Operational risk at Zions Bancorporation

RMA Journal, The, Nov, 2002 by David Stone

Enhancing Deployment, Communication & Sustainability

Establishing work flow and alerts determines how information in the system is channeled to departments. In effect, it determines who needs to see risk information, what they need to see, and what they need to act on and when. Defining work flow and alerts creates the system's sequence of activity and decision making, and defines the players involved. For example, Figure 1 shows how after a staff member enters a risk into the system, the assessment is electronically forwarded to a manager for review and approval. If the risk is approved, electronic notifications are sent to relevant business and support areas, such as Corporate Insurance and Internal Audit. Zions also created alerts for changes in residual risk ratings, action item status, and other important events. As noted in Figure 1, other groups are also alerted as needed. For instance, an alert goes to IT Security if it is an IT security risk, to Compliance if it is a compliance risk, to Business Continuity if it is a business continuity risk, and so o n. The result is a system that enhances communication and accountability, and enables assurance groups across the company to more proactively support business lines, help shape decision making, and improve controls.

Home Page. The Home Page (Figure 2) was designed to serve as a "dashboard" of current risk issues to help users assess their risk status and take action. It is made up of four quadrants displaying different types of information from the system. The first lists residual risk ratings for a business or group of businesses. Here a user can drill down to see the most critical risk issues. The second quadrant shows risks that need to be reviewed and approved. The third quadrant displays action items that are past due or will be due in the near future. The fourth quadrant contains important notices about the system and other pertinent information posted by the administrator. As a whole, the Home Page pinpoints critical risk areas, facilitates information flow, and expedites action resolution. (Note: Figures 2 and 3 are from the system prototype.)

Accountability and sustainability. Enterprise risk management systems can be cumbersome to maintain. There can be hundreds of risk issues and action items to track and follow up on. Without effective project management software, issues are lost, forgotten, and go unresolved. Lexign's work flow technology helps overcome these challenges. The system's workflow alerts and action-tracking capability transform it into a management tool that businesses can use to ensure issues are addressed and resolved in a timely manner. It will help better manage payment risk across Zions. The bank will be able to roll up and compare exposures and track efforts to strengthen controls. Managers and staff can use the system to share information, update status, and ensure accountability.

Data Integrity and Validation

Balancing qualitative and quantitative data. Zions' risk assessment system includes both qualitative and quantitative information to generate a comprehensive risk profile that encourages greater thought and data integrity. As noted earlier, instead of listing vague business objectives, users are asked to enter a numeric goal to indicate achievement of an objective and their current status against that goal. Then users are asked to electronically attach a chart or document that validates their entries. For example, a unit might enter a loan application accuracy goal of XX% against which they track daily/monthly status. Escalation triggers can also be created to notify appropriate individuals if performance falls below predefined levels.