<v>GARP

FRM Financial Risk Manager

Operational Risk and Resiliency

Pearson
Copyright © 2022, 2021 by the Global Association of Risk Professionals All rights reserved.
This copyright covers material written expressly for this volume by the editor/s as well as the compilation itself. It does not cover the individual
selections herein that first appeared elsewhere. Permission to reprint these has been obtained by Pearson Education, Inc. for this edition only. Further
reproduction by any means, electronic or mechanical, including photocopying and recording, or by any information storage or retrieval system, must
be arranged with the individual copyright holders noted.

Grateful acknowledgment is made to the following sources for "Stress Testing Banks," by Til Schuermann, reprinted from the International
permission to reprint material copyrighted or controlled by them: Journal of Forecasting 30, no. 3, (2014) pp. 717-728, by permission of
Elsevier BV.
"Principles for the Sound Management of Operational Risk," by Basel
Committee on Banking Supervision, June 2011, by permission of the Bank "Guidance on Managing Outsourcing Risk," Supervisory Letter SR 13-19/
for International Settlements. Information retrieved from the Bank for CA13-21, December 2013, by the Board of Governors of the Federal
International Settlements is freely available at their website: www.bis.org. Reserve System.
"Enterprise Risk Management: Theory and Practice," by Brian W. Nocco "Management of Risks Associated with Money Laundering and Financing
and Rene M. Stulz, reprinted from Journal o f Applied Corporate Finance, of Terrorism," by Mark Carey, February 2019, the GARP Risk Institute.
vol. 18, no. 4, Fall 2006, by permission of John Wiley & Sons, Inc. All "Regulation of the OTC Derivatives Market," by John C Hull, reprinted
rights reserved. Used under license from John Wiley & Sons, Inc. from Risk Management and Financial Institutions, 5th edition (2018), by
"What is ERM?," by James Lam, reprinted from Enterprise Risk permission of John Wiley & Sons, Inc. All rights reserved. Used under
Management: From Incentives to Controls, Second Edition (2014), by license from John Wiley & Sons, Inc.
permission of John Wiley & Sons, Inc. All rights reserved. Used under "Capital Regulation Before the Global Financial Crisis," by Mark Carey,
license from John Wiley & Sons, Inc. April 2019, the GARP Risk Institute.
"Implementing Robust Risk Appetite Frameworks to Strengthen Financial "Solvency, Liquidity and Other Regulation After the Global Financial
Institutions," June 2011, by permission of the Institute of International Crisis," by Mark Carey, April 2019, the GARP Risk Institute.
Finance. "High-Level Summary of Basel III Reforms," by Basel Committee on
"Banking Conduct and Culture: A Permanent Mindset Change," by Banking Supervision, December 2017, by permission of the Bank for
the G30 Working Group, 2018, by permission of the Group of 30 International Settlements. Information retrieved from the Bank for
Consultative Group on International Economic and Monetary Affairs, Inc. International Settlements is freely available at their website: www.bis.org.

"Risk Culture," by Alessandro Carretta and Paola Schwizer, reprinted "Basel III: Finalising Post-Crisis Reforms," by Basel Committee on
from Risk Culture in Banking by Alessandro Carretta, Franco Fiordelisi Banking Supervision, December 2017, by permission of the Bank for
and Paola Schwizer (2017), by permission of Palgrave Macmillan. International Settlements. Information retrieved from the Bank for
International Settlements is freely available at their website: www.bis.org.
"OpRisk Data and Governance," by Marcelo G Cruz, Gareth W Peters
"The Cyber-Resilient Organization," by Andrew Coburn, Eireann Leverett,
and Pavel V Shevchenko, reprinted from Fundamental Aspects of
and Gordon Woo, reprinted from Solving Cyber Risk: Protecting Your
Operational Risk and Insurance Analytics: A Handbook of Operational
Risk (2015), by permission of John Wiley & Sons, Inc. All rights reserved. Company and Society (2019), by permission of John Wiley & Sons, Inc. All
Used under license from John Wiley & Sons, Inc. rights reserved. Used under license from John Wiley & Sons, Inc.
"Cyber-Resilience: Range of Practices," by Basel Committee on Banking
"Adoption of Supervisory Guidance on Model Risk Management,"
Supervision, December 2018, by permission of the Bank for International
reprinted from Financial Institution Letter FIL-22-2017, June 2017,
Settlements. Information retrieved from the Bank for International
published by the Federal Deposit Insurance Corporation.
Settlements is freely available at their website: www.bis.org.
"Information Risk and Data Quality Management," by David Loshin, "Operational Resilience: Impact Tolerances for Important Business
reprinted from Risk Management in Finance: Six Sigma and Other Services" © 2021 Financial Conduct Authority and © 2021 Bank of
Next-Generation Techniques, edited by Anthony Tarantino and Deborah England. Reproduced with permission.
Cernauskas (2009), by permission of John Wiley & Sons, Inc. All rights
reserved. Used under license from John Wiley & Sons, Inc. "Principles for Operational Resilience," by Basel Committee on Banking
Supervision, March 2021, by permission of the Basel Committee on
"Validating Rating Models," by Giacomo De Laurentis, Renato Maino, Banking Supervision.
and Luca Molteni, reprinted from Developing, Validating and Using
Internal Ratings (2010), by permission of John Wiley & Sons, Inc. All "Striving for Operational Resilience: The Questions Boards and Senior
rights reserved. Used under license from John Wiley & Sons, Inc. Management Should Ask," by Rico Brandenburg, Tom Ivell, Evan Sekeris,
Matthew Gruber and Paul Lewis, 2019, by permission of Oliver Wyman.
"Assessing the Quality of Risk Measures," by Allan M Malz, reprinted
Learning Objectives provided by the Global Association of Risk
from Financial Risk Management: Models, History, and Institutions (2011),
Professionals.
by permission of John Wiley & Sons, Inc. All rights reserved. Used under
license from John Wiley & Sons, Inc. All trademarks, service marks, registered trademarks, and registered
service marks are the property of their respective owners and are used
"Risk Capital Attribution and Risk-Adjusted Performance Measurement," herein for identification purposes only.
by Michel Crouhy, Dan Galai and Robert Mark, reprinted from The
Essentials of Risk Management, 2nd Edition (2014), by permission of the Pearson Education, Inc., 330 Hudson Street, New York, New York 10013
McGraw-Hill Companies, Inc. A Pearson Education Company
"Range of Practices and Issues in Economic Capital Frameworks," by www.pearsoned.com
Basel Committee on Banking Supervision, March 2009, by permission of
Printed in the United States of America
the Basel Committee on Banking Supervision.
ScoutAutomatedPrintCode
"Capital Planning at Large Bank Holding Companies: Supervisory
Expectations and Range of Current Practice," August 2013, by the Board 00011693-00000004 / A103000278802
of Governors of the Federal Reserve System.
EEB/MB

Pearson ISBN 10: 0137686595

ISBN 13: 9780137686599
Chapter 1 Revisions to the Chapter 2 Enterprise Risk
Principles for the Management:
Sound Management Theory and
of Operational Risk 1 Practice 15

1.1 Introduction 2 2.1 How Does ERM Create

1.2 Components of Operational Shareholder Value? 16
Risk Management 2 The Macro Benefits of Risk
M anagem ent 16
1.3 Operational Risk Management 2 The Micro Benefits of ERM 17
1.4 Principles for the Sound 2.2 Determining the Right
Management of Operational Risk 5 Amount of Risk 18
G overnance 6
Risk M anagem ent Environm ent 8 2.3 Implementing ERM 22
Monitoring and Reporting 10 Inventory of Risks 22
Control and M itigation 11 Econom ic Value versus Accounting
Information and Com m unication Perform ance 23
Technology 12 Aggregating Risks 24
Business Continuity Planning 13 M easuring Risks 26
Role of Disclosure 14 Regulatory versus Econom ic Capital 26
Role of Supervisors 14

in
 Using Econom ic Capital to Section 2 - Key Outstanding
Make Decisions 27 Challenges in Implementing
The G overnance of ERM 28 Risk Appetite Frameworks 43
Conclusion 28 Section 3 - Emerging Sound
Practices in Overcoming
the Challenges 45
3.1 Risk A p p etite and Risk Culture 46
Chapter 3 What Is ERM? 29 3.2 "D riving Down" the Risk A p p etite
into the Businesses 47
3.3 Capturing Different Risk Types 49
3.1 ERM Definitions 30 3.4 The Benefits of Risk A p p etite
as a Dynam ic Tool 50
3.2 The Benefits of ERM 31
3.5 The Link with the Strategy
O rganizational Effectiveness 31
and Business Planning Process 51
Risk Reporting 31
3.6 The Role of Stress Testing
Business Perform ance 32 within an RAF 54
3.3 The Chief Risk Officer 33 Section 4 - Recommendations
3.4 Components of ERM 35 for Firms 57
C orporate G overnance 35 Recom m endations for Board D irectors 57
Line M anagem ent 35 Recom m endations for Senior
Portfolio M anagem ent 36 M anagem ent 59

Risk Transfer 36 Recom m endations for Risk M anagem ent 60

Risk Analytics 36 Annex I: Case Studies 61

Data and Technology Resources 37 Developing a Risk A p p etite Fram ew ork
Stakeholder M anagem ent 37 at RBC May 2011 61
Risk A p p etite within National Australia
Bank: an Ongoing Jo u rney 64
Sco tiabank-A Canadian Experience

Chapter 4 Implementing in Setting Risk A p p etite May 2011 70

Risk A p p etite Fram ew ork Developm ent
Robust Risk at the Com m onwealth Bank of Australia 73
Appetite
Frameworks to
Strengthen
Financial Chapter 5 Banking Conduct
Institutions 39 and Culture 79

Introduction 40 Introduction 80
Section 1 - Principal Findings Section 1. Assessment
from the Investigation 41 of Industry Progress 88

iv ■ Contents
 M indset of Culture 90 External Frauds 122
Senior Accountability and G overnance 91 Internal Fraud 122
Perform ance M anagem ent Em ploym ent Practices and W orkplace
and Incentives 93 Safety 122
Staff Developm ent and Promotions 94 Dam age to Physical A ssets 123
An Effective Three Lines of Defense 96 7.3 The Elements of the OpRisk
Regulators, Supervisors, Enforcem ent Framework 123
A uthorities, and Industry Standards 97
Internal Loss Data 123
Section 2. Lessons Learned 100 Setting a Collection Threshold
and Possible Impacts 123
Com pleteness of Database
(Under-Reporting Events) 124
Chapter 6 Risk Culture 107 Recoveries and Near M isses 124
Tim e Period for Resolution
of O perational Losses 125
6.1 Introduction 108
1

Adding Costs to Losses 125

6.2 What Corporate Culture Provisioning Treatm ent of Expected
Is and Why It Matters? 108 O perational Losses 125

6.3 Risk Culture: Scope 7.4 Business Environment

and Definition 110 and Internal Control Environment
Factors (BEICFs) 125
6.4 Risk Culture: Drivers
Risk Control Self-Assessm ent (RCSA) 126
and Effects 111
Key Risk Indicators 127
6.5 Change and Challenge:
J

Deploying an Effective 7.5 External Databases 128

Risk Culture 112 7.6 Scenario Analysis 129
Conclusions 115 7.7 Oprisk Profile in Different
Bibliography 115 Financial Sectors 131
Trading and Sales 131
Corporate Finance 131
Retail Banking 131
Chapter 7 OpRisk Data Insurance 132
and Governance 117 A sset M anagem ent 133
Retail Brokerage 134

7.8 Risk Organization

7.1 Introduction 118
and Governance 135
7.2 OpRisk Taxonomy 118 O rganization of Risk D epartm ents 135
Execution, D elivery, and Process Structuring a Firm W ide Policy:
M anagem ent 119 Exam ple of an O pRisk Policy 136
Clients, Products, and Business Practices 120 Governance 136
Business Disruption and System Failures 121

Contents ■ v
Chapter 8 Supervisory Chapter 9 Information Risk
Guidance on and Data Quality
Model Risk Management 153
Management 139
9.1 Organizational Risk, Business
8.1 Introduction 140 Impacts, and Data Quality 154
Business Impacts of Poor Data Q uality 154
8.2 Purpose and Scope 140
Information Flaw s 155
8.3 Overview of Model Risk
9.2 Examples 155
Management 140
Em ployee Fraud and A buse 155
8.4 Model Development, Underbilling and Revenue Assurance 155
Implementation, and Use 142 Credit Risk 155
Model D evelopm ent and Insurance Exposure 156
Im plem entation 142
Developm ent Risk 156
Model Use 143
Com pliance Risk 156
8.5 Model Validation 144
9.3 Data Quality Expectations 156
Key Elem ents of Com prehensive
A ccuracy 156
Validation 145
Validation of Vendor and O ther Com pleteness 156
Third-Party Products 148 Consistency 156
Reasonableness 157
8.6 Governance, Policies,
Currency 157
and Controls 148
Uniqueness 157
Board of Directors and Senior
M anagem ent 149 O ther Dim ensions of Data Q uality 157
Policies and Procedures 149 9.4 Mapping Business Policies
Roles and Responsibilities 149 to Data Rules 157
Internal Audit 150
9.5 Data Quality Inspection,
External Resources 150 Control, and Oversight:
Model Inventory 151 Operational Data Governance 157
Docum entation 151
9.6 Managing Information
Conclusion 151 Risk Via a Data Quality Scorecard 158
Data Q uality Issues View 158
Business Process View 159
Business Impact View 159
Managing Scorecard View s 159

Summary 159

vi ■ Contents
 12.3 RAROC: Risk-Adjusted Return
Chapter 10 Validating on Capital 186
Rating Models 161 12.4 RAROC for Capital Budgeting 187
12.5 RAROC for Performance
10.1 Validation Profiles 162 Measurement 188
R A R O C Horizon 188
10.2 Roles of Internal Validation
Default Probabilities: Point-in-Time
Units 163
(PIT) vs. Through-the-Cycle (TTC) 190
10.3 Qualitative and Confidence Level 190
Quantitative Validation 164 Hurdle Rate and Capital Budgeting
Q ualitative Validation 164 Decision Rule 190
Q uantitative Validation 168 Diversification and Risk Capital 191

12.6 RAROC in Practice 192

Conclusion 194
Chapter 11 Assessing the
Quality of Risk
Measures 175 Chapter 13 Range of
Practices and
11.1 Model Risk 176 Issues in
Valuation Risk 176 Economic
Variability of VaR Estim ates 177 Capital
Mapping Issues 178 Frameworks 195
Case Study: The 2005 Credit
Correlation Episode 178
Case Study: Subprim e Default M odels 182 13.1 Executive Summary 196
Use of Econom ic Capital and
G overnance 196

Chapter 12 Risk Capital Risk M easures 196

Risk Aggregation 197
Attribution and
Validation 197
Risk-Adjusted D ependency Modelling in Credit Risk 197
Performance Counterparty C redit Risk 198
Measurement 183 Interest Rate Risk in the Banking Book 198
Sum m ary 198

12.1 What Purpose Does Risk 13.2 Recommendations 198

Capital Serve? 184 13.3 Introduction 200
12.2 Emerging Uses of Risk 13.4 Use of Economic Capital
Capital Numbers 184 Measures and Governance 201

Contents ■ vii
 Business-Level Use 201 13.10 Annex 3: Interest Rate
Enterprise-W ide or Group-Level Use 202 Risk in the Banking Book 229
G overnance 204 Sources of Interest Rate Risk 229
Supervisory Concerns Relating to Use Interest Rate M easurem ent
of Econom ic Capital and G overnance 205 Techniques and Indicators 230

13.5 Risk Measures 207 Modelling Issues 231

D esirable C haracteristics of Risk Main Challenges for the

M easures 207 M easurem ent of Interest Rate
Risk in the Banking Book 231
Types of Risk M easures 208
Calculation of Risk M easures 209 References 235
Supervisory Concerns Relating
to Risk M easures 210

13.6 Risk Aggregation 210

Aggregation Fram ew ork 210
Chapter 14 Capital Planning
Aggregation M ethodologies 211
at Large Bank
Range of Practices in the Choice of Holding
Aggregation M ethodology 214 Companies 237
Supervisory Concerns Relating
to Risk Aggregation 215

13.7 Validation of Internal 14.1 Introduction 238

Economic Capital Models 216 14.2 Foundational Risk
W hat Validation Processes Management 240
A re in Use? 217 Risk Identification 240
W hat A sp ects of M odels Does
Validation C o ver? 220 14.3 Internal Controls 241
Supervisory Concerns Relating Scope of Internal Controls 241
to Validation 220 Internal A udit 241
Independent Model Review and
13.8 Annex 1: Dependency
Validation 242
Modelling in Credit Risk Models 220
Policies and Procedures 242
Types of M odels 221
Ensuring Integrity of Results 243
Supervisory Concerns Relating to
Currently Used C redit Portfolio Docum entation 243
Models 223 14.4 Governance 243
13.9 Annex 2: Counterparty Board of D irectors 243
Credit Risk 225 Board Reporting 244
Counterparty C redit Risk Challenges 225 Senior M anagem ent 244
Range of Practices 227 Docum enting Decisions 245

•••
VIII ■ Contents
 14.5 Capital Policy 245 Modeling Losses 275
Capital Goals and Targets 246 Modeling Revenues 276
Capital Contingency Plan 246 Modeling the Balance Sheet 277

14.6 BHC Scenario Design 247 15.5 Stress Testing Disclosure 277
Scenario Design and Severity 247 Conclusion 280
Variable C overage 248
Acknowledgments 280
C lear N arratives 248
References 280
14.7 Estimation Methodologies
for Losses, Revenues, and
Expenses 248
General Expectations 248 Chapter 16 Guidance
Loss-Estim ation M ethodologies 251 on Managing
PPN R Projection M ethodologies 259 Outsourcing
14.8 Assessing Capital Risk 283
Adequacy Impact 263
Balance Sheet and RW As 263
A llow ance for Loan and Lease 16.1 Purpose 284
Losses (A LLL) 264
16.2 Risks from the Use
A ggregation of Projections 264
of Service Providers 284
14.9 Concluding Observations 265
16.3 Board of Directors
and Senior Management
Responsibilities 284
Chapter 15 Stress Testing 16.4 Service Provider Risk
Banks 267 Management Programs 284
A . Risk A ssessm ents 285
B. Due Diligence and Selection
Abstract 268 of Service Providers 285
C. Contract Provisions and
15.1 Introduction 268
Considerations 286
15.2 Stress Testing in the D. Incentive Com pensation Review 288
Literature 272 E. O versight and Monitoring
of Service Providers 288
15.3 Stress Testing Design 273
F. Business Continuity
15.4 Executing the Stress and Contingency Considerations 289
Scenario: Losses and Revenues 274 G . Additional Risk Considerations 289

Contents ■ ix
 18.2 Post-Crisis Regulatory
Chapter 17 Management of Changes 299
Risks Associated Uncleared Trades 299
with Money Determ ination of Initial Margin: SIMM 300
Laundering and 18.3 Impact of the Changes 301
Financing of Liquidity 301
Terrorism 291 Rehypothecation 302
The Convergence of O T C and
Exchange-Traded M arkets 302
17.1 Background 292 18.4 CCPS and Bankruptcy 302
17.2 Application of Standard Summary 303
Practices 292
Further Reading 303
17.3 Risk Assessment 293
17.4 Customer Due Diligence
and Acceptance 293
Chapter 19 Capital
17.5 Transaction and Other Regulation
Monitoring and Reporting 293
Before the
17.6 Correspondent Banking 293 Global
17.7 Wire Transfers 294 Financial
17.8 International Scope 294 Crisis 305
References 294
19.1 The Basel Accord:
Basel I Variant 306
Chapter 18 Regulation The Risk-Based Capital Ratio 307
of the OTC 19.2 The Basel Accord:
Derivatives Basel II Variant 311
Market 295 Capital for C redit Risk 312
Retail Exposures Under IRB 314
Credit M itigants O ther Than Collateral 315
18.1 Clearing in OTC Markets 296 Capital for O perational Risk 315
Margin 296 Solvency II 316
Central Clearing 297
Summary 317
Bilateral Clearing 298
Netting 298
References 317
Events of Default 298

x ■ Contents
Chapter 20 Solvency, Liquidity, Chapter 21 High-Level
and Other Summary of
Regulation Basel III
After the Reforms 329
Global
Financial Crisis 319
Standardised Approach for
Credit Risk 330
20.1 The Financial Stability Internal Ratings-Based
Board 320 Approaches for Credit Risk 333
Removing the Use of the Advanced IRB
20.2 Basel 2.5 320
Approach for Certain A sset Classes 333
Stressed VaR 320
Specification of Input Floors 334
Increm ental Risk Charge 320
Additional Enhancem ents 334
Correlations and the Com prehensive
Risk M easure 321 CVA Risk Framework 334
20.3 Basel 3 321 Operational Risk Framework 335
The Definition of Capital 322 Leverage Ratio Framework 335
Leverage Ratio Capital Requirem ents 323
Buffer for Global System ically
System ically Im portant Financial Im portant Banks 335
Institutions 323
Refinem ents to the Leverage Ratio
Buffers 323 Exposure M easure 336
Liquidity Requirem ents 325
Output Floor 336
D erivatives Counterparty
C redit Risk 326 Transitional Arrangements 337
20.4 Resolution Planning and
Preparation 326
Chapter 22 Basel III: Finalising
CoCos 326
Living W ills 327
Post-Crisis
Reforms 339
20.5 Stress Testing and Other
Local Applications of Basel 327
20.6 Other Reforms 328 22.1 Introduction 340
References 328 22.2 The Standardised Approach 340

Contents ■ xi
 The Business Indicator 340
The Business Indicator Com ponent 340 Chapter 23 The Cyber-Resilient
The Internal Loss M ultiplier 340 Organization 347
The Standardised Approach
O perational Risk Capital
Requirem ent 341 23.1 Changing Approaches
22.3 Application of the to Risk Management 348
Standardised Approach within Identify, Protect, D etect, Respond,
Recover 348
a Group 341
Threat Analysis 348
22.4 Minimum Standards for
the Use of Loss Data Under 23.2 Incident Response
the Standardised Approach 341 and Crisis Management 348
Real-Time Crisis M anagem ent:
22.5 General Criteria on Loss How Fighter Pilots Do It 348
Data Identification, Collection Rapid Adaptation to Changing
and Treatment 342 Conditions 349
22.6 Specific Criteria on Loss C yber Risk Aw areness in Staff 349
Data Identification, Collection Business Continuity Planning
and Treatment 342 and Staff Engagem ent 349

Building of the Standardised Approach Gam ing and Exercises 350

Loss Data Set 342 Nudging Behavior 350
G ross Loss, Net Loss, and Recovery 23.3 Resilience Engineering 350
Definitions 342
Safety M anagem ent 350
22.7 Exclusion of Losses from Hotel Keycard Failure Exam ple 351
the Loss Component 343
23.4 Attributes of a
22.8 Exclusions of Divested Cyber-Resilient Organization 351
Activities from the Business A nticipate, W ithstand, Recover,
Indicator 344 and Evolve 351

22.9 Inclusion of Losses and N egative A ttrib u tes 352

Bl Items Related to Mergers Six Positive A ttrib u tes for Resilience 352
and Acquisitions 344 C yber Resilience O bjectives 352

22.10 Disclosure 344 23.5 Incident Response Planning 353

Forensic Investigation 353
22.11 Annex: Definition of
Initial Breach Diagnosis 354
Business Indicator Components 344

xii ■ Contents
 23.6 Resilient Security Solutions 354 Cyber-Security Strategy Is Expected
Resilient Softw are 354 But Not Required 366

D etection, Containm ent, and M anagem ent Roles and

Control 354 Responsibilities 367

Minimize Intrusion Dwell Tim e 355 Cyber-Risk A w areness Culture 367

Anom aly Detection Algorithm s 355 Architecture and Standards 368

Penetration Testing 356 Cyber-Security W orkforce 368

The Risk-Return Trade-O ff 356 24.4 Approaches to Risk

23.7 Financial Resilience 357 Management, Testing and
Incident Response and Recovery 369
Financial Consequences of a
C yb er A ttack 357 M ethods for Supervising Cyber-Resilience 370

Financial Risk A ssessm ent 357 Information Security Controls Testing and
Independent Assurance 370
Reverse Stress Testing 357
Response and Recovery Testing and
D efense in Depth 358
Exercising 371
Enterprise Risk M anagem ent 358
Cyber-Security and Resilience M etrics 372
C yb er Value at Risk 358
Re-Simulations of Historical Events 359 24.5 Communication and Sharing
Counterfactual Analysis 359
of Information 373
O verview of Information-Sharing
Building Back Better 359
Fram ew orks A cross Jurisdictions 373
Events Drive Change 360
Sharing Am ong Banks 375
Education for C yb er Resilience 360
Sharing from Banks to Regulators 375
Improving the C yb er Profession 361
Sharing Am ong Regulators 376
Sharing from Regulators to Banks 377
Sharing with Security A gencies 377
Chapter 24 Cyber-Resilience: 24.6 Interconnections with
Range of Third Parties 379
Practices 363 G overnance of Third-Party Connections 379
Business Continuity and Availability 381
Information Confidentiality and Integrity 382
24.1 Introduction 364 Specific Expectations and Practices with
24.2 Cyber-Resilience Standards Regard to the Visibility of Third-Party
Connections 383
and Guidelines 365
Auditing and Testing 383
24.3 Cyber-Governance 365 Resources and Skills 384

•••
Contents ■ XIII
 A2.2 Important Business Services 394
Chapter 25 Operational
A2.3 Impact Tolerances 395
Resilience: Impact
Setting an Impact Tolerance 395
Tolerance for Impact Tolerance M etrics 396
Important Business
A2.4 Actions to Remain Within
Service 385 Impact Tolerance 397
Policy Im plem entation 398

25.1 Introduction 386 A2.5 Mapping 399

25.2 Important Business Services 387 A2.6 Scenario Testing 399
O verview 387 A2.7 Governance 401
Internal Services 387 Board Responsibilities 401
Definitions 387 M anagem ent Responsibilities 401
25.3 Impact Tolerances 388 A2.8 Self-Assessment 401
O verview 388
A2.9 Groups 402
Impact Tolerances for PRA -FC A
Dual-Regulated Firms 388 Appendix 3 403
Disruption to M ultiple Business Services 389
A3.1 Introduction 403
Measuring Impact Tolerances 389
Definition of Impact Tolerances Betw een
A3.2 The Relationship Between
Supervisory A uthorities 389 Operational Resilience and
Governance 404
25.4 Implementation Timeline 390
Interaction with O ther Board
25.5 Delivering Operational Responsibilities 404
Resilience 391 Interaction with O ther M anagem ent
O verview 391 Responsibilities 404
Mapping 391 A3.3 The Relationship Between
Scenario Testing for PRA -FC A Operational Resilience and
Dual-Regulated Firms 391 Operational Risk Policy 405
Severe/Extrem e But Plausible Definition 391 Risk A p p etite and Impact Tolerances 405
Review of Testing 392 Financial Resilience 405
Self-Assessment Templates and Guidance Incident M anagem ent 406
for PRA-FCA Dual-Regulated Firms 392
O utsourcing and the Use of Third Parties 392
A3.4 The Relationship Between
Operational Resilience and Business
25.6 International Alignment 393 Continuity Planning (BCP) 406
25.7 Conclusion 393 A3.5 The Relationship Between
Appendix 2 393 Operational Resilience and
Outsourcing 406
A2.1 Introduction 393

xiv ■ Contents
Chapter 26 Principles for Chapter 27 Striving for
Operational Operational
Resilience 407 Resilience 413

26.1 Introduction 408 Executive Summary 414

26.2 An Evolving Operational Risk 27.1 Why Now?: Need for
Landscape 408 Operational Resilience 414
26.3 Essential Elements of 27.2 Bend, But Don't Break:
Operational Resilience 408 Operational Resilience Approach 414
26.4 Definition of Operational 27.3 Has the Organization Got It?:
Resilience 409 Important Questions to Ask
26.5 Operational Resilience About Operational Resilience 417
Principles 410 27.4 Improving Resilience:
G overnance 410 Getting Started 417
O perational Risk M anagem ent 410 Bibliography 421
Business Continuity Planning and Testing 411
In
1 n d y
IIUuA J
Mapping Interconnections and
Interdependencies 411
Third-Party D ependency M anagem ent 411
Incident M anagem ent 412
let Including C yb er Security 412

Contents ■ xv
On behalf of our Board of Trustees, GARP's staff, and particu­ The FRM program addresses the financial risks faced by both
larly its certification and educational programs teams, I would non-financial firms and those in the highly interconnected and
like to thank you for your interest in and support of our Financial sophisticated financial services industry, because its coverage is
Risk Manager (FRM®) program. not static, but vibrant and forward looking.

The past couple of years have been difficult due to COVID-19. The FRM curriculum is regularly reviewed by an oversight com­
And in that regard, our sincere sympathies go out to anyone mittee of highly qualified and experienced risk-management
who was ill or suffered a loss due to the pandemic. professionals from around the globe. These professionals con­
The FRM program also experienced many virus-related chal­ sist of senior bank and consulting practitioners, government
lenges. Because we always place candidate safety first, we regulators, asset managers, insurance risk professionals, and
cancelled the May 2020 FRM exam offering and deferred all can­ academics. Their mission is to ensure the FRM program remains
didates to October, while reserving an optional date in January current and its content addresses not only standard credit and
2021 for candidates not able to sit for the examination in October. market risk issues, but also emerging issues and trends, ensur­
A change like this has never happened before. Ultimately, we ing FRM candidates are aware of what is or is expected to be
were able to offer the FRM exam to all 2020 registered candidates important in the near future. We're committed to offering a pro­
who wanted to sit for it during the year and were not constrained gram that reflects the dynamic and sophisticated nature of the
by COVID-related restrictions, which was most of our registrants. risk-management profession and those who are making it
a career.
Since its inception in 1997, the FRM program has been the
global industry benchmark for risk-management professionals We wish you the very best as you study for the FRM exams, and
wanting to demonstrate objectively their knowledge of financial in your career as a risk-management professional.
risk-management concepts and approaches. Having FRM hold­ Yours truly,
ers on staff also tells companies' that their risk-management
professionals have achieved a demonstrated and globally
adopted level of expertise.

In a world where risks are becoming more complex daily due to

any number of technological, capital, governmental, geopoliti­
cal, or other factors, companies know that FRM holders possess
the skills to understand and adapt to a dynamic and rapidly Richard Apostolik

changing financial environment. President & C EO

xvi ■ Preface
FRM

Chairperson
Michelle McCarthy Beck
Former GARP Board Member

Members
Richard Apostolik Dr. Attilio Meucci, CFA
President and C E O , Global Association of Risk Professionals Founder, ARPM

Richard Brandt Dr. Victor Ng

MD Operational Risk Management, Citigroup MD Head of Risk Architecture, Goldman Sachs

Julian Chen, FRM, SVP Dr. Matthew Pritsker

FRM Program Manager, Global Association of Risk Professionals Senior Financial Economist and Policy Advisor / Supervision,
Regulation, and Credit, Federal Reserve Bank of Boston
Dr. Christopher Donohue, MD
GARP Benchmarking Initiative, Global Association of Risk Dr. Samantha Roberts, FRM
Professionals SVP Balance Sheet Analytics & Modeling, PNC Bank

Donald Edgar, FRM Dr. Til Schuermann

MD Risk & Quantitative Analysis, BlackRock Partner, Oliver Wyman

Herve Geny Nick Strange

Former Group Head of Internal Audit, London Stock Exchange Senior Technical Advisor, Operational Risk & Resilience,
Group and former CRO , ICAP Supervisory Risk Specialists, Prudential Regulation Authority,
Bank of England
Keith Isaac, FRM
VP Capital Markets Risk Management, TD Bank Group Dr. Sverrir Porvaldsson, FRM
Senior Quant, SEB
William May, SVP
Global Head of Certifications and Educational Programs, Global
Association of Risk Professionals

FRM® Committee ■ x v ii
Revisions to the
Principles for the
Sound Management
of Operational Risk
Learning Objectives
After completing this reading you should be able to:

Describe the three lines of defense in the Basel model Describe tools and processes that can be used to identify
for operational risk governance. and assess operational risk.

Summarize the fundamental principles of operational risk Describe features of an effective control environment and
management as suggested by the Basel Committee. identify specific controls that should be in place to address
operational risk.
Explain guidelines for strong governance of operational
risk and evaluate the role of the board of directors, senior Explain the Basel Committee's suggestions for managing
management, and supervisors in implementing an technology risk and outsourcing risk.
effective operational risk framework.

Excerp t is reprinted with perm ission o f the Bank for International Settlem ents. The full publication is available on the BIS w ebsite free
o f charge: w w w .bis.org.

1
1.1 INTRODUCTION Recognising the increased potential for significant disruptions to
bank operations from pandemics, natural disasters, destructive
The Basel Committee on Banking Supervision ("the Committee") cyber security incidents or technology failures, the Committee
introduced its Principles for the Sound Management of O pera­ has also developed principles for operational resilience,4 which
tional Risk ("the Principles") in 2003, and subsequently revised reflect several of the principles contained in this document.
them in 2011 to incorporate the lessons from the Great Financial
Crisis of 2007-09. In 2014, the Committee conducted a review
of the implementation of the Principles.1 The purpose of this
1.2 COMPONENTS OF OPERATIONAL
review was to (i) assess the extent to which banks had imple­ RISK MANAGEMENT
mented the Principles; (ii) identify significant gaps in implemen­
The Principles in this document for banks cover governance; the
tation; and (iii) highlight emerging and noteworthy operational
risk management environment; information and communication
risk management practices at banks not currently addressed by
technology; business continuity planning; and the role of disclo­
the Principles.
sure. These elements should not be viewed in isolation; rather,
The 2014 review identified that several principles had not they are integrated components of the operational risk man­
been adequately implemented, and further guidance would agement framework (ORMF) and the overall risk management
be needed to facilitate their implementation in the following framework (including operational resilience) of the group.
areas:
Through the publication of this document, the Committee
a. Risk identification and assessment tools, including risk desires to promote the effectiveness of operational risk manage­
and control self-assessments (RCSAs), key risk indicators, ment throughout the banking system. The Committee believes
external loss data, business process mapping, comparative that the Principles reflect sound practices relevant to all banks.
analysis, and the monitoring of action plans generated from Nonetheless, the Committee recommends that banks should
various operational risk management tools. take account of the nature, size, complexity and risk profile of
b. Change management programmes and processes (and their their activities when implementing the Principles.
effective monitoring).

c. Implementation of the three lines of defence, especially by

1.3 OPERATIONAL RISK
refining the assignment of roles and responsibilities.
MANAGEMENT
d. Board of directors and senior management oversight.

e. Articulation of operational risk appetite and tolerance 1. Operational risk is defined in the capital framework as the risk
statements. of loss resulting from inadequate or failed internal processes,
people and systems or from external events. This definition
f. Risk disclosures.
includes legal risk, but excludes strategic and reputational risk.
The Committee also recognised that the 2011 Principles did not
2. Operational risk is inherent in all banking products, activities,
sufficiently capture certain important sources of operational risk,
processes and systems, and the effective management of opera­
such as those arising from information and communication tech­
tional risk is a fundamental element of a bank's risk management
nology (ICT) risk,1
2 thus warranting the introduction of a specific
programme. Sound operational risk management is a reflection of
principle on ICT risk management. Other revisions were made to
the effectiveness of the board of directors and senior management
ensure consistency with the new operational risk framework in
the Basel III reforms.3
4 "Operational resilience" is defined as the ability of a bank to deliver
critical operations through disruption. This ability enables a bank to
identify and protect itself from threats and potential failures, respond
and adapt to, as well as recover and learn from disruptive events in
1 BCBS, Review of the Principles for Sound Management of Operational order to minimise their impact on the delivery of critical operations
Risk, October 2014, www.bis.org/publ/bcbs292.pdf. through disruption. In considering its operational resilience, a bank
should assume that disruptions will occur, and take into account its
2 Conduct and legal risks (including risks associated with money laun­
overall risk appetite and tolerance for disruption. In the context of
dering or terrorist financing) remain important concerns. In this context,
operational resilience, the Committee defines "tolerance for disruption"
financial institutions should continue to improve their ability to manage
as the level of disruption from any type of operational risk a bank is
operational risk.
willing to accept given a range of severe but plausible scenarios. For
3 BCBS, Basel III: finalising post-crisis reforms, December 2017, www.bis. more details, refer to BCBS, Principles for operational resilience,
org/bcbs/publ/d424.pdf. March 2021, www.bis.org/bcbs/publ/d516.htm.

2 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
in administering their portfolio of products, activities, processes and the risk profile of a bank's activities, the degree of
and systems. Where appropriate, strategic and reputational risks formality of how these three lines of defence are implemented
should be considered by banks' operational risk management. will vary.

3. Although operational risk management and operational resil­ 7. Banks should ensure that each line of defence:
ience address different goals, they are closely interconnected.
a. is adequately resourced in terms of budget, tools and staff;
An effective operational risk management system and a robust
level of operational resilience work together to reduce the fre­ b. has clearly defined roles and responsibilities;

quency and the impact of operational risk events. c. is continuously and adequately trained;

4. Sound risk management allows the bank to better under­ d. promotes a sound risk management culture across the
stand and mitigate its risk profile. Risk management encom­ organisation; and
passes identifying risks to the bank; measuring and assessing e. communicates with the other lines of defence to reinforce
exposures to those risks (where possible); monitoring exposures the ORMF.
and corresponding capital needs on an ongoing basis; taking
If in one business unit there are functions of both the first and
steps to control or mitigate exposures; and reporting to senior
second line of defence, then banks should document and dis­
management and the board of directors on the bank's risk
tinguish the responsibilities of such functions in the first and
exposures and capital positions. Internal controls are typically
second line of defence, emphasising the independence of the
embedded in a bank's day-to-day business and are designed
second line of defence.
to ensure, to the extent possible, that the bank's activities are
efficient and effective; that information is reliable, timely and 8. The Committee has highlighted that, despite the three lines
com plete; and that the bank is compliant with applicable laws of defence model being widely adopted by banks, confu­
and regulations. sion around roles and responsibilities sometimes hampers its
effectiveness.8 Thus, the review of the Principles is also the
5. Sound internal governance forms the foundation of an effec­
opportunity to stress that this model should be adequately and
tive ORMF. Governance of operational risk management has
proportionally used by financial institutions to manage every
similarities but also differences relative to the management of
kind of operational risk subcategory, including ICT risk.
credit or market risk. Banks' operational risk governance func­
tion should be fully integrated into their overall risk manage­ 9. In industry practice, the first line of defence is business unit
ment governance structure. management. Sound operational risk governance recognises
that business unit management is responsible for identifying and
6. Banks commonly rely on three lines of defence: (i) business
managing the risks inherent in the products, activities, processes
unit m anagem ent;5 (ii) an independent corporate operational
and systems for which it is accountable. Banks should have a
risk management function (C O R F);6 and (iii) independent assur­
policy that defines clear roles and responsibilities in relevant
ance.7 Depending on the bank's nature, size and com plexity,
business units.9 The responsibilities of an effective first line of
defence in promoting a sound operational risk management cul­
ture should include:

a. identifying and assessing the materiality of operational risks

5 The term "business unit" is meant broadly to include all associated
inherent in their respective business units through the use
support, corporate and/or shared service functions, eg Finance, Human
Resources, and Operations and Technology. Risk Management and of operational risk management tools;
Internal Audit are not included unless otherwise specifically indicated.
b. establishing appropriate controls to mitigate inherent oper­
6 In addition to an independent Operational Risk Management function,
ational risks, and assessing the design and effectiveness of
the second line of defense also typically includes a Compliance function.
these controls through the use of the operational risk man­
7 Independent assurance includes verification and validation: verification
agement tools;
of the ORMF is done on a periodic basis and is typically conducted by
the bank's internal and/or external audit, but may involve other suitably
qualified independent third parties from external sources. Verification
activities test the effectiveness of the overall ORMF, consistent with
policies approved by the board of directors, and also test validation
processes to ensure they are independent and implemented in a man­
8 See BCBS, Cyber resilience: range of practices, December 2018,
ner consistent with established bank policies. Validation ensures that the
https://www.bis.org/bcbs/publ/d454.pdf,
quantification systems used by the bank are sufficiently robust and pro­
vide assurance of the integrity of inputs, assumptions, methodologies, 9 In complex banking structures, " relevant business units" are likely to
processes and outputs. Validation is critical for a well functioning ORMF. include support functions such as information systems departments.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 3
 c. reporting whether the business units lack adequate 12. The third line of defence provides independent assurance
resources, tools and training to ensure identification and to the board of the appropriateness of the bank's ORMF. This
assessment of operational risks; function's staff should not be involved in the developm ent,
implementation and operation of operational risk m anage­
d. monitorinq and reportinq the business units' operational
risk profiles,10*and ensuring their adherence to the ment processes by the other two lines of defence. The third

established operational risk appetite and tolerance line of defence reviews generally are conducted by the bank's
internal and/or external audit, but may also involve other
statement; and
suitably qualified independent third parties. The scope and
e. reporting residual operational risks not mitigated by con­
frequency of reviews should be sufficient to cover all activities
trols, including operational loss events, control deficiencies,
and legal entities of a bank. An effective independent review
process inadequacies, and non-compliance with operational
should:
risk tolerances.
a. review the design and implementation of the operational
10. A functionally independent C O RF is typically the second line
risk management systems and associated governance pro­
of defence. The responsibilities of an effective second line of
cesses through the first and second lines of defence (includ­
defence should include:
ing the independence of the second line of defence);
a. developing an independent view regarding business units'
b. review validation processes to ensure they are independent
(i) identified material operational risks, (ii) design and effec­
and implemented in a manner consistent with established
tiveness of key controls, and (iii) risk tolerance;
bank policies;
b. challenging the relevance and consistency of the business
c. ensure that the quantification systems used by the bank are
unit's implementation of the operational risk management
sufficiently robust as (i) they provide assurance of the integ­
tools, measurement activities and reporting systems, and
rity of inputs, assumptions, processes and methodology
providing evidence of this effective challenge;
and (ii) result in assessments of operational risk that credibly
c. developing and maintaining operational risk management reflect the operational risk profile of the bank;
and measurement policies, standards and guidelines;
d. ensure that business units' management promptly, accu­
d. reviewing and contributing to the monitoring and reporting rately and adequately responds to the issues raised, and
of the operational risk profile; and regularly reports to the board of directors or its relevant
e. designing and providing operational risk training and instill­ committees on pending and closed issues; and
ing risk awareness. e. opine on the overall appropriateness and adequacy of
11. The degree of independence of the C O RF may differ among the O RM F and the associated governance processes
banks. A t small banks, independence may be achieved through across the bank. Beyond checking compliance with poli­
separation of duties and independent review of processes and cies and procedures approved by the board of directors,
functions. In larger banks, the C O R F should have a reporting the independent review should also assess whether the
structure independent of the risk-generating business units O RM F meets organisational needs and expectations (such
and be responsible for the design, maintenance and ongoing as respect of the corporate risk appetite and tolerance,
development of the O RM F within the bank. The C O R F typi­ and adjustment of the fram ework to changing operating
cally engages relevant corporate control groups (eg Com pli­ circumstances) and complies with statutory and legislative
ance, Legal, Finance and IT) to support its assessment of the provisions, contractual arrangements, internal rules and
operational risks and controls. Banks should have a policy which ethical conduct.
defines clear roles and responsibilities of the CORF, reflective of 13. Because operational risk management is evolving and the
the size and complexity of the organisation. business environment is constantly changing, senior manage­
ment should ensure that the ORMF's policies, processes and
systems remain sufficiently robust to manage and ensure that
10 Operational risk profiles describe the operational risk exposures and operational losses are adequately addressed in a timely manner.
control environment assessments of business units and consider the Improvements in operational risk management depend heavily
range of potential impacts that could arise from estimates of expected on senior management's willingness to be proactive and also act
to severe losses. Profiles generally provide management and the board
of directors with a representation of operational risk exposures at a level promptly and appropriately to address operational risk managers'
which supports their decision-making and oversight responsibilities. concerns.

4 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
1.4 PRINCIPLES FOR THE SOUND 17. Compensation policies should be aligned to the bank's
statement of risk appetite and tolerance as well as overall safety
MANAGEMENT OF OPERATIONAL RISK and soundness, and appropriately balance risk and reward.12*

Principle 1: The board of directors should take the lead in 18. Senior management should ensure that an appropriate level
establishing a strong risk management culture, implemented of operational risk training is available at all levels throughout
by senior management.11 The board of directors and senior the organisation, such as heads of business units, heads of
management should establish a corporate culture guided by internal controls and senior managers. Training provided should
strong risk management, set standards and incentives for reflect the seniority, role and responsibilities of the individuals
professional and responsible behaviour, and ensure that staff for whom it is intended.
receives appropriate risk management and ethics training.
19. Strong and consistent board of directors and senior man­
14. Banks with a strong culture of risk management and ethical agement support for operational risk management and ethical
business practices are less likely to experience damaging opera­ behaviour convincingly reinforces codes of conduct and ethics,
tional risk events and are better placed to effectively deal with compensation strategies, and training programmes.
those events that occur. The actions of the board of directors
Principle 2: Banks should develop, implement and maintain
and senior management as well as the bank's risk management an operational risk management framework that is fully inte­
policies, processes and systems provide the foundation for a
grated into the bank's overall risk management processes.
sound risk management culture. The ORM F adopted by an individual bank will depend on a
15. The board of directors should establish a code of conduct range of factors, including the bank's nature, size, complex­
or an ethics policy to address conduct risk. This code or policy ity and risk profile.
should be applicable to both staff and board members, set
20. The board of directors and bank management should
clear expectations for integrity and ethical values of the highest understand the nature and complexity of the risks inherent in
standard, identify acceptable business practices, and prohibit
the portfolio of bank products, services, activities, and systems,
conflicts of interest or the inappropriate provision of financial which is a fundamental premise of sound risk management. This
services (whether wilful or negligent). The code or policy should
is particularly important for operational risk, given operational
be regularly reviewed and approved by the board of direc­ risk is inherent in all business products, activities, processes and
tors and attested by employees; its implementation should be
systems.
overseen by a senior ethics committee, or another board-level
committee, and should be publicly available (eg on the bank's 21. The components of the O RM F should be fully integrated

website). A separate code of conduct may be established into the overall risk management processes of the bank by the

for specific positions in the bank (eg treasury dealers, senior first line of defence, adequately reviewed and challenged by

management). the second line of defence, and independently reviewed by the

third line of defence. The ORM F should be embedded across all
16. Management should set clear expectations and accountabili­
levels of the organisation including group and business units as
ties to ensure bank staff understands their roles and responsibili­
well as new business initiatives' products, activities, processes
ties for risk management, as well as their authority to act.
and systems. In addition, results of the bank's operational risk
assessment should be incorporated into the bank's overall busi­
ness strategy development process.

22. The ORM F should be comprehensively and appropriately doc­

11 This paper refers to a management structure composed of a board of
directors and senior management. The Committee is aware that there umented in board of directors approved policies and include defi­
are significant differences in legislative and regulatory frameworks across nitions of operational risk and operational loss. Banks that do not
countries regarding the functions of the board of directors and senior
adequately describe and classify operational risk and loss expo­
management. In some countries, the board has the main, if not exclu­
sive, function of supervising the executive body (senior management, sure may significantly reduce the effectiveness of their ORMF.
general management) so as to ensure that the latter fulfils its tasks.
For this reason, in some cases, it is known as a supervisory board. This
12 See also BCBS, Report on the range o f methodologies for the risk and
means that the board has no executive functions. In other countries, the
performance alignment o f remuneration, May 2011; Financial Stability
board has a broader competence in that it lays down the general frame­
Forum, Principles for sound compensation practices, April 2009; Finan­
work for the management of the bank. Owing to these differences, the
cial Stability Board, FSB principles for sound compensation practices -
terms "board of directors" and "senior management" are used in this
implementation standards, September 2009; and the Financial Stability
paper not to identify legal constructs but rather to label two decision­
Board's toolkit Strengthening Governance Frameworks to Mitigate
making functions within a bank.
Misconduct Risk, April 2018.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 5
23. O RM F documentation should clearly: Governance14
a. identify the governance structures used to manage opera­
Board o f Directors
tional risk, including reporting lines and accountabilities,
and the mandates and membership of the operational risk Principle 3: The board of directors should approve and peri­
governance committees; odically review the operational risk management framework,
and ensure that senior management implements the policies,
b. reference the relevant operational risk management policies
processes and systems of the operational risk management
and procedures;
framework effectively at all decision levels.
c. describe the tools for risk and control identification and
24. The board of directors should:
assessment and the role and responsibilities of the three
lines of defence in using them; a. establish a risk management culture and ensure that the
bank has adequate processes for understanding the nature
d. describe the bank's accepted operational risk appetite and
and scope of the operational risk inherent in the bank's cur­
tolerance; the thresholds, material activity triggers or limits
rent and planned strategies and activities;
for inherent and residual risk; and the approved risk mitiga­
tion strategies and instruments; b. ensure that the operational risk management processes are
subject to comprehensive and dynamic oversight and are
e. describe the bank's approach to ensure controls are
fully integrated into, or coordinated with, the overall fram e­
designed, implemented and operating effectively;
work for managing all risks across the enterprise;
f. describe the bank's approach to establishing and moni­
c. provide senior management with clear guidance regarding
toring thresholds or limits for inherent and residual risk
the principles underlying the ORMF, and approve the cor­
exposure;
responding policies developed by senior management to
g. inventory risks and controls implemented by all business
align with these principles;
units (eg in a control library);
d. regularly review and evaluate the effectiveness of, and
h. establish risk reporting and management information sys­
approve the O RM F to ensure the bank has identified and is
tems (MIS) producing timely, and accurate data; managing the operational risk arising from external market
i. provide for a common taxonomy of operational risk terms changes and other environmental factors, as well as those
to ensure consistency of risk identification, exposure rating operational risks associated with new products, activities,
and risk management objectives across all business units.13 processes or systems, including changes in risk profiles and
The taxonomy can distinguish operational risk exposures by priorities (eg changing business volumes);
event types, causes, materiality and business units where e. ensure that the bank's ORM F is subject to effective inde­
they occur; it can also flag those operational exposures that pendent review by a third line of defence (audit or other
partially or entirely represent legal, conduct, model and ICT appropriately trained independent third parties from exter­
(including cyber) risks as well as exposures in the credit or nal sources); and
market risk boundary;
f. ensure that, as best practice evolves, management is avail­
j. provide for appropriate independent review and challenge ing themselves of these advances.15
of the outcomes of the risk management process; and
25. Strong internal controls are a critical aspect of operational
k. require the policies to be reviewed and revised as appropri­ risk management. The board of directors should establish
ate based on continued assessment of the quality of the clear lines of management responsibility and accountability for
control environment addressing internal and external envi­ implementing a strong control environment. Controls should be
ronmental changes or whenever a material change in the regularly reviewed, monitored, and tested to ensure ongoing
operational risk profile of the bank occurs. effectiveness. The control environment should provide appropri­
ate independence/separation of duties between operational risk
management functions, business units and support functions.

13 An inconsistent taxonomy of operational risk terms may increase the

14 See also BCBS, Principles for enhancing corporate governance,
likelihood of failure to identify and categorise risks, or failure to allocate
October 2010.
responsibility for the assessment, monitoring, control and mitigation of
risks. For the particular case of cyber risk, the Financial Stability Board's 15 See the Committee's 2006 International Convergence of Capital Mea­
Cyber Lexicon, published in November 2018, should be used as a surement and Capital Standards: A Revised Framework - Comprehensive
starting point. Version; paragraph 718(xci).

6 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Principle 4: The board of directors should approve and Senior Management
periodically review a risk appetite and tolerance statem ent16
Principle 5: Senior management should develop for approval
for operational risk that articulates the nature, types and
by the board of directors a clear, effective and robust
levels of operational risk the bank is willing to assume.
governance structure with well-defined, transparent and
26. The risk appetite and tolerance statement for operational consistent lines of responsibility. Senior management is
risk should be developed under the authority of the board of responsible for consistently implementing and maintaining
directors and linked to the bank's short- and long-term stra­ throughout the organisation policies, processes and systems
tegic and financial plans. Taking into account the interests of for managing operational risk in all of the bank's material
the bank's customers and shareholders as well as regulatory products, activities, processes and systems consistent with
requirements, an effective risk appetite and tolerance statement the bank's risk appetite and tolerance statement.
should:
28. Senior management is responsible for establishing and main­
a. be easy to communicate and therefore easy for all stake­ taining robust challenge mechanisms and effective issue resolu­
holders to understand; tion processes. These should include systems to report, track
b. include key background information and assumptions and, when necessary, escalate issues to ensure resolution. Banks
that informed the bank's business plans at the time it was should be able to demonstrate that the three-lines-of-defence
approved; approach is operating satisfactorily and to explain how the
board of directors, independent audit committee of the board,
c. include statements that clearly articulate the motivations
and senior management ensure that this approach is imple­
for taking on or avoiding certain types of risk, and establish
mented and operating in an appropriate manner.
boundaries or indicators (which may be quantitative or not)
to enable monitoring of these risks; 29. Senior management should translate the O RM F approved
by the board of directors into specific policies and procedures
d. ensure that the strategy and risk limits of business units
that can be implemented and verified within the different busi­
and legal entities, as relevant, align with the bank-wide risk
ness units. Senior management should clearly assign authority,
appetite statement; and
responsibility and reporting relationships to encourage and
e. be forward-looking and, where applicable, subject to sce­ maintain accountability, and to ensure the necessary resources
nario and stress testing to ensure that the bank understands are available to manage operational risk in line with the bank's
what events might push it outside its risk appetite and toler­ risk appetite and tolerance statement. Moreover, senior man­
ance statement. agement should ensure that the management oversight process
27. The board of directors should approve and regularly review is appropriate for the risks inherent in a business unit's activity.
the appropriateness of limits and the overall operational risk 30. Senior management should ensure that staff responsible for
appetite and tolerance statement. This review should consider managing operational risk coordinate and communicate effec­
current and expected changes in the external environment tively with staff responsible for managing credit, market, and
(including the regulatory context across all jurisdictions where other risks, as well as with those in the bank who are responsible
the institution provides services); ongoing or forthcoming mate­ for the procurement of external services such as insurance risk
rial increases in business or activity volumes; the quality of the transfer and other third-party arrangements (including outsourc­
control environment; the effectiveness of risk management or ing). Failure to do so could result in significant gaps or overlaps
mitigation strategies; loss experience; and the frequency, vol­ in a bank's overall risk management programme.
ume or nature of limit breaches. The board of directors should
31. The managers of the C O RF should be of sufficient stature
monitor management adherence to the risk appetite and toler­
within the bank to perform their duties effectively, ideally evi­
ance statement and provide for timely detection and remedia­
denced by a title that is commensurate with other risk manage­
tion of breaches.
ment functions such as credit, market and liquidity risk.

32. Senior management should ensure that bank activities are

conducted by staff with the necessary experience, technical
16 See the Committee's 2015 Corporate governance guidelines, which capabilities and access to resources. Staff responsible for moni­
use the FSB's 2013 Principles for an effective risk appetite framework
definition of risk appetite: the aggregate level and types of risk a bank toring and enforcing compliance with the institution's risk policy
is willing to assume, decided in advance and within its risk capacity, to should have authority independent from the units they oversee.
achieve its strategic objectives and business plan. "Risk tolerance" is the
variation around the prescribed risk appetite that the bank is willing to 33. A bank's governance structure should be commensurate
tolerate. with the nature, size, complexity and risk profile of its activities.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 7
When designing the operational risk governance structure, a a. Event management - When banks experience an opera­
bank should take the following into consideration: tional risk event, the process of identification, analysis,
end-to-end management and reporting of the event follows
a. Committee structure - Sound industry practice is for larger
a predetermined set of protocols. A sound event manage­
and more complex organisations with a central group func­
ment approach typically includes analysis of events to iden­
tion and separate business units to utilise a board-created
tify new operational risks, understanding the underlying
enterprise-level risk committee for overseeing all risks,
causes and control weaknesses, and formulating an appro­
to which a management level operational risk committee
priate response to prevent recurrence of similar events. This
reports. Depending on the nature, size and complexity of the
information is an input to the self-assessment and, in par­
bank, the enterprise-level risk committee may receive input
ticular, to the assessment of control effectiveness.
from operational risk committees by country, business or func­
tional area. Smaller and less complex organisations may utilise b. Operational risk event data - Banks often maintain a com­
a flatter organisational structure that oversees operational risk prehensive operational risk event dataset that collects all
directly within the board's risk management committee. material events experienced by the bank and serves as basis
for operational risk assessments. The event dataset typically
b. Committee composition - Sound industry practice is for
includes internal loss data, near misses, and, when feasible,
operational risk committees (or the risk committee in
external operational loss event data (as external data is
smaller banks) to include members with a variety of exper­
informative of risks that common across the industry). Event
tise, which should cover expertise in business activities,
data is typically classified according to a taxonomy defined
financial activities, legal, technological and regulatory mat­
in the O RM F policies and consistently applied across the
ters, and independent risk m anagem ent.17
bank. Event data typically include the date of the event
c. Committee operation - Committee meetings should be (occurrence date, discovery date and accounting date) and,
held at appropriate frequencies with adequate time and in the case of loss events, financial impact. When other
resources to permit productive discussion and decision-mak­ root cause information for events is available, ideally it can
ing. Records of committee operations should be adequate also be included in the operational risk dataset. When fea­
to permit review and evaluation of committee effectiveness. sible, banks are encouraged to also seek to gather external
operational risk event data and use this data in their internal
Risk Management Environment analysis, as it is often informative of risks that are common
across the industry.
Identification and Assessment
c. Self-assessments - Banks often perform self-assessments
Principle 6: Senior management should ensure the compre­
of their operational risks and controls on various different
hensive identification and assessment of the operational risk
levels. The assessments typically evaluate inherent risk (the
inherent in all material products, activities, processes and
risk before controls are considered), the effectiveness of
systems to make sure the inherent risks and incentives are
the control environment, and residual risk (the risk exposure
well understood.
after controls are considered) and contain both quantitative
34. Risk identification and assessment are fundamental charac­ and qualitative elements. The qualitative element reflects
teristics of an effective operational risk management system, consideration of both the likelihood and consequence of
and directly contribute to operational resilience capabilities. the risk event in the bank's determination of its inherent
Effective risk identification considers both internal factors and and residual risk ratings. The assessments may utilise busi­
external factors. Sound risk assessment allows the bank to bet­ ness process mapping to identify key steps in business
ter understand its risk profile and allocate risk management processes, activities, and organisational functions, as well
resources and strategies most effectively. as the associated risks and areas of control weakness. The
35. Examples of tools used for identifying and assessing opera­ assessments contain sufficiently detailed information on the
tional risk are:18 business environment, operational risks, underlying causes,
controls and evaluation of control effectiveness to enable an
independent reviewer to determine how the bank reached
17 See the Committee's 2015 Corporate governance principles for banks
its ratings. A risk register can be maintained to collate this
for additional requirements on the Committee composition.
information to form a meaningful view of the overall effec­
18 This list is not comprehensive and does not reflect the full diversity of
sophistication of possible analyses. It should be seen as indicative (and tiveness of controls and facilitate oversight by senior man­
not limitative). agement, risk committees, and the board of directors.

8 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
d. Control monitoring and assurance framework - Incorporat­ g. Benchmarking and comparative analysis - Benchmarking and
ing an appropriate control monitoring and assurance fram e­ comparative analysis are comparisons of the outcomes of
work facilitates a structured approach to the evaluation, different risk measurement and management tools deployed
review and ongoing monitoring and testing of key controls. within the bank, as well as comparisons of metrics from the
The analysis of controls ensures these are suitably designed bank to other firms in the industry. Such comparisons can be
for the identified risks and operating effectively. The analy­ performed to enhance understanding of the bank's opera­
sis should also consider the sufficiency of control coverage, tional risk profile. For example, comparing the frequency
including adequate prevention, detection and response and severity of internal losses with self-assessments can help
strategies. The control monitoring and testing should be the bank determine whether its self-assessment processes
appropriate for the different operational risks and key con­ are functioning effectively. Scenario data can be compared
trols across business areas. to internal and external loss data to gain a better under­
standing of the severity of the bank's exposure to potential
e. Metrics - Using operational risk event data and risk and
risk events.
control assessments, banks often develop metrics to assess
and monitor their operational risk exposure. These metrics 36. Banks should ensure that the operational risk assessment
may be simple indicators, such as event counts, or result tools' outputs are:
from more sophisticated exposure models when appropri­
a. based on accurate data, whose integrity is ensured by
ate. Metrics provide early warning information to moni­
strong governance and robust verification and validation
tor ongoing performance of the business and the control
procedures;
environment, and to report the operational risk profile.
b. adequately taken into account in the internal pricing and
Effective metrics clearly link to the associated operational
performance measurement mechanisms as well as for busi­
risks and controls. Monitoring metrics and related trends
ness opportunities assessments; and
through time against agreed thresholds or limits provides
valuable information for risk management and reporting c. subject to CORF-monitored action plans or remediation
purposes. plans when necessary.

f. Scenario analysis - Scenario analysis is a method to iden­ 37. These operational risk assessment tools can also directly
tify, analyse and measure a range of scenarios, including contribute to a bank's operational resilience approach, in par­
low probability and high severity events, some of which ticular event management, self assessment and scenario analysis
could result in severe operational risk losses. Scenario procedures, as they allow banks to identify and monitor threats
analysis typically involves workshop meetings of subject and vulnerabilities to their critical operations. Banks should use
matter experts including senior management, business the outputs of these tools to improve their operational resilience
management and senior operational risk staff and other controls and procedures, as identified in the Committee's
functional areas such as com pliance, human resources and Principles for operational resilience.19*
IT risk management, to develop and analyse the drivers Principle 7: Senior management should ensure that the
and range of consequences of potential events. Inputs
bank's change management process is comprehensive,
to the scenario analysis would typically include relevant appropriately resourced and adequately articulated between
internal and external loss data, information from self- the relevant lines of defence.
assessm ents, the control monitoring and assurance fram e­
work, forward-looking metrics, root-cause analyses and 38. In general, a bank's operational risk exposure evolves when

the process fram ework, where used. The scenario analysis a bank initiates change, such as engaging in new activities or

process could be used to develop a range of conse­ developing new products or services; entering into unfamiliar

quences of potential events, including impact assessments markets or jurisdictions; implementing new or modifying busi­

for risk management purposes, supplementing other tools ness processes or technology systems; and/or engaging in

based on historical data or current risk assessm ents. It businesses that are geographically distant from the head office.

could also be integrated with disaster recovery and busi­ Change management should assess the evolution of associated

ness continuity plans, for use within testing of operational

resilience. Given the subjectivity of the scenario process, a
robust governance fram ework and independent review are 19 These controls and procedures should be consistent with and con­
ducted alongside the identification of threats and vulnerabilities as part
important to ensure the integrity and consistency of the of a bank's operational resilience approach as articulated in Principle 2 in
process. the Committee's Principles for operational resilience, March 2021.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 9
risks across time, from inception to termination (eg throughout 41. The review and approval process should include ensur­
the full life cycle of a product).20 ing that appropriate investment has been made for human
resources and technology infrastructure before changes are
39. A bank should have policies and procedures defining the
introduced. Changes should be monitored, during and after
process for identifying, managing, challenging, approving and
their implementation, to identify any material differences to the
monitoring change on the basis of agreed objective criteria.
expected operational risk profile and manage any unexpected
Change implementation should be monitored by specific over­
risks.
sight controls. Change management policies and procedures
should be subject to independent and regular review and 42. Banks should maintain a central record of their products and
update, and clearly allocate roles and responsibilities in accor­ services to the extent possible (including the outsourced ones)
dance with the three-lines-of-defence model, in particular: to facilitate the monitoring of changes.

a. The first line of defence should perform operational risk and

control assessments of new products, activities, processes
and systems, including the identification and evaluation of Monitoring and Reporting
the required change through the decision-making and plan­ Principle 8: Senior management should implement a process
ning phases to the implementation and post-implementa­ to regularly monitor operational risk profiles and material
tion review. operational exposures. Appropriate reporting mechanisms
b. The second line of defence (CORF) should challenge the should be in place at the board of directors, senior manage­
operational risk and control assessments of first line of ment, and business unit levels to support proactive manage­
defence, as well as monitor the implementation of appropri­ ment of operational risk.
ate controls or remediation actions. C O RF should cover all
43. A bank should ensure that its reports are comprehensive,
phases of this process. In addition, C O RF should ensure that accurate, consistent and actionable across business units and
all relevant control groups (eg finance, compliance, legal,
products. To this end, the first line of defence should ensure
business, ICT, risk management) are involved as appropriate.
reporting on any residual operational risks, including operational
40. A bank should have policies and procedures for the review risk events, control deficiencies, process inadequacies, and non-
and approval of new products, activities, processes and systems. compliance with operational risk tolerances. Reports should be
The review and approval process should consider: manageable in scope and volume by providing an outlook on
the bank's operational risk profile and adherence to the opera­
a. Inherent risks - including legal, ICT and model risks - in
tional risk appetite and tolerance statement; effective decision­
the launch of new products, services, activities, and opera­
tions in unfamiliar markets, and in the implementation making is impeded by both excessive amounts and paucity of
data.
of new processes, people and systems (especially when
outsourced). 44. Reporting should be timely and a bank should be able to

b. Changes to the bank's operational risk profile, appetite and produce reports in both normal and stressed market condi­

tolerance, including changes to the risk of existing products tions.21* The frequency of reporting should reflect the risks

or activities. involved and the pace and nature of changes in the operating
environment. The results of monitoring activities should be
c. The necessary controls, risk management processes, and
included in regular management and board reports, as should
risk mitigation strategies.
assessments of the ORM F performed by the internal/external
d. The residual risk. audit and/or risk management functions. Reports generated
e. Changes to relevant risk thresholds or limits. by or for supervisory authorities should also be reported inter­
nally to senior management and the board of directors, where
f. The procedures and metrics to assess, monitor, and manage
appropriate.
the risk of new products, services, activities, markets, juris­
dictions, processes and systems. 45. Operational risk reports should describe the operational risk
profile of the bank by providing internal financial, operational,
20 The life cycle of a product or service encompasses various stages
from the development, ongoing changes, grandfathering and closure.
Indeed, the level of risk may escalate for example when new products,
activities, processes, or systems transition from an introductory level to 21 Reporting should be consistent with the Committee's Principles for
a level that represents material sources of revenue or business-critical effective risk data aggregation and risk reporting (https://www.bis.org/
operations. publ/bcbs239.pdf).

