Analysing the influence of people and culture risk on risk management in the banking sector ML Monama orcid.org 0000-0001-8265-8452 Supervisor: Prof SJ Ferreira-Schenk Co-supervisor: Ms R Sgammini Dissertation accepted in fulfillment of the requirements for the degree Master of Commerce in Risk Management at the North-West University Graduation: May 2024 i DECLARATION I, Makiri Lancelot Monama, declare that: “ANALYSING THE INFLUENCE OF PEOPLE RISK AND CULTURE RISK ON RISK MANAGEMENT IN THE BANKING SECTOR” is my own work and that all the sources I have used or quoted have been indicated and acknowledged by means of complete references, and that this thesis has not previously been submitted by me for a degree at any other university. _____________________________ Makiri Lancelot Monama November 2023 Vanderbijlpark ii LETTER FROM LANGUAGE EDITOR iii ACKNOWLEDGEMENT First and most importantly, I thank God for giving me strength, guidance, powers, and determination throughout the completion of this research study. I want to acknowledge with gratitude the assistance, support, and encouragement of those individuals who contributed to the successful completion of this research study. A special note of thanks is extended to the following people or entities: • North-West University, thank you for the financial support. • To my supervisor, Prof. Sune Ferreira-Schenk and co-supervisor, Ms Ruschelle Sgammini, for their expert guidance, support, time, involvement, and encouragement throughout this journey. Your contribution is beyond what words can describe. • Dr. Kago Amiel Matlhaku, thank you for your involvement in this research study. • Prof. Marike Cockeran, for excellent statistical services and guidance. • Sarah Louise Cornelius, for excellent language and technical editing services. • To my parents, Samuel “Malope wa Morwaswi” and Magdeline “Marumo wa Hlole” Monama, thank you for supporting and encouraging me to do well in my studies. You taught me to make education fashionable. • To my siblings, Lekgowe, Makutu, Moji, and Thoke Monama, thanks for your support and encouragement. I would not have done this without you siblings. • To my partner, thank you so much for the support, motivation, love, and time you have given me to complete this research study. Your presence motivated me. • To my friends and colleagues, thank you for your support and words of encouragement. • To the banking sector participants for their willingness to complete the questionnaire as honestly as possible. • Finally, I would like to thank ME for my hard work and completion of master's study. I Philippians 1.6: I am certain that God, who began a good work in you, will carry it on to completion until the day of Christ Jesus iv ABSTRACT Keywords: Operational risk management, People risk, Culture risk, banks, Risk management perception, COVID-19 pandemic, Demographical factors, Banking sector, South Africa One of the main determinants for banks to overcome financial and reputational challenges is to manage operational risk to an acceptable level. Banks have been exposed to various operational risks, such as people risk and culture risk. Moreover, this has been exacerbated by employees' lack of positive perceptions about the importance of managing or mitigating people risk and culture risks within the banking sector. Therefore, analysing the influence of people risk and culture risk on risk management in the banking sector is crucial for banks to provide better risk strategies to enhance their employees' perception of operational risk and overall risk management. Operational risks such as people risk and culture risk have impacted other major risks in the banking sector, especially during the COVID-19 pandemic. The COVID-19 pandemic has impacted the banking landscape and changed the usual day-to-day operation of banks by adopting hybrid models that may have impacted culture, how employees used to work, more dependence on banking apps (less contact with people), and increased levels of risk. In South Africa, very few studies focus on people risk and culture risk in the banking sector. Therefore, a gap was found in conducting this research study. The main objective of this research study was to analyse the influence of people risk and culture risk on risk management in the banking sector. The literature review and empirical objectives of the research study were achieved by establishing quantitative research approaches in conjunction with a positivist research paradigm. This research study's target population consisted of South African banking sector employees. The sample frame included the top five South African commercial banks, namely ABSA, FNB, Nedbank, Capitec Bank, and Standard Bank. They were chosen based on market share, number of branches, and profit maximisation. The non-probability purposeful and snowball sampling methods were chosen for this research study as the best methods to gather large amounts of information from limited parameters effectively. Participants who met the inclusion criteria of being 18 years or older with matriculation as a minimum level of education and having more than six months of work experience in the banking sector were obtained as a representative sample. A sample size of 391 employees was considered satisfactory for quantitative data analysis. Quantitative data was collected using a self-administered online questionnaire and validated and pre-tested by seven researchers in the field of risk management. Various statistical analysis tools such as EFA, correlation coefficient, ANOVA, v T-test, hypothesis testing, and SEM were used to model the influence of people and culture risk on risk management. The main contributions of the research study are based on the achievement of the empirical objectives and the creation of a model for how people and culture risk (as components of operational risk) influence risk management in the banking sector. For the first empirical objective, a significant difference was found in how individuals perceived risk management and operational risk. The demographic factors (age, ethnicity group, types of employment, and position or role held) were statistically significant, while gender (females) had a greater understanding of operational risk management. For the second empirical objective, it was found that there was a medium-positive linear relationship between operational risk management and risk management perception. Further, operational risk management and risk management perception positively correlated with people risk and culture risk during the COVID-19 pandemic. Lastly, the SEM demonstrated significant results that contributed to achieving the primary objectives. The SEM allows banks to predict factors that influence people risk and culture risk, which are likely to be the most valuable intangible assets of the bank. Consequently, this will help banks develop mitigation strategies and action plans to manage these operational risks. Managing any operational risk will allow banks to strive for more profit, competitive advantage, a better working environment, a strong reputation, an enabling culture, a better perception of risk, and ensure that risk is within acceptable risk appetite levels. Considering this research study's theoretical and empirical findings, limitations will always be part of any research study, as they are used to improve the current study. Future researchers can use this research study as a basis to improve the study by choosing a larger sample size and expanding the range of demographic factors. As this research study focused on people risk and culture risk as part of operational risk, future researchers may consider other types of risk such as reputational risk, market risk, credit risk, financial risk, information communication and technology risk and strategic risk with a focus on the banking sector. vi TABLE OF CONTENTS DECLARATION .............................................................................................................................................. I ACKNOWLEDGEMENT ..............................................................................................................................III ABSTRACT ................................................................................................................................................. IV TABLE OF CONTENTS ............................................................................................................................. VI LIST OF TABLES....................................................................................................................................... XII LIST OF FIGURES .................................................................................................................................... XIV LIST OF ABBREVIATIONS ...................................................................................................................... XV CHAPTER 1 ................................................................................................................................................... 1 INTRODUCTION AND BACKGROUND TO THE STUDY ........................................................................ 1 1.1. INTRODUCTION ............................................................................................................................... 1 1.2. PROBLEM STATEMENT ................................................................................................................. 4 1.3. RESEARCH OBJECTIVES ............................................................................................................. 5 1.3.1. PRIMARY OBJECTIVE ............................................................................................................................. 5 1.3.2. THEORETICAL OBJECTIVES .................................................................................................................... 5 1.3.3. EMPIRICAL OBJECTIVES ......................................................................................................................... 5 1.4. RESEARCH DESIGN AND METHODOLOGY............................................................................... 6 1.4.1. STUDY DESIGN AND CONTEXT ................................................................................................................ 6 1.4.2. EMPIRICAL STUDY .................................................................................................................................. 6 1.4.3. PRIMARY DATA ...................................................................................................................................... 6 1.4.3.1 Population ................................................................................................................................... 6 1.4.3.2 Sample Size ............................................................................................................................... 6 1.4.3.3 Process of obtaining informed consent .................................................................................. 7 1.4.3.4 Data collection ............................................................................................................................ 7 1.5. ETHICAL CONSIDERATIONS ........................................................................................................ 8 1.6. CHAPTER CLASSIFICATION ......................................................................................................... 8 CHAPTER 2 ................................................................................................................................................. 10 THEORETICAL BACKGROUND: ANALYSIS OF THE BANKING SECTOR ...................................... 10 2.1 INTRODUCTION ............................................................................................................................. 10 2.2 DEFINITION OF A BANK .............................................................................................................. 