SBAB Bank implements digital risk management solution

February 01, 2022

Nordic

Financial Services

Background: 4C Strategies has been working with the Swedish government-owned SBAB Bank for many years. This has, amongst other things, included risk management support and holding crisis management training and exercises for the central crisis management team and the Board. In 2014, SBAB Bank decided to phase out the use of spreadsheets for operational risk management and use a digital solution instead. 4C had the optimal solution in Exonaut®.

Challenge: Help SBAB digitalise operational risk management to better meet stricter regulations, provide an organisation-wide common risk understanding, and support the implementation of new risk methodologies.

Solution: Exonaut Risk Manager delivers a systematic approach to enterprise-wide risk, according to the ISO 31000 standard, in an information-rich and user-friendly desktop and mobile solution. Exonaut is featured in Gartner’s 2020 Hype Cycle for Risk Management report.

Benefits: SBAB can follow a structured risk framework throughout the risk lifecycle and control, communicate and mitigate risk more efficiently at every level of the organisation using an innovative three-dimensional approach to risk evaluation.

Customer: SBAB bank offers mortgages and savings options to consumers, businesses, and tenant-owned housing associations. It is wholly owned by the Swedish government and employs around 750 staff.

Dedicated risk management tool

The increasing number of financial regulations has made it more and more challenging for banks to effectively keep track of all their risks using basic programs such as spreadsheets. In 2014, SBAB decided to invest in 4C’s Exonaut software which started a digital journey leading to new efficiencies, and risk methodologies, for the online bank.

Common risk understanding

Stakeholders throughout the organisation – ranging from middle management to business executives – have access to the risk management solution. Data can be easily partitioned to ensure the right users can easily and only get access to the right information.

“The Exonaut risk management solution serves as a foundation for the organisation to have a common understanding of the risks that it’s exposed to. It enables us to collect data in one central place, so we can easily work with and track it – which facilitates communication among the relevant stakeholders. Keeping data up to date and structured is key to avoid misunderstandings – especially when you have up to 100 users,” says SBAB Risk Analyst and Exonaut System Manager, Filip Rönning.

“Using Exonaut, we are able to analyse and identify distinguishing features of the company’s risk exposure within different operational areas – and track our progress. This information feeds into the overall strategy of the company as it enables senior management to take better, more informed decisions.”

Filip Rönning, SBAB Risk Analyst and Exonaut System Manager

Clear terminology and framework

This is not something that has happened by chance. The operational risk department has developed a clear and distinct terminology and framework, which it is working hard to implement organisation-wide. This ensures all stakeholders are on the same page when it comes to the communication of risk, and the decisions that have to be taken further down the line.

“If you mix up a control deficiency with a risk, you can end up in some sort of risk paralysis.” Filip continues. “Having a complete framework, which includes control dimensions, enables us to avoid such a mix up. We can also point to which risk a control mitigates and identify the effect it has on the risk exposure. This enables us to make better, risk-informed decisions in terms of if we need to take actions or not.”

Four-step process

“Exonaut is used regularly as part of a four-step risk process. The four steps begin with gaining an awareness of the risks that can occur in any given activity. They are then evaluated in terms of the best- and worst-case scenarios. This is documented along with the associated risks, from which conclusions are drawn. Finally, risks are followed-up by answering questions such as: Does the situation need to be changed, or is it possible to proceed as planned and adjust accordingly?”

“Risk management isn’t something you do once and put in a drawer for use later down the road.” says Filip. “Risk is a circular process that must be managed continuously, which is a lot easier to do with a digital risk management solution such as Exonaut. The four steps must be present in any activity. The level of detail will essentially depend on the complexity of the activity.”

Three-dimensional approach to risk evaluation

During the time SBAB has been using the Exonaut risk management solution, the bank has gone through a change process, which is dependent on having a common understanding of risk within the organisation. The risk department recently developed a three-dimensional approach to risk evaluation which is currently being implemented organisation-wide.

Filip adds; “Standard risk models only consider the probability and consequences of risk, we wanted to include the current level of control we have over a risk as well. We discovered that the control level dimension adds a very valuable perspective on our risk discussions and decision-making.”

“There’s a sense of frustration among senior managers that risk management isn’t acting as an enabler for better business decision making. It’s time to align risk appetite; time for a risk management model for a new decade.”

Ansgar Toscha, Principal Consultant, 4C Strategies

Read an interview with Ansgar Toscha on the importance of risk management.

Regulatory compliance

The combination of Exonaut and a three-dimensional approach to risk evaluation offers many other benefits for the bank, not least from a regulatory perspective. “We can map out the mandatory controls as stipulated in the different regulations, in order to define what we need to have in place to be compliant. We can also analyse the different scenarios related to risks to ensure we understand our level of exposure and can prepare for it.” concludes Filip.

“Essentially, with the help of 4C’s Exonaut, we can identify the right balance between risk and reward. And, we have a structured record of all the data so we can analyse our performance in actual risk mitigation over time and learn from it.”

Filip Rönning, SBAB Risk Analyst and Exonaut System Manager

Shaping strategy through informed decisions

With this level of information, organisation-wide risk management is playing a key role in the bank’s strategy moving forward. “Using Exonaut, we are able to analyse and identify distinguishing features of the company’s risk exposure within different operational areas – and track our progress. This information feeds into the overall strategy of the company as it enables senior management to take better, more risk-informed decisions.”

About Filip Rönning, SBAB Risk Analyst and Exonaut System Manager

Filip is responsible for the development of frameworks, processes, and methods that support structured management of operational risk and promote a healthy risk culture at the bank. He is also the system manager of the Exonaut risk management solution.

Get in touch

Discover how you can build your risk, business continuity and crisis management capability with our expert services. Book a free consultation with one of our consultants to discuss your requirements.

Related Case Studies

Climate Resilience

Climate Risk Management – preparing Stockholm for 100-year rainstorms

Learn how 4C's Climate Resilience platform helped make the City of Stockholm resilient to climate adaptation and extreme weather.

Business Continuity Management

Priority planning in an energy crisis with a National Energy Authority

Discover how 4C is supporting Styrel to map, prioritise and protect electricity-dependent critical societal functions.

Compliance Management

Global bank automates compliance with Exonaut

Learn how Exonaut's Compliance Management solution enabled a global bank to automate and centralise its internal control framework, with real-time dashboard data visualisation.