10 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and compliance indicators, as well as external market or environ­ e. Tracking of reports for approved exceptions to thresholds
mental information about events and conditions that are rele­ or limits, management overrides and other deviations from
vant to decision making. Operational risk reports should include: policy, regulations and laws.

a. Breaches of the bank's risk appetite and tolerance 49. Controls processes and procedures should address how the
statement, as well as thresholds, limits or qualitative bank ensures operational resilience is maintained in both normal
requirements. circumstances and in the event of disruption, reflecting respec­
tive functions' due diligence, consistent with the bank's opera­
b. A discussion and assessment of key and emerging risks.
tional resilience approach.
c. Details of recent significant internal operational risk events
50. An effective control environment also requires appropriate
and losses (including root cause analysis).
segregation of duties. Assignments that establish conflicting
d. Relevant external events or regulatory changes and any
duties for individuals or a team, without dual controls (eg a pro­
potential impact on the bank.
cess that uses two or more separate entities (usually persons)
46. Data capture and risk reporting processes should be anal­ operating in concert to protect sensitive functions or informa­
ysed periodically with the goal of enhancing risk management tion) or other countermeasures, may result in concealment of
performance as well as advancing risk management policies, losses, errors or other inappropriate actions. Therefore, areas
procedures and practices. where conflicts of interest may arise should be identified, mini­
mised, and be subject to careful independent monitoring and
review.
Control and Mitigation 51. In addition to segregation of duties and dual controls, banks
Principle 9: Banks should have a strong control environment should ensure that other traditional internal controls are in
that utilises policies, processes and systems; appropriate place, as appropriate, to address operational risk. Examples of
internal controls; and appropriate risk mitigation and/or these controls are:
transfer strategies. a. Clearly established authorities and/or processes for
47. Internal controls should be designed to provide reasonable approval.
assurance that a bank will have efficient and effective opera­ b. Close monitoring of adherence to assigned risk thresholds
tions; safeguard its assets; produce reliable financial reports; or limits.
and comply with applicable laws and regulations. A sound
c. Safeguards for access to, and use of, bank assets and
internal control programme consists of four components that
records.
are integral to the risk management process: risk assessment,
control activities, information and communication, and monitor­ d. Appropriateness of staffing level and training to maintain
ing activities.22 technical expertise.

e. Ongoing processes to identify business units or products

48. Control processes and procedures should include a system
where returns appear to be out of line with reasonable
for ensuring compliance with policies, regulations and laws.
expectations.23*
Examples of principle elements of a policy compliance assess­
ment are: f. Regular verification and reconciliation of transactions and
accounts.
a. Top-level reviews of progress towards stated objectives.
g. Vacation policy that provides for officers and employees
b. Verification of compliance with management controls.
being absent from their duties for a period of not less than
c. Review of the treatment and resolution of instances of
two consecutive weeks.
non-compliance.
52. Effective use and sound implementation of technology
d. Evaluation of the required approvals and authorisa­
can contribute to the control environment. For example, auto­
tions to ensure accountability to an appropriate level of
mated processes are less prone to error than manual processes.
management.
However, automated processes introduce risks that must be

22 The Committee's paper Framework for Internal Control Systems in 23 For example, where a supposedly low risk, low margin trading activity
Banking Organisations, September 1998, discusses internal controls in generates high returns that could call into question whether such returns
greater detail. have been achieved as a result of an internal control breach.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 11
addressed through sound technology governance and infra­ 55. In those circumstances where internal controls do not
structure risk management programmes. adequately address risk and exiting the risk is not a reasonable
option, management can complement controls by seeking to
53. The use of technology related products, activities, processes
transfer the risk to another party such as through insurance. The
and delivery channels exposes a bank to operational risk and the
board of directors should determine the maximum loss exposure
possibility of material financial loss. Consequently, a bank should
the bank is willing and has the financial capacity to assume, and
have an integrated approach to identifying, measuring, monitor­
should perform an annual review of the bank's risk and insurance
ing and managing technology risks along the same precepts as
management programme. While the specific insurance or risk
operational risk management.
transfer needs of a bank should be determined on an individual
54. While recourse to entities such as, but not limited to basis, many jurisdictions have regulatory requirements that must
third-party service providers can help manage costs, provide be considered.
expertise, expand product offerings, and improve services, it
56. Because risk transfer is an imperfect substitute for sound
also introduces risks that management should address. The
controls and risk management programmes, banks should view
board of directors and senior management are responsible for
risk transfer tools as complementary to, rather than a replace­
understanding the operational risks associated with outsourcing
ment for, thorough internal operational risk control. Having
arrangements and ensuring that effective risk management poli­
mechanisms in place to quickly identify, recognise and rectify
cies and practices are in place to manage the risk in outsourcing
distinct operational risk errors - or specific legal risk exposure -
activities. Amongst others, the concentration of risk and the
can greatly reduce exposures. Careful consideration also needs
complexity of outsourcing should be taken into account. Third-
to be given to the extent to which risk mitigation tools such as
party risk policies (as a part of the ORM F's policies) and risk
insurance truly reduce risk, transfer the risk to another business
management activities24 should encompass:
sector or area, or create a new risk (eg counterparty risk).
a. Procedures for determining whether and how activities can
57. Banks should have unified classification, methodology, and
be outsourced.
procedures of operational risk management established by the
b. Processes for conducting due diligence in the selection of
CORF.
potential service providers.

c. Sound structuring of the outsourcing arrangement, includ­

ing ownership and confidentiality of data, as well as term i­
Information and Communication
nation rights. Technology
d. Programmes for managing and monitoring the risks associ­ Principle 10: Banks should implement a robust ICT25 risk
ated with the outsourcing arrangement, including the finan­ management programme in alignment with their operational
cial condition of the service provider. risk management framework.

e. Establishment of an effective control environment at the 58. Effective ICT performance and security are paramount for
bank and the service provider, that should include a register a bank to conduct its business properly. The appropriate use
of outsourced activities and metrics and reporting to facili- and implementation of sound ICT risk management contributes
ate oversight of the service provider. to the effectiveness of the control environment and is funda­
f. Development of viable contingency plans. mental to the achievement of a bank's strategic objectives. A
bank's ICT risk assessment should ensure that its ICT fully sup­
g. Execution of comprehensive contracts and/or service
ports and facilitates its operations. ICT risk management should
level agreements with a clear allocation of responsibilities
reduce a bank's operational risk exposure to direct losses,
between the outsourcing provider and the bank.
legal claims, reputational damage, ICT disruption and misuse
h. Banks' supervisory and resolution authorities' access to third of technology in alignment with its risk appetite and tolerance
parties. statement.

24 These risk policies and risk management activities should be consis­

tent with and conducted alongside the critical operations management 25 "Information and communication technology" refers to the underlying
and dependency management for operational resilience. Basel Commit­ physical and logical design of information technology and communica­
tee on Banking Supervision, Principles for operational resilience, March tion systems, the individual hardware and software components, data,
2021. and the operating environments.

12 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
59. ICT risk management includes: Business Continuity Planning
a. ICT risk identification and assessment.
Principle 11: Banks should have business continuity plans in
b. ICT risk mitigation measures consistent with the assessed place to ensure their ability to operate on an ongoing basis
risk level (eg cybersecurity, response and recovery pro­ and limit losses in the event of a severe business disrup­
grammes, ICT change management processes, ICT incident tion.26 Business continuity plans should be linked to the
management processes, including relevant information bank's operational risk management framework.
transmission to users on a timely basis).
63. Sound and effective governance of banks' business continu­
c. Monitoring of these mitigation measures (including regular
ity policy27*requires:
tests).
a. Regular review and approval by the board of directors.
60. To ensure data and systems' confidentiality, integrity and
availability, the board of directors should regularly oversee the b. The strong involvement of the senior management and

effectiveness of the bank's ICT risk management and senior business units leaders in its implementation.

management should routinely evaluate the design, implementa­ c. The commitment of the first and second lines of defence to
tion and effectiveness of the bank's ICT risk management. This its design.
requires regular alignment of the business, risk management and d. Regular review by the third line of defence.
ICT strategies to be consistent with the bank's risk appetite and
64. Banks should prepare forward-looking business continu­
tolerance statement as well as with privacy and other applicable
ity plans (BCP) with scenario analyses associated with relevant
laws. Banks should continuously monitor its ICT and regularly
impact assessments and recovery procedures:
report to senior management on ICT risks, controls and events.
a. A bank should ground its business continuity policy on
61. ICT risk management together with complementing pro­
scenario analyses of potential disruptions that identify and
cesses set by the banks should:
categorise critical business operations and key internal or
a. be reviewed on a regular basis for completeness against rel­
external dependencies. In doing so, banks should cover all
evant industry standards and best practices as well as against
their business units as well as critical providers and major
evolving threats (eg cyber) and evolving or new technologies;
third parties (eg central banks, clearing house).
b. be regularly tested as part of a programme to identify
b. Each scenario should be subject to a quantitative and quali­
gaps against stated risk tolerance objectives and facilitate
tative impact assessment or business impact analysis (BIA)
improvement of the ICT risk identification, protection,
with regards to its financial, operational, legal and reputa­
detection and event management; and
tional consequences.
c. make use of actionable intelligence to continuously enhance
c. Disruption scenarios should be subject to thresholds or
their situational awareness of vulnerabilities to ICT systems,
limits (such as maximum tolerable outage) for the activation
networks and applications and facilitate effective decision
of a business continuity procedure. The procedure should
making in risk or change management.
address resumption aspects, set recovery time objectives
62. Banks should develop approaches to ICT readiness for (RTO) and recovery point objectives (RPO) as well as commu­
stressed scenarios from disruptive external events, such as the
nication guidelines for informing management, employees,
need to facilitate the implementation of wide-scale remote-
regulatory authorities, customers, suppliers, and - where
access, rapid deployment of physical assets and/or significant appropriate - civil authorities.
expansion of bandwidth to support remote user connections
65. A bank should periodically review its business continuity
and customer data protection. Banks should ensure that:
plans and policies to ensure that contingency strategies remain
a. appropriate risk mitigation strategies are developed for
consistent with current operations, risks and threats. Training
potential risks associated with a disruption or compromise
and awareness programmes should be customised based on
of ICT systems, networks and applications. Banks should
evaluate whether the risks, taken together with these strate­
gies, fall within the bank's risk appetite and risk tolerance; 26 The Committee's paper High-level principles for business continuity,
b. well defined processes for the management of privileged August 2006, discusses sound continuity principles in greater detail.
users and application development are in place; and 27 Business continuity planning should be consistent with and conducted
alongside the business continuity planning and testing of critical opera­
c. regular updates are made to ICT including cyber security in tions as specified in the principles for operational resilience. BCBS,
order to maintain an appropriate security posture. Principles for operational resilience, March 2021.

Chapter 1 Revisions to the Principles for the Sound Management of Operational Risk ■ 13
specific roles to ensure that staff can effectively execute contin­ process for assessing the appropriateness of their disclosures
gency plans. Business continuity procedures should be tested and disclosure policy.
periodically to ensure that recovery and resumption objectives
and timeframes can be met. Where possible, a bank should
participate in business continuity testing with key service pro­
Role of Supervisors
viders. Results of formal testing and review activities should be 69. Supervisors should regularly assess banks' O RM F by evalu­
reported to senior management and the board of directors. ating banks' policies, processes and systems related to opera­
tional risk. Supervisors should ensure that there are appropriate
mechanisms in place allowing them to remain apprised of banks'
Role of Disclosure
operational risk developments.
Principle 12: A bank's public disclosures should allow stake­
70. Supervisory evaluations of operational risk should include
holders to assess its approach to operational risk manage­
all areas described in the Principles for the sound management
ment and its operational risk exposure.
of operational risk. Where banks are part of a financial group,
66. A bank's public disclosure of relevant operational risk man­ supervisors should ensure that there are processes in place to
agement information can lead to transparency and the develop­ ensure that operational risk is managed in an appropriate and
ment of better industry practice through market discipline. The integrated manner across the group. In assessing banks' ORMF,
amount and type of disclosure should be commensurate with cooperation and exchange of information with other supervi­
the size, risk profile and complexity of a bank's operations, and sors, in accordance with established procedures, may be neces­
evolving industry practice. sary.30 In certain circumstances, supervisors may choose to use
external auditors in these assessment processes.31
67. Banks should disclose relevant operational risk exposure
information to their stakeholders (including significant opera­ 71. Supervisors should take steps to ensure that banks address
tional loss events), while not creating operational risk through deficiencies identified through the supervisory review of banks'
this disclosure (eg description of unaddressed control vulner­ ORMF. Supervisors should use the tools most suited to the par­
abilities).28,29 A bank should disclose its ORM F in a manner ticular circumstances of banks and their operating environment.
that allows stakeholders to determine whether the bank identi­ To ensure that supervisors receive current information on opera­
fies, assesses, monitors and controls/mitigates operational risk tional risk, supervisors may wish to establish reporting mecha­
effectively. nisms directly with banks and external auditors (eg internal bank
management reports on operational risk could be made rou­
68. Banks should have a formal disclosure policy that is subject
tinely available to supervisors).
to regular and independent review and approval by the senior
management and the board of directors. The policy should 72. Supervisors should encourage banks' ongoing internal
address the bank's approach for determining what operational development efforts by monitoring, comparing and evaluat­
risk disclosures it will make and the internal controls over the ing banks' recent improvements and plans for prospective
disclosure process. In addition, banks should implement a developments.

30 Refer to the Committee's papers High-level principles for the cross-

border implementation of the New Accord, August 2003, and Principles
for home-host supervisory cooperation and allocation mechanisms in
Internationally active banks are required to comply with the Basel III the context of Advanced Measurement Approaches (AMA), November
Pillar 3 operational risk disclosure requirements. 2007.
29 The recommendation to disclose significant operational loss events 31 For further discussion, see the Committee's paper The relationship
does not include disclosure of confidential and proprietary information, between banking supervisors and bank's external auditors, January
including information about legal reserves. 2002.

14 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Learning Objectives
After completing this reading you should be able to:

Define enterprise risk management (ERM) and explain Describe the role of and issues with correlation in risk
how implementing ERM practices and policies can create aggregation and describe typical properties of a firm's
shareholder value, at both the macro and the micro level. market risk, credit risk, and operational risk distributions.

Explain how a company can determine its optimal amount Distinguish between regulatory and economic capital
of risk through the use of credit rating targets. and explain the use of economic capital in the corporate
decision-making process.
Describe the development and implementation of an ERM
system, as well as challenges to the implementation of an
ERM system.

E x c e rp t is from Journal of Applied Corporate Finance 18, No. 4 (2006), by Brian W. N o cco and R ene M. S tu lz *

* We are grateful for comments from Don Chew, Michael Hofmann, Joanne Lamm-Tennant, Tom O'Brien, Jerome Taillard, and William Wilt.

15
The past two decades have seen a dramatic change in the role level. At the macro level, ERM creates value by enabling senior
of risk management in corporations. Twenty years ago, the job management to quantify and manage the risk-return trade-off
of the corporate risk manager— typically, a low-level position in that faces the entire firm. By adopting this perspective, ERM
the corporate treasury— involved mainly the purchase of insur­ helps the firm maintain access to the capital markets and other
ance. At the same time, treasurers were responsible for the resources necessary to implement its strategy and business plan.
hedging of interest rate and foreign exchange exposures. Over
At the micro level, ERM becomes a way of life for managers and
the last ten years, however, corporate risk management has
employees at all levels of the company. Though the academic
expanded well beyond insurance and the hedging of financial
literature has concentrated mainly on the macro-level benefits of
exposures to include a variety of other kinds of risk— notably
ERM, the micro-level benefits are extremely important in prac­
operational risk, reputational risk, and, most recently, strategic
tice. As we argue below, a well-designed ERM system ensures
risk. What's more, at a large and growing number of companies,
that all material risks are "ow ned," and risk-return trade-offs
the risk management function is directed by a senior executive
carefully evaluated, by operating managers and employees
with the title of chief risk officer (CRO) and overseen by a board
throughout the firm.
of directors charged with monitoring risk measures and setting
limits for these measures.

A corporation can manage risks in one of two fundamentally

The Macro Benefits of Risk Management
different ways: (1) one risk at a time, on a largely compart­ Students in the first finance course of an MBA program often
mentalized and decentralized basis; or (2) all risks viewed come away with the "perfect markets" view that since share­
together within a coordinated and strategic framework. The holders can diversify their own portfolios, the value of a firm
latter approach is often called "enterprise risk management," does not depend on its "total" risk. In this view, a company's
or "ER M " for short. In this article, we suggest that companies cost of capital, which is a critical determinant of its P/E ratio,
that succeed in creating an effective ERM have a long-run com­ depends mainly on the "system atic" or "nondiversifiable
petitive advantage over those that manage and monitor risks component of that risk (as typically measured by a company's
individually. Our argument in brief is that, by measuring and "beta"). And this in turn implies that efforts to manage total risk
managing its risks consistently and systematically, and by giving are a waste of corporate resources.
its business managers the information and incentives to optimize
But in the real world, where investors' information is far from
the trade-off between risk and return, a company strengthens its
complete and financial troubles can disrupt a company's opera­
ability to carry out its strategic plan.
tions, a bad outcome resulting from a "diversifiable" risk— say,
In the pages that follow, we start by explaining how ERM can an unexpected spike in a currency or commodity price— can
give companies a competitive advantage and add value for have costs that go well beyond the immediate hit to cash flow
shareholders. Next we describe the process and challenges and earnings. In the language of economists, such risks can have
involved in implementing ERM. We begin by discussing how a large "deadweight" costs.1
company should assess its risk "appetite," an assessment that
To illustrate, if a company expects operating cash flow of $200
should guide management's decision about how much and
million for the year and instead reports a loss of $50 million, a
which risks to retain and which to lay off. Then we show how
cash shortfall of this size can be far more costly to the firm than
companies should measure their risks. Third, we discuss various
just the missing $250 million. First of all, to the extent it affects
means of laying off "non-core" risks, which, as we argue below,
the market's expectation of future cash flows and earnings, such
increases the firm's capacity for bearing those "core" risks the
a shortfall will generally be associated with a reduction in firm
firm chooses to retain. Though ERM is conceptually straightfor­
value of much more than $250 million— a reduction that reflects
ward, its implementation is not. And in the last— and longest—
the market's expectation of lower growth. And even if operating
section of the chapter, we provide an extensive guide to the
cash flow rebounds quickly, there could be other, longer-lasting
major difficulties that arise in practice when implementing ERM.
effects. For example, assume the company has a number of
strategic investment opportunities that require im m ediate fund­
ing. Unless the firm has considerable excess cash or unused1
2.1 HOW DOES ERM CREATE
SHAREHOLDER VALUE?
1 There is a large academic literature that investigates how firm value
ERM creates value through its effects on companies at both a depends on total risk. For a review of that literature, see Rene Stulz, Risk
"macro" or company-wide level and a "micro" or business-unit Management and Derivatives, Southwestern Publishing, 2002.

16 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
debt capacity, it may be faced with the tough choice of cutting earnings as the underlying would have a similar advantage over
back on planned investments or raising equity in difficult cir­ a derivatives dealer.
cumstances and on expensive terms. If the cost of issuing equity
More generally, in making decisions whether to retain or trans­
is high enough, management may have little choice but to cut
fer risks, companies should be guided by the principle of com ­
investment. And unlike the adjustment of market expectations
parative advantage in risk-bearing.2 A company that has no
in response to what proves to be a temporary cash shortfall, the
special ability to forecast market variables has no comparative
loss in value from the firm having to pass up positive-NPV proj­
advantage in bearing the risk associated with those variables. In
ects represents a perm anent reduction in value.
contrast, the same company should have a comparative advan­
For most companies, guarding against this corporate "underin­ tage in bearing information-intensive, firm-specific business risks
vestment problem" is likely to be the most important reason to because it knows more about these risks than anybody else. For
manage risk. By hedging or otherwise managing risk, a firm can example, at Nationwide Insurance, exposures to changes in
limit (to an agreed-upon level) the probability that a large cash interest rates and equity markets are managed in strict ranges,
shortfall will lead to valuedestroying cutbacks in investment. with excess exposures reduced through asset repositioning or
And it is in this sense that the main function of corporate risk hedging. At the same time, Nationwide retains the vast majority
management can be seen as protecting a company's ability to of its insurance risks, a decision that reflects the firm's advantage
carry out its business plan. relative to any potential risk transfer counterparty in terms of
experience with and knowledge of such risks.
But which risks should a company lay off and which should it
retain? Corporate exposures to changes in currencies, interest One important benefit of thinking in terms of comparative
rates, and commodity prices can often be hedged fairly inex­ advantage is to reinforce the message that companies are in
pensively using derivatives such as forwards, futures, swaps, business to take stra teg ic and business risks. The recognition
and options. For instance, a foreign exchange hedging program that there are no economical ways of transferring risks that are
using forward contracts typically has very low transaction costs; unique to a company's business operations can serve to under­
and when the transfer of risk is inexpensive, there is a strong score the potential value of reducing the firm's exposure to
case for laying off economic risks that could otherwise under­ other, "non-core" risks.3 Once management has decided that
mine a company's ability to execute its strategic plan. the firm has a comparative advantage in taking certain business
risks, it should use risk management to help the firm make the
On the other hand, companies in the course of their normal
most of this advantage. Which brings us to a paradox of risk
activities take many strategic or business risks that they can­
management: By reducing non-core exposures, ERM effectively
not profitably lay off in capital markets or other developed risk
transfer markets. For instance, a company with a promising enables companies to take more strategic business risk— and
greater advantage of the opportunities in their core business.
plan to expand its business typically cannot find an economic
hedge— if indeed there is any hedge at all—for the business
risks associated with pursuing such growth. The company's The Micro Benefits of ERM
management presumably understands the risks of such expan­
sion better than any insurance or derivatives provider— if they As discussed above, an increase in total risk can end up reduc­
don't, the company probably shouldn't be undertaking the ing value by causing companies to pass up valuable projects or
project. If the company were to seek a counterparty to bear otherwise disrupting the normal operations of the firm. These
such business risks, the costs of transferring such risks would costs associated with total risk should be accounted for when
likely be prohibitively high, since they would have to be high assessing the risk-return trade-off in all major new investments.
enough to compensate the counterparty for transacting with If the company takes on a project that increases the firm's total
a better informed party and for constructing models to evalu­ risk, the project should be sufficiently profitable to provide an
ate the risks they're being asked to hedge. For this reason, we adequate return on capital after compensating for the costs
should not be surprised that insurance companies do not offer associated with the increase in risk. This risk-return trade-off
insurance contracts that provide complete coverage for earn­
ings shortfalls or that there is no market for derivatives for which
the underlying is a company's earnings. The insured companies 2 For an extended treatment of this concept, see Rene Stulz, "Rethink­
ing Risk Management," Journal o f Applied Corporate Finance, Vol. 9
would be in a position not only to know more than the insurers No. 3, Fall 1996.
about the distribution of their future earnings, but to manipulate
3 For a discussion of core and non-core risks, see Robert Merton,
that distribution to increase the payoffs from such insurance "You Have More Capital Than You Think," Harvard Business Review
policies. A firm that entered into a derivatives contract with its (November, 2005).

Chapter 2 Enterprise Risk Management: Theory and ■ 17

must be evaluated for all corporate decisions that are expected division could take a project that another would reject based on
to have a material impact on total risk. a different assessment of the project's risk and associated costs.
With the above capital allocation and performance evaluation
Thus, a major challenge for a company implementing ERM is
system mechanisms put in place when ERM is implemented,
to ensure that decision-making not just by senior management,
business managers are forced to consider the impact of all
but by business managers throughout the firm, takes proper
material risks in their investment and operating decisions. In
account of the risk-return trade-off. To make this happen, the
short, every risk is "owned" since it affects someone's perfor­
risk evaluations of new projects must be performed, at least
mance evaluation.
initially, on a decentralized basis by the project planners in the
business units. A completely centralized evaluation of the risk- Spreading risk ownership throughout the company has become
return trade-off of individual projects would lead to corporate more important as the scope of risk management has expanded
gridlock. Take the extreme case of a trader. Centralized evalu­ to include operating and reputational risks. Ten or 20 years ago,
ation would require the CRO's approval of each of the trader's when risk management focused mainly on financial risks, compa­
decisions with a potentially material impact on the firm's risk. nies could centrally measure and manage their exposures to mar­
But in a decentralized evaluation of the risk-return trade-off, ket rates. But operational risks typically cannot be hedged. Some
each unit in the corporation evaluates this trade-off in its deci­ of these risks can be insured, but companies often choose to
sion making. An important part of senior management's and the reduce their exposure to such risks by changing procedures and
CRO's job is to provide the information and incentives for each technologies. The individuals who are closest to these risks are
unit to make these trade-offs in ways that serve the interests of generally in the best position to assess what steps should be taken
the shareholders. to reduce the firm's exposure to them. So, for example, decisions
to manage operating risks are often entrusted to line managers
There are two main components of decentralizing the risk-return
whose decisions are based on their knowledge of the business,
trade-off in a company:
and supplemented by technical experts where appropriate.
a. First, managers proposing new projects should be required
Nationwide has developed a "factor-based" capital allocation
to evaluate all major risks in the context of the marginal
approach for its management accounting and performance
impact of the projects on the firm's total risk. The com­
evaluation system. Capital factors are assigned to products
pany's decision-making framework should require the busi­
based on the perceived risk of such products. For example, the
ness managers to evaluate project returns in relation to the
risk associated with, and capital allocated to, insuring a home in
marginal increases in firm-wide risk to achieve the optimal
a hurricane- or earthquake-prone area is greater than that for a
amount of risk at the corporate level.
home in a non-catastrophe exposed region.
b. Second, to help ensure that managers do a good job of
One of the most important purposes of such a risk-based capital
assessing the risk-return trade-off, the periodic performance
allocation system is to provide business managers with more
evaluations of the business units must take account of the
information about how their own investment and operating
contributions of each of the units to the total risk of the
decisions are likely to affect both corporate-wide performance
firm. As we will see later, this can be done by assigning
and the measures by which their performance will be evaluated.
a level of additional "im puted" capital to the project to
When combined with a performance evaluation system in this
reflect such incremental risk— capital on which the project
way, a risk-based capital allocation approach effectively forces
manager will be expected to earn an adequate return. By so
the business managers to consider risk in their decision-making.
doing, the corporation not only measures its true economic
Nationwide's risk factors are updated annually as part of the
performance, but also creates incentives for managers to
strategic and operational planning process, reflecting changes in
manage the risk-return trade-off effectively by refusing to
risk and diversification. Decision-making authority is delegated
accept risks that are not economically attractive.
by means of a risk limit structure that is consistent with Nation­
With the help of these two mechanisms that are essential to wide's risk appetite framework.
the management of firm-wide risk, a company that implements
ERM can transform its culture. Without these means, risk will be
accounted for in an ad hoc, subjective way, or ignored. In the 2.2 DETERMINING THE RIGHT
former case, promising projects could be rejected when risks AMOUNT OF RISK*
are overstated. In the latter case, systems that ignore risk will
end up encouraging high-risk projects, in many cases without How should a company determine the optimal amount of total
the returns to justify them. Perhaps even more troubling, one risk to bear? To answer this question, it's important to start by

18 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
recognizing that the costs associated with the cash shortfalls we risk portfolio by trading off the probability of large shortfalls
discussed earlier would not exist if the firm had a larger buffer and the associated costs with the expected gains from taking or
stock of equity capital invested in liquid assets. But carrying retaining risks.
excess equity also, of course, has costs. For example, a recent
Let's refer to this targeted minimal level of resources (which can
study concludes that, for some companies (typically larger,
be formulated in terms of cash flow, capital, or market value) as
mature companies), the last dollar of "excess" cash is valued by
the company's financial distress "threshold." Many companies
the market at as little as 60 cents.4
use bond ratings to define this threshold. For example, manage­
By reducing risk, a company can reduce the amount of expen­ ment may conclude that the firm would have to start giving up
sive equity capital needed to support its operating risks. In this valuable projects if its rating falls to Baa. In that case, it would
sense, risk management can be viewed as a substitute for equity adopt a financial and risk management policy that aims to limit
capital, and an important part of the job of the CRO and top to an acceptably low level the probability that the firm's rating
management is to evaluate the trade-off between more active will fall to Baa or lower. Given a firm's current rating— and let's
risk management and holding a larger buffer stock of cash assume it is Aa— it is straightforward to use data supplied by the
and equity. rating agencies to estimate the average probability that the
firm's rating will fall to Baa or lower. A study by Moody's using
As we saw earlier, for companies without a large buffer of excess
data from 1920 to 2005 shows that the probability of a company
equity, a sharp drop in cash flow and value can lead to financial
with an Aa rating having its rating drop to Baa or lower within a
distress and a further (permanent) loss of value from underin­
year's time is 1.05%, on average.5
vestment. Let's define "financial distress" to be any situation
where a company is likely to feel compelled to pass up positive W hether such a probability is acceptable is for top management
net present value (NPV) activities. and the board to decide. For a company with many valuable
growth opportunities, even just a 1% chance of having to forgo
Many companies identify a level of earnings or cash flow that
such investments may be too risky. By contrast, a basic manufac­
they want to maintain under almost all circumstances (i.e.,
turing firm with few growth opportunities is likely to be better
with an agreed-upon level of statistical confidence, say 95%,
off making aggressive use of leverage, maximizing the tax ben­
over a one-year period) and then design their risk manage­
efits of debt, and returning excess funds to shareholders. For
ment programs to ensure the firm achieves that minimum. For
such a firm, the costs associated with financial trouble would be
example, in the case described earlier of the firm with a $250
relatively low, at least as a percentage of total value.
million shortfall, management may want to explore steps that
would ensure that the firm almost never loses more than, say, For financial companies like Nationwide, however, there is
$100 million in a year, since that may be the point where man­ another important consideration when evaluating the costs of
agement begins to feel pressure to cut projects. But, as the financial distress that is specific to financial institutions: financial
mention of statistical confidence intervals suggests, a company trouble has an adverse impact on liabilities like bank deposits
cannot— nor should it attempt to — guarantee that its cash and and insurance contracts that constitute an important source of
earnings will never fall below the level it's aiming to protect. As the value of banks and insurance companies.6 Because such lia­
long as a company operates in a business that promises more bilities are very credit-sensitive, these financial institutions gen­
than the risk-free rate, there will be some risk of falling into erally aim to maximize their value by targeting a much lower
financial distress. probability of distress than the typical industrial firm.

What management can accomplish through an ERM program, Let's suppose for the moment that a rating is a completely reli­
then, is not to minimize or eliminate, but rather to limit, the able and sufficient measure of the probability that a company
probability of distress to a level that management and the board will default— an assumption we will reexamine later. And let's
agrees is likely to maximize firm value. Minim izing the prob­ consider a company that would have to start giving up valuable
ability of distress, which could be achieved by investing most of
the firm's capital in Treasury bills, is clearly not in the interests of
shareholders. Management's job is rather to optim ize the firm's
5 Moody's Default and Recovery Rates of Corporate Bond Issuers,
1920-2005, March 2006. We compute probabilities that assume that the
rating is not withdrawn.
4 By contrast, for riskier companies with lots of growth opportunities, 6 See Merton, Robert C., 1993, "Operation and Regulation in Financial
the same dollar can be worth as much as $1.50. See Lee Pinkowitz and Intermediation: A Functional Perspective," in Operation and Regulation
Rohan Williamson, "What Is the Market Value of a Dollar of Cash Hold­ of Financial Markets, edited by P. Englund. Stockholm: The Economic
ings?," Georgetown University working paper. Council.

Chapter 2 Enterprise Risk Management: Theory and ■ 19

Table 2.1 Transition M atrix from M oody's

Rating To:

Rating From: Aaa Aa A Baa Ba B Caa-C Default

Aaa 91.75% 7.26% 0.79% 0.17% 0.02% 0.00% 0.00% 0.00%

Aa 1.32% 90.71% 6.92% 0.75% 0.19% 0.04% 0.01% 0.06%

A 0.08% 3.02% 90.24% 5.67% 0.76% 0.12% 0.03% 0.08%

Baa 0.05% 0.33% 5.05% 87.50% 5.72% 0.86% 0.18% 0.31%

Ba 0.01% 0.09% 0.59% 6.70% 82.58% 7.83% 0.72% 1.48%

B 0.00% 0.07% 0.20% 0.80% 7.29% 80.62% 6.23% 4.78%

Caa-C 0.00% 0.03% 0.06% 0.23% 1.07% 7.69% 75.24% 15.69%

Average one-year rating transition matrix, 1920-2005, conditional upon no rating withdrawal.
Source: Moody's Default and Recovery Rates of Corporate Bond Issuers, 1920-2005, March 2006.

projects if its rating fell to Baa or below (that is, Baa would In practice, however, the process of determining a target rating
serve as its financial distress threshold). Assume also that man­ can involve more considerations, which makes it more compli­
agement and the board have determined that, for this kind of cated. For example, Nationwide analyzes and manages both
business, the optimal level of risk is one where the probability its probability of default and its probability of downgrade, and
of encountering financial distress is 7% over a one-year period. it does so in separate but related frameworks. The company's
Such an optimal level of risk would be determined by compar­ optimal probability of default is anchored to its target Aa ratings
ing the costs associated with financial distress and the benefits and reflects the default history of Aa-rated bonds. By contrast,
of having a more levered capital structure and taking on riskier the probability of downgrade to Baa or below is assumed to be
projects. affected by, and is accordingly managed by limiting, risk con­
centrations such as those arising from natural catastrophes and
To the extent that ratings are reliable proxies for financial health,
equity markets.
companies can use a rating agency "transition matrix" to esti­
mate the amount of capital necessary to support a given level of In the example above, the company is assumed to maximize
risk. The transition matrix shown in Table 2.1 can be used to value by targeting a rating of A. As we noted earlier, equity
identify the frequency with which companies moved from one capital provides a buffer or shock absorber that helps the firm to
rating to another over a certain period (in this case, 1920 to avoid default. For a given firm, a different probability of default
2005).7 For any rating at the beginning of the year (listed in the corresponds to each level of equity, so that by choosing a given
left-hand column of the table), the column of numbers running level of equity, management is also effectively choosing a prob­
down from the heading "Baa" tells us the probability that a ability of default that it believes to be optimal.
company will end up with a Baa rating at the end of the year.
As can be seen in Table 2.1, an A rating is associated with a
Again, let's assume management wants the probability of its rat­ probability of default of 0.08% over a one-year period. Thus,
ing falling to Baa or lower over the next year to average around to achieve an A rating, the company in our example must have
7%. To determine the probability of a downgrade to or lower the level of (equity) capital that makes its probability of default
than Baa for a given initial rating, we add up the probabilities of equal to 0.08%. If we make the assumption that the value of a
ending with a rating equal to or lower than Baa along the row company's equity falls to a level not materially different from
that corresponds to the initial rating. The row where the prob­ zero in the event of default, we can use the probability of
abilities of ending at Baa or lower is closest to 7% is the one default to "back out" the amount of equity the firm needs to
corresponding to an A rating. Consequently, by targeting an A support its current level of risk.
rating, management would achieve the probability of financial
distress that is optimal for the firm. Although the probability of default is in fact a complicated func­
tion of a number of firm characteristics, not just the amount of
equity, the analytical process that leads from the probability of
7 See footnote 2. default to the required amount of capital is straightforward.

20 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
To see this, suppose that the company
becomes bankrupt if firm value at the
end of the fiscal year falls below a
default threshold level, which is a
function of the composition and
amount of the firm's debt.8 Given this
assumption, the firm needs the
amount of equity capital that will
make the probability of its value fall­
ing below the default threshold level
equal to 0.08% (or alternatively, the
amount that will ensure that its value
will not fall below the default thresh­
old level with a probability of 99.92%).

A company can also assess its costs

of financial distress by using criteria
other than ratings and ratings thresh­
olds. For instance, in addition to a rat­
ing downgrade, Nationwide Insurance
identifies a number of other scenarios
that it views as imposing large costs
on the company. Chief among them
Fiq u re 2.1 R eq u ired eq u ity capital to a ch ie v e a ta rg e t p ro b ab ility of d efau lt
are high levels of volatility in earnings
a function of firm vo latility or VaR.
and capital that, while not alone suf­
ficient to cause a rating downgrade,
could contribute to an increase in overall risk and hence the an amount of equity equal to its firm-wide one-year VaR deter­
required level of capital. For each of these critical variables and mined at a probability level of 0.08%.
scenarios, Nationwide sets target probability levels and accept­
For some companies, VaR conveys the same information as the
able tolerances that enable the firm to limit its volatility risk
volatility of its stock price or market value, which would allow
within those targeted levels.
the firm using VaR to focus on these more direct measures of
When thinking about acceptable levels of volatility, and the volatility of its value.9 But for those companies for which the dis­
equity capital needed to support them, many financial com­ tribution of firm value changes is not "normal" or symmetric, the
panies use a risk measure called value-at-risk, or VaR for short. analysis of risk provided by VaR can be quite different from the
VaR is the amount of the loss that is expected, with some pre­ information provided by volatility— and in such cases, VaR must
specified probability level, to be reached or exceeded during a be estimated directly.
defined time period. For instance, if a portfolio of securities has
But whether management uses VaR or volatility, given a tar­
a one-year VaR at the 5% probability level of $20 million, there
geted probability of default or financial distress, the company
is a 5% chance the portfolio will have a loss that exceeds $20
faces a trade-off, as illustrated in Figure 2.1, between its level of
million in the next year. VaR can also be computed for an entire
VaR or volatility and the size of its buffer stock of equity capital.
company by assessing the distribution of firm value. When the
As VaR or volatility increase, the firm requires more capital to
determination of the buffer stock of equity proceeds along the
achieve the same probability of default. And as can also be seen
lines described so far, the company in our example must have
in the upward shift from line x to line y in Figure 2.1, this trade­
off becomes steeper if management chooses to reduce the tar­
geted probability of default.
8 If all debt were due at the end of the year, the default threshold level
would be the principal amount of debt outstanding plus interest due.
However, if debt matures later, firm value could fall below the principal
amount of debt outstanding without triggering a default. So, the default
threshold level is lower than the principal amount of debt outstanding 9 In particular, VaR is a multiple of volatility when the variable for which
when the firm has long-term debt. VaR is estimated has a normal distribution.

Chapter 2 Enterprise Risk Management: Theory and ■ 21

Now suppose that based on its estimate of volatility, manage­ a given amount of total risk, the company can increase its
ment concludes that the firm needs $5 billion of equity capital capital to achieve its target rating. At the margin, the firm
to achieve its target probability of default. As noted earlier, the should be indifferent between changing its capital and
company can reduce its required level of equity by using risk changing its risk.
management to reduce the probability of default, which would 4. Top management decentralizes the risk-capital trade-off
make sense if that option were deemed less costly than holding with the help of a capital allocation and performance evalu­
the $5 billion of equity. In making this trade-off between manag­ ation system that motivates managers throughout the orga­
ing risk and holding more equity, the company should aim to nization to make investment and operating decisions that
position itself "at the margin" where it is indifferent between optimize this trade-off.
decreasing risk and increasing capital. Management can satisfy
itself that it has achieved this position if, after having decided
on a certain combination of risk management and capital, it 2.3 IMPLEMENTING ERM
can show that, for example, spending another $10 million to
decrease risk by 1% will save the firm roughly $10 million in But if ERM is conceptually straightforward, its implementation is
equity capital costs. In this event, it has achieved the optimal challenging. For a company to succeed in implementing ERM,
amount of risk. it is critical that people throughout the organization understand
how it can create value. Managers must understand that it is not
Using this approach, the company can evaluate the marginal
an academic exercise but a critical tool for executing the firm's
impact of a project on both its risk of default and its risk of
strategy. Thus ERM must be "sold" to and "bought into" by
financial distress. As total risk increases, the firm requires more
all levels of the organization. For the whole organization to get
capital to support that risk. Moreover, the cost of the additional
behind it, considerable thought must be devoted to the design
capital provides a useful measure of the cost of the project's
of managerial performance evaluation and incentives. We now
contribution to the firm's total risk. The project is worth under­
consider the main challenges involved in making ERM work.
taking only if its NPV is large enough to cover that additional
cost. Similarly, when evaluating the performance of a unit within
the firm, the unit contributes to shareholder wealth only insofar Inventory of Risks
as its economic value added exceeds the cost of its contribu­
tion to the risk of the firm. In this way, then, the capital required The first step in operationalizing ERM is to identify the risks to
to support the contribution of an activity to the total risk of the which the company is exposed. A common approach is to iden­
firm becomes itself a measure of risk— a measure that, because tify the types of risks that will be measured. In the early days of
of its simplicity, can easily be added up across different activities corporate risk management, financial institutions focused mainly
or risks. on market and credit risks. Eventually operational risk was
added. As a result, a common practice for banks is to classify all
The conceptual framework of ERM can thus be summarized as
risks into one of three categories: market, credit, and opera­
follows:
tional. But for such an approach to capture all the risks the firm
1. Management begins by determining the firm's risk appetite, is exposed to, operational risk has to be a catch-all category
a key part of which is choosing the probability of financial that includes all risks that are not market and credit risks.101
distress that is expected to maximize firm value. When Many companies have gone beyond measuring market, credit,
credit ratings are used as the primary indicator of financial and operational risks. In recent years, some firms have also
risk, the firm determines an optimal or target rating based attempted to measure liquidity, reputational, and strategic
on its risk appetite and the cost of reducing its probability risks. Further, the three-party typology used in banking often
of financial distress. does not correspond well to the risks faced in other industries.
2. Given the firm's target rating, management estimates the For example, because insurance companies have risks on their
amount of capital it requires to support the risk of its opera­ asset side— that is, the risks associated with their investment
tions. In so doing, management should consider the prob­
ability of default.

3. Management determines the optimal combination of capi­ 10 For banks, the definition of operational risk that prevails in the Basel
tal and risk that is expected to yield its target rating. For 11accord is much narrower; for instance, it ignores the reputational risks
that are today a major concern of many financial institutions. As a result,
a given amount of capital, management can alter its risk for banks, there will be a tension between the measurement of opera­
through hedging and project selection. Alternatively, for tional risk for regulatory purposes and from the perspective of ERM.

22 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
portfolio— as well as their liability side, such companies gener­ units often resist such monitoring efforts because they are time-
ally use a different typology. Nationwide Insurance regularly consuming and distract from other activities. A well-known
measures and monitors its asset, liability, operating, liquidity, example of such resistance that ultimately created massive prob­
and strategic risks— and it considers reputational risks in the lems for the old UBS took place when the firm attempted to
context of each of these risks and of its overall business. (Market include its equity derivatives desk into its risk measurement sys­
and credit risks are both treated as parts of asset risks.) tem. Because the equity derivatives desk used a different com­
puter system, such an undertaking would have required major
Having identified all of the company's major risks, management
changes in the way the desk did its business. But since the desk
must then find a consistent way to measure the firm's exposure
was highly profitable, it was allowed to stay outside the system.
to these risks— a common approach that can be used to identify
Eventually, the operation incurred massive losses that funda­
and quantify all the firm's significant exposures. Without such a
mentally weakened the bank and led it to seek a merger.11
method, exposure to the same risk could have different effects
on the performance evaluation and decision-making of differ­
ent business units and activities. The resulting possibility that Economic Value versus Accounting
identically risky activities would be allocated different amounts Performance
of capital would almost certainly create tension within the firm.
Furthermore, risk would gradually migrate within the organiza­ Although credit ratings are a useful device for helping a com­
tion to those parts of the firm where it received the lowest risk pany think about its risk appetite, management should also
rating and smallest capital allocation. recognize the limitations of ratings as a guide to a value-maxi­
mizing risk management and capital structure policy. Because
For an inventory of risks to be useful, the information pos­ of the extent of their reliance on "accounting" ratios as well as
sessed by people within the organization must be collected, analysts' subjective judgment, credit ratings are often not the
made comparable, and continuously updated. Organizations most reliable estimates of a firm's probability of default. For
that have grown through acquisitions or without centralized IT example, a company might feel confident that the underlying
departments typically face the problem of incompatible com­ economics of its risk management and capital structure give
puter systems. Companies must be able to aggregate common it a probability of default that warrants an A rating, but find
risks across all of their businesses to analyze and manage those itself assigned a Baa rating— perhaps because of a mechanical
risks effectively. application of misleading accounting-based criteria— by the
Nationwide employs both a top-down and a bottom-up pro­ agencies. In such cases, management should rely on its own

cess of risk identification. From a top-down perspective, the economics-based analysis, while making every effort to share its
company's ERM leadership and corporate level risk committee thinking with the agencies.

have identified all risks that are large enough in aggregate to But having said this, if maintaining a certain rating is deemed to
threaten the firm with financial distress in an adverse environ­ be critical to the success of the organization, then setting capital
ment. The bottom-up process involves individual business units at a level that achieves the probability of default of the targeted
and functional areas conducting risk-control self assessments rating may not be enough. Management may also have to tar­
designed to identify all material local-level risks. The goal is to get some accounting-based ratios that are important determi­
identify all important risks, quantify them using a consistent nants of ratings as well.
approach, and then aggregate individual risk exposures across
This question of economic or value-based management vs.
the entire organization to produce a firm-wide risk profile that
accounting-based decision-making raises a fundamental ques­
takes account of correlations among risk. For example, Nation­
tion of risk management: What is the shortfall that manage­
wide analyzes and establishes aggregate limits for the equity
ment should be concerned about? Is it a shortfall in cash flow
risk stemming from three main sources: (1) the stock holdings
or in earnings? Is it a drop in a company's G A A P net worth or a
in its property and casualty insurance investment portfolio;
market-based measure of firm value?
(2) the fee levels that are tied to equity values in the variable
annuity and insurance contracts of its life insurance business; If the company is managing its probability of default, it should
and (3) the asset management fees that are tied to equity obviously focus on the measure that is most directly linked to
values in its investment management business. that outcome. For example, an unexpected drop in this year's
cash flow may not be a problem for a company if its future cash1
Corporate failures to conduct thorough "inventories" of their
risks on a regular basis have been responsible for a striking num­
ber of major corporate disasters over the last 20 years. Business 11 See Dirk Schutz, La Chute de I'UBS, Bilan, 1998.

Chapter 2 Enterprise Risk Management: Theory and ■ 23

flows are clearly unaffected. If the firm finds it easy to borrow While companies should pursue economic outcomes whenever
against its future cash flows or tangible assets, a shortfall in this possible, there will clearly be situations where they need to
year's cash flow is unlikely to lead the firm to default. But those limit the volatility of reported accounting earnings. Companies
companies that cannot borrow against future cash flows, per­ with debt covenants that specify minimal levels of earnings and
haps because they are too speculative and have few tangible net worth are one example. Another is provided by companies
assets, may be affected much more adversely. In such cases, the that face regulatory requirements to maintain minimal levels
shortfall in cash flow, by triggering financing constraints, could of "statutory" capital, which is typically defined in standard
push the firm into financial distress. It is these kinds of compa­ accounting terms. Yet another are companies whose ability to
nies that are likely to focus their risk management efforts on attract customers depends in part on credit ratings, which in
measures of cash flow volatility. turn can be affected by earnings volatility. Nationwide Insur­
ance, for example, operates in many businesses that are highly
But if a company is more likely to experience financial distress
sensitive to credit ratings. And to the extent its ratings could be
because the p re se n t value of future cash flows is low than
affected by high (or unexplained) levels of accounting volatility,
because of a drop in cash flow, management must model the
management's decision-making must clearly take such volatility
risk of changes in firm value, which reflects the present value
into account. In such cases, the challenge of an ERM system is
of expected future cash flows, rather than the risk of changes
to meet the lenders' and regulators' accounting requirements
in cash flows. There are a number of topdown approaches that
while still attempting to manage risk from the perspective of
provide estimates of total risk based on industry benchmarks
economic value. Nationwide's approach is to make economically
that are cheap and easy to implement. Unfortunately, such
based decisions to maximize value while treating its targeted
approaches are not useful for managing risk within a com­
"A a" ratings vulnerability as a "constraint." A significant amount
pany because they do not make it possible to relate corporate
of effort is devoted to minimizing the effect of this constraint
actions to firm-wide risk. For instance, management could
through disclosure and communication with the rating agencies.
obtain an estimate of the volatility of firm value or cash flows by
looking at the distribution of the value or cash flows of compa­
rable companies. But such an approach would provide manage­ Aggregating Risks
ment with little understanding of how specific risk management
policies, including changes in capital structure, would affect A firm that uses the three-part typology of market, credit, and
this estimate. operational risk mentioned earlier generally begins by measur­
ing each of these risks individually. If the firm uses VaR, it will
Thus, a management intent on implementing ERM must esti­
have three separate VaR measures, one each for market risk, for
mate the expected distribution of changes in firm value from
credit risk, and for operational risk. These three VaRs are then
the bottom up. When, as is typical, a company's value is best
used to produce a firm-wide VaR.
estimated as the present value of its expected future cash flows,
management should "build" its estimates of firm value by mod­ As shown in Figure 2.2, these three types of risks have dramati­
eling the distribution of future cash flows. As a fundamental cally different distributions.12 Market risk behaves very much like
part of its ERM program, Nationwide has developed stochastic the returns on a portfolio of securities, which have a "norm al" or
models that generate multi-year cash flow distributions for its symmetric distribution. In contrast, both credit and operational
main businesses. risk have asymmetric distributions. With credit risk, either a
creditor pays in full what is owed or it does not. In general, most
The Accounting Problem creditors pay in full, but some do not— and when a creditor
defaults, the loss can be large. With operational risk, there tends
By focusing on cash flows, then, a company focuses on its eco­
to be large numbers of small losses, so that small operational
nomic value. But while helping the firm achieve its target prob­
losses are almost predictable. There is also, however, some
ability of default, such an approach could also result in more
chance of large losses, so that the distribution of operational
volatile accounting earnings. For example, under the current
losses has a "long tail." Statisticians describe distributions as
accounting treatment of derivatives, if a company uses deriva­
having "fat tails" when the probability of extreme losses is
tives to hedge an economic exposure but fails to qualify for
higher than can be described by the normal distribution. While
hedge accounting, the derivatives hedge can reduce the volatil­
many use the normal distribution to estimate the VaR of market
ity of firm value while at the same time increasing the volatility
of accounting earnings. And thus a company that implements
ERM could end up with higher earnings volatility than a compa­ 12 This is also the case when risks are divided into asset risks, operational
rable firm that does not. risks, and liability risks.

24 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Market Risk

2 4 6 8 10
Loss

Operational Risk

F ig u re 2 .2 Typical m arket, cred it, and o p eratio n al risk d istrib utio n s.

risk, such an approach is not appropriate for credit and opera­ regardless of whether they use their own or other firms' correla­
tional risks because these risks have fat tails. tion measures, companies should keep in mind the tendency for
correlations to increase in highly stressed environments.
When aggregating the risks, one must also estimate their cor­
relations. The probability of experiencing simultaneously highly One important issue in estimating correlations across types of
adverse market, credit, and operational outcomes is typically risks is the importance of recognizing that such correlations
very low. This means that there is diversification across risk cat­ depend to some extent on the actions of the company. For
egories, and that the firm-wide VaR is thus less than the sum example, the total risk of an insurance company depends on the
of the market risk, credit risk, and operational risk VaRs. How correlation between its asset risk and its liability risk. By chang­
much less depends on the correlation between these risks. The ing its asset allocations, the company can modify the correlation
estimation of the correlations between certain types of risks is at between its asset risk and its liability risk. As a consequence, an
present more art than science. For this reason, many companies insurance company's asset portfolio allocations can be an essen­
choose to use averages of correlations used by other firms in tial part of its risk management effort. For example, Nationwide
their industry rather than relying on their own estim ates.13 But Insurance uses a sophisticated asset/liability model to create an
efficient frontier of investment portfolios. The actual target port­
13 For data on correlations used in practice for financial institutions, see folio selected takes into consideration the firm's tolerance for
Andrew Kuritzkes, Til Schuermann, and Scott M. Weiner, "Risk Measure­
ment, Risk Management and Capital Adequacy in Financial Conglomer­ interest rate, equity market, and other risks as well as the oppor­
ates," Brookings-Wharton Papers on Financial Services, 2003, pp. 141-193. tunity for expected economic value creation.

Chapter 2 Enterprise Risk Management: Theory and Practice ■ 25

Measuring Risks For most investment grade companies, then, it is much easier
to evaluate the distribution of changes in firm value over the
Some companies focus mostly on tail risk—the low-probability, range of changes that encompasses not default, but just a rat­
large-loss outcomes. As a result, when they measure the risk of ings downgrade. For example, using the Moody's transition
changes in the present value of cash flows, they use a measure matrix data (Table 2.1), one can say with some confidence that
like VaR at a probability level that corresponds to a default an A-rated firm has a 5.67% chance on average of being down­
threshold. Some of these companies also complement their VaR graded to a Baa rating over a one-year period; in other words,
estimates with stress tests in which they investigate the impact such an event is expected to happen in more than one year out
on firm value of rare events (such as the crisis period of August of 20. (In contrast, default is expected to happen in approxi­
and September 1998 that followed Russia's default on some of mately one year out of 1,000.) Because of the abundance of
its debt). data on downgrades as opposed to defaults for A-rated compa­
Though VaR is widely used, it is important to understand its nies, the distribution of changes in firm value that corresponds
limitations and to complement its use with other risk measures. to a downgrade to Baa can be estimated more precisely. Over
Perhaps the main problem is that while VaR measures the loss that much narrower range of possible outcomes, the prob­
that is expected to be exceeded with a specified probability, lems created by "asymmetries" in the distribution of firm value
it says nothing about the expected size of the loss in the event changes and the so-called "fat tail" problems (where extreme
that VaR is exceeded. Some have argued that companies should negative outcomes are more likely than predicted by common
instead focus on the expected loss if VaR is exceeded. But statistical distributions) are not likely to be as severe. In such
focusing on this risk measure, which is often called conditional cases, management may have greater confidence in its esti­
VaR, instead of focusing on VaR has little economic justification mates of the distribution of value changes corresponding to a
in the context of firmwide risk management. Setting the compa­ downgrade rather than a default and will be justified in focusing
ny's capital at a level equal to the conditional VaR would provide on managing the probability of a downgrade.
the firm with a lower probability of default than the targeted As discussed previously, it is also important to understand and
level, leading to an excessively conservative capital structure. take account of risk correlations when analyzing and manag­
But a more important reason for companies to look beyond a ing default and distress probabilities. Nationwide Insurance
VaR measure estimated at the probability level corresponding incorporates in its economic capital model a correlation matrix
to a default threshold is that ERM adds value by optimizing the that reflects sensitivity-tested stress correlations. It is also now
probability and expected costs of financial distress. It is therefore in the process of exploring event-driven correlation analysis
critical for companies to make sure that the equity capital set for scenarios that include terrorist attacks, mega hurricanes,

based on a VaR estimate leads to the targeted optimal probabil­ and pandemics.
ity of financial distress. Such an effort requires a broader under­
standing of the distribution of firm value than is provided by a
Regulatory versus Economic Capital
VaR estimate for a given probability of default. Further, since dif­
ferent levels of financial distress have different costs, a company The amount of equity capital required for the company to
can take these different costs into account and focus on the achieve its optimal rating may bear little relation to the amount
probability distribution of different levels of financial distress. of capital regulators would require it to hold. A firm that
practices ERM may therefore have an amount of capital that
To compound the problem, when a company has a high rating
substantially exceeds its regulatory requirements because it
target, the estimation of VaR becomes more of an art as the esti­
maximizes shareholder wealth by doing so. In this case, the
mated VaR corresponds to an extremely low probability level.
regulatory requirements are not binding and would not affect
To see this, consider a company that has determined that an A
the firm's decisions.
rating is optimal. Since the probability of default for an A-rated
company is only 0.08% over a one-year period, to estimate The company would be in a more difficult situation if its required
its optimal amount of capital the firm must therefore estimate regulatory capital exceeded the amount of capital it should hold
the loss in value that is exceeded with a probability of 0.08%. to maximize shareholder wealth. Nationwide Insurance refers to
The problem, however, is that few A-rated companies have any this excess as "stranded capital." To the extent that economic
experience of losses that come anywhere near that level. And and regulatory capital are subject to different drivers, the dif­
without any historical experience of such losses, it is difficult for ference between the two can be arbitraged to some degree to
management to estimate the VaR at that probability level and minimize the level of stranded capital. Nationwide allocates any
then evaluate the result. residual stranded capital to its businesses and products. If all the

26 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
potential competitors of the firm face the same onerous regula­ way to estimate the cost of the impact of a new risky activity on
tory capital requirements, the capital the firm has to hold that the firm's total risk is to evaluate how much incremental capital
is not justified on economic grounds is simply a regulatory tax. would be necessary to ensure that the new risky activity has no
If some potential competitors could provide the firm's products impact on the firm's probability of financial distress.
without being subjected to the same regulatory capital, these
To illustrate, suppose that before the company takes on the new
less regulated competitors could offer the products at a lower
activity, the VaR estimate used to set the firm's capital is $5 bil­
price and the firm would risk losing business to them. In this
lion. Now, with the new activity, this VaR estimate increases
case, the firm would have to factor in the cost of regulatory cap­
to $5.1 billion. Thus, for the firm to have the same probability
ital of its various activities and would want to grow its portfolio
of financial distress as it had before it undertook the new risky
of activities in a way that requires less regulatory capital.
activity, it would need to raise capital of $100 million. Moreover,
Regulatory capital is generally defined in terms of regulatory this capital would have to be invested in such a way that the
accounting. For purposes of an ERM system, companies focus investment does not increase the risk of the firm, since otherwise
on G A AP and economic capital. An exclusive focus on account­ the VaR of the firm would further increase. If the risky new activ­
ing capital is mistaken when accounting capital does not accu­ ity is expected to last one year, and the cost to the firm of having
rately reflect the buffer stock of equity available to the firm. this additional $100 million available for one year is estimated to
The firm may have valuable assets that, although not marked to be $8 million, then the economic value added of the new activ­
market on its books, could be sold or borrowed against. In such ity should be reduced by $8 million. If the firm ignores this cost,
cases, the firm's book equity capital understates the buffer stock it effectively subsidizes the new risky activity. To the extent that
available to it that could be used to avoid default. riskier activities have higher expected payoffs before taking into
Thus, in assessing the level of a company's buffer of capital, this account their contribution to the firm's probability of financial
suggests that the amount of its G A AP equity capital is only part distress, a firm that ignores the impact of project risks on firm­
of the story. The composition and liquidity of the assets matters wide risk ends up favoring riskier projects over less risky ones.

as well. If the firm incurs a large loss and has no liquid assets it Though the example just discussed is straightforward, the
can use to "finance" it, the fact that it has a large buffer stock of implementation of this idea in practice faces several difficulties.
book equity will not be very helpful. For this reason, many com­ A company is a collection of risky projects. At any time, a proj­
panies now do separate evaluations of their liquidity and the ect's contribution to the firm's total risk depends on the risk of
amount of equity capital they require. As the practice of ERM the other projects and their correlations. When business units
evolves, we would expect such companies to pay more atten­ are asked to make decisions that take into account the contri­
tion to the relation between the optimal amount of equity and bution of a project to firm-wide risk, they must have enough
the liquidity of their assets. information when making the decision to know how to evaluate
that contribution. They cannot be told that the contribution will
Using Economic Capital to Make Decisions depend on everything else that is going to happen within the
firm over the next year, and then have a risk charge assigned to
As we saw earlier, if companies could simply stockpile equity
their unit after the fact.
capital at no cost, there would be no deadweight costs associ­
ated with adverse outcomes. Management could use its liquid Many companies sidestep this issue and ignore correlations alto­
assets to finance the losses, and the bad outcome would have gether when they set capital. In that case, the capital required
no effect on the firm's investment policy. But in the real world, to support a project would be set so that the project receives
there are significant costs associated with carrying too much no benefit from diversification, and the contribution of the
equity. If the market perceives that a company has more equity project to firm-wide risk would then be the VaR of the project
than it needs to support the risk of the business, it will reduce itself. To account for diversification benefits under this system,
the firm's value to reflect management's failure to earn the cost the firm would reduce the cost of equity. But when evaluating
of capital on that excess capital. the performance of a business unit, the VaR of the business
unit would be used to assess the contribution of the unit to
When a company undertakes a new risky activity, the probability
the firm's risk and the units would effectively get no credit for
that it will experience financial distress increases, thus raising
diversification benefits.
the expected costs of financial distress. One way to avoid these
additional costs is by raising enough additional capital so that When decentralizing the risk-return trade-off, the company has
taking on the new risky activity has no effect on the probability to enable the managers of its business units to determine the
of financial distress. Consequently, the most straightforward capital that has to be allocated to a project to keep the risk of

Chapter 2 Enterprise Risk Management: Theory and ■ 27

the firm constant with the relatively simple information that is trusted by investors. In such cases, investors will be able to
readily available to them. Nationwide's factor-based capital allo­ distinguish bad outcomes that are the result of bad luck rather
cation and performance evaluation system is an example of such than bad management, and that should give them confidence to
an approach. The company allocates diversification benefits keep investing in the firm.
within major business units, but not across them. This means
that a project whose returns have a low correlation with the
other activities within its unit will receive "credit" for such diver­ CONCLUSION
sification benefits in the form of a lower capital allocation for the
unit. But investments of a business unit that have low correla­ In this chapter, we have discussed how enterprise risk manage­
tions with activities of other major business units are not cred­ ment creates value for shareholders and examined the practical
ited with firm-wide diversification benefits. The rationale for this issues that arise in the implementation of enterprise risk man­
policy is that it enables Nationwide's top management to take agement. Although the key principles that underlie the theory
account of the effects of new investments on risk at the corpo­ of ERM are well-established, it should be clear from this article
rate level while at the same time holding the business managers that additional research is needed to help with the implemen­
who make those decisions accountable for earning returns con­ tation of ERM. In particular, while much attention has been
sistent with their competitive operating environment. paid to measures of tail risk like VaR, it has become clear from
attempts to implement ERM that a more complete understand­
ing of the distribution of firm value is required. Though correla­
The Governance of ERM tions between different types of risks are essential in measuring
firm-wide risk, existing research provides little help in how to
How does a company know that its ERM is succeeding? While
estimate these correlations. Companies also find that some of
one outcome of effective ERM should be a better estimate of
their most troubling risks— notably, reputational and strategic
expected value and better understanding of unexpected losses,
risks— are the most difficult to quantify. A t this point, there is
ERM does not eliminate risk. Thus, extreme negative outcomes
little research that helps practitioners in assessing these risks,
are still a possibility, and the effectiveness of ERM cannot be
but much to gain from having a better understanding of these
judged on whether such outcomes materialize. The role of ERM
risks even if they cannot be quantified reliably.
is to limit the probability of such outcomes to an agreed-upon,
value-maximizing, level. But what if the probability of default In sum, there has been considerable progress in the implemen­
is set at one in 1,000 years? Quite apart from whether this is tation of ERM, with the promise of major benefits for corporate
indeed the value-maximizing choice, such a low probability shareholders. And, as this implementation improves with the
means that there will be no obvious way to judge whether the help of academic research, these benefits can only be expected
CRO succeeded in managing risk so as to give the firm its target to grow.
probability of default.

To evaluate the job of a CRO , the board and the C EO must Brian Nocco is the Chief Risk Officer of Nationwide Insurance.

attempt to determine how well the company's risk is understood Rene Stulz is the Reese Chair of Banking and Monetary Economics at
and managed. A company where risk is well understood and Ohio State University's Fisher School of Business and a research fellow
at the NBER and at the European Corporate Governance Institute. He is
well managed is one that can command the resources required also a member of the executive committee of the Global Association of
to invest in the valuable projects available to it because it is Risk Professionals (GARP).

28 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
What Is ERM?
Learning Objectives
After completing this reading you should be able to:

Describe enterprise risk management (ERM) and compare Describe the role and responsibilities of a chief risk officer
and contrast differing definitions of ERM. (CRO) and assess how the CRO should interact with other
senior management.
Compare the benefits and costs of ERM and describe the
motivations for a firm to adopt an ERM initiative. Describe the key components of an ERM program.

E x c e rp t is C h a p ter 4 o f Enterprise Risk Management: From Incentives to Controls, S e co n d Edition, b y Ja m e s Lam.

29
Earlier, we reviewed the concepts and processes applicable to across business units and functions, and provide overall risk
almost all of the risks that a company will face. We also argued monitoring for senior management and the board.
that all risks can be thought of as a bell curve. Certainly, it is a
Nor is risk monitoring any more efficient under the silo
prerequisite that a company develop an effective process for
approach. The problem is that individual risk functions measure
each of its significant risks. But it is not enough to build a sepa­
and report their specific risks using different methodologies
rate process for each risk in isolation.
and formats. For example, the treasury function might report
Risks are by their very nature dynamic, fluid, and highly inter­ on interest rate and FX risk exposures, and use value-at-risk as
dependent. As such, they cannot be broken into separate com­ its core risk measurement methodology. On the other hand,
ponents and managed independently. Enterprises operating in the credit function would report delinquencies and outstand­
today's volatile environment require a much more integrated ing credit exposures, and measure such exposures in terms of
approach to managing their portfolio of risks. outstanding balances, while the audit function would report out­
standing audit items and assign some sort of audit score, and
This has not always been recognized. Traditionally, companies
so on.
managed risk in organizational silos. Market, credit, and opera­
tional risks were treated separately and often dealt with by dif­ Senior management and the board get pieces of the puzzle,
ferent individuals or functions within an institution. For example, but not the whole picture. In many companies, the risk func­
credit experts evaluated the risk of default, mortgage specialists tions produce literally hundreds of pages of risk reports, month
analyzed prepayment risk, traders were responsible for mar­ after month. Yet, oftentimes, they still don't manage to provide
ket risks, and actuaries handled liability, mortality, and other management and the board with useful risk information. A good
insurance-related risks. Corporate functions such as finance and acid test is to ask if the senior management knows the answers
audit handled other operational risks, and senior line managers to the following basic questions:
addressed business risks. • What are the company's top 10 risks?
However, it has become increasingly apparent that such a • Are any of our business objectives at risk?
fragmented approach simply doesn't work, because risks are • Do we have key risk indicators that track our critical risk
highly interdependent and cannot be segmented and managed exposures against risk tolerance levels?
by entirely independent units. The risks associated with most
• What were the company's actual losses and incidents, and did
businesses are not one-to-one matches for the primary risks
we identify these risks in previous risk assessment reports?
(market, credit, operational, and insurance) implied by most tra­
ditional organizational structures. Attempting to manage them • Are we in compliance with laws, regulations, and corporate

as if they are is likely to prove inefficient and potentially danger­ risk policies?

ous. Risks can fall through the cracks, risk inter-dependencies If a company is uncertain about the answers to any of these
and portfolio effects may not be captured, and organizational questions, then it is likely to benefit from a more integrated
gaps and redundancies can result in suboptimal performance. approach to handling all aspects of risk— enterprise risk man­
For exam ple, imagine that a company is about to launch a agement (ERM ).1
new product or business in a foreign country. Such an initiative
would require:

• The business unit to establish the right pricing and market-

3.1 ERM DEFINITIONS
entry strategies;
Since the practice of ERM is still relatively new, there have yet
• The treasury function to provide funding and protection to be any widely accepted industry standards with regard to the
against interest rate and foreign-exchange (FX) risks; definition of ERM. As such, a multitude of different definitions is
• The Information Technology (IT) and operations function to available, all of which highlight and prioritize different aspects of
support the business; and ERM. Consider, for example, a definition provided by the Com ­
• The legal and insurance functions to address regulatory and mittee of Sponsoring Organizations of the Treadway Commis­
liability issues. sion (CO SO ) in 2004:

It is not difficult to see how an integrated approach could more

effectively manage these risks. An enterprise risk management
1 Other popular terms used to describe enterprise risk management
(ERM) function would be responsible for establishing firm-wide include firm-wide risk management, integrated risk management, and
policies and standards, coordinate risk management activities holistic risk management.

30 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 "ERM is a process, effected by an entity's board of company and rationalizes the use of derivatives, insurance, and
directors, management, and other personnel, applied in alternative risk transfer products to hedge only the residual risk
strategy setting and across the enterprise, designed to deemed undesirable by management.
identify potential events that may affect the entity, and
Third, enterprise risk management requires the integration of
manage risk to be within its appetite, to provide rea­
risk management into the business processes of a company.
sonable assurance regarding the achievement of entity
Rather than the defensive or control-oriented approaches used
objectives."
to manage downside risk and earnings volatility, enterprise risk
Another definition was established by the International Organi­ management optimizes business performance by supporting
zation of Standardization (ISO 31000): and influencing pricing, resource allocation, and other business
decisions. It is during this stage that risk management becomes
Risk is the "effect of uncertainty on objectives" and risk
an offensive weapon for management.
management refers to "coordinated activities to direct
and control an organization with regard to risk." All this integration is not easy. For most companies, the implemen­
tation of ERM implies a multi-year initiative that requires ongoing
While the CO SO and ISO definitions provide useful concepts
senior management sponsorship and sustained investments in
(e.g., linkage to objectives), I think it is important that ERM is
human and technological resources. Ironically, the amount of time
defined as a value added function. Therefore, I would suggest
and resources dedicated to risk management is not necessarily
the following definition:
very different for leading and lagging organizations.
Risk is a variable that can cause deviation from an
The most crucial difference is this: leading organizations make
expected outcome. ERM is a comprehensive and inte­
rational investments in risk management and are proactive, opti­
grated framework for managing key risks in order to
mizing their risk profiles. Lagging organizations, on the other
achieve business objectives, minimize unexpected earn­
hand, make disconnected investments and are reactive, fighting
ings volatility, and maximize firm value.
one crisis after another. The investments of the leading compa­
The lack of a standard ERM definition can cause confusion for a nies in risk management are more than offset by improved effi­
company looking to set up an ERM framework. No ERM defini­ ciency and reduced losses.
tion is perfect or applicable to every organization. My general
Let's discuss the three major benefits to ERM: increased organi­
advice is for each organization to adopt an ERM definition and
zational effectiveness, better risk reporting, and improved busi­
framework that best fit their business scope and complexity.
ness performance.