10 vii 2.3 THE PURPOSE OF A BANK......................................................................................................... 11 2.3.1. THE ROLE OF A BANK AS A FINANCIAL INTERMEDIARY........................................................................ 13 2.4 TYPES OF BANKS ............................................................................................................................... 14 2.4.1. COMMERCIAL BANK ............................................................................................................................ 15 2.4.2. INVESTMENT BANK .............................................................................................................................. 15 2.4.3. RETAIL BANK ...................................................................................................................................... 16 2.4.4. COOPERATIVE BANK ........................................................................................................................... 17 2.5 RISK AND RISK MANAGEMENT ................................................................................................. 17 2.5.1. RISK AND THE SOURCE OF RISK .......................................................................................................... 18 2.5.2. MANAGING RISK .................................................................................................................................. 19 2.6 RISKS FACED BY BANKS ........................................................................................................... 20 2.6.1. OPERATIONAL RISK ............................................................................................................................. 20 2.6.2. CREDIT RISK ....................................................................................................................................... 22 2.6.3. MARKET RISK ...................................................................................................................................... 22 2.6.4. REPUTATIONAL RISK ........................................................................................................................... 23 2.6.5. LIQUIDITY RISK .................................................................................................................................... 25 2.6.6. SOLVENCY RISK .................................................................................................................................. 27 2.6.7. OTHER RISKS FACED BY BANKS ......................................................................................................... 27 2.7 THE SOUTH AFRICAN BANKING REGULATORY STRUCTURE ........................................... 28 2.7.1. THE ROLE OF THE SOUTH AFRICAN RESERVE BANK ........................................................................... 29 2.7.2. BANKING LEGISLATION IN SOUTH AFRICA ........................................................................................... 29 2.7.3. THE TWIN PEAKS REGULATION ........................................................................................................... 31 2.8 GLOBAL STANDARDS AND REGULATIONS ........................................................................... 32 2.8.1. BASEL ACCORDS ................................................................................................................................ 32 2.8.1.1 .Basel I Accord ......................................................................................................................... 33 2.8.1.2 Basel II Accord ......................................................................................................................... 34 2.8.1.3 Basel III Accord ............................................................................................................................ 37 2.8.1.4 Basel IV Accord ............................................................................................................................ 38 2.8.2. KING COMMITTEE ON CORPORATE GOVERNANCE ............................................................................... 39 2.8.2.1 King I Code ............................................................................................................................... 39 2.8.2.2 King II Code .............................................................................................................................. 40 2.8.2.3 King III Code ............................................................................................................................. 40 2.8.2.4 King IV Code ............................................................................................................................ 40 2.8.3. INTERNATIONAL ORGANISATION FOR STANDARDISATION .................................................................... 42 viii 2.8.4. COMMITTEE OF SPONSORING ORGANISATIONS OF THE TREADWAY COMMISSION ............................... 43 2.9 SYNOPSIS ............................................................................................................................................. 46 CHAPTER 3 ................................................................................................................................................. 48 OVERVIEW OF OPERATIONAL RISK, PEOPLE RISK AND CULTURE RISK ................................... 48 3.1 INTRODUCTION ............................................................................................................................. 48 3.2 OPERATIONAL RISK .................................................................................................................... 49 3.2.1. PEOPLE RISK AS A COMPONENT OF OPERATIONAL RISK ...................................................................... 49 3.2.2. CULTURE RISK AS A COMPONENT OF OPERATIONAL RISK .................................................................. 51 3.2.3. THE RELATIONSHIP BETWEEN PEOPLE RISK AND CULTURE RISK ....................................................... 55 3.3 OPERATIONAL RISK IN THE SOUTH AFRICAN BANKING SECTOR ................................... 57 3.3.1. THE PERCEPTION OF OPERATIONAL RISK AND RISK MANAGEMENT ...................................................... 57 3.3.2. THE PERCEPTION OF PEOPLE RISK AND CULTURE RISK ........................................................................ 60 3.3.3. THE IMPORTANCE OF GOOD CORPORATE CULTURE ............................................................................ 62 3.3.4. THE INFLUENCE OF COVID-19 ON PEOPLE RISK AND CULTURE RISK ..................................................... 64 3.4 OPPORTUNITIES AND CHALLENGES FACED BY BANKS ................................................... 67 3.5 SYNOPSIS ...................................................................................................................................... 68 CHAPTER 4 ................................................................................................................................................. 70 RESEARCH DESIGN AND METHODOLOGY ......................................................................................... 70 4.1 INTRODUCTION ............................................................................................................................. 70 4.2 RESEARCH DESIGN ........................................................................................................................... 71 4.2.1. RESEARCH PARADIGM......................................................................................................................... 72 4.2.1.1 The Positivist Research Paradigm ........................................................................................ 74 4.2.1.2 The Constructivist Research Paradigm ................................................................................ 74 4.2.1.3 The Participatory Research Paradigm .................................................................................. 75 4.2.1.4 The Pragmatist Research Paradigm ..................................................................................... 75 4.2.2. RESEARCH APPROACH ........................................................................................................................ 76 4.2.2.1 Qualitative Research Approach ............................................................................................. 76 4.2.2.2 Quantitative Research Approach .......................................................................................... 77 4.2.2.3 Mixed Methods Research Approach ..................................................................................... 78 4.3 CHOSEN RESEARCH DESIGN AND APPROACH .................................................................... 79 4.4 SAMPLING PROCEDURES .......................................................................................................... 79 ix 4.4.1. TARGET POPULATION .......................................................................................................................... 80 4.4.2. SAMPLING FRAME ................................................................................................................................ 80 4.4.3. SAMPLING METHODS ........................................................................................................................... 81 4.4.3.1 Probability Sampling Method ................................................................................................. 81 4.4.3.2 Non-probability Sampling Method ......................................................................................... 82 4.4.3.3 Sampling Size .......................................................................................................................... 83 4.5 DATA COLLECTION METHOD AND PROCEDURES ............................................................... 84 4.5.1. QUESTIONNAIRE DESIGN ...................................................................................................................... 85 4.5.2. QUESTIONNAIRE FORMAT .................................................................................................................... 86 4.5.3. QUESTIONNAIRE LAYOUT ..................................................................................................................... 87 4.5.3.1 Section A: Demographic information .................................................................................... 88 4.5.3.2 Section B: Operational risk and Risk management ............................................................ 88 4.5.3.3 Section C: Culture risk ............................................................................................................ 89 4.5.3.4 Section D: People risk ............................................................................................................. 89 4.5.4. ETHICAL CONSIDERATIONS .................................................................................................................. 89 4.5.5. QUESTIONNAIRE PILOT STUDY ............................................................................................................. 90 4.5.6. ADMINISTRATION OF THE QUESTIONNAIRE ........................................................................................... 91 4.6 PRELIMINARY DATA ANALYSIS ................................................................................................ 91 4.7 STATISTICAL ANALYSIS ............................................................................................................. 92 4.7.1. DESCRIPTIVE STATISTICS ..................................................................................................................... 92 4.7.2. INFERENTIAL STATISTICS ..................................................................................................................... 93 4.7.3. RELIABILITY ANALYSIS ........................................................................................................................ 