How data analytics can help with risk management

Darren James, Partner, Deloitte

Thursday, February 24, 2011

Business Risk Management Seminar Series

2010/2011 Toronto sessions

Discussion items
Data analytics in the context of risk management Background: What is data analytics Applying data analytics to risk management Case studies Closing thoughts

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Data analytics in the context of risk management

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Opportunity for using data analytics in managing risk

Explosive data growth means more raw materials Innovation in data generation and capture Data supports fact-based decision making Already used extensively in many areas of business Data analytics focusing on risk are primarily used in the areas of credit risk, anti-money laundering and fraud

Data analytics has significant potential to be exploited in the risk management space
3 Business Risk Management Seminar Series 2010-2011
Deloitte & Touche LLP and affiliated entities.

What will the future hold

Will boards be asking us to back up our gut feel on risk with hard data? Will the C-Suite want to understand the key risk factors and their relative importance in real numbers? Will management have even greater responsibility to foresee future risks long before they manifest themselves? Will data analytics be a core competency for all risk professionals?

Data analytics is a business tool that will be pervasive in our organizations

4 Business Risk Management Seminar Series 2010-2011
Deloitte & Touche LLP and affiliated entities.

Background: What is data analytics

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

What is data analytics

A practical definition, however, would be that analytics is the process of obtaining an optimal or realistic decision based on existing data. (Wikipedia)

Data analytics is the science of examining raw data with the purpose of drawing conclusions about that information. (whatis.com)
Analytics leverage data in a particular functional process (or application) to enable context-specific insight that is actionable. (Gartner)

Data analytics is the use of raw data to produce insights or conclusions that can be acted upon
6 Business Risk Management Seminar Series 2010-2011
Deloitte & Touche LLP and affiliated entities.

How can we categorize data analysis methods

Descriptive Statistics Exploratory Data Analysis (EDA) Confirmatory Data Analysis (CDA)

Rules-based (Human Intelligence)

Inference-based (Machine Learning)

Supervised Learning Unsupervised Learning

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

What types of questions can analytics answer

Historical Perspective
What happened?

Current Perspective
Where is the problem? What actions are needed?

Future Perspective
What if these trends continue? What will happen next? Whats the best that can happen?

How many, how often, where?

Why is this happening?

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Some sample data analytics techniques are...

Clustering Predictive Analytics Association Rule Learning Regression Analysis Visualization Decision Tree Learning

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

How does data analytics apply to risk management

10

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

How can data analytics be applied to risk management Error detection and quantification Targeted analytic applications to detect errors (e.g., business unit reviews or internal audits)

Historical perspective

Risk Dashboard/Continuous Monitoring How Current are we currently doing? What is our current risk monitoring profile? Key Risk Indicators (KRIs) What-if How will this decision affect our risk?

Forwardlooking

11

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Some examples of historical-type questions...

Historical perspective

Error detection and quantification

How many stock-outs did we have? Which stores were they in? What caused them? What could have prevented them?

12

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Some examples of things we might monitor...

Current monitoring

Risk Dashboard/Continuous Monitoring

How are our stock-outs trending? Where do we continue to have problems? Where are inventory controls failing? What is our current opportunity cost from empty shelves?

13

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Some examples of proactive questions...

Forwardlooking

What-if and What will happen next?

Where will the next stock-out occur? What if we increase our minimum holding levels? What changes do we need to make to reduce the number of stock-outs? What are our optimum stock levels to balance the risk of stock outs with holding costs?

14

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Data analytics can enhance our existing KRIs

Forwardlooking

KRIs

Develop more sophisticated multi-dimensional KRIs Identify KRIs that more closely correlate with desired outcomes More accurately determine the contribution of a given indicator to overall risk Provide a more fulsome picture of risk profiles by monitoring and trending a more comprehensive range of indicators
15 Business Risk Management Seminar Series 2010-2011
Deloitte & Touche LLP and affiliated entities.