3.2 THE BENEFITS OF ERM Organizational Effectiveness

Most companies already have risk management and corporate-
ERM is all about integration, in three ways. oversight functions, such as finance/insurance, audit and compli­
First, enterprise risk management requires an integrated risk ance. In addition, there may be specialist risk units: for example,
organization. This most often means a centralized risk manage­ investment banks usually have market risk management units,
ment unit reporting to the C EO and the Board in support of while energy companies have commodity risk managers.
their corporate- and board-level risk oversight responsibilities. The appointment of a chief risk officer and the establishment of
A growing number of companies now have a Chief Risk Officer an enterprise risk function provide the top-down coordination
(CRO) who is responsible for overseeing all aspects of risk within necessary to make these various functions work cohesively and
the organization— we'll consider this development later. efficiently. An integrated team can better address not only the
Second, enterprise risk management requires the integration individual risks facing the company, but also the interdependen­
of risk transfer strategies. Under the silo approach, risk transfer cies between these risks.
strategies were executed at a transactional or individual risk
level. For example, financial derivatives were used to hedge
Risk Reporting
market risk and insurance to transfer out operational risk. How­
ever, this approach doesn't incorporate diversification within or As previously noted, one of the key requirements of risk man­
across the risk types in a portfolio, and thus tends to result in agement is that it should produce timely and relevant risk
over-hedging and excessive insurance cover. An ERM approach, reporting for the senior management and board of directors.
by contrast, takes a portfolio view of all types of risk within a As we also noted, however, this is frequently not the case. In a

Chapter 3 What Is ERM? ■ 31

silo framework, either no one takes responsibility for overall risk existence of heavy internal and external pressures. In the busi­
reporting, and/or every risk-related unit supplies inconsistent ness world, managers are often galvanized into action after a
and sometimes contradictory reports. near miss— either a disaster averted within their own organiza­
tion or an actual crisis at a similar organization.
An enterprise risk function can prioritize the level and content
of risk reporting that should go to senior management and the In response, the board and senior management are likely to
board: an enterprise-wide perspective on aggregate losses, pol­ question the effectiveness of the control environment and
icy exceptions, risk incidents, key exposures, and early-warning the adequacy of risk reporting within their company. To put it
indicators. This might take the form of a risk dashboard that another way, they will begin to question how well they really
includes timely and concise information on the company's key know the organization's major risk exposures.
risks. O f course, this goes beyond the senior management level; Such incidents are also often followed by critical assessments
the objective of ERM reporting is by its nature to increase risk from auditors and regulators— both groups which are constitu­
transparency throughout an organization. tionally concerned with the effectiveness of risk management.
Consequently, regulators focus on all aspects of risk during
examinations, setting risk-based capital and compliance require­
Business Performance
ments, and reinforcing key roles for the board and senior man­
Companies that adopt an ERM approach have experienced agement in the risk management process.
significant improvements in business performance. Figure 3.1
This introspection often leads to the emergence of a risk cham­
provides examples of reported benefits of ERM from a cross-
pion among the senior executives who will sponsor a major
section of companies. ERM supports key management decisions
program to establish an enterprise risk management approach.
such as capital allocation, product development and pricing, and
As noted above, this risk champion is increasingly becoming a
mergers and acquisitions. This leads to improvements such as
formalized senior management position— the chief risk officer,
reduced losses, lower earnings volatility, increased earnings, and
or CRO .
improved shareholder value.
Aside from this, direct pressure also comes from influential
These improvements result from taking a portfolio view of all
stakeholders such as shareholders, employees, ratings agencies,
risks; managing the linkages between risk, capital, and profit­
and analysts. Not only do such stakeholders expect more earn­
ability; and rationalizing the company's risk transfer strategies.
ings predictability, management have fewer excuses today for
The result is not just outright risk reduction: companies that
not providing it. Over the past few years, volatility-based mod­
understand the true risk/return economics of a business can take
els such as value-at-risk (VaR) and risk-adjusted return on capital
more of the profitable risks that make sense for the company
(RAROC) have been applied to measure all types of market risk
and less of the ones that don't.
within an organization; their use is now spreading to credit risk,
Despite all these benefits, many companies would balk at and even to operational risk. The increasing availability and
the prospect of a full-blown ERM initiative were it not for the liquidity of alternative risk transfer products— such as credit

Benefit Company Actual Results

Market value improvement Top money center bank Outperformed S&P 500 banks by 58% in stock price
performance

Early warning of risks Large commercial bank Assessment of top risks identified over 80% of future losses;
global risk limits cut by one-third prior to Russian crisis

Loss reduction Top asset-management 30% reduction in the loss ratio enterprise-wide; up to 80%
company reduction in losses at specific business units

Regulatory capital relief Large international commercial $1 Billion reduction of regulatory capital requirements, or
and investment bank about 8-10%

Risk transfer rationalization Large property and casualty $40 million in cost savings, or 13% of annual reinsurance
insurance company premium

Insurance premium reduction Large manufacturing company 20-25% reduction in annual insurance premium

F ig u re 3.1 ER M b en efits.

32 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
derivatives and catastrophe bonds— also means that companies • Implementing a set of risk indicators and reports, including
are no longer stuck with many of the unpalatable risks they losses and incidents, key risk exposures, and early warning
previously had no choice but to hold. Overall, the availability of indicators;
such tools makes it more difficult and less acceptable for com­ • Allocating economic capital to business activities based on
panies to carry on with more primitive and inefficient alterna­ risk, and optimizing the company's risk portfolio through
tives. Managing risk is management's job. business activities and risk transfer strategies;
• Communicating the company's risk profile to key stakehold­

3.3 THE CHIEF RISK OFFICER ers such as the board of directors, regulators, stock analysts,
rating agencies, and business partners; and

The role of a chief risk officer has received a lot of attention • Developing the analytical, systems, and data management
within the risk management community, as well as from the capabilities to support the risk management program
finance and general management audiences. Articles on chief Still, given that enterprise risk management is still a relatively
risk officers and ERM appear frequently in trade publications new field, many of the kinks have yet to be smoothed out of the
such as Risk M agazine and Risk and Insurance, but have also Chief Risk Officer role. For example, there are still substantial
been covered in general publications such as C FO magazine, amounts of ambiguity with regard to where the CRO stands in
the Wall S tre e t Journal, and even USA Today. the hierarchy between the board of directors and other C-level
• • •
positions, such as C EO s, C FO s, and CO O s.

Today, the role of the CRO has been widely adopted in risk­ In many instances, the CRO reports to the C FO or C E O — but
intensive businesses such as financial institutions, energy firms, this can make firms vulnerable to internal friction when serious
and non-financial corporations with significant investment activities clashes of interest occur between corporate leaders. For exam­
and/or foreign operations. Today, I would estimate that as many ple, when Paul Moore, former head of regulatory risk at HBOS,
as up to 80% of the biggest U.S. financial institutions have CROs. claimed that he had been "fired . . . for warning about reckless
lending," the resulting investigations led to the resignation of
The recent financial and economic meltdowns have increased
HBOS' chief executive, Sir Jam es Crosby, as the deputy chair­
the demand for comprehensive ERM frameworks. As an indica­
man of the Financial Services Authority.*•3
tion of this increased demand, executive management training
programs in ERM are increasingly offered by leading business One organizational solution is to establish a dotted-line report­
schools. For example, in November 2010, Harvard Business ing relationship between the chief risk officer and the board or
School implemented a five-day program designed to train board risk committee. Under extreme circumstances (e.g., C EO /
C EO s, C O O s, and CRO s in managing risk as corporate leaders: C FO fraud, major reputational or regulatory issues, excessive
there have been two other sessions to date, one in February risk taking beyond risk appetite tolerances), that dotted line may
2012, and one just recently, in February 2013.2 convert to a solid line so that the chief risk officer can go directly
to the board without fear for his or her job security or compen­
Typical reports to the CRO are the heads of credit risk, mar­
sation. Ultimately, to be effective, risk management must have
ket risk, operational risk, insurance, and portfolio manage­
an independent voice. A direct communication channel to the
ment. Other functions that the CRO is commonly responsible
board is one way to ensure that this voice is heard.4
for include risk policy, capital management, risk analytics and
reporting, and risk management within individual business units. For these dotted-line reporting structures between the CRO
In general, the office of the CRO is directly responsible for: and the board (and between the business line risk officers and
the CRO), it is critical that an organization clearly establish and
• Providing the overall leadership, vision, and direction for
document the ground rules. Basic ground rules include risk
enterprise risk management;
escalation and communication protocols, and the role of the
• Establishing an integrated risk management framework for all board or CRO in hiring/firing, annual goal setting, and compen­
aspects of risks across the organization; sation decisions of risk and compliance professions who report
• Developing risk management policies, including the quantifi­ to them.
cation of the firm's risk appetite through specific risk limits;

3 Davy, Peter. "Cinderella Moment," Wall Street Journal, October 5, 2010.

2 Winokur, L.A. "The Rise of the Risk Leader: A Reappraisal," Risk Pro­ 4 Lam, James. "Structuring for Accountability," Risk Progressional, June
fessional, April 2012, 20. 2009, 44.

Chapter 3 What Is ERM? ■ 33

Another board risk oversight option is to alter existing audit strategic roles is the primary contributing factor to their suc­
committees to incorporate risk management. In a survey of the cess, and that with the coming years, this progress is only
S&P 500, "58% of respondents said that their audit committees likely to accelerate.7
were responsible for risk m anagem ent."5 However, this presents
• • •

problems of its own; oftentimes, audit committees are already

working at maximum capacity just handling audit matters, and Some argue that a company shouldn't have a CRO because that
are unable to properly oversee ERM as well. Henry Ristuccia, of job is already fulfilled by the C EO or the C FO . Supporting this
Deloitte, affirms that unless the "audit committee [can improve] argument is the fact that the C E O is always going to be ulti­
its grasp of risk m anagem ent. . . a separate risk committee mately responsible for the risk (and return) performance of the
needs to be form ed."6 company, and that many risk departments are part of the CFO 's
organization. So why create another C-level position of CRO and
The lack of an ERM standard is also a significant barrier to the
detract from the CEO 's or CFO 's responsibilities?
positive development of the CRO role. Mona Leung, C FO
of Alliant Credit Union, says that "we have too many varying The answer is the same reason that companies create roles for
definitions" of enterprise risk management, with the result other C-level positions, such as chief information officers or
that ERM means something different to every company, and chief marketing officers. These roles are defined because they
is implemented in different ways. O f course, firms from differ­ represent a core competency that is critical to the success for
ent industries should (and must) tailor their approaches to risk the company—the C EO needs the experience and technical
management in order to meet the requirements of their specific skills that these seasoned professionals bring. Perhaps not every
business models and regulatory frameworks, but nonetheless, it company should have a full-time CRO , but the role should be an
is important to have a general ERM standard. explicit one and not simply one implied for the C EO or C FO .

Despite the remaining ambivalences in the structure of the For companies operating in the financial or energy markets, or
CRO role, I believe that it has elevated the risk management other industries where risk management represents a core com­
profession in some important ways. First and foremost, the petency, the CRO position should be considered a serious pos­
appointment of executive managers whose primary focus is sibility. A CRO would also benefit companies in which the full
risk management has improved the visibility and organizational breadth of risk management experience does not exist within
effectiveness of that function at many companies. The successes the senior management team, or if the build-up of required risk
of these appointments have only increased the recognition and management infrastructure requires the full-time attention of an
acceptance for the CRO position. experienced risk professional.

Second, the CRO position provides an attractive career path for What should a company look for in a CRO ? An ideal CRO would
risk professionals who want to take a broader view of risk and have superb skills in five areas. The first would be the leadership
business management. In the past, risk professionals could only skills to hire and retain talented risk professionals and establish
aspire to become the head of a narrowly focused risk function the overall vision for ERM. The second would be the evangeli­
such as credit or audit. Nearly 70 percent of the 175 participants cal skills to convert skeptics into believers, particularly when it
in one online seminar that I gave on September 13, 2000, said comes to overcoming natural resistance from the business units.
they aspired to become CRO s. Third would be the stewardship to safeguard the company's
financial and reputational assets. Fourth would be to have the
Today, CRO s have begun to move even further up the corpo­
technical skills in strategic, business, credit, market, and opera­
rate ladder by becoming serious contenders for the positions
tional risks. And, last but not least, fifth would be to have con­
of C E O and C FO . For exam ple, Matthew Feldm an, form erly
sulting skills in educating the board and senior management,
CRO of the Federal Home Loan Bank of Chicago, was
as well as helping business units implement risk management
appointed its C E O and President in May of 2008. Likewise,
at the enterprise level. While it is unlikely that any single indi­
Deutsche Bank CRO Hugo Banziger was a candidate for UBS
vidual would possess all of these skills, it is important that these
C E O . Kevin Buehler, of M cKinsey & Co.'s, affirms that the
competencies exist either in the CRO or elsewhere within his or
gradual movement of CRO s from control functions to more
her organization.

5 Banham, Russ. "Disaster Averted," CFO Magazine, April 1, 2011,2.

7 Winokur, L. A. "The Rise of the Risk Leader: A Reappraisal," Risk
6 Ibid. Professional, April 2012, 17.

34 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
3.4 COMPONENTS OF ERM Corporate Governance
Corporate governance ensures that the board of directors and
A successful ERM program can be broken down into seven key
management have established the appropriate organizational
components (see Figure 3.2). Each of these components must
processes and corporate controls to measure and manage risk
be developed and linked to work as an integrated whole. The
across the company. The mandate for effective corporate gov­
seven components include:
ernance has been brought to the forefront by regulatory and
1. Corporate governance to ensure that the board of directors industry initiatives around the world. These initiates include the
and management have established the appropriate organi­ Treadway Report from the United States, the Turnbull Report
zational processes and corporate controls to measure and from the UK, and the Dey Report from Canada. All of these
manage risk across the company. made recommendations for establishing corporate controls
2. Line management to integrate risk management into the and emphasized the responsibilities of the board of directors
revenue-generating activities of the company (including and senior management. Additionally, the Sarbanes-Oxley Act
business development, product and relationship manage­ provides both specific requirements and severe penalties for
ment, pricing, and so on). non-compliance.

3. Portfolio management to aggregate risk exposures, incor­ From an ERM perspective, the responsibilities of the board of
porate diversification effects, and monitor risk concentra­ directors and senior management include:
tions against established risk limits.
• Defining the organization's risk appetite in terms of risk poli­
4. Risk transfer to mitigate risk exposures that are deemed too cies, loss tolerance, risk-to-capital leverage, and target debt
high, or are more cost-effective to transfer out to a third rating.
party than to hold in the company's risk portfolio.
• Ensuring that the organization has the risk management skills
5. Risk analytics to provide the risk measurement, analysis, and and risk absorption capability to support its business strategy.
reporting tools to quantify the company's risk exposures as • Establishing the organizational structure of the ERM fram e­
well as track external drivers. work and defining the roles and responsibilities for risk man­
6 . Data and technology resources to support the analytics and agement, including the role of chief risk officer.
reporting processes. • Implementing an integrated risk measurement and manage­
ment framework for strategic, business, operational, financial,
7. Stakeholder management to communicate and report the
and compliance risks.
company's risk information to its key stakeholders.
• Establishing risk assessment and audit processes, as well
Let's consider these in turn.
as benchmarking company practices against industry best
practices.
• Shaping the organization's risk culture by setting the tone
from the top not only through words but also through
1. Corporate Governance
Establish top-down risk management actions, and reinforcing that commitment through incentives.
• Providing appropriate opportunities for organizational learn­
3. Portfolio 4. Risk Transfer ing, including lessons learned from previous problems, as
2. Line Management
Management Transfer out well as ongoing training and development.
Business strategy
Think and act like a concentrated or
alignment
"fund manager" inefficient risks

6. Data and Technology

Line Management
5. Risk Analytics
Resources
Develop advanced Perhaps the most important phase in the assessment and pricing
Integrated data and
analytical tools of risk is at its inception. Line management must align business
system capabilities
strategy with corporate risk policy when pursuing new business
7. Stakeholders Management and growth opportunities. The risks of business transactions
Improve risk transparency for key stakeholders
should be fully assessed and incorporated into pricing and prof­
F ia u re 3 .2 S even co m p o n en ts of ER M . itability targets in the execution of business strategy.

Chapter 3 What Is ERM? ■ 35

Specifically, expected losses and the cost of risk capital should desirable but concentrated risks. To reduce undesirable risks,
be included in the pricing of a product or the required return of management should evaluate derivatives, insurance, and hybrid
an investment project. In business development, risk acceptance products on a consistent basis and select the most cost-effective
criteria should be established to ensure that risk management alternative. For example, corporations such as Honeywell and
issues are considered in new product and market opportuni­ Mead have used alternative risk transfer (ART) products that
ties. Transaction and business review processes should be combine traditional insurance protection with financial risk pro­
developed to ensure the appropriate due diligence. Efficient tection. By bundling various risks, risk managers have achieved
and transparent review processes will allow line managers to estimated savings of 20 to 30% in the cost of risk transfer.
develop a better understanding of those risks that they can
A company can dramatically reduce its hedging and insurance
accept independently and those that require corporate approval
costs— even without third-party protection— by incorporat­
or management.
ing the natural hedges that exist in any risk portfolio. In the
course of doing business, companies naturally develop risk

Portfolio Management concentrations in their areas of specialization. The good news

is that they should be very capable of analyzing, structuring,
The overall risk portfolio of an organization should not just and pricing those risks. The bad news is that any risk concentra­
happen—that is, it should not just be the cumulative effect of tion can be dangerous. By transferring undesirable risks to the
business transactions conducted entirely independently. Rather, secondary market—through credit derivatives or securitization,
management should act like a fund manager and set portfolio for example— an organization can increase its risk origination
targets and risk limits to ensure appropriate diversification and capacity and revenue without accumulating highly concentrated
optimal portfolio returns. risk positions.
The concept of active portfolio management can be applied Finally, management can purchase desirable risks that they
to all the risks within an organization. Diversification effects cannot directly originate on a timely basis, or swap undesir­
from natural hedges can only be fully captured if an orga­ able risk exposures for desirable risk exposures through a
nization's risks are viewed as a whole, in a portfolio. More derivative contract.
importantly, the portfolio management function provides
a direct link between risk management and shareholder
value maximization. Risk Analytics
For example, a key barrier for many insurance companies in The development of advanced risk analytics has supported
implementing ERM is that each of the financial risks within the efforts to quantify and manage credit, market, and operational
overall business portfolio is managed independently. The actu­ risks on a more consistent basis. The same techniques that allow
arial function is responsible for estimating liability risks arising for the quantification of risk exposures and risk-adjusted profit­
for the company's insurance policies; the investment group ability can be used to evaluate risk transfer products such as
invests the company's cash flows in fixed-income and equity derivatives, insurance, and hybrid products. For example, man­
investments. The interest rate risk function hedges mismatches agement can increase shareholder value through risk transfer
between assets and liabilities. However, an insurance company provided that the cost of risk transfer is lower than the cost of
which has implemented ERM would manage all of its liabil­ risk retention for a given risk exposure (e.g., 12% all-in cost of
ity, investment, interest rate, and other risks as an integrated risk transfer versus 15% cost of risk capital).
whole in order to optimize overall risk/return. The integration
Alternatively, if management wants to reduce its risk exposure,
of financial risks is one step in the ERM process, while strategic, risk analytics can be used to determine the most cost-effective
business, and operational risks must also be considered in the
way to accomplish that objective. In addition to risk mitiga­
overall ERM framework. tion, advanced risk analytics can also be used to significantly
improve net present value (NPV)- or economic value added
(EVA)-based decision tools. The use of scenario analyses and
Risk Transfer
dynamic simulations, for exam ple, can support strategic plan­
Portfolio management objectives are supported by risk transfer ning by analyzing the probabilities and outcomes of different
strategies that lower the cost of transferring out undesirable business strategies as well as the potential impact on share­
risks, and also increase the organization's capacity to originate holder value.

36 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Data and Technology Resources Stakeholder Management
One of the greatest challenges for enterprise risk management Risk management is not just an internal management process. It
is the aggregation of underlying business and market data. Busi­ should also be used to improve risk transparency in a firm's rela­
ness data includes transactional and risk positions captured in tionship with key stakeholders. The board of directors, for exam­
different front- and back-office systems; market data includes ple, needs periodic reports and updates on the major risks faced
prices, volatilities, and correlations. In addition to data aggrega­ by the organization in order to review and approve risk man­
tion, standards and processes must be established to improve agement policies for controlling those risks. Regulators need to
the quality of data that is fed into the risk systems. be assured that sound business practices are in place, and that
business operations are in compliance with regulatory require­
As far as risk technology goes, there is no single vendor soft­
ments. Equity analysts and rating agencies need risk information
ware package that provides a total solution for enterprise risk
to develop their investment and credit opinions.
management. Organizations still have to either build, buy, and
customize or outsource the required functionality. Despite the An important objective for management in communicating
data and system challenges, companies should not wait for and reporting to these key stakeholders is an assurance that
a perfect system solution to become available before estab­ appropriate risk management strategies are in effect. O ther­
lishing an enterprise risk management program. Rather, they wise, the company (and its stock price) will not get full credit,
should make the best use of what is available and at the same since interested parties will see the risks but may not see the
time apply rapid prototyping techniques to drive the systems- controls. The increasing emphasis of analyst presentations
development process. Additionally, companies should consider and annual reports on a company's risk management capabili­
tapping into the power of the Internet/lntranet in the design of ties is evidence of the importance now placed on stakeholder
an enterprise risk technology platform. communication . . . .

Chapter 3 What Is ERM? ■ 37

 A
Implementing
Robust Risk Appetite
Frameworks to
Strengthen Financial
Institutions
Learning Objectives
After completing this reading you should be able to

Describe best practices for the implementation and Assess the role of stress testing within an RAF and
communication of a risk appetite framework (RAF) at describe challenges in aggregating firm-wide risk
a firm. exposures.

Explain key challenges to the implementation of an RAF Explain lessons learned in the implementation of an
and describe how a firm can overcome each challenge. RAF through the presented case studies.

E x c e rp t is rep rin ted with perm ission of the Institute o f International Finance.

39
INTRODUCTION taking can help achieve business objectives while respect­
ing constraints to which the organization is subject." A key
1. One of the key lessons of the financial crisis was that some finding of the CM BP was that putting in place a robust risk
firms took more risk in aggregate than they were able to appetite framework constitutes an essential component
bear given their capital, liquidity, and risk management of adequate risk management. The CM BP elaborated on
capabilities, and some took risks that their manage­ a number of aspects regarding risk appetite, including the
ment and Boards did not properly understand or control. high-level governance aspects of defining and implement­
Indeed, in its October 2009 report, Risk M anagem ent L e s­ ing a risk appetite framework.
son s from the G lobal Banking Crisis o f 2008, the Senior 5. In 2009 the IIF, recognizing the need to actively promote
Supervisors Group (SSG) highlighted major governance the implementation of the CM BP recommendations,
challenges at the 20 largest banks in the most-affected established a Steering Committee on Implementation
jurisdictions, in particular "the unwillingness or inability (SCI). This committee was charged with steering the EF's
of Boards of Directors and senior managers to articulate, efforts on further analysis of key risk management implica­
measure and adhere to a level of risk acceptable to the tions of the crisis as well as tracking EF members' efforts
firm ." The SSG concluded that "a key weakness in gov­ in revising their practices and implementing Industry
ernance stemmed from . . . a disparity between the risks practices recommendations. In December 2009 the SCI
that their firms took and those that their Boards of Direc­ issued its report, Reform in the Financial S e rvices Industry:
tors perceived the firms to be taking." Put simply, Boards Stren gth en in g Practices fo r a M ore Stable System , which
did not understand well enough, or properly control in assessed the progress made by the Industry in implement­
advance, the risks that their firms were taking. These con­ ing and embedding revised risk management and gover­
clusions are not disputed by the Industry. nance practices.
2. Three years after the crisis, largely as a consequence of 6. Among other issues, the 2009 SCI report focused once
these conclusions, there is now consensus between super­ again on risk appetite, further developing and discussing
visors and the Industry that a clearly articulated statement the concept and a number of related issues. The report
of risk appetite and the use of a well-designed risk appe­ also provided an augmented definition of risk appetite
tite framework to underpin decision-making are essential as being "the amount and type of risk that a company is
to the successful management of risk. Taken together, able and willing to accept in pursuit of its business objec­
such a statement and framework provide clear direction tives." The statement of risk appetite balances the needs
for the enterprise and ensure alignment of expectations of all stakeholders by acting both as a governor of risk
among the Board, senior management, the risk manage­ and a driver of current and future business activity. It is
ment function, supervisory bodies, and shareholders. In expressed in both quantifiable and qualitative terms and
combination with a strong risk culture, they provide the covers all risks." In particular, the 2009 report set out an
cornerstone for building the effective enterprise-wide risk analytical framework for risk appetite and outlined a num­
management framework that is essential to the long-term ber of key issues in regard to the practical implementation
stability of a firm. of the concept by financial firms.
3. In 2008 the Institute of International Finance formed a
7. Risk appetite has also received a great deal of atten­
high-level Committee on Market Best Practices (CMBP) to tion from the regulatory community. In particular, the
draw key lessons for the financial services industry from
SSG— which has been the public sector group most
the global financial crisis that was unfolding at that time.
deeply involved in the analysis of the risk management
The CM BP issued a report containing a number of key
implications of the crisis— has focused extensively on risk
principles and recommendations for the Industry, focusing
appetite issues and related supervisory implications. Spe­
on areas such as governance, risk management, and trans­
cifically, the SSG's 2009 report, Risk M anagem ent Lesson s
parency. The core purpose of these recommendations was
from the G lobal Banking Crisis o f 2008, identified risk
to promote much more robust risk management and gov­
appetite as a crucial element of robust risk management.
ernance frameworks in financial institutions.
The SSG identified a number of deficiencies in the way the
4. Early in the discussion and analytical process that led to Industry was approaching risk appetite issues, observing,
the final CM BP report, IIF members identified risk appetite for example, that much more evidence was needed of
as being of fundamental importance. The CM BP report Board involvement in setting and monitoring adherence
defined risk appetite as "a firm's view on how strategic risk to firms' risk appetite, and that the Industry needed to

40 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 continue working to make risk appetite statements much • To develop specific practical recommendations for
more robust to encompass a suitably wide range of mea­ firms to address the challenges of implementing a
sures and actionable elements. robust and meaningful risk appetite framework.

8. In December 2010, the SSG issued another report, O b se r­ 12. The W G RA has carried out an Industry survey, group dis­
vations on D evelo p m en ts in Risk A p p e tite Fram ew orks cussions, interviews, and case studies involving a diverse
and IT Infrastructure, which elaborated on this subject. In sample of participants globally. As detailed in Annex II,
particular, the SSG highlighted the importance of Board respondents to the survey represented a cross-section of
and senior management involvement in the articulation geography and institutional size, all at various stages of
and implementation of the risk appetite framework and the implementation journey. The survey was sent to 79
emphasized the need to embed revised practices within firms; 73 responses were received from 40 firms. Although
firms so that such practices can be sufficiently resilient in the survey responses received were rich and comprehen­
an increasingly competitive environment. sive, in order to get behind them to understand at a prac­
tical level how challenges were overcome to enable the
9. While there is clearly a substantial amount of ongoing
sharing of good practices, multiple thematic conference
work by both the Industry and the regulatory community
calls, as well as bilateral in-depth discussions, were held
in the area of risk appetite frameworks, it is widely recog­
with Industry participants in several continents, covering
nized that additional guidance would be helpful as firms
the key topics and challenges considered in Section 2. The
continue refining their practices and methodologies. The
survey responses, conference calls, extensive bilateral dis­
reports by the 11F and the SSG, together with the substan­
cussions, and the four case studies supplied have provided
tial experience gained by firms in the last several years,
the background for our in-depth analysis of the current
constitute a fertile ground in which to continue developing
challenges facing the Industry and a practical set of rec­
guidance as to how management and Boards should con­
ommendations to move forward.
front and resolve difficult, basic issues linked to the design
and implementation of a risk appetite framework. 13. Annex I presents four highly detailed case studies which
were generously provided, upon request, by Common­
10. As fi rms, in response to the crisis, continue to make
wealth Bank of Australia, National Australia Bank, Royal
progress in improving their risk appetite processes, pri­
Bank of Canada, and Scotiabank. These case studies are
marily in pursuit of stronger risk management but also
intended to complement the evidence gathered through
to meet evolving supervisory expectations, additional
the survey and the W G RA discussions and to provide valu­
guidance should draw on lessons from firms' experience
able insights and "real-life" examples of the approaches
and from the successful practices that are being devel­
that large firms have taken to overcoming the challenges
oped globally by many in the Industry. This can, in turn,
involved in establishing a risk appetite framework (RAF).
form the basis for a constructive dialogue with the global
The case studies represent an integral part of this report
supervisory community.
and are recommended reading as they contain a wealth of
11. In order to organize the in-depth analysis and discus­ detailed information regarding the diversity of approaches
sion of risk appetite issues, assess the Industry's state of taken, the role of leadership and collaboration, the itera­
practice on the subject, and learn by leveraging the expe­ tive nature of RAF development and the influence of cul­
rience and expertise of a broad range of market partici­ ture in the risk appetite process.
pants, the IIF SCI established the Working Group on Risk
Appetite (W GRA). The W G RA and the present report have
the following key objectives:
SECTION 1 - PRINCIPAL FINDINGS
• To assess and evaluate current Industry practices in the
area of risk appetite.
FROM THE INVESTIGATION
• To identify the key stages and the technical and cultural 14. Th is section outlines a number of key findings of our
challenges in the journey toward setting— and moni­ work on risk appetite, the extent to which the Industry
toring adherence to— appropriate boundaries for risk, is embracing it, and the principal impediments to imple­
within a sound risk appetite framework. mentation. It outlines a number of practical steps that
• To bring Industry expertise and sound practices to firms have taken to overcome the principal challenges and
bear on examining how these challenges have been which form the basis of emerging Industry sound practices
addressed, including the analysis of real-life case studies. in this evolving area. In some instances the findings of

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 41

 this report are not new. The survey highlights, reinforces, Supervisors need to be alert to this and avoid insist­
or otherwise clarifies issues that the Industry continues ing on formulaic solutions that may not be aligned with
to struggle with and that at times have been commented business needs.
on elsewhere. The report does, however, aim to offer
19. Despite the different stages of development of firms'
valuable insights on how many of these challenges are RAFs and the multiplicity of approaches being taken, our
being overcome. investigation has shown that there is some convergence
15. It is clear from the responses to the survey and from the of thought and experience around the implementation,
discussions that followed that developing a risk appetite design, and impact of an effective risk appetite fram e­
framework is a journey on which the Industry finds itself work. These areas of convergence include:
in the early stages. Although the cultural, organizational, a. Successful implementation is highly dependent on
and technical challenges are formidable and the major­ effective interactions among all key stakeholders,
ity of firms are not yet where they either need or want to including Board members, senior management, the
be, our investigation has shown that a number of leading risk management function, and the operating busi­
firms in the Industry are making good progress. Evidence nesses. In a large majority of firms, defining or setting
suggests that there has been more progress in designing,
the risk appetite is initiated by senior management
implementing, and embedding risk appetite frameworks— and, after an effective challenge process, is approved
at least in participating firms—than has been generally by the Board. In all cases the "tone from the top" was
realized until now. essential to driving the process. It is clear that where
16. The aggregate risk profiles of large financial institutions there is visible and continuous support of the risk
are complex, multidimensional, and, even where risk IT is appetite concept from the Board and senior m anage­
well developed, relatively opaque.1 Consequently, devel­ ment, the developm ent and implementation of the
oping a risk appetite framework requires time and signifi­ risk appetite fram ework was much more effective in
cant intellectual and financial resources. Not surprisingly, all respects.
the degree of progress varies across participating banks, b. The in-depth discussion around the survey results
and a substantial gap is likely to remain for some time indicates quite clearly that putting in place an effec­
between leading-edge practices and what is "typical." tive risk appetite fram ework is inextricably linked
One very striking feature of the results of this investiga­ to the risk culture of a firm. To be fully effective, the
tion, however, is the widespread recognition of the intrin­ risk appetite fram ework, together with an apprecia­
sic importance of risk appetite to good risk management tion of its benefits, needs to be disseminated through­
and the motivation to get this right. out the institution. Done properly, implementation
17. Where progress has been made to date, it has been of a risk appetite fram ework can act as a powerful
driven principally by a recognition by the firms' leadership reinforcement to a strong risk culture in providing
of the need to strengthen risk management and gover­ a coherent rationale and consistent fram ework for
nance arrangements. It has not typically been solely, or understanding risk at all levels. It can never substitute
even primarily, a response to specific regulatory or super­ for proper system s, controls, and limits, but instead
visory requirements. supplem ents and motivates these and may even
increase compliance. Firms with strong risk cultures
18. Not only are firms at different stages of development
that provide staff with guidance for their own behavior
of their RAFs, they are also adopting a wide range of
and what to look for and challenge in others are much
approaches, as can be clearly seen from the important
more effective in the implementation process. This is
and detailed case studies supplied in Annex I. This reflects
especially important when developing appetite state­
differing business models, structures, and degrees of
ments around those risks that are less quantifiable
complexity. Thus, an important finding of our work is
(e.g ., operational risk, risks of legal or regulatory non-
that one size does not fit all. While some convergence of
com pliance, and reputational risk). It is also clear that
practices can be expected to emerge over time, diversity
risks cannot be com pletely avoided, and aspirational
of approach is inevitable and should not be discouraged.1
statem ents relating to "zero tolerance" of certain
types of risk are less useful than detailed guidance to
1 The identification of sound industry practices for risk IT is the subject
of a parallel IIF report: Risk IT and Operations: Strengthening Capabili­ the businesses about how such risks should be viewed
ties, June 2011. and managed.

42 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
c. While implementing an RAF is challenging, those f. The survey shows that a large majority of firms (70%)
firms that have made progress are clear that they see are taking a comprehensive view of all risks across
tangible benefits resulting from their risk appetite the firm, not merely focusing on those risks that can be
process. While these benefits are not always apparent easily measured, and are using a combination of quan­
at the start, there is a high degree of consensus among titative and qualitative metrics in expressing risk appe­
such firms that the RAF is allowing the Board and the tite. This reinforces the point that risk appetite does
senior management to have a more informed discus­ not mean the creation of a complex, highly granular
sion of the risks in the business plan and strategy. Firms set of limits. That said, at this stage in the journey the
reporting the most progress have also established most common transmission mechanism for communi­
strong linkages between risk issues and strategy, plan­ cating Board-level risk appetite statements throughout
ning, and finance— the last two of these being areas the enterprise is the translation into limits. This in part
in which risk was often not formally considered in the reflects the quantifiable nature of some risks and pro­
past. These linkages have been put in place at both vides for clear, recognizable boundaries.
the enterprise-wide and business unit (BU) levels. Such g. Stress testing and stress metrics play a role in the
processes may, at least initially, make the resource risk appetite framework of almost all respondents
planning cycle longer and more complicated, but this is (only one firm stated that they are not used). The use
a price well worth paying in return for fostering a more of stress tests varies, with some banks putting them at
robust risk culture and a stronger awareness through­ the center of the risk appetite setting process, whereas
out the organization. Firms at a more advanced stage others use stress tests primarily to "sense-check"
also highlight the benefits deriving from a stronger their appetite.
integration of risk considerations into the strategic and
h. A large majority of those responding indicated that
business plans and more effective risk/reward decision­
risk appetite is monitored on an ongoing basis at the
making across the organization. These benefits can be
group level and that a contingency plan or escalation
clearly seen in the case studies attached in Annex I.
procedure is triggered when a risk appetite metric
d. There is a high degree of commonality around the most is exceeded.
relevant inputs driving the shaping of a firm's risk 20. As noted above, the case studies in Annex I are an essen­
appetite. Most often used is capital capacity, followed tial part of this report and clearly illustrate many of the
by budget targets, liquidity, and other market con­ points listed above.
straints and stress test results. Although not captured in
the survey data, several firms emphasized that a firm's
overall strategy and financial objectives should be con­ SECTION 2 - KEY OUTSTANDING
sidered as a key input. CHALLENGES IN IMPLEMENTING
e. Limits and controls have a central role in any well-run RISK APPETITE FRAMEWORKS
organization, but an excessively narrow emphasis on
granular limits (or too many of them) can provide false 21. Despite the visible progress being made by many in the
Industry in the implementation of effective risk appetite
comfort to management and supervisors; lead to a
mechanical, "tick-box" (or compliance-type) approach; frameworks, more needs to be done. The survey and

and detract from or undermine this crucial dialogue. A discussion reveal there is a degree of commonality in the

strong RAF is much more powerful than limits alone: hurdles firms are facing and the need for proven practi­

staff at all levels with any significant responsibility cal solutions to these issues. Section 3 provides a number

should know what they need to do and why, rather of examples of emerging Industry sound practices in

than merely follow instructions. The overwhelmingly addressing these. This section outlines the largest chal­

important conclusion from firms' experiences in this lenges that are proving most difficult to overcome. The

area is that developing an RAF is not about putting in chart below shows the most relevant survey results in

place "tablets of stone" and creating and implement­ this context.

ing a structure of many hundreds of highly granular 22. The link with the wider risk culture is of central impor­
limits. It is important that stakeholders, including super­ tance but is also problematic in some firms. Broad
visors, should recognize this when assessing progress in discussion among firms reinforces the point that without
this area. a strong risk culture success on the risk appetite journey

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 43

 is extremely difficult, if not impossible, while it is easiest noted, firms that have been most successful in creating
to implement an effective RAF where there is already a an RAF to date have recognized that it needs to pervade
strong culture around risk. However, a number of respon­ the organization in the sense that risk concepts are fully
dents cited culture and its link to risk appetite as being an understood by staff at a range of levels and influence
important and difficult issue. A strong culture implies that behavior as a result of being internalized. The benefits of a
staff understand what is required of them with respect to risk appetite framework are often much more apparent to
risk and why, and where such a strong risk culture exists it Board members and senior management than they are to
may be possible for firms to place less reliance on narrow mid-level staff. This raises questions of how best to train
compliance with limits and processes. Nevertheless, even and educate staff to enable them to perceive the benefits
the strongest culture needs to be supported with good of the new approach and also touches upon the desired
systems, controls, and limits. It is also necessary to estab­ responsibilities of management in such training and the
lish a strong link between risk appetite and compensation. way in which the new approaches can or should be sup­
At the simplest level this can be an assessment of whether plemented with formal controls and limits.
business results and key performance indicators (KPIs) 24. The best way of expressing risk appetite in a way that
have been achieved by operating within limits and in covers all relevant risks is also proving a challenge for
accordance with the behaviors and culture described and firms. This is particularly true in respect to risks that are
embedded within the risk appetite. Where this is not the less quantifiable and require a more qualitative approach.
case remuneration incentive awards should be moderated Once the process moves beyond traditional credit
or adjusted accordingly.
and market risks— where historical data is abundantly
23. Effectively cascading the risk appetite framework available—to focus on reputational, strategic, and opera­
throughout the firm and embedding and integrating it tional risks, significant challenges remain. However, it is
into the operational decision-making process is clearly widely recognized that an RAF cannot be confined to risks
the largest challenge for almost all firms. While most firms that can be easily measured. To be meaningful, risk appe­
have risk policies and risk measures in the form of limits tite needs to take a comprehensive view across a firm,
that can easily be cascaded through the organization, and risk appetite statements need to capture and include
other guidance on risk tends to be more general and at a those risks that cannot be easily quantified. The identifi­
higher level. The linkage between high-level risk appetite cation and effective mitigation of such risks is a difficult
principles and the risk policies and metrics guiding day- challenge that is not, of course, confined to risk appetite.
to-day decision-making needs further development. As While some firms are comfortable tracking these risks with

0 5

Effectively cascading the risk appetite statement through the operational levels
1 10 1f 6
of the organization and embedding it into operational decision making processes

How to best express risk appetite for different risk types,

some of which can be quantified in generally accepted ways,
and some of which cannot be easily quantified

Using the risk appetite framework as a dynamic tool for managing risk rather than
another way of setting limits or strengthening compliance

■ 1
Using the risk appetite framework as a driver of strategy and business decisions

■ 2
Achieving sufficient clarity around the concept of risk appetite and some of the ■3
terminology used (e.g. difference between risk appetite and risk limits)

How to effectively relate risk appetite to risk culture

How to make best use of stress-testing in the risk appetite process

How to most effectively aggregate risks from different business units and/or
different risk types, for risk appetite purposes

44 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 qualitative indicators, most are making significant efforts 27. Stress testing, and how it should be effectively incor­
to quantify such risks, through, for example, proxy mea­ porated into the risk appetite framework, remains an
sures and use a combination of qualitative and detailed area of uncertainty and evolving practice in the Industry.
quantitative elements in their risk appetite statements. While it is widely accepted as being a component of an
effective risk appetite framework, there is less consensus
25. Some respondents are finding it difficult to shift the
about exactly how stress testing should be incorporated
perception that risk appetite is primarily about set­
into a framework. The use of stress tests varies widely,
ting limits. While limits and risk policies are important
with some banks putting them at the center of the risk
components of an effective risk appetite framework, the
appetite— setting process, even as others use stress tests
more dynamic nature of risk appetite and its role in man­
primarily to sense-check their appetite. As a general obser­
aging risk, driving strategy, and optimizing return on a
vation, the firms that were most affected by the financial
much broader basis needs to be ingrained throughout
crisis appear to be more advanced in this area, but further
the organization. Ensuring that the RAF is positioned and
guidance is required for the majority. While an important
perceived internally as a dynamic tool for shaping the risk
focus of an RAF will be the level of risk with which the Board
profile of the institution, rather than as merely a dressed-
and senior management are comfortable during "business
up, "grander" process for setting limits and additional
as usual" conditions, it is equally important to understand
business constraints is also an important challenge. In real­
and consider the implications of extreme but plausible sce­
ity, it is necessary to strike the right balance between a
narios on the risk profile. The technical and methodological
framework on the one hand which is so rigid, constraining
challenges of stress and scenario testing are well known. In
and inflexible over time as to be unable to sensibly and
the RAF context, Boards, senior management, and business
prudently accommodate the evolution of the businesses
units need to ask how the results of stress tests should be
and group strategy in a timely fashion, having due regard
interpreted and what they mean for risk profiles and prefer­
to the risk implications, and one on the other hand which
ences. One particularly important question in this context is
is excessively flexible and too easily substantially changed
the extent to which Board members and risk professionals
from one period to the next (perhaps in response to any
are equipped a) to make sense of scenarios that have poten­
number of proposed growth initiatives), and consequently
tially very substantial impacts but low probability and b) to
imposes insufficient discipline on the businesses, lacks
push back against the pressures from the business that are
continuity, and is difficult for all employees to understand
curtailing apparently profitable lines of business.
and embrace. Striking this balance correctly requires care­
ful judgment by Boards and senior management. 28. A related issue is how to achieve an appropriate aggre­
gation at the group level of the levels of risks for the
26. Many firms have difficulty forging the necessary links different individual businesses and how to establish rela­
between risk appetite and the strategic and busi­ tionships between these. Individual business units need to
ness planning processes, though leading firms have have a consistent framework for setting their own toler­
done this successfully. It is relatively straightforward to ances for risk, and these need to be consistent with the
establish an RAF in the sense of the Board setting out overall enterprise-wide risk appetite, both individually and
a statement of risk preferences that the business then in aggregate. Although progress has been made in this
seeks to translate into a range of limits. There is a growing area by a number of firms, no single approach is dominant
recognition, however, that this is a very narrow concept today. There is currently no uniform process for translating
of risk appetite and that the establishment of actionable high-level risk appetite indicators into more specific mea­
guidance at the business unit level is crucial. The tradi­ sures, such as risk limits and tolerances, and further work
tional approach of making high-level statements and then is needed in the area of risk aggregation.
seeking to turn these into a plethora of granular and not
well-understood limits has been shown to have serious
limitations, as it tends to result in risk appetite being seen
SECTION 3 - EMERGING SOUND
within the businesses as a remote and sometimes irrele­ PRACTICES IN OVERCOMING THE
vant part of the risk management apparatus. As explained CHALLENGES
further below, risk appetite needs to be an integral part of
a business. Its effects need to be pervasive throughout the 29. The objective of this section is to draw on the survey and
organization, and there needs to be a clear link between the case studies, as well as discussions with firms to iden­
the RAF and business decisions. tify ways in which the principal challenges identified in the

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 45

 previous section might be overcome. The point needs to be
made at the outset that the Industry is still some distance This self-reinforcing link is exp la in ed by one firm in the fol­
from an identifiable body of sound practices in most of lowing way: " The adoption o f a Risk A p p e tite Fram ew ork
d id not en co u n ter m ajor resistance from the organization.
these areas. What follows, however, is intended to form the
This is likely due to (a) the Bank's existin g stron g risk man­
basis of emerging good practices. a g em en t culture and (b) the fact that the sp e cific m etrics
in the 'm easures' co m p o n e n t o f the Risk A p p e tite Fram e­
w ork w ere key existing m etrics that already had buy-in
3.1 Risk Appetite and Risk Culture across the organization. In many re sp e cts, the adoption
o f a form al Risk A p p e tite Fram ew ork co d ifie d existing risk
A crucial challenge is building a strong link and an effective
culture, principles, o b je ctive s, and m ea su res."
interaction between culture and the RAF. Risk culture can
be defined as the norm s and traditions o f behavior o f indi­ A n o th e r firm highlighted that "the risk a p p e tite fram ew ork
plays a crucial role in establishing the d e sire d risk culture
viduals and o f g ro u p s within an organization that d e te r­
across the organization. The discussions o f risk a p p etite
mine the way in which they identify, understand, discuss, across the G roup as well as the sp e cific con ten t o f the
and act on the risks the organization confronts and the B oard-ow ned Risk A p p e tite Sta tem en t have p ro m o te d a
risks it takes.2 It is widely recognized that a strong (or stron g risk culture, which is key to su ccess. Business Units
weak) risk culture manifestly and directly impacts the risk understan d what is o u tsid e a p p e tite and th erefo re do n ot
pursue th ese opportu n ities. The Risk A p p e tite Sta tem en t
appetite process.
contains a key sectio n outlining the principles o f the risk
Firms that had made the most progress in establishing a culture that the G roup se e k s to a c h ie v e ."
risk appetite framework report that there is a close and
indissoluble link between risk appetite and culture.
firms from financial centers where there is traditionally a less
Risk appetite is about the organization being clear, and
direct link between profit/return and remuneration report
making clear to others its desired level of risk. This in turn
that risk appetite may be an easier "sell" to staff and busi­
informs the planning and risk taking decisions of the busi­
ness heads.
ness units. Decision-makers, while continuing to be bound
by policies and limits, have a clearer understanding of why 34. G iven these close links, the practical steps for getting the
the policies and limits are as they are. And to the extent culture of risk appetite right are similar to those for get­
that they have the discretion and scope to exercise judg­ ting overall risk culture right. Overall, firms report that
ment, the risk appetite will provide them with a lodestone they know when they are making progress when refer­
that helps to inform them in doing so. ences to risk and risk appetite become a normal part of
day-to-day discourse about the business.
32. Some firms have found that internal "values" statements
can be of some use in reinforcing culture. If these are seen
Overall Lessons:
as self-serving and isolated examples of "management-
speak," such statements are likely to be counterpro­ • There needs to be a demonstrable commitment to
ductive; however, if they are part of a consistent set of explaining— through training and day-to-day experience—
messages and behaviors that provide staff members with the importance the institution attaches to risk appetite.
a guide to their own behavior, they can be the basis on This needs to have the consistent support of the highest
which staff can feel able to constructively challenge behav­ level of management.
iors or decisions of others, and they can be of real benefit. • Many staff for whom the benefits of an effective RAF are
33. The link with culture is therefore potentially self-reinforcing: not immediately apparent are unlikely to undergo an instant
firms with a strong risk culture find it relatively more straight­ conversion. Even after training and assimilation are in place,
forward than others to implement a risk appetite framework. it is necessary to operate rigorous controls and limits.
At the same time, an effective risk appetite framework can • It is important to develop measurable indicators of
consolidate and reinforce an effective risk culture with indi­ compliance with risk management norms that can form
viduals and business heads feeling reinforced about doing a robust basis for promotion and remuneration. This
the right thing. National traditions play a part in this. Some should include not only compliance with hard limits but
also with clearly stated behavioral expectations. Com pli­
ance with these more qualitative criteria can be more
2 Appendix III of the December 2009 11F report, "Reform in the Financial
difficult to assess objectively but is critical in establish­
Services Industry: Strengthening Practices for a More Stable System,"
provides a background discussion around the concept, importance, and ing the desired risk culture and is integral to making
key impacts of risk culture. risk appetite effective. Rigorous application of such

46 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 guidelines is consistent with cultivating a strong risk cul­ 36. Two points, however, emerged very clearly in this regard:
ture, provided it is consistent and relatively transparent. • An effective risk appetite framework should be perva­
• Clear communication of risk appetite parameters and sive throughout the organization in that all staff with
preferences is a prerequisite for developing the appro­ any significant decision-making authority should under­
priate culture. Individuals need to feel incentivized to stand the institution's stance toward risk and what it
comply with these and confident in doing so. There can means for them.
be no hidden agendas or revealed preferences on the • Yet the benefits of an effective risk appetite framework,
part of management. while very real, are often not apparent to more junior
• Consistency of messages and consistency of senior staff and, indeed, there may be some initial resistance
behaviors with these messages, rewards and sanctions or skepticism among these groups.
that are demonstrably consistent with the messages, and 37. For this reason, communication and training are essential
the absence of barriers to bad news travelling upward starting points. The C EO needs to be personally involved
are essential components of a strong culture. in promulgating the message about the risk appetite
• There is value in measures such as the creation of a framework and what it means. There needs to be com­
meaningful and non-public statement of values codify­ plete agreement within the Board and management on a
ing this. But culture is determined ultimately by what the meaningful and comprehensive definition of risk appetite,
leadership does rather than by what it says. and the concepts need to be communicated in a straight­
forward way without jargon. There also needs to be clarity

3.2 "Driving Down" the Risk Appetite into in communications about where risk appetite fits alongside
risk capacity or tolerance, that is, how much risk it is techni­
the Businesses
cally possible to take, and the current level of risk being
35. Effective internal communication that makes risk appetite taken. Finally, there needs to be clarity regarding the own­
directly relevant to employees in the business units is seen ership of risk. The risk function should own the overall risk
as a major challenge by all participating banks. A variety of framework and the interface with the Board on risk appe­
approaches have been taken, but no clear consensus has yet tite. However, responsibility for risk within the business
emerged about how to do this most effectively. This remains units and for achieving consistency with the enterprise­
very much work in progress, even for the leading banks. wide risk stance rests squarely with business unit heads.

A cornerstone in the architecture of an R A F and a key ste p in • A n o th e r firm has a rather d e ta ile d sta tem en t coverin g
its internal communication is the articulation of a risk appetite the follow ing qualitative and quantitative elem en ts: 1. To
statement. Som e firm -specific exam ples are p ro vid ed below : • g en e ra te sustainable eco n o m ic p ro fit com m ensurate
with the risks taken; capital liquidity & im pairm ents &
• One firm explains that its risk a p p etite sta tem en t is cur­
e x p e c te d loss; 2. To b e well capitalised on a regulatory
rently a mix o f quantitative lim its/m etrics and qualitative
basis and maintain a long-term d e b t rating o f X ; 3. To
g u id elin es:
maintain a stron g Tier 1 ratio co m p rise d o f a large core
i) Lim its and m etrics con sisten tly m on itored include: R O E : Tier 1 p ro p o rtio n ; 4. To maintain a w ell-diversified funding
Stress te sts: RW A limits; Capital m arket m easures (e.g. stru ctu re; 5. To k e e p o ff the balance sh e e t vehicles non­
VaR, trading limits): Liquidity ratios: Single-N am e C o n ­ m aterial in size relative to the size o f the balance sh e e t;
centration: Industry con cen tration ; and C ountry e n v e ­ 6. Risk m anagem ent to ensure im pairm ents and losses
lo p es. These lim its/m etrics co rre sp o n d to the Target are m anaged within the g ro u p 's to lera n ce; 7. To m anage
Rating s e t for the Bank. all risk ca te g o rie s within its a p p e tite ; 8. To harness b e n ­
ii) Q ualitative g uidelin es mainly stem from a co m p re­ efits from business diversification to g en e ra te nonvolatile
hensive s e t o f Risk forum s at the E xe cu tive M an age­ and sustainable earnings; 9. To co m p e te in b u sin esses
m ent level (e .g ., Portfolio d ecisio n s: Risk C om m ittee, with international cu sto m ers w here m arket con n ectivity
Stra teg ic Risk Forum s on C ountries, Industry/Product/ is critical, b u sin esses with local cu sto m ers w here w e have
S e cto rs, as well as on Capital M arket activities. Key local scale and p ro d u cts w here global scale is critical to
Individual d ecisio n s: Risk co m m ittees on one sp e cific e ffe ctiv e n e ss; 10. To use ro b u st and appropriate scen ario
transaction/counterparty; Excep tio n a l Transaction and stress testin g to a ssess the p o ten tia l im pact o f the chosen
N ew A ctivity Validation C om m ittees. Them atic trans­ scenario on the G roup's capital a d eq u a cy and stra teg ic
versal p o licies: C red it policies). plans.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 47

38. Limits are a necessary part of driving risk appetite into the overall risk appetite. Business unit heads are responsible
the businesses. Effective limits are an essential part of for formulating these local plans. They also have a respon­
any risk framework, whether or not the firm embraces a sibility to explain the importance of risk appetite concepts
full RAF. Financial institutions have operated with limits and boundaries within their business units. Illustrating the
(e.g., for lending or market transactions) for many years, links between specific business initiatives and day-to-day
without necessarily effectively controlling aggregate risks transactions and the broader risk appetite helps to make
within acceptable levels. The establishment of an effective these processes come alive for staff within the businesses.
framework goes far beyond the simple setting of limits, Some firms have also found value in a "thematic" approach
however. There is a strong consensus that it is very impor­ to risk, placing a specific focus on aspects of risk— such as
tant for staff who are subject to limits to understand both reputation risk— for a specific period.
the context and rationale for these and their implications
40. Similarly, staff on risk committees or those who are involved
for revenue, customer service/satisfaction, and aggregate
in the approval of transactions can link risk appetite con­
risks. The objective is to foster an effective, ongoing dia­
cepts to individual policies and transaction approvals,
logue about the boundaries of acceptable risks and the
thereby raising awareness and understanding of the bound­
implications of these boundaries, including for the optimal
aries and importance of risk appetite facilitating dialogue
allocation of scarce resources within the firm.
within the businesses about these boundaries and limits.
39. In this context, a strong culture of responsibility for, and
41. When this dialogue within and across business units and
open dialogue about, risks in the businesses is seen as fun­
with risk and senior management works well, it facilitates
damentally important in effectively embedding risk appetite
both intelligent challenges to the risk appetite boundaries
in the business lines. Business unit leaders have a strong
and their evolution over time. In this way, the risk appetite
leadership role to play in this. Firms that have made the
framework is made dynamic and is able to sensibly accom­
most progress in implementing risk appetite have put in
modate new business opportunities and changes to the risk/
place processes designed to ensure the broad congruence
reward relationships between different parts of the business.
of business and risk decisions and the overall enterprise­
wide risk appetite. In these firms, business heads are 42. The Iink between risk appetite as expressed by the Board
required to have visible ownership of risk in their areas and the behavior of mid-level staff empowered to make
and to incorporate risk explicitly in their business planning. local decision is also facilitated by the integration of the
Processes then need to be put into place to check the con­ RAF into the business planning, as further explained in
sistency of these— both individually and in aggregate— with section 3.5.

In som e banks the business unit leaders are req u ired to have the operational groups/enterprise risk appetite. This awareness
prim ary' accountability fo r preparin g and interpreting their is created through learning program s ta rg eted at mid-level
own risk a p p e tite sta tem en ts to ensure that they are both m anagem ent. M id-level m anagem ent in front-line opera­
p ro p e rly aligned with the g rou p risk a p p etite statem en ts tions is g u id e d in part by the sim plified statem ents created
and also w ell-d esig n ed and effective in com m unicating to by the enterprise. Both qualitative and quantitative aspects
the sta ff in their own bu sin esses. Fo r instance, in one firm are reflected through policies and pro cedu res that govern
the "line o f Business (LO B) m anagem ent is resp o n sib le for the activities o f m id-level staff. These policies and procedu res
execu tin g the stra teg ic and financial operatin g plans o f the provide m ore detail to the high-level statem ents o f the risk
business, optim izing the risk and rew ard o f the business appetite, including business practices for exam ple, reputa­
within limits esta b lish ed by execu tive m anagem ent, and tional risk, regulatory and legal requirem ents), risk transparency
ensuring internal controls are appropriate. A dditionally, each requirem ents for exam ple, new products and initiatives) as well
LO B d e v e lo p s a Line o f Business Risk A p p e tite which further as detailed limit fram eworks (market risk, liquidity and funding,
drives the en terp rise Risk A p p e tite into the individual Lines credit risk) that are se t at various levels o f the organization."
o f Business. Every em p lo yee understands that it is his or her
A fe w banks highlight a link with business planning: "The
respon sibility to im plem ent and adhere to the Risk A p p e tite
integration o f the risk a p p e tite sta tem en t produ ction into the
while m aking daily business d e c isio n s."
fram ew ork o f the business planning p ro ce ss g ives a linkage
In addition, other banks seem to rely on an appropriate inter­ o f the Board's risk a p p etite to the decision s and stra teg ies
action am ong risk culture, awareness, and policies and p ro ce ­ m ade by business at that tim e. This is also e x p re sse d via the
dures. A s explained by one bank participating in our survey: Board's capital plan, w here return requirem ents, capitaliza­
"The link is b a sed on an awareness o f the qualitative aspects, tion targets, and capital allocation resolutions com bine with
o f e x p e c te d norm s and behaviors and how decisions im pact business volum e ta rg e ts."

48 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Overall Lessons: among the participants about how the risks that cannot be
easily quantified (if at all) should be captured in the RAF.
• Communication and education on the benefits of a risk
appetite framework are essential. Members of senior 44. Some firms report that an effective first stage in the iden­
management need to be visibly and consistently associ­ tification of risk appetite has been a free-ranging and
ated with these. sometimes quite qualitative discussion of risk with the
Board. It is reported that this can be helpful in avoiding
• Limit setting is a key part of risk management, whether
becoming bogged down either in issues of definition or
or not it is part of a wider risk appetite framework. Busi­
quantification. The Board's preferences are then subse­
ness unit and risk management heads should use the risk
quently turned into a quantified framework.
appetite framework as the context for explaining and
promulgating limits and risk policies. 45. In some banks there is a clear link between elements of
the RAF and operational risk management. To the extent
• Business unit heads must own local business plans, which
that operational risk management seeks to identify, quan­
in turn must pay proper regard to risk. This, including the
tify, and control less intrinsically quantifiable aspects of
link to the wider risk appetite, should be clearly and con­
risk, the methodologies developed can be a useful input
sistently communicated to staff.
to a broader RAF framework. Some firms indicated that
• Continuous and open dialogue about risks is seen as
a range of indicators is reported to the Board as part of
fundamentally important in effectively embedding risk
regular reporting on compliance with the risk appetite
appetite in the business lines. Business unit leaders have a
framework. Many banks involved in the study were seek­
strong leadership role to play in this. When this dialogue
ing proxies to help them to understand the manner in
about risks—within and across business units and with
which risks (both internal and external) are evolving, at
risk and senior management— works well, it facilitates
least directionally. In this context, defining risk appetite
both intelligent challenges to the risk appetite boundaries
was described as "an art around the science." There was
and their evolution over time. In this way, the risk appe­
agreement that around any set of similar metrics one
tite framework is made dynamic and is able to sensibly
needs to overlay a good measure of interpretation.
accommodate new business opportunities over time.
46. However, some clear examples were given that resulted
in a significant change to the risk appetite for certain busi­
3.3 Capturing Different Risk Types nesses. One high-profile example of this is material changes

43. Incorporating different risk types into the risk appetite to the regulatory landscape (e.g., Lehman minibonds in

framework and, more specifically, capturing risks that can­ Hong Kong). These kinds of changes in the regulatory (and

not easily be quantified, is a challenging task. There is wide political) environment fundamentally change the level of risk

agreement that the RAF should capture and include all associated with certain businesses and, subsequently, the

material risks, including those that are not easily quanti­ risk/reward of the business proposition significantly.

fied, such as operational and reputational risks. However, 47. Committee structures, if thoughtfully designed, can provide
although 70 percent of the participating firms stated that an opportunity to draw on experienced judgment and over­
their RAF covers all risks, no real consensus was seen sight in areas in which quantification is inherently weak.

One institution n o te d that, w h erever p o ssib le , estim ates are arriving at an overall indication o f how large or small that risk
m ade o f the poten tia l im pact o f crystallized risks on future is in com parison with o th er risks. This is m ore a question o f
earnings capacity. Exam ples o f this w ould b e the e ffe ct o f m agnitude rather than precision, as the o b jective is to ensure
regulatory changes or sanctions on the revenue from individ­ that it carries enough w eigh t versus o th er risks.
ual busin ess lines. A n e ffo rt is then m ade to com pare th ese
O ne firm undertakes a regular assessm ent o f the p ercep tio n s
im pacts with th o se o f o th er risks. H ow ever, "this is re c o g ­
o f various stakeh olders (clients, shareholders, em ployees,
nized as bein g very su b je c tiv e " and o f very lim ited value with
and regulators) noting a) that th ese legitim ately differ and b)
re sp e c t to non-linear tail risks such as litigation or serious
that the o b jective should be "no su rp rise s." This approach is
reputational dam age.
rein forced through the creation o f a sen io r Reputation Risk
A n o th e r bank d o e s not g o as far in seekin g to quantify C om m ittee co m p rised o f sen io r m anagem ent (C FO , CRO ,
risks b u t d o e s try to estim ate the poten tial im pact o f risks and heads o f Legal and Com pliance). This com m ittee review s
on future earnings capacity for each risk with the o b je c t o f highly co m p lex or structured transactions that may create

(C ontinued)

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 49

 particularly high levels o f reputation risk. The basic p u rp o se • Penalties from su pervisors, inclusive o f the results o f inves­
is to determ ine w hether this is the type o f business the firm tigations and rem edial actions im p o sed , even w here there
should b e doing. A n o th e r firm uses com m ittee structures to is no fine;
assess the b ro a der risk im plications o f new p ro d u ct approvals. • N ew p ro d u ct activity and de-listing o f p ro d u cts (gives a
A n o th e r firm captures a num ber o f m etrics o f varying im por­ real flavor o f the use te st and how this is affecting "real
tance. F o r exam ple: life ");
• Trading with su sp e c te d insider traders; and
• Com m unications to the central bank/regulator regarding
m oney laundering b rea ch es; • Com plaints from custom ers.

48. The point was also made by many firms that, notwithstand­ 50. Our investigation has shown that successfully position­
ing a professed "zero tolerance" for some categories of ing the RAF internally as a dynamic tool for shaping the
risk (such as reputation risk and the risks of legal or regula­ risk profile of an institution depends critically on how
tory non-compliance) there are, in reality, always tradeoffs, it is em bedded in the businesses and on the quality of
and zero levels of these risks are not achievable in practice. the ongoing, day-to-day dialogue about risk within and
The key thing is to recognize these risks and manage them across business units and with risk management staff and
intelligently. senior management. As discussed in section 3.2, when
this dialogue works well, it facilitates both intelligent
Overall Lessons: challenges to risk appetite boundaries and their evolu­

• To be effective, the risk appetite framework needs to tion over time. In such circumstances, the risk appetite

incorporate all material forms of risk, including those that fram ework is seen and understood to be dynamic by all

are not readily quantifiable. Zero tolerance is not a very participants.

meaningful or practical concept— all risks need to be 51. Risk appetite frameworks and processes of the kind
actively managed. discussed in this report are relatively new in many orga­
• Firms should make a maximum effort to quantify such nizations, and take time to institutionalize. Participating
risks, making use of such innovative approaches as esti­ banks agree that the benefits are not immediately appar­
mates of earnings foregone. ent at the outset; in some banks, there is (or was) active
resistance from some business units that needed to be
• Maximum use should also be made of proxies and other
overcome.
metrics, even where these do not permit the direct quan­
tification of losses. Quantification and the development 52. It is obvious that leadership from the top is important, in
of proxies need to draw on operational risk frameworks. terms of stating the reason for creating the risk appetite
• Committee structures to address reputational or legal framework and associated processes and explaining the
risks directly, and the risk implications of new products benefits to be gained from doing this. Nevertheless, from
can, if well operated, bring experienced oversight to the experience of some banks it may be necessary to start
bear effectively. with an element of compulsion. Participants reported that
they needed to push quite hard initially to get the busi­
nesses to think about risk appetite, although after "learn­
3.4 The Benefits of Risk Appetite as a ing by doing" for a while, many reported that they have
Dynamic Tool seen the benefits.

49. The following two challenges are somewhat linked and 53. In general, senior executives appreciate the benefits of
need to be addressed as important steps in building an risk appetite more readily than those lower down in the
RAF: positioning and communicating the RAF internally as business. The active dialogue linked to specific transac­
a dynamic tool for shaping the risk profile of the institu­ tions within the business line was described earlier, and it
tion, rather than as merely a dressed-up, more elaborate is key to educating front-line staff about risk appetite and
process for setting limits or a source of additional business the benefits that awareness and understanding of it bring
constraints, and communicating its benefits. to the business and the group.

50 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 described. The key is to be "real" with the business— it is
O ne participating bank ran a series o f w orkshops fo r line important to make the risk appetite measures and metrics
sta ff in se le c te d business units, titled "H o w risk a p p etite clear and real in the individual business units to facilitate
affects y o u ." Th ese p ro v e d useful in raising aw areness o f
effective challenge and discussion. If this is achieved,
the key risk a p p etite co n ce p ts and re ce iv e d p o sitive fe e d ­
back from participating staff, who generally saw why this it is the experience of the leading participants that the
was im portant from an organizational p e rsp e ctiv e . benefits will become progressively clearer to all stakehold­
ers as time passes; this is also strongly reflected in the
Similarly, another bank holds risk a p p e tite w orkshops with
each o f its m ajor b u sin esses to identify con cern s such as case studies.
im plem entation and/or resou rce issues. Th ese w orkshops
aim not only at "driving d o w n " the R A F into the busi­ Overall Lessons:
n esses b u t also at enabling the b u sin esses to understand
the full b en efits available from a co m p lete risk a p p etite • Leadership from the top is crucial, in terms of stating the
fram ew ork, such as an assessm en t o f limits and financial reason for creating the RAF and explaining its benefits.
volatility, that is, the volatility o f a business's plan, w here Nevertheless, it may be necessary to start with an ele­
to focu s resou rces and capital, alignm ent to o th er p ro ­ ment of compulsion.
ce sse s through stress testin g, and gauging the poten tial o f
the busin ess g o in g forw ard. • The active dialogue within and across business units and
with risk management staff and senior management is
essential to communicate the benefits that the implemen­
tation of an RAF brings to the firm. Such dialogue should
54. In general, participants agreed that there is a balance to also be linked to specific transactions within the business
be found between coercion ("this is the policy/limit, keep line in order to effectively involve front-line staff.
to it") and understanding ("here is the broader risk con­
• Education is a key element in raising awareness about
text and rationale to help guide what you do").
the full benefits originating from a complete risk appe­
55. As noted previously, business unit leaders must have the tite framework.
principal responsibility for bringing risk appetite into their
• Business unit leaders must have the principal responsibil­
business units and incorporating it into the regular fab­
ity not only for bringing and incorporating risk appetite
ric of their businesses. Similarly, they have the principal
into their business but also for articulating the benefits of
responsibility for articulating the benefits of risk appetite
risk appetite in their businesses.
in their businesses— and so they need to be convinced of
the benefits themselves. Some participants reported that
initial resistance in particular business units can be effec­ 3.5 The Link with the Strategy and
tively overcome in many instances by the C E O , CRO , and Business Planning Process
other senior leaders actively explaining and reinforcing the
58. The establishment of an effective link between the risk
need for business unit staff to embrace risk appetite and
have it become part of the fabric of the organization. appetite framework and the strategy and business plan­
ning processes is fundamental.
56. It is important to note that if specific business units can't
get the needed quantitative information to see how they 59. A key finding of this study is that such a link has been
effectively established at a number of leading institu­
are tracking against key risk appetite metrics, then risk
appetite concepts have less traction and less "bite" in tions in recent years. This has been achieved in several

those business units; in these circumstances the benefits different ways, as the National Australia Bank (NAB) and
Commonwealth Bank of Australia (CBA) case studies
of the framework and processes are less clear to front-line
staff. For this reason, firms should be acutely aware of the illustrate. There is strong agreement, however, that the
relationship needs to be iterative and based on extensive
measurement limitations at each stage of their risk appe­
tite framework evolution. internal dialogue.