94 4.7.4. VALIDITY ANALYSIS ............................................................................................................................. 95 4.7.5. FACTOR ANALYSIS .............................................................................................................................. 97 4.7.6. CORRELATION COEFFICIENT ................................................................................................................ 97 4.7.7. STRUCTURAL EQUATION MODELLING (SEM) ...................................................................................... 98 4.7.8. STATISTICAL MEASURES ...................................................................................................................... 99 4.8 SYNOPSIS ...................................................................................................................................... 99 CHAPTER 5 ............................................................................................................................................... 101 STATISTICAL ANALYSIS AND DISCUSSION OF THE RESULTS .................................................... 101 5.1. INTRODUCTION ........................................................................................................................... 101 5.2. ANALYSIS OF DEMOGRAPHICAL INFORMATION ................................................................ 101 5.2.1. GENDER DISTRIBUTION OF PARTICIPANTS .......................................................................................... 103 5.2.2. ETHNIC GROUP OF PARTICIPANTS ...................................................................................................... 103 x 5.2.3. AGE DISTRIBUTION OF PARTICIPANTS ................................................................................................ 103 5.2.4. LEVEL OF EDUCATION OF PARTICIPANTS ........................................................................................... 103 5.2.5. BANKING EXPERIENCE OF PARTICIPANTS ........................................................................................... 104 5.2.6. CURRENT ROLE/POSITION .................................................................................................................. 104 5.2.7. EMPLOYMENT STATUS ....................................................................................................................... 104 5.2.8. RISK MANAGEMENT FRAMEWORK/GUIDELINE..................................................................................... 104 5.2.9. MEMBERSHIP HOLDS ......................................................................................................................... 105 5.3. DESCRIPTIVE ANALYSIS AND INTERPRETATION ............................................................... 105 5.4. FACTOR ANALYSIS .................................................................................................................... 108 5.4.1. EFA FOR SECTION B – RISK MANAGEMENT ...................................................................................... 108 5.4.1.1. Naming and interpretation of the dimensions for Section B ............................................... 109 5.4.1.2. Internal reliability of scale: Section B ..................................................................................... 110 5.4.2. EFA FOR SECTION C – CULTURE RISK .............................................................................................. 111 5.4.2.1 Naming and interpretation of dimensions in Section C: Culture risk .............................. 112 5.4.2.2 Internal reliability of Section C: Culture risk ....................................................................... 114 5.4.3. EFA FOR SECTION D – PEOPLE RISK ............................................................................................... 114 5.4.3.1 Naming and interpretation of dimensions in Section D: People risk .............................. 115 5.4.3.2 Internal reliability of Section D: People risk ....................................................................... 116 5.5. HYPOTHESIS TESTING .............................................................................................................. 117 5.6. ANALYSIS OF VARIANCE (ANOVA) ........................................................................................ 118 5.6.1. DETERMINE THE PERCEPTION OF OPERATIONAL RISK MANAGEMENT PRACTICES WITHIN THE BANKING SECTOR BASED ON DEMOGRAPHIC FACTORS ............................................................................................... 118 5.6.1.1 Age comparison for operational risk management and risk management perception .... 118 5.6.1.2. Ethnic group comparison for operational risk management and risk management perception ................................................................................................................................................. 121 5.6.1.3. Types of employment comparison for operational risk management and risk management perception ........................................................................................................................ 125 5.6.1.4. Current role or position comparison for operational risk management and risk management perception ........................................................................................................................ 128 5.6.1.5. T-test for gender comparison of the perception of operational risk management and risk management ..................................................................................................................................... 130 5.7. CORRELATION ............................................................................................................................ 132 5.7.1. DETERMINE THE RELATIONSHIP BETWEEN PEOPLE RISK, CULTURE RISK AND RISK MANAGEMENT DURING COVID-19 PANDEMIC ..................................................................................................................... 132 xi 5.7.2. ANALYSING THE INFLUENCE OF PEOPLE RISK AND CULTURE RISK ON RISK MANAGEMENT IN THE BANKING SECTOR ......................................................................................................................................... 134 5.8. STRUCTURAL EQUATION MODELLING (SEM) ..................................................................... 136 5.8.1. INDICATE STRUCTURAL MODEL .......................................................................................................... 136 5.8.2. ASSESS STRUCTURAL MODEL VALIDITY ............................................................................................. 137 5.8.3. FORECASTING MODEL CONCLUSION AND RECOMMENDATIONS........................................................... 141 5.9. SYNOPSIS .................................................................................................................................... 142 CHAPTER 6 ............................................................................................................................................... 144 CONCLUSION AND RECOMMENDATIONS ......................................................................................... 144 6.1. INTRODUCTION ........................................................................................................................... 144 6.2. OVERVIEW OF THE RESEARCH STUDY ................................................................................ 144 6.3. MAIN FINDINGS OF THE RESEARCH STUDY ........................................................................ 146 6.3.1. EMPIRICAL OBJECTIVE 1: DETERMINE THE PERCEPTION OF OPERATIONAL RISK MANAGEMENT PRACTICES BASED ON DEMOGRAPHICAL FACTORS ...................................................................................... 146 6.3.2. EMPIRICAL OBJECTIVE 2: DETERMINE THE RELATIONSHIP BETWEEN PEOPLE RISK, CULTURE RISK, AND RISK MANAGEMENT DURING COVID-19 PANDEMIC ............................... 146 6.3.3. EMPIRICAL OBJECTIVE 3: ANALYSING THE INFLUENCE OF PEOPLE RISK AND CULTURE RISK ON RISK MANAGEMENT IN THE BANKING SECTOR ....................................................................................................... 147 6.4. GENERAL CONCLUSION AND CONTRIBUTION OF THE RESEARCH STUDY ................ 148 6.5. MANAGERIAL IMPLICATIONS AND RECOMMENDATIONS ................................................ 149 6.6. LIMITATIONS AND FUTURE RESEARCH ................................................................................ 149 REFERENCES .......................................................................................................................................... 151 ANNEXURE A: INFORMED CONSENT ................................................................................................. 194 ANNEXURE B: QUESTIONNAIRE ......................................................................................................... 197 ANNEXURE C: CODE BOOK.................................................................................................................. 204 ANNEXURE D: ETHICAL CLEARANCE ................................................................................................ 207 ANNEXURE E: STATISTICAL CLEARANCE ........................................................................................ 208 xii LIST OF TABLES Table 2.1 Roles and responsibilities of a bank Table 2.2 Different types of banks Table 2.3 Source of risk Table 2.4 Categories of operational risk Table 2.5 Types of market risk explained Table 2.6 Examples of potential reputational damage Table 2.7 Other types of risk Table 2.8 Capital tiers of the Basel I Accord Table 2.9 Pillars of the Basel II Accord Table 2.10 Elements of the SREP Table 2.11 Summary of the Basel Accords Table 2.12 Summary of the King reports Table 2.13 Core principles of the ISO Table 2.14 Components of the COSO Framework Table 2.15 Five components of the COSO (2017) framework Table 3.1 Inherent people risk Table 3.2 Core elements used to enhance culture risk Table 3.3 Impact on the relationship between people risk and culture risk Table 3.4 Causes of negative perception Table 4.1 Explanation of the types of research design Table 4.2 Research paradigms Table 4.3 Probability sampling methods Table 4.4 Non-probability sampling methods Table 4.5 Rating scales Table 4.6 Layout of the questionnaire Table 4.7 Ethical consideration Table 4.8 Descriptive statistics Table 4.9 Types of inferential statistics Table 4.10 Reliability measures Table 4.11 Validity measures Table 4.12 Descriptive and inferential statistics adopted Table 5.1 Descriptive analysis of sample Table 5.2 Descriptive statistics of section B – Risk Management xiii Table 5.3 Descriptive statistics of section C – Culture risk Table 5.4 Descriptive statistics of section D – People risk Table 5.5 KMO and Bartlett’s test of sphericity for Section B Table 5.6 Pattern matrix for Section B: Operational risk Management Table 5.7 Reliability scale for Section B: Operational Risk Management Table 5.8 KMO and Bartlett’s test of sphericity for Section C: Culture risk Table 5.9 Pattern matrix for Section C: Culture risk Table 5.10 Reliability for Section C: Culture risk Table 5.11 KMO and Bartlett’s test of sphericity for Section D: People risk Table 5.12 Pattern matrix for Section D: People risk Table 5.13 Reliability for Section D: People risk Table 5.14 Analysis of Variance for age Table 5.15 Analysis of Variance for ethnic group Table 5.16 Analysis of Variance for types of employment Table 5.17 Analysis of Variance for current role or position h Table 5.18 T-test analysis for gender Table 5.19 Correlation for the second objective Table 5.20 Correlation for the third objective Table 5.21 Latent variables model of SEM Table 5.22 Standardised regression coefficient for SEM Table 5.23 Summary of variables xiv LIST OF FIGURES Figure 2.1 Types of liquidity risk Figure 3.1 Culture risk formation Figure 3.2 Factors influencing perception Figure 4.1 Types of research design Figure 4.2 Sampling methods Figure 5.11 Structural model Figure 5.12 Structural equation model of