Data analytics can enhance our early warning capabilities

Forwardlooking

Early warning systems

Components of an early warning system Sensors to collect data Systems to accumulate and process the data Analytics to provide insights from the data Something/someone to interpret the results Something/someone to action the interpretation

16

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Increasing range of sensors creating raw data

Business Systems Data Vendors Network Systems

Customer

Operation s Systems

Social Media

Raw Data

Security Systems

Business Partners

Surveys

Video Email

Phone Calls

17

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

An increasing variety of innovative sensors are becoming available

18

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Innovators are developing new sensor deployments

The Quake-Catcher Network is a collaborative initiative for developing the world's largest, lowcost strong-motion seismic network by utilizing sensors in and attached to internet-connected computers.

19

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Generating good quality data from sensors

Text mining Audio analysis Video analysis Entity resolution Data enhancement E.g. Census data, postal data

20

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Computers are being developed to handle Big Data

Big Data is a term used for data sets that are too large for existing standard software to be able to process within a workable time frame New computing systems have needed to be developed to handle Big Data including massively parallel processing (MPP) databases, cloud computing platforms and data mining grids

21

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Case studies

22

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Bank branch network analysis for audit selection

Objective: Identify high risk branch locations for branch audit visits Self Organizing Maps were used to analyse all relevant data from the clients national branch network. This allowed analysis of a broader array of key risk indicators than usual under traditional approaches Data Analysed: Financial P&L, delinquency, compliance, average holding size, credit quality, portfolio risk Branch Staff Data turnover, bonus payments, leave balances, trends and staff demographics Customer/Sales Data number of products per customer, accounts opened/closed, source of new customers, account profitability Other suspense account activity, audit findings, fraud incidents Output highlighted outliers within the branch network and allowed for a purely risk-based branch audit selection approach

Large retail bank

Analysis of branch data highlight s behavioural outliers, and helps direct audit activity. From this analysis, branch 122 had exceptional characteristics relating to a combination of: higher than average no. of loans; higher than average loan value ($); large no. of loan defaults combined with 5 other above average parameters

Further analysis highlighted activity by quarter in relation to opening new accounts. We can direct audit effort to investigate into what is driving this behaviour

23

Deloitte & Touche LLP and affiliated entities.

Safety analytics diagnostic

Traditional safety analytics defined scale of the safety problem, but lacked insight to why events occurred. Using a strategic safety profiling analysis we: Objectively identified the key factors and behaviors that impacted safety related incidents and then designed measurable interventions to minimise safety risk Large resources company
Type A - Number of events Type B - Number of events

Used the profiling model to predict the most likely next person(s) at risk to get hurt
Data Analysed: Permanent records, Payslips, Leave history Rosters (including FIFO), training history / results Performance reviews Access card history Injuries sustained / near misses / hazards Severity of injuries Equipment involved Location of event Weather observations at time of event
Type A staff are almost eight times more likely to have suffered a safety event. Impact is 240% more severe than average, exclusively male, 20% older than average, unionised and residential at the mine site. Tend to get hurt in the beginning of their roster (1st or the 2nd day), through an object causing them harm and have not completed a required safety training unit.

Type B staff are six times more likely to have suffered a safety event with an impact almost 300% more severe than average. Their accidents are expensive tending to be sprains or soft tissue damage. In contrast to type A, these employees generally get hurt on the 7th day of a 7 day roster just before they roll off.

24

Deloitte & Touche LLP and affiliated entities.

Closing thoughts

25

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Closing thoughts
Data analytics requires innovative thinking about sourcing data and identifying sensors Data analytics is as much, if not more, about asking the right questions as it is about the mathematical contortions going on behind the scenes Data analytics can be applied to more aspects of risk management than just credit risk, AML and fraud

26

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

For more information

If you would like more information about Data Analytics or how Deloitte can help your organization, please contact:

Darren James Partner Enterprise Risk 416-601-6567 djames@deloitte.ca

27

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.

Next Business Risk Management Series session

Session 7: Internal audit Ensuring strategic relevance Date: Thursday, March 10, 2011 Venue: Toronto Board of Trade RSVP: brm@deloitte.ca

28

Business Risk Management Seminar Series 2010-2011

Deloitte & Touche LLP and affiliated entities.