60. The fi rms that have made the most progress in this typi­
57. In making the benefits more visible in the businesses, it
is important to emphasize the return dimension of risk cally followed a process that involved some variation of
the following:
appetite and the opportunity for risk/reward optimization
and to position risk appetite as a foundation for active • The Board set key, top-level principles and risk param­
dialogue within and about the business, as previously eters for the overall risk appetite at the group level.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 51

 • This may take the form of a fully articulated risk appe­ In some cases an initial effort is made at translating the
tite statement or, sometimes, an initial, high-level sig­ high-level statem ent into metrics such as RoE, RWA, and/
naling of key risk parameters to business divisions. or net funding needs, which are then fed into the busi­
• Use of these guidelines by the business units in draft­ nesses. In general, however, it is recognized that the
ing their own, divisional business and budget plans. In process needs to involve a combination of breaking down
some cases this involves the creation of local risk appe­ the high-level aspirations into measurable dimensions
tite statements. In others it involves the articulation of and business units formulating their bottom-up plans in
a risk "posture" that indicates whether risk is expected a consistent form, allowing the appropriate consistency
to increase, decrease, or remain constant in the busi­ checks to take place.
ness unit. 63. The fi nal stage in the iterative process may involve chang­
• Ensuring that, whatever the form of the local plan, it ing either aspects of the business plans or of the overall
embeds and is fully consistent with the high-level risk risk appetite— but if the latter, this is done on a properly
appetite statement or principles. informed basis in order to create the needed alignment
between the two that has often been missing in many
• Individual and aggregated assessment at the group
institutions in the past. The fact that such decisions are
level of proposed business and budget plans and com­
made on a properly measured and informed basis, and
parison with the group risk appetite.
within a formal and robust governance framework, is the
• Revision and amendment as appropriate of divisional
key to ensuring that the risk appetite framework strikes
level plans and budgets— or, in some cases, group risk
the right balance between being unduly rigid— and there­
appetite.
fore unable to effectively and prudently accommodate
61. In some cases the formal planning process, rather than business and strategy evolution— and excessively flexible,
being wholly "top down," incorporates a significant in which case it would fail to create the necessary disci­
amount of "bottom up" planning at an early stage, pline on the business.
starting at the divisional level. But in either case,
iteration— starting with a concept of risk appetite — ►
business planning — ►aggregation — ►checking back with One bank p ro v id e d an exam ple of when the explicit con ­
sideration o f risk a p p etite in the planning p ro ce ss led to
the risk appetite framework and adjusting as necessary—
an increase in a business line/asset class rather than the
was observed to be the key and an important method to im position o f a reduction. The group had a g re e d to a firm­
creating essential alignment between the divisional and w ide risk a p p etite for a certain a sset class, and one busi­
business unit plans and the group risk appetite statement. ness unit w anted to increase exp osu re. This led to a risk vs.
This process also builds common awareness of the inter­ return discussion, which led to a shift within the asset class
o f increased allocation to the requesting business unit, but
action and tradeoffs between key risk appetite constraints
w ithout an increase in firm -wide risk a p p etite for that asset
and revenue opportunities. Some firms have found the
class. It was re p o rte d that "n o t everyone liked the answer,
use of standardized formats for setting out strategic plans but they a p p reciated the o p en n ess o f the d iscu ssio n ."
incorporating mandatory sections on risk profile and risk
appetite to be useful mechanisms for ensuring that these
issues have the appropriate prominence in the planning 64. The value of a stronger link between risk appetite and
process. business-level planning was summed up by C BA , "Build­
ing of the consideration of risk appetite into the group's
62. In general, the process begins with high-level signaling of
strategic planning process has been a significant step
risk or key risk parameters. For instance, NAB, as further
forward and has given both management and Board trans­
explained in the case study in Annex I, starts its process
parency either to amend the strategy to align with the
by discussing and agreeing the high-level risk posture
existing appetite or the appetite to allow for the proposed
of each major business and the group. Another institu­
strategy over decisions."
tion noted that prior to the strategy planning risk man­
agement and/or finance provide indications of current 65. The following have been key factors in building and rein­

sensitivities (e.g., leverage, liquidity, capital objectives forcing the necessary links with the business units:

or constraints, etc.), so that the initial business planning • The creation of a strong partnership between the
process is done on a more informed basis. There is no group risk management, strategy, and finance func­
uniform approach for translating high-level risk appetite tions, notwithstanding some initial resistance to this
decisions into workable parameters for business units. in a few institutions, because of some concerns about

52 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 potentially complicating the planning/budget process. and widely understood concept that avoids technical
There was general recognition and acceptance that language and enables extensive participation by a wide
formally including the risk management function in the group of participants in the dialogue and discussion
planning process may make the process longer and about risk appetite. The iterative process described
more complicated, but this was seen by those banks above needs to include an explicit discussion of the
that have taken this step as well worth it for the result­ risk/reward tradeoffs. The relevant questions are: What
ing alignment of risk appetite and plans. As the plan­ are we trying to do? and What are the tradeoffs? One
ning process is repeated, participants learn by doing firm reported: "This [risk appetite] approach allows an
and a new process with new expectations becomes intelligent discussion of 'who we are' and the optimal
established that becomes more efficient over time. business mix and balance based on risk and return."
However, as observed by NAB in its case study, the Another said: "getting the Head of Strategy to recog­
language of risk used by risk management staff can nize and incorporate Risk Management personnel into
often be opaque and not closely associated with the planning decisions was big win for us."
language used by those staff who develop strategy • Periodic reviews between risk management, finance,
and business plans. Therefore, it is important for risk and each business division to discuss what is new or
management staff to find ways to communicate and growing rapidly, what is changing, what's driving those
engage effectively in the planning process. changes, and what are the emerging risk/capital/liquid-
• Use of the concept of "risk posture"— a qualitative ity capacity issues, are a good tool for keeping the
expression of whether the business unit intends to take required linkage strong. These reviews also support the
more, less, or approximately the same amount of risk process for the next planning cycle.
over the next planning period— at both the divisional • Some firms require that each business head be able to
and group levels is an effective approach in moving the explain how risk appetite has been taken into account in
discussion forward and supplements the use of quan­ local strategy documents and how key elements of the
titative metrics. Risk posture is an intuitive, accessible, business unit strategy are consistent with risk appetite.

W hat follow s is a n o tew o rth y exam ple o f h ow a re sp o n d e n t • C u stom er and p ro d u ct profitability are m easured via C u s­
firm is achieving the link b e tw e e n its R A F and stra teg y and to m er Level Profitability R eportin g (CLPR), which in co rp o ­
planning: rates eco n o m ic capital;
Links b etw een Risk A p p e tite and Stra teg ic Planning: • Capital is re p re se n te d in the Risk A p p e tite sta tem en t and
m easured and m on itored as such.
• Line o f Business Risk m anagem ent is involved from the
beginning o f the stra teg ic planning cycle to evaluate and Links b e tw e e n Risk A p p e tite and Liquidity Planning:
assess how grow th or revenue targets fit with the C o m ­ • To geth er with the C h ie f Financial O fficer G roup, Risk M an­
pany's Risk A p p e tite ; agem en t is involved in settin g and m onitoring liquidity risk
• The Plan is d e v e lo p e d to assure G overnance and C ontrol limits, guidelin es and early warning indicators;
functions are appropriately aligned and sta ffe d around
• Risk M anagem ent controls include the analysis o f co n ­
new grow th;
tractual obligations and utilization o f stress m odeling to
• A ll plans fo r grow th are a lig n ed around the Risk ensure that e x ce ss liquidity is size d appropriately and
A p p e tite ; aligned with the liquidity risk tolerance o f the en te rp rise;
• The C h ie f Risk O fficer ensures alignm ent o f the Stra teg ic • Risk M anagem ent in corporates liquidity risk analysis into
Plan to the Risk A p p e tite . Risk m anagem ent has o p p o rtu ­ n ew p ro d u ct, business and investm ent decisio n s w here
nities th roughout the p ro ce ss to challenge any elem ents applicable, and w orks with Lines o f Business that have
o f the plan. m aterial co n tin g en t funding e xp o su re s and/or require
m aterial levels o f u n secu red funding;
Links b etw een Risk A p p e tite and Capital Planning:
• Liquidity Risk is re p re se n te d in the Risk A p p e tite sta te ­
• The capital fram ew ork a ssesses capital a dequ acy in rela­
m ent and m easured and m on itored as such.
tion to risk and p ro vid e s a com m on currency for m easur­
ing business unit perform a n ce; Links b e tw e e n Risk A p p e tite and Perform ance M anagem ent:
• The capital m anagem ent p ro ce ss co n sid ers credit, mar­ • Perform ance m anagem ent is tie d to adh eren ce to the Risk
ket, operational, in terest rate, liquidity, country, com pli­ A p p e tite in all areas o f the en terp rise, including Risk, Lines
ance and stra teg ic risks in the Internal Capital A d e q u a cy o f Business and En terp rise C ontrol Functions.
A sse ssm e n t P ro cess;

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions

Overall Lessons: 69. In this context, leading banks in a number of jurisdic­
tions are increasingly using a variety of stress testing
• There needs to be an iterative relationship between set­
processes, which typically feature a combination of mac­
ting risk appetite and planning at both the group and
roeconomic scenarios and changes in market variables,
the business unit levels.
to understand financial outcomes for the group, including
• This involves a partnership between a group's risk man­ potential credit and market losses and the likely reduction
agement, strategy, and finance and the business units, or loss of business revenues under severe economic and
with explicit consideration of risk in business planning. market scenarios. Conducting such stress tests for all enti­
• Risk posture— a qualitative expression of whether a busi­ ties across a group requires overcoming a number of very
ness unit intends to take more, less, or approximately substantial technical challenges and the significant exer­
the same amount of risk over the next planning period— cise of management judgment.
can be a useful starting point for this discussion.
70. In general, banks in national jurisdictions that were hit
• The annual planning process should be supplemented hardest by the financial crisis appear to have made more
with quarterly reviews by risk management, finance, and progress on developing comprehensive, firm-wide stress
the businesses to assess how the risk profile and the testing capabilities, perhaps in response to Industry-wide
risk/return tradeoffs are changing. These reviews should stress testing requirements of national regulators. They
place a special focus on business activities or risk con­ are therefore more likely to use these capabilities in a
centrations that are new or growing rapidly and what is more central way in their process for setting risk appetite.
changing and what's driving those changes, as well as
71. An important challenge facing management in the deter­
any emerging risk/capital/liquidity capacity issues.
mination of risk appetite is how much relative weight
should be given to:
3.6 The Role of Stress Testing within • The predicted level or range of aggregate losses that
an RAF could be sustained over a defined time period under
relatively likely, less se ve re adverse economic and
66 . An important issue on which the investigation has been
market conditions (e.g., a "one-in-ten year" economic
focused is the potential role of stress and scenario test­
downturn scenario), as against
ing within a risk appetite framework. Linked to this is the
• The much higher predicted level or range of aggre­
question of how appropriate levels of risk can be deter­
gate losses that could be sustained over a defined
mined for individual businesses and in aggregate for the
time period under a variety of relatively unlikely, m ore
group in total and the relationship between these.
severe— but nonetheless plausible— stress scenarios
67. Consciously constraining aggregate risks in advance so
(including severe liquidity stress scenarios).
as to ensure a firm's survival under severe stress scenarios
72. The key areas in which management needs to exercise
is part of the raison d 'e tre and at the heart of setting risk
judgment are therefore:
appetite appropriately. It is essential for senior manage­
ment and the Board to carefully analyze and understand • The severity of the stresses/scenarios to be applied.
the likely distribution of potential outcomes that would As noted, it is necessary to strike a balance in estab­
be experienced over time under a variety of severe, but lishing scenarios that are appropriately severe while
plausible economic and market scenarios and to deter­ being not so implausible as to make it impossible to act
mine what level of loss would be tolerated under each of upon them.
these scenarios. • The implications of the stress and scenario outcomes
68 . These assessments are crucial but very complex and dif­ for losses and how these compare to what are judged
ficult, involving both significant technical challenges and to be acceptable loss levels within the existing risk
the exercise of a substantial amount of judgment. They appetite. It is also necessary to ensure that the implica­
cannot be reduced to a series of simple, formulaic steps. tions for capital levels are rigorously assessed.
This is because, as the financial crisis has shown, for large • The implications of the foregoing for risk appetite
financial groups the aggregate, integrated risk profile of a and strategy. Boards and management need to be
firm and the way this evolves is opaque, to insiders as well equipped to assimilate and act upon the outcomes of
as to outsiders, and difficult for senior management, direc­ stress tests, even where they embody relatively low
tors, and supervisors to properly understand. probability events.

54 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
73. It would appear that in many banks these judgments have likely losses that would be experienced under more severe
been made somewhat implicitly to date, given the con­ stress scenarios and treating the results of these stress
siderable technical challenges involved. These are very scenarios as more binding in the risk appetite process.
subjective but important questions, and a divergence of
76. Some banks participating in our investigation, including
views regarding their treatment was seen among the par­
some banks in jurisdictions that were less affected by the
ticipating banks. Indeed, participants reported that it is
financial crisis, have not yet built a comprehensive, group­
common to see a divergence of views on these questions
wide stress testing capability or have not yet fully incor­
even within the management teams of individual banks.
porated stress testing into their process for setting risk
74. It is nevertheless important to distinguish between the appetite. For these banks, selected stress tests have been
relatively technical challenges of ensuring that scenarios used to date primarily as a basis for checking and chal­
are chosen carefully and their implications properly lenging the reasonableness of quantitative risk appetite
worked through and the strategic challenge of ensuring parameters and boundaries that have been set via other,
that the outcomes of stress and scenario tests are acted more subjective means. Some banks in this category have
upon. Boards and management often report difficulty in placed higher emphasis to date on ensuring a strong risk
assimilating the implications of relatively low probability culture and effective dialogue about risks at all levels, and
events and pushing through the necessary adjustments to they caution that placing heavy emphasis on stress test­
business models and strategies. Some report that this will ing in the risk appetite— setting process may risk placing
become even more of a challenge as competitive pres­ too much focus on "known unknowns." Consequently, it
sures reassert themselves as memories of the crisis fade. is clear from our investigation that the further develop­
75. It is possible to make a tentative observation that some ment of stress testing capabilities and the evolution of
of the banks that were hit hardest in the financial crisis are the way in which stress testing outcomes are incorporated
currently taking a more conservative approach than others into the process and context for setting risk appetite is an
that were impacted less severely. The former are placing area that many firms are continuing to develop, as can be
more weight in setting their overall risk appetite upon the clearly seen in some of the case studies.

One leading firm has d e v e lo p e d a co m p re h e n sive , firm ­ business lines and esta b lish ed an unam biguous level o f se v e r­
w ide stre ss-te stin g capability and uses this in a way that is ity. Su b seq u en tly, scen arios coverin g o th er poten tia l firm ­
central to the p ro c e ss o f se ttin g its risk a p p e tite . The bank w ide vulnerabilities have been im plem ented.
had originally built its firm -w ide risk a p p e tite fram ew ork D eve lo p m en t o f scen arios typically b eg in s with the identifica­
around a s e t o f statistical loss m easures, which it co m p a re d tion and prioritization o f an area o f concern, i.e ., a poten tia l
with earnings and capital m etrics. U n derpin ning the fram e­ eco n o m ic or m arket crisis, through dialogue am ong risk
w ork w ere statistica l m o d els fo r individual b u sin e sse s and m anagers, econ om ists, and line m anagem ent. Scenarios are
p o rtfo lio s, c o m p le m e n te d by stre ss m o d els ta rg e te d tow ard calibrated on a "h o w bad cou ld it plausibly g e t " basis. B a sed
the idiosyn cra tic vulnerabilities o f th o se p o rtfo lio s (not on a broad outline o f the prim ary scenario drivers, the firm
g en era lly com b in a b le due to in co n sisten t scen a rio a ssu m p ­ d e v e lo p a d eta iled scenario specification d escrib in g the e v o ­
tions). Lim its on a com bination o f th e se stre ss and sta tisti­ lution o ver 1-2 years o f a fe w dozen b ro a d m acro and m arket
cal m o d e l results w ere u se d as o p era tin g co n tro ls on the variables such as G D P grow th in m ajor m arkets, in terest and
b u sin e sse s. W hile se vera l units within the bank had g a in e d F X rates, equ ity m arkets, cred it sp rea d s, inflation, and hous­
su bstan tial e x p e rie n c e in the g en era tio n o f m acro and mar­ ing p rices. Both short-term and long-term behavior m ust b e
k e t scen arios and the evaluation o f th eir im pacts on their m o d e le d to evaluate im pact on p o rtfo lio s at o p p o site en ds
re sp e c tiv e b u sin e sse s, th e se had n o t b e e n in te g ra te d to o f the liquidity sp ectru m , i.e., m arket vs. cred it risks. H istory
d e v e lo p firm -w ide scen a rio s. and sta keh o ld er input inform the settin g o f th ese param ­
eters, which are u p d a ted periodically (at least once a year)
During the financial crisis, the firm reco g n ized the n e e d
to ensure that scenario assum ptions remain econom ically
to a dapt its risk a p p etite fram ew ork to incorporate stress
m eaningful.
scen arios alongside its statistical m odels and to particularly
em phasize p ro tectio n o f its Tier 1 capital as a risk a p p etite In tandem with this, analysis— often making use o f historical
o b jective. The p e rio d follow ing the Lehm an collapse se rv e d data at a granular level— is p e rfo rm e d to iden tify' the key
as a catalyst and m o d el exam ple fo r the d e ve lo p m e n t o f sensitivities o f busin ess/portfolio incom e with the scenario
firm -wide scen arios, since it im p acted many o f the bank's inputs; w here n ecessary (i.e., for trading p ortfolios), the

(C ontinued)

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions

 scenario specification is e x te n d e d to substantially g re a te r the scenario. A dditionally, the sufficiency o f earnings to co ver
detail. In som e ca ses, w here data analysis d o e s n ot lead to poten tial losses (and the timing o f th ose losses) is co n sid ered .
su fficien t explanatory pow er, ju d g m e n t as to scenario im pacts C onform ance to risk a p p etite is te ste d and re p o rte d to senior
or p ro xy m etrics is applied. The possib ility that causal rela­ m anagem ent m onthly in the form o f a dash board and com ­
tionships are m istakenly id en tified through analysis o f lim ited m entary, including d eta iled review o f portfo lio and business
data is also co n sid ered . Typically, e ffe cts on m arket and cred it losses/perform ance under the binding scenario. During the
risk p o rtfo lio s and incom e o f a sset gathering b u sin esses are annual planning p ro ce ss, the entire risk a p p etite fram ew ork
p o ssib le to m od el m ore robustly, while volum e-based bu si­ is review ed up to Board level and business plans are evalu­
n esses and operational risks require m ore ju d g m en t. a ted through the lens o f the fram ew ork and its m etrics. Firm ­
w ide stress scenarios are co n sid e re d a particularly valuable
Scenario im pact on P&L, capital, and RW As are evaluated
co m p o n en t o f the fram ew ork, beca u se o f the relative ease
both in absolute term s and with re sp e c t to typical m etrics
o f d escrib in g (and debating) the causal chain by which losses
(i.e.. Tier 1 ratio). The w orst-case scenario o f the available s e t
arise and can b e iden tified with bu sin esses, p o rtfo lio s, and
is chosen (along with the com plem entary firm -wide statistical
risk drivers. C on sequ en tly, it is co n sid e re d that scenario-
m odel results) for com parison against risk a p p etite o b jectives.
b a se d m etrics o ffer advantages o f transparency and avoid­
O f th ese, p erh a p s the g re a te st focus is on maintaining a mini­
ance o f (som e) blind sp o ts relative to statistical m easures.
mum Tier 1 ratio at all tim es, evaluated fo r each quarter o f

Challenges Associated with Firm-wide Risk • The inability of capital measures to capture the liquidity
Aggregation: dimensions of risk, which are so crucial for understand­
ing potential losses in severe scenarios.
77. One of the significant challenges that firms will eventually
face as they proceed along the risk appetite journey is • More fundamentally, the non intuitive nature of capi­
the issue of risk appetite aggregation—that being, once tal measures. Experience has shown that it is difficult
individual businesses have set their own risk appetite to get senior managers and directors to engage in a
boundaries, how does an organization decide whether, in meaningful way with statistical variables and capital
aggregate, these boundaries fit within the firm's overall measures (e.g., Value at Risk at 99% or 99.95% confi­
risk appetite? Or, conversely, if key quantitative aspects of dence levels) and use them with confidence in the risk
the group's overall risk appetite have been determined, appetite process. The experience of a number of firms
how can the risk appetite of individual businesses be set has been that it can be easier to get active engage­
in such a way as to ensure alignment with the overall risk ment from senior management and directors around
appetite in aggregate? Given that this discussion includes specific macroeconomic scenario assumptions.
all risks, some of which are not easily quantified, a great For these reasons, although certain capital measures (e.g.,
deal of management judgment is required to effectively Tier 1 capital adequacy) are the subject of prominent focus
manage this issue, which is obviously very closely related in the overall risk appetite process, it is difficult to robustly
to the issue of risk aggregation. determine an acceptable level of aggregate risks using
78. The technical challenges involved in risk aggregation are capital measures alone. This is one reason why, in addition
numerous and complex. In practice, most banks use a to capital and liquidity measures, leading banks in certain
variety of regulatory and economic capital measures for jurisdictions are increasingly using a variety of stress testing
risk aggregation purposes. However, these measures suf­ processes, as discussed in detail above.
fer from a number of important weaknesses when used for 79. While Industry practice is clearly still developing in this
this purpose. These include: area of risk appetite aggregation, our investigation has
• The inability of capital measures to capture and reflect shown that there are certain practices that have proven
non quantifiable risks. effective to date. These include:

• The challenges of determining the appropriate treat­ • All risks should be included in the aggregation process,
ment of risk concentrations and diversification within not just those that are quantifiable, such as market,
and between risk types. credit, and liquidity.
• The difficulty of directly linking capital measures to spe­ • For risks that are quantifiable, comparison of the
cific macroeconomic stress scenarios. enterprise-level limit framework to the aggregation

56 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 of business unit limits— including single name, Industry • Management and Boards need to feel confident in
concentration limits or economic and regulatory capi­ assessing the results of the chosen stress and scenario
tal allocation— is an effective and practical measure tests. It is often more meaningful to present outcomes
of alignment. in concrete terms ("This is what the following scenario
• Attention to the diversity, quality, and stability of earn­ would imply for Tier 1 capital . . .") than in more abstract
ings across the enterprise is essential; terms ("There is a 1 percent probability of a loss of
$X million.")
• Aggregation should identify areas of excessive risk
concentration. In this regard it is also important that • Boards need to ensure that there is a robust mecha­
when aggregating risk, over-reliance not be placed nism for holding the line on risk appetite in light of
on a potential diversification benefit. Recent history stress results when faced with inevitable resistance
has proved that in times of crisis, diversification of risk from the business. If the decision is to take no action in
often fails in practice. response to a stressed scenario, the Board and manage­
ment should be able to explain fully why this decision
• For all risks, the aggregate view of risk posture (as
is defensible.
outlined in this paper) is helpful in determining how
an organization is approaching risk overall. If, for • The compliance of stressed outcomes with the bound­
example, the individual business units are each willing aries contained within the RAF should be monitored
to take on more risk in the coming year, comparison frequently, and the risk appetite and stress testing
of risk posture at the platform level is a simple cross­ frameworks themselves should be reviewed at least
check to determine if senior management has that annually with the Board.
same awareness.
• Aggregation of risk appetite should be done on both a
"normal course" and stressed basis.
SECTION 4 - RECOMMENDATIONS
80. Aggregation of all risks for the purpose of determining fit
FOR FIRMS
within the overall risk appetite of the organization is an
81. This section draws together a number of the main findings
ongoing challenge. As an industry, some progress is being
of this report for Board directors, senior management, and
made but as with many other aspects of this paper, this
risk managers in firms.
will take time and a great deal of management judgment
to develop.
Recommendations for Board Directors
Overall Lessons:
82. One of the main m essages from this report is that a
• A comprehensive, enterprise-wide stress testing well-functioning risk appetite fram ew ork is one that
mechanism is a key part of a fully effective risk appetite is pervasive throughout the organization. A ttem pts
framework. to introduce risk appetite as a remote and disem bod­
• Management needs to develop clear and consistent ied aspect of risk m anagem ent have tended to fail.
criteria for deciding on the severity/plausibility of the The process has been much more successful where it
stress and scenario tests chosen. Firms should generally has been recognized that risk appetite needs to be
err on the side of choosing more, rather than less-severe intim ately bound up with corporate culture, corporate
scenarios, though this needs to be balanced against the governance, and strategy and planning as well as risk.
need for the results to be operationally useful. Boards have an integral part to play in the definition
• Once the primary scenarios have been chosen, economic and monitoring of risk appetite and the interchange
and markets expertise, together with informed judg­ with m anagem ent, risk m anagem ent, and the business
ment, are needed to assess the array of secondary impli­ is crucial in this. The following are the main im plica­
cations for the firm as a whole. tions of our investigation for Board m em bers. They are
particularly relevant for m em bers of Board Risk Man­
• Results of stress tests need to be linked to key objective
agem ent Com m ittees.
variables such as P&L, RWAs, and Tier 1 capital and illus­
trate explicitly how outcomes for these would comply 83. Board members need to be properly equipped to
with risk appetite boundaries through time. engage fully with risk and risk appetite. They need

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 57

 to understand generic risk concepts and the relevance 87. Operating a risk appetite framework in the dynamic and
of these to the business. They also need to have access iterative way advocated in this report makes it particularly
to the information and expertise necessary to enable important that all participants, including Board members,
them to develop a good understanding of the risk pro­ risk management staff, senior management, and busi­
file of the firm. They should insist that the material pro­ ness heads, are clear about their respective functions and
vided to them strikes the right balance between providing responsibilities. Setting out the initial risk appetite state­
a comprehensive macro perspective and illustrating the ment or signaling a set of risk preferences is just the start
required level of detail. of a process of ongoing discussion and testing. Board
members need to challenge senior management to ensure
84. Board members should be proactive in insisting on proper
support from management and risk management pro­ that the necessary processes and structures to facilitate
this are put into place and remain effective.
fessionals, in terms of education on risk concepts and
approaches, technical briefings, and updates on the risk 88 . Such an iterative approach results in Board members hav­
implications of products and activities. ing other significant challenge functions. This challenge
is essential to ensuring that the risk appetite framework
85. The Board needs to establish the framework for risk, typi­
is neither stultifyingly rigid nor excessively flexible. These
cally through the articulation of a clear and meaningful
challenge functions include, but are not confined, to:
risk appetite statement. This is likely to include a num­
ber of key metrics as well as clear qualitative guidance • Making certain that mechanisms are in place to ensure
in respect to less quantifiable risks. One test of whether that new business initiatives, transactions, or products
the statement is meaningful might be whether and how are consistent with the enterprise-wide risk appetite,
it would change in response to a decision by the Board and that the risk implications of these are fully under­
that 10 percent more (or less) risk would be acceptable. stood before the activity proceeds.
Another test would be whether the statement would • Ensuring that mechanisms are in place to monitor and
provide the basis for an effective challenge to plans on manage risks that are not readily quantifiable— such as
the part of one or more business units to move to a mark­ reputation and legal risks— and that their level is consis­
edly more expansionary mode, with attendant implications tent with overall risk appetite.
for risk. • Ensuring that stress testing is undertaken in a rigorous
86. Board members need to ensure that risk appetite is and comprehensive way and that the Board is able to
used in a dynamic and iterative way. A key conclusion of assess the results in the context of the risk appetite
this report is that an effective RAF extends far beyond a framework (more on this below).
mechanism that simply creates limits. Instead, it involves a 89. In general, as this report emphasizes, an effective RAF
dynamic or iterative process in which: is indissolubly linked to the culture of an institution.
• The Board provides a clear statement or set of signals There are no simple measures of risk culture, and it is a
regarding its preferred risk/return trade off. key responsibility of Boards to understand and shape this

• This informs an enterprise-wide process in which, on culture. Experience has shown that it can be exceptionally
difficult for Boards and supervisors to detect weaknesses
the basis of extensive dialogue, business units deter­
in risk culture in an otherwise performing firm; in particular,
mine their business models and strategies and the risk
implications of these. the absence of obvious contra-indicators cannot be taken
as positive evidence of a strong culture. Understanding and
• The Board then considers whether the individual and
shaping the firm's risk culture involves setting broad direc­
aggregate risk stances and positions of the business
tion and continual challenging of senior management to
units are consistent with the firm's risk appetite.
demonstrate how their actions and communications are con­
• If these are not consistent, a conscious and informed sistent with this and how rewards and penalties are visibly
decision is made to change one or more of the busi­ and predictably aligned with the firm's avowed risk culture.
ness unit profiles or the overall risk appetite. Senior management should be expected to account for
In some cases, the process is more "bottom up" with the their behaviors, and Board members may find it helpful to
initiative for setting risk taken more at business unit level. find opportunities to interact directly with staff at all levels in
In such cases, the role of the Board in establishing the an attempt to gauge the extent to which they are aware of
parameters for risk and actively assessing it at both busi­ and responsive to a positive risk culture, and to assess, for
ness unit and aggregate levels is especially important. example, the extent to which "bad news travels upwards".

58 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
90. Even the strongest risk culture needs to be supported by and business leaders. This includes recognition and
effective systems and controls. Board members need to acknowledgment that a clear statement of risk appetite
satisfy themselves that the firm has a clear and consistent helps drive risk and governance discussions, is integral
set of controls and limits that support the objectives of to the strategic and business planning discussions, and
the risk appetite statement and the observance of the provides assurance to regulators and rating agencies that
boundaries of acceptable risk embodied within the risk the institution has clear parameters for how much risk it
appetite framework. Board members should challenge will take on. The following are the main implications of our
management on the way in which these systems are used investigation for senior management:
to encourage compliance and penalize noncompliance. 94. To be effective it is essential that senior manage­
This may, for example, involve the setting of objective ment set the tone and lead the discussion regarding
and quantifiable behavioral norms or objectives that can risk appetite. Senior management must be seen as
be used in determining remuneration or promotion or, taking a leadership role in articulating the importance
conversely, as the basis for disciplinary action when neces­ and benefit of risk appetite throughout an organiza­
sary. The Board may seek input from the CRO in regards tion. This is an ongoing responsibility and must be
to any risk cultural or behavioral issues that the Board continually emphasized.
should consider in making incentive payment decisions
95. Recognition that risk appetite and risk culture are inex­
for executives.
tricably linked is important, given that culture derives
91. Boards have a key role to play in the evaluation of from leadership and determines inter alia, how middle-
stress and scenario test results. Members need to satisfy level managers assimilate and embed risk appetite.
themselves that the stress tests are conducted rigorously,
96. Creation of an enterprise-wide RAF is an iterative
that the stresses and scenarios strike the right balance
process involving the Board, senior management, and
between severity and realism, and that the implications
risk management staff. At the heart of the process is an
have been properly evaluated across all businesses in
ongoing dialogue, and senior management should expect
the group. Boards have a fundamental role in deciding
to be challenged by the Board as to what is being recom­
whether risk appetite needs to be revisited or adjusted in
mended, including risk/return tradeoffs and regular close
light of the results. Board members also need to ask them ­
scrutiny and discussion of all aspects of the firm's risk pro­
selves searching questions about their ability to assimilate
file under stressed conditions.
and respond to low-probability but high-impact scenarios.
97. It is an absolute requirement that the business (and not
Many Board members find this very challenging. Boards
risk management) take ownership and drive the devel­
need to be aware of their limitations in this regard and
opment of line-of-business risk appetite and profile. It
consider carefully whether these are acting as a brake on
must be recognized that risk appetite does not belong
effective decision-making.
to the risk management staff and is not simply another
92. Finally, Boards should subject their own operations way to set limits and constrain business. Business unit risk
and processes to constant review. Every effort should appetite frameworks are the main vehicle for providing
be made to identify, on a continuous basis, areas in which guidance and clarity regarding which activities and risks
Board procedures have worked well and not so well and businesses can consider and what would be outside of
to learn from mistakes. There should be an annual review
agreed upon appetite.
of how the Board interacts with the management and
98. It is important to recognize that while it is helpful to have
business heads. Overall, the Board should have a formal
an articulation of risk appetite that can be used by the
process at least annually for considering whether and
Board and all levels of management, there is no clear
how it has made a real difference to risk management in
need to have the enterprise-level RAF as a document
the organization.
that middle management across the enterprise must use.
The critical component is to have a risk appetite fram e­

Recommendations for Senior work that helps drive a clear and comprehensive limit
structure for the various businesses as well as activities
Management
and limits that determine the ability of middle manage­
93. Implementation of an effective risk appetite framework ment to pursue and grow specific lines of activity that
is highly dependent on visible support from senior link back to the enterprise risk appetite framework. Line-
management, including a bank's Executive Committee of-business risk appetite frameworks should not be

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 59

 developed as simple subsets (or even simple "clones") 103. Risk management needs to be actively involved at
of the enterprise framework. While there are linkages to multiple levels in the development of the risk appetite
the enterprise framework, the most useful aspects of the framework. It is incumbent upon risk management to
business-level frameworks are often quite specific to the provide clarity of concept and definition and support
line of business, reflecting the diversity of a firm's activi­ in understanding the implications of the risk appetite
ties, geographic scope, or regulatory regimes in which statements and metrics as they develop. A lack of clar­
it operates. ity in definition often leads to confusing and ineffective
99. Senior management needs to ensure that the risk appe­ discussion that can frustrate the participants and extend
tite framework includes full consideration of and appro­ the process unnecessarily. In this regard, it is important
priately reflects business strategy. It is important that the that risk management provide the necessary coaching and
Board and the market understand that the senior manage­ training to facilitate the understanding of risk appetite on
ment takes risks in areas that are central to its key strategies an enterprise-wide basis.
and businesses and that losses in those areas, while not 104. An effective RAF covers all risks, and it is important that
positive, are expected and understood as a likely outcome risk management work with all stakeholders in developing
in both normal business conditions and under a difficult the right balance of appropriate quantitative and quali­
market/stress scenarios. Smaller and more peripheral tative metrics. Recognizing that the appetite for some
businesses by contrast should not be a source of significant risks is more easily quantified than others, it is important
losses. that risk management lead the discussion and develop­
100. It is important that senior management understands and ment of desired behavior and tolerances for less quantifi­
accepts how the RAF will apply to its activities and impact able risks such as reputation risk.
any initiatives, growth plans, or acquisitions that may be 105. Risk appetite is an iterative process that requires perse­
under consideration. The strategic planning process verance. To that end, the challenges faced early in the
must include discussions relating to risk appetite and process are different from those experienced later. At
profile. While risk appetite needs to become a fundamen­ all stages, it is important for risk management to ensure
tal driver of strategy and of front-line business decisions, it full engagement by all key stakeholders, including the
should be accepted that it will take time and effort to get Board, senior management, and risk practitioners.
this to a point at which business unit leaders and risk man­
106. At the same time, risk management must allow the busi­
agers are comfortable with the process.
nesses to take charge of the process of developing line-
101. Business leaders must ensure that risk metrics ade­ of-business-level risk appetite statements. This means
quately capture and reflect all material risks of their the business unit leaders themselves, not the embedded
business. These metrics should be meaningful and pertain risk management staff within the business units.
to their key business and risk drivers. Similarly, the busi­
107. Risk management needs to provide the appropriate
nesses are responsible for putting appropriate controls in
infrastructure and controls to support the ongoing
place to effectively manage their risks, so as to ensure that
maintenance of the RAF. This includes comprehensive
they do not exceed their defined risk appetite.
and timely reporting to senior management and the
Board to provide clear reference to the current risk profile
Recommendations for Risk Management and to make the framework itself both real and relevant.
Ongoing reporting of the firm's risk profile relative to the
102. Development and maintenance of an effective risk appe­
agreed upon risk appetite— and how this is changing—
tite framework is a shared responsibility, with risk man­
and repeated/iterative discussions of the evolving fram e­
agement staff playing an essential role in the process. It
work itself, will help to build both "pattern recognition"
is not uncommon for risk management to take the lead in
and acceptance of the framework as a useful tool.
building management support and engaging the Board as
the framework is developed. Similarly, the ongoing main­ 108. Risk appetite needs to be viewed in the context of both
tenance of a robust framework is heavily dependent on normal and stress conditions. Risk management needs
risk management to provide good-quality reporting of risk to be capable of providing both of these perspectives and
metrics to support the framework and its application. The facilitating the appropriate discussion at the Board level
following are the main implications of our investigation for with regard to the potential impact on business strategy
risk management staff: and planning.

60 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
109. It is critical that risk management engage with the busi­ Initial Planning and Development of RBC's Risk
nesses in the strategy and planning process to ensure Appetite Framework
proper alignment between the enterprise-level state­
Work to formalize RBC's enterprise risk appetite began in 2006,
ment of risk appetite and those statements created at the
as part of the annual process to benchmark and refresh credit
business-specific level.
risk and market risk limits. An initial presentation on risk appe­
110. Risk management should be the catalyst and conduit tite was made to the Risk Committee of our Board of Directors
for effective discussion of risk appetite between the to gain feedback on the approach to articulating RBC's risk
Board and the businesses by translating what may be at appetite, and confirm areas of priority.
times high-level statements of risk preference into effec­
Initial statements of RBC's risk appetite were derived from
tive risk measures and limits appropriately tailored to
a review of decisions made by senior management and the
each business.
Board that yielded explicit statements about what risks were
111. Risk management must ensure that the RAF is supported
acceptable, and what risks we wanted to avoid. We identified
by a suite of risk policies that reinforce and reflect the
to the Board areas we intended to enhance, as well as a plan to
risk appetite as articulated. This includes a clear under­
develop a comprehensive Risk Appetite Framework. The global
standing of the process for dealing with and reporting
financial crisis of 2008 then triggered further prioritization of risk
transactions that may be approved outside of policy
appetite for financial services institutions.
boundaries as well as excesses to approved risk appetite.
The Chief Risk Officer and Group Risk Management (risk man­
112. Education and communication are areas in which it is vital
agement corporate function) acted as a catalyst to define and
for risk management to participate on an ongoing basis. It
communicate the value of risk appetite. Our Board of Directors
is necessary to effectively communicate the key elements
was engaged primarily through the Board Risk Committee, and
of the design, implementation, and maintenance of the
this committee provides feedback and challenges the risk/return
risk appetite framework to all stakeholders internally and
tradeoffs implicit within risk appetite. It was understood that our
externally. It also is important that the Board be able to
Risk Appetite Framework would be expanded and refined over
address questions raised by shareholders and regulators
time, and that we were learning as we progressed through the
alike as to the appropriateness of the nature and quan­
development process.
tum of the risks being assumed, both individually and in
aggregate, and how senior management is challenged in RBC's Risk Appetite Framework was created through an itera­
this regard. tive process. We faced an early challenge to reach consensus on
a single management view of self-imposed constraints or other
specific parameters to put forward to the Board for feedback
ANNEX I: CASE STUDIES and approval. We gradually gained senior management buy-
in, yet had to remain focused on building senior management
Developing a Risk Appetite Framework understanding and acceptance of how the Risk Appetite Frame­
at RBC May 2011 work would apply to the key activities and decisions they faced
within their business segments.
A b o u t RBC
Buy-in to the Risk Appetite Framework also had to be built
Royal Bank of Canada (RY on TSX and NYSE) and its subsidiaries
within our Group Risk Management function. We needed to cre­
operate under the master brand name RBC. We are Canada's
ate a forum for the various specialist groups within Risk to shape
largest bank as measured by assets and market capitalization,
the framework, and we now rely on these teams to communi­
and among the largest banks in the world, based on market
cate and reinforce the framework.
capitalization. We are one of North America's leading diversi­
fied financial services companies, and provide personal and Central to our framework is the consideration of business strat­
commercial banking, wealth management services, insurance, egy, and the concept that not all losses are created equally. This
corporate and investment banking and transaction processing pertains to our ongoing intention to take risks in areas that are
services on a global basis. We employ approximately 79,000 full- central to our key strategies and businesses, and that losses in
and part-time employees who serve close to 18 million personal, those areas, while not a positive, are expected and understood
business, public sector and institutional clients through offices in as a likely outcome in difficult market and stress scenarios.
Canada, the U.S. and 50 other countries. For more information, Smaller and more peripheral businesses by contrast should not
please visit rbc.com. be a source of significant losses.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 61

Risk Appetite Framework • Establish and regularly confirm our risk appetite, defined
by drivers and self-imposed constraints through which
Risk appetite is now a fundamental part of RBC's Enterprise Risk
we have chosen to limit or otherwise influence the
Management Framework, which is our enterprise-wide program
amount of risk undertaken
for identifying, measuring, controlling and reporting of the
significant risks faced by the organization. Integral to our Enter­ • Translate our risk appetite into risk limits and tolerances
prise Risk Management Framework is our strong risk culture, that guide businesses in their risk taking activities
which is both a prerequisite to and reinforced by risk appetite. • Regularly measure and evaluate our risk profile against
Used effectively, risk appetite aligns business strategy, people, risk limits and tolerances, ensuring appropriate action
processes and infrastructure. is taken in advance of risk profile surpassing risk
appetite
We define risk appetite as the amount and type of risk we are
willing to accept in the pursuit of our business objectives. RBC's RBC's Risk Appetite Framework is composed of four major
Risk Appetite Framework provides a structured approach to: components:

• Define our risk capacity by identifying regulatory con­

straints that restrict our ability to accept risk

The largest circle represents the regulatory constraints RBC faces. RBC’s regulatory
constraints are classified as:
1) Financial - Tend to be quantitative in nature and therefore easier to interpret.
Capital ratios and liquidity metrics are examples of financial regulatory
constraints.
2) Other - Tend to be predominately qualitative in nature and therefore require
judgment in interpreting requirements and assessing compliance. Examples
include maintaining compliance with legislative and regulatory requirements,
and adhering to privacy and information security regulations.
Financial

The darker center circle represents RBC’s risk appetite as defined by

1) Drivers - These are business objectives that imply risks RBC must accept to
generate the desired financial return. Examples include revenue growth and
earnings per share.
2) Self-imposed constraints - Quantitative and qualitative statements that
Regulatory Reputationa restrict the amount of risk RBC is willing to accept. Examples follow
on the next page.

Financial
The center circle refers to our risk limits and tolerances that we translate from
risk appetite:
1) Risk limits are quantifiable levels of maximum exposure RBC will accept. They
are established only for risks that are financial and measurable, such as
credit risk and market risk.
2) Risk tolerances are qualitative statements about RBC's willingness to accept
risks that are not necessarily quantifiable and for those risks where RBC does
Regulatory Reputationa
not have direct control over the risk we accept (such as legal risk and
reputational risk).
We communicate risk limits and tolerances through policies, operating procedures and
Financial
limit structures.

The striped oval represents the organization's risk profile at a given point in time.

Regulatory
Reputational

62 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A key element of RBC's Risk Appetite Framework is self- Reporting
imposed constraints and drivers in which we have chosen to
Risk profile relative to risk appetite is reported quarterly to
limit or otherwise influence the amount of risk undertaken. We
senior management and the Board of Directors. An Annual
have seven key categories of self-imposed constraints:
Enterprise Risk Presentation is also made to the full Board of
• Maintain a "A A " rating or better Directors. We have found that a comprehensive and balanced
• Ensure capital adequacy by maintaining capital ratios in set of our most meaningful metrics, connected with external
excess of rating agency and regulatory thresholds developments, has yielded effective discussion and decision
making. Reporting has been a key component in building under­
• Maintain low exposure to "stress events"
standing of the framework and its application.
• Maintain stability of earnings
• Ensure sound management of liquidity and funding risk Success Factors
• Maintain a generally acceptable regulatory risk and com­
An important success factor has been strong support of our
pliance control environment
Board of Directors, Chief Executive Officer, and senior manage­
• Maintain a risk profile that is no riskier than that of our ment. Our emphasis on risk appetite as an enterprise priority
average peer has been framed and accepted as a critical element to advance
For each category of self-imposed constraints we then have our strong risk culture.
a set of quantitative and qualitative key measures. Our self- Repeated iterations with stakeholders were helpful in gradually
imposed constraints and key measures are regularly reviewed building pattern recognition, senior management buy-in, Board
and updated, and approved by the Risk Committee of our of Directors' support, and confirmation of the central compo­
Board of Directors. nents of our Risk Appetite Framework.

Risk appetite development has been led by our CRO , with

Application of RBC's Risk Appetite Framework ongoing facilitation by senior executives in Group Risk Manage­
Beginning in 2008, two pilots were conducted to determine ment and engagement with business segments. We began to
if the Risk Appetite Framework used to determine enterprise build business segment ownership of business segment— level
level self-imposed constraints could be applied at the busi­ risk appetite by integrating risk appetite with business strategy.
ness segm ent level. The heads of risk with direct responsi­ A flexible approach was required because one method would
bility for business segm ent risk management facilitated the not fit for all businesses and stakeholders.
interpretation of the enterprise fram ework to each business
Our risk frameworks contain straightforward terminology and
segm ent context. This led to the developm ent of business
can be generally understood by all stakeholders. We avoid
level constraints that aligned to the seven key categories of
overly technical and complex discussions about risk with our
enterprise self-imposed constraints. Businesses also chose to
Board and senior management, and focus discussion within
incorporate several key specific constraints to businesses which
the context of real and current issues for our institution. In this
they manage.
vein, our business segment statements of risk appetite are quite
We have made significant progress building out comprehensive focused and business driver specific, for example, concentration
statements of risk appetite for each business segment. Risk risk for certain sectors, acceptable earnings volatility and levels
appetite and risk profile were applied in this year's business seg­ of capital at risk.
ment strategy development process more explicitly than in pre­
vious years. Activities continue to enhance business segment/ Challenges
unit risk appetite, and communicate risk appetite concepts to
It was initially challenging to achieve clarity on what risk appetite
broad employee audiences.
means and how it is used to drive management decisions. Board
We observe an increasing number of discussions and propos­ and senior management decisions implied a high level risk
als framed within the context of risk appetite. We see our appetite; however, it was initially challenging to gain consensus
organizational capability improving to ensure that risk appetite and concisely articulate risk appetite for the enterprise. Itera­
considerations are well incorporated into growth initiatives and tive discussions on the framework and ongoing reporting of risk
business planning overall. Group Risk Management will continue profile helped improve our definition of risk appetite, and build
to facilitate and oversee enhancements to business segment risk understanding and acceptance with senior management and
appetite and related reporting. the Board.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 63

It also took time to gain traction building business segment As mentioned, we will continue to enhance articulations of risk
articulations of risk appetite because it was not possible for appetite for our business segments and key lines of business.
business segment frameworks to be developed as simple Compensation risk management is another practice that we are
subsets of the enterprise framework. While there are distinct integrating into our risk frameworks.
linkages to the enterprise framework, some of the most useful
It is also our objective to cascade risk appetite concepts to
aspects of the business level frameworks are often quite specific
broader employee audiences, to create a general understanding
to the business segment or business line.
of risk appetite and instill ownership of risk. Consistent with our
We also needed to demonstrate the value of a risk appetite industry peers, we have made significant progress in the area of
framework in some instances, before the businesses (and not risk appetite, and there remains work to be done to achieve full
Group Risk Management) would take ownership and drive the business engagement and integration into all relevant manage­
development of business segment risk appetite. There were some ment processes.
early concerns that risk appetite and risk profile reporting was
one more mechanism to impose limits or constrain growth plans.
Risk Appetite within National Australia
Lesson Learned and Key Benefits Achieved Bank: an Ongoing Journey
By articulating risk appetite at both an enterprise and busi­ Overview-Where We are on the Journey
ness segment level, we have an effective combination of top- The setting of risk appetite within National Australia Bank
down constraints and business specific risk drivers. The linkage currently manifests itself in two key ways. Firstly, the framework
between the enterprise level constraints and the actions of busi­ by which we determine our risk posture is strongly aligned to,
nesses to grow or change risk profile is now fairly clear. Owner­ and informs, the planning process. Secondly, the statement of
ship of issues is also now clearer. risk appetite (the Risk Appetite Statement (RAS)) and its three
Risk appetite and risk profile are effective communication tools. elements ("posture," "budget" and "settings," described
Increased transparency and reporting on these matters has facil­ below) sets out our capacity for taking on risk and the settings
itated internal alignment among business and functional lead­ associated therewith.
ers, and supports effective decision making. Our enterprise risk Our current capability, in terms of risk appetite, reflects an
profile provides a consolidated view of risk concentrations and ongoing journey over a number of years and will continue to
deficits to ensure alignment between actual risk exposure and evolve as our thinking develops. As with most large organisa­
target risk exposure. Our Risk Appetite Framework and risk pro­ tions, the pace of change is a function of the ability of the
file have also been very helpful in conversations with our Board, organisation to absorb that change. As such, our strategy for
regulators and rating agencies. improving the risk appetite has been measured, rather than
Risk appetite is increasingly integrated into our business strate­ dramatic, so as to ensure understanding, acceptance and use
gies and planning processes, so that strategies are developed as we progress. This has allowed us to approach the task with
and approved in the context of risk appetite. We are em bed­ a longer term vision, introduce change progressively, reflect on
ding into our annual strategic planning process analysis of how the responses and then refine our thinking.
growth objectives, degree of planned change and "risk posture" The risk appetite framework (RAF) is grounded in:
may impact business segment risk profile and risk appetite. In
• strong engagement between key stakeholders, including
addition, our annual process where the Board approves del­
Board and Executive, in setting the planning envelope
egation of authorities to management and the associated limit
for the business; and
structures is now put forward with direct linkage to risk appetite.
• an interactive process over the planning period that sees
Moving Forward agreement on the risk reward tradeoffs that are required
for the plan.
Our enterprise Risk Appetite Framework is updated at least
The framework results in a statement on risk appetite, the RAS,
annually, focused on continued development of self-imposed
which encompasses:
constraints. For example, we are enhancing constraints pertain­
ing to low exposure to stress events, operational risk and quali­ • a "risk posture" that seeks to qualitatively describe our
tative measures for non-financial risks. Other areas of focus are capacity and willingness to take risk at any point con­
to create more forward looking metrics, and achieve the right sidering the internal and external circumstances and a
blend of qualitative and quantitative key measures. forward view;

64 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • a "risk budget" expressed as an economic capital limit of risk is somewhat opaque and not broadly identified with by
within which the Group must operate; and those tasked to develop and execute strategy and plan— that
• "risk settings" that express key operational limits. is, the businesses. Finding ways for Risk to communicate and
engage in planning was thus critical to the development of
Through a combination of a framework strongly integrated into
risk appetite.
the plan, and the production of a RAS as the embodiment of
risk appetite, we seek to effectively communicate this appetite On top of all this, responsibility for preparing the RAS frequently
throughout the organisation. changed hands between teams in either Risk or Finance, which
made it difficult to establish a long-term vision or change
agenda for risk appetite.
Modest Beginnings
The development of our RAS and associated framework has Our First Steps-Dedicated Resources and
been, and continues to be, iterative. As described below we are Defining "Risk Posture" Qualitatively
currently up to the 3rd generation RAS. Our current capability
By 2009, we found ourselves at a crossroads. Thinking around
owes much to the learnings, insights and persistence of those
risk appetite was relatively basic and the RAS was seen by many
tasked with earlier efforts.
as having limited relevance or influence.
We have been preparing RASs for a number of years and well
Despite our best efforts it focused primarily on economic capital
before it was becoming an explicit regulatory expectation. The
(a measure not widely understood in the business), was pre­
RAS was created under the leadership of the Board Risk Com ­
pared after the annual planning and strategy process was com­
mittee and the sponsorship of the C FO and CRO . Whilst rigor­
plete (hence merely reflecting what was to be done) and was
ous and well-grounded in principles of corporate finance, the
widely seen as uninformative in terms of strategic and business
emphasis was on quantitative risk and capital metrics and not
decisioning (and hence of little strategic use).
enough on qualitative discussion or actual risk settings, limits
and policies. For this reason the RAS remained a centrally man­ The Group CRO and the Board Risk Committee continued
aged document with little visibility or traction beyond the Board to push for further improvements in the thinking behind, and
and Group Executive. delivery of, the RAS, highlighting areas that could be improved
to assist the Group in its understanding and application around
Our "second-generation" RASs set out to respond to these
risk appetite. At this stage, responsibility for the RAS changed
identified gaps by incorporating clear, explicit and detailed
hands yet again, and was given to a designated owner within
risk settings, limits and triggers. The drawback of these RASs
Risk. We created a new position— Head of Risk Appetite, who
was that whilst there was a lot of detail around risk settings,
reported through the General Manager Credit Strategy to the
it became inaccessible to readers given its complexity. More
Group Chief Credit Officer. A dedicated risk appetite function
important, the Board and the executive felt that the detail
was an important step in the journey, taken to lift the relevance
made it hard to "see the wood for the trees" and were of the
and influence of risk appetite concepts and methodology in the
view that links between the RAS and overall business strategy
Group. For the first time, it had an owner whose principal role
were unclear.
was to not only prepare the RAS but to develop our thinking
This issue of the lack of strategic relevance for the RAS was around how best to embed risk appetite into the business.
compounded by the absence of a fully integrated role for the
Given this structural change, the risk appetite team embarked
Risk function itself within the planning process. Whilst Risk had
on developing the "third-generation" RAS by starting with a
a clear role in matters such as the validation of forecasts on loan
clean slate and spending time thinking more explicitly about
loss provisioning or expectations about the movement in asset
what we were looking to achieve.
quality, it had a minimal part in framing the initial risk envelope
in which the business strategies and financial plans were to fit. The challenge was to give life and meaning to risk appetite so
that there was one agreed [upon] view that was used and under­
Why was this the case? Apart from the well-accepted view that
stood throughout the Group.
Finance "ran the planning process," Risk lacked both a platform
to effectively communicate its views and a framework to mean­ The major breakthrough was the decision to describe the "risk
ingfully participate in the planning process. In particular, Risk posture" for the Group, and separately each business unit, in
was not successful in identifying a language that readily con­ terms of three broad settings linked to directional benchmarks.
veyed its position and views. Unlike Finance, whose language is These settings were qualitative, and conveyed how the Group
encapsulated in metrics that are well understood, the language would position itself over the plan period, having regard to the

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 65

internal and external environment. It effectively sought to pro­ planning (to signal direction) and when planning is finalised (to
vide direction on whether we were prepared to take more or assess whether plans reflect the agreed upon posture). This
less risk. By describing this posture, both in language and visual debate occurs between all stakeholders, including the Board,
form, we provided an anchor point from which to develop the and can best be described as interactive and iterative. There
Risk engagement with the business units about the respective are a number of stage gates during the planning process where
risk appetite. we revisit the posture assumptions and positioning. More for­
mally, we submit three RASs a year to the Board, each showing
After defining this "risk posture," it became easier to debate
changes in the posture relative to prior periods (for both the
where we should be, or wanted to be, in terms of a risk stance.
businesses and the Group).
This debate could be had at both the Group level and at each
business unit recognising differing market positions, strategic As we evolve our thinking on posture, we see opportunity to
capability and priority and external conditions which vary mark­ further enhance and enrich the discussion. To this end we are
edly across our Group. It provided a framework for the Execu­ trialling whether the description of a risk posture statement
tive to do this in a manner that was more readily understood for key risks (e.g., credit, operational, market, reputation, etc.)
without reversion to the traditional language of risk (limits, and for major business activities would enhance messaging. A
metrics, etc.). As such, it elevated the richness of the discussion direct benefit in developing this thinking is that it forces broader
and gave new impetus to the role and purpose of risk appetite. engagement with all stakeholders and raises awareness around
By forcing this discussion around the appropriate posture, given risk appetite.
both the subsisting circumstances and our capabilities and con­
straints, the linkage to the plan was more easily understood. It Along the Path-Completing the Picture
also ensured that once a particular posture was agreed upon, Whilst describing a risk posture was a catalyst for increased
risk appetite and settings could be more explicitly linked to debate at Executive and Board level, and one that has seen the
the strategy. quality of discussion around risk appetite increase throughout
For 2009 the initiative around risk posture was "after the event" the Group, other developments have also been important.
as the plans were by then already substantially completed. Since A key development has been increased engagement by Risk
then, we have sought to set the risk posture (and associated with the Strategy and Finance teams in the development of the
guidelines) ahead of the planning process so as to provide the strategic, financial and risk parameters established for the plan­
businesses with appropriate direction. ning process. This has allowed us to more effectively integrate
Importantly, we seek to describe the risk posture for each line of risk appetite into the planning process, as businesses see the
business and bring these together to reflect the overall Group three key Group functional stakeholders (in risk, finance and
position. Debate around posture occurs both when we start strategy) more closely aligned and linked in their messaging
around the drivers of financial outcomes. From a Board per­
spective, increased engagement between the Group func­
Conservative Neutral Expansionary
tions has provided comfort that the strategies and business
plans more effectively reflect a risk lens.

This has also allowed for more effective review and challenge
throughout the planning process (over some 6-8 months) in
order that plan outcomes reflect not only the financial expec­
tations but also the risk appetite. Where they are outside this,
adjustments to either the plan or the risk appetite are made.

This integration and the role of the RAF in the planning cycle
are shown below in Exhibit 4.1.

As discussed above, the concept of a risk posture has

allowed Risk to more effectively communicate with strategy
and finance. We have also developed the concept of "key risk
them es" within the RAS, which are the most important risks
(or "categories" of risk) facing the Group at any time. They
complement thinking around Group strategies, form a basis
for identifying the most relevant points of vulnerability in the

66 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 This approach to the RAF is shown below.

Whilst the framework for the RAS and risk appetite was evolv­
ing, we were conscious that communication through to bankers
Rik Appetite, Fisnancial Plan remained a challenge. The language of the RAS is targeted at
and Strategy are integrally
connected
the Board, Executive and Senior Management. Beyond this,
the language is less appropriate for day-to-day activity. Not­
All three communicate risk /
reward 'trade-off^ to be withstanding, it is clear that effective communication to bank­
made, though with different
Capital ft funding language ers needs to occur in some form if the RAS is to fulfil its role of
"Board to Banker" understanding of risk appetite.

To this end we have sought to engage businesses in preparing

their own "risk-setting statements" (RSSs) that can be more
granular and effective in communicating messages to all levels
Exhibit 4.1 Risk a p p e tite in th e planning cycle. of the business. Whilst these clearly need to align to the RAS,
they provide more latitude to effectively communicate to a
broader audience. Although some progress has been made, this
plan and provide a framework for thinking about risk mitigation.
remains a work in progress.
In addition, because they are described in common language
rather than technical terms, they provide a more broadly under­
stood link for those outside the Risk community. Lessons Learned-Successes and Challenges Along
Having established the role of "risk posture" (a qualitative risk the Way
setting description) in risk appetite we have also sought to The developm ents described above have been interactive
enhance our thinking around the more quantitative aspects of with enhancem ents to both the RAS and the fram ework
the RAS, in particular: occurring as we progressed. In the course of our journey,
• setting a "risk budget" in terms of economic capital; and the absence of an "off the shelf" solution has meant we
have spent significant time discussing what works and what
• describing operational "risk settings" to further enhance
doesn't. Our approach has always been to dem onstrate
the communication with bankers.
ongoing steady im provem ent rather than coming up with the
The "risk budget" is described in economic capital terms and
"com plete solution." Given the uniqueness of the issue, the
sets our maximum risk taking capacity. Reflecting the posture,
m ultifaceted nature of the challenge and the relative interest
it establishes a limit in advance on the use of our available risk
and needs of stakeholders, we have concluded that this is not
capital to support business activity. Allocated to the businesses
achievable. Rather, ongoing developm ent and refinem ent will
by risk class (e.g., credit, market, operational risk, etc.), it pro­
lead to better outcom es.
vides a quantitative boundary for planned activity. Actual use
of economic capital is then measured against these limits. This Against this backdrop, there are lessons we have learnt along
approach has served as a trigger to review increased business the way that have shaped, and continue to shape, our thinking.
activity in certain areas where economic capital limits were likely The things that have led to significant improvement for us
to be insufficient to support the proposed activity. include:
In the past, economic capital would not have acted as such a • fostering leadership of the debate on risk appetite from
constraint as it had always been an outcome of the plans (i.e., the C E O , the CRO and the Board Risk Committee;
the agreed upon plan used "this" amount of economic capital)
• fostering a receptive internal environment. The organisa­
and as such was not seen as a limit on activity or as a trigger
tion has worked hard on its culture over time and has a
point for a decision.
strong emphasis on teamwork, collaboration and enter­
Having set a "risk posture" (qualitative) and a "risk budget" prise thinking. This, alongside the wake-up call issued to
(quantitative), we then establish "risk settings" to further pro­ all parties associated with the financial services sector
vide guidance as to the risk tolerances within which the Group (arising from the global financial crisis and its aftermath),
should operate. These risk settings are represented by limits, has enabled more sophisticated and planned discus­
policies and procedures and other setting statements and are sions and analysis on the forward outlook for risk and the
more operational in nature. They are at different levels of granu­ environment and our response through posture, appetite
larity depending on the messaging required. and strategy;

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 67

 Risk settings
Existing Customer Controls
Outlook
franchise needs
• Models • Hurdles
• Trading (e.g. x-sell,
lim its return, LVR,
etc.)
Potential • Op. loss
• Policies
rewards tolerance
• Audits

Limits
Confidence in • Industry • Equity
capabilities • Country • Product
• Market • Liquidity
. IRRBB • etc.
Expectations
for return
Processes / procedures
• Making • Custom er
decisions onboarding
• Product • Training
exposu re
monitoring
Risk^aking Regulatory Legacy
capacity constraints assets /
Messaging
liabilities

Not all risk settings are in the R A S -b u t all are w ith it

Exhibit 4.2 From risk p o stu re to risk b u d g e t and actual risk se ttin g s.

• identifying a single, dedicated team with accountability • identifying key stakeholders in the business to champion
for the RAS and the broader framework has allowed us risk appetite discussion; and
to attain consistency in approach and provide the impe­ • maintaining the ongoing commitment of key stakehold­
tus for innovation; ers such as the Board and senior executive.
• separating discussion of risk appetite into three parts, Most important, we can already say that in the past few years
each of which are linked but serve a different purpose: the outcome of a number of material strategic decisions taken
risk posture, risk budget and risk settings; by the Group were significantly influenced by the framework
• integrating the risk appetite and RAS with the strategic described above.
and financial planning process; As there are diverse views around the approach to risk appetite
• increasing the dialogue with the business units around (and the RAS) our journey has not been without challenges.
their view of risk posture; Some of the more significant challenges have been:
• delivering three RASs to the Board with the cycle and • balancing the desire for quantitative or prescriptive crite­
content linked to the planning process. This has allowed ria to define risk posture with the flexibility and generality
for more regular Board discussion on risk appetite and that qualitative, "principles-based" definitions provide.
has reinforced the link between risk appetite and the We have responded by developing a number of quantita­
business strategies and plans. The Board now sees more tive metrics which are "indicative" of risk posture whilst
careful consideration of the implications of proposed avoiding the trap of attempting to define it formulaically.
actions and activities on the Group risk profile and its
• choosing the appropriate metric for each application.
relation to the Group Risk Appetite and evidence of risk
For example, economic capital is the metric for risk
appetite thinking in its discussions with management;
"budgeting" across the Group, but other metrics are
• supplementing the RAS and associated discussion with more useful for other applications, such as exposure lim­
risk workshops and targeted risk papers for the Board, its, trading desk limits, industry or country credit expo­
has assisted the Board in linking risk appetite to the busi­ sure limits, etc. Our response has been not to promote a
ness activities and the portfolios; single all-encompassing risk metric but rather to identify
• engaging with our Regulator; the most appropriate risk metrics for each purpose.

68 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • whilst used as the measure of risk budget, the use of from a risk portfolio perspective, not just our limits, bud­
economic capital still remains a challenge. We continue get and tolerances;
to use it given its historic link to past RASs, ICAAP and • further linking the "return-on-risk" (as opposed to return­
the fact that most measured risks can be quantified in on-capital) with the risk appetite;
economic capital terms (albeit there is always debate
• using the RAS to further enhance transparency around
as to the voracity of the number). Notwithstanding this,
trade-offs in respect to choices between strategic priori­
most stakeholders still have little engagement with eco­
ties, investments and risk levels we are prepared to accept;
nomic capital as a meaningful metric to measure risk
performance against. The proper place and purpose of • continuing to develop the framework for defining "risk­

economic capital as a useful tool in the RAF continues to setting statements" (RSSs) within the businesses; and

be a focus. • explicitly linking changes in external environment to

• never allowing the sole use of "risk adjusted" metrics changes in risk appetite.