risk management xv LIST OF ABBREVIATIONS ABSA Amalgamed Bank of South Africa AI Artificial Intelligence AIG American International Group AL Lending Assets ANOVA Analysis of Variance AO Other bank assets BCBS Basel Committee on Banking Supervision CFA Confirmatory Factor Analysis CFI Comparative Fit Index COSO Committee of Sponsoring Organisations of the Treadway Commission EFA Explanatory Factor Analysis e-forms Electronical Forms ERM Enterprise Risk Management e-Views Electronic Views FA Factor Analysis FAIS Financial Intermediary and Advisory Services Act FIC Financial Intelligence Centre FNB First National Bank FSCA Financial Conduct Sector Authority GFC Global Financial Crises G10 Group of Ten HMDA Home Loan and Mortgage Disclosure Act ICAAP Internal Capital Adequacy and Assessment Process IoT Internet of Things IRB Internal Rating-Based IRM Institute of Risk Management ISO International Organisation for Standardisation xvi KMO Kaiser-Myer-Olkin MRC Minimum Requirement Capital NCA National Credit Act NCFFR National Commission on Fraudulent Financial Reporting NGO Non-Governmental Organisation NWU North-West University PA Prudential Authority POPIA Act Protection of Personal Information PwC PriceWaterhouseCoopers RMF Risk Management Framework RMSEA Root Mean Square Error of Approximation RWA Risk Weighted Assets SARB South African Reserve Bank SC Senior Council SCR Solvency Capital Requirement SD Standard Deviation SEM Structural Equation Model SPSS Statistical Package for Social Sciences SREP Supervisory Review and Evaluation Process STC New Securitization Framework TLI Tucker-Lewis Index UK United Kingdom USA United States of America 1 CHAPTER 1 INTRODUCTION AND BACKGROUND TO THE STUDY 1.1. INTRODUCTION One of the responsibilities of banks is to fully identify, analyse, measure, manage, and monitor risks that could negatively impact their operational and strategic objectives. According to Praxiom Research Group Limited International (2018), a risk is an uncertainty surrounding an event's outcome. Strachnyi (2012) mentioned that risk originates from not knowing or being confident of what you are doing. Risks such as market risk, operational risk, financial risk (liquidity risk, solvency risk, credit risk), as well as black swan risk (COVID-19), if not adequately and efficiently managed, are the main risks that impact a bank’s survival (Suryaningsih & Sudirman, 2020:259). The banking sector faces daily exposure to operational risk (Neha, 2017:1). This exposure occurs due to the ever-changing environment in the banking sector that comes with new risks. New technologies, shifting ways of serving customers, using new data, and various catastrophic risks, such as the COVID-19 pandemic, are evident enough to witness the change in the banking environment (Eceiza et al., 2020). According to the Basel Committee on Banking Supervision (BCBS) (2011:3), “operational risk is the risk of losses resulting from an inadequate or failed internal process, people, systems or from external events. This definition includes legal risk but excludes strategic and reputational risk”. According to Chapelle (2019:1), operational risk is everything that is not black swan events and market risk. Chapelle (2019:1) further categorised operational risk by defining it as a non-financial risk, which are risks that are not purely financial. On the other hand, de Jongh et al. (2013:267) defined operational risk as a risk that usually involves losses from operations, which is different from market risk, which considers the downside (losses) and upside (profit) that arises from the market movements. Operational risk can be categorised into four components: people, processes, systems, and external factors. These components of operational risk are also interconnected to each other. One operational risk component may cause significant risk to another component (Alobaidi & Raweh, 2018:12). The impact of a severe operational risk has a probability of decreasing banks’ profits due to these unexpected events causing more operating expenses (Fadun & Oye, 2020:25). Alobaidi and Raweh (2018:12) highlighted that operational risk is the result of people’s responsibilities, the financial system in place, processes and procedures applied and external events that can negatively affect the financial institution. 2 Furthermore, operational risk arises in different ways, and the impact of this risk causes operational or financial losses to any bank. The losses emerging from inadequate management of operational risk can be significant enough to bring the bank to its knees and cause long-term reputational damage (Robertson, 2016:1). Compliance in the banking sector is also important to monitor whether banks comply with all BCBS regulations in terms of operational risk management (Fadun & Oye, 2020:27). However, since operational risk consists of four categories, the focus will be given to people risk (Alobaidi & Raweh, 2018:12). People risk is the first category of operational risk. Evans (2019) mentioned that people risk arises from the risk associated with the behaviour of employees that negatively impacts the organisation in meeting its goals. This could come from employees' work overload, incompetent employees, key man dependency, or employee theft. Evans (2019) further mentioned that people risk might also arise from the risk of unintentional errors or mistakes as most employees get tired due to the numerous daily operational tasks. Employees are the most essential assets in the banking sector; however, they can also be the biggest risk that could impact the banks’ operations (Jackson, 2015). Banks and other financial institutions should, by all means, ensure that adequate and effective controls are in place to manage the people risk that could potentially have a low frequency of occurrence yet a higher severity of impact. These risks could be managed by allocating resources aside for unexpected losses, training employees, and competitive staff compensation (Fadun & Oye, 2020:27). The importance of employees in a bank goes together with the culture of the organisation (Blunden & Thirlwell, 2013:296). Culture brings common goals and standards to the employees and helps them work well together to achieve specific goals. Furthermore, culture is a tool that establishes precedents on how an organisation approaches, communicates and manages risk (Jackson, 2015). Culture is what an individual does and how the individual does something without being managed or supervised (Jackson, 2015). Carretta et al. (2017:16) highlighted that culture is seen as a positive symbolic communication to the banks, and if taken seriously, it can guarantee the achievement of complex issues or tasks. Culture is the result of shared beliefs, assumptions, business experiences, behaviour, and strategic decisions within an institution as an aggregate (Carretta et al., 2017:12). Banks need to build a positive relationship with their employees and the culture that is enabling as it helps in reducing operational risk and adding value to assist in meeting the needs of the customers. Without a clear culture, organisations lack direction on how work should be done and lack values, beliefs, standards, and norms, which cause culture risk (Schmitt, 2019:3). 3 According to Landy (2016), developing employees with internal and external learning programs remains an important tool to upskill staff and contribute to helping banks achieve their operational and strategic objectives. It is about taking care of employees first, giving them some sense of togetherness, upskilling them, and making banks an attractive organisation of choice with a great working environment that benefits the employees. People and a positive culture create an environment that is family-like and is encouraged by good work ethics within the bank (Landy, 2016). Culture in the banking sector surrounds everyone with a common belief and goal and positively impacts people’s work habits and how they work well together. Although financial institutions and other organizations had a positive culture before the COVID-19 pandemic, lockdowns and less physical interaction negatively impacted organizational culture. They disrupted how employees used to go to work and do their work. Cherrington (2021) asserted that the unprecedented COVID-19 pandemic came with risks associated with people risk and culture risk, which may remain more prolonged than usual. People work from home; there is high absenteeism, and most things are automated, which poses a more operational risk to the banks. As banks operate through the current COVID-19 pandemic, it is more important than ever that people risk and culture risk becomes a priority. One of the challenges banks faces is managing people and culture risks in an ever-changing environment, especially during the COVID-19 pandemic (Cherrington, 2021). This is because the COVID-19 pandemic has changed how people work and negatively impacted the banks' corporate culture. Smit (2021) highlighted that during this time (the year 2021), banks and other organisations are exposed to a negative or decline in corporate culture as most of the work is done virtually, where employees tend to work in silos. According to Carretta et al. (2017:22), corporate culture is not static; instead, it is a formal and informal process repeated and renewed by the employees. Building a solid corporate culture enables an organisation to strongly support its employees and give them a sense of belonging. Carretta et al. (2017:22) further mentioned that in order to encourage an excellent corporate culture, financial institutions should consider having solid and effective communication, training and development, succession planning, better incentives, and a robust recruitment and selection process. These will contribute to the financial institutions' mitigating possibilities of a weak corporate culture. Middleton (2018) stated, “Take care of your employees, and they will take care of the customers” - Richard Branson. The consequences of people risk show its effect on the corporate culture of the organisation, which may result in culture risk. Culture risk results from misalignment between a company’s values, norms, beliefs, and standards and employees’ conduct, behaviour, ethics, morals, and company systems (Oven, 4 2020). Culture risk arises from the possibility of failing to adapt company practices across all functions. An enabling organisational culture can positively impact management’s decisions and employees’ daily operations if the company practices are adapted accordingly and managed adequately (Schmitt, 2019:3). Good culture in the banking sector has a tradition to fit in the banks’ knowledge and expertise that contributes to great institutional culture. For a bank to achieve its strategic objectives, operational risk should be given more attention to be adequately and effectively managed. The success of all the banks relies on proper management of all the risks to an acceptable level, and this will promote public interest and investor confidence (Rose & Hudgins, 2013:486). 