTIC APPROACH

Historically, Wachovia had looked at risk by line of business. After the merger, management decided to develop a more holistic approach to address operational risk categories that cut across business lines-including vendor, compliance, financial, fiduciary, human capital, technology, loss management, legal, business continuity, planning, implementation risk, real estate and business process.

According to Joseph Hanssen, senior vice president of operational risk, "Our vision was to develop an operational risk management framework that would create and sustain a competitive advantage for Wachovia through lower earnings volatility, greater customer satisfaction and enhanced reputation."

Technology was needed to provide actionable risk information, reporting and transparency in support of the bank's approach to operational risk management. The solution had to provide enterprise-wide data in a format that supports multiple views of company activities and promotes consistency of information across the organization.

According to Hanssen, technology was needed to support several functions, including the capture, management and reporting of risk and control assessments, internal loss events, issue and action plans and risk profiling.

By using an integrated technology solution and format, Wachovia would reduce the level of manual capture processes and the potential for redundant investments. The ideal system would support Wachovia's development of an enterprise-wide operational risk profile, and provide the necessary information for operational capital modeling necessary to meet new regulatory requirements.

To provide this platform, Wachovia chose Purchase, N.Y-based Centerprise Services Inc., a developer of enterprise management systems for the financial services industry.

"Wachovia did their homework," says Reto Tuffli, Centerprise CEO and co-founder with Eric Yu, CTO. "They clearly thought through the institutional and cultural building blocks necessary to implement a comprehensive operational risk program. Building off this program will be instrumental in supporting their governance and management processes."

It wasn't a decision Wachovia made lightly. The risk management team undertook a painstakingly thorough selection process. Qualified firms from around the globe were identified through discussions with peer institutions, regulators and consulting agencies, attendance at operational risk conferences and industry research.

Wachovia's legal department and a strategic sourcing group supported a smooth process through review of proposals and help in contract negotiation.

The Request for Proposal process included vendor feedback, internal due diligence and an opportunity for on-site demonstrations. The Phase One RFP was sent to potential vendors and included business and technical requirements and a high-level pricing form. The team narrowed the field to the most likely candidates and performed reference cheeks, a vendor application security review and a complete financial analysis. Remaining vendors were asked to deliver an integrated solution containing all of Wachovia's required components.

Each component and their integration was assessed and validated in three sessions presented to various departmental personnel. "Throughout these sessions, we also observed and reviewed a number of vendor characteristics such as flexibility and product knowledge," said Hanssen. "It was important for us to take the time and energy up front to identify a partner we could work with effectively."

Throughout the process, Wachovia's operational risk team also coordinated with internal partners in information technology and corporate information security to ensure that the operational risk platform would meet appropriate security requirements and effectively interface with other systems.