(like economic capital, RWAs and VaR) to lead us to lose

sight of the underlying nominal exposure behind each
Conclusion-Reflecting on the Journey
risk. Banks lose dollars, not economic capital— and the The key for National Australia Bank in advancing the RAF has
same can be said of shareholder dividend payments— so been:
we always seek to ensure visibility of unadjusted expo­
• identifying dedicated resources for accountability;
sures when discussing any risk.
• developing a standardised risk language around posture,
• integrating meaningful stress testing into the risk appe­
appetite, settings;
tite and planning framework, including setting limits
more systematically and drawing insights from the • aligning Risk with Strategy and Finance;

results, which is a task that is still a work in progress; and • fully engaging Risk as key participant in the planning

• balancing coverage of credit risk (our largest single process;

risk type), with other material risks (such as operational • continuing to develop thinking around the RAF by
or reputation risk), which are less easily quantified or engaging with the key stakeholders; and
described. As with stress testing, this is still a work • seeking ways to broaden the view and understand­
in progress. ing of risk appetite so others feel more engaged in its
development.
Where We Go from Here-Further Increasing the The benefits from the advancement of our RAF and the align­
Value of the Risk Appetite Framework ment on issues of strategy, finance and risk have elevated the
The journey never ends. Whilst we have made progress, we quality of debate around risk profile and the linkages with the
are of the view that further enhancements can be, and will current and targeted risk profile. Our approach has been to
be, made to our RAF to increase its effectiveness within the develop our risk appetite framework in a manner which meets
Group. In recent discussions with stakeholders, including our organisational needs, reflecting our experiences and our
Board members, a range of issues have been identified that level of maturity. We have taken an evolutionary approach to
would further enhance the impact of the RAS and associated ensure we bring the organisation along at a pace that will more
framework including: deeply embed the RAF into our organisational culture and
processes. We know that if we pushed the pace of change too
• further progressing the discussion around stress testing,
rapidly, and without the appropriate engagement and consulta­
scenarios and responses and incorporating this more
tion with the business units, our efforts would not be as suc­
robustly into the planning process;
cessful. We know this because we hear and observe many more
• continuing to complement the use of economic capital discussions and debates around risk appetite today than in the
with consideration of other key measures such as regula­ past. Our internal culture has aided the development of the Risk
tory capital and simple, unadjusted exposure; Appetite framework and at the same time, the Risk Appetite
• enhancing how the risk appetite shapes portfolios from framework assists in continuing to define, describe and shape
a top-down perspective, with analysis on why such deci­ our risk culture. The challenge is to remain vigilant to ensure that
sions would be taken— e.g., matching external risks with we continue to learn and adapt our thinking reflecting where we
portfolio shape and defining "where we want to be" are at and where we want to be. We cannot be complacent.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 69

Scotiabank-A Canadian Experience in through a risk lens. Risk managers across the industry began giv­
ing more consideration to defining risk appetite as a guide for
Setting Risk Appetite May 2011
decision-making— to frame how much risk their firms were will­
The year 2008 marked a strategic inflection point for the ing to take on in the context of executing their business strate­
world's view on "risk." The financial crisis compelled the gies and in the drive for value.
Risk Management discipline in global financial institutions to
A t the tim e, Scotiabank participated in a Canadian bench­
re-assess every method and assumption em bedded in their
marking survey, conducted by D eloitte, as one input to
processes. Three years later, we can all reflect on how financial
defining appropriate practices. The study confirmed that risk
institutions have evolved their risk frameworks, including, to
appetite was an active area of focus for the banks and that
various degrees, a deliberate, robust and clear expression of
formalization would take the form of a Board-approved fram e­
"risk appetite."
work with ties to capital m anagem ent and other management
This case study captures the challenges and lessons in the activities.
design and implementation of a Risk Appetite Framework at
There is general industry consensus on the meaning of "risk
Scotiabank (the Bank). Today Scotiabank considers implementa­
appetite" and the importance of distinguishing it from risk
tion of their Risk Appetite Framework to have been successful.
capacity. The broadly held view is that risk appetite is an expres­
For perspective, however, Scotiabank was not starting at the
sion of the desire to take risk and, implicitly, a statement of
beginning. It already had a risk appetite position embedded in
how returns will be earned against that risk. It is, in effect, a
its strong risk culture that had served it well through the finan­
key part of the contract between senior management and the
cial crisis. Nonetheless, Scotiabank recognized the potential
Board . . . and the shareholders they represent. Risk appetite is
value of a more clearly defined, comprehensive Risk Appetite
clearly distinct from risk capacity, which is the ability of the firm
Framework based on governing financial objectives, risk prin­
to withstand risk events. However, that seems to be where the
ciples and risk appetite measures. Scotiabank integrated these
industry consensus ends. To date there is no common approach
key dimensions into an enterprise-wide framework, strength­
beyond definitions and key elements of a framework at the cor­
ening its overall approach to governing risk-taking activities.
porate level.
The Risk Appetite Framework was approved by the Bank's
Board of Directors in early 2010. The journey of evolving that
Framework continues. Setting Context
The Bank's most senior executives were actively engaged in
Enterprise Risk industry discussions relating to risk, implications of the global
crisis and the subsequent way forward for the industiy. Senior
In 2006 the Bank created an Enterprise Risk function with a man­
executives became involved in 11F benchmarking efforts, sup­
date of linking capital capacity, revenue and risk-taking across
ported by a broad cross-section of management.
the various risk types (e.g., credit, market, liquidity, operational
risk, etc.). The first priority of the new team was the develop­ The Enterprise Risk mandate was expanding in several ways. In
ment of appropriate and actionable risk metrics. From there, a addition to becoming central support for the EF benchmarking
comprehensive information package was developed for regular analysis, the team began integrating risk measures from across
reporting to senior management and the Board on all risks span­ the firm. They started to serve as a clearinghouse for all types
ning the entire Bank against key Board-approved risk limits, of risk information, and as a risk communications channel for
globally, creating a clear picture of the Bank's risk exposures. senior management and the Board. Without a more defined Risk
Additional priorities included further development of the Bank's Appetite Framework, however, the risk reporting lacked context.
credit risk strategy. With these developments, the Board was So the team conducted an internal assessment of what was in
more informed and could become more engaged. Together, place and confirmed the following:
these risk limits, and various risk reporting aspects, helped
• The Bank already had an implicit risk appetite embedded
senior management articulate to the Board the amount of risk
in its strong risk management culture. At Scotiabank, the
being taken at the institution.
risk culture is anchored in a long history of who we are as
By 2008 it was evident that a broader strategy was required. a lender, from our early days of financing North Am eri­
Risk Management at the Bank was still, to a large extent, siloed can Eastern Seaboard trade to the launch of our first per­
by risk type. The inter-connectedness of risks was only begin­ sonal loans in 1958, and continuing today with market
ning to be aggregated. And various dimensions of financial leading financing programs around the world. Our deep
performance and strength were not consistently being viewed experience in lending has embedded a focus on capital

70 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 preservation that spans the full spectrum of risk . . . mak­ Development of the next iteration of the Framework focused on
ing risk management a strategic priority shared by all a few key areas:
employees. Today, a key aspect of this culture is to be
• The context of the Bank's governing financial objectives
well-diversified across business lines, countries, products
and strategic principles;
and industries. Another key element of the culture is
• Articulation of Risk Management principles (qualitative
the relatively long tenure of employees. For example, of
attributes) that would guide the Bank's overall approach
Canadian-based managers— people in decision-making
in risk-based activities;
roles— over one-third have been with the Bank more
than 20 years. And the Executive Management Commit­ • Bringing into focus a limited number of risk measures
tee's tenure is even longer. Based on that deep experi­ that were considered essential objective expressions of
ence, senior management has a strong sense for what the Bank's risk profile, along with corresponding target
would be "offside" relative to the cultural norms estab­ ranges; and
lished over almost one hundred and eighty years; • Establishment of monitoring and reporting structures.
• Existing limit structures were, in effect, a network of Development of the Risk Appetite Framework was driven by
contracts already in place between Risk Management, Risk Management in collaboration with a broad range of stake­
the Business Lines and the Board on what risks could be holders. Finance was a pivotal partner in the work as they had
taken, or not; and overall management of the Bank's Balanced Scorecard (more
• Business lines clearly owned risk, complemented by highly recently moved to the Strategic Planning Office). As well,
centralized decision-making on risk policy setting and sig­ Global Human Resources ensured that employee incentives are
nificant transactions through executive committees. linked to performance, and that risk performance is taken into
consideration. Engagement of senior management in the Busi­
However,
ness Lines was a key part of the review and approval process.
• The existing limit structure was com plex and not codi­ The Bank's Asset & Liability Committee served as the forum
fied in any way that made it straightforward to com­ for review prior to presentation to the Executive Management
bine and report the total risk taking activities to the Committee, and ultimately the Board.
Board; and
The approach could be relatively expedient based on a few
• There was no explicit statement of the objectives
factors:
and principles that governed the Bank's decisions for
risk-taking. • The well-established risk culture;

Most experts on "risk appetite" acknowledge that the develop­ • The independence of the Risk Management oversight
ment of a framework should engage senior management in the function; and
Risk Management function and in the Business Lines, as well as • The specific limits to be brought into the Framework
the Board. However, the biggest obstacle to developing the could be largely to be drawn from the network of exist­
framework and implementing it can be the lack of consensus on ing controls.
what risks are appropriate for the firm and the extent of controls The Framework that emerged from the discussions had two sides: a
needed to mitigate the risks. So, when there is broad apprecia­ qualitative, principles-based component, and specific risk measures
tion of an established risk culture along with specific risk-based in key risk disciplines. More specifically, the structure was under­
contracts already in place between the stakeholders, the task pinned by sound risk governance, followed by the Risk Appetite
of designing and implementing a risk appetite framework is Framework itself. The use of risk management techniques was con­
already well advanced. sidered to be another key component, including the strategies, pol­
icies, limits, processes, measurement and monitoring tools which
Diving In Risk Management implements. These risk management techniques
are deployed across the spectrum of risk disciplines covering credit,
The first iteration of the Risk Appetite Framework involved
market, liquidity, operational and reputational risk. Finally, the
selection of existing quantitative metrics (covering Board-
entire structure is underpinned by the Bank's strong risk culture.
approved risk limits, performance targets and capital targets) as
key indicators of the Bank's risk appetite and actual risk profile.
Operationalizing the Framework
The indicators were consolidated and incorporated into the
Capital Management Policy. By the end of 2008, however, it was With the Framework generally agreed upon, the risk measures
evident that a more complete policy was needed. were operationalized through quarterly monitoring, including

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 71

comprehensive Board reporting. This practice helped to • avoidance of excessive concentrations, and
consolidate risk reporting and to bring into focus the Bank's • ensuring that risks are clearly understood, measurable
performance on the risk contract between management and and manageable.
the Board.
2. Strategic Principles provide qualitative benchmarks to
Functionally, the Bank implemented the principles component guide the Bank in its pursuit of the Governing Financial
of the Framework by referencing the Framework in policies such Objectives, and to gauge broad alignment between new
as the Capital Management Policy and by communicating the initiatives and the Bank's risk appetite. Strategic principles
risk appetite principles to the Board, Executive, Senior Manage­ include:
ment and shareholders via the "Management's Discussion &
• placing emphasis on the diversity, quality and stability of
Analysis" section of the Annual Report.
earnings;
Through established policy groups, the Framework was cas­ • focusing on core businesses by leveraging competitive
caded to major international subsidiaries. advantages; and
The Framework was initially socialized externally with local regu­ • making disciplined and selective strategic investments.
lators and at a "College of Supervisors" and was included in 3. Governing Financial Objectives focus on long-term share­
presentations with rating agencies.
holder value. These objectives include sustainable earnings
By 2010, formalized processes were being put into place for growth, maintenance of adequate capital in relation to the
ongoing internal discussion. Annually, the Framework is now Bank's risk profile and availability of financial resources to
shared with the senior team responsible for Bank-wide strategic meet financial obligations on a timely basis at reasonable
planning development—the Strategy Working Group— which is prices.
made up of Senior Vice Presidents and C FO s for the Business 4. Risk Appetite Measures provide objective metrics that
Lines and Corporate Functions. As well, the Framework has gauge risk and articulate the Bank's risk appetite. They
become a lens for reviewing the strategic plans of each Business
Line in the Executive Management Committee's annual strategic
planning process.

Evidence of Change
The value of formalizing the Risk Appetite Framework is best
illustrated by the change in Scotiabank's Annual Report to
shareholders. Prior to 2008, there had been no discussion of risk
appetite. By 2010, the Annual Report contained several pages
directly connected to the new Risk Appetite Framework, cap­
tured here:

In discussing Scotiabank's overarching Risk Management Frame­

work, the Bank is now more able to enunciate the relationship of
risk governance, risk appetite and risk management techniques
and the foundation of these in the Bank's strong risk manage­
ment culture.

2010 Annual Report Risk Management _ ^ ^. .

. Strategic Principles
The Report notes that the Risk Appetite Framework consists of
four components and elaborates on each:

1. Risk Management Principles provide the qualitative founda­

tion of the Risk Appetite Framework. These include:
11 Risk Appetite
Framework
\

• promotion of a robust risk culture,

• accountability for risk by the Business Lines, Governing Financial Risk Appetite
Objectives Measures
• independent central risk oversight,

72 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 provide a link between actual risk-taking activities and the evolve from reliance on the culture and norms, to embedding
risk management principles, strategic principles and gov­ the Framework as the more clearly defined and rigorous context
erning financial objectives. These measures include capital for decision-making.
and earnings ratios, market and liquidity risk limits and
As for "the right balance," there still needs to be linkage
credit and operational risk targets.
between the high-level principles and metrics as expressions
of risk appetite at the top of the Bank and the risk indica­
Strategies, Policies Guidelines, Processes tors and limits deployed at a business unit level. While some
8t Limits Et Standards
measures of credit and market risk have been allocated to
businesses, others, including most measures for operational
risk are not easily aggregated, nor divided. As such, the Bank
Risk Management (and the industry) continues to work at an effective way to link
Techniques
certain "top of the house" measures with business specific risk
performance measures.

Measurement, Additional work also remains to further integrate the Risk A p pe­
Monitoring tite Framework with other risk policies and the enterprise-wide
8t Reporting
stress testing program.

Ultimately, Scotiabank's test of an effective Risk Appetite

• Risk management techniques are regularly reviewed and
updated to ensure consistency with risk-taking activities, and Framework is that it fits the organization; the Board under­
relevance to the business and financial strategies of the Bank stands it; management is having good discussions reflecting
both qualitative and quantitative measures; decisions are made
Key Benefits, Challenges and Future and action is taken; and sustainable long-term earnings growth
Considerations is achieved.

The Framework is envisioned as a living document that will

undergo periodic review and update. The Bank considers it to Risk Appetite Framework Development
be an evolving guideline that will continue to be disseminated at the Commonwealth Bank of Australia
internally and which will find expression in additional policies,
strategies and risk management practices in the future. Background
The biggest benefits of defining the Risk Appetite Framework Within the Commonwealth Bank of Australia (CBA) Group, risk
for Scotiabank have been that it provides greater transpar­ appetite had always been part of the risk vocabulary. However,
ency of the key objectives, principles and measures defining historically there has been little documentation of a formal
the Bank's appetite for risk in the pursuit of value, and it has framework. During the mid-2000s some attempts had been
enabled greater awareness and more effective communication made to define the framework but it was not until the appoint­
with internal risk decision-makers and external stakeholders. ment of the new Group Chief Risk Officer in 2008 and the
actions of an energetic Board Risk Committee chairman that
This "case" captures how the development of a strong and
the need for a formal, Board-owned risk appetite foundation
functioning Risk Appetite Framework can be accomplished in
gathered real traction. Consequently, a project to develop a
the setting of a strong, existing risk culture where there is a
risk appetite framework was launched at the start of 2009 and
deep network of established controls, limits and risk oversight
this case study covers the various stages of its development
structure. The development of the Framework was the straight­
to date.
forward part. Work continues on key challenges around imple­
mentation and further alignment.
What Do We Mean by Risk Appetite?
The key challenge continues to be a combination of 1) aware­
The first challenge was to understand what was meant by risk
ness and application of the Framework within the Business
appetite. Internal discussions revealed many different interpreta­
Lines, and 2) finding the right balance between broad principles
tions of what was meant by risk appetite. Furthermore, publicly
and granular guidance for day-to-day decision-making with line
available disclosures from banks and financial institutions around
management throughout the Bank.
the world also appeared to use the term in different ways.
In terms of awareness, the program was launched with "road Annual Reports often referred to "acting in accordance with risk
shows," but more communication work needs to be done to appetite," but nowhere was the risk appetite defined.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 73

We felt that part of the reason for the lack of traction in previous and, just as important, how we could establish the Board's views
attempts to establish a risk appetite framework was the lack of a on this.
common definition of "in what terms" risk appetite was defined.
A clear conceptual definition was therefore required. Board and Management Engagement
This led us to define risk appetite as: "The types and degree The Group's risk appetite needs to be owned by the Board. We
of risk the Group is willing to accept for its shareholders in its were aware that getting effective engagement and ownership
strategic, tactical and transactional business actions." That is, of the Board depended on us taking the Board along the devel­
appetite was expressed as a boundary on risk taking activities opment road with us rather than either presenting a document
that defines where we do not want to be, rather than where we for them to rubber stamp or other actions that lowered Board
want to be. We liken it to the outer boundary markings on a member personal investment in the outcome.
sports field-we don't mind where you play as long as you don't
Our approach was to have a series of structured conversations
go outside of this boundary.
over a period of months with the Board. The first of these was
This contrasts with the amount of risk you are able to take (a conducted as an interactive voting session to gather anonymous
capacity for risk taking), the amount of risk you wish to take (a views from all Board members on a number of key questions
target for risk taking) and, of course, the actual risk profile (the regarding outcomes for the Group that they would be least will­
amount of risk you are actually taking). All these alternative ing to accept. This involved selecting various absolute measures
expressions add characterisation to our risk taking capabilities as well as ranking various potential outcomes. Where answers
and exposures. were not well aligned between Board members a staff-facili­
tated discussion was used to arrive at an acceptable consensus
If the role of risk management is thought of in terms of both
view. We found that questions requiring ranking of choices
protecting the organisation from unwanted outcomes and
added clarity of insight on Board appetite. A fear by staff that
advising the organisation on how to optimise its risk/return out­
the Board would collectively adopt a highly conservative risk
comes, then risk appetite is supporting the protection role of
outcome did not happen, but we prepared the Board by talking
risk management; the optimisation of risk and return is part of
about appropriate risk-taking as key to profitable growth.
the advisory role of risk management and is addressed by assist­
ing business set their target risk profile. Armed with this base input we were able to translate the Board's
views into what we believed was the risk appetite that they had
Monitoring risk levels then becomes one of monitoring the
expressed. This was written up and presented back to the Board
actual risk profile against target levels that have been set to
as a draft Risk Appetite Statement for their further discussion and
optimise risk-adjusted returns within the risk appetite boundary.
refinement over a series of further Board meetings. In the latter
This is illustrated in Figure 4.1.
stages nuancing of the words became more and more prevalent,
The Group actively uses these types of "spider" diagrams in its but by starting the Board engagement without a draft document
business unit and Board dashboards to good effect. the initial conversations had concentrated on the concepts rather
With a clear concept established, we could turn attention to the than the words.
terms in which we should express the risk appetite boundary The same interactive voting session was first trialled with a sub­
set of the Group's management Executive Committee. Interest­
ingly, the views of management were less well aligned than they
were amongst the Board members.
Spare Risk Risks actively
Capacity sought
Content of the Group Risk Appetite Statement
At C BA the risk appetite is defined by a combination of the
Dimension 5 Dimension 2
Group Risk Appetite Statement (RAS) and the supporting Group-
BOUNDARY
(APPETITE)
level risk policies, such as the credit concentration policies, which
define specific limits aligned with the RAS principles and metrics.
Actual Risk r
f Target Risk Profile
Profile / l (Strategy) The RAS covers three important areas:
Dimension 4 Dimension 3
® CBA Group • The conceptual definition of risk appetite for the Group;
F ig u re 4.1 T h e risk a p p e tite co n ce p t in C B A • Risk Culture; and

74 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • The risk-taking boundary— specific boundaries exposures/outcomes that we do not wish to experience but
(expressed in both quantitative and qualitative terms) for recognise are not 100% preventable. Where they arise the RAS
major risk drivers, together with expressions on how par­ commits us to take rapid and comprehensive action to minimise
ticular risk types are controlled. the chance of reoccurrence.
Having an appropriate "Risk Culture" is viewed as absolutely key Having developed the content of the Group RAS with the
to effective risk management. The RAS sets down a high-level Board, an important second step was to validate the alignment
statement of intent with regard to risk, i.e., what we stand for of the existing Group-level risk policies, and in particular the
in risk terms (e.g., the business, not Risk, manages and own the limits contained within those policies, to the RAS. These poli­
risks), and the expected behaviours of employees with regard to cies complete the definition of the overall risk appetite. The
risk. The aim is to ensure that the right people own the risk and RAS metrics are now one of the key drivers of the limits that
support the desired risk outcomes. are included in risk policies, for example, the counterparty,
The approach to defining the culture was no different to the industry and country limits within the credit concentration policy
other content in the RAS— we asked the Board questions about framework.
the culture and behaviours they expected and then drafted
content that we thought reflected their responses. The result Cascading of the Risk Appetite
was a single page containing around 10 cultural and 6 behav­
By necessity, the Group-level risk appetite is high level and
ioural principles relating to risk, which was edited based on
requires translation into more specific and meaningful terms for
Board responses to it. Exam ples of the types of topics that we
a particular business unit.
cover are the need to understand and appropriately price for
risk and a culture where it is safe to call out mis-management of The approach to this was to make the head of each business
risk by others. unit— not the Chief Risk Officers of the business units—
accountable for developing an equivalent RAS for their business
In order to embed the desired culture there was a need to link it
unit. The RAS would need to be both aligned with the Group
to the remuneration system and this has been addressed in two
risk appetite but also specific to the characteristics of their busi­
main ways:
nesses. This responsibility was an important part of the cultural
The Board asked, as one element of aligning with the regula­ change, with the business themselves rather than Risk Manage­
tor's requirements, that risk management opine on compliance ment being responsible for the risks being taken on and for their
with these principles for their consideration in setting executive outcomes.
incentive awards; and
Board members read these documents to test their specificity
The Group's internal staff performance review system opens to the activities of the business unit, and also as a lens through
with the requirement to consider whether an individual's key which to view the strategies presented by businesses.
performance has been achieved by operating within the culture
and boundaries of the Group's and the relevant business units'
RAS.
Bedding in R A S
The risk-taking boundary includes qualitative expressions of requires c a s c a d i n g
"risks to which the Group is intolerant" together with more
Principles Supporting limits
quantitative limits for key financial outcomes for the Group.

The "intolerant" concept arose from conversations with the

Board and management about incentives and consequences <
Qi_

of operating outside of appetite. If we were to say that we had Q_

•

n>
CD

zero appetite for particular risks (e.g., fraud) and we aligned o

n
-n

performance assessment and incentives to operating within —

oT
appetite, then a fraud incident should have remuneration 3
n>
CQ

implications. This could create the wrong behaviours (either

spending disproportionately on preventing fraud or non­
reporting of fraud incidents) and so, rather than talk about zero
appetite, the concept of intolerance was developed. These are F ig u re 4 .2 Risk a p p e tite co m p o n e n ts and cascad in g

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 75

Link to Strategy • By setting clear Risk Culture expectations in the Group
RAS and putting ownership for developing business unit
A major element of the overall risk appetite framework is the
RASs on the heads of the business units (rather than the
interaction between risk appetite and strategy. The formal align­
business unit risk teams), there has been a cultural shift
ment and interaction of these two elements had not previously
in the ownership of risk from Risk Management to the
been built into the operations of the Group.
businesses. Business units now act with clearer responsi­
The first point of connection is that both appetite and strategy bility (ownership) for the risk they take on.
should be aligned with the Group's vision and values. Beyond
• The incorporation of the review of risk appetite as part
that the appetite is setting boundaries on risk taking activities
of the strategic planning process, and the presentation
while strategy is seeking optimal use of the Group's resources
of strategic plans, formally accompanied by recently
in response to the evolving environments in which we oper­
agreed upon risk appetite statements, to both manage­
ate. Each should be challenging the other. Equally, reading one
ment and Board has brought risk appetite considerations
should give knowledge of the other. These concepts are illus­
form ally into key decision making and strategy setting
trated in Figure 4.3.
discussions.
The building of the consideration of risk appetite into the • The understanding of the interaction of strategy and
Group's formal strategic planning process has been a significant risk appetite has changed previously held views that
step forward. However, it is not just in a formal way that risk risk appetite was a barrier to progress, and in particular
appetite has impacted decision making across the organisation. that it could not be challenged or changed. A lot of
The referencing of decisions as being aligned with or outside work has gone into explaining the connection between
risk appetite is now becoming part of the everyday conversa­ strategy and appetite and the important way that they
tions around the bank. Even more gratifying is to hear people are brought together in strategic planning, to give both
often talk of the need to reassess the risk appetite in light of management and the Board transparency over decisions
opportunities that are presented, which creates an evolving and either to amend the strategy to align with the existing
productive challenge to current RASs— leading to keeping RASs appetite, or the appetite to allow the proposed strategy.
fresh and appropriate. The joint consideration and refinement of strategy and
risk appetite is now part of business as usual. (See the
Successes to D ate "Assess & Revise" arrows in Figure 4.3.)
There have been several aspects of the development of risk • By establishing clear boundaries, Business units under­
appetite that have worked well and translated into meaningful stand what is outside appetite and therefore do not pur­
benefits for the Group: sue these opportunities, leading to a reduction in both
wasted effort and frustration.
• Firstly, the approach to engaging with the Board led to a
strong sense of ownership and a depth of understanding • By bringing the requirement to operate into align­
of risk appetite by the Board that would not otherwise ment with the Group and local risk appetite statements
have been achieved. into the performance management and remuneration
framework, risk appetite has achieved a high level of
awareness and influence on behaviours. Key behaviours
Bedding RAS in... are found in the Group RAS, e.g ., responsibility to raise
Links it to other critical elements in a risk framework issues, protection for doing so and "no harm" to people
CBA Group Vision and Values who raise false-positive issues.

0 4

Group Strategic Plan

Assess
et Group Risk Appetite Continuation in the Evolution of Risk Appetite
Revise Statement/Policies
Although considerable success has been achieved in the risk

$: K J appetite journey so far, we are cognisant that there is more

BU1 | to be done in developing the maturity of risk appetite across
BU [ BU2 | Business Unit
Risk Appetite the Group.
#
Strategic BU3
fitoup v
BU 4
Plans Statement/Policies
• By necessity, the Group RAS is high level and principle
Fiq u re 4 .3 T h e critical link b e tw e e n a p p e tite and based in nature. The challenge is in cascading this
strateg y. to lower levels in a way that makes it meaningful in

76 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 day-to-day decision making on the front line. Business • The incorporation of stress testing outcomes into the
units are developing risk parameters for lower level contextual setting of risk appetite is an area that we con­
portfolios/products that will translate the limits/prin- tinue to develop.
ciples established in the Group and business unit RASs
into meaningful limits for staff working in these areas. Summary o f Key Lessons Learned
This will allow a more granular inclusion of RAS con­
As the risk appetite has been developed a number of lessons
sideration into performance assessments and incentive
have been learned, the foremost of which include:
payment outcomes.
• Without sponsorship from the top it is difficult to get
• There has been some initial reluctance by some busi­
traction in developing a risk appetite framework.
ness units to set the hard quantitative boundaries
required to help define risk appetite. This may be • Without a clear conceptual definition of risk appetite
partly due to the presence of a formal policy limit set­ there are many confusing and ineffective discussions
ting fram ework, plus a previously held view that once about risk management and we fail to get business buy-
set, RAS quantitative boundaries would be difficult to in to the framework.
change. (The Board actively assists in this matter by • The conversations around risk appetite are equally as
engaging on proposed changes out of cycle to the important and beneficial as the actual Risk Appetite
annual RAS review process.) Further work is needed Statement document produced from them.
to include more specific quantitative boundaries for • Culture is a fundamental part of risk appetite and to the
these businesses. success of embedding risk appetite in the organisation.
• Further development is ongoing in adding clarity to busi­ Taking the time to craft descriptions of what risk appetite
ness unit RASs and strategies so that they become more the Group and business units have for variance in risk
overtly complementary and aligned. culture breathes life into risk culture.

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 77

Banking Conduct
and Culture
A Permanent Mindset Change

Learning Objectives
After completing this reading you should be able to:

Describe challenges faced by banks with respect to Assess the role of regulators in encouraging strong conduct
conduct and culture and explain motivations for banks to and culture at banks, and provide examples of regulatory
improve their conduct and culture. initiatives in this area.

Explain methods by which a bank can improve its corporate Describe best practices and lessons learned in managing a
culture and assess progress made by banks in this area. bank's corporate culture.

E x c e rp t is rep rin ted from Banking Conduct and Culture: A Permanent Mindset Change, by the G 30 W orking G roup, 2018.

79
INTRODUCTION management, and supervisors, and promised to provide an
update on the progress major banks have made in implementing
This year marks the tenth anniversary of the 2008-09 global our recommendations. This report provides that update.
financial crisis, an event that put banking culture and conduct We focus on two fundamental questions: (1) How much progress
under the global spotlight. In the previous installment of our has the banking industry made in culture and conduct (Box 5.1)
series of reports on this topic, Banking C o n d u ct and Culture— A since the financial crisis, particularly since our last report?, and
Call for Su sta in ed and C om preh en sive Reform (2015), we put (2) Where do we go from here? That is, in what areas should
forth a set of recommendations for banks, their boards and banks continue to press on, and what evolving questions should

BOX 5.1 DEFINITION OF CULTURE AND CONDUCT

In our 2015 report,* we defined culture as the mechanism that influenced by the less tangible elements, such as the bank's
delivers the values and behaviors that shape conduct and con­ unspoken rules, ideas, norms, and subconscious beliefs that
tributes to creating trust in banks and a positive reputation for lie beneath the surface.
banks among key stakeholders, both internal and external.
Managing culture thus requires understanding visible con­
We used a fram ework that identifies key factors that deter­ duct and behaviors as well as the complex web of influences
mine two broad outcomes for a bank: (a) client and stake­ that lie beneath them.
holder perceptions about the bank's reputation and services,
While conduct can be evaluated as good or bad, culture
and whether the bank builds trust (among stakeholders
itself cannot be. The culture of each firm is unique to that
including em ployees, society, government, and supervisors);
organization and it is not empirically right or wrong;
and (b) financial performance, which rewards shareholders.
rather, it has to be right for that organization. In that same
To achieve these outcomes, the bank starts with its history
vein, firms that have had conduct issues or scandals do not
(client franchise, brand, technology, and financial resources),
necessarily have an overall bad culture but have elements of
defines a purpose or strategy for the institution, and devel­
their culture that are misaligned with the outcomes the firm
ops a unique culture that is the summation of values and
is seeking and that are driving undesirable or inappropriate
ethics, desired conduct standards, and implied behaviors.
behaviors. That is why it is so important to focus on both the
Figure 5.1 provides a schematic summary of this framework.
overall culture and all of the elements that comprise culture.
Culture comprises not only conduct and behaviors, but also Culture is complex and is made up of multiple structural
the bank's values and ethics. While cultural norms and beliefs elements (such as processes, policies, organization, and
cannot easily be measured, the conduct and behaviors that technology) and multiple human elements (such as norms,
the cultural norms encourage or discourage can be. In fact, expectations, beliefs, and values), all of which must be
conduct can and should be observed, monitored, managed, aligned with one another and with the desired outcomes in
and incentivized. It is important to remember that while con­ order for the culture to work for the firm.
duct and behaviors— that is, what people actually say and * Source: Banking Conduct and Culture - A Call for Sustained and
do— are the only visible elements of culture, they are directly Comprehensive Reform, Group of Thirty, Washington, D.C., 2015.

INPUTS OUTCOMES

C U LT U R E C LIEN T & S T A K E H O LD E R
P E R C E P T IO N S

Conduct & Values &

Reputation Trust
behaviors ethics

BAN K P U R P O S E & S T R A T EG Y FINANCIAL P ER FO R M A N C E

BANK HISTORY

Figure 5.1 Elements of a unique bank culture.

80 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
they be mindful of going forward? 85
To address these questions, we inter­ 80
viewed a significant number of C EO s,
75 74
board members, and senior executives
at major banks across the globe, as well - - 70

as a number of supervisory institutions 0) 65

>
and industry standards bodies. We o f62lf62l
60
also drew on other sources including 3
OT

55
insights from Oliver Wyman's global
practice. 50

45
O ver the last decade, bank culture
and conduct have received increased 0
attention from bank management 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

and their supervisors, clients/ Banks Consumer goods Media Automotive

customers, and investors. Supervisors, Energy Health care Technology
regulators, and governments globally Fiqure 5.2 Ed elm an Trust B a ro m e te r results by industry sector, 2 0 0 6 -2 0 1 8
have increased scrutiny of culture and
Source: Edelman Trust Barometer Archive.
conduct issues; since the financial crisis,
the banking industry has paid an esti­ Note: Trust level results are distinguished between two populations: "Informed public" (ages 25-64,
collegeeducated, in top 25 percent of household income per age group/country), and "general
mated US$350 billion to US$470 bil­ population" (all population ages 18+). Due to differences in publicly disclosed results by Edelman,
lion1 in penalties (including fines and years 2006-2011 of this figure show informed public results; years 2012-2015 show a blend of
litigation/settlement charges) for informed public and general population results; and years 2016-2018 show general population
results.
conduct-related matters, evidence that
these so-called soft people issues can significantly impact the • Systematization of the roles of second and third lines of
bottom line. Both institutional clients and retail customers are defense in culture and conduct, and a push toward greater
becoming more focused on bank conduct and culture, driven by ownership of these concerns by the first line
highly publicized cases of conduct failures. Senior executives • Changes to business processes, including new prod­
and board members are increasingly expected to demonstrate uct approval and product governance, revised pric­
that conduct risk is understood and managed, and that appro­ ing approaches, improved whistleblowing mechanisms,
priate discipline and culture are being reinforced. and review of questionable market practices in trad­

A s a result, banks have invested significant effort in improv­ ing and hedging, all of which are signs that the conduct
ing their culture and conduct. With increasing appreciation of agenda is beginning to cascade down to the way business
the scope and scale of culture and conduct issues, banks have is done.

instituted many changes focused on improving their culture and Despite these efforts to improve conduct and culture, the
conduct. These efforts span both formal and informal measures banking industry still suffers from a negative reputation,
and include: and trust still needs repairing. According to the Edelman
Trust Barometer, the banking industry historically ranked
• Refinement and/or re-articulation of bank purpose and val­
among the most highly trusted industries since the end of the
ues, with subsequent establishment of extensive communica­
World War II; however, trust declined precipitously during the
tion and training programs
financial crisis, and today remains low compared to other indus­
• Heightened engagement at the board level on conduct and
tries and far from recovering to precrisis levels, as shown in
culture issues
Figure 5.2.
• Modification of compensation and performance management
The ongoing stream of conduct scandals, ranging from lapses
schemes to incorporate not just financial results but also
in customer protection to anti-money-laundering deficiencies
behavioral considerations
to manipulation of market benchmark rates to rogue trad­
ers, has called attention to the intimate link between conduct
1 Sources: Conduct Costs Project, Good Jobs Project, Oliver Wyman and reputation and continues to take a toll on the bank­
analysis. ing industry's reputation. The broad spectrum of topics and

Chapter 5 Banking Conduct and Culture ■ 81

geographies of recent scandals (see Figure 5.3) reveals that While some scandals are institution-specific, the reputational
conduct is not just an investment banking issue but an "all fallout is often not limited to the offending institution but has
banks, all g e o g ra p h ie s, all b u sin e sse s p o te n tia l issu e ," as one a contagion effect, impacting other players in the industry.
banking official put it. It is relevant to all banks globally and to This shows that trust is an industry common good rather than
all lines of business within banks. (See Box 5.2 for the case of an institution-specific competitive advantage. Further, as scan­
Australia.) dals are often revealed retrospectively rather than in real time,

Note: AML = anti-money laundering; BBSW = Bank Bill Swap Rate; ETF = exchange-traded fund; EU = European Union; FX = foreign exchange;
IPO = initial public offering; LIBOR = London Inter-bank Offered Rate; 1MDB

82 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 the reputational overhang can live on long after the miscon­ are n o t " Banks have a small window to figure out how to man­
duct occurs, sometimes even after the specific issue has been age culture and conduct and regain the public's trust. Without
addressed. All this shows that while trust and reputation are earning trust every day, the continued survival of banks is at risk
easy to lose, rebuilding it is much more difficult. Even as banks from displacement by new industry entrants, a growing list that
continue their efforts to become more trustworthy, becoming includes fintech start-ups, technology firms, retailers, and tele­
trusted again will be a slower process. com companies.

Banks cannot afford to be complacent about their trust and In addition to the risk of client attrition, trust and reputational
reputational problems, especially in light of emerging com­ issues may over time also lead to problems in acquiring and
petition from alternative providers. As Bill Gates presciently retaining talent. For instance, young millennials continue to be
put it nearly twenty-five years ago, "banking is n ecessary; banks turned off by banks' reputational problems and are opting instead

IN G BANK
Money laundering: An investigation opened in 2016
has resulted in a US$900 million fine for failing to
prevent years of money laundering abuse.
ABN AMRO
r pumob notional bonk
CM U M IfK if

Mortgage fraud: Mortgage Fraudulent transaction:

advisors forged client signatures Issued fraudulent guarantees A B LV
in revised documentation on for diamond merchant firms Violated International sanctions
mortgages to withdarw unsecured loans against North Korea & bribed Latvian
from overseas branches official to prevent tougher AM L rules

W ELLS
FARGO
Commonwealth Bank
Fraudulent accounts: / D e u ts c h e B a n k
Opened millions of Money laundering: Money laundering: Failied
^ + ICBC
fradulent savings C5 fOCTAL s u r r a a v u t OF a < IM Negligence led to more to prevent a US$10 billion
& checking accounts Loan fraud: 19 banks granted loans than 50,000 breaches Russian money-laundering
without customer to criminals who illegally pledged of AM L & counterterriosm scheme, resulting in
consent gold of low purity as collateral aws worth US$ millions US$630 million in fines

i i i i i= f
2015 2016 2017 2018
* *
i i i
TD Bank
bsi. /tr
iJank < Danske
IALC0N PR!\AIL BANK
Unsuitable financial Aggressive sales Money laundering: C EO
Money laundering: Bankers targets: Increased resigns amid probe into
advice: Encouraged
participated in and coordinated overdraft protection US$200 billion money­
more than 3,500
money laundering activities linked amounts & credit card laundering scheme
clients to undertake
to corrupt Malaysian 1MBD fund borrowing limits without perpetrated at its
risky, inappropriate,
investments customer authorization Estonia branch
WKLLS
FARGO US
Coyrw ofi wealth Bark p AMP#-
"Forced" auto insurance sales: Fees for "no service":
Sold auto collateral protection Charged thousands of
insurance to more than 550,000 customers for financial
customers who did not need advice that was not
coverage delivered

Chapter 5 Banking Conduct and Culture ■ 83

 BOX 5.2 THE AUSTRALIAN CRISIS
As the current situation unfolding in Australia demonstrates, specific to APRA's review of CBA , the report contains lessons
the banking industry remains subject to further serious scan­ for the industry as a whole, and in fact, other banks are being
dals and fallouts. required to conduct a self-assessment against the specific CBA
findings. The key issues outlined in the review include:
In December 2017, Australian prime minister Malcolm Turn­
bull's government called for the establishment of the Royal • Lack of alignment between banking remuneration
Commission into Misconduct in the Banking, Superannua­ practices and frameworks and indicators of good conduct
tion and Financial Services Industry following revelations of
• Lack of senior leadership and board oversight on issues of
years of serious misconduct by Australia's financial institu­
conduct and culture
tions. Since the 2015 G30 report, egregious examples
of misconduct have surfaced, affecting one or more of • Inadequate oversight and challenge by the Board and its
Australia's "Big Four" banks* These include rate manipula­ gatekeeper committees of emerging nonfinancial risks
tion allegations (2015), unsuitable financial advice impacting • Unclear accountabilities, starting with a lack of ownership
thousands of clients (2015), weak controls to prevent thou­ of key risks at the Executive Committee level
sands of breaches of anti-money-laundering/counterterrorism • Paucity or nonexistence of sufficient internal controls.
laws (2018), and fees for no service (for example, charging
accounts of dead clients) (2018). As next steps, APRA has recommended that the banks
design and implement stronger remuneration practices that
These incidents have led to over US$700 million in penal­
will align with strong conduct and culture outcomes, and that
ties and compensation since the 2008 global financial crisis,
banks leverage the Banking Executive Accountability Regime
removal of senior leadership (at C BA and AMP), and numerous
(BEAR) to detail international best practices on strengthening
legal and criminal investigations. An interim report, released
conduct and culture.
in September 2018, noted remuneration practices and inade­
quate consequences as having been closely linked to issues of With the ongoing Royal Commission investigation and
conduct and culture, with more to come pending the final rec­ pending recommendations, as well as continued revelations
ommendations of the Royal Commission. The executive sum­ of retrospective misconduct among Australia's financial institu­
mary of the Interim Report of the Royal Commission points to tions, we anticipate that the Australian banking industry is only
greed as a central issue, resulting in "the pursuit of short-term beginning its long journey to repair its conduct and culture.
profit at the expense of basic standards of honesty" (p. xix). • National Australia Bank (NAB), Commonwealth Bank of Australia
Separately, the Australian Prudential Regulatory Authority (CBA), Australia and New Zealand Banking Group (ANZ), and West-
(APRA) concluded in April 2018 its prudential inquiry into pac (WBC).
C BA and released a report that outlines key shortcomings in Source: "Why is Australia investigating its banks?," BBC News,
governance, accountability, and culture. While the findings are February 12, 2018.

for other sectors, as seen in the changing career destinations cho­ banks to be able to play their role in society, and to the stability
sen by MBA students post-graduation (Figure 5.4). Despite a of the broader financial system. Banks are held to a higher stan­
number of high-profile discrimination lawsuits, banks' efforts dard than many other service providers given that the services
focused on improving diversity have been minimally successful, as banks provide are viewed by many as a public good that ben­
diverse talent remains deterred by cultures they view as not efits society—that is, intermediating between sources and needs
supportive and attentive to their development and well-being.2 of funds and facilitating transactions throughout the economy—
Further, the shift toward digitization will continue to reveal gaps and the effects of failure extend beyond just shareholders, with
in banks' technology capabilities, pressuring banks to compete repercussions for the broader economy. Further, because bank­
for talent that is already in high demand by other industries. ing products and services can be complex and difficult to under­
stand, the public expects banks to provide good advice based
This and similar trends may spark concerns about potential
on expertise and in the clients' best interest.
talent shortages in an industry that is highly dependent on its
human resources as a competitive differentiator. And yet, many banks that devote considerable attention to their
business strategies and actions spend insufficient time thinking
Bank culture and conduct are more important than ever,
about their purpose and the role they play in society. Despite
to repair trust and reputational issues and fulfill the role
the trending notion of balancing stakeholder needs and the
o f banks in society. Sound culture and conduct are critical for
argument that, over the long run, putting the customer first is
2 "Why Diversity Programs Fail," Frank Dobbin and Alexandra Kalev, the best way to drive sustainable shareholder value, shortterm
Harvard Business Review 94 (7) (July/August), 2016. trade-offs often confront banking executives, in which doing

84 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Finance

Consulting

Technology

Investment Banking* * “ Investment Banking” is a subset

of the “ Finance” category. MBA =
0 10 15 20 25 30 35 40 45 Master of Business Administration.
Percentage of MBA graduates entering each industry

■ 2007 ■ 2013 ■ 2017

Fiaure 5.4 C a re e r d estin a tio n s ch o sen by M B A stu d en ts.

Sources: 2007 and 2013 data: "Business education: Banks? No, thanks!," The Economist, October 11,2014. 2017 data: average
employment data from Chicago Booth, Wharton, Harvard, London, and INSEAD.

what is best for customers may lead to less immediate profit or • Have things really changed? Skeptics wonder whether true
more immediate cost.3 In such situations, clarity of purpose is change is possible in an industry that maintains large poten­
critical to enable executives to resist the temptation of near- tial upsides to pushing the boundaries, and point to the
term gains, and to make decisions for the long run. Banks must example of Wall Street in 2017 recording its highest bonuses
understand, reinforce, and internalize their key economic and since 2006.4 In addition, despite banks implementing many
social purpose and improve their culture and conduct to fulfill process and policy changes to mitigate misconduct, culture
that purpose. and conduct have yet to be fully embedded in many banks in
how they do business, and conduct issues are still observed
Responsibility for ensuring the organization's ability to bal­
in banks worldwide. Others are concerned about the passage
ance purpose and profit ultimately resides with the board and
of time dimming the effect of the lessons learned during the
the C E O . Under the rubric of culture, as with other aspects
global financial crisis, and of the possible return to old prac­
of business performance, the board should see it as its key
tices, especially if interest rates rise, regulation is lessened,
responsibility to set the right tone and reinforce the desired
and other business conditions improve. As post-global finan­
culture, and to oversee the bank's efforts to sustain a healthy
cial crisis regulations are potentially rolled back (in some juris­
culture. In addition to the board, the chief executive should
dictions), firm-level focus on conduct and culture (by the
have a comprehensive awareness of the overall tone and know
board and senior leaders) must take on even greater
what is happening under his or her watch. An expectation that
importance.
senior management should invariably be aware of every depar­
ture from desired behaviors would, of course, be unrealistic, • Potential for culture and conduct fatigue. Especially in
inappropriately implying a reversal of the burden of proof. But some geographies where there has been a long-standing
it is a specific responsibility of the board and senior manage­ focus on conduct and culture problems, we detected some
ment to put in place robust processes to identify and ensure desire to move on and get on with business. Banks cannot
appropriate escalation of behavioral breaches. Such processes think of culture and conduct as separate from business,
should be designed to be auditable and the subject of regular or as merely soft or HR-specific issues. They are business,
monitoring by internal audit as a key ingredient of the third line that is, how business needs to be done and the means by
of defense. which banks can achieve continued success and sustain­
ability. For culture and conduct initiatives to be success­
Despite significant efforts, many still voice concern about the
ful, they need to become internalized as a way of doing
industry's ability to make profound and lasting change. In our
business rather than a program that is created and then
interviews, industry leaders voiced several questions and con­
ignored. Conduct and culture must be understood by all
cerns about culture and conduct:
em ployees.

3 Balancing stakeholder needs with putting the customer first ultimately 4 "NYS Comptroller DiNapoli: Wall Street Profits and Bonuses Up
improves company success, so no trade-off between customers and Sharply in 2017," Office of the New York State Comptroller, March 26,
shareholders should exist. 2018; http://www.osc.state.ny.us/press/releases/marl8/032618.htm.

Chapter 5 Banking Conduct and Culture ■ 85

• Shift in relevant management and leadership capabili- embedded bias in automated black box systems and artificial
ties. Many leaders reported that historically, the banking intelligence (Al).
industry managed the business and the people primarily via • Rolling bad apples. Individuals with poor conduct records
quantitative metrics (for exam ple, volumes, sales, and prof­ move from one bank to another. Can issues truly be resolved
its), which were relatively straightforward to assess. In the and addressed at the industry level if "bad players" can
context of the increased emphasis on culture and conduct, simply move from one institution to another with impunity?
however, there is greater need for management acumen What can the industry do to address this? Are there lessons
and skill as banks start to manage not just the "w hat" but from other professional industries (for example, legal, medi­
also the "how," which requires much more judgm ent as cal, engineering) that are applicable? Do laws defending
well as proximity to and involvement in the daily business employee rights clash with the industry's ability to protect
operations. Also, driving sustainable cultural change at large itself from toxic employees? The industry continues to grap­
organizations requires leadership capabilities that may not ple with these issues within the constraints of privacy and
have been a focus of developm ent in the past, such as more employment laws.
focus on soft people management skills rather than finan­
• Increasing scope for supervisory gaps and conduct
cial acumen. Finally, creating an environment of psycho­
arbitrage. As the thinking of financial authorities around
logical safety where all em ployees feel empowered to be
the world continues to evolve on conduct and culture, the
authentic, where diversity can thrive, and where challenging
divergence in supervisory approaches across jurisdictions
groupthink is encouraged will require greater management
is arousing concerns around conduct arbitrage, that is to
skills.
say large firms seeking to benefit from supervisory over­
• Shifting toward a more nuanced and effective style of sight in jurisdictions that may be less focused and demand­
management. This is especially difficult in many institutions ing. Further, Open Banking developments have started
given the leadership deficit they are facing. In fact, many to create some blurring of competitive lines across banks,
banks historically promoted their best producers/perform- technology companies, retailers, and telecom companies,
ers into management roles with minimal regard to ability or adding to concerns around fair competition and customer
interest in managing others (and often without regard to the protection.
individuals' values and ethics, sending a powerful message 'k 'k -k

in terms of the organization's priorities). And little time was

dedicated to developing management skills. A management This report is structured as follows. Section 1 presents industry
role was often considered a reward for a job well done rather progress on conduct and culture since the financial crisis, and
than a privilege, obligation, and responsibility to develop particularly since our 2015 report; section 2 outlines the lessons
others and ensure the long-term sustainability of the firm. learned; section 3 offers additional, specific recommendations
Banks are now realizing a leadership gap in middle manage­ reinforcing our 2015 recommendations; and section 4 explores
ment layers, with a lack of skill and capacity to manage the outstanding questions and opportunities for continued progress
"how" of performance, and limited ability to influence and in the future.
drive team member behaviors. A number of banks that have W hile this report focuses on banks as our primary audience,
historically underinvested in the management and leadership we note that non-bank financial institutions (for exam ple, pri­
capabilities that they require are now investing in leadership vate equity firms, hedge funds, and insurance companies) are
development to make up for lost time. also prone to conduct and culture issues that are similar to
• Evolving forces on conduct. While the definition of good those of banks. Certain issues may come into particularly sharp
conduct will stay the same, the pressure points will change focus at these institutions, such as the possibility of outsized
as the market and business models continue to evolve. financial rewards promoting excessive risk-taking behavior. We
Banks will be tasked with anticipating and addressing addi­ hope that, as has been the case with our previous reports on
tional scenarios for misconduct that may emerge, such as governance and supervision, the leadership and directors of
uncertainty in pricing contracts in the context of the London non-bank financial institutions will also internalize the lessons
Inter-bank Offered Rate (LIBOR) transition; new General learned and our recommendations. As Box 5.3 makes clear,
Data Protection Regulation (GDPR) requirements around conduct and cultural failures are not unique to banks— far
data usage, consent, retention, and portability; and risk of from it.

86 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
BOX 5.3 NOT JUST BANKS
Examples of corporate misconduct are not limited to the are rampant. During the tenure of its former C E O , Uber's
banking industry. Other industries worldwide, including man­ culture had serious faults and resulted in numerous inci­
ufacturing, automotive, and high tech, have exhibited various dents of misconduct, including deliberately undermining
forms and levels of misconduct, especially over the last few its competitors (for example, booking thousands of fake
years. As in banking, the root causes of misconduct stem Lyft rides, spamming Lyft drivers), underpaying its drivers,
from poor corporate cultures, inexperienced or self-absorbed using technology to deceive law enforcement, applying
managers, weak internal controls, and lack of safe escalation surge prices inappropriately, and stealing trade secrets
procedures. These have resulted in billions of dollars in fines, from Waymo (the Uber example is also an interesting case
criminal investigations and charges, leadership removal, and of social media turning on a company for its decisions/
loss of customers. behaviors, and the #DeleteUber movement showed cus­
tomers voting with their feet).
Two industries, in particular, automotive and high tech, high­
In December 2017, Apple admitted to slowing the pro­
light the similarities in environmental factors also observed in
cessors on its older generation iPhones, presumably to sell
the banking industry, which led to cultural breakdowns and
more batteries or new iPhones. Finally, Facebook has
eventually to misconduct issues.
demonstrated significant negligence in managing the pri­
• Automotive: In Germ any, in particular, several major vacy of millions of its users' data, as revealed in the Cam ­
incidents of misconduct have emerged from the bridge Analytica scandal in early 2018. Personal conduct
intentional manipulation of vehicular software to deceive of senior executives is also under scrutiny; in a one-month
emissions tests. In Septem ber 2015, the United States period in the summer of 2018, three C EO s in the chip
and Germany opened investigations into Volkswagen's/ industry resigned or were fired for conduct reasons (the
Audi's deliberate rigging of software on 11 million diesel- companies involved are Texas Instruments, Intel, and
powered vehicles worldwide between 2009 and 2015, Rambus).3
including 600,000 vehicles in the United States, to falsify
emissions levels to pass U.S. emissions tests. Investigators
further found active approval, engagement, and conceal­ Cross-industry lessons
ment of this program by the Volkswagen/Audi senior Upon examination of other industries that have suffered
leadership, including then-CEO Martin W interkorn. significant and systemic cultural breakdowns similar to
Consequently, Volkswagen has faced numerous federal those observed in banking, we identify five characteristics
investigations in both the United States and Germany; that these industries have in common and that might
criminal charges or arrests of senior leaders and manag­ provide insights into characteristics that lead to greater
ers, including Volkswagen's and Audi's C E O s; and over culture risk.
US$30 billion in recalls, legal penalties, and settlements
as of midyear 2018.1 In addition, German authorities are
1. Lack of diversity: Industry homogeneity in backgrounds,
education, gender, and racial/ethnic composition
investigating similar misconduct at Daimler, which faces a
remains prevalent and can foster groupthink cultures.
potential US$4.4 billion fine for illegal software in some
Such environments limit the number of challenges or
Mercedes-Benz m odels.1 2
alternative opinions required to effectively mitigate poor
It is worth noting that the German car executives
business decisions.
concerned received among the highest bonuses in the
country. 2. Presence of dominant companies: A few large, success­
• High tech: The high-tech industry has also struggled with ful players dominate these industries and may lead to
many reputational issues, allegations of misconduct, and deprioritizing culture, given that these companies have
been able to attract customers and talent due to their
loss of business due to actions that negatively impact key
dominant brands.
stakeholders (that is, customers and employees). In addi­
tion, the hightech industry overall has been plagued by 3. High dependence on specialized skills: High-quality,
extensive accusations of discrimination and mistreatment well-educated candidates with specialized knowledge
of female employees. The examples of cultural failings are critical in these industries. As a result, such individu­
als can often take on an outsized organizational role in

1‘ "Audi CEO Rupert Stadler arrested in Germany," CNN Money,

June 18, 2018.
3- "Texas Instruments CEO Resigns After Code of Conduct Viola­
2' "Germany threatens Daimler with 3.75 billion euro fine over tions," Maria Armental and Eliot Brown, Wall Street Journal, July 17,
emissions-Spiegel," Reuters, June 1, 2018. 2018.

(C ontinued)

Chapter 5 Banking Conduct and Culture ■ 87

 their influence and decision making and make it more annual wage for computer- and tech-related jobs is 77
challenging to fire such highly valued individuals even percent higher than the U.S. mean.4
in the face of egregious behaviors or inappropriate 5. Ineffective leadership and management skills: Board
decisions. Distorted views of individual's contributions members, senior leaders, and middle management of
can also lead to the cult of personality in many of these fast-growing and highly successful firms may over- esti­
firms. mate their own and their company's capabilities and be
4. Misaligned incentives: Performance and remuneration ill-equipped and too inexperienced to recognize poten­
schemes are often aligned with quantitative or financial tial risks and complexities of their operating and revenue
targets, which can inadvertently prioritize decisions that models. Hubris caused by a high degree of success can
lead to misconduct. In addition, average annual wages also cause individual leaders to believe their capabilities
for positions in these industries tend to be significantly and decisions are unassailable and they start to believe
higher than mean annual national wages; for example, in their own rhetoric.
the United States, the mean annual wage for financial
analysts and advisors is 107 percent higher than the U.S. 4- "National Occupational Employment and Wage Estimates," U.S.
mean annual wage across all industries, and the mean Bureau of Labor Statistics, Washington, D.C., May 2017.

SECTION 1. ASSESSMENT assessed, we observed significant gaps between the leaders

and laggards, with some institutions having made significant
OF INDUSTRY PROGRESS*• improvements while others still operate under the perception
of "it w ould n ever happen to us."
Our 2015 report outlined key recommendations for improv­
ing conduct and culture, across both the what and the how for • While progress in terms of inputs/efforts can be easily
banks to challenge their cultural foundation: observed, whether and how these inputs/ efforts actually
impact outcomes is difficult to prove. Even a reduction in
• THE WHAT. Banks should specify their cultural aspirations conduct breaches over time cannot be considered a con­
through a robust set of principles, and fashion mechanisms clusive indication of improvement, as seen by the number
that deliver high standards of values and associated conduct
of conduct scandals that persisted for many years and only
consistent with the firm's purpose and broader role in society. recently have come to light.
• THE HOW. Banks should work to fully embed the desired cul­ Given these considerations, we focus on the efforts and inputs
ture through ongoing monitoring and perseverance, drawn
of banks to improve culture and conduct, and we attempt to
from four key areas: senior accountability and governance, provide a range of views on progress across the industry.
performance management and incentives, staff development
and promotion, and an effective three lines of defense. That the industry mindset on culture has evolved was a point
of unanimous agreement across all our interviews. There is
Our specific recommendations are summarized in Table 5.1.
now collective appreciation of the importance of culture and
This chapter reviews the progress the banking industry has conduct, and the need to improve. But tangible industry prog­
made on conduct and culture since the financial crisis, particu­ ress has been slow, especially as the bar for good conduct
larly since our last report in 2015, with a specific focus on the continues to rise and the public continues to expect more from
recommendations above. Before we begin, two caveats: banks, and as levels of transparency (especially due to social
media) increase. While a number of individual firms have made
• It is not possible to holistically grade progress at a global
headway in implementing changes to formal and informal ele­
level, given the (sometimes very) significant differences
ments of culture, the industry as a whole continues to struggle
by geography and by each individual institution; for larger
to embed culture in a more fundamental manner, and to con­
banks, progress may even differ across businesses, offices,
clusively demonstrate the effects of these changes. Moreover,
and teams. For example, banks in markets directly impacted
there is a growing gap between firms that are applying a holis­
by the financial crisis (for example, the United States, the UK,
tic, multipronged approach with active board-level engagement
and Europe) experienced an immediate spotlight on culture
and firms that continue to focus more narrowly on misconduct
and conduct and have been on this journey for a decade,
management and compliance as the solution to cultural issues.
while banks in markets that escaped the financial crisis rela­
tively unscathed (for example, Australia) have only more Two relatively recent incidents in particular have attested to the
recently begun to focus on the issue. In many of the areas seriousness of the continuing cultural and behavioral leadership

88 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 5.1 Summary of 2015 Recommendations

Area Recommendations

1 Fundamental shift in a. Banks should look at culture and look to achieve consistent behavior and conduct aligned
the overall mindset on with firm values, as key to strategic success.
culture
b. Banks should reinforce the messages in their actions and in their internal communications.

c. Banks' behaviors and conduct should be open to constructive internal challenge.

2 Senior accountability d. Oversight of embedded values, conduct, and behaviors should receive regular attention in
and governance boards' agenda setting, given sensitivity to reputational risk.

e. Board charters should include responsibility for oversight of values and conduct.

f. Boards should build a reputation, values, and conduct risk tolerance dashboard to aid in their
evaluation of cultural issues.

g. If the Chair and C EO positions are not split, boards should ensure that the lead independent
director spends adequate time in the effective challenge role to the C EO on values and con­
duct issues.

h. The C E O and Executive team should be highly visible in championing the desired values and
conduct, and face material consequences if there are persistent or high-profile breaches.

i. The C E O should ensure that there is a thorough process that reviews the bank's brand and
reputational standing.

j. Asset owners and third-party fund managers should tell boards directly that they consider
effective governance and accountability to be a priority cultural matter for the firm and
investors.

3 Performance k. Compensation and promotion processes should ensure reflection of desired behaviors,
management and including consequences for weak management oversight or willful blindness.
incentives
l. A comprehensive set of indicators is needed to monitor and assess the adherence of individu­
als and teams to firm values and desired conduct.

m. Individual review and assessment of senior executives by the senior leadership and C EO is
required.

4 Staff development and n. Banks should buttress first-line skills and ensure that frontline management and leadership are
promotion properly trained in how to conduct judgment-based staff evaluation and deal with identified
breaches.

o. Banks should develop programs for staff across all areas of the bank that regularly reinforce
what the desired values and conduct mean in practice.

p. Institutions should formulate and implement a system-wide values and conduct evaluation
process for internal promotions and external hires.

5 An effective three lines q. Staff and management in the business (first line of defense) should shoulder the largest respon­
of defense sibility forjudging whether behavior is in line with the bank's values and desired conduct.

r. Banks should allocate clear second-line ownership to Compliance or Risk Management func­
tions and ensure that the designated function is on the Executive team.

s. Banks should provide assurance to all employees that reports of wrongdoing in the workplace
will be taken seriously and confidentially without reprisal. Banks should challenge the conven­
tional wisdom on legal impediments and ensure that robust penalties and appraisal processes
are in place.
(C ontinued)

Chapter 5 Banking Conduct and Culture ■ 89

Table 5.1 C ontinued

Area Recommendations

t. Staff rotation between control and business functions may be beneficial and help develop the
desired firm-wide cultural mindset.

u. Banks should ensure that the third line of defense is robust, has operational independence, is
suitably staffed, and has a clear mandate to examine adherence to standards.

6 Regulators, supervi­ v. Regulators should carefully consider the limited effectiveness of promulgating rules related to
sors, and enforcement values and conduct.
authorities
w. Conduct-of-business and prudential supervisors can, however, gauge the effectiveness of
board and management processes that generate tangible oversight and change in values and
conduct.

x. Conduct-related assessment should be embedded into the core supervisory work, rather than
developed as an "add-on" task or objective.

y. Industry-led standard-setting initiatives should be encouraged.

and managerial deficit, one regarding Wells Fargo in the United money-laundering scandal has shown that whistleblowing cannot
States and one regarding Commonwealth Bank of Australia be overlooked and should always be carefully and swiftly investi­
(CBA). Wells Fargo, considered an industry leader in cross-sell gated by senior management with the oversight of and reporting
metrics and praised for having successfully navigated the finan­ to the board. Likewise, a money laundering scandal at ING led to
cial crisis, saw a series of high-profile scandals erupt in succes­ a US$900 million fine earlier this year. The Punjab National Bank
sion from late 2016 that revealed serious cultural failings such US$2 billion fraud has also highlighted conduct and oversight
as flawed incentives and excessive sales pressures, a pattern of weaknesses in India's state-owned banks. Finally, the reported
corner-cutting and unethical behavior, and inaction by senior conduct failure at Goldman Sachs related to 1MDB, drives home
leadership. C BA , the largest financial institution in Australia and that a focus on conduct and behavior is essential to all firms.
a bank respected for its history of financial success and technol­
ogy innovations, also underwent a succession of scandals and
was found in a 2018 prudential inquiry to harbor critical cultural Mindset of Culture
shortcomings, including a sense of complacency; utilizing only
Since the financial crisis, culture and conduct concerns have
a reactionary approach to exposed risks; insularity; and pursuit
risen in prominence at many banks, representing a clear shift in
of consensus at the expense of constructive challenge and
the mindset of culture. Most banks by now have re-articulated
accountability.
their core values (which are unique to each bank, but commonly
In some ways, these cases shook up the industry in each market include concepts such as customer/client centricity, integrity,
more than other cases because they were so unexpected; these and internal collaboration) in a Code of Conduct or similar docu­
were institutions with stellar reputations that had weathered the ment and have made efforts to repeatedly communicate these
financial crisis relatively unscathed. They were also considered throughout their organizations (including implications of per­
solid traditional banking institutions with a community focus. sonal and company behaviors and expectations related to the
These scandals proved that conduct issues are not limited to firm's values).
investment banking and can in fact permeate conventional retail
Banks have taken various approaches to communicate values
and wealth management banking activities. As one senior industry
throughout their organizations. One C EO personally reviews
member stated, it is when the institution is successful, growing,
important bank-wide communications to increase visibility of
and well-regarded that senior leadership must be most vigilant
the bank's values and ensure alignment with the organization's
against the "tyranny o f su cce ss," extreme overperformance vis-a-
culture. Other banks have set up regular town halls and focus
vis competitors, and the temptation of willful blindness.
groups to promote dialogue on values and create venues for
Unfortunately, major conduct failures continue elsewhere, further constructive challenge. A number of institutions have devel­
underscoring this is not predominantly an Anglo-Saxon matter. oped interactive training and role-playing to further clarify and
For example, the Danske Bank US$200 billion Estonia-Russia entrench the values and expectations.

90 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Despite significant progress in formal intention, frameworks, and dedicated attention to culture and conduct topics, leading to a
communications, the degree to which these values have been deficit in expectations and guidance for senior executives on
embedded in the day-to-day behaviors of employees has yet such issues. Today, conduct and culture discussions account for
to be determined. While "tone from the top" is appropriately a meaningful share of board agendas, and as observed by indus­
focused on conduct and culture matters, it is unclear if this has try participants, the increased board involvement represents not
flowed throughout the organization and whether employees at just lip service but tangible improvement.
all levels, and especially in the front lines, have fully internalized
The specific form of implementation varies across banks. Some
how this will change how they do business. Much opportunity
boards have co-opted existing, more broadly mandated com­
also remains in working with middle management layers to
mittees (for example, Risk Committees); some banks have newly
ensure that tone from above properly reflects the message and
established dedicated subcommittees on culture and conduct
intent from the top, and that employees are not in a position
topics; and still others have opted for multiple overlapping com­
where they feel a conflict between what they hear from senior
mittees to exercise joint oversight over these issues.
leadership and what they are required to do on a day-to-day
basis. Our prior recommendation to split Board Chair and C EO roles
has been executed to varying degrees. Many U.S. banks persist
Accurately understanding and measuring changes in culture on
in a combined role. Wells Fargo notably shifted to a split model
the ground remains challenging (especially in large, multi-geog­
driven by shareholder pressure in the aftermath of the conduct
raphy and multi-business-unit banks), and will require banks to
failure and scandal, and Citigroup has announced they will
continuously monitor whether the formal shifts in their mindset
confine to split the Chair and C E O roles. While the splitting of
of culture have translated to changes in the day-to-day conduct
roles does not on its own guarantee elimination of misconduct
and behaviors of their employees.
(scandals have occurred in banks with split roles), it nonetheless
Banks need to ensure that the inclusion of behavior and is good governance practice and facilitates checks and balances
conduct within their mindset and approach toward business is between board and executive leadership.
permanent, and to view the process underway as a fundamental
shift in how they do business rather than a program or set of Board-Level Conduct Management Reporting
initiatives. Many leaders interviewed shared the concern that as
Developing management and board-level conduct management
the crisis and scandals are put behind us, the lessons might be
reporting has been a major area of focus for many banks over
forgotten and a return to old practices might occur.
the last few years, in response to regulatory and senior manage­
ment pressure. Many banks are in the process of creating and
Senior Accountability and Governance refining their culture (and often also ethics) dashboards, often
leveraging data and information that is already collected across
Board Responsibilities and Involvement the organization, and now collating and analyzing these
With the increased public scrutiny on conduct and culture, and indicators through a culture lens for the first time. There is
greater expectation for Boards to be fully informed of and general agreement on the value and importance of such
involved in such issues, ignorance is no longer an acceptable dashboards, though the approaches vary in the type, amount,
excuse. In fact, on conduct issues and risk taking, many directors and granularity of indicators. Results are often examined by a
are asking themselves "h ow d o we really kn ow ?" and are put­ variety of factors including geography, business unit/function,
ting in place measures for greater involvement and insights into tenure, and employment level, to identify subcultures, discrep­
the company culture. ancies, and pockets of issues existing today and appearing
over tim e.6
The banking industry overall has stepped up board-level involve­
ment on these topics. Prior to the crisis, only one-third of global The trend analysis across both leading and lagging indicators
systemically important financial institutions (SIFIs) had a dedi­ has been used effectively in a number of institutions, but many
cated board- level financial risk com m ittee,5 and boards rarely organizations still struggle with shortcomings in their reporting
(for example, once a year or sometimes even less frequently) abilities. The challenges reported by banks include:

• DATA QUALITY AND AVAILABILITY: The required data are

not available and take time to build (requiring capability
5 "BSB Blog: Sir David Walker on Banking Conduct and Culture,"
David Walker, Banking Standards Board, May 24, 2018; https://
www.bankingstandardsboard.org.uk/bsb-blog-sir-david-walker- 6 See Section 2 Lessons Learned for additional information on how
on-banking-conduct-and-culture/. banks are approaching culture and conduct measurement and reporting.