1.2. PROBLEM STATEMENT One of the main determinants for banks to overcome financial and reputational challenges is to manage operational risk to an acceptable level. Banks have been exposed to various operational risks, such as people risk and culture risk. Moreover, this has been exacerbated by employees' lack of positive perceptions about the importance of managing or mitigating people risk and culture risk within the banking sector. People risk, and culture risk has not been in the limelight as top risks that could potentially impact the banking sector (Cherrington, 2021). People risk, and culture risk are interconnected and pose a threat to banks to adapt to the new culture, which may arise with new risks. The impact of people risk, and culture risk can put banks in an unfavourable financial position. Due to an immature culture, people may unintentionally commit huge errors that could financially impact the banks. This is constituted by the reality that people risk, and culture risks have not been given more attention as top focus risk areas. However, these risks are now regarded as one of the core risks within the banking sector, primarily since the COVID-19 pandemic in the 2021 period, where organisational culture declined tremendously due to employees working remotely with no or less room to improve culture and changing the traditional way of work and clients accessing banking services. However, this raises the importance of implementing effective and adequate controls strategies to ensure that people risk, and culture risk are less risky to the bank's operations and that there is good organisational governance. This will further promote sound and proactive management of people risk and culture risk and encourage positive and robust risk management practices within banks. Although banks have faced people risk and culture risk as part of operational risk, creating the right risk management environment will be beneficial to managing people risk and culture risk. This will guarantee extensive management of the 5 risks that would go far beyond protecting banks against unpredictable losses. Therefore, the research question “is there relationship between people risk, culture risk and risk management in the banking sector”? The aims to analyse people risk and culture risk on risk management in the banking sector to ensure that banks manage or mitigate the impact of inadequate management of employees and the risk of negative culture that could harmfully affect the success of the banks. 1.3. RESEARCH OBJECTIVES The following objectives were identified and outlined for this research study. 1.3.1. Primary objective The primary objective of this research study was to analyse the influence of people risk and culture risk on risk management in the banking sector. 1.3.2. Theoretical objectives In order to achieve the primary objective, the following theoretical objectives were formulated for the study: • Contextualise the South African banking sector; • Define culture risk and its relation to people risk; • Discuss a theoretical framework for culture risk as a component of operational risk; • Discuss the importance of good corporate culture in the banking sector; and • Establish the opportunities and challenges banks face to mitigate people risk and culture risk. 1.3.3. Empirical objectives In order to achieve the primary objective of the study, the following empirical objectives have been identified: • Determine the perception of operational risk management practises within the banking sector based on demographic factors; • Determine the relationship between people risk, culture risk and risk management during the COVID-19 pandemic and • Analysing the influence of people risk and culture risk on risk management in the banking sector. 6 1.4. RESEARCH DESIGN AND METHODOLOGY This study comprised a literature review and applied a quantitative research method. Primary data was gathered through the distribution of an electronic questionnaire, which was distributed to employees in the banking sector. The remainder of this section addresses the proposed outline for the research study's methodology. 1.4.1. Study design and context The following objectives have been identified and outlined for the study. 1.4.2. Empirical study The study was conducted using primary data through online questionnaires distributed to participants. 1.4.3. Primary data The primary data comprises the sections below: 1.4.3.1 Population A target population must be appropriately selected since researchers make inferences regarding the whole population based on a selected sample. Target populations will be based on employees in the South African banking sector. The study will also comprise various banks impacted by operational risks, such as the top five South African commercial banks: Amalgamated Bank of South Africa (ABSA), First National Bank (FNB), Nedbank, Standard Bank, and Capitec Bank. These South African commercial banks were chosen based on net assets, income, market share, and the number of branches and employees (Opperman, 2020). 1.4.3.2 Sample Size The sampling frame consists of 400 individual employees in the banking sector. This study used purposive and snowball sampling to identify individual employees who met the sample criteria. The criteria encompass participants from the following top five South African commercial banks: ABSA, FNB, Nedbank, Standard Bank, and Capitec Bank. This includes employees/participants who have been employed for more than six months in any of the banks mentioned above, are 18 years of age and above and have some form of education (a minimum of matric - Grade 12/certificate). 7 1.4.3.3 Process of obtaining informed consent All participants were requested to complete an online consent form before starting the online questionnaire. The purpose, role, and objectives of the study were also explained. The compliance and ethical clearance processes were outlined to demonstrate to participants that all ethical and compliance processes and procedures had been followed. The informed consent form was added to the questionnaire for participants to consider ethical considerations. 1.4.3.4 Data collection The study used an online questionnaire distributed electronically to individual employees in the banking sector. No hard copy (paper-based) questionnaire was distributed to individual employees due to COVID-19 guidelines of less physical interaction. An introduction was used to explain the significance of the study to the individual employees and their participation. The questionnaire outlined the importance of the study and their participation in it. The questionnaire includes the following sections: Section A contains demographic information, Section B contains risk management questions, Section C contains culture risk questions, and Section D contains people risk questions. The first section, Section A, comprises various demographical factors such as age, gender, ethnicity group, and education level. Demographic questions were asked as part of the inclusion criteria for this study to capture the correct sample, and it was not required to achieve the research study's objectives. The education levels were also asked as participants needed specific financial knowledge about the importance of overall risk management within the banking sector. Section B comprises risk management questions to determine the perception of risk management in the banking sector. Section C includes culture risk questions that would assist in determining the perception of culture risk in the banking sector. Section D, the last section of the questionnaire, encompasses people risk questions that would assist in determining the perception of people risk in the banking sector. The questionnaire was constructed based on literature and previous studies on risk management and risk maturity assessment (Newby, 2016; National Treasury of South Africa, 2020). 8 1.5. ETHICAL CONSIDERATIONS The study was conducted in alignment with the North-West University (NWU) ethical guidelines and principles (NWU, 2016:13). The questionnaire was treated with high confidentiality, and employees did not include their details or other personal information. Employees were instructed not to mention or include any information that could be used to identify them or their employer, as they would remain anonymous. Employees were not forced to participate in this study as their participation was voluntary, and they were welcome to decline to participate. All the responses from the individual employees were treated as highly confidential information and were only used for this research study. 1.6. CHAPTER CLASSIFICATION The study consists of the following chapters: Chapter 1: Introduction The section introduced the study, its objectives, an overview of the methods intended to be employed, and a summary of the sections that have been planned. The overall research objectives and theoretical and empirical objectives were explained, and the research methodology used in the study was described. Chapter 2: Analysis of the banking sector This chapter provides an analysis and overview of the banking industry. Its benefits and drawbacks were mentioned as part of the discussion. Various banking regulations, along with solvency requirements, were included and analysed. This section also discusses measures banks could take to reduce risk and raise awareness. Chapter 3: Overview of operational risk, people risk and culture risk This chapter will provide a theoretical overview of operational risk and examine the theoretical link between people risk and culture risk. The factors influencing people and culture risk in the banking sector were outlined and analysed. The impact of people risk and culture risk on the 2007/08 Global Financial Crisis (GFC) and the COVID-19 pandemic was discussed and compared, and international frameworks and guidelines such as the Basel Accords, ISO 31000, and the King IV Code were highlighted. Chapter 4: Research design and methodology 9 This chapter provides information regarding the research design, methodology, and data collection techniques. Different research approaches and designs were discussed, and the most appropriate ones for this research study were chosen. Sampling procedures were outlined, including explanations of the sample size, choice of sample, and the data collection process. Pre-testing of data was also conducted. The model used in the simulations was explained. Chapter 5: Statistical analysis and discussion of the results A simulation of the statistical data was conducted. The data were analysed to provide a clear conclusion about the people risk and culture risk in the banking industry. The results were analysed using statistical tools and interpreted to give possible solutions and findings. Chapter 6: Recommendation and Conclusion An analysis of the influence of people risk and culture risk on risk management in the banking sector was recommended and concluded. The conclusion pointed out the importance of the study and measures to focus more on mitigating people risk and culture risk. 10 CHAPTER 2 THEORETICAL BACKGROUND: ANALYSIS OF THE BANKING SECTOR 2.1 INTRODUCTION The focus of this chapter is to provide an in-depth analysis or review of the banking sector, which includes a revision of its definition and identifying and differentiating between the different types of banks. Moreover, it is crucial to contextualise banks' current compliance and regulation. The last section will focus on measures banks could put in place to manage the ever-changing risk environment in the banking sector. This chapter aims to achieve the following theoretical objective mentioned in chapter 1: contextualising the South African banking sector. This can be achieved by discussing the following components: • Review the South African banking sector, its definition, and types of banks; • The roles, responsibilities, and purpose of a bank to the economy and society; • Definition and discussion of risk and risk management; • The risks inherent in the South African banking sector; • The regulation and legislation governing South African banks; and • The global regulatory and governing bodies, including the Basel Accords, King reports, Committee of Sponsoring Organisations of the Treadway Commission (COSO) and ISO standards. Banks play an essential role as financial intermediaries where financial transactions are facilitated, and they are also the core engine of the economy. Developed and developing economies depend on banks as financial intermediaries to facilitate and safeguard financial transactions (Akrani, 2011). The following section will define a bank and its role as a financial institution. 2.2 DEFINITION OF A BANK According to Ozsoy and Sayfullin (2006:75), the word bank originated from the Middle French ‘banque’ derived from Old Italian ‘banca’ meaning ‘table’. In Old High German, bank meant ‘bench counter', which is a place where bankers used benches as makeshift exchange counters (Akrani, 2011). Different authors and economists define banks according to what it does as a financial institution. 11 According to AL-Shatnawi et al. (2021:3), a bank is a financial institution that allocates and transfers money by issuing loans, holds clients’ deposits for a fee and withdraws to individuals, businesses, companies and governments. A bank is defined as a financial institution according to the nature of its business as well as how it conducts its financial services in the economy (Heffernan, 2017:1). Gobat (2012:38) further mentioned that a bank is a financial institution by nature of its operation that matches up depositors and borrowers to help ensure that the economy and financial transactions function smoothly. There is no single definition of a bank; however, it is described according to the nature of its business, which it provides as a financial service to its customers (Gobat, 2012:38). Hull (2018:25) highlighted the traditional financial services that a bank provides include the following but are not limited to: • Deposits and withdraws; • Issuing of loans to individuals and businesses; • Offering home mortgage loans; • Offering financial advice and related financial services, such as insurance; • Issuing credit; and • Currency exchange (bureau de change). Hull (2018:25) asserted that the traditional role of banks has been to provide financial services, such as deposits, withdrawals, and making loans, in return for receiving interest from loans or withdrawals. Most banks provide services in both commercial and investment banking. Commercial banking services include deposits and lending, whereas investment banking helps businesses raise debt and equity and provides financial advice on mergers and acquisitions and other corporate finance decisions (Hull, 2018:25). Large corporate banks often engage in stock or securities trading. The following section will discuss the purpose and role of a bank as a financial institution. 2.3 THE PURPOSE OF A BANK South African banks play a crucial role in the economy by maintaining financial stability and facilitating financial transactions between two or more parties (Maredza & Ikhide, 2013:553). Banks act as financial intermediaries and serve as the purses of individuals, businesses, government, and other economic role players (Mishra, 2010:20). Although South African banks operate in an unpredictable environment that is faced with numerous risks, they have managed to avoid the financial meltdown that arose from the 2007/08 GFC. Maredza and Ikhide (2013:553) asserted that this resulted from the South African banking sector being protected by solid macroeconomic policies and prudent regulation. This implies that the South African banks had enough capital in reserves to help them survive tough macroeconomic 12 challenges. South African banks’ ability to identify, measure and manage risks comprehensively has benefited and contributed towards a stable banking sector (Stavroula, 2009:13). One of the essential roles of a bank is to connect and align with creditors and borrowers, as well as play a vital role in smoothing domestic and international transactions (Gobat, 2012:38). Munyai (2020:12) explains that banks were established for commercial purposes and to facilitate financial transactions. According to Heffernan (2017:1), customers usually prefer banks with immediate liquid cash because lenders, depositors, and borrowers all have different liquidity appetites. Customers want access to funds from their accounts at any time without a hassle (Heffernan, 2017:1). According to Allen et al. (2019:1), banks similarly perfect their role as intermediaries between investors and borrowers by ensuring that depositors’ funds are saved and used to offer loans to customers. Furthermore, banks also provide insurance to customers against unexpected macroeconomic challenges. They do this by putting aside some of the depositors' funds to sustain them during the tough economic meltdown. Various banks differ according to their roles across different sectors and countries. However, they remain an important key to the financial system (Bollard, 2011:2). Table 2.1 below represents an overview of a bank's roles and responsibilities. Table 2.1: Roles and responsibilities of a bank Role Responsibilities Credit provision Provision of credit to individuals and businesses. Liquidity provision Deposits can be withdrawn at any time when a financial need arises. Risk management services Banks allow businesses and households to pool their risks from financial market exposure and commodity price risks. Much of this is provided by banks through derivatives transactions. Remittance of money Easy transfer of money from one person to another and also offer credit facilities, which include credit cards, cheques, drafts, and real-time gross settlement. Rapid economic development Issue loans to different sectors and industries for economic development. Facilitate foreign or local direct investment in industrial sectors. Also, provide financial/commercial consultancy. Promotion of entrepreneurship Promote entrepreneurship by making loans available to customers. Source: Adapted from Bollard (2011:2); Sanderson (2019) 13 As shown in Table 2.1, banks play different roles in society and the economy, serving as an intermediary between people, governments, and other institutions by facilitating financial transactions (deposits and withdrawals), issuing loans, and maintaining financial stability through quantitative easing in the banking system. 2.3.1. The role of a bank as a financial intermediary Banks are known as the middlemen where the transfer or exchange of money between individuals, organisations and businesses takes place, as well as deposits and borrowing by the public and other companies (Redda, 2015:18). Dawd (1996:115) explained that the role of financial intermediary is to allow a third-party organisation to smooth the transfer of financial information or financial transactions between two individuals or organisations. Van der Merwe et al. (2014:42) further highlighted that a financial intermediary is a financial institution that transfers funds from savers to borrowers intending to make a profit from the interest gained. Financial intermediaries connect investors to borrowers and make financial markets more efficient in the process. Van der Merwe et al. (2014:42) further stated that borrowers include any customer (who needs to finance day-to-day expenses), company or organisation (that needs to expand their operations or for investment purposes), and government (that needs to finance deficits and provide public services). On the other hand, lenders are domestic and international role players in the financial system that save their income, intending to lend it to other individuals or organisations to meet their financial needs (Van der Merwe et al., 2014:42). Financial intermediation is a fundamental process within an economy that facilitates the financial cycle from one who is not currently using the money to another one in need of the money (Redda, 2015:18; Ferreira, 2019:15). This builds the economy to be more efficient with a smooth distribution of funds between hands. To build resilient financial systems, financial intermediaries continue to hold appropriate capital for sustainability purposes, especially during harsh macroeconomic conditions such as the 2007/08 GFC, and to maintain their financial stability and reputation (Munyai, 2020:13). Ferreira (2019:16) and Munyai (2020:13) pointed out that financial intermediaries comprise the depository and liquidity functions. Depository functions include using bank payment facilities to transfer or save money. In contrast, liquidity functions relate to customers' current and future financial needs and the ability to convert assets that are temporarily invested into cash (Ferreira, 2019:16). Financial intermediaries charge lower costs of the transaction to customers and provide cheaper financial services than other financial institutions as a result of their massive contribution to the economy (Van der Merwe et al., 2014:42). 14 A bank, as a financial intermediary, helps customers save their funds and provides credit to those customers who need financial relief (Van der Merwe et al., 2014:42). Van der Merwe et al. (2014:42) further mentioned that various financial intermediaries provide a broad range of financial services. In contrast, others are more focused on a niche market. The following section focuses on different types of banks and their services to society and the economy. 2.4 TYPES OF BANKS Previously, South African banks were focused on financial products to help secure more outstanding market share (Strauss & Mfongeh, 2016:62). Nowadays, South African banks are more focused on rendering financial services to their clients, playing a vital role in the economy through growth and development, and ensuring efficient movement of money from savers to borrowers (Maredza & Ikhide, 2013:553). Banks are categorised according to the nature and services rendered to the economy. However, this study will focus on commercial, investment, retail, and cooperative banks that guard, exchange, and accept deposits. This results in commercial, investment, retail, and cooperative banks providing extensive economic services and having a high percentage of market share in terms of clients. Table 2.2 lists different types of banks with their respective core functions. Table 2.2: Different types of banks Type of bank Services rendered Affiliated bank Banks that a holding company partially or wholly owns. Agri bank Offer loans to small and emerging farmers. Banker’s bank Offer cheque clearing and trading of securities to other banks, and services are not offered to the public. Central bank Overseeing the monetary system and financial sector of the country. Commercial bank Offer or accept deposits, withdrawals, personal loans, and savings accounts to individuals and small and emerging businesses. Community bank Locally centered commercial and savings bank. Cooperative bank Mutual society banks promote savings among their customers and provide ownership to the customers who make deposits. Development bank Offer loans to promote development and sustainable economic development, growth, and regional integration through infrastructure finance and development. Insured bank Reserve deposits, which are backed by deposit insurance plans. International bank Commercial banks are present in numerous nations. 15 Type of bank Services rendered Investment bank Offer underwriting issues of securities and oversee large and complex financial transactions. Merchant bank Offering debt and equity to corporate clients Mortgage bank Provide mortgage loans to clients. Retail bank Offer financial services to households and small and emerging businesses. Saving bank Accept deposits, withdrawals, and loans to individuals. Universal bank Provides various banking services to customers and non-banking financial services under one authorized or legal entity. Virtual bank Banking services that are solely offered over the Internet or online platform. Wholesale bank Major commercial banks that are offering services to big corporations, businesses, and governments/states. Source: Adapted from Rose & Hudgins (2013:3); Heffernan (2017:1); Hull (2018:26); Ferreira (2019); Mukhopadhyay & Vaidya (2021) The South African banking sector has increased sharply with the number of banks entering the market and attracting more customers. These types of banks mentioned above dominate the South African market by the financial services they provide to the people, governments, organisations, and other institutions (SARB, 2021c). The following section will discuss South African prevalent banks in detail. 