Chapter 5 Banking Conduct and Culture ■ 91

 enhancement or new roles and responsibilities), and/or aligned with the company's culture, even though it resulted in a
available data are of poor or variable quality. Data must significant loss of business and profits for the company. Third,
also enable reporting and metrics at the right level of detail leaders can and should model desired behaviors by express­
and granularity to be able to identify localized declines or ing (and, more importantly, demonstrating) a genuine desire
weak areas. Management must be able to slice and dice to receive and respond to feedback. At one bank, the C EO ,
the information in order to spot, highlight, and investigate upon finding that a culture issue raised by an employee had not
specific or localized issues. Greater advances in technology received attention in a timely manner, proffered a personal apol
and Al are starting to enable greater monitoring and analysis ogy for the delay.
capabilities.
Finally, bank leadership can tangibly demonstrate they are in
• APPLICABILITY: Defining standardized metrics across busi­ the same boat with employees by taking responsibility for the
nesses and geographies that are meaningful and can be consequences of difficult actions or outcomes. For example,
aggregated remains a challenge. the C E O at one bank took a voluntary 40 percent pay reduction
• RELEVANCE AND EFFECTIVENESS: Existing metrics pro­ upon unveiling a plan to cut staff numbers and instituted long­
vide useful but limited insights in isolation, and relationships term incentive plans with compensation deferred for multiple
between variables and trends need to be considered. Also, years.
banks continue to struggle to develop forward-looking Senior leaders sharing their own dilemmas and scenarios of
measures and test outcomes, and given the fact that avail­ when they faced difficult and ambiguous decision making also
able metrics are often asymmetrical, they remain focused helps in both defining the expectations and making leaders
on reporting misconduct rather than conduct more broadly more approachable.
(including positive measures of conduct).
• USEFULNESS: Conduct and culture reporting in many institu­ Role of Asset Owners and Third-Party Fund
tions is a relatively new exercise and will require practice to Managers in Influencing the Board and
get right. Many banks are still struggling with how to best Management Focus on Culture and Conduct
use the data and metrics to trigger action or achieve goals
• Asset owners and shareholders are beginning to increase
of better managing conduct risk. Interpreting the data and
pressure on banks with regard to culture and conduct, and in
translating it into actionable insights is a work in progress at
a number of interviews, C EO s spoke about actively engag­
many banks we interviewed.
ing key shareholders in a dialogue about their firm's culture.
Monitoring and measurement will always be difficult, but this Investors, on the other hand, still feel it is difficult to have
should not dissuade firms from the exercise, as they can con­ a true voice in the process given the diffuse nature of the
tinue to develop and adjust their tools over time. investor community; that is, they rarely speak with one voice
(see Box 5.4).
Modeling Behavior • The Wells Fargo scandals revealed the extent of increasing

Banks increasingly recognize the importance of leading from the investor attention on these topics: not only did they incite

top ("tone from the top") and the need for senior management vocal reactions from activist investors, demanding improved
governance and changes in board membership, but the
to consistently set concrete examples of desired behavior for
the organization to follow. While tone from the top can material­ resulting record US$60 million senior executive claw-backs
were made possible by prior activism in 2013 by New York
ize in various ways, a few best practices have emerged in recent
years. City's pension funds to enable claw- backs in the event of
misconduct.7,87
8
First, leaders can ensure that their communications through­
out the bank are consistent, clear, and relatable, (for example,
clearly explaining key decisions, how they fit with the firm's
overall strategy and culture, and how the decision is relevant
to employees). Second, leaders can demonstrate the desired 7 "Citi, Wells broaden exec pay clawback policies, MarketWatch,
behavior by living it on a daily basis and exhibiting it in how they March 13, 2013; https://www.marketwatch.com/story/
citi-wells-broaden-exec-pay-clawback-policies-2013-03-13.
act within the firm, with employees, and with customers and
clients. Examples matter, and those set by a firm's leadership 8 Clawbacks (especially ones due to public/investor demands) should be
seen by the industry as a last resort measure. The industry should strive
are key to embedding culture. One C EO set a strong tone early to achieve effective upfront compensation assessments rather than after-
in their tenure by rejecting a business opportunity that was not the-fact remediation.

92 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 5.4 THE INVESTOR VIEW
As companies in the banking industry (and in other industries) returns are necessary but not sufficient; returns can be wiped
face increasing conduct issues, and have incurred significant out by one event. Culture failures not only lead to hard costs
financial costs (fines, lawsuits, lost business), we have seen (fines, lawsuits) and financial losses, but scandals and reputa­
investors increasingly paying attention to the softer issues tional issues put management in a crisis mode, which detracts
beyond financial results. A number of bank C EO s reported from their focus on business growth and revenue generation.
to us that they have started engaging directly with large A sustainable business model must include a focus both on
investors to discuss their culture— and the potential impact financial results and on addressing the interests and well­
of strategy on culture and conduct. For the first time, we being of all stakeholders. As one institutional investor stated:
included interviews with large institutional investors in our "It is not a choice between profit or purpose— we are long­
report, the key findings of which are described below. term investors for our clients and that requires our portfolio
companies to pay attention to both profit and purpose."
Investors we interviewed care about the culture of their
portfolio companies from two perspectives: (a) they look for The challenge, of course, is that even today, the markets
a board that is independent and strong, while also being put significant focus on quarterly earnings, which can lead
appropriately involved in understanding how the business is to business decisions and actions that maximize short-term
run; and (b) they look for sustainability, which requires both financial results over other priorities. One institutional inves­
strong financial results and positive outcomes for all stake­ tor told us that the market needs to start thinking long term
holders, not just shareholders. rather than in quarterly results, "but the market is not good at
pricing the value of having sustainable results: there is value
Board culture: The investors we spoke with look at the corpo­
in good culture and good corporate citizenship but we call
rate culture but also, importantly, at the board culture. While
these the nonfinancial elements because we don't know how
the two are related, they are not the same. Assessing the
to price sustainability." This investor looks carefully at envi­
board culture enables investors to understand the effective­
ronmental, social, and corporate governance (ESG)* elements
ness of the board in representing and defending the interests
as they believe these provide forward-looking insights. Finan­
of shareholders. Elements that they look at include:
cial results report on historical performance, but the ESG
• Diversity of board members (such as experience, back­ elements provide predictive insights into an organization's
ground, and gender) health, and therefore continued ability to perform.
• Culture of accountability within the board While asset owners have the potential to significantly influ­
• Ability to dissent and have differing views from the ence boards and management to focus on culture as a driver
majority of long-term sustainability; the greatest impediment remains
• "Chumminess" of the board with the C EO . the diffuse nature of the investor community and of their
interests. Even the largest institutional investors rarely have
Investors also assess how well the board understands the cul­ significant ownership in any one company, and it can be dif­
ture of the firm and how the culture drives ability to achieve ficult for them (on their own) to influence board/management
desired results. One investor we spoke with said that while agendas. Aside from specific scandals that can cause inves­
boards have become more involved in discussions with man­ tors to align their interests, shareholders in any one com­
agement about culture, many directors are still unable to fully pany often have very diverse goals and may seek divergent
articulate or describe the company culture. From the inves­ outcomes. The asset owners we interviewed spoke about
tors' viewpoint, there appears to be room for improvement the need for the investment community as a whole to better
in terms of boards' understanding, involvement in, and influ­ align on the importance of culture and governance as drivers
ence on corporate culture. of sustainable financial results.
Culture as a driver of sustainability: While investors focus on * Note: The ESG elements are the three main areas of focus in
returns, there is an increasing recognition that "soft" fac­ measuring the sustainability and ethical impact of an investment in a
tors such as culture can make or break a company. Financial company.

Performance Management Authority (EBA) guidance, have reviewed their remuneration

schemes, and incorporated cultural and behavioral consider­
and Incentives
ations into performance scorecards, most notably at senior
Many banks, particularly in the UK and Europe,9 driven by management levels. Banks are at varying stages of formalizing
recent Financial Conduct Authority (FCA) and European Banking these measures, cascading them to middle management levels

9 In Australia, APR A released an updated remuneration framework and Sydney, April 2018. Specifics on implementation and outcomes are not
set of standards; see "Information Paper: Remuneration practices at yet available.
large financial institutions," Australian Prudential Regulation Authority,

Chapter 5 Banking Conduct and Culture ■ 93

and below, and ensuring consistent application. While some A number of leaders we interview ed, while agreeing about
banks are beginning to report cases of significant compensation the need to change com pensation structures, also pointed
adjustments resulting from the adoption of balanced score- to the limited im pact on culture this change will have if done
cards for performance management, many banks still weigh the in isolation. In fact, com pensation is often a by-product of its
"how" element lower than the "w hat." In practice, it is much environm ent rather than a driver. W henever there is m iscon­
easier to evaluate direct results than behaviors, and difficult to duct, there are almost always issues with incentive design.
penalize high performers who do not fall in line with cultural However, one must ask w hether the incentives drove the
expectations. Nonetheless, boards and management must take undesirable behavior or the incentives are an indication of
this step, and be willing to terminate employees for conduct the wrong m indset, which is ultim ately responsible for the
breaches when necessary. behavior.

Recent years have seen cases of conflicted remuneration To be credible, the shift toward a balanced performance man­
models that incentivize overly aggressive sales behaviors that agement culture also requires willingness and courage on the
resulted in harmful outcomes for customers. A number of indi­ part of leadership to deal with high performers (from a purely
vidual firms have removed sales-focused incentives for frontline results perspective) who display toxic behaviors. When manage­
staff, opting instead for alternative measures such as those ment unevenly upholds standards of behavior, it sends a power­
based on team goals and customer satisfaction outcomes. ful message to all team members of what is important in reality
One bank shifted compensation away from paying based on regardless of the stated values.
profitability metrics to paying commission based on a service
Banks have also become more willing to act on and publicize
provided to the customer. For the commission to be paid, the
breaches of conduct, and some have signaled when conduct
client must be aware of and happy with the service (a third
failures have led to terminations, which, when done, sends
party is employed to collect client satisfaction key performance
a very strong firm-wide message. W hereas in the past poor
indicators [KPIs]). Another bank shifted to a three-pronged
behavior from a strong producer may have been overlooked,
performance evaluation for all staff: (a) performance in job, (b)
banks today have much lower tolerance for bad behavior
effectiveness of behavior, and (c) results on personal stretch
and have stated that they are even willing to forego revenue
goals.
opportunities (for exam ple, withdraw from certain deals or
This transition in compensation structures has not been without businesses) where necessary in favor of maintaining a strong
friction, with some banks experiencing initial sales declines, and culture.
others needing to experiment with alternative performance
Banks are also beginning to weigh the potential benefits of
measures to achieve the right balance between incenting good
using breach of conduct incidents and terminations as teaching
conduct and achievement of strategic goals. The changes in
moments, against the potential risks of running afoul of privacy,
incentives will also require efforts in other areas, such as reedu­
confidentiality, and employment law. Some banks are choosing
cating staff to better assess customer needs and make suitable
to explicitly communicate such narratives, while others rely on
recommendations, and introducing new service tools and rou­
informal grapevines and collective consequences (for example,
tines for frontline staff.
heavier scrutiny of activities) imposed on teams of the offend­
Another challenge of transitioning from purely results-based ing individual or individuals to spread the message internally.
compensation to a balanced-scorecard compensation structure A number of senior industry executives pointed to the discon­
is that it requires insight into how employees perform their role. nect between regulation and societal expectations on the one
This means that managers must have enough time and man­ hand, and employment and privacy laws on the other. Deal­
agement acumen to understand what actions and decisions are ing rapidly and forcefully with egregious breaches of conduct
required in different circumstances and whether the employee can be difficult, especially in certain jurisdictions with strong
did in fact exhibit these behaviors. Also, because compensation employee protection. In the current climate of social justice
is such a blunt (and limited) instrument for influencing behav­ campaigns and activist investors, ethical and legal consider­
ior, organizations that value the "how" as much as the "what" ations need to be aligned.
need to minimize reliance on compensation as a management
tool. Compensation has a role to play, but more important is Staff Development and Promotions
the role of leadership. One institution we interviewed trains
managers to look for real-time coachable moments to drive Training programs on conduct and culture have expanded
employee behaviors rather than only ex-post compensation in size and scope at most banks, often focusing on defining
measures. specific expectations around behavior and helping employees

94 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
understand how abstract values and principles specifically trans­ ambiguous and complex situations where the right answer is not
late into day-to-day responsibilities and expectations. This is a obvious.
very important element of driving behavior; historically, while
At the same time, some banks have seen that the increased
banks had value and mission statements, there was very little
level of training on all aspects of conduct can have a numbing
guidance for employees to translate highlevel statements into
effect on staff, where employees start to tune out and training
"w hat d o e s this mean specifically fo r m e in my everyday jo b
has the opposite effect than intended. It is important to have
to b e able to live up to the exp ecta tio n s o f the institution ?"
the right training for the right people at the right time and to
Banks are applying a variety of scenario-based/role-playing/
target the training and not push everyone through everything.
industrial theater approaches and using a combination of live
and web-based mechanisms to deliver content. As one industry Conduct screens are also increasingly being applied to promo­
leader put it, "w e n e e d to map the culture to the p ra ctica l," tion and external hiring decisions. Some banks have stepped up
providing actual examples of how the culture must be lived. their hiring practices to better assess new recruits' alignment
Another area of training is around the grey zones where judg­ with the organization's purpose, values, and expectations
ment is required. Banking is a complex business where rules and on behavior; examples include conduct interview questions,
policies are not possible (or even desirable) for every situation. ethical screening, and various forms of personality assessments.
A principles-based culture requires that employees also have the Recent years have also seen active investment in surveil­
knowledge, skills, and tools to face the multitude of decisions in lance technology at banks (see Box 5.5), typically beginning

BOX 5.5 USE OF MACHINE LEARNING FOR CULTURE AND CONDUCT

SURVEILLANCE BY SUPERVISORS
Both banks and supervisors have recently started to look The initial practical challenge is the collection of the nec­
at the use of advanced technology (that is, Al and machine essary data in a consistent manner across institutions.
learning) to support conduct risk management through auto­ However, bigger concerns and challenges arise after the
mated surveillance techniques. data are collected. These include establishing baseline
behavior, setting thresholds and triggers, drawing mean­
Culture and conduct surveillance establishes what normal
ingful comparisons given the com plexity of institutions
or expected behavior is for a company/function/role, and
and differences across institutions, engaging institutions
then analyzes relevant data to identify behaviors that are
to investigate potential issues, and the treatm ent of false
not in line with the norm. This objective of identifying pat­
positives. The other overarching issue, particularly from the
terns and anomalies in behavior is an ideal application for
perspective of supervised institutions, is the potential nega­
machine learning models. For example, clustering algorithms
tive consequence of big brother influence on em ployees
are effective in identifying patterns, trends, and correlations
created by the ongoing monitoring of em ployee behaviors
in large bodies of data such as account openings and sales
and actions.
performance. In addition, natural language processing tech­
niques can be used to extract sentiment and meaning from The potential to use machine learning by supervisors for
chat logs and call transcripts to identify employee misbehav­ industry-wide culture and conduct surveillance is real,
ior or trends in customer complaints. given that the technology already exists, and the data
already reside within individual institutions. The benefits are
While not without some controversy (related to privacy and
numerous and include rapid identification and remediation
intrusiveness), the technology is advancing rapidly and there
of bad behavior and systemic issues; reduction of manual,
are numerous benefits to automating the monitoring, com­
siloed, and costly monitoring processes at institutions; and
parison, and analysis of behavior patterns. Indeed, individual
understanding of the cultural health of the industry (similar
companies have experimented with and are starting to imple­
to how other industry-wide exercises such as Com prehen­
ment such capabilities. Supervisory bodies are also exploring
sive Capital Analysis and Review [CCAR] help supervisors
how these capabilities could be used to address their goals
understand the financial health of the industry). However,
of ensuring safety and soundness.
the practical challenges are significant and likely prohibitive
Assuming supervisors can collect the necessary data at the at this point. Overcoming these challenges would require
appropriate granularity and frequency from institutions, they a concerted effort and collaboration between supervisors
could apply machine learning techniques to monitor culture and the industry to ensure that the potential benefits of
and conduct at the industry level and across institutions on this new generation of surveillance methods outweigh the
an ongoing or near real-time basis. However, even though downsides.
such applications are feasible in theory, the practical reality is
much more challenging.

Chapter 5 Banking Conduct and Culture ■ 95

with capital markets businesses but increasingly broadening frontline business areas have taken full ownership for conduct
in scope to other areas. The focus at the cutting edge is on risk and related change and development programs. There are,
making better use of available data with advanced analytics, however, firms that were slower to make this shift and continue
bringing together disparate analytical outputs (for example, to lag behind their peers.
communications/ trade/voice surveillance, social media scan­
In addition to ensuring that the first line firmly owns conduct and
ning), and exploring additional analytics to detect or predict
culture risk management, banks have also struggled with the
potential conduct events (for example, reputational/sentiment
organizational placement of the second line conduct oversight
analysis, network analysis, cluster analytics). While the technol­
and control responsibility. Many banks have shifted the respon­
ogy is rapidly evolving to support such capabilities, the ethical
sibility for second line oversight across a number of functions in
questions around the acceptable degree and level of employee
order to find the right fit. Common organizational placements
monitoring remain. With increased monitoring capabilities,
are Compliance, HR, Risk (directly under the Chief Risk Officer),
banks need to carefully balance the need to manage conduct
Operational Risk, and Enterprise Risk Management. Each of
with the need to provide employees with some level of privacy
these has its own set of benefits and challenges:
and trust.
• Compliance is probably the most natural fit given that it has
the expertise, experience, and discipline for surveillance and
An Effective Three Lines of Defense monitoring of employee activity. However, some banks are
starting to worry that it may restrict the view too much with a
An effective three lines of defense is the area of greatest focus on laws and regulations. Conduct is about what should
challenge and least progress to date. The shift of ownership or should not be done, rather than on what can or cannot be
of conduct and culture initiatives to the first line (where it done.
belongs) has been slow. Banks are beginning to improve clarity
• HR has the benefit of being able to integrate conduct man­
of second-line oversight of conduct and culture risk, though
agement into the broader talent management life cycle from
a standard model has yet to em erge; the specific setup varies
hiring to termination. Banks with close HR involvement in
by bank size, com plexity, and risk management approach.
conduct initiatives have benefited from the ability to closely
A t many banks, second line teams are often still responsible
embed culture and values into various HR processes, includ­
for driving conduct initiatives, focusing on the development
ing performance evaluations, incentives structures, and
of frameworks and standards, piloting, and initial stages of
external recruiting. The downside is that as HR in some banks
implementation. In terms of the third line of defense, while
plays a first line role in many of those activities, its second
some banks have started to establish culture audit practices,
line abilities may be restricted (in fact, in a number of banks,
many banks still struggle with the best way to audit what can
HR is considered a first line function). Another potential limi­
feel very intangible. Given this is a relatively new area of focus,
tation is that in many institutions, HR does not have the same
banks are in the process of working through a maturity curve
organizational power as the Risk function, nor does it have
to understand the risk and develop a common taxonomy and
the proximity to the daily business that Compliance and Risk
frameworks.
have.
The biggest gap we observed in the effective implementation of • Placing conduct management in the Risk function directly
the three lines of defense for conduct risk management is that in under the Chief Risk Officer can be effective, especially in
many banks it still appears to primarily be a second line focus institutions that have experienced significant conduct issues,
area. As with all other risks, to be properly managed, it needs to as it elevates the importance of the function and senior man­
be owned by the first line and embedded in all business pro­ agement line of sight. However, as an ongoing business-as-
cesses. It is especially important for the first line to be deeply usual structure, this can lead to a siloed approach to conduct
aware of and accountable for conduct risk management given risk management.
that conduct by its nature is how you do business. A conduct
• Operational risk management is a natural fit for many institu­
risk lens needs to be explicitly applied to all business activities
tions that have defined conduct risk within the operational
including new product approvals, pricing guidelines, customer
risk taxonomy and structure. Given that operational risk
complaint handling, and evaluation of new transaction/business
opportunities. Where it has been a focus by regulators and
banks, some progress has been made. For instance, as the UK 10 "5 Conduct Questions" Industry Feedback for 2017 Wholesale
FCA notes in its "5 Conduct Questions" April 2018 Industry Banking Supervision, Financial Conduct Authority, London, April 2018.
Feedback report,101for the polled com panies,11 nearly all 11 Per the report, a sample of approximately 30 firms.

96 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 covers people, process, and technology risks, conduct risk This is often due to the lack of clarity of how this risk should
can be viewed as an extension of those risk types. The down­ be defined and managed. It cannot be overstated that ulti­
side is that operational risk is such a broad and still evolving mately, ownership and oversight for conduct and culture risk
area of risk management that conduct risk may get lost in the management needs to be owned by the Board, the C E O , and
fray and not receive the attention it needs. the heads of the business units. Defining conduct risk, incorpo­
• More recently, some banks have moved conduct risk man­ rating it into the risk appetite statement, and developing risk
agement under enterprise risk. This can make sense for sev­ identification and auditing processes are all still very much a
eral reasons: it is closely linked to reputational risk, it requires work in progress. For instance, many institutions are still strug­
a holistic understanding of risks across the enterprise, and it gling with the classification of conduct risk: is it its own risk type
entails significant reporting effort for the board and senior or a subset of another risk such as operational risk? As with all
management. The downside is that the Enterprise Risk Teams other risk types (credit, market, and operational and reputa­
in many banks may be too small and not have the capacity to tional risks), the methodologies and practices will mature over
undertake oversight of such a pervasive risk type. time. Formal risk management routines will need to be agreed
and adopted for the effective functioning of the three lines
Furthering the dilemma on the organizational placement of
of defense.
second line conduct risk oversight is that many institutions do
not yet have full clarity on whether conduct, culture, and ethics
should be managed as one integrated function, or separately. Regulators, Supervisors, Enforcement
While the industry has not defined one agreed model for sec­ Authorities, and Industry Standards
ond line oversight of conduct and culture, there are two guiding
Regulators and supervisors across the globe have increased
principles that should be observed:
attention to and expectations regarding conduct and culture.
• W hichever function is selected as the responsible second Examples include:
line, it needs to be clear. While all the groups listed above
• UNITED KINGDOM: The FC A has been a driving force, issu­
likely have a role to play in the oversight and governance of
ing the Fair and Effective Markets Review in conjunction with
conduct and culture, there needs to be clarity on roles and
the Bank of England and Her Majesty's Treasury, and imple­
responsibilities; that is, which function is taking the lead and
menting regulations for benchmark rates, foreign exchange
which functions are tasked with contributing input (and the
(FX) remediation programs, and the Senior Managers and
type of input) need to be explicitly stated. The risk respon­
Certification Regime to increase individual accountability and
sibilities, policies, and appetite statements also need to be
governance via banks' senior leadership.
aligned.
• EUROZONE: European regulators have dialed up scrutiny of
• W hichever team is given second line oversight and gover­
conduct issues, for instance, with the EC B /EB A releasing
nance responsibility also needs to be given proper power for
conduct-related guidelines on governance arrangements and
conduct initiatives to have teeth.
remuneration policies, and the De Nederlandsche Bank
Banks are also starting to further their thinking in terms of the (DNB, the Dutch central bank) conducting examinations
third line's role in the management of culture and conduct. A focusing on topics such as decision making, leadership, and
number of banks have explicitly structured culture audit pro­ communication. Further, the ECB updated its Manual for
cesses, and in some cases, institutions have established audit Asset Quality Review in June 2018, incorporating the
teams specifically focused on culture auditing. implications of International Financial Reporting Standard 9
While second line placement is important for an effective (IFRS 9)12 and increasing the importance of bank business
conduct risk management program, most important for the models focused on investment services. Also, as part of its
long-term and permanent success of culture and conduct Internal Capital Adequacy Assessment Process, DNB has
efforts is ownership by the frontline business. Progress has stated they will devote particular attention to strategic risks
been slow in embedding ownership of conduct risk in the first to banks, including the gradual deterioration of a business
line, often due to a lack of understanding or experience by model.
the first line management and/or the view of culture and con­
duct as a soft HR issue rather than a business imperative. Due
to lack of first line ownership, some banks have seen first line 12 IFRS 9 was promulgated by the International Accounting Standards
Board and addresses accounting for financial instruments. It covers the
responsibilities slip to the second line, which in turn rendered classification and measurement of financial instruments, impairment of
ineffective the second line's role of independent challenge. financial assets, and hedge accounting.

Chapter 5 Banking Conduct and Culture ■ 97

• UNITED STATES: There has been increased focus on culture nonfinancial risks. " As a result, the APRA applied a $1 billion
and conduct from the Federal Reserve Banks, the Office of Australian dollar add-on to CBA's minimum capital
the Com ptroller of the Currency (O C C ), the Financial Indus­ requirement.
try Regulatory Authority (FINRA), the Securities and • HONG KONG: The Securities and Futures Commission's
Exchange Commission (SEC), and the Consumer Financial (SFC's) Manager in Charge regime aims to increase account­
Protection Bureau (CFPB). In particular, the Wells Fargo ability of senior management and managers of key/control
sales practices scandal led the O C C to launch a multiphase functions, while the Hong Kong Monetary Authority (HKMA)
industry-wide review. In his June 2018 speech, "Now is the recently released a framework for fostering sound culture at
Tim e for Banking Culture R efo rm ,"13 Federal Reserve Bank banks.
of New York president and C E O John Williams expressed a
• SINGAPORE: The Monetary Authority of Singapore (MAS)
sense of urgency in addressing banking culture, and the
has drafted proposed guidelines on individual accountability
"n e e d to en sure that bank m an agem en t and b o a rd s are
and conduct via banks' senior leadership.
e xe rtin g stro n g and e ffe c tiv e lea d ersh ip with ro b u st
g o ve rn a n ce . That m eans h oldin g m an agem en t and b o a rds
• CHINA: The China Banking Regulatory Commission (CBRC)
o f d ire cto rs to high sta n da rd s in term s o f culture and has published Conduct Management Guidelines for banks,

c o n d u c t. " designed to facilitate reporting of improper conduct in

banks. The process is designed to establish norms for long­
• CANADA: The Financial Consumer Agency of Canada
term monitoring and inspection of bank practices. The
(FCAC) launched a business practices probe, focusing on
People's Bank of China has also underlined the importance of
bank employees' obligation to obtain customer consent and
conduct and culture for the leadership of major banks via its
provide proper disclosure about fees and costs when selling
support for the G30 recommendations.
new products, and the Office of the Superintendent of Finan­
cial Institutions (OSFI) launched a review of domestic retail Financial authorities recognize that culture and conduct supervi­

sales practices. The FC A C s related report,14 released in sion represents a departure from historical, often quantitatively
based prudential supervision, and are grappling with what that
March 2018, noted insufficient controls at Canada's largest
banks to mitigate the risk of mis-selling and breaching market means in terms of the skills and capabilities of their staff and

conduct obligations. their traditional approaches, and their own internal culture and
practices. A consensus view has yet to emerge on whether out­
• AUSTRALIA: The Banking Executive Accountability Regime
side organizations that have traditionally focused on quantitative
(BEAR) is seeking to improve standards of behavior and
measures of bank health can, without hands-on experience, truly
accountability, and the Banking Royal Commission is cur­
assess the culture of the banks they supervise and add value to
rently investigating incidents of misconduct. The Interim
a culture review.
Report of the Royal Commission is critical of regulators, and
in its final report, due in February 2019, is likely to recom­ In our interviews we heard significant differences of opinion in
mend that they be accorded additional powers. In May 2018, terms of the role regulatory agencies can play. On the one hand,
the Australian Prudential Regulation Authority (APRA), culture is so intimate and unique to the strategy and values of a
released its review of Commonwealth Bank of Australia's specific institution, it is hard to imagine any external party being
frameworks for governance and accountability,15 noting able to engage productively in an assessment of the culture.
"C PA 's con tin u ed financial su cce ss d u lled the se n se s o f the On the other hand, numerous scandals and conduct issues have
institution, particularly in relation to the m anagem ent o f shown that insiders can miss signals of cultural deterioration,
and management could benefit from external, unbiased inquiry.
Some regulators have taken an optimistic view on this and are
experimenting with alternative approaches. For example, DNB
13 Now Is the Time for Banking Culture Reform: Remarks given at
Governance and Culture Reform Conference, Federal Reserve Bank has hired psychologists to observe and analyze culture at banks,
of New York, by John C. Williams, President and CEO of the Federal and the Monetary Authority of Singapore is building up Al and
Reserve Bank of New York, June 2018. data analytics capabilities.
14 "Domestic Bank Retail Sales Practices Review," Financial Consumer
An important differentiation in determining the role supervisors
Agency of Canada, Ottawa, March 20, 2018.
should adopt in this space is the difference between conduct
15 "Prudential Inquiry into the Commonwealth Bank of Australia (CBA)
Final Report," Australian Prudential Regulation Authority, Sydney, April and culture. Given that conduct risk management is based on
2018. observable behaviors, it may lend itself to a clearer supervisory

98 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 5.6 HOLDING MANAGERS ACCOUNTABLE
First introduced in 2016 by the UK Financial Conduct Author­ effective July 2018; and most recently the Monetary Author­
ity, Accountability Regimes already cover or will cover many ity of Singapore's proposed Individual Accountability and
major financial centers and financial business models. These Conduct Regime and guidance from the US Federal Reserve
regimes are a direct response to a call to amend professional Bank.
standards and the culture of the banking sector following a
In designing and implementing these regimes, supervisors
perceived lack of personal responsibility for management fail­
need to have a clear view of the intended outcomes of an
ings in the financial crisis.
Accountability Regime, and design a regime that adheres
The UK Senior Managers and Certification Regime (SMCR), to those outcomes, taking lessons learned from established
introduced a statutory duty of responsibility for a defined set regimes such as the FCA SM CR. Special attention should be
of senior individuals in a firm to demonstrate that they have paid upfront to consider potential unintended consequences
taken reasonable steps to prevent prudential and conduct and design standards and principles that allow for flexible
failures. The regime has been recognized by many as a key application where appropriate.
driver of cultural and behavioral changes in senior managers
Firms themselves should avoid a pure compliance-based
in banking. The SM CR was originally established for deposit
"tick-box" approach when responding to Accountability
takers and later extended to include investment firms and
Regimes and ideally use such regimes as an opportunity to
insurers and focused clearer articulation of senior roles,
drive and build on strengthening leadership behaviors and
responsibilities, and accountability, as well as individual con­
overall culture in the organization, ensuring that employees
sequences extending to legal prosecution and sanction in the
have the resources and support to discharge their duties.
event of breaches by the firm.
Firms that need to respond to regimes in multiple jurisdic­
Accountability Regimes have since emerged in several other tions will need to align on approaches, and navigating the
jurisdictions including Hong Kong Manager-in-Charge (MIC), minefield of unintended behavioral consequences will be key
effective October 2017; the Australian Prudential Regulation for both firms and supervisors.
Authority's BEAR (Banking Executive Accountability Regime)

assessment. As Box 5.6 shows, in recent years, supervisory • The Financial Stability Board has since 2015 been
authorities in a number of countries have recognized this and coordinating international efforts around a work plan to
reinforced managerial responsibility for conduct and conduct reduce misconduct risk, most recently publishing a tool­
failures with accountability regimes. kit for firms and supervisors to strengthen governance
fram eworks. The tools focus on mitigating cultural drivers
Culture, on the other hand, is intangible and ubiquitous; as
of misconduct, strengthening individual responsibility and
such, it requires deep understanding of the strategy, operating
accountability, and addressing the "rolling bad apples"
model, and values of the organization. In other words, conduct
phenomenon.
can be assessed as right or wrong, whereas culture is not
objectively right or wrong, it can only be assessed in terms of • The Bankers' Oath in the Netherlands is a legally required
its alignment to the strategy and values of the institution. ethics statement and code of conduct holding bankers to
standards of good behavior. To date, it has been taken by
In some markets, discussions on conduct and culture have
87,000 Dutch bank em ployees.16
moved beyond individual bank efforts to collaboration across
multiple players in the industry, including tools and practices • The Global Banking Education Standards Board recently

that are shared more broadly. Examples include: announced standards for ethics education and training for
professional bankers, with plans to develop further standards
• The Banking Standards Board in the UK conducts an annual in both general banker competency and on the capabilities
assessment across banks on culture and conduct topics, pro­
required in credit products.
viding participating banks with useful benchmarking on how
they are doing relative to peers.
• The Fixed Income, Currencies and Commodities Markets
Standards Board has developed actionable standards on
behavior and statements of good practice that have been 16 "The Banker's Oath," Tuchtrecht Banken, Amsterdam; https://www
well received by industry participants. .tuchtrechtbanken.nl/en/the-bankers-oath.

Chapter 5 Banking Conduct and Culture ■ 99

SECTION 2. LESSONS LEARNED LESSON 2. Leadership always matters. Conduct and culture
must be embedded from the top down throughout the firm,
As the banking industry reflects on the last decade, and culture from the board to senior management and through middle man­
and conduct efforts gain additional maturity, our research has agement down to the teller, and through all business units and
revealed eight key lessons. geographic locations.

First and foremost, the board needs to be aware of and involved

1 Managing culture is not a one-off event, but a in defining and guiding the culture. The board's role is to define
continuous and ongoing effort that needs to be
purpose of the organization and ensure that all business levers
constantly reinforced and that must become a
permanent way of doing business. are aligned with that purpose. Strategy, communications, poli­
cies, processes, and practices must all align with the desired
2 Leadership always matters; conduct and culture must
culture, and the board must oversee that alignment.
be embedded from the top down throughout the firm,
starting with the board and senior management but Senior leaders need to involve middle management to further
also importantly including middle management.
articulate and reinforce firm values and intended behaviors in
3 The scope of conduct management is shifting from their respective areas of oversight. The day-to-day realities of
misconduct to conduct risk management more frontline staff are most profoundly impacted by their immediate
broadly. manager rather than by the C EO or other senior executives. As
4 Managing culture requires a multipronged approach such, leadership modeling must flow all the way through the
and the simultaneous alignment of multiple cultural organization and cannot only be seen at the senior levels. This is
levers.
especially difficult for large, multi-geography and multi-business-
5 Ten years out from the financial crisis, there is strong unit banks. A direct manager that does not model the values
recognition that a more diverse set of views and voices of the firm can easily undermine any example or message com­
in senior management will lead to better (and more
municated by the C E O ; as such, many banks are shifting away
sustainable) outcomes for all stakeholders.
from focusing mainly on tone from the top, to tone from above.
6 While cultural norms and beliefs cannot be explicitly While the tone and direction of the culture message needs to be
measured, the behaviors and outcomes that culture
consistent across all leaders, it also needs to be flexible enough
drives can and should be measured.
to be aligned with the different styles of each leader.
7 Regulation has a limited role in rule setting and man­
dating culture. LESSON 3. The scope of conduct management is shifting from
misconduct to conduct risk management more broadly. Conduct
8 Restoring trust will benefit the industry as a whole; as
such, industry-wide dialogue and best practices shar­ is not just about purposeful misbehavior driven by an employee's
ing are important elements in the journey toward a desire for personal gain or to meet performance targets (for exam­
stronger and healthier banking sector. ple, rogue traders); rather, it should be considered more broadly.
For example, a bank's decisions— in the form of such things as
A discussion of each of these lessons follows.
business targets, product design, and automated processes— can
LESSON 1. Managing culture is not a one-off event, but a sometimes have unintended consequences and harm clients, cus­
continuous and ongoing effort that needs to be constantly rein­ tomers, and/or colleagues even in the absence of bad intentions.
forced, and it needs to be permanent (see Box 5.7). Banks need
In many institutions, conduct has been defined to include intent,
to not only find ways to keep culture discussions from becom­
negligence, and failure of judgment. The definition is also
ing stale or repetitive, but also to ensure that culture efforts are
broadening to cover all stakeholders, having shifted from only
responsive to potential changes in the desired outcomes them ­
market and customer impact to also include harm to colleagues.
selves as the industry evolves (for example, digitization). This
In this context, rather than just focusing on how to reduce bad
is particularly important as changes to conduct and culture are
conduct, it may be useful to consider the mirror image ques­
further embedded throughout the organization. It is also impor­
tion of how to promote good conduct that aligns and furthers
tant to remember that culture is not (and should not be) static;
the organization's purpose and values. It is also important to
it will evolve as the business evolves, customer needs change,
consider the full potential consequences and implications of ail
and competitive forces modify. As such, the firm must constantly
business decisions.
and deliberately adapt culture to align to a changing strategy
and business conditions. Constant nudges and reinforcement of LESSON 4. Managing culture requires a multipronged approach
expectations are needed in everyday life as training alone is not and the simultaneous alignment of multiple cultural levers. Cul­
enough to shift behavior. ture is not empirically good or bad, but it must be right for the

100 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 5.7 LESSONS FROM OTHER INDUSTRIES
Banks can learn from other high-risk, asset-intensive indus­ the customer, and to mitigate those hazards so that the cus­
tries that have worked for years to embed responsibility for tomer is not harmed. Such analyses, applied to banking and
managing behaviors throughout the organization. Examples other financial products, could help banks think more rigor­
include the following. ously about product features, even those commonly taken for
granted, and build in appropriate safeguards against poten­
Oil and gas: Companies have established specific guidance
tial customer misuse.
on behavior (for example, Shell's "Life-Saving Rules") that sets
clear expectations on acceptable vs. unacceptable behavior. Pharmaceuticals: Healthcare professionals abide by a phi­
Also, firms use a buddy system to encourage employees, losophy of "right patient, right medication, right tim e"* to
upon observing non-compliant behavior by peers, to intervene ensure patient safety and reduce errors in drug administra­
with each other without the need to escalate the issue up tion.** A banking analog (for example, articulated as "right
the management chain. This helps create an environment of customer, right product, right need") of this philosophy could
trust and psychological safety where employees look after the help guide retail sales staff in recommending appropriate
well-being of the firm and of each other. Banks could consider products for customers, reduce mis-selling incidents, and ulti­
applying similar approaches to clarify behavioral expectations mately improve customer satisfaction and outcomes.
and foster a speaking-up culture. A speaking-up culture could * Some versions also specify, for example, right dose, right route,
also mean speaking out to a colleague through mentoring and right reason, right documentation, and right response.
coaching rather than only via escalation measures.
** While considered a useful rule of thumb, this is not a foolproof
Medical devices: "Hazard analysis" (also known as risk analy­ guideline; see "The Five Rights: A Destination without a Map," by
sis) is a mandatory step in the design of medical devices, to Matthew Grissinger, P& T35 (10) (October): 542, 2010; https:\\www
consider the possible consequences of inadvertent misuse by .ncbi.nlm.nih.gov/pmc/articles/ PMC2957754.

organization based on its values, strategy, and business model. concrete, relatable examples around behavior in real-life situ­
And the various levers of culture must be aligned with the desired ations that employees may face. While values and principles
outcomes. Cultural levers include structural elements such as provide direction, on their own they are often too abstract
policies, organization, processes, and technology, as well as intan­ to be directly useful in gray-zone situations. This can be best
gibles such as tone from the top, beliefs, and perceptions. achieved through tailored trainings across levels and more
open communication from senior leadership.
Embedding culture is not about changing specific cultural levers
in isolation, but about achieving alignment throughout, that is, LESSON 5. Ten years out from the financial crisis, there is strong
a clearly stated (and believed) purpose that flows into strategy, recognition that a more diverse set of views and voices in senior
policies, behaviors, governance models, processes, performance management will lead to better (and more sustainable) out­
measurement, and incentive schemes. Tone from the top and comes for all stakeholders. Many of the industry leaders inter­
leading by example are necessary for initiatives to have credibil­ viewed pointed to group-think as a contributing cause of the
ity, but they are not sufficient. Processes and structural elements behaviors leading to the financial crisis and many of the scandals
are also critical for enabling messaging to cascade uniformly that have occurred since.
and effectively throughout the organization, especially for larger Diversity in thinking, problem solving, and leadership styles
banks. Small changes in everyday decisions ultimately add up to will help organizations achieve better results through greater
big changes over time. Implications of this lesson include: questioning, challenging, creativity, and innovation. Diverse
leadership teams can also help employees (especially diverse
• Along the lines of "every organization is perfectly designed
to get the results it gets," a bank's various culture elements employees) feel safer in raising concerns and escalating issues.

are a reflection of its true (which may differ from its stated) Many leaders stated that their institutions have recently placed
values and priorities. Banks should think carefully about how greater focus and importance on hiring, retaining, and empow­
each culture element came to be designed/implemented/ ering diverse employees. These leaders recognize that suc­
perceived in its current form, and make necessary adjust­ cessful, innovative, and learning organizations are ones that are
ments to ensure that it is aligned with the organization's diverse— at all levels of the organization. As one senior industry
desired values and priorities. leader stated, "everythin g changes for the b e tte r when you
have critical mass o f w om en in the C-Suite and the B oardroom ."
• Beyond articulating purpose and values, banks need to pro­
vide practical, actionable guidance to help staff make deci­ But results on this front are slow, and achieving truly diverse
sions. This means clear communication of expectations, and teams (especially at the senior levels) will require intentional

Chapter 5 Banking Conduct and Culture ■ 101

and ongoing effort. A 2016 study by Oliver Wyman showed that them. While measuring culture is a challenging task, it is also
while slight improvement is being made in terms of female rep­ a necessity. Leadership's ability to confidently and objectively
resentation in the C-Suite and the board, the numbers are very state that the conduct of individuals across the organization
low and only marginally improving (see Figure 5.5). is in line with their strategy, core principles, and desired goals
requires a set of indicators that can support their statements. To
Recent analysis of the financial sector by Mercer shows that
maintain a healthy culture and detect conduct issues before they
women are significantly better represented at the support staff
become a significant problem, management needs to be able
level than at the senior manager or executive level. In addition,
to observe and track behavior through meaningful and objec­
the proportion of women decreases at each level as we move
tive metrics. This is especially true for larger organizations that
up the hierarchy; they are hired at a lower rate than men at all
span numerous geographies and business lines, and can host a
levels except for senior manager; they are less likely than men to
myriad of subcultures that differ significantly. In addition, banks
be promoted to the next level across all levels of the organiza­
need to measure and report on culture and conduct because
tion; and they exit at higher rates than they are being hired at all
only by measuring them will banks be able to shift their focus
levels, and even more so at manager level and above. This is a
away from purely quantitative financial metrics (for example,
troubling picture. Global firms in other industries do not display
revenues, volumes, profits) to an understanding of how their
such large skews.
actions and decisions align to their values.
In addition, gender disparity in pay is gaining attention as an
Culture also needs to be measured and monitored because it
issue in the banking industry, as recently highlighted in the UK
is not constant; culture can and should evolve over time and be
but holding true globally. While some of this disparity can be
influenced by a number of factors including company strategy,
attributed to issues with equal pay for equal work, the fact that
hiring, growth, acquisitions, and external drivers such as evolv­
women hold fewer senior, highly paid positions than men is typi­
ing customer needs or technology advancements. Without
cally a larger source of disparity. Such imbalances can create
effective measurement, leadership cannot determine whether
culture issues such as bullying, harassment, and other behaviors
this evolution is progressing in a desirable direction.
that can negatively impact clients.
Deriving metrics from company values is a multistep process
One Bank Board Chair interviewed rightly stated: "A s human
that requires organizations to look inward and answer some
bein gs, we are n o t w ired to se e k out diversity; the natural o rd er
challenging questions starting with values, identifying stakehold­
is to b e drawn to th o se who are like us. A n d fo r too many years,
ers and outcomes for each, and then articulating desired behav­
cultural fit has b een u sed in hiring and prom otion d ecisio n s as a
iors and translating them into observable metrics. Following this,
p ro xy for 'is ju s t like m e ."'
banks will need to embark on a data exploration and analysis
LESSON 6. While cultural norms and beliefs cannot be explicitly effort to make sure that the data needed for the desired metrics
measured, the behaviors and outcomes that culture drives can are available or can be readily collected. Several tools, including
and should be measured. Banks are at various stages of trial and internal surveys, audits, and customer assessments, are particu­
error to determine what the right metrics are and how to use larly useful in gathering data for given metrics.

30

Board

ExCo

Interquartile range
(25th to 75th
percentile)
0
2003 2008 2013 2016
Fiaure 5.5 P e rce n ta g e of board and E x e cu tiv e C o m m itte e (ExC o) m em b ers in m ajor
financial se rv ice s o rg an izatio n s w ho are w o m en .

Source: Oliver Wyman analysis of organization disclosures across 381 financial services organizations in 32 countries
("Women in Financial Services," Oliver Wyman, New York, 2016).

102 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
There is no silver bullet for measuring and reporting conduct metrics do not identify issues per se; rather, they identify
and culture, but several key design principles are critical to where to look for potential issues. The metrics don't tell you
building a culture dashboard that provides useful and actionable what went wrong, they just tell you where to look. In that
insights, as shown in Figure 5.6. same vein, as banks refine their approach to selecting and
calibrating metrics, they often struggle with many false posi­
The more mature banks in terms of culture and conduct report­
tives. Getting the right metrics and inferring the right insights
ing provide the following lessons learned:
will take time and should be piloted/tested over a period of
• The report should focus on metrics that are meaningful to time.
the purpose and values of the firm. Also important in metric
• The reporting should focus on conduct rather than nar­
selection is having both leading and lagging metrics: the
rowly on misconduct. When banks start down the culture
forward-looking metrics are key to identify what might hap­
and conduct measurement path, many focus their efforts
pen rather than only reporting on what did happen.
on misconduct— intentional actions that are clear breaches
• To be truly valuable, the metrics should be seen over time of policies. However, culture and conduct reporting should
and analyzed as a trend rather than a single number or also include outcomes driven by unintentional behaviors and
point in time. In addition, the analysis should not just look unintended consequences, such as flawed product design
at individual metrics in isolation but rather assess how the that does not meet customer needs. Furthermore, to provide
data interact. Metrics from across strategy, governance, HR, a truly comprehensive and balanced view of company culture
service, operations, product, sales, and clients should come and conduct, the scope of measurement should cover p o si­
together to form the full narrative on culture and conduct. tive conduct and associated indicators such as employee
• The details are critical, and the board and senior manage­ volunteer hours, employee satisfaction survey results, sustain­
ment should focus on the anomalies, exceptions, and the tail, ability efforts, and social impact investments.
given that in the summary view, the issues can be buried and • The reporting tool should be flexible and provide multiple
lead to a false sense of complacency. views, levels of granularity, geographic focus, and types of
• The report should include commentary and explanation of metrics needed to meet the needs of multiple audiences (for
the data, and the reporting operating model should also example, the board, senior management, business heads, and
include the ability to do further analysis and investigation various second line functions). A number of institutions are start­
where needed. With culture and conduct reporting, the ing to develop dynamic web-based reporting views (Figure 5.7).

O Has direct link to firm values © Displays trends over time © Provides granular results
and risk appetite framework for each indicator across lines of business

S
Leading S
s — — — — MX I.IX MX M MX
Value Metric vs. lagging
• • • k• • %!•••••• 9 • 0 0 M l M l MS
/ U lx MX

Company Revenue and cost against target Leading !•• •!••!••« •«(••••
— 'w l.«X M l I.IX MX •JX

landscape Efficiency ratio Leading •• • 'w — n - ix t in IU I IMX •MX

— j• » Af0 lu x IU I IMX fl.lx IM X

Involuntary turnover, by type (e.g. Sales Leading Efficiency ratio 0

— • • II CM
Our People Ml Ml

Practices, Fraud, etc.) Custom er complaints —

•
V Ml u «•> M Ml
1

Sales training completion rates, by type Leading

I
Suitability reviews — — — IM MX MX MX IMX
1
Com pliance breaches # II IX MIX
Customer complaints by type Lagging
11 IX MIX It lx
Customers 0
1 Em ployee surveys 0
— u ii 49 IM Mil • ill

# or % of products only appropriate for a Lagging 0

• • 41 41 IB ll

small subset of customers 0

€X •M II fli • 1X

r
••
Risk Control # of products with periodic review overdue Leading *t 0J.
• •*.!##•
k *
in Ml Ml MV •IV

• •• S i m — 1 MV •IV m f |Y IM

% open issues raised by audit Lagging ®

• •••#• •* 4»«
•• •
m
0
— 44V in in •IV •IV
♦••• •• •• •••!♦ •
Overdue customer appropriateness reviews Lagging .. .
0
—
^km_ 0 in III IM 41* m

0 m rtx •n m in
— Hv
Number of compliance breaches Lagging i-------- »----
*00 $ * 0•%- 9 ••««•••••!•••
0 0
Ml t il Ml MX
j / w MV

o Includes granular
data and targets
Q Uses both leading
and lagging indicators
0 Provides value-adding
commentary

Conduct metrics Dashboard

F ia u re 5 .6 Design principles for conduct and culture measurement.

Chapter 5 Banking Conduct and Culture ■ 103

 Conduct risk dashboard Settings Log Out

Board View Detailed View

Filte rs Region All ▼ Office All ▼ Periodl 2018 Q1 ▼

M etrics sum m ary Insights All

S ta k e h o ld e r c a te g o ry O v e ra ll s ta tu s C o m m e n ts Feb 12, 2018

Employee turnover
Status: Open
C u s to m e rs a n d
c lie n t s • Spike in LOB 1 employee turnover over the
past two quarters.

Feb 12, 2018

E m p lo y e e s S p ik e in L O B 1 e m p lo y e e
tu rn o v e r

Feb 2, 2018
Employee Hotline Volume
C o m m u n it ie s Status: Resolved
• 10% increase in Employee Hotline volume
across the enterprise during 2017 Q4
• The increase was determined to be the result
S h a r e h o ld e r s
of an employee hotline awareness campaign

S u p e r v is o r s ,
r e g u la t o r s , a n d Feb 2, 2018
g o v e rn m e n ts
Customer Complaints
Status: Resolved

Conduct risk dashboard Settings Log Out

Board View Detailed View

Filte rs Region All ▼ Office All ▼ Period 2018 Q1 ▼

Teammates: Metric overview Insights

Metric ° (v: ra" LOB 1 LOB 2 LOB 3

status Employee turnover
Employee hotline volume and whistleblower cases
Status: Open ▼

Number of misconduct incidents (overall) Spike in US employee turnover over the

Number of employees with a misconduct incident in the past 12
past two quarters. The change is currently
months under investigation.
Rate of employee turnover
• The trend is isolated to LOB1 at London
office 1. LOB 2 in the same office also
Employees: Trends has a spike, but not as large.
Jane Smith, Feb 12, 2018
-

• Reached out to the LOB 1 HR team in

Employee hotline volume Whistleblower cases that office; waiting for their perspective
Volume pegged to historical average Includes both substantiated and before escalating
unsubstantiated cases Jane Smith, Feb 14,2018
-

M
KJ Add an update
US

Employee Hotline Volume

20 Status: Resolved ▼
• 10% increase in Employee Hotline
volume across the enterprise during
10
2017 Q4

Fiq u re 5 .7 Sample conduct and culture dashboards: Board view and detailed view.
Source: Oliver Wyman.

LESSO N 7. Regulation has a limited role to play given that response, undermining the clarity of the message that culture is
culture cannot be mandated or defined by rules; that is, good a matter for banks' boards and executives, creating a mindset
culture cannot be regulated into existence. A number of indus­ of outsourcing good judgment, and forcing disengagement
try leaders raised concerns related to the potential downsides of from activities that may expose banks to future financial pen­
overly prescriptive regulation, such as encouraging a box-ticking alty. Having said that, regulatory agencies are responsible for

104 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 5.8 SKILLS AND CAPABILITIES REQUIRED OF REGULATORS
To effectively assess banks and assist them in effecting last­ well-intentioned manner. Further, supervision of conduct and
ing conduct and culture changes, supervisors themselves culture will involve greater resources and time commitment
will need to evolve in order to be properly equipped with relative to traditional supervisory activities, requiring ongoing
the right skills and capabilities. As one senior industry leader dedication, careful planning, and a deeper understanding of
stated, "a su p e rviso r w ould not undertake the review o f a each bank's business model and strategy.
financial m odel w ithout financial m odeling e x p e rtise ; how
Over time, some supervisors may find themselves needing
can they en g a g e in dialogue and review o f culture w ithout
to reassess their internal governance structure, operating
the skills in behavioral d rive rs?"
model, and rules of engagement. It goes without saying that
Supervisory teams should be composed of experienced there should be no conduct issues among those tasked with
individuals who understand banks' business models and strat­ evaluating conduct. Finally, supervisors should consider lever­
egy, and can engage in judgment-based, forward-looking aging additional expertise from external experts (for exam­
discussions with boards and senior executives about con­ ple, behavioral scientists, governance experts) to bolster the
duct matters. These teams must be adept at leveraging new quality of assessments and strengthen supervisors' knowl­
types of assessment methodologies and be able to identify edge and capabilities going forward.
potential issues and behavioral outliers in a constructive and

safeguarding the safety and soundness of the financial services carry out their responsibilities on a daily basis (that is, they
industry. As such, these agencies cannot be excluded from the are more involved in and aware of the activities and decisions
dialogue and monitoring. being carried out in their organizations). See Box 5.8 for a
discussion of the skills and capabilities required of regulators.
The industry continues to explore effective approaches to regu­
lation and supervision; while there is not yet a consensus view, • SUPERVISION: Supervision has an important role in engag­
agreement is beginning to emerge in some areas, including: ing in a dialogue with the industry and holding up a mirror
to the institution. Supervisors can ask questions of the board
• REGULATION: Regulation can be an effective tool to focus
and management to ensure an appropriate focus on culture
banks' attention on specific and tangible areas of persis­
and conduct topics, and can also share industry best prac­
tent conduct failures (for example, conflicts of interest, risk
tices and learnings. It is important that supervisors share
incentives, and customer protection), in such cases clearly
culture insights that they have gleaned from their work across
outlining basic principles while leaving room for banks to
multiple institutions and in their dialogue with regulatory
own and drive the specifics of implementation. The approach
bodies from around the world.
of principles-based regulation has recently proven effective
in two areas: increasing accountability of senior leadership Supervisors can also help in anticipating future sources of
(FCA's Senior Managers and Certification Regime [SM&CR]) potential misconduct given their broader industry-wide view.
and aligning remuneration policies to drive better conduct Trust, transparency, and open dialogue between banks and
(FC A /EBA guidance on remuneration). Regulatory bodies can supervisors will be critical to allow for this, and to enable
also outline requirements in terms of claw-back practices, early intervention to prevent serious issues before they
including defining the appropriate time period for deferrals materialize.
and clawbacks, which may be too short in some cases today.
• SYSTEMIC ISSUES: Systemic issues such as the "rolling bad
The various senior accountability regimes seen in some juris­ apples" problem cannot be addressed by individual bank

dictions are one way regulation has impacted bank culture. efforts and require collective response across the industry

While the specifics differ, increasingly supervisors are incor­ and regulatory/supervisory bodies.17

porating individual accountability for breaches of conduct LESSO N 8. Restoring trust will benefit the industry as a whole;
in the mandate of their senior management regimes. These as such, industry-wide dialogue and best practices sharing are
are leading to changes in the roles and responsibilities of important elements in the journey toward a stronger and health­
senior leaders and directors, and are also affecting how ier banking sector. The banking industry in major markets should
banks recruit, appoint, train, and compensate their most
senior leaders. It is of course also having a direct impact on 17 Although this must be done within the constraints of local legislation
the mindset and actions of these individuals and on how they and employee protection laws.

Chapter 5 Banking Conduct and Culture ■ 105

 BOX 5.9 TRAINING FOR LASTING BEHAVIORAL CHANGE
Many banks struggle to change their culture because they fail and actions, followed by nudges (ideally every eight or so
to address the issue of behavioral change. Training for behav­ days), seeking to affect the subconsciousness associated with
ioral change is not a linear process, but an iterative process, the change, and finally closing out to reinforce behavioral
with potential loopbacks to allow adjustments and learning. change.
People change their behavior gradually and on an individual
While there is no one-size-fits-all process of behavioral
basis, as behavior is embodied in the person. That is, in the
change, there are typically five stages: awareness (becoming
moment of action, an employee doesn't always think about
aware of the new behaviors and need to change), nudging
his or her behavior, but rather simply behaves according
(starting to experience the impact of the new behaviors),
to subconscious patterns. Changing these behaviors is not
reinforcing (frequent repetition of new behavior delivers
possible in a one-off training or coaching session, but rather
consistent feedback), sustaining (reinforcing structures help
requires repeated rewiring of new patterns and suppressing
embed the change), and, finally, impact (positive results
old ones over a series of reinforcing experiences, often an
appear on both a business and personal level).
awkward and difficult process, until the new patterns move
out of the conscious mind into the subconscious and become A well-designed training program comprises not just the
behaviors. initial training sessions, but also interventions in subsequent
months that help reinforce the behavioral intent. Banks
Neuroscience research suggests that driving behavioral
should look for ways to incorporate such interventions in
change relies on cycles that ensure new behaviors stick,
order to fully reap the benefits of the investment they make
starting with a diagnostic to develop a plan of action, then
in their training programs.
engineering a shock to raise awareness of target behaviors

seriously consider mechanisms of collaboration (for example, evaluating their own firm's practices and collaborating with and
through industry standards organizations) to develop cross­ supporting other banks in identifying changes in conduct and
industry comparisons regarding their progress on culture and culture.
conduct. Even though culture is unique to each institution, col­
The Fixed Income, Currencies and Commodities Market Stan­
laboration and comparisons can benefit the industry by provid­
dards Board also provides good examples of behavioral patterns
ing banks with a view, considered by some to be more honest
evident in misconduct in its July 2018, Behavioural C lu ster A n a l­
than that collected in-house, into their own culture relative to
ysis study.18 The publication provides a practical toolkit to iden­
those of peers. Further, such benchmarking results can provide
tify the root causes and relevant behaviors that underlie market
banks with an objective basis for introspection and construc­
misconduct. The study has identified 25 patterns, which can be
tive challenge, guarding against overconfidence in their own
categorized into seven categories of behavior: Price Manipula­
approaches.
tion, Circular Trading, Collusion & Information Sharing, Inside
The Banking Standards Board (BSB) in the UK provides a good Information, Reference Price Influence, Improper Order Han­
example of this industry-wide collaboration. Established in 2015, dling, and Misleading Customers. The study finds that there are
the BSB is a private, nonregulatory, membership-based orga­ a limited number of patterns that repeat themselves, are juris-
nization open to any bank in the UK. The BSB has provided UK dictionally and geographically neutral, occur across different
banks with an open forum to share and aggregate best practices asset classes, and adapt to new technologies and market struc­
on conduct and culture. One of the cornerstone pieces of work tures. This study also demonstrates that conduct issues are a
achieved and published annually is the BSB Annual Review, long-standing and constant struggle that management must vig­
which assess current and year- over-year changes in behavior, ilantly monitor and mitigate. (See Box 5.9).
competence, and culture in UK banking, and identifies key best
practices from member banks. Though only its second report,
the 2017 Annual Review received over 36,000 responses of
18 "Behavioural Cluster Analysis, Misconduct Patterns in Financial Mar­
input across 25 UK banks, which highlights the keen interest kets," Fixed Income, Currencies and Commodities Markets Standards
and active participation on the part of UK banks in critically Board, London, July 2018.

106 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Risk Culture

Learning Objectives
After completing this reading you should be able to:

Compare risk culture and corporate culture and explain • Describe characteristics of a strong risk culture and
how they interact. challenges to the implementation of an effective risk
culture.
Explain factors that influence a firm's corporate culture
and its risk culture. Assess the relationship between risk culture and business
performance.
Describe methods by which corporate culture and risk
culture can be measured.

E x c e rp t is C h a p ter 2 from Risk Culture in Banking, by A lessa n d ro Carretta, Franco Fiordelisi and Paola Schwizer.
6.1 INTRODUCTION the organization's specific way to perceive, think, and feel in
relation to problems (Schein 2010). Organizational culture deals
Studies on corporate culture have been carried out for a long with different approaches. One takes into account external out­
time. Corporate culture has been a popular management tool puts: environmental, architectural, technological, office layout,
since the early 1980s and, more recently, an intense activity dress code, behavioral standards (visible and audible aspects),
of research on this subject (arisen from the failure of tradi­ official documents (statutes, regulations, and internal commu­
tional cultural models) turned cultural explanations into a more nication), and symbols. Such an analysis is the necessary basis
valuable asset than a simple matter of "claiming the residuals" for investigating principles, knowledge, and experiences that
(Zingales 2015). guide attitudes and behavior. These aspects reflect the internal­
ized core values of the organization and justify the behavior of
In the last decades, the market saw a clear evolution of the
individuals. In fact, basic assumptions which underlie actions are
role of banks, passed from public institutions to profit-driven
often hidden or even unconscious: beliefs determine the way
private entities. A new com petitive environment, in terms
in which group members perceive, think, feel, and therefore,
of actors, rules, geography, and products, produced an
act but are difficult to observe from an outside perspective
evolution of corporate culture in banking. In this fram ework,
(Carretta 2001).
risk culture can be seen as a subculture with a central role
in financial institutions. This Chapter provides an introduc­ Culture is more complex than other organizational variables: it
tion to the concept of risk culture, focusing on its definition, can be extremely effective and at the same time resistant to the
importance, and effects on bank competition and financial need for change dictated by the environment (Fahlenbrach et al.
stability. It includes an in-depth analysis of the relevant litera­ 2012). Culture is, in fact, "what you do and how you do it when
ture and of good/bad practices. This Chapter is structured as you are not thinking about it". If well governed over time, it can
follows: be the glue that holds together a company.

• Definition and measurement of corporate culture and its Culture has always been considered a key tool affecting cor­
impact on corporate behaviors; porate behavior, but authors do not agree on how this occurs.
Some consider culture as a fixed effect on firm performance,
• Presentation of the scope and alternative definitions of Risk
while others argue that it is a variable that can be managed over
culture;
time. Viewing culture as a variable is a quite recent fact, and
• Analysis of drivers and effects of risk culture on sound and several institutions have developed proper management tools
prudent management of financial institutions;
and frameworks to measure and manage it.
• Discussion on main challenges in deploying an effective risk
The discussion is still going on, but, in principle, a culture suitable
culture.
for being applied to a business formula makes a significant con­
tribution to business performance. A suitable culture implies that
6.2 WHAT CORPORATE CULTURE people "make use" of the same assumptions and adopt behavior

IS AND WHY IT MATTERS? inspired by the company's values; this increases the market value
of the company identity. In business, the importance of main­
taining behavior consistent with corporate culture needs to be
Literally speaking, there are many thousands of definitions of
constantly stressed, especially by "leaders", at all levels of the
corporate culture, all sounding subtly different. Literature often
organization. The management should always remind the staff of
refers to corporate culture as the missing link to fully under­
the underlying cultural contents and their positive impact on indi­
stand how organizations act (Kennedy and Deal 1982). Culture
vidual and organization performance, by setting good example
is the result of shared values, basic, underlying assumptions and
and communication. According to economic literature, culture
business experiences, behavior and beliefs, as well as strategic
is a mechanism in such a way that makes the corporation more
decisions. Culture is much more than a management style: it
efficient through simplified communication and decision-taking
is a set of experiences, beliefs and behavioral patterns. It is
process. From this perspective, a strong culture has high fixed
created, discovered or developed when a group of individuals
costs but reduces its marginal costs (Stulz 2014).
learn to deal with problems of adaptation to the outside world
and internal integration. Individuals develop a system of basic The fact that culture can be structured as artifacts, values, and
assumptions proven to be valid by past experience. Members assumptions implies different levels of analysis and assess­
of the same group assimilate these assumptions, which become ment. The purpose of analysis requires a specific level of

108 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
assessment and the most appropriate methodology. However, ethnographic analysis and the case study, which allow an in-
researchers should keep in mind that the study of only the vis­ depth investigation, but at the same time limit the comparability
ible manifestations of culture is likely to describe "how " but of results. According to Schneider (2000), direct observation is
not "why" (Carretta 2001). And as noted by Karolyi, there is a the only way to understand culture, since many of its aspects are
fragility in the measures of the cultural values available to us silent. In addition, people within an organization are not aware
(Karolyi 2015). of how many assumptions affect their behavior and take for
granted that it applies to everyone in the sector. Furthermore,
A number of survey methods and metrics are used, among
cognitive beliefs of researchers may influence their evaluation
others, by firms to investigate the mind-sets underlying culture
capacity. As a consequence, a problem of objectivity prevents
(See Box 6.1).
the possibility for other researchers to replicate the analysis and
In academic literature, there are some relatively well-established confirm its results.
approaches to measuring culture. Qualitative methods are the
On the other hand, quantitative methods use standardized
approaches of analysis through statistical tools. These methods
do not provide in-depth observations but are more objective
BOX 6.1 MEASURING CULTURE AND and allow the comparison of different situations.
CULTURAL PROGRESS: RANGE OF The goal should be to create a homogenous method within
APPROACHES USED BY FIRMS organizations or groups of intermediaries, capable of reflecting
Em ployee engagem ent and culture survey the needs of companies and of the environment. This would
result in a comparable approach compliant with the regulatory
Most firms use annual employee engagement surveys,
supplemented by culture and climate surveys or modules environment. Quantitative methods have been primarily used
added to the regular engagement survey to evaluate culture indirectly, by observing developments in risk
governance and the link between risk governance and the com­
Custom er perceptions and outcom es
pany's risk- return combinations (Ellul and Yerramilli 2013; Lingel
According to some firms, the real test of culture consists and Sheedy 2012; Aebi et al. 2012).
in the outcomes it generates. The focus is particularly on
customer satisfaction scores, while other firms even try to A new and dynamic environment, in terms of actors, rules, geog­
test outcomes (e.g., mystery shopping or regular online raphy, and products has produced an evolution of corporate
panels of customers) culture in the banking sector. In the last century the market saw
Indicator dashboard a clear evolution of the role of banks, passed from public institu­
tions to profit-driven private entities. For some countries, this
Several firms use a range of indicators, sometimes consoli­
dated into "culture dashboards", including: shift was very difficult and driven by an incisive, market-oriented
intervention by regulators, especially in Europe, where the final
• Customers: satisfaction scores, complaints
goal was the creation of a common market. Prudent regulation
• Employees: engagement scores, speaking up scores,
has increased the range of banking services offered and, indi­
turnover, absence rates, grievances, use of whistleblow­
ing lines rectly, competition. In order to prevent excessive risk-taking, the
Basel Committee has promoted the " self-regulation" of inter­
• Conduct and risk: conduct breaches, clawbacks, mate­
rial events, and escalations mediaries, setting up a system of internal controls and a new
compliance function. The new culture of supervisors is based
Validation on the collaboration with banks and this relationship may have
Firms use a range of methods to validate progress or per­ positive effects in terms of bank performances (Carretta et al.
formance and confirm understanding: 2015). The financial behavior of families and firms, traditionally
• Consultancy firms' benchmarking exercises the main banking clients, has also undergone rapid changes.
• Other external benchmarks Family propensity to save has decreased. Families today tend to
• Internal Audit assessments invest more in financial instruments inside or outside their home
• Triangulation across various data sources, e.g. staff and countries, while firms are adopting new forms of financing, by
customer surveys acting directly on the capital markets.

Source: Adapted from Banking Standards Board (2016). These underlying shifts demonstrate the importance of study­
ing the effect of corporate culture on banks' performance and

Chapter 6 Risk Culture ■ 109

competitiveness. The literature on banking culture focuses on 6.3 RISK CULTURE: SCOPE
the existence of a specific culture and on how it reacts to the
new paradigms, showing that culture creates value in firms, and
AND DEFINITION
especially in banks. In an ever-changing market, credit supply
The Oxford Dictionary defines risk as a situation that involves
and screening remain the most important activities undertaken
exposure to danger. Particularly dangerous exposure is called
by banks and represent a basic know-how. This comes from
bad risk. But banks, as well as any other firm, have the same
experience and the «mutual commitment based on trust and
opportunities to take risks of an ex ante reward on a stand­
respect» (Boot 2000), which are the expression of a specific
alone basis. This risk is being called "a good risk". One might
bank's culture.
be tempted to conclude that good risk management reduces
In some cases, culture in the financial institutions has demon­ the exposure to danger. However, this view of risk manage­
strated the ability to integrate companies' know-how and new ment ignores the fact that banks cannot succeed without taking
market opportunities. For example, the entry of banks into the risks that are ex ante profitable. Consequently, taking actions
insurance business was difficult, due to limited experience with that reduce risk can be costly for shareholders when lower risk
sophisticated products. On the other hand, insurers had limited means avoiding higher risk valuable investments and activities.
experience with bank retail client requirements. The problem Therefore, from the perspective of shareholders, valuable risk
was solved through successful strategic alliances in which banks management does not reduce risk in general, since reducing risk
used their distribution capacity and insurers developed simpler would mean not taking on valuable projects. If good risk man­
products. Culture has also driven the creation of new approaches agement does not mean low risk, then what does it mean? How
to answer increasing competition. A "culture of distribution" has is it implemented? What are its limitations? What can be done
replaced the pre-existing "culture of production". Due to this to make it more effective? (Stulz 2014). These questions can be
change, management has shifted the focus from an efficient ser­ answered by looking at the concept of risk culture.
vice development towards an effective selling system. This new
Some authors define risk culture (RC) as an element of corporate
perspective is centered on creating unique and personalized
culture; it is what in the culture relates to risk (Power et al. 2013).
conditions to attract the highest possible number of clients.
It is a product of organizational learning concerning what has or
In the new context, culture is a resource rather than a limitation. has not worked in past investments and procedures of a financial
If adequately taken into consideration, it can ensure the suc­ institution (Roeschman 2014). RC could be seen as a subculture
cess of complicated events such as mergers and acquisitions. with a central role in financial institutions. In fact, the culture of an
The "one size fits all" solution is not valid anymore, and despite organization is neither unique, nor uniform throughout the com­
cultural integration is never easy, effective management is the pany (Schein 2010). The growing complexity of operations, roles,
only chance to make it successful (Carretta et al. 2007). Part of and activities performed by firms produces different subcultures at
the literature considers culture as a static element to be devel­ all levels of the organization; for example, the point of view on the
oped only in the long-term, but many authors and practitioners environment taken by the risk management department can sub­
highlight that culture may be used in order to improve firm stantially differ from that taken by the business line. In this case,
performance and stability. Nowadays, it is particularly difficult to RC interacts with dominant corporate culture and subcultures to
develop and implement a strategy due to the intrinsic variability ensure a continuous balance between the need for integration
of the market, with controls becoming increasingly complicated and the opportunity for differentiation of these two perspectives.
due to a wider range of bank activities and functions. In this con­ This balance is the basis for the adaptation to the environment
text, culture can create shared values to drive individual behav­ and for business changes. Box 6.2 presents a selection of the
ior in pursuing the organizational strategy and assisting the role existing definitions for RC in financial institutions; the main ones
of internal controls. are by FSB, Institute of International Finance (IIF) and Institute of
To conclude, a specific corporate culture exists in the bank­ Risk Management (IRM). These institutions use concepts that are
ing sector and literature shows that, in specific contexts, it widely used in literature to define corporate culture, such as val­
can change and help bank stability. Empirical studies confirm ues, norms, ethics, and traditions. The FSB and IIF definitions are
it (Carretta 2001): positive relations with the environment are very similar; in fact, both define RC as norms and behavior related
linked with an open culture. Banks have overcome their previous to how individuals identify, understand, discuss (risk awareness ),
specialization, developing various new internal competences: and act (risk-taking and management) concerning the risks. The
integration, teamwork, and interpersonal relations are the base IRM definition, on the other hand, refers to values and beliefs, and
for a new model of leadership. However, the results also show is in line with previous literature, which asserts that basic assum p­
that this new culture is not yet widespread. tions (beliefs) are at the heart of culture (Schein 1990).

110 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 discuss, and act on the risks» (IRM 2012). So, RC is related to
BOX 6.2 RISK CULTURE «risk awareness, risk-taking and risk management, and controls
DEFINITIONS that shape decisions on risks», which act at all levels of the insti­
tution «during the day-to-day activities and have an impact on
Risk culture can be defined as the norms and traditions
of the behavior of individuals and of groups within an the risks they assume» (FSB 2014).
organization that determine the way in which they identify,
understand, discuss, and act on the risks the organization
confronts and the risks it takes ( Institute o f International 6.4 RISK CULTURE: DRIVERS
Finance 2009).
AND EFFECTS
«A bank's norms, attitudes, and behavior related to risk
awareness, risk-taking and risk management and controls First of all, RC depends on national culture and environment.
that shape decisions on risks. Risk culture influences the
As far as culture is concerned, some countries are more homo­
decisions of management and employees during the day-
geneous than others, even though sometimes, areas having
to-day activities and has an impact on the risks they assume»
(Financial Stability Board 2014; Basel Com m ittee 2015). a similar culture are part of different nations. Despite these
limitations, comparing national cultures is still a meaningful and
«Risk Culture is a term describing the values, beliefs,
knowledge, and understanding about risk shared by a revealing venture and has become part of the main social sci­
group of people with a common purpose, in particular, the ences. Research by Hofstede has shown that national cultures
employees of an organization or of teams or groups within differ particularly at the level of habitual, unconscious values
an organization)) ( Institute o f Risk M anagem ent 2012). held by the majority of a population. According to Hofstede, the
«Barclays risk culture is the set of objectives and practices, dimensions of national cultures are rooted in our unconscious
shared across the organization, that drive and govern risk values. Provided that these values are acquired in childhood,
management ( Barclays PLC). national cultures are remarkably stable o vertim e; changing
Number of levers are used to reinforce the risk culture, national values is a matter of generations. Instead, practices
including tone from the top, governance and role change in response to the changing circumstances: symbols,
definition, capability development, performance
heroes, and rituals change, but underlying values are largely
management and reward)) ( Lloyds Banking G roup).
untouched. For this reason, differences between countries have
«Risk culture is characterized by a holistic and integrated such a remarkable historical continuity.
view of risk, performance, and reward, and through full
compliance with our standards and principles)) (UBS). Similarly, culture is very much a product of the environment
«lt can be defined as the system of values and behavior (Lo 2015). The International Monetary Fund has published
present throughout an organization that shapes risk deci­ empirical evidence covering about 50,000 firms in 400 sectors
sions. Risk culture influences the decisions of management in 51 countries, according to which firms operating in countries
and employees, even if they are not consciously weighing characterized by lower aversion to uncertainty, greater indi­
risks and benefits)). (Farrel and Hoon 2009)
vidualism and sectors with a strong opacity of information such
«The behavioral norms of a company's personnel with as the financial world have a more aggressive risk culture, and
regard to the risks presented by strategy execution and "even in a highly-globalized world with sophisticated managers,
business operations. In other words, it is a key element
culture matters" (Li et al. 2013). Furthermore, these aspects will
of a company's enterprise risk management framework,
albeit one that exists more in practice than in codification)) be discussed in the following subsections: the impact of regula­
(Sm ith-Bingham 2015). tion and its underlying culture (Carretta et al. 2015), as well as
supervision pervasiveness of a company's risk culture (Power
«Risk culture encompasses the general awareness,
attitudes, and behavior of an organization's employees et al. 2013). In the financial system, supervisors and supervised
toward risk and how risk is managed within the parties can collaborate in order to improve the culture of risk,
organization. Risk culture is a key indicator of how widely fully aware that it is a sensitive area requiring time and resources
an organization's risk management policies and practices (Senior Supervisors Group 2009; Group of Thirty 2008).
have been adopted)) (D elo itte Australia 2012).
Culture directly impacts on corporate risk-taking not merely
through indirect channels such as the legal and regulatory
frameworks (Mihet 2012).
Concluding, RC is composed of underlying assumptions and the
way they turn into norms, values, and artifacts. Not all assump­ Risk culture also impacts on characteristics and behavior of a
tions are relevant, but only those about risk or, more precisely, firm and at the same time is an expression of them. Over time
those that affect «the way in which they identify, understand, (Fahlenbrach et al. 2012), it can regulate the possibility for

Chapter 6 Risk Culture ■ 111

 BOX 6.3 THE MACQUARIE UNIVERSITY RISK CULTURE SCALE
The Macquarie University Risk Culture Scale was used to the importance of anonymous and independent risk cul­
assess the culture in 113 business units across three large ture assessments where staff felt safe to reveal their true
banks, two headquartered in Australia and one in North beliefs.
America. • There were statistically significant differences between the
The main findings were as follows: risk cultures of the three large banks analyzed.

• Strong risk culture was generally associated with more • The majority of business units assessed (more than 95%
desirable risk- related behavior (e.g., speaking up) and less of 113) had an internally consistent perception of culture,
undesirable behavior (e.g., manipulating controls). namely, there was a strong or obvious culture in the unit
(i.e., not just the perception of an individual but a qual­
• Personal characteristics were also important. Long-tenured ity of the group). However, it should be noted that there
and less risk tolerant employees, and employees with a might have been agreement on the fact that culture was
positive attitude towards risk management were more good or poor.
likely to display desirable risk-related behavior. Those with
• The most significant variation in risk culture scores
high personal risk tolerance were more likely to display
undesirable risk-related behavior. occurred at the business unit level and seemed to be
driven by the local team environment. This was consis­
• Good risk structures (policies, controls, IT systems, training, tent with the hypothesis that culture was a local construct
and remuneration systems) appeared to support a strong highly dependent on interactions with close colleagues
culture and ultimately a less undesirable risk behavior. and immediate managers.
Good risk structures did not by themselves guarantee good
behavior. Early results suggested that structures such as Source: Adapted from Elizabeth Sheedy and Barbara Griffin, Empiri­
remuneration were interpreted through the lens of culture. cal Analysis of Risk Culture in Financial Institutions: Interim Report,
• Senior staff tended to have a significantly more favorable Macquarie University, November (2014).
perception of culture than junior staff. This highlighted

businesses to adapt to the changing environment, but it may bank's overall corporate governance (i.e. shareholders, board of
also change if it is no longer able to solve an organization's directors, management, and auditors).
problems (Richter 2014). Therefore, it will only affect the role
Subcultures may exist depending on the different contexts within
of risk management in the organization; even in case of highly
which parts of an institution operate (See Box 6.3). However,
sophisticated and formalized risk governance, risk culture is still
subcultures should adhere to the high-level values and elements
in charge of deciding which rules and behavior are important
that support an institution's overall risk culture. A dynamic bal­
(Roeschmann 2014; Stulz 2014). As a mechanism of control over
ance is required between the value generated by the differences
behavior, risk culture can impact on results, and if it is strong
in risk perception and that generated by a unitary risk approach.
and in a stable environment, it can become more persistent over
time (Sorensen 2014).

The organization is perhaps the "elementary unit" for the analy­

6.5 CHANGE AND CHALLENGE:
sis of culture (Carretta 2001) and risk culture, but the individual DEPLOYING AN EFFECTIVE RISK
is the unit in terms of personal integrity and propensity towards CULTURE
risk. High levels of perceived integrity are positively correlated
with good incomes, in terms of higher productivity, profitability, Risk culture is not a static thing but a formal and informal process
better industrial relations, and a higher level of attractiveness continuously repeating and renewing itself. Risk culture, as well
to prospective job applicants (Guiso et al. 2015), but individual as corporate culture, evolves over time in relation to the events
behavior appears to be influenced by both context and profes­ that affect an institution's history (such as mergers and acquisi­
sional identity which, once more, confirm the key importance of tions ) and to the external context within which it operates.
the organization (Villeval 2014).
Building a sound risk culture is a collective process, not simply a
Obviously, risk culture can appear in different forms as sub­ matter of improving technical skills. Risk culture shall be a part
cultures, or even conflicting countercultures, in the following of a business and not simply of the supervision, which is not
areas: type of risk (i.e., credit or market), business functions and necessarily a good proxy. Therefore, it concerns decisions and
families in which it develops, prevailing business models, roles in actions on a daily basis, such as the way information is shared,

112 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 of a complex organization like a bank is possible, but difficult
BOX 6.4 "USING" CULTURE and requires the awareness of the need for change, many

Although its influence on firm behavior has long been resources, and a long time. In fact, relationships between
clear, culture has only recently been discovered as a management actions and culture are not necessarily linear, as
dependent variable of planning by management litera­ there are multiple, complex issues relating to proportionality
ture. In theory, culture suited to the type of enterprise can and accountability of individuals versus institutions that require
make a significant contribution to firm success. This means consideration by enforcement agencies (Group of Thirty 2015).
that people "make use of" culture, that their behavior
A major improvement in culture can be secured by focusing on
is inspired by company values, and that they have com­
municated company values to the market, emphasizing values and conduct, which are the building blocks of culture.
the positive aspects of its culture (Hofstede 1983). It is (2) Change necessitates a systemic approach to all subjects
necessary for the "bosses" at all levels to continuously involved, by taking into account their mutual roles. A sustained
emphasize the importance that behavior adheres to com­ focus on conduct and culture shall be carried out by banks
pany culture, repeat and strengthen its basic contents and
(board and management), and the banking industry. All is
remind people that it has a positive impact on people and
needed to make major improvements in culture within the bank­
company performance.
ing industry and individual institutions (Group of Thirty 2015).
Addressing cultural issues must of necessity be the responsibility
of the board and management of firms. Supervisors and regula­
the people being asked, when something went wrong, the
tors cannot determine culture, but the former has an important
capacity to represent risk inside the organization and the under­
monitoring function. (3) In order to be successful, the new cul­
standing and correct use of documents. It also includes what
ture has to be profitable and create real value for all subjects,
"worked" in the past. With the changing of both external and
institutions, and individuals which present forms on their own
internal conditions, culture too changes along with a strategic
motivations explaining their possibly diverging behavior (Lo
change (See Box 6.4). Obsolete business culture is an obstacle
2015). The effect of all this should be the creation of a competi­
to improving performance.
tive advantage for firms with better cultures and conducts, with
The Group of Thirty (2015) states that culture and behavior respect to client reputation and the ability to attract staff and
in today's financial systems and institutions are inadequate. investors. Banks will only succeed if they accept that culture is
An important finding is that a suitable culture, with particular core to their business models and if they decide that fixing cul­
regard to risk, is not a critical success factor but is displayed ture is key to their economic sustainability (Dickson 2015).
only to meet the expectations of a public, customers or norms
The assessment of a bank's risk culture and the perception
at particular times. It is not central to governance organs or
of its possible distance from a culture that can be considered
senior management. It is not sufficiently rewarded in perfor­
adequate to context, business model, and government require­
mance management and does not feature in bank personnel
ments are matters for the individual bank according to its char­
training. It does not dialogue with three lines of risk defense,
acteristics. In fact, there is no doubt that risk culture is widely
(business, supervision and risk management, auditing). In the
inadequate today and that there is a need to move from "form
United Kingdom, the Banking Standard Board has been set up
to substance". The attitude "I have complied with the regula­
by seven big banks in response to the findings of a Parliamen­
tions" needs to be replaced by "I have done everything possible
tary Commission. The Board aims to raise and spread behavioral
to prevent and resolve problems". Just because it is legal it
standards inside the British financial system, thus contributing to
does not mean that it is right (See Box 6.5).
the continuous improvement in bank behavior and culture».
A process of cultural change is ambitious as it involves many
The main changes since 2008 in the risk culture scenario are
players. It is the case that bank shareholders, management,
enforcement in legislation, growth of the risk function, introduc­
bank staff, parliament, government, legal system, supervision
tion of balanced scorecards replacing sales staff performance
authorities, media, education system, and customers are respon­
indicators, shift in focus from compliance to conduct, and cul­
sible for the current unsatisfactory situation to various degrees.
ture becoming a board issue (Cass Business School 2015).
What matters today is that all these forces are involved in a
So how can a renewed culture be fully developed and spread in common effort to promote a new banking culture shared by
a bank today? both banking authorities and clientele. And, importantly banks
themselves shall play an active role in this new cultural change.
Theory and cross-industry experiences clearly demonstrate
that three mechanisms are critical for achieving the cultural Risk culture is a sensitive area and cannot be dealt with on the
transformation of the banking sector. (1) Changing the culture single dimension of lowering risk propensity by strengthening

Chapter 6 Risk Culture ■ 113

 BOX 6.5 MEASURES TO REDUCE MISCONDUCT RISK
Codes and standards of conduct have been in place across manner that is consistent across the industry, requires
the industry for some time. The issue was not the develop­ the developm ent of a consistent set of definitions,
ment of codes or standards, but their effective implemen­ methods of assessm ent, and measurement of conduct
tation and enforcement across diverse business lines and risk. These risks vary across product lines and may vary
jurisdictions. Official sector and private sector representa­ with the organizational structure of businesses within
tives noted that the effective implementation of conduct firms.
risk management involves fundamental changes in culture • Grey areas. Actions that are not "illeg al" but which,
and behavior across the industry, involving firms and market under particular circum stances, could be inconsistent
stakeholders. Such changes take time. with a firm's values are som etim es difficult to address
Critical implementation challenges include: because they are often dependent on facts and circum­
stances. Frontline em ployees are often called upon to
• Integration in business decision-making. The integration of exercise their discretion in fulfilling custom er requests;
behavior and ethical considerations in business decisions these decisions are som etim es com plex and can vary
(which could involve limiting or withdrawing from certain across business lines. Under these circum stances, it is
transactions or businesses) challenges the "prevailing con­ difficult to make prior determ inations on the best course
sensus" on success; other stakeholders, including a firm's of action or to define clear boundaries. Firms need to
customers and shareholders, may need to be involved in develop fram eworks to address these questions in a
supporting these changes. consistent manner. A visible institutional leadership in
• Consistency of messages and action. The "tone at the resolving and sanctioning a weak management of con­
top" is not always supported by consistent actions that duct risk will be important. Engaging business lines in
demonstrate that conduct and ethical considerations vis­ cooperative approaches to identifying conduct risk such
ibly determine hiring, promotions, professional standing, as "reporting in the public interest" may help overcome
and success. This requires coordinated engagement of all limitations of "w histleblow ing" approaches, which risk
parts of the organization; ethical and behavior consider­ putting em ployees and the institution on opposite
ations cannot, therefore, be segregated into compliance sides. It was however noted that there was a significant
or human resources functions. Ensuring that senior level amount of regulation and case law in existence which
employees take responsibility for driving forward changes should help give firms clarity on what constituted a
is important to success. breach of regulation or law.
• Cross-border and cross-cultural issues. Supervisors, clients, • Role of directors. W hile board oversight of conduct risk
and stakeholders have different expectations and perspec­ is critical to the strengthening of conduct risk m anage­
tives of the role of financial services providers. As such, ment, an appropriate balance should be established
approaches to conduct risk management, as well as rules between the accountability of individual executives and
relating to permissible incentives regarding conduct, differ the board, in particular, N ED s. It was acknowledged that
across jurisdictions. These differences pose challenges for boards are facing increased pressure and that there may
global firms seeking to establish consistent expectations be a risk that this could potentially create disincentives
across the institution. for experienced and qualified experts to serve on them.
• Common taxonom y for conduct risk. The integration
of conduct risk in all aspects of a firm's business, in a Source: Adapted from Financial Stability Board (2015).

supervision. The most fundamental issue in the risk culture management tool and need to be explained in detail for a cor­
debate is the trade-off between risk-taking and control (Power rect balance between risk-taking and the maintaining of an
et al. 2013). appropriate level of control. "Bad apples" in a bank shall not be
allowed to take the blame for specific behavior which reflects
As reported in the Financial Times, the C EO of UBS recently
a weak risk culture. Rather than a lack of personal integrity or a
commented that: "Mistakes are ok . . . try to eliminate all risk­
"natural" tendency towards dishonesty, non-compliant behavior
taking and threaten to punish all mistakes and the ensuing
is, in fact, the outcome of exogenous environmental and com­
culture of fear will limit the pursuit of legitimate business." The
pany factors which deform the sound conversion of individual
controversy caused by these comments showed that seeking
values into behavior and actions, which, in other words, reflect
to completely eliminate risk, which after all underpins all finan­
a firm's unsatisfactory risk culture. An experiment recently per­
cial intermediation, is unrealistic. Instilling into the personnel
formed on a sample of bank managers compared with other
the fear of making mistakes can only lead to immobility. In the
sectors aiming to test their propensity to lie yielded interesting
context of a robust and sound culture of risk, mistakes are a

114 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
findings. The propensity to lie is similar in different sectors and Carretta, A ., Farina, V., Schwizer, P. "Cultural Fit and Post-merger
in normal conditions, but rises significantly for managers, whose Integration in Banking M&As". Jou rn a l o f Financial Transform a­
work environment (in this case the bank) is mentioned (Cohn tion 33 (2007): 137-155.
et al. 2014).
Cass Business School. "A Report on the Culture of British Retail
Risk culture is definitively 100% compatible with risk-taking and Banking". London, UK: New City Agenda and Cass Business
profit-making. A sound risk culture helps ensure that activities School, November 24, 2014.
beyond the institution's risk appetite are recognized, assessed,
Cohn, A ., Fehr, E., Marechal, M. A. "Business Culture and
escalated, and addressed in a timely manner (Dickson 2015).
Dishonesty in the Banking Industry". Nature 516 (2014): 86-89.

Deloitte Australia. "Cultivating an Intelligent Risk Culture: A Fresh

CONCLUSIONS Perspective". Sydney, AU: Deloitte Touche Tohmatsu Ltd. (2012).

Dickson, J . "The Relevance of the Supervision of Behavior

Culture matters. Risk culture is essential for a prudent and sound and Culture to the SSM ". Amsterdam, NED: 'Looking
bank management, and needs to be central in any evaluation. forw ard: Effective Supervision o f Behavior and Culture at
Risks are an inherent aspect of bank function and are taken, Financial Institutions ' C o n feren ce in the Tropenmuseum, De
transformed, and managed with competence and profession­ Nederlandsche Bank, Amsterdam, September 24, 2015.
alism. In this sense, risk culture is central to banks and has an
Ellul, A ., Yerramilli, V. "Stronger Risk Controls, Lower Risk:
impact on risk-taking propensity and policies, types of risk assess-
ment/performance ratio and final decisions. The behavior of Evidence from U.S. Bank Holding Com panies". Jou rn a l o f
Finance 68 (2013): 1757-1803.
banks and their personnel are a direct expression of risk culture.

Banks must develop their risk culture beyond regulatory Fahlenbrach, R., Prilmeier, R., Stulz, R. M. "This Time is the

guidelines, in order to support their corporate strategy and Same: Using Bank Performance in 1998 to Explain Bank Perfor­

strengthen their core skills, and turn risks into opportunities. mance During the Recent Crisis". Jou rn a l o f Finance 67 (2012):

They are required to commit, to more effectively improving their 2139-2185.

culture. The banks which are successful at doing this with consis­ Farrel, J. M., Hoon, A. What's Your Com pany Risk C ulture? US:
tency, awareness, and determination in strategic decisions will KPMG US Lip., May, 2009.
raise and consolidate their market reputation.
Financial Stability Board, FSB. G uidance on Su p erviso ry Interac­
tion with Financial Institutions on Risk Culture. A Fram ew ork

BIBLIOGRAPHY for A sse ssin g Risk Culture, FSB Publications, Policy Documents,
April 7, 2014.

Aebi, A . B., Sabato, G ., Schmid, C. "Risk Management, Corpo­ Financial Stability Board, FSB. M easures to R ed u ce M isco n d u ct
rate, Governance and Bank Performance in the Financial Crisis". Risk, FSB Publications, Progress Reports, November 6, 2015.
Jou rn a l o f Finance and Banking 36 (2012): 3213-3226.
Group of Thirty. Banking C o n d u ct and Culture. A Call for S u s­
Basel Committee on Banking Supervision, BSCBS Publications. tained and C om preh en sive Reform , Washington DC, US: Group
C o rp o ra te G overnance Principles for Banks. G uidelines, 2015. of Thirty, July, 2015.

Banking Standards Board. Annual R eview 2015/201 6, London, Guiso, L., Sapienza, P., Zingales, L. "The Value of Corporate
March 8, 2016. Culture". E IE F W orking p a p e r 27 (2013).

Boot, A. W. A. "Relationship Banking: What Do We Know?" Hofstede, G . H. "The Cultural Relativity of Organizational Prac­
Jou rn a l o f Financial Interm ediation 9 (2000): 7-25. tices and Theories". Jou rn a l o f International Business Stu d ies
14(1983): 75-89.
Carretta, A ., Farina, V., Fiordelisi, F., Schwizer, P., Stentella
Lopes, F. S. "Don't Stand So Close to Me: The Role of Supervi­ Institute of International Finance(IIF). Reform in the Financial
sory Style in Banking Stability". Jou rn a l o f Finance & Banking Services Industry: Stren gth en in g Practices for a M ore Stab le S y s­
52 (2015): 180-188. tem , Report of the 11F Steering Committee on Implementation,
2009.
Carretta, A. (ed.). II g o vern o d e l cam biam ento culturale in
ban co: m odelli di analisi, strum enti operativi, valori individuali, Institute of Risk Management. Risk Culture U nder the
Rome, ITA: Bancaria Editrice (2001). M icro sco p e G uidance for Board, 2012.

Chapter 6 Risk Culture ■ 115

Karolyi, G . A. "The Gravity of Culture for Finance". Jou rn a l o f Schein, E. H. Organizational Culture and Leadership, 4th Edition,
C o rp o ra te Finance 41 (2015): 610-625. San Francisco, US: Jossey-Bass Inc. (2010).

Kennedy, A. A ., Deal, T. E. C o rp o ra te C ultures: The Rites and Schneider, B. The Psychological Life o f O rganizations in H and­
Rituals o f C o rp o ra te Life, New York, US: Perseus Books (1982). b o o k o f O rganizational Culture and Clim ate, eds. Ashkanasy,
Neal, M., Wilderom, Celeste, P. M., Wilderom and Peterson,
Li, K., Griffin, D., Zhao, L. "How Does Culture Influence Corpo­
Mark. F., London, Thousand Oaks, New Delhi, UK, US, IND:
rate Risk-taking?" Jou rn a l o f C o rp o ra te Finance 23 (2013): 1-22.
Sage (2000).
Lingel, A ., Sheedy, E. A. "The Influence of Risk Governance on
Senior Supervisors Group. Risk M anagem ent Lesso n s from
Risk Outcomes— International Evidence". M acquarie A p p lie d
Financial Crisis 2008, 2009.
Finance C entre Research Paper 37 (2012).
Sheedy, E., and Griffin, B. Em pirical Analysis o f Risk Culture in
Lo, A. W. "The Gordon Gekko Effect: The Role of Culture in the
Financial Institutions: Interim R ep ort, Sydney, AU: Macquarie
Financial Industry". N B ER W orking Papers 21267 (2015).
University (2014).
Mihet, R. "Effects of Culture on Firm Risk-Taking: A Cross-country
Smith-Bingham, R. Risk Culture: Think o f the C o n seq u e n ces,
and Cross-industry Analysis". IM F W orking Paper 210 (2012).
New York, US: Risk Management Insights, Marsh & Me Lennan
Power, M., Ashby, S., and Palermo, T. Risk Culture in Financial Companies, Oliver Wyman (2015).
O rganizations: A Research R ep o rt, London, UK: London School
Sorensen, J . B. "The Strength of Corporate Culture and the
of Economics (2013).
Reliability of Firm Perform ance". A dm inistrative Scien ce
Richter, C. "Developm ent of a Risk Culture Intensity Index to Q uarterly 47 (2014): 70-91.
Evaluate the Financial Market in Germ any". P ro ceed in g s o f
Stulz, R. M. "Governance, Risk Management, and Risk-Taking in
FIK U SZ Sym posium fo r Young R esea rch er 14 (2014): 237-248.
Banks". Finance W orking Paper 427 (2014).
Roeschman, A . Z. "Risk Culture: What it is and how it Affects an
Villeval, M. C. "Behavioural Economics: Professional Identity Can
Insurer's Risk Management. Risk Management and Insurance".
Increase Dishonesty". Nature 516 (2014): 48-49.
Risk M anagem ent and Insurance R eview 17 (2014): 227-296.
Zingales, L. "The 'Cultural Revolution' in Finance". Jou rn a l o f
Schein, E. H. "Organizational Culture". The Am erican Psychologist
Financial Eco n om ics 117 (2015): 1-4.
Association 45 (1990): 109-119.

116 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
OpRisk Data and
Governance
Learning Objectives
After completing this reading you should be able to:

Describe the seven Basel II event risk categories and identify Describe and assess the use of scenario analysis in
examples of operational risk events in each category. managing operational risk and identify biases and
challenges that can arise when using scenario analysis.
Summarize the process of collecting and reporting
internal operational loss data, including the selection of Compare the typical operational risk profiles of firms in
thresholds, the time frame for recoveries and reporting different financial sectors.
expected operational losses.
Explain the role of operational risk governance and
Explain the use of a risk control self-assessment (RCSA) explain how a firm's organizational structure can impact
and key risk indicators (KRIs) in identifying, controlling, risk governance.
and assessing operational risk exposures.

E x c e rp t is C h a p ter 2 o f Fundamental Aspects of Operational Risk and Insurance Analytics: A Handbook of Operational Risk,
by M arcelo G. Cruz, Gareth W. P eters, and Pavel V. Sch evch en ko.

117
7.1 INTRODUCTION producing a classification. For example, the fact that dolphins
live in the sea and look like a fish does not make them a fish as
One of the first and most important phases in any analytical pro­ many of their characteristics made biologists classify them as
cess, and this is certainly no different when developing OpRisk "m am m als". Taxonomy basically encompasses description, iden­
models, is to cast the data into a form amenable to analysis. This tification, nomenclature, and classification. Therefore, taxonomy
is the very first challenge that an analyst or quant faces when has become an interesting and a popular turn in risk manage­
determined to model, measure, and even manage OpRisk. At ment industry as new risks are being encountered at regular
this stage, there is a need to establish how the information avail­ intervals.
able can be modeled to act as an input in the analytical process Before getting onboard the risk taxonomy bandwagon, a firm
that would allow proper risk assessment to be used in risk man­ must perform a comprehensive risk mapping exercise. This
agement and mitigation. In risk management, and particularly in means going through, in excruciating details, every major pro­
OpRisk, this activity is today quite regulated and the entire data cess of the firm. For example, let us imagine the equity trading
process, from collection to maintenance and use, has strict rules, process. Analyzing this process would mean going through the
which in a way reduces the variance in the use of the data across risks since the customer places an order until the transaction
the industry. gets fully settled with exchanges of payment and securities
The OpRisk framework starts by having solid risk taxonomy so delivered. Those will be the basic risks that unlikely would
risks are properly classified. Firms also need to perform a com­ change, unless there is a change in the process. From this pro­
prehensive risk mapping across their processes to make sure cess, a risk manager should also be able to point out where
that no risk is left out of the measurement process. This is a key losses are coming from and develop mechanisms to collect
process to be accomplished and where a number of firms should them. The outcome of this exercise would be the building block
be paying more attention. of any risk classification study.

In this chapter, we lay the ground for the basic building blocks It is interesting to note that even today firms are struggling
of OpRisk management. First we describe how risk taxonomy with basic risk classification, which is the base of the risk man­
works, classifying loss events into the major risk categories. Then agement pyramid, the very first building block of a robust risk
we describe the four major data elements that should be used management framework. Mistakes made in the past years in
to measure and manage OpRisk: internal loss data, external classifying a risk will have repercussions in the risk management
loss data, scenario analysis, and business and control environ­ and on the communication of risks, at a minimum, to outside
ment factors. When these risk mapping, taxonomy, and data parties like regulators, and might compromise any good work
building blocks are reasonably structured, it becomes important done elsewhere in the framework. There are roughly three
to configure the organization of the OpRisk department and a ways that firms drive this risk taxonomy exercise: cause-driven,
firm's risk governance. Even a very efficient and well-developed impact-driven, and event-driven. In many firms, risk taxonomy
OpRisk framework would fail if the proper organization and poli­ is a mixture of these three making it even more difficult to get
cies are not in place. it right. Let us discuss these three methods. In the cause-driven
method, the risk classification is based on the reasons that cause
operational losses. This usually follows the old OpRisk definition
7.2 OPRISK TAXONOMY (which most firms use in their annual reports) in which OpRisk is
defined as a function of "people, systems, and external events".
The term "taxonomy" has become quite popular in the risk Some risk types in this classification would be, for example,
management industry. In most conferences and industrial work­ "lack of skills in trade control" or "inappropriate access control
shops, and most certainly among consultants, the term "risk to system s". Although there are some advantages in this type of
taxonomy" has become a regular mantra. So, what is risk taxon­ classification, as a "root cause" is pretty much embedded into
omy? Taxonomy is actually a term borrowed from biology. One the risk classification, challenges arise when multiple causes exist
of the missions of the biologist is to discover new species on or the cause is not immediately clear. If this cause-driven risk
remote places of the planet and it would make their work easier classification is applied to a process in which operational losses
if they could classify a new species into a new group based have high frequency, it would be very difficult for risk manag­
on some characteristics. So taxonomy means the conception, ers to correctly classify every single loss, and the attrition within
naming, and classifying organisms into groups. It is a common the business and within the department is likely to be high.
practice in biology to group individuals into species, arranging Another way to perform this classification exercise is through an
species into larger groups, and giving those groups names, thus impact-driven method. In this method, the classification is made

118 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
according to the financial impact of operational losses. Most OpRisk framework, firms need to be very careful. In the following
firms that follow this type of classification do not invest heavily sections, all seven Basel II event types required for the advanced
in OpRisk management; they just use this type to retrieve data measurement approach (AMA) are defined and discussed in
from their systems. This is quite common in smaller firms. In this detail; detailed breakdown into event types at level I, level 2, and
type of classification, it is quite difficult to manage OpRisk as, activity groups is provided in BCBS (2006, pp. 305-307).
although the exposures are known, it is difficult to understand
what is driving these losses. Execution, Delivery, and Process
The event-driven risk classification is probably the most common Management
one used by large firms. It classifies risk according to OpRisk
EDPM loss event type is one of the most prominent in the
events. This is the classification used by the Basel Committee.
OpRisk profile of firms or business units with heavy transaction
It is interesting to know that during the Basel II discussions,
processing and execution businesses. It encompasses losses
when this type of risk taxonomy was presented, most of the
from failed transaction processing, as well as problems with
industries were reluctant to accept it. A number of firms, even
counterparties and vendors. Table 7.1 describes the Basel event-
today, follow their own classification initially and map to the
type breakdown for this risk.
Basel event-type category later. What is interesting in this clas­
sification is that the definition is rather broad which should make Losses of this event type are quite frequent as these can be
it easier to accept changes in the process. For example, under due to human errors, miscommunications, and so on, which are
"Execution, Delivery, and Process Management" (EDPM ), which very common in an environment where banks have to process
is the level-1 event type, there is a category named "Transaction millions of transactions per day. A typical example of execution
Capture, Execution, and Maintenance" that can be an umbrella losses might help to illustrate how frequent these losses can be.
for a number of event types. For example, if the equity trading
Consider the following deal: A foreign exchange (FX) trader
process changes from an old-fashioned phone-based system to
bought USD 100,000,000 for €90,000,000 (i.e., USD 1 = €0.90)
online high-frequency trading, using this classification would be
and then sold USD 100,000,000 for €90,050,000 (i.e.,
easy to define the taxonomy of these risks.
USD 1 = €0.9005) with a trading initial profit of €50,000. Both
Given how new risks emerge in OpRisk, and also the breadth of its transactions were made almost at the same time, and the trader
scope, the concept and the ideas behind risk taxonomy in OpRisk was obviously very satisfied with a profit of €50,000. In his/her
sound quite appealing. However, as this is a building block of the excitement at the successful deal, however, there were some

Table 7.1 Ex ecu tio n , D elivery & P ro cess M an ag em en t (ED PM ) Event-Type D efin ed as L o sse s fro m F a ile d
T ra n sa c tio n P r o c e s s in g o r P r o c e s s M a n a g e m e n t , fro m R e la tio n s w ith T ra d e C o u n t e r p a r t ie s a n d V e n d o r s . Basel II
e v e n t ty p e classification as p ro vid ed in B C B S (2006, pp. 3 0 5 -3 0 7 )

Category (Level 1) Categories (Level 2) Activity Examples

Execution, Delivery & Transaction Capture, Execution Miscommunication; data entry, maintenance or loading error;
Process Management and Maintenance missed deadline or responsibility; model/system misoperation;
accounting error/entity attribution error; other task misperformance;
delivery failure; collateral management failure; reference data
maintenance

Monitoring and Reporting Failed mandatory reporting obligation; inaccurate external report
(loss incurred)

Customer Intake and Client permissions/disclaimers missing; legal documents missing/

Documentation incomplete

Custom er/Client Account Unapproved access given to accounts; incorrect client records
Management (loss incurred); negligent loss or damage of client assets

Trade Counterparties Nonclient counterparty misperformance; misc. nonclient

counterparty disputes

Vendors and Suppliers Outsourcing; vendor disputes

Chapter 7 OpRisk Data and Governance ■ 119

 EXECUTION, DELIVERY AND PROCESS MANAGEMENT: MISUNDERSTANDING
A TRADING ORDER: LARGE US PRIVATE BANK, AUGUST 2012
Despite the fact that there are currently many options to particular share". The private banker passed this order to
place orders, where technological devices such as e-mail, the trader, and at the end of the day the trader passed a
Internet, live chats are available, many purchase orders, bill to the private banker for several million US dollars. The
particularly in private banking, are still being placed by old- private banker was absolutely stunned to see that they had
fashioned telephone methods. A very common mistake is bought a significant portion of this particular company. As a
the misunderstanding of the order, especially frequent when consequence of this transaction, the share price of this com­
the counterparty is a foreign-language speaker and the com­ pany rose significantly which also generated questions from
munication chain usually goes from client to banker to trader authorities that suspected some type of pum p-and-dum p
assistant to trader, and in any one of these links there is scheme. Considering it all, the bank decided to keep the
potential for communication breakdowns to happen. shares and sell it little by little. The operational loss in this
case was reflected in the value lost in returning the stocks to
In a busy afternoon at the end of summer 2012, a client
the market after the shares returned to their average price.
asked his private banker to purchase "USD 100,000 of a

snags in the back-office with some confusion on where to remit settlement) are not linked back to the underlying cause. The
the payments of one leg of the deal, and the transaction was error goes to an "error account" or the like and, in terms of
finally settled 3 days later than it should have been. OpRisk management, those who are responsible for the errors
are never identified; even worse is that the real profitability of
In FX transactions trading tickets are usually larger to compensate
individual transactions is rarely understood. The cost side (and
for the low margins. Similar situations as described earlier may lead
the OpRisks involved) is in general ignored.
to errors. The counterparties obviously would have demanded a
compensation as the settlement has been delayed for 3 days, and Knowing where these errors occur is very important for OpRisk
the bank would also have paid a penalty, in the form of interest management.
claims of €55,000. Therefore, any error has the potential to be big­
ger than a transaction's eventual economic profit.
Clients, Products, and Business Practices
The overall scenario is alarming. There was a loss of €5,000 on
the aggregate due to operational errors {€50,000 transaction Loss events under Clients, Products and Business Practices
profit less €55,000 interest claims due for late payment). This (CPBP) risk type are usually the largest, particularly in the US.
is the reality a trading environment faces on the day-to-day. These events encompass losses, for example, from disputes with
The actions of traders are recognized at the closing of the deal, clients and counterparties, regulatory fines from improper busi­
and errors coming to light at a later time (e.g., mis-pricing, late ness practices, or wrongful advisory activities. Table 7.2 presents

Table 7.2 C P B P Event-Type D efin ed as L o sse s A r is in g fro m an U n in te n tio n a l o r N e g l ig e n t F a ilu re to M e e t a

P r o f e s s io n a l O b lig a tio n t o S p e c i f i c C lie n t s (in c lu d in g fid u c ia ry a n d s u ita b ility r e q u ir e m e n t s ) o r fro m t h e N a tu r e o r
D e s ig n o f a P r o d u c t . Basel II even t ty p e classification as p ro vid ed in B C B S (2006, pp. 3 0 5 -3 0 7 )

Category (Level 1) Category (Level 2) Activity Examples

Clients, Products, and Suitability, Disclosure, Fiduciary breaches/guideline violation; suitability/disclosure issues (e.g.,
Business Practices and Fiduciary KYC); retail customer disclosure violations; breach of privacy; aggressive
sales; account churning; misuse of confidential information; lender liability

Improper Business or Antitrust; improper trade/market practices; market manipulation; insider

Market Practices trading (on firm's account); unlicensed activity; money laundering

Product Flaws Product defects (e.g., unauthorised); model errors

Selection, Sponsorship, Failure to investigate client per guidelines; exceeding client exposure
and Exposure limits

Advisory Activities Disputes over performance of advisory activities

120 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 REAL OPRISK EVENTS: SBC WARBURG (INVESTMENT BANK), OCTOBER 1996
The Securities and Futures Authority in the UK (the former the 12:30 pm deadline, SBC Warburg traders sought to sell
City of London regulator since superseded by the Financial some of the same shares they were about to get from Kepit
Services Authority) released partial details in March 1997 in order to reduce the risk (this process is known as short sell,
of an investigation that had commenced in October 1996 and it is accepted as a normal practice in a program trade, as
into rogue trading in a program trade in SBC Warburg. (A long as the price does not fall too much).
program trade is a transaction where one agent, generally a
Elsewhere at SBC Warburg, a trader was running an arbitrage
fund, chooses another agent, generally a bank or a broker,
position on Kepit, seeking to make money by exploiting
to sell part of its shares in the market in a determined day
differences between Kepit's own share price and the price
and hour determined by market prices.) The program trading
of the shares the bank owned. SFA investigators were told
error that made SBC Warburg the subject of the investiga­
that in the minutes before the 12:30 pm deadline, the SBC
tion is thought to have cost it no more than £5 million. Nev­
Warburg trader running the arbitrage position was seen on
ertheless, this program trade was one of the largest ever to
the trading floor making gestures with his hands for traders
be awarded to SBC Warburg, and the SFA investigation has
to get the price of the shares down. Nevertheless, a mistake
clearly embarassed it. The investigation relates to a mistake
by one of the SBC Warburg's Paris-based traders attracted
made during the execution of a £300 million program trade
the attention of SFA. Instead of selling as much as he could
for an investment trust which caused the price of a number
before 12:30 pm, SFA investigators have been told that the
of French stocks to fall sharply. The investigation is being
trader misunderstood his instructions and instead attempted
extended whether this bank made a similar error when selling
to sell at the strike time. The trader also failed to put a so-
Spanish shares as part of the same program deal.
called down limit on his proposed share sales, effectively
The SFA investigation focused on a 30-min period on O cto­ turning it into an unlimited sell order.
ber 30, 1996. At some time around mid-day. SBC Warburg In the tapes passed to the SFA (all conversations on the trad­
traders learnt that the bank had been awarded three con­ ing desk are recorded), the London-based trader is heard
tracts by Kleinwort Benson European Privatization Investment talking with a colleague about how the price of the French
(Kepit) to execute a series of share sales (the so-called pro­ shares had fallen much further than they had planned. The
gram trade) on its behalf. Contracts for programme trades trader complained that a colleague had just told him, in hind­
are often awarded just before the deal takes place, and the sight after the share prices had collapsed, that they should
Kepit deal was no different. It involved SBC Warburg taking only have pushed the prices down by 1%. SBC admitted in
the £300 million-worth of shares onto its books just minutes March 1997 that its short selling had contributed to adverse
later, at 12:30 pm, and paying Kepit, the mid-market prices price movements and dismissed several employees involved
for each share at that time. In the remaining minutes before in the trade.

the Basel event-type breakdown and definition for this risk closed, they need to make requests to their counterparties to
type. This is a specific and an important risk type for firms with allow them special conditions; however, the rates in which they
operations in the US where litigation is very common. As seen capture these funds are higher than the daily average. This
in recent regulatory fines imposed on French banks and other extra cost, although due to a system failure and, therefore,
foreign banks operating in US jurisdiction, this loss type can also should be classified as BDSF, would hardly be captured at all.
be significant to off-shore entities. Table 7.3 presents the formal Basel definition and breakdown
of this risk type.

Business Disruption and System Failures

Business Disruption and System Failures (BDSF) event type is Table 7.3
________ B D S F E v e n t Risk Type D efin ed as
one the most difficult to spot in a large organization. A system ing fro m D is r u p tio n o f B u s in e s s o r S y s t e m F a ilu re s.
crash, for exam ple, would almost certainly bear some financial »l II ev e n t ty p e classification as p ro vid ed in B C B S
loss for a firm, but these losses must likely would be classified
as EDPM . An exam ple might help to clarify this point. Suppose
Category Category
that the funding system of a large bank crashes at 9:00 am.
(Level 1) (Level 2) Activity Examples
Despite all efforts from IT, the system comes back online only
by 4:00 pm when money markets are already closed. When Business Systems Hardware; software;
the system returns, the bank learns that it needs to fund an Disruption and telecommunications; utility
System Failures outage/disruptions
extra USD 20 billion on that day. As the markets are already

Chapter 7 OpRisk Data and Governance ■ 121

Table 7.4 Extern al Fraud E v e n t Risk Type D efined
as L o s s e s D u e t o A c t s o f a T y p e I n t e n d e d to D e fr a u d , REAL OPRISK EVENTS: MODEL
M is a p p r o p r ia t e P r o p e r t y , o r C ir c u m v e n t t h e L a w INPUTS FRAUD, NATWEST,
b y a T h ird P a rty . Basel II ev e n t ty p e classification as MARCH 1997
p ro vid ed in B C B S (2006, pp. 3 0 5 -3 0 7 ) One of the most famous cases in derivatives mispric­
ing was the one that happened at NarWest in 1997. On
Category Category
February 28, 1997, a few days after the bank released its
(Level 1) (Level 2) Activity Examples annual results, it announced a loss of approximately USD
150 million caused by a junior trader who has already left
External fraud Theft and Theft/robbery; forgery;
the bank. The trader was said to be dealing in long-dated
fraud check kiting
O TC interest rate options, used by companies that borrow
Systems Hacking damage; theft of at a floating rate and purchase a cap on the interest pay­
security information (w/monetary ments. The major problem in valuing these options is that
loss) they are relatively illiquid. The trader calculated the price
of the options by providing his own estimates of volatil­
ity, which he apparently overestimated, creating fictitious
The difficulty to capture this event type is reflected in external profits that built up in the books over time.
databases where, aside damage to physical assets, this risk type The volatility estimates resulted in the options being under-
has least number of events. priced. The trader attracted more clients, booking the
requested premium, thereby increasing the apparent prof­
itability of his desk (and, by extension, his remuneration).
External Frauds The loss was realized when the options were exercised.

External frauds are frauds committed or attempted by third parties

or outsiders against the firm. Examples would be system hacking
and check and credit card frauds. External fraud is very common in accepted mark-to-market price, are not uncommon. Recently
retail businesses where financial firms deal with millions of clients. there were a number of large internal frauds in which billions of
Frauds attempted or committed by clients are a daily event in dollars were lost as traders of a particular bank failed to men­
sectors such as retail banking, retail brokerage, and credit card ser­ tion their position. These are usually low-frequency/high-severity
vices; see Table 7.4 for Basel II definition and breakdown. events. Table 7.5 presents the formal Basel definition and break­
down of this risk type.

Internal Fraud
Employment Practices and Workplace
Internal frauds are frauds committed or attempted by a firm's
Safety
own employees. It is one of the less frequent types of OpRisk
loss. Given the sophisticated controls that most institutions have Employment Practices and Workplace Safety (EPWS) type of risk
this would be unlikely. However, events such as traders mismark- is more prominent in the Americas than Europe or Asia as either
ing positions, particularly in assets that are hard to establish an the labor laws are old-fashioned and/or there is more a culture

Table 7.5 Internal Fraud E v e n t Risk Type D efin ed as L o s s e s D u e t o A c t s o f a T y p e I n t e n d e d to D e fr a u d ,

M is a p p r o p r ia t e P r o p e r t y o r C ir c u m v e n t R e g u la tio n s , t h e L a w o r C o m p a n y P o lic y , E x c lu d in g D iv e r s it y /
D is c rim in a tio n E v e n t s , W h ich In v o lv e s a t L e a s t O n e In te r n a l P a rty . Basel II e v e n t ty p e classification as p ro vid ed in
B C B S (2 0 0 6 , pp. 3 0 5 -3 0 7 )

Category (Level 1) Category (Level 2) Activity Example

Internal fraud Unauthorised/Activity Transactions not reported (intentional); transaction type unauthorised
(w/monetary loss); mismarking of position (intentional)

Theft and fraud Fraud/credit fraud/worthless deposits; theft/extortion/embezzlement/

robbery; misappropriation of assets, malicious destruction of assets;
forgery; check kiting; smuggling; account take-over/impersonation/etc.;
tax noncompliance/evasion (willful); bribes/kickbacks; insider trading (not
on firm's account)

122 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 7.6 EP W S E v e n t Risk Type D efin ed as L o s s e s 7.3 THE ELEMENTS OF THE OPRISK
A r is in g fro m A c t s In c o n s is t e n t w ith E m p lo y m e n t ,
FRAMEWORK
H e a lth o r S a f e t y L a w s o r A g r e e m e n t s , fro m P a y m e n t o f
P e r s o n a l In ju ry C la im s, o r fro m D iv e rs ity / D is c rim in a tio n The four elements that should be used in any OpRisk framework
E v e n t s . Basel II even t ty p e classification as p ro vid ed in are as follows:
B C B S (2006, pp. 3 0 5 -3 0 7 )
• Internal loss data;
Category Category • Business environment and internal control factors;
(Level 1) (Level 2) Activity Examples
• External loss data:
Employment Employee Compensation, benefit, • Scenario analysis.
Practices and relations termination issues;
Workplace organised labor activity We provide a description of each of these elements in the fol­
Safety lowing text.
Safe General liability (e.g., slip
environment and fall); employee health
and safety rules events; Internal Loss Data
workers compensation
Operational loss means a gross monetary loss (excluding insur­
Diversity and All discrimination types
ance or tax effects) resulting from an operational loss event. An
discrimination
operational loss includes all expenses associated with an opera­
tional loss event except for opportunity costs, forgone revenue,
and costs related to risk management and control enhance­
of litigation against the employers (Table 7.6). For example,
ments implemented to prevent future operational losses.
some large banks in Brazil would count employment litigation on
the tens of thousand and it is one of the main OpRisks for banks. Having a robust historical internal loss database is the basis of
In some lines of business like investment banking employment any OpRisk framework. These losses need to be classified into
issues are also quite important. As these lines of business mostly the Basel categories (and internal if different than the Basel) and
provide advisory to large corporations and the key personnel mapped to a firm's business units. Given their importance for
is highly compensated, litigation against some of these key the OpRisk framework, the collection and maintenance of these
employees and losing them can cost millions of dollars. data are heavily regulated. Basel II regulation says that firms
need to collect at least 5 years of data, (BCBS, 2006), but most
decided not to discard any loss even when these are older than
Damage to Physical Assets this limit. Since losses are difficult to acquire and take years to
Damage to Physical Assets (DPA) is another OpRisk event type. build up a reliable and informative loss database, consequently
The most common method to assess the exposure to this risk is most firms even pay to supplement internal losses (see the
through scenario analysis using insurance in formation. Very few external loss database). Hence, it is clear that it would not make
firms actively collect losses on this risk type as these are usually sense to discard losses that took place in the firm unless the
either too small or incredibly large. The formal Basel definition business in which this loss took place was sold. There are a num­
and breakdown of this risk type is presented in Table 7.7. ber of issues that can come from internal data modeling that are
worth comments and are listed below.

Considerable challenges exist in collating a large volume of

Table 7.7 D PA E v e n t Risk Type D efin ed as L o s s e s data, in different formats and from different geographical loca­
A r is in g fro m L o s s o r D a m a g e to P h y sic a l A s s e t s fro m tions, into a central repository, and ensuring that these data
N a tu ra l D is a s t e r o r O t h e r E v e n t s . B asel II e v e n t ty p e feeds are secure and can be backed up and replicated in case of
classification as p ro vid ed in B C B S (2006, pp. 3 0 5 -3 0 7 ) an accident.

Category Category
(Level 1) (Level 2) Activity Examples
Setting a Collection Threshold and
Possible Impacts
Damage to Disasters and Natural disaster losses;
physical assets other events human losses from external Most firms set a threshold for loss collection as allowed by Basel.
sources (e.g., terrorism, However, this decision can have significant impact in establish­
vandalism) ing the risk profile of a business unit. This is usually the case

Chapter 7 OpRisk Data and Governance ■ 123

Table 7.8 Th e Im pact of T h resh o ld C h o ice : Lo sse s in a C e rta in Y ear for th e A sse t M an ag em en t Division of a Bank

Loss Brackets (USD) Number of Losses Total (USD) Accumulated Total (USD)

> 5,000.000 3 23,750,325 23,750,325

1,000,000-5,000.000 7 13,775,000 37,525,325

500,000-1,000,000 10 8,250,781 45,776,106

100,000-500,000 12 3,562,177 49,338,283

50,000-100,000 22 1,723,490 51,061,773

20,000-50,000 71 2,159,021 53,220,794

< 20,000 1520 17,500,235 70,721,029

in businesses that have heavy transaction execution like asset expensive parts of the entire data collection process, but the out­
management or equities. See the example in Table 7.8. If the come can be decisive in making an OpRisk project successful and
OpRisk department had chosen USD 100,000 as the threshold, increasing confidence in the completeness of the loss database.
usually under the argument that only tail events drive OpRisk
This OpRisk filter will vary from bank to bank depending on their
capital, that firm would think that its total loss in that year was
systems, but in all cases it works like a conduit between systems,
USD 49 million. If the threshold choice was USD 20,000, the total
collecting every cancellation or alteration made to a transaction or
losses would be USD 53 million. However, most losses are due
any differences between the attributes of a transaction in one sys­
to compensating retail clients whose orders are usually ranging
tem compared to its attributes in another system. The transaction
from USD 1,000 to USD 50,000. The sum of the losses under
flow starts at the front-office system that registers the transaction
USD 50,000 is about USD 20 million, which is almost equivalent
passing it to the accounting and clearing systems. Any discrep­
to the losses above USD 5 million. For this particular firm, setting
ancy, alteration, or cancellation must be extracted by the OpRisk
the loss collection threshold at USD 100,000 would show total
filter. Also, abnormal inputs (e.g., a lower volatility in a deriva­
losses for the year as USD 49 million. However, if this firm had
tive) can be flagged and investigated. The filter will calculate the
not set a loss collection threshold they would observe that their
OpRisk loss event and several other impacts in the organization.
actual losses were USD 71 million, a very different risk profile.

A number of OpRisk managers pick their threshold thinking

only in terms of OpRisk capital. Disregarding these small losses Recoveries and Near Misses
in many cases can bias the risk profile of a business unit and, of The Basel II rules (BCBS, 2006) in general do not allow for the
course, this will also have an impact on OpRisk capital. use of recoveries to be considered for capital calculation pur­
poses. The issue again is that if firms are trying to estimate losses

Completeness of Database that can happen once every thousand years, it would not make
sense to start applying mitigating factors to reduce the losses
(Under-Reporting Events)
and eventually reducing also capital. For this reason, gross losses
In gathering data from disparate sources, we need to avoid an should be considered for OpRisk calculation purposes.
OpRisk in collecting the OpRisk data. Such risks and subsequent
The only exception is on rapidly recovered loss events but even
losses may arise, for example, the employee responsible for
this exception is not accepted everywhere. Rapidly recovered
reporting losses does not send the loss information to the cen­
loss events are OpRisk events that lead to losses recognized in
tral database, whether accidental or not. The Basel II document
financial statements that are recovered over a short period. For
BCBS (2006) refers to this scenario with the possible conse­
instance, a large internal loss is rapidly recovered when a bank
quence being that an institution that could not prove that loss
transfers money to a wrong party but recovers all or part of the
data is flowing with a high degree of reliability to the central
loss soon thereafter. A bank may consider this to be a gross loss
database(s) is likely to be disallowed to employ more advanced
and a recovery. However, when the recovery is made rapidly, the
techniques for assessing the levels of risk.
bank may consider that only the loss net of the rapid recovery
The development of filters that capture operational issues constitutes an actual loss. When the rapid recovery is full, the
and calculate an eventual operational loss is one of the most event is considered to be a "near miss".

124 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Time Period for Resolution of Operational Recently, with the issuing of IAS37 by the International Account­
ing Standards Board, W ittsiepe (2008), the rules have become
Losses
clearer as to what might be subject to provisions (or not). IAS37
Some OpRisk events, usually some of the largest, will have a establishes three specific applications of these general require­
large time gap between the inception of the event and the final ments, namely:
closure, due to the complexity of these cases. As an example,
• a provision should not be recognized for future operating
most litigation cases that came up from the financial crisis in
losses;
2007/2008 were only settled by 2012/2013. These legal cases
• a provision should be recognized for an onerous contract— a
have their own life cycle and start with a discovery phase in
which lawyers and investigators would argue if the other party contract in which the unavoidable costs of meeting its obliga­

has a proper case to actually take the action to court or not. At tions exceeds the expected economic benefits;

this stage, it is difficult to even come up with an estimate for • a provision for restructuring costs should be recognized only
eventual losses. Even when a case is accepted by the judge it when an enterprise has a detailed formal plan for restructur­
might be several years until lawyers and risk managers are able ing and has raised a valid expectation in those affected.
to estimate properly the losses. Firms can set up reserves for These provisions should not include costs, such as retraining
these losses (and these reserves should be included in the loss or relocating continuing staff, marketing or investing in new
database), but they usually do that only for a few weeks before systems and distribution networks; the restructuring does not
the case is settled to avoid disclosure issues (i.e., the coun­ necessarily entail that.
terparty eventually knows the amount reserved and uses this
information in their favor). This creates an issue for setting up IAS37 requires that provisions should be recognized in the bal­

OpRisk capital because firms would know that they are going to ance sheet when, and only when, an enterprise has a present

undergo a large loss and yet are unable to include it in the data­ obligation (legal or constructive) as a result of a past event. The

base; the inclusion of this settlement would cause some volatility event must be likely to call upon the resources of the institution

in the capital. The same would happen if a firm set a reserve of, to settle the obligation, and, more importantly, it must be pos­

for example, USD 1 billion for a case, and then a few months sible to form a reliable estimate of the amount of the obligation.

later, if a judge decides to remove the loss in favor of the firm. Provisions should be measured in the balance sheet at the best

For this reason, firms need to have a clear procedure on how to estimate of the expenditure required to settle the present obliga­

handle those large, long-duration losses. tion at the balance sheet date. Any future changes, like changes
in the law or technological changes, may be taken into account
where there is sufficient objective evidence that they will occur.
Adding Costs to Losses IAS37 also indicates that the amount of the provision should not

As said earlier, an operational loss includes all expenses associ­ be reduced by gains from the expected disposal of assets (even
if the expected disposal is closely linked to the event giving rise
ated with an operational loss event except for opportunity costs,
forgone revenue, and costs related to risk management and con­ to the provision) nor by expected reimbursements (arising from,
for example, insurance contracts or indemnity clauses). When
trol enhancements implemented to prevent future operational
losses. Most firms, for example, do not have enough lawyers on and if it is virtually certain that reimbursement will be received

payroll (or expertise) to deal with all the cases, particularly some should the enterprise settle the obligation, this reimbursement
should be recognized as a separate asset.
of the largest or those that demand some specific expertise and
whose legal fees are quite expensive. There are cases in which the
firm wins in the end, maybe due to some external law firms, but
the cost can reach tens of millions of dollars. In such cases, though 7.4 BUSINESS ENVIRONMENT AND
the firm wins a court victory, there will be an operational loss. INTERNAL CONTROL ENVIRONMENT
FACTORS (BEICFs)
Provisioning Treatment of Expected
One can see OpRisk as a function of the control environment.
Operational Losses
If the control environment is fair and under control, large
Unlike credit risk, the calculated expected credit losses might operational losses are not likely to take place and OpRisk is con­
be covered by general and/or specific provisions in the bal­ sidered to be under control. Therefore, understanding the firm's
ance sheet. For OpRisk, due to its multidimensional nature, the business processes, mapping the risks on these processes, and
treatment of expected losses is more complex and restrictive. assessing the control of these processes are the fundamental

Chapter 7 OpRisk Data and Governance ■ 125

 The answers point toward the specific
Trade
Custody and Clear and Settle inherent risks em bedded within a busi­
Trade capture matching and
control trades ness unit's process, which must be
confirmation
assessed to determine the likelihood
F ia u re 7.1 E q u ity se ttle m e n t p ro cess the events could occur (frequency) and
severity. The results of this analysis provide a birds' eye view of
the inherent risk of a firm's business processes. Management
roles of an OpRisk manager. A simple example is the equities can then use this assessment to prioritize and focus on the
trading process and is shown in Figure 7.1. most critical risks that must be proactively managed.
Firms need to be able to assess risk on the many steps of the Once these inherent risks are understood, controls will be
settlement process and report them regularly. There are a added in the RCSA fram ework. The effectiveness of these
couple of tools that are commonly used by financial firms to per­ controls are then assessed to understand how efficient these
form this task: Risk Control Self-Assessment and Business and are to mitigate risks. A t this stage, the residual risk is also
Control Environment programs. calculated, which is the risk that is left after inherent risks are
controlled. Put another way, residual risk is the probability of
Risk Control Self-Assessment (RCSA) loss that remains to systems that store, process, or transmit
information after security measures or controls have been
These are also known as Control Self-Assessm ent (CSA) in
implemented.
some firms, According to this procedure, firms regularly ask
For a firm that has the RCSA program as the core of
experts about their views on the status of each business pro­
the OpRisk fram ework, all other OpRisk initiatives under the
cess and subprocess. These reviews are usually done every
12 or 18 months and color rated Red/Am ber/Green (RAG) firm's O pRisk program are usually structured to feed the
RCSA. Risk metrics such as key risk indicators (KRIs), inter­
according to the perceived status. Some firms go beyond
and try to quantify these risks using subjective approaches or nal loss events, and external events would contribute to
the risk identification process ensuring the organization has
through a scorecard. For many firms, RCSA is the anchor of the
OpRisk fram ework and most OpRisk activities are linked to this considered all readily available data and benchmark risk
assessments.
procedure.
Once the universe of controls and mitigation measures has
In a broad sense, the RCSA program requires the docum enta­
been identified, the business unit can partner with various
tion and assessm ent of risks em bedded in a firm's processes.
control functions to conduct the control testing phase of the
Levels of risks are derived (usually from a frequency, and
RCSA. Control testing is critical to a mutual understanding of
severity basis), and controls associated with these risks are
expectations and actions across business units and between
identified. As risks are usually reported by business units, these
the front and back offices.
processes are aggregated to a certain business unit and rated/
assessed. One significant challenge that arises due to combining RCSA
data is interpreting what the data actually means. For exam ple,
In the RCSA program, managers first identify and assess
outputs from a RCSA program might lead a risk manager to
inherent risks by making no inferences about controls
conclude that no immediate action is required if the risk expo­
em bedded in the process: controls are assumed to be absent.
sures are controlled within the tolerances acceptable to the
Under this assumption, managers must carefully identify
firm. On the other hand, if the RCSA data indicates that the
how risk manifests within the activities in the processes.
control environment is weakening and threatening the success
The following are the usual questions asked by risk managers
of a particular business goal, a risk manager might decide to
in this phase:
recommend a corrective action. However, weighting those risks
• Risk scenarios. W here are the potential failure points in across the entire risk universe and naming the most important
each of these processes? or "key" might not be an easy and objective task.
• Exposure. How big a loss could happen to my operation if There are a number of vendors that provide systems that help to
a failure happens? collate these results. The issue with these programs in general is
• Correlation to other risks. Could a failure altogether change that they make it harder to integrate with the other data inputs
my organization's performance, either financially, its reputa­ that are numeric. Even if these RAG assessments can be con­
tion, or affect any other area? verted to a number or rating, there is always a bias embedded

126 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
that the person who does the assessment would have a motiva­ confirm ations older than 30 days increases to over a certain
tion to improve their ratings so as to reduce their capital. percent of the total population, and the number of repudi­
ated trades increases, one might say that this process is
Key Risk Indicators facing challenges that need to be addressed.

These indicators/factors are mostly quantitative and are The process of KRI collection deserves special attention. It is
used as a proxy for the quality of the control environm ent im portant that these data are absolutely reliable, in order to
of a business. For exam ple, in order to report the quality display relationships between KRIs and losses. Autom ating
of the processing system s of an investm ent bank, we might the collection straight from the firm's operational system s
design factors such as "system dow ntim e" (measuring the might help to create a more realistic reflection of the true
number of minutes that a system stayed offline), and "sys­ profile of the infrastructure of a certain business. There are
tem slow tim e" (counting the minutes that a system was many stages in establishing these links and of course there
overload and running slow). These KRIs can be extrem ely is a cost associated with the im plem entation of the KRI
im portant in O pRisk m easurem ent as they can allow O pRisk program , but probably no other type of data will be more
models to behave very sim ilarly to those in m arket and powerful than KRIs for managing and measuring operational
credit risks. risk. It is much easier to explain O pRisk as a function of the
control environm ent in which a firm exists than to say that
Going back to the equity settlem ent exam ple, instead of
O pRisk capital is moving up or down because of past losses
using RAG self-assessm en t, a better way to assess the
or changes in scenarios.
quality of these processes is to establish a few KRIs that
provide an accurate picture of the control environm ent as The first stage of the KRI collection process is trying to establish
seen in Figure 7.2. As an exam ple, on the trade confirmation assumptions on the OpRisk profile of a certain business. For
stage of the settlem ent process, if the number of unsigned example, we might assume that execution errors in the equi­
ties division can be explained by the trade volume on the day
the number of securities that failed to be received or delivered,
the head count available on the trading desk and the back
office, and system downtime (measured by minutes offline).
Daily trade volume
Late booking trades The decision to be made is: at what organizational level should
Trade capture
this relationship be measured? Equities division as a whole?
and execution
Should we break down the equities division into cash equities,
listed derivatives and O TC derivatives, or along any other lines?
Should we consider breaking it down along regional lines? All
Unsigned confirmation > 30 days these questions are fundamental for the success of the analysis.
Repudiated trades
Trade Breaks If loss data and KRIs are collected at cost center level (the
matching and lowest possible level), it becom es possible to perform this
confirmation
disaggregation. In general, the lower the level you model the
causal relationship, the better the chances that you will find
higher level fits to the m odel. Put this another way, it is easier
Breaks
to find strong causal relationships, if you model, for exam ple,
Disputed collateral calls
Custody and the US cash equities departm ent than modeling at the global
control
equities division level, as the lower level would better capture
local nuances, idiosyncrasies, and trends.

The m odeler might also consider using external factors such

Fails as equity indexes and interest rates. It is common to find
Breaks (agent cash, agent stock) strong relationships between a stock m arket index and opera­
Clear and settle
trades tional losses, for exam ple, higher volatility on stock markets
is usually associated with high trading volum es, which in turn
is highly associated with execution losses in O pRisk. Table 7.9
presents few exam ples of Business Environm ent and Internal
F iq u re 7 .2 Eq u ity se ttle m e n t p ro cess. Control Factors (B EIC Fs) used in few environm ents.

Chapter 7 OpRisk Data and Governance ■ 127

Table 7.9 Examples of BEICFs Used in Few Environments

Business Environment Factor Description

Systems System downtime Number of minutes a system is offline

System slow time Number of minutes a system is slow
Software stability
Number of code lines changed in a program or software in a certain
period of time

Information Security Malware attacks Number of malware attacks

Hacking attempts Number of hacking attempts

People/Organization Employees Number of employees

Employees experience Average experience of employees

Execution/Processing Transactions Number of transactions processed

Failed transactions Number of transactions that failed to settle
Data quality Ratio of transactions with errors
Breaks Number of transactions breaks

7.5 EXTERNAL DATABASES loss experience in their portfolio, but while this loss experience
is not available, the best way to start the business is using this
According to the Basel Accord, OpRisk modelers need to cal­ external database. As the insurer starts building up their own
culate regulatory capital at the 99.9% confidence level, which is loss experience, it can start weighting the importance of the
equivalent to finding enough capital to protect against losses in external database in their premium through credibility theory
the worst year in a 1,000 year period. One way to try to over­ methods.
come these challenges is through using other firms' loss experi­ Similarly, banks and other financial firms might struggle to come
ences. This is common in insurance. For example, suppose that a up with reasonable measures for some types of risk because
US insurer wants to expand to a new state, say New Jersey. This they were never exposed to large losses, but, despite that, they
insurer does not have experience in New Jersey; New Jersey understand that they are still under the risk that such a loss
has different characteristics, for example it may have much more would happen eventually. These loss-gathering databases can
cars per square foot than other states and hence the accident be very useful in these cases.
ratio is known to be higher. How can this insurer price correctly
There are basically three ways to get hold of these databases
its premium in New Jersey? The most used alternative is to start
as seen in Table 7.10. The best choice for a firm would depend
with a local database of car accidents. This database is available,
significantly on how their framework is structured and how the
with considerable details, for insurance companies to acquire.
modeler expects to use these losses.
Obviously, this database would never replace the insurer's own

Table 7.10 M eth o d s to A cq u ire Ex tern al D ata and D etails

Type Details Pros Cons

Internally developed Firm gathers these losses from Cheapest way It might not be comprehensive
news feeds and magazines enough and may miss losses in
many industries and jurisdictions

Consortia The most popular is O RX which Loss reporting threshold is No details on the losses. It can
has some of the largest banks in €20,000 only be used for measurement
the industry

Vendors There are a number of vendors More detailed analysis on Loss threshold is usually high
like IBM OpVantage and SAS the loss. It can be used for (USD 1 million). Loss details
management or scenarios might not be accurate as these
were taken from newspapers

128 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
7.6 SCENARIO ANALYSIS 16 n

Another important tool in OpRisk management and mea­

surement is scenario analysis. For a significant number of
firms, the scenario analysis program is the pillar of their
framework. These scenario estimates are usually gathered
through expert opinions, where these experts (or a group
of experts) communicate their estimates on how losses can
happen on an extreme situation. These experts are com­
monly guided by information gathered from external data
or KRIs and internal loss trends, see for instance discussions
workshops discussions
on scenario analysis for OpRisk in Rippel and Teply (2008).
Alderweireld et. al. (2006) and Huffman (2002). Figure 7.3 S u rvey on how US banks run scen ario s.

Though there are different approaches to run a scenario

workshop, only three approaches are widely used: struc­
tured workshops, surveys, or individualized discussions.
A recent survey in 2012 with the largest US financial firms
(the results are not in public domain and reference can­
not be provided) shows that information from experts is
obtained mainly through structured workshops (Figure 7.3).
A comprehensive guide to performing and establishing
appropriate statistical structures for surveys in such work­
shops is provided in detail in O'Hagan et. al. (2006).

Scenarios can be a useful tool in case of emerging risks Fiaure 7.4 N u m b er of new sce n a rio s d e v e lo p e d
where a loss experience would not be available. Finan­ annually by financial firm s.
cial institutions understanding this challenge are creating
many new scenarios for these emerging risks every year.
key limitations of this process as these biases are very difficult to
Figure 7.4 presents some other results of this survey about the
mitigate or avoid. Some of the biases are as follows:
number of new scenarios developed annually by financial firms
showing that most firms develop between 51 and 100 scenarios • Presentation Bias. This arises when the order in which the
every year. information is provided can skew or alter the assessment from
the experts; see discussion in Hogarth and Einhorn (1992);
In order to make the outcomes of the scenario analysis work­
shops useful to the OpRisk measurement and qualification • Availability bias. It is related to the over/underestimation of

efforts, the opinions need to be converted into numbers. There loss events due to respondents' exposure or familiarity to a

are a few ways to do so, but the most frequent is through gath­ particular experience or risk. For example, if the expert has

ering estimates on the loss frequencies on predefined severity

brackets. These numbers are then converted to empirical dis­ Table 7.11 Using S cen ario A n alysis O u tco m e for
tributions, see example in Table 7.11, that are aggregated with M easu rem en t
internal losses later.
Loss Bracket Relative
After convening expert opinion into an empirical distribu­ (in USD thousand) Loss Frequency Frequency
tion, the question is how to incorporate this into the OpRisk
USD 5,000 7 6.9%
framework. There are a number of articles on the subject, for
example, see recent publications of Dutta and Babbel (2013), 1,000-5,000 10 9.8
Ergashev (2012), and Shevchenko (2011). 500-1,000 15 14.7
Common Issues and Bias in Scenarios. Because scenarios are 100-500 30 29.4
usually based on expert opinion, they present a number of
50-100 40 39.2
biases, see for example, a demonstration of such features in the
Total 102
experiments designed by Lin and Bier (2008). This is one of the

Chapter 7 OpRisk Data and Governance ■ 129

 a 30 years career in FX trading and had never experimented Delphi has been tested and broadly used in several applications
or seen an individual loss of USD 1 billion or larger, he/she such as gathering current and historical data not accurately
might be unable to accept the risk that such a loss would known or available and examining the significance of events.
take place; Usually, one or more of the following properties of the problem
• Anchoring bias. Anchoring occurs when participants restrict to be solved leads to the need for employing Delphi.
their estimates to being within a range of a given value, • The problem does not lend itself to precise analytical
which may come from their own experiences, a value they techniques but can benefit from subjective judgments on a
have seen elsewhere (e.g., internally, in the media) or a value collective basis;
provided in the workshop; see discussion in Wright and
• The individuals needed to contribute to the examination of
Anderson (1989);
a broad or complex problem have no history of adequate
• "Huddle" bias or anxiety bias. It involves the tendency of communication and may represent diverse backgrounds in
groups to avoid conflicts and differences of opinion, either respect of experience or expertise;
because individuals do not want to disrupt the smooth func­
• Time and cost make frequent group meetings infeasible; and
tioning of the group through dissent, or because they are
• More individuals are needed than can effectively interact in a
unwilling to disagree openly with the more senior, expert,
face-to-face exchange.
or powerful people in the room; see discussions in O'Hagan
(2005); Therefore, for Delphi to work, it is necessary that a group of
• Gaming. Conflicts of participants' interests with the goals experts in each business get together in order to estimate
or consequences of the workshops can cause motivational OpRisk occurrences at a given confidence level. Consider an
biases or gaming. Participants may be unwilling to disclose example: a bank in order to assess transaction execution risk in
information or engage meaningfully in the workshop or may the fixed income desk decided to get three different perspec­
seek to influence the outcomes; tives: from the front desk (traders), from the finance group,
and from the operations group. Each one of these areas has
• Over/under confidence bias. This bias involves over/under-
a different perspective on what risks would be and how many
estimation of risk due to the available experience and/or
losses would happen. As the estimates from each of the three
literature on the risk being limited;
areas were very different, a separate scenario workshop was
• Inexpert opinion. In many firms, scenario workshops do not performed in each department and the participants were elic­
attract the expert (or the expert is not identified) and a more ited to estimate extreme losses. At the end, a final number was
junior employee or someone with much less experience ends agreed by the three areas and all recognized that tremendous
up participating in the workshop and providing inaccurate education took place as traders, for example, did not have the
estimates; perspective of losses due to settlement failures. Delphi tech­
• Context bias. This bias arises when framing in a certain man­ nique (Dalkey and Helmer, 1963) has a number of stages:
ner alters the response of experts, that is, color their opinion;
1. In the first step, the subject under discussion should be
see discussion in Fischhoff et. al. (1978).
explored with as many individuals contributing additional
A fundamental problem that scenario analysis programs face is information;
the disparity of understanding and opinions on losses' sizes and
2. Given the information from step 1, a feedback and a
frequencies. To circumvent some of these problems, application
description of the issues are provided to the group;
of the Delphi technique may be of help. The Delphi technique,
3. (Optional) Bring out the possible differences found in step 2
as Linstone and Turoff (1975) defined, ". . . may b e characterized
as a m eth o d fo r structuring a g rou p com m unication p ro ce ss so and evaluate them; and

that the p ro ce ss is effe ctive in allowing a g ro u p o f individuals, as 4. A final evaluation occurs when all the previously gathered
a w hole, to deal with a co m p lex p ro b le m ." information has been initially analyzed and the evaluations
have been fed back to the respondents for consideration.
The Delphi concept is a spin off from defense research. "Project
Delphi" is the name given to an American Air Force project, Finally, we would like to mention that ideas from works on
started in the early 1950s, that made use of expert opinion (see expert elicitation processes were implemented in a freely avail­
Dalkey and Helmer, 1963). The objective of the original study able toolkit known as the Sheffield Elicitation Framework
was to "obtain the m ost reliable con sen su s o f opinions within a (SH ELF)1, which is covered under copyright when it comes to
g ro u p o f e x p e rts " by a series of intensive questionnaires inter­
spersed with controlled opinion feedback. 1 SHELF is available at http://www.tonyohagan.co.uk/shelf/

130 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
commercial usage; see details on the associated website. In Table 7.12 Trading and Sales OpRisk Profile
agreement with the standard industrial practice of structured
workshops, the SH ELF framework is developed to be performed Event Type Frequency (%) Severity (%)
with a group elicitation in mind and comprises a framework for Internal Fraud 1.0 11.0
eliciting beliefs of one or more experts as a group.
External Fraud 1.0 0.3

Employment Practices 3.1 2.3

and Workplace safety
7.7 OPRISK PROFILE IN DIFFERENT
FINANCIAL SECTORS Clients, Products, and
Business Practices
12.7 29.0

After deciding the form of the operational loss data model and Damage to Physical 0.4 0.2
Assets
the types of losses that need to be reported, it is useful to split
the financial institution into different business lines, given that Business Disruption 5.0 1.8
the OpRisk profile is generally very diverse across different busi­ and System Failures

nesses within a financial institution. While an asset management Execution, Delivery & 76.7 55.3
unit is more inclined to have legal/liability problems (although Process Management
still having a few transaction processing problems, in general, Source: Results from the 2008 Loss Data Collection Exercise for Opera­
asset managers hold their positions longer than treasury), the tional Risk, see BCBS (2009b).
investment bank arm is more inclined to operational errors in
processing transaction. A large investment bank might process strategic alternatives. The differences to consulting firms are
over a million transactions a day. due to the fact that corporate finance in banks constantly offers
A typical list of business units includes C o rp ora te Finance, Trad­ financing options, so deals are made. Therefore, it is expected
ing and Sales, Retail Banking, Com m ercial Banking, Paym ent that most of the losses fall under the umbrella of "litigation" or
and Settlem en t, A g e n c y Services, A s s e t M anagem ent, and Retail disputes with clients for arguably poor advice when, for exam­
B rokerage. These are business units at level 1 as suggested ple, IPOs go wrong; see Table 7.13.
in Basel II. Detailed breakdown into level 2 business units and
activity groups can be found in BCBS (2006, p. 302). Also it can
Retail Banking
be appropriate to add an extra business unit, Insurance. Most of
these business units are discussed in the following sections. The OpRisk profile of retail banks is not too dissimilar to that of
retail brokerage; see Table 7.14. On the frequency side, most

Trading and Sales

Table 7.13 C o rp o ra te Fin an ce O p R isk Profile
It should not come as a surprise that trading and sales OpRisk
profile is dominated by "ED PM " or just "Execution". This can Event Type Frequency (%) Severity (%)
be clearly seen in Table 7.12, where both frequency and severity Internal Fraud 1.6 0.24
execution losses dominate. The business model in trading is quite
External Fraud 5.4 0.12
simple; traders perform trades on behalf of either their own firms
or clients, and these trades get settled by exchanging the securi­ Employment Practices 10.1 0.59
and Workplace safety
ties against some form of payments. However, as the products
are diverse and complex and settlement deadlines and proce­ Clients, Products, and 47.1 93.67
dures vary significantly it is not surprising that executing these Business Practices
transactions is the major OpRisk of this business and, for many Damage to Physical 1.1 0.004
trading shops, the major overall risk that they are exposed to. Assets

Business Disruption 2.2 0.02

and System Failures
Corporate Finance
Execution, Delivery & 32.5 5.36
This business is where financial firms many times behave similar Process Management
to consulting firms by providing advice to corporations in pos­ Source: Results from the 2008 Loss Data Collection Exercise for Opera­
sible mergers and acquisitions, doing an IPO or even assessing tional Risk, see BCBS (2009b).

Chapter 7 OpRisk Data and Governance ■ 131

Table 7.14 Retail Banking OpRisk Profile at least another two years, then life insurers' financial pain will
be broader and deeper. On the P&C side, the continuing pros­
Event Type Frequency (%) Severity (%)
pects for weak investment returns and low interest rates over an
Internal Fraud 5.4 6.3 extended period compel carriers to improve underwriting mar­
gins, requiring difficult decisions concerning pricing and operat­
External Fraud 40.3 19.4
ing approaches. Organic growth continues to be a challenge,
Employment Practices 17.6 9.8 given the economic situation and the competitive landscape.
and Workplace safety
Individual insurers confront greater competition, driven by an
Clients, Products, and 13.1 40.4 abundance of capital, uncertainty around the timing, the scope
Business Practices of regulatory changes, and the continuing volatility caused by
Damage to Physical 1.4 1.1 weather-related losses, highlighted recently by Hurricane Sandy
Assets in 2012 (in the US, Hurricane Sandy affected 24 states with par­
Business Disruption 1.6 1.5 ticularly severe damage in New Jersey and New York). Health
and System Failures insurers in the US, given the advent of the Patient Protection
Execution, Delivery & 20.6 21.4 and Affordable Care Act (signed into law by US President
Process Management Barack Obama on March 23, 2010, and commonly referred to as

Source: Results from the 2008 Loss Data Collection Exercise for Opera­ "O bam acare"), are in much better shape than their counterparts
tional Risk, see BCBS (2009b). with a better perspective ahead of them.

Regarding risk regulation in this sector, there are significant

losses are due to external frauds that are daily events for these differences between Europe and the US. In Europe, a process
firms. Execution comes in a far second. However, when looking similar to Basel II was developed by insurance regulators, called
at severity, the largest risk exposure is due to litigation once Solvency 2. Two key themes have dominated regulatory dis­
again. cussions in the past year: supervisory focus on risk and capital
management and concerted efforts to move toward a consistent
approach to cross-territory supervision of insurance groups.
Insurance These initiatives underscore the importance of embedding
strong risk management principles throughout an enterprise and
For those not familiar with this industry, this sector can be
moving beyond just "tick the box" compliance, similar to what
actually divided into three types given the significant differ­
Basel II has been influencing in the banking industry.
ences: life insurance, health insurance, and property/casualty
or "P& C" insurance (or general insurance as known in Europe). In the US, the regulatory environment also has been changing
To put it very simply, life insurers basically charge a premium as State insurance departments and rating agencies, in addition
from individuals in exchange to providing a sum of money to National Association of Insurance Commissioners (NAIC), are
when they die. Life insurers also offer retirement and income- also influencing the direction of solvency regulation. While these
protection products. Health insurers provide medical and hos­ varied initiatives place differing degrees of emphasis on capital
pital coverage. P&C insurers offer coverage against damage to requirements, reporting standards and risk measures, a common
properties caused by fire, natural disasters, theft, etc. They also theme is their intensified focus on clearly articulating an insurer's
offer protection against liabilities (e.g., directors being sued and risk profile. To prepare and address the regulatory pressures to
professional errors). The actuarial calculation used in the P&C enhance risk management, insurers must significantly enhance
insurance is very similar to the one used in OpRisk capital calcu­ their data management, reporting and analytical resources, and
lation. Most operational risk capital techniques are derived from their organizations' ability to integrate risk data across disci­
P&C actuarial techniques, and there are many articles in the plines. The US insurance industry is also anticipating potential
Jou rn a l o f O pR isk that were written by P&C actuaries. impacts of Dodd-Frank legislation, including in the systemically
important financial institution (SIFI) designation and the Federal
Regarding the sector's overall current financial situation, simi­
Insurance Office's (FIO) pending report to Congress on the state
lar to most of the financial sectors, the effects of the financial
of US insurance regulation, which in practice creates a national
crisis still lingers. Life insurers started to feel the consequential
insurance regulator.
effects from the long low-interest rate environment, which
affects their profitability and company valuations and also, as Regarding OpRisk more specifically, insurers are still in the early
consumers struggle, declining sales and revenue. If interest stages of the development of their OpRisk frameworks. This
rates continue to stay low, and it appears likely that they will for comes somehow as a surprise as insurers suffered several large

132 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
operational losses that were very public and reported in the seen their AUM go down by 30 or 40%, not only because of
media. Some of the examples over the last decade2 are the USD the drop in asset prices but also because clients are withdraw­
250 million loss that a large US insurer suffered a few years ago ing funds, either out of necessity to cover debts, because they
for discrimination (i.e., allegedly pricing their policies differently fear that the stock markets will take a long time to recover, or
according to race); a large European reinsurer lost USD 3.5 billion sometimes even out of concern for the financial well-being of
for not having final contracts in place on the 9/11 terror attacks some asset managers. The crisis also showed historic regulatory
inflicting damages to clients; a large US auto insurer lost USD failures, like the Bernie Madoff case, in which he created a Ponzi
1 billion for using low-quality auto parts in vehicle repairs; a large scheme, that was discovered during the 2008 financial crisis, and
US life insurer lost USD 2 billion for abusive sales practices and lost USD 6 billion from investors (this case is one of the largest
illegal sales of securities and the list goes on and on. OpRisk events in history). Many investors close to retirement
lost their pensions not only because of the market conditions
Insurers face a number of OpRisks; some of these are mis-selling
but also because of a lack of caution and risk management from
their products to clients. A number of insurers worldwide got
pension fund managers.
severe penalties for these sales practices. As with any retail
sector, insurers are exposed to bad faith claims (i.e., frauds by This long-lasting dire economic environment forces asset man­
customers)— Hollywood has a number of movies on these inter­ agers to develop a much more careful discipline around costs,
esting stories. More recently, the issue of unclaimed property risk management, and productivity. Each of these factors has
has become a concern for insurers as public officials are now received widespread attention in the specialized media.
focusing much more on the issue than they did in the past.
The industry has reacted quickly to this new reality. For exam­
Given these pressures, insurers have been more diligent to catch
ple, a large independent US asset manager has already put in
up with banks in developing more robust OpRisk frameworks.
place several measures to reduce costs, by sharing services in
However, they have a long road ahead of them.
its distribution and administration departments to reduce costs
across geographical areas. This same firm has also launched an
Asset Management initiative to reduce its N CE by 20% in 2009, with the develop­
ment of an inter-company committee to determine the expenses
The financial crisis brought to the global asset management
that have to be eliminated.
industry challenges it has not seen in decades as the industry
was accustomed to high margins and substantial profits (par­ A European-based global firm decided to reduce the number of
ticularly in the years 2000-2007 due to the availability of excess products it offered and the development efforts for a few prod­
liquidity). As the financial markets climbed regularly over the ucts where it can build competitive advantage on a global scale.
last 30 years, occasional dips notwithstanding, asset managers This firm also decided to immediately implement a plan, which
became used to the steady increases in their assets under man­ had been on the shelf for many years, to streamline its operational
agement (AUM) and easy profits. However, in the wake of the platforms on a global basis. Currently, each geographical location
biggest downturn since the Great Depression, a slow recovery (and sometimes within the same country) has its own platform
has left many firms struggling. Even in 2012, most of the growth with different vendors and frameworks to process securities.
of the asset management came from market appreciation and
Asset managers are susceptible to all forms of risks, namely
not due to increase in flow of resources from clients.
market, credit, and OpRisks. However, due to the characteristics
This new environment changed the asset management indus­ of their business (and perhaps helped by a historic disregard
try. During the precrisis "golden years" of abundant liquidity, for strong controls), OpRisk is typically the largest risk exposure
most asset managers were not overly worried about the costs an asset manager has. Market and credit risk associated losses
incurred in running their operations and did not pay close would usually have an indirect impact on the asset manager's
attention to the risks involved, since the continuous growth in revenue, as any loss to the client funds entails lower commis­
personal wealth steadily increased their AUM , covering for these sions. However, these losses are usually borne by the fund's
expenses. Errors and high operating costs were buried under clients, not the asset manager as a financial institution. These
the increased revenues from a larger asset base and the profits market and credit risk losses would impact the quotas and
that came from high returns in the world markets. Postcrisis, the NAVs, so the client would take a direct hit; the asset manager
situation has changed dramatically. Large asset managers have would just have less fee revenue in these cases, an indirect
impact. OpRisk can be manifested in many different ways for
an asset manager as, for example, in errors in processing trans­
2 To preserve confidentiality, the company names are not mentioned. actions or a system failure that can cause severe damage and

Chapter 7 OpRisk Data and Governance ■ 133

Table 7.15 Asset Management OpRisk Profile on the retail, offering the convenience of trading from home
or work and charging a reasonable fee for trades and usually
Event Type Frequency (%) Severity (%) offering free online research tools and a few other services,
Internal Fraud 1.5 11.1 brick-and-mortar brokers are mostly a division of larger financial
institutions and tend to focus on a wealthier customer base that
External Fraud 2.7 0.9
would pay for high fees they charge, advice from financial advi­
Employment Practices 4.3 2.5 sors, etc.
and Workplace safety
Over the past decade, the industry had a dramatic transforma­
Clients, Products, and 13.7 30.8
tion with the proliferation of sophisticated, high-speed trading
Business Practices
technology that has changed the way broker-dealers trade for
Damage to Physical 0.3 0.2 their own accounts and as agent for their customers. In addi­
Assets
tion, customers of these broker-dealers— particularly leading-
Business Disruption 3.3 1.5 edge institutions— have themselves begun using technological
and System Failures tools to place orders and to trade on markets with little or no
Execution, Delivery & 74.2 52.8 substantive intermediation of their broker-dealers. This, in turn,
Process Management has given rise to the increased use and reliance on "direct mar­
Source: Results from the 2008 Loss Data Collection Exercise for Opera­ ket access" or "sponsored access" arrangements. Under these
tional Risk, see BCBS (2009b). arrangements, the broker-dealer allows its customers— whether
an institution such as a hedge fund, mutual fund, bank or insur­
ance company, an individual, or another broker-dealer—to
impact the balance sheet of the asset manager. Asset managers
use the broker-dealer's market participant identifier ("M PID")
are also regularly sued for poor performance by clients. Consis­
or other mechanism for the purposes of electronically access­
tently failing to comply with local regulations, or with very basic
ing the exchange. With "direct market access", as commonly
business ethics, can generate very large operational losses and
understood, the customer's orders first flow through the
subsequent reputational damage. A number of examples are
broker-dealer's systems and then enters the markets, while with
available in the media for large losses in each of these cases
"sponsored access", the customer's orders flow directly into the
(Table 7.15).
markets without passing through the broker-dealer's systems.
Coming to realize the need to focus on OpRisk, asset manag­ In all cases, irrespectively, whether the broker-dealer is trading
ers have been setting up OpRisk departments at a fast speed in for its own account, is trading for customers through more tra­
the last few years. The higher focus from regulators on hedge ditionally intermediated brokerage arrangements, or is allowing
funds also made these more sophisticated asset managers to set customers direct market access or sponsored access, the broker-
up better OpRisk procedures around their operations. This new dealer with market access is legally responsible for all trading
focus on control and risks would actually facilitate a more stable activities that occur under its MPID. In some cases, the broker-
growth, with less bumps, when the economic environment even­ dealer providing sponsored access may not utilize any pretrade
tually improves. risk management controls (i.e., "unfiltered" or "naked" access),
and thus could be unaware of the trading activity occurring
under its market identifier and has no mechanism to control it.
Retail Brokerage
Nowadays, order placement rates can exceed 1000 orders per
For OpRisk practitioners, this sector is possibly one of the most
second with the use of high-speed, automated algorithms. If,
interesting. Although we obviously need to consider that risk
for example, an algorithm such as this malfunctions and places
profiles would vary significantly between institutions given their
repetitive orders with an average size of 300 shares and an
different business strategies, broker-dealers risk profile is usually
average price of USD 20, a two-minute delay in the detec­
dominated by OpRisk, which accounts for at least 60-70% of the
tion of the problem could result in the entry of, for example,
total risk capital in these firms. This OpRisk type becomes clear
120,000 orders that values USD 720 million. In sponsored access
when we review the sector.
arrangements, as well as other access arrangements, appro­
Broker-dealers of these days can be roughly classified into priate pretrade risk controls could prevent this outcome from
online and brick-and-mortar brokers. Although what separa­ occurring by blocking unintended orders from being routed
tion then cannot be precisely defined, the customer focus of to an exchange. Incidents involving algorithmic or other trad­
these brokers is different. While online brokers tend to compete ing errors in connection with market access occur with some

134 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
regularity. For example, it was reported that, on September Table 7.16 Asset Management OpRisk Profile
30, 2008, trading in Google became extremely volatile toward
the end of the day, dropping 93% in value at one point, due to Event Type Frequency (%) Severity (%)
an influx of erroneous orders onto an exchange from a single Internal Fraud 5.8 18.1
market participant. As a result, Nasdaq had to cancel numerous
External Fraud 2.3 1.4
trades, and adjust the closing price for Google and the closing
value for the Nasdaq 100 Index. In addition, it was reported Employment Practices 4.4 6.3
that, in September 2009, Southwest Securities announced a and Workplace safety

USD 6.3 million quarterly loss resulting from deficient market Clients, Products, and 66.9 59.5
access controls with respect to one of its correspondent brokers Business Practices
that vastly exceeded its credit limits. Despite receiving intra-day Damage to Physical 0.1 0.1
alerts from the exchange, Southwest Securities' controls proved Assets
insufficient to allow it to respond in a timely manner, and trading Business Disruption 0.5 0.2
by the correspondent continued for the rest of the day, result­ and System Failures
ing in a significant loss. Another example that highlights the
Execution, Delivery & 20.0 14.4
need for appropriate controls in connection with market access Process Management
occurred in December 2005, when Mizuho Securities, one of
Source: Results from the 2008 Loss Data Collection Exercise for Opera­
Japan's largest brokerage firms, sustained a significant loss due tional Risk, see BCBS (2009b).
to an erroneous manual order entry that resulted in a trade that,
under the applicable exchange rules, could not be canceled.
Specifically, it was reported that a trader at Mizuho Securities In this section, we provide an overview of how risk is organized
intended to enter a customer sale order for one share of a secu­ in financial firms, how policies are structured, and the importance
rity at a price of 610,000 Yen, but the numbers were mistakenly of a solid committee and governance structure. Sound internal
transposed and an order to sell 610,000 shares of the security at governance forms the foundation of an effective OpRisk manage­
a price of 1 Yen was entered instead. A system-driven, pretrade ment framework. Although internal governance issues related
control reasonably designed to reject orders that are not rea­ to the management of operational risk are not unlike those
sonably related to the quoted price of the security would have encountered in the management of credit or market risk, OpRisk
prevented this order from reaching the market. management challenges may differ from those in other risk areas.
As these examples show, broker-dealers are intensively exposed
to OpRisk that usually occupies the headlines of most of the
Organization of Risk Departments
newspapers and media. Brokers usually do not hold large pro­
prietary positions and lending, particularly after the 2008 crash, One cannot downplay the role of an organization in any large
has been limited; therefore, most exposure comes from poten­ business. Although many times the focus is on the measurement
tially explosive system issues, execution errors, litigation with models with its complex formulas, most of the times the success of
retail customers, fraud committed by clients, etc. (Table 7.16) implementing an OpRisk framework lies in having the right organi­
zation. The organizational design would usually hint at the strength
and degree of development of an OpRisk framework at a firm. In
7.8 RISK ORGANIZATION AND the following text, we show a few organizational designs and the

GOVERNANCE beliefs that firms need to have to make them work. Usually firms
start with Design 1 and go to Design 4 presented in Figure 7.5.

Developing a solid risk organization is a key part of the frame­ • Design 1— Central Risk Function as Coordinator. In this
work. Understanding the reporting lines and establishing the organizational design, risk management role is more of a
position of this organization on the firm would have probably facilitator. Usually in this structure, risk management gathers
as much importance as having a good measurement system. information and reports to the C EO or the Board. Sometimes
Also having proper organizational involvement in OpRisk issues risk management would add some layer of analysis, but in
where key stakeholders are regularly informed and oversee risk most cases, the Central Risk group would be a small group.
is fundamental for success. Developing a framework in a silo One of the issues with this structure is that the regulators dis­
that no one sees or cares is nor a desirable situation. The OpRisk like the idea that risk managers report to revenue generating
manager needs to be integrated to the rest of the organization. businesses;

Chapter 7 OpRisk Data and Governance ■ 135

Design 1 and compensation decisions are still taken by these. In order
for this to be successful, the Business Units should have a
strong risk culture and collaborate very closely with the Central
Risk function. This dotted line structure works well when there
is a culture of Business Unit independence and distrust of the
Central Risk function for some reason or event that happened
in the past;
• Design 3— Solid reporting lines to Central Risk Manage­
ment. This organizational structure is reasonably popular
Design 2 within large firms. Risk Managers still physically work in the
Business Units but report to the Central Risk function usually
based in the headquarters. The Central Risk function will be
better positioned to prioritize risk management efforts across
different initiatives. This solid line reporting will also assist in
the creation of a more homogenous risk culture and consis­
tent approach across the enterprise;
• Design A— Strong Central Risk Management. Large firms
have adopted this structure lately, either by internal agree­
Design 3 ment or through regulatory pressure. In this structure, the
Corporate Chief Risk Officer is the key decision maker in risk
management and fully responsible for risk across the firm.
Central Risk Management is responsible to monitor and
manage all the firm's risks and report to senior management
and the Board. Such structure makes it much easier for the
regulator to streamline supervision as they can focus to one
particular group instead of being scattered in many business
units and geographical areas.

Design 4
Structuring a Firm Wide Policy: Example
of an OpRisk Policy
Example of a policy is presented in Table 7.17. A policy defines
a firm's operational risk management framework, which includes
governance structure, roles and responsibilities, and standards
for OpRisk management and measurement. It also describes
the OpRisk management programs, which are the functional
activities requiring guidelines for consistent firm wide execution
D e sig n s 1 -4 . (e.g., loss capture program, risk control self-assessment, and
scenario analysis).

In order for this structure to be successful, one should believe

that the Business Units will be responsive to the Central Risk Governance
demands even without being part of their reporting line and
Common industry practice for sound OpRisk governance often
the control and incentives that such reporting includes (e.g.,
relies on three lines of defense:
control over compensation, etc.);
• Business line management;
• Design 2— Matrix reporting—the "dotted lines". In this
organizational design, a sort of evolution to the previous • An independent corporate OpRisk management function;
design, risk managers have a dotted line to the Central Risk and
function; however, they are appointed by the Business Units • An independent review (usually internal audit).

136 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 7.17 Example of an OpRisk Policy

Content Description

Executive summary Defines the rationale and scope of the policy

Policy statements Provide a quick definition of the standards that will be used across the policy

Risk taxonomy Categorize OpRisk in different risk types. It can follow the Basel categories, but if it does not, it
usually provides a mapping of internal categories to the Basel-defined categories

Loss collection Defines what losses or incidents should be reported. Discuss concepts of "near misses" and
describes recoveries

Risk assessment Usually describes other programs used to supplement internal loss data collection like scenario
analysis or risk factor analysis

Risk measurement Describes the basic framework for measuring OpRisk, which types of data are used, and how
capital is calculated (overall view of the building blocks not a detailed manual)

Validation Describes how the risk assessment and measurement are validated, how frequent validation
takes place, and which departments are responsible for the validation

Policy assurance and testing Determines which department(s) in the firm will be responsible for assurance that the policy is
being followed and the reports that assure this firm-wide compliance

Governance Describes where this policy is situated, which committee approves it, and how the OpRisk
governance works

References Determine on which regulations, external standards, and/or other firm policies this was based
upon

Depending on the bank's nature, size and complexity, and the The regulators also reinforce the role of the board of direc­
risk profile of a bank's activities, the degree of formality of how tors. In the US and UK it is common that the regulators meet
these three lines of defense are implemented will vary. In all separately with financial firms' board of directors regularly to
cases, however, a bank's OpRisk governance function should be discuss their expectations regarding risk management. The
fully integrated into the bank's overall risk management gover­ board of directors should take the lead in establishing a strong
nance structure and the regulators closely monitor this. risk management culture. The board of directors and senior
management should establish a corporate culture that is guided
If OpRisk governance utilizes the three lines of defense model
by strong risk management and that supports and provides
(i.e., the business is the first line of defense, risk management is
appropriate standards and incentives for professional and
the second line, and internal audit being the third), the structure
responsible behavior. In this regard, it is the responsibility of the
and activities of the three lines often vary, depending on the
board of directors to ensure that a strong OpRisk management
bank's portfolio of products, activities, processes, and systems;
culture exists throughout the whole organization and this will be
the bank's size; and its risk management approach. Strong risk cul­
closely monitored by regulators.
ture and good communications among the three lines of defense
are important characteristics of good OpRisk governance.

Chapter 7 OpRisk Data and Governance ■ 137

Supervisory
Guidance on Model
Risk Management
Learning Objectives
After completing this reading you should be able to:

Describe model risk and explain how it can arise in the Explain best practices for the development and
implementation of a model. implementation of models.

Describe elements of an effective model risk management Describe elements of a strong model validation process
process. and challenges to an effective validation process.

E x c e rp t is rep rin ted from Financial Institution L e tte r FIL-22-2017 p u b lish e d by the Fed era l D e p o sit Insurance C orporation.
8.1 INTRODUCTION management; however, sound development, implementation,
and use of models are also vital elements. Furthermore, model
Banks rely heavily on quantitative analysis and models in most risk management encompasses governance and control mecha­
aspects of financial decision making.1 They routinely use models nisms such as board and senior management oversight, policies
for a broad range of activities, including underwriting credits; and procedures, controls and compliance, and an appropriate
valuing exposures, instruments, and positions; measuring risk; incentive and organizational structure.
managing and safeguarding client assets; determining capital Previous guidance and other publications issued by the FDIC on
and reserve adequacy; and many other activities. In recent years, the use of models address aspects of model risk management
banks have applied models to more complex products and with for specific types of models or pay particular attention to model
more ambitious scope, such as enterprise-wide risk measure­ validation.2 Based on supervisory and industry experience over
ment, while the markets in which they are used have also the past several years, this document expands on existing
broadened and changed. Changes in regulation have spurred guidance— most importantly by broadening the scope to
some of the recent developments, particularly the U.S. regula­ include all aspects of model risk management. Many banks may
tory capital rules for market, credit, and operational risk based already have in place a large portion of these practices, but
on the framework developed by the Basel Committee on Bank­ banks should ensure that internal policies and procedures are
ing Supervision. Even apart from these regulatory considerations, consistent with the risk management principles and supervisory
however, banks have been increasing the use of data-driven, expectations contained in this guidance. Details may vary from
quantitative decision-making tools for a number of years. bank to bank, as practical application of this guidance should be
The expanding use of models in all aspects of banking reflects customized to be commensurate with a bank's risk exposures, its
the extent to which models can improve business decisions, but business activities, and the complexity and extent of its model
models also come with costs. There is the direct cost of devot­ use. For example, steps taken to apply this guidance at banks
ing resources to develop and implement models properly. There using relatively few models of only moderate complexity might
are also the potential indirect costs of relying on models, such as be significantly less involved than those at a bank where use of
the possible adverse consequences (including financial loss) of models is more extensive or complex.
decisions based on models that are incorrect or misused. Those
consequences should be addressed by active management of
model risk. 8.3 OVERVIEW OF MODEL RISK
This guidance describes the key aspects of effective model
MANAGEMENT
risk management. Section II explains the purpose and scope of
For the purposes of this document, the term m odel refers to a
the guidance, and Section III gives an overview of model risk
quantitative method, system, or approach that applies statistical,
management. Section IV discusses robust model development,
economic, financial, or mathematical theories, techniques, and
implementation, and use. Section V describes the components of
assumptions to process input data into quantitative estimates.
an effective validation framework. Section VI explains the salient
A m odel consists of three components: an information input
features of sound governance, policies, and controls over model
component, which delivers assumptions and data to the model;
development, implementation, use, and validation. Section VII
a processing component, which transforms inputs into estimates;
concludes.
and a reporting component, which translates the estimates into
useful business information. Models meeting this definition

8.2 PURPOSE AND SCOPE might be used for analyzing business strategies, informing

The purpose of this document is to provide comprehensive 2 For instance, the FDIC has addressed aspects of model risk manage­
ment in guidance related to different activities; see Joint Agency Policy
guidance for banks on effective model risk management.
Statement on Interest Rate Risk (FIL-52-96), FFIEC Advisory on Interest
Rigorous model validation plays a critical role in model risk Rate Risk Management (FIL-2-2010), Interagency Advisory on Interest
Rate Risk Management Frequently Asked Questions (FIL-2-2012),
FDIC's Credit Card Activities Manual (https://www.fdic.gov/regulations/
1 Unless otherwise indicated, banks refers to state non-member banks, examinations/credit_card/), and Supervisory Guidance on Implementing
state savings associations, and all other institutions for which the Fed­ Dodd-Frank Act Company-Run Stress Tests for Banking Organizations
eral Deposit Insurance Corporation is the primary supervisor. It is not With Total Consolidated Assets of More Than $10 Billion but Less Than
expected that this guidance will pertain to FDIC-supervised institutions $50 Billion (79 FR 14153). In addition, the advanced-approaches risk-
with under $1 billion in total assets unless the institution's model use is based capital rules (12 CFR 325, Appendix D) contain explicit validation
significant, complex, or poses elevated risk to the institution. requirements for subject banking organizations.

140 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
business decisions, identifying and measuring risks, valuing • The model may be used incorrectly or inappropriately. Even
exposures, instruments or positions, conducting stress testing, a fundamentally sound model producing accurate outputs
assessing adequacy of capital, managing client assets, measuring consistent with the design objective of the model may
compliance with internal limits, maintaining the formal control exhibit high model risk if it is misapplied or misused. Models
apparatus of the bank, or meeting financial or regulatory report­ by their nature are simplifications of reality, and real-world
ing requirements and issuing public disclosures. The definition of events may prove those simplifications inappropriate. This
m odel also covers quantitative approaches whose inputs are is even more of a concern if a model is used outside the
partially or wholly qualitative or based on expert judgment, environment for which it was designed. Banks may do this
provided that the output is quantitative in nature.3 intentionally as they apply existing models to new products
or markets, or inadvertently as market conditions or customer
Models are simplified representations of real-world relationships
behavior changes. Decision makers need to understand the
among observed characteristics, values, and events. Simplifi­
limitations of a model to avoid using it in ways that are not
cation is inevitable, due to the inherent complexity of those
consistent with the original intent. Limitations come in part
relationships, but also intentional, to focus attention on particu­
from weaknesses in the model due to its various shortcom­
lar aspects considered to be most important for a given model
ings, approximations, and uncertainties. Limitations are also
application. Model quality can be measured in many ways:
a consequence of assumptions underlying a model that may
precision, accuracy, discriminatory power, robustness, stability,
restrict the scope to a limited set of specific circumstances
and reliability, to name a few. Models are never perfect, and the
and situations.
appropriate metrics of quality, and the effort that should be put
into improving quality, depend on the situation. For example, Model risk should be managed like other types of risk. Banks
precision and accuracy are relevant for models that forecast should identify the sources of risk and assess the magnitude.
future values, while discriminatory power applies to models that Model risk increases with greater model complexity, higher
rank order risks. In all situations, it is important to understand a uncertainty about inputs and assumptions, broader use, and
model's capabilities and limitations given its simplifications and larger potential impact. Banks should consider risk from indi­
assumptions. vidual models and in the aggregate. Aggregate model risk is
affected by interaction and dependencies among models; reli­
The use of models invariably presents model risk, which is the
ance on common assumptions, data, or methodologies; and
potential for adverse consequences from decisions based on
any other factors that could adversely affect several models and
incorrect or misused model outputs and reports. Model risk
their outputs at the same time. With an understanding of the
can lead to financial loss, poor business and strategic decision
source and magnitude of model risk in place, the next step is to
making, or damage to a bank's reputation. Model risk occurs
manage it properly.
primarily for two reasons:
A guiding principle for managing model risk is "effective
• The model may have fundamental errors and may produce
challenge" of models, that is, critical analysis by objective,
inaccurate outputs when viewed against the design objective
informed parties who can identify model limitations and
and intended business uses. The mathematical calculation
assumptions and produce appropriate changes. Effective
and quantification exercise underlying any model generally
challenge depends on a combination of incentives, com pe­
involves application of theory, choice of sample design and
tence, and influence. Incentives to provide effective challenge
numerical routines, selection of inputs and estimation, and
to models are stronger when there is greater separation of
implementation in information systems. Errors can occur at
that challenge from the model developm ent process and
any point from design through implementation. In addition,
when challenge is supported by well-designed com pensa­
shortcuts, simplifications, or approximations used to manage
tion practices and corporate culture. Com petence is a key to
complicated problems could compromise the integrity and
effectiveness since technical knowledge and modeling skills
reliability of outputs from those calculations. Finally, the qual­
are necessary to conduct appropriate analysis and critique.
ity of model outputs depends on the quality of input data
Finally, challenge may fail to be effective without the influence
and assumptions, and errors in inputs or incorrect assump­
to ensure that actions are taken to address model issues. Such
tions will lead to inaccurate outputs.
influence comes from a combination of explicit authority, stat­
ure within the organization, and commitment and support from
3 While outside the scope of this guidance, more qualitative approaches higher levels of management.
used by banking organizations—i.e., those not defined as models
according to this guidance—should also be subject to a rigorous control Even with skilled modeling and robust validation, model risk
process. cannot be eliminated, so other tools should be used to manage

Chapter 8 Supervisory Guidance on Model Risk Management ■ 141

model risk effectively. Among these are establishing limits on recognize that this subjectivity elevates the importance
model use, monitoring model performance, adjusting or revising of sound and comprehensive model risk management
models over time, and supplementing model results with other processes.4
analysis and information. Informed conservatism, in either the
inputs or the design of a model or through explicit adjustments
to outputs, can be an effective tool, though not an excuse to
Model Development and Implementation
avoid improving models. An effective development process begins with a clear statement
As is generally the case with other risks, materiality is an impor­ of purpose to ensure that model development is aligned with
tant consideration in model risk management. If at some banks the intended use. The design, theory, and logic underlying the
the use of models is less pervasive and has less impact on their model should be well documented and generally supported
financial condition, then those banks may not need as com­ by published research and sound industry practice. The model
plex an approach to model risk management in order to meet methodologies and processing components that implement the
supervisory expectations. However, where models and model theory, including the mathematical specification and the numeri­
output have a material impact on business decisions, including cal techniques and approximations, should be explained in
decisions related to risk management and capital and liquidity detail with particular attention to merits and limitations. Devel­
planning, and where model failure would have a particularly opers should ensure that the components work as intended,
harmful impact on a bank's financial condition, a bank's model are appropriate for the intended business purpose, and are
risk management fram ework should be more extensive and conceptually sound and mathematically and statistically correct.
rigorous. Comparison with alternative theories and approaches is a funda­
mental component of a sound modeling process.
Model risk management begins with robust model develop­
ment, implementation, and use. Another essential element is The data and other information used to develop a model are
a sound model validation process. A third element is gover­ of critical importance; there should be rigorous assessment
nance, which sets an effective framework with defined roles and of data quality and relevance, and appropriate documenta­
responsibilities for clear communication of model limitations and tion. Developers should be able to demonstrate that such data
assumptions, as well as the authority to restrict model usage. and information are suitable for the model and that they are
The following sections of this document cover each of these consistent with the theory behind the approach and with the
elements. chosen methodology. If data proxies are used, they should be
carefully identified, justified, and documented. If data and infor­
mation are not representative of the bank's portfolio or other

8.4 MODEL DEVELOPMENT, characteristics, or if assumptions are made to adjust the data
and information, these factors should be properly tracked and
IMPLEMENTATION, AND USE analyzed so that users are aware of potential limitations. This is
particularly important for external data and information (from a
Model risk management should include disciplined and knowl­
vendor or outside party), especially as they relate to new prod­
edgeable developm ent and implementation processes that are
ucts, instruments, or activities.
consistent with the situation and goals of the model user and
with bank policy. Model developm ent is not a straightforward An integral part of model development is testing, in which
or routine technical process. The experience and judgm ent of the various components of a model and its overall functioning
developers, as much as their technical knowledge, greatly are evaluated to determine whether the model is perform­
influence the appropriate selection of inputs and processing ing as intended. Model testing includes checking the model's
components. The training and experience of developers accuracy, demonstrating that the model is robust and stable,
exercising such judgm ent affects the extent of model risk. assessing potential limitations, and evaluating the model's
Moreover, the modeling exercise is often a multidisciplinary behavior over a range of input values. It should also assess the
activity drawing on economics, finance, statistics, mathematics,
and other fields. Models are employed in real-world markets
4 Less complex banks that rely on vendor models may be able to satisfy
and events and therefore should be tailored for specific the standards in this guidance without an in-house staff of technical,
applications and informed by business uses. In addition, a quantitative model developers. However, even if a bank relies on
considerable amount of subjective judgm ent is exercised at vendors for basic model development, the bank should still choose the
particular models and variables that are appropriate to its size, scale,
various stages of model developm ent, implementation, and lines of business and ensure the models are appropriate for the
use, and validation. It is important for decision makers to intended use.

142 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
impact of assumptions and identify situations where the model realities. Model users can provide valuable business insight
performs poorly or becomes unreliable. Testing should be during the development process. In addition, business manag­
applied to actual circumstances under a variety of market condi­ ers affected by model outcomes may question the methods or
tions, including scenarios that are outside the range of ordinary assumptions underlying the models, particularly if the managers
expectations, and should encompass the variety of products or are significantly affected by and do not agree with the outcome.
applications for which the model is intended. Extreme values for Such questioning can be healthy if it is constructive and causes
inputs should be evaluated to identify any boundaries of model model developers to explain and justify the assumptions and
effectiveness. The impact of model results on other models design of the models.
that rely on those results as inputs should also be evaluated.
However, challenge from model users may be weak if the model
Included in testing activities should be the purpose, design, and
does not materially affect their results, if the resulting changes
execution of test plans, summary results with commentary and
in models are perceived to have adverse effects on the business
evaluation, and detailed analysis of informative samples. Testing
line, or if change in general is regarded as expensive or difficult.
activities should be appropriately documented.
User challenges also tend not to be comprehensive because
The nature of testing and analysis will depend on the type of they focus on aspects of models that have the most direct
model and will be judged by different criteria depending on the impact on the user's measured business performance or com­
context. For example, the appropriate statistical tests depend pensation, and thus may ignore other elements and applications
on specific distributional assumptions and the purpose of the of the models. Finally, such challenges tend to be asymmetric,
model. Furthermore, in many cases statistical tests cannot unam­ because users are less likely to challenge an outcome that
biguously reject false hypotheses or accept true ones based on results in an advantage for them. Indeed, users may incorrectly
sample information. Different tests have different strengths and believe that model risk is low simply because outcomes from
weaknesses under different conditions. Any single test is rarely model-based decisions appear favorable to the institution. Thus,
sufficient, so banks should apply a variety of tests to develop a the nature and motivation behind model users' input should be
sound model. evaluated carefully, and banks should also solicit constructive
suggestions and criticism from sources independent of the line
Banks should ensure that the development of the more judg­
of business using the model.
mental and qualitative aspects of their models is also sound. In
some cases, banks may take statistical output from a model and Reports used for business decision making play a critical role in
modify it with judgmental or qualitative adjustments as part of model risk management. Such reports should be clear and com­
model development. While such practices may be appropriate, prehensible and take into account the fact that decision makers
banks should ensure that any such adjustments made as part of and modelers often come from quite different backgrounds and
the development process are conducted in an appropriate and may interpret the contents in different ways. Reports that pro­
systematic manner, and are well documented. Models typically vide a range of estimates for different input-value scenarios and
are embedded in larger information systems that manage the assumption values can give decision makers important indica­
flow of data from various sources into the model and handle the tions of the model's accuracy, robustness, and stability as well as
aggregation and reporting of model outcomes. Model calcula­ information on model limitations.
tions should be properly coordinated with the capabilities and
An understanding of model uncertainty and inaccuracy and a
requirements of information systems. Sound model risk manage­
demonstration that the bank is accounting for them appropri­
ment depends on substantial investment in supporting systems
ately are important outcomes of effective model development,
to ensure data and reporting integrity, together with controls
implementation, and use. Because they are by definition imper­
and testing to ensure proper implementation of models, effec­
fect representations of reality, all models have some degree of
tive systems integration, and appropriate use.
uncertainty and inaccuracy. These can sometimes be quantified,
for example, by an assessment of the potential impact of factors
that are unobservable or not fully incorporated in the model, or
Model Use
by the confidence interval around a statistical model's point esti­
Model use provides additional opportunity to test whether a mate. Indeed, using a range of outputs, rather than a simple
model is functioning effectively and to assess its performance point estimate, can be a useful way to signal model uncertainty
over time as conditions and model applications change. It can and avoid spurious precision. At other times, only a qualitative
serve as a source of productive feedback and insights from a assessment of model uncertainty and inaccuracy is possible. In
knowledgeable internal constituency with strong interest in hav­ either case, it can be prudent for banks to account for model
ing models that function well and reflect economic and business uncertainty by explicitly adjusting model inputs or calculations

Chapter 8 Supervisory Guidance on Model Risk Management ■ 143

to produce more severe or adverse model output in the interest limitations and assumptions, and assesses their possible impact.
of conservatism. Accounting for model uncertainty can also As with other aspects of effective challenge, model validation
include judgmental conservative adjustments to model output, should be performed by staff with appropriate incentives, com­
placing less emphasis on that model's output, or ensuring that petence, and influence.
the model is only used when supplemented by other models or
All model components, including input, processing, and report­
approaches.5
ing, should be subject to validation; this applies equally to
While conservative use of models is prudent in general, banks models developed in-house and to those purchased from or
should be careful in applying conservatism broadly or claiming developed by vendors or consultants. The rigor and sophisti­
to make conservative adjustments or add-ons to address model cation of validation should be commensurate with the bank's
risk, because the impact of such conservatism in complex mod­ overall use of models, the complexity and materiality of its mod­
els may not be obvious or intuitive. Model aspects that appear els, and the size and complexity of the bank's operations.
conservative in one model may not be truly conservative com­
Validation involves a degree of independence from model
pared with alternative methods. For example, simply picking
development and use. Generally, validation should be done by
an extreme point on a given modeled distribution may not be
people who are not responsible for development or use and do
conservative if the distribution was misestimated or misspecified
not have a stake in whether a model is determined to be valid.
in the first place. Furthermore, initially conservative assumptions
Independence is not an end in itself but rather helps ensure that
may not remain conservative over time. Therefore, banks should
incentives are aligned with the goals of model validation. While
justify and substantiate claims that model outputs are conserva­
independence may be supported by separation of reporting
tive with a definition and measurement of that conservatism
lines, it should be judged by actions and outcomes, since there
that is communicated to model users. In some cases, sensitivity
may be additional ways to ensure objectivity and prevent bias. As
analysis or other types of stress testing can be used to demon­
a practical matter, some validation work may be most effectively
strate that a model is indeed conservative. Another way in which
done by model developers and users; it is essential, however,
banks may choose to be conservative is to hold an additional
that such validation work be subject to critical review by an inde­
cushion of capital to protect against potential losses associated
pendent party, who should conduct additional activities to ensure
with model risk. However, conservatism can become an impedi­
proper validation. Overall, the quality of the process is judged
ment to proper model development and application if it is seen
by the manner in which models are subject to critical review.
as a solution that dissuades the bank from making the effort to
This could be determined by evaluating the extent and clarity of
improve the model; in addition, excessive conservatism can lead
documentation, the issues identified by objective parties, and the
model users to discount the model outputs.
actions taken by management to address model issues.
As this section has explained, robust model development,
In addition to independence, banks can support appropriate
implementation, and use is important to model risk manage­
incentives in validation through compensation practices and
ment. But it is not enough for model developers and users
performance evaluation standards that are tied directly to the
to understand and accept the model. Because model risk is
quality of model validations and the degree of critical, unbiased
ultimately borne by the bank as a whole, the bank should objec­
review. In addition, corporate culture plays a role if it establishes
tively assess model risk and the associated costs and benefits
support for objective thinking and encourages questioning and
using a sound model-validation process.
challenging of decisions.

Staff doing validation should have the requisite knowledge,

8.5 MODEL VALIDATION skills, and expertise. A high level of technical expertise may
be needed because of the complexity of many models, both
Model validation is the set of processes and activities intended in structure and in application. These staff also should have a
to verify that models are performing as expected, in line with significant degree of familiarity with the line of business using
their design objectives and business uses. Effective validation the model and the model's intended use. A model's developer
helps ensure that models are sound. It also identifies potential is an important source of information but cannot be relied on as
an objective or sole source on which to base an assessment of
model quality.
5 To the extent that models are used to generate amounts included in Staff conducting validation work should have explicit authority
public financial statements, any adjustments for model uncertainty are
required by existing law to comply with generally accepted accounting to challenge developers and users and to elevate their findings,
principles. including issues and deficiencies. The individual or unit to whom

144 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
those staff report should have sufficient influence or stature based on its underlying assumptions, theory, and methods. In
within the bank to ensure that any issues and deficiencies are this way, it provides information about the source and extent
appropriately addressed in a timely and substantive manner. of model risk. Validation also can reveal deterioration in model
Such influence can be reflected in reporting lines, title, rank, or performance over time and can set thresholds for acceptable
designated responsibilities. Influence may be demonstrated by a levels of error, through analysis of the distribution of outcomes
pattern of actual instances in which models, or the use of mod­ around expected or predicted values. If outcomes fall consis­
els, have been appropriately changed as a result of validation. tently outside this acceptable range, then the models should be

The range and rigor of validation activities conducted prior to redeveloped.

first use of a model should be in line with the potential risk pre­
sented by use of the model. If significant deficiencies are noted
as a result of the validation process, use of the model should
Key Elements of Comprehensive
not be allowed or should be permitted only under very tight Validation
constraints until those issues are resolved. If the deficiencies are An effective validation framework should include three core
too severe to be addressed within the model's framework, the elements:
model should be rejected. If it is not feasible to conduct neces­
sary validation activities prior to model use because of data • Evaluation of conceptual soundness, including developmen­

paucity or other limitations, that fact should be documented tal evidence

and communicated in reports to users, senior management, and • Ongoing monitoring, including process verification and
other relevant parties. In such cases, the uncertainty about the benchmarking
results that the model produces should be mitigated by other • Outcomes analysis, including back-testing
compensating controls. This is particularly applicable to new
models and to the use of existing models in new applications. Evaluation of Conceptual Soundness
Validation activities should continue on an ongoing basis after This element involves assessing the quality of the model design
a model goes into use, to track known model limitations and and construction. It entails review of documentation and empiri­
to identify any new ones. Validation is an important check on cal evidence supporting the methods used and variables selected
model use during periods of benign economic and financial con­ for the model. Documentation and testing should convey an
ditions, when estimates of risk and potential loss can become understanding of model limitations and assumptions. Validation
overly optimistic, and when the data at hand may not fully should ensure that judgment exercised in model design and con­
reflect more stressed conditions. Ongoing validation activities struction is well informed, carefully considered, and consistent
help to ensure that changes in markets, products, exposures, with published research and with sound industry practice. Devel­
activities, clients, or business practices do not create new model opmental evidence should be reviewed before a model goes into
limitations. For example, if credit risk models do not incorporate use and also as part of the ongoing validation process, in particu­
underwriting changes in a timely manner, flawed and costly busi­ lar whenever there is a material change in the model.
ness decisions could be made before deterioration in model
A sound development process will produce documented evi­
performance becomes apparent.
dence in support of all model choices, including the overall
Banks should conduct a periodic review— at least annually but theoretical construction, key assumptions, data, and specific
more frequently if warranted— of each model to determine mathematical calculations, as mentioned in Section IV. As part
whether it is working as intended and if the existing valida­ of model validation, those model aspects should be subjected
tion activities are sufficient. Such a determination could simply
to critical analysis by both evaluating the quality and extent of
affirm previous validation work, suggest updates to previous developmental evidence and conducting additional analysis and
validation activities, or call for additional validation activities.
testing as necessary. Comparison to alternative theories and
Material changes to models should also be subject to validation. approaches should be included. Key assumptions and the choice
It is generally good practice for banks to ensure that all models
of variables should be assessed, with analysis of their impact on
undergo the full validation process, as described in the following model outputs and particular focus on any potential limitations.
section, at some fixed interval, including updated documenta­ The relevance of the data used to build the model should be
tion of all activities. evaluated to ensure that it is reasonably representative of the
Effective model validation helps reduce model risk by identify­ bank's portfolio or market conditions, depending on the type of
ing model errors, corrective actions, and appropriate use. It model. This is an especially important exercise when a bank uses
also provides an assessment of the reliability of a given model, external data or the model is used for new products or activities.

Chapter 8 Supervisory Guidance on Model Risk Management ■ 145

Where appropriate to the particular model, banks should procedures for responding to any problems that appear. This
employ sensitivity analysis in model development and validation program should include process verification and benchmarking.
to check the impact of small changes in inputs and param­
Process verification checks that all model components are
eter values on model outputs to make sure they fall within an
functioning as designed. It includes verifying that internal and
expected range. Unexpectedly large changes in outputs in
external data inputs continue to be accurate, complete, consis­
response to small changes in inputs can indicate an unstable
tent with model purpose and design, and of the highest quality
model. Varying several inputs simultaneously as part of sensitiv­
available. Computer code implementing the model should be
ity analysis can provide evidence of unexpected interactions,
subject to rigorous quality and change control procedures to
particularly if the interactions are complex and not intuitively
ensure that the code is correct, that it cannot be altered except
clear. Banks benefit from conducting model stress testing to
by approved parties, and that all changes are logged and can
check performance over a wide range of inputs and parameter
be audited. System integration can be a challenge and deserves
values, including extreme values, to verify that the model is
special attention because the model processing component
robust. Such testing helps establish the boundaries of model
often draws from various sources of data, processes large
performance by identifying the acceptable range of inputs as
amounts of data, and then feeds into multiple data repositories
well as conditions under which the model may become unstable
and reporting systems. User-developed applications, such as
or inaccurate.
spreadsheets or ad hoc database applications used to generate
Management should have a clear plan for using the results of quantitative estimates, are particularly prone to model risk. As
sensitivity analysis and other quantitative testing. If testing indi­ the content or composition of information changes over time,
cates that the model may be inaccurate or unstable in some systems may need to be updated to reflect any changes in the
circumstances, management should consider modifying certain data or its use. Reports derived from model outputs should be
model properties, putting less reliance on its outputs, placing reviewed as part of validation to verify that they are accurate,
limits on model use, or developing a new approach. complete, and informative, and that they contain appropriate
indicators of model performance and limitations.
Qualitative information and judgment used in model develop­
ment should be evaluated, including the logic, judgment, and Many of the tests employed as part of model development
types of information used, to establish the conceptual sound­ should be included in ongoing monitoring and be conducted
ness of the model and set appropriate conditions for its use. The on a regular basis to incorporate additional information as
validation process should ensure that qualitative, judgmental it becomes available. New empirical evidence or theoreti­
assessments are conducted in an appropriate and systematic cal research may suggest the need to modify or even replace
manner, are well supported, and are documented. original methods. Analysis of the integrity and applicability of
internal and external information sources, including information
Ongoing Monitoring provided by third-party vendors, should be performed regularly.

The second core element of the validation process is ongoing Sensitivity analysis and other checks for robustness and stability
monitoring. Such monitoring confirms that the model is appro­ should likewise be repeated periodically. They can be as useful
priately implemented and is being used and is performing as during ongoing monitoring as they are during model development.
intended. If models only work well for certain ranges of input values, market
conditions, or other factors, they should be monitored to identify
Ongoing monitoring is essential to evaluate whether changes
situations where these constraints are approached or exceeded.
in products, exposures, activities, clients, or market conditions
necessitate adjustment, redevelopment, or replacement of the Ongoing monitoring should include the analysis of overrides
model and to verify that any extension of the model beyond its with appropriate documentation. In the use of virtually any
original scope is valid. Any model limitations identified in the model, there will be cases where model output is ignored,
development stage should be regularly assessed over time, as altered, or reversed based on the expert judgment of model
part of ongoing monitoring. Monitoring begins when a model users. Such overrides are an indication that, in some respect, the
is first implemented in production systems for actual business model is not performing as intended or has limitations. Banks
use. This monitoring should continue periodically over time, with should evaluate the reasons for overrides and track and analyze
a frequency appropriate to the nature of the model, the avail­ override performance. If the rate of overrides is high, or if the
ability of new data or modeling approaches, and the magnitude override process consistently improves model performance,
of the risk involved. Banks should design a program of ongo­ it is often a sign that the underlying model needs revision or
ing testing and evaluation of model performance along with redevelopment.

146 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Benchmarking is the comparison of a given model's inputs and complexity, data availability, and the magnitude of potential
outputs to estimates from alternative internal or external data model risk to the bank. Outcomes analysis should involve a
or models. It can be incorporated in model development as range of tests because any individual test will have weaknesses.
well as in ongoing monitoring. For credit risk models, examples For example, some tests are better at checking a model's abil­
of benchmarks include models from vendor firms or industry ity to rank-order or segment observations on a relative basis,
consortia and data from retail credit bureaus. Pricing models whereas others are better at checking absolute forecast accu­
for securities and derivatives often can be compared with alter­ racy. Tests should be designed for each situation, as not all will
native models that are more accurate or comprehensive but be effective or feasible in every circumstance, and attention
also too time consuming to run on a daily basis. W hatever the should be paid to choosing the appropriate type of outcomes
source, benchmark models should be rigorous and benchmark analysis for a particular model.
data should be accurate and complete to ensure a reasonable
Models are regularly adjusted to take into account new data or
comparison.
techniques, or because of deterioration in performance. Parallel
Discrepancies between the model output and benchmarks outcomes analysis, under which both the original and adjusted
should trigger investigation into the sources and degree of models' forecasts are tested against realized outcomes, provides
the differences, and examination of whether they are within an an important test of such model adjustments. If the adjusted
expected or appropriate range given the nature of the com­ model does not outperform the original model, developers,
parison. The results of that analysis may suggest revisions to the users, and reviewers should realize that additional changes— or
model. However, differences do not necessarily indicate that the even a wholesale redesign— are likely necessary before the
model is in error. The benchmark itself is an alternative predic­ adjusted model replaces the original one.
tion, and the differences may be due to the different data or
Back-testing is one form of outcomes analysis; specifically, it
methods used. If the model and the benchmark match well, that
involves the comparison of actual outcomes with model forecasts
is evidence in favor of the model, but it should be interpreted
during a sample time period not used in model development and
with caution so the bank does not get a false degree of comfort.
at an observation frequency that matches the forecast horizon or
performance window of the model. The comparison is generally
Outcomes Analysis done using expected ranges or statistical confidence intervals
The third core element of the validation process is outcomes around the model forecasts. When outcomes fall outside those
analysis, a comparison of model outputs to corresponding actual intervals, the bank should analyze the discrepancies and inves­
outcomes. The precise nature of the comparison depends on tigate the causes that are significant in terms of magnitude or
the objectives of a model, and might include an assessment of frequency. The objective of the analysis is to determine whether
the accuracy of estimates or forecasts, an evaluation of rank­ differences stem from the omission of material factors from the
ordering ability, or other appropriate tests. In ail cases, such model, whether they arise from errors with regard to other aspects
comparisons help to evaluate model performance, by establish­ of model specification such as interaction terms or assumptions of
ing expected ranges for those actual outcomes in relation to linearity, or whether they are purely random and thus consistent
the intended objectives and assessing the reasons for observed with acceptable model performance. Analysis of in-sample fit and
variation between the two. If outcomes analysis produces evi­ of model performance in holdout samples (data set aside and not
dence of poor performance, the bank should take action to used to estimate the original model) are important parts of model
address those issues. Outcomes analysis typically relies on sta­ development but are not substitutes for back-testing.
tistical tests or other quantitative measures. It can also include A well-known example of back-testing is the evaluation of
expert judgment to check the intuition behind the outcomes
value-at-risk (VaR), in which actual profit and loss is compared
and confirm that the results make sense. When a model itself with a model forecast loss distribution. Significant deviation in
relies on expert judgment, quantitative outcomes analysis helps
expected versus actual performance and unexplained volatility
to evaluate the quality of that judgment. Outcomes analysis in the profits and losses of trading activities may indicate that
should be conducted on an ongoing basis to test whether the hedging and pricing relationships are not adequately measured
model continues to perform in line with design objectives and by a given approach. Along with measuring the frequency of
business uses. losses in excess of a single VaR percentile estimator, banks
A variety of quantitative and qualitative testing and analytical should use other tests, such as assessing any clustering of
techniques can be used in outcomes analysis. The choice of exceptions and checking the distribution of losses against other
technique should be based on the model's methodology, its estimated percentiles.

Chapter 8 Supervisory Guidance on Model Risk Management ■ 147

Analysis of the results of even high-quality and well-designed Vendor products should nevertheless be incorporated into a
back-testing can pose challenges, since it is not a straightfor­ bank's broader model risk management framework following
ward, mechanical process that always produces unambiguous the same principles as applied to in-house models, although the
results. The purpose is to test the model, not individual forecast process may be somewhat modified.
values. Back-testing may entail analysis of a large number of
As a first step, banks should ensure that there are appropriate
forecasts over different conditions at a point in time or over
processes in place for selecting vendor models. Banks should
multiple time periods. Statistical testing is essential in such
require the vendor to provide developmental evidence explain­
cases, yet such testing can pose challenges in both the choice of
ing the product components, design, and intended use, to
appropriate tests and the interpretation of results; banks should
determine whether the model is appropriate for the bank's prod­
support and document both the choice of tests and the inter­
ucts, exposures, and risks. Vendors should provide appropriate
pretation of results.
testing results that show their product works as expected. They
Models with long forecast horizons should be back-tested, but should also clearly indicate the model's limitations and assump­
given the amount of time it would take to accumulate the neces­ tions and where the product's use may be problematic. Banks
sary data, that testing should be supplemented by evaluation should expect vendors to conduct ongoing performance moni­
over shorter periods. Banks should employ outcomes analysis toring and outcomes analysis, with disclosure to their clients, and
consisting of "early warning" metrics designed to measure to make appropriate modifications and updates overtim e.
performance beginning very shortly after model introduction
Banks are expected to validate their own use of vendor prod­
and trend analysis of performance over time. These outcomes
ucts. External models may not allow full access to computer
analysis tools are not substitutes for back-testing, which should
coding and implementation details, so the bank may have to
still be performed over the longer time period, but rather very
rely more on sensitivity analysis and benchmarking. Vendor
important complements.
models are often designed to provide a range of capabilities
Outcomes analysis and the other elements of the validation and so may need to be customized by a bank for its particular
process may reveal significant errors or inaccuracies in model circumstances. A bank's customization choices should be docu­
development or outcomes that consistently fall outside the mented and justified as part of validation. If vendors provide
bank's predetermined thresholds of acceptability. In such cases, input data or assumptions, or use them to build models, their
model adjustment, recalibration, or redevelopment is warranted. relevance for the bank's situation should be investigated. Banks
Adjustments and recalibration should be governed by the prin­ should obtain information regarding the data used to develop
ciple of conservatism and should undergo independent review. the model and assess the extent to which that data is repre­
sentative of the bank's situation. The bank also should conduct
Material changes in model structure or technique, and all model
ongoing monitoring and outcomes analysis of vendor model
redevelopment, should be subject to validation activities of
performance using the bank's own outcomes.
appropriate range and rigor before implementation. At times
banks may have a limited ability to use key model validation Systematic procedures for validation help the bank to under­
tools like back-testing or sensitivity analysis for various reasons, stand the vendor product and its capabilities, applicability, and
such as lack of data or of price observability. In those cases, limitations. Such detailed knowledge is necessary for basic con­
even more attention should be paid to the model's limitations trols of bank operations. It is also very important for the bank to
when considering the appropriateness of model usage, and have as much knowledge in-house as possible, in case the ven­
senior management should be fully informed of those limitations dor or the bank terminates the contract for any reason, or if the
when using the models for decision making. Such scrutiny vendor is no longer in business. Banks should have contingency
should be applied to individual models and models in the plans for instances when the vendor model is no longer avail­
aggregate. able or cannot be supported by the vendor.

Validation of Vendor and Other

8.6 GOVERNANCE, POLICIES,
Third-Party Products
AND CONTROLS
The widespread use of vendor and other third-party products—
including data, parameter values, and complete models— poses Developing and maintaining strong governance, policies,
unique challenges for validation and other model risk manage­ and controls over the model risk management framework is
ment activities because the modeling expertise is external to the fundamentally important to its effectiveness. Even if model devel­
user and because some components are considered proprietary. opment, implementation, use, and validation are satisfactory,

148 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
a weak governance function will reduce the effectiveness of over­ the bank's relative complexity, business activities, corporate
all model risk management. A strong governance framework pro­ culture, and overall organizational structure. The board or its
vides explicit support and structure to risk management functions delegates should approve model risk management policies and
through policies defining relevant risk management activities, review them annually to ensure consistent and rigorous prac­
procedures that implement those policies, allocation of resources, tices across the organization. Those policies should be updated
and mechanisms for evaluating whether policies and procedures as necessary to ensure that model risk management practices
are being carried out as specified. Notably, the extent