2.4.1. Commercial Bank As defined in Table 2.2, commercial banks make a profit by earning interest from loans issued to customers and other financial transactions (Mishra et al., 2021). Farhan et al. (2019) mentioned that commercial banks combine numerous types of contingent guarantees with financial derivatives such as forwards, futures, swaps, and other loans, including financial loans and mortgages. Commercial banks do not usually depend on unstable wholesale funding like brokerage institutions. Commercial banks often fail due to significant investment in non-household real estate loans and issue loans to the riskiest borrowers without background checks or collateral, resulting in defaults (Antoniades, 2017). 2.4.2. Investment Bank An investment bank, as defined in Table 2.2., assists clients by providing financial services to raise debt and equity financing for large corporations and governments (Rose & Hudgins, 2013:3). Hull (2018:32) mentioned that one of the functions of an investment bank includes 16 originating securities, underwriting of currencies, investing securities and offer funding to qualifying investors in the market with the hope of receiving investment returns. According to (Hull, 2018:32), the following financial services are offered by investment banks to their clients: • Underwriting; • Mergers and acquisitions; • Trading – equities, fixed income (bonds), proprietary; • Fund management; • Consultancy; • Global custody; • Assets management; • Wealth management, and • Capital raising. 2.4.3. Retail Bank A retail bank is also known as a consumer bank, and its primary function is to facilitate financial transactions of individual customers and small businesses directly rather than corporate entities (Rose & Hudgins, 2013). Retail banking is also known as customer-centric services offered by commercial banks (Anandalakshmy et al., 2020:1691). The term ‘retail’ (from a retail bank) specifies the services that are almost like storefront shopping or the over-the- counter nature of commercial banking. According to Kumar (2017), retail banks usually have a head office and many branches in different locations to provide services closer to customers. All branches provide the same services that serve the customer’s needs. According to Kumar (2017), the services offered by retail banks include, but are not limited to: • Personal loans; • Mortgage loans; • Debit and credit cards; • Savings and transactional accounts; and • Certificate of deposits. One of the core services that retail banks offer is accessible technology to clients to do their transactions using online banking applications (Apps) (Anandalakshmy et al., 2020:1691). Retail banks depend on technology to facilitate their transactions, and customers frequently expect digital solutions that are reliable and easy to use to access their bank accounts. Product differentiation and customer choices between retail banks are usually influenced by access to 17 technology (online banking) and technological capacity (Makhaya & Nhundu, 2016:112).This implies that customers’ preference for retail banks highly depends on the ease of access technology enables. 2.4.4. Cooperative Bank According to Kumar and Srivastava (2020), cooperative banks are small-sized financial institutions that offer financial services to their customers, and those customers are the bank's owners. A cooperative bank is formed and administered by the depositors, entitled to vote in the shareholders’ meetings and receive dividends. Kumar and Srivastava (2020) further mentioned that the depositors who are cooperative bank members are the bank's customers. The control of a cooperative bank is typically democratic, with each member (customers) having an opportunity to vote once. Kumar and Srivastava (2020) explained that a cooperative bank is different from any other bank in how it conducts its business by issuing small amounts of loans to customers, the client base, and geographic area. Cooperative banks play a huge role in providing banking services and meeting the financial needs of retail, small, and medium-scale businesses and borrowers within geographical proximity and local communities (Kumar & Srivastava, 2020). Cooperative banks have always been conservative in their investments, allowing them to remain financially stable and operational during tough macroeconomic challenges such as the 2007/08 GFC. Although cooperative banks do not provide large-scale economic services like commercial and investment banks, they are essential to communities as they serve many clients with low to medium household incomes (Kumar & Srivastava, 2020). However, all banks face particular risks in the financial sector, and they need to identify, analyse, and manage these risks. For banks to mitigate or manage risks, there is a need to understand risk and risk management to help ensure the operational efficiency of the banks where risks are managed to the appropriate level. The following section will focus on in-depth discussions on risk and risk management. 2.5 RISK AND RISK MANAGEMENT All organisations, from non-profit to profit-making companies, including banks, function in an ever-changing economic and financial environment where risk is inevitable and may impact the organisation’s strategic objectives. Each risk the organisation faces originates from an internal or external source (Toma et al., 2012:976). Toma et al. (2012:976) further highlighted that risk management is an essential tool to safeguard organisational processes and can add and create value in an organisation. According to Soin and Collier (2013:83), risk is defined 18 as the uncertainty of the outcome of an event or decision, whereas risk management is the process of managing risk. Risks are managed through adequate and effective risk management. Management of risks guarantees smooth operations, a favourable financial position, attracts investors and clients, and a better public perception of the organisation (Young, 2014:15; Aldasoro & Park, 2018:2). Furthermore, Soin and Collier (2013:83) mentioned that the link between risk and risk management had been given little attention in the past. However, this concern has been addressed as an after-effect of the 2007/08 GFC. Organisations have since adopted proactive Enterprise Risk Management (ERM) strategies and response plans to manage or mitigate risk through identifying, analysing and effectively monitoring the risk to achieve their strategic objectives (Vasvári, 2015:29). 2.5.1. Risk and the Source of Risk According to Ivascu and Cioca (2015:2), risk is the uncertainty of an event that can negatively affect a business to achieve its strategic objectives. Praxton Research Group Limited (2018) stated that risk is formed from three elements, which start with a future potential event combined with probability (likelihood) and potential severity (impact). Risk is best defined as an unknown or uncertain area. However, Duong (2013:10) argues that uncertainty encompasses a broader term, while risk is only part of it. According to Toma et al. (2012:976), risk originates from history associated with economic theory, where there was an evaluation of the good or the bad related to economic activities. According to Vasvári (2015:29), risk comes from a source, the root cause. Abdirad et al. (2012:90) mentioned that the source of risk is a primary condition that creates a possible risk event. Abdirad et al. (2012:90) further highlighted that where there is a risk (uncertainty), there is a source or root cause of that risk. According to Baud and Chiapello (2017), there are three sources of risks outlined in Table 2.3 below: Table 2.3: Source of risk Source of risk Description Uncertainty-based risk Uncertainty-based risk is a business risk that cannot be qualified or quantified, and its consequences cannot be foreseen or insured against. Uncertainty is also based on beliefs, and not only randomness or haphazardly. Examples include natural disasters, black swan events, macroeconomic factors, and operational and financial risks. Opportunity-based risk Opportunity-based risk is based on taking risks that banks are guaranteed to profit or capitalise on the opportunity. This risk is taken when companies aim at maximising their profit 19 Source of risk Description without facing any uncertainty. Examples include selling new products or services, relocating the business to a new location to attract new customers, and creating new opportunities. Hazard-based risks Hazard-based risk is a risk associated with the occupational health and safety of the company. This risk arises from damage, safety concerns, potential harm, and adverse health effects on employees. Examples include fire, storm, gas, smoke in the premises, and abandoned old buildings. Source: Author’s compilation; Wang et al. (2014:90); Baud and Chiapello (2017); Msomi (2018:12) Table 2.3 above shows three different sources of risk which can be used in risk assessment in any organisation to identify the origin of the risk (root cause). The source of risk comes from the traditional risk management approach, also referred to as a reactionary method of managing risk. The traditional risk management approach is applied after a risk has occurred and is concerned with the types of risk that an insurer can insure or a third party (Lundqvist, 2015:442). Every sector is exposed to different types of risks. The banking sector is exposed to (but not limited to) operational risk, reputational risk, credit risk, market risk, country risk, people risk, and compliance risk (Mazars, 2020). Risk can have a positive or negative impact on the banking sector. For example, positive risk (favourable fluctuation of currency, emerging positive change in regulations) can help banks to open new branches in different locations and make a profit. In contrast, negative risk (political instability, unfavourable local economy, credit default from clients) could ultimately force the bank to close (Stulz, 2014). Moreover, risk is the uncertainty that banks cannot avoid due to the complex banking sector in which they operate. Banks face almost the same systemic risk resulting from the breakdown or collapse of the entire banking system. However, the severity (impact) of systemic risk may differ amongst banks due to the exposure faced (Nasa, 2020:21). The following subsection discusses risk management. 2.5.2. Managing Risk According to Blunden and Thirlwell (2013:5), risk management entails taking measures to manage or mitigate the likelihood and impact of a possible risk. Although there is always a potential that something could go wrong due to human error, process failure, or an unpredictable external factor, putting controls in place to mitigate the risk is a way for banks to gain public trust and regulatory intervention. Nasa (2020:19) mentioned that for banks to 20 mitigate the potential risks they could be exposed to, effective risk management and controls should be implemented. The criticality of risk management is one of the processes that helps banks and other organisations identify and manage any potential risk that could financially and operationally harm the banks and other organisations. Inadequate risk management impacts the bank's image and financial position (Muriithi & Waweru, 2017). Effective risk management enables banks to identify, analyse, assess, and manage risks they are faced with, including emerging risks, which are risks that have been identified but not yet occurred, as well as those risks that banks do not have knowledge of or experience in managing (Fadun & Oye, 2020:25). The next section will further discuss the risks (operational risk, credit risk, market risk, reputational risk, liquidity risk as well as solvency risk) that banks face. 2.6 RISKS FACED BY BANKS A wise man once said that high risk equates to high reward and that profit is a reward for taking all the risk exposure (Richardson, 1970:88). This statement is apparent in the banking sector as banks are exposed to numerous types of risks. According to Suresh and Paul (2014:6), a successful bank can manage and mitigate the risk it is exposed to, as well as make a significant profit from all financial transactions. Mitigation of the risks faced by banks starts with establishing context, identifying the risks, assessing the risks, analysing the risks, evaluating the possible impact, and monitoring the movement of the risks (Venter, 2020). Anginer et al. (2014) stated that risks such as operational risk, credit risk, reputational risk, systemic risk, systematic risk, market risk, liquidity risk, and regulatory risk are some of the risks that pose a severe threat to the banking sector if they are not adequately and effectively managed. These risks mentioned above will be discussed below. 2.6.1. Operational Risk Operational risk, as defined above in Chapter 1, consists of potential losses stemming from the operation of a bank. Operational risk sources include people, processes, and internal and external factors and are different from market risk, which involves upside (profit) or financial movements caused by adverse market movements (BCBS, 2006). Some examples of operational risk include losses from inefficient processes, unintentional employee errors or mistakes, employee misconduct, occupational health and safety risk, cyber risk, disruption of information technology systems, natural disasters as well as black swan events like the COVID-19 pandemic, Spanish flue, and monkeypox viral disease (Mare, 2019; Hughes & Marzouk, 2021:174; Kozlov, 2022). 21 Operational risk is linked to one of the root causes of the 2007/08 GFC that impacted banks since it is connected to the risk of the issuance or approval of loans to risky customers who did not qualify and failure to identify potential risks (Nasa, 2020). de Jongh et al. (2013) asserted that the 2007/08 GFC was caused by the issuing of loans and mortgage bonds to unqualified customers, which resulted in banks failing to manage operational risk. Furthermore, banks failed because they did not put funds aside as a cushion to help them overcome unexpected customer defaults. As a result, banks were still operating under the guidance of the Basel II Accord, which did not make room for unexpected losses (Larsson & Soderberg, 2017). For banks to guarantee their success in the current changing risk climate, operational risk should be managed constantly and continually. Britain’s oldest investment bank, Barings Bank, suffered from operational risk (internal losses) due to a massive loss sustained by one of its derivatives traders (Elliott, 2020). This shows how it is vital for banks to manage operational risk as it has brought Baring Bank to its knees. The fundamental requirement for managing operational risk in any organisation is to ensure that risk takers are separated from risk controllers (Chapelle, 2019:222). Operational risk comprises four categories, which are illustrated in Table 2.4 below: Table 2.4: Categories of operational risk Categories Examples of root causes People Harassment, discrimination, employee errors, great resignation, key man dependency, lack of succession plan, ethics, organisational culture. System Technical and technological failures include inadequate information systems, data governance, business continuity management and plans, outdated software, and power backup. Process Inadequate frameworks and policies, Standard Operating Procedures (SOPs), and ineffective internal controls and tools. External events Poor services by third parties, social and political unrest, black swan events (COVID-19, Spanish flu, Swine flu), social and geographical factors (racism, tribalism), and natural disasters (earthquakes, typhoons, tremors, draught). Source: Author’s compilation; Matthews (2008); Matthews & Thompson (2008:128); Hughes & Marzouk (2021:174) Table 2.4 above demonstrates four categories of operational risk. These components contribute towards banks' exposure to financial, reputational, and operational loss, which can, in turn, lead to bankruptcy if not managed adequately and effectively. By mitigating these 22 components of operational risk, smooth operations of banks are guaranteed, as well as quality products and services to the customers (Suryaningsih & Sudirman, 2020:253). 2.6.2. Credit Risk Suresh and Paul (2014:276) mentioned that credit risk is defined in relation to “financial failure”, which means bankruptcy, default, or liquidation of a bank or organisation. The definition sets aside the possibility of credit quality or creditworthiness of a loan that could be downgraded or upgraded (Suresh & Paul, 2014:276). Credit risk is defined as the risk resulting from customers’ failing to pay back a loan or financial commitment to a bank based on agreed payment arrangements (Chance & Brooks, 2016:537). An inclusive definition would include value risk, which is the risk of losing a significant amount of funds without defaulting (Saleh & Afifa, 2020:3). Banks are not only formed to accept deposits and withdrawals; they also issue loans and provide smooth credit facilities. Although lending is one of the primary sources of income for banks, they are ultimately exposed to several risks that could impact the bank if not assessed, analysed, and managed adequately and effectively (Saleh & Afifa, 2020:4). This makes them unavoidably exposed to credit risk. The success of banks relies on proper and efficient management of credit risk, which has a positive impact on the profitability and reputation of the bank (Garr & Awadzie, 2021:4). This can be accomplished by putting in place adequate risk management measures that banks can use to control or manage the negative effects of credit risk on their balance sheets. 2.6.3. Market Risk Apart from issuing loans and holding deposits from customers, banks also facilitate a significant portion of the securities that are traded in a bank as a means of receiving short- term money (Allen et al., 2019:2). Market risk is the risk resulting from the loss of financial investment due to exchange rate fluctuations, price movements, or interest rate movements (Chance & Brooks, 2016:557). Market risk sources range from commodities to cryptocurrencies and any other financial instruments. Killian (2019) asserted that market risk is also referred to as a systematic risk, which is undiversified since it is a universal risk that affects the entire market or economy. Market risk can be managed by hedging the risk. According to Killian (2019), hedging refers to purchasing assets to reduce the risk of losses from other assets. Hedging is a strategy used to offset the risk of uncertainties. Traders understand that certain risks are needed to bring higher returns on investment. On the other hand, hedging allows traders to take the risks they 23 have an appetite for while being protected (Shin & Soydemir, 2018:3). Banks usually use hedging contracts such as swaps, forwards, and options to manage market risk. Table 2.5 below lists the types of market risk with a detailed explanation: Table 2.5: Types of market risk explained Type of market risk Description Interest rate risk Interest rate risk is associated with an adverse consequence resulting from unexpected changes or movements in interest rates. Interest rate risk is linked to fixed-income assets, such as mortgage bonds, and has an inverse relationship with bonds. As interest rates increase, the bond price decreases. Equity price risk Equity price risk is the risk resulting from losses or not achieving predicted income from unexpected changes in the prices of financial assets in the market. Commodity price risk Commodity price risk is the risk resulting from changes in commodity prices due to adverse external market movements. This risk may be caused by unstable political interference and regulatory or seasonal change. Exchange rate risk Exchange rate risk results from the fluctuation of currency prices. When the price of a foreign currency changes, it spills over to the local currency by becoming more or less expensive to acquire foreign assets—for example, the movements of the dollar against the rand. Source: Author’s compilation; Treapăt & Anghel (2016); Gray (2019) Table 2.5 explains the different types of risks that make up market risk. Market risk is unavoidable; however, banks usually put measures in place to manage this risk by allocating resources specifically for adverse market movements. The repercussions of market risk tend to be severe and hurt the entire global economy, including the banking sector and could bring any organisations and institutions to their knees. However, budgeting for market risks to be in a better financial and operational position when they arise is crucial. 2.6.4. Reputational Risk Reputational risk is regarded as one of the top risks (one that they pay the most attention to) in the banking sector. According to Chapelle (2019:221), reputational risk results from damage to a bank's image or negative perception. Ferreira (2019:56) further described the reputational risk as the risk associated with the brand and other related stakeholders’ (customers, public, investors) perception of the bank. Reputational risk can affect the image of any business or organisation, regardless of its size, industry, or sector; however, it is difficult to quantify the damage it causes. According to Blunden & Thirlwell (2013:323), reputational risk results from a control failure because of an operational risk event. 24 A good reputation can build a bank, whereas a bad reputation can similarly damage a bank. Young (2014:15) stipulates that the more a bank depends on public confidence, the greater the risk of reputational damage, as it negatively affects the entire bank and not just the function where the risk event occurred. Msomi (2020:19) further mentioned that some possible effects of reputational risk on banks include but are not limited to downgrades in credit ratings, loss of key stakeholders, non-compliance with regulation, litigation, or loss of funding. Negative perception potentially negatively impacts a bank's earnings and capital, also known as reputational risk. According to Blunden and Thirlwell (2013:335), reputational risk can be mitigated through preventive or detective measures to provide positive stakeholder expectations. This can be done through a stakeholder survey as a detective control for reputational risk management. Another control for managing reputational risk is through corporate or bank communication functions that assist in providing assurance to all stakeholders via communication platforms. The importance of managing reputational risk in a bank is shown when employees, potential employees, clients, and regulators have confidence in the bank and positively contribute towards its success, from financial to operational, as well as attracting new markets (Hoy, 2012:14). Table 2.6 below provides examples of reputational damage that could impact a bank: Table 2.6: Examples of potential reputational damage Reputational problem Example of poor reputational handling Losing key employees Poor internal communication and lack of succession plan. Loss of suppliers and customers Poor marketing communication. Difficulty in raising capital Poor investor relations. Non-compliance and litigation Inadequate controls over operational risk. Financial loss Poor service delivery to stakeholders. Source: Author’s compilation; Blunden & Thirlwell (2013: 335) Table 2.6 depicts root causes that could possibly cause reputational risk events that can damage a bank's brand. Reputational risk is one of the crucial risks to banks and other corporate entities as it is associated with people’s perceptions and opinions (Ferreira, 2019:52). 25 2.6.5. Liquidity Risk Liquidity has been the centre of attention for banks to shield themselves from the risk of inefficient liquidity management. This is due to the fact that banks should always have a liquid amount of money available for rainy days (Iraci, 2021). Gupta (2020) stated that the 2007/08 GFC exposed banks and financial institutions to liquidity risk, including Lehman Brothers and American International Group (AIG). According to Saleh and Afifa (2020:3), liquidity risk arises from a bank failing to meet its short-term obligations, such as payment to creditors or payment of salaries and bills. Liquidity risk arises as a result of a bank being unable to quickly convert assets into cash when required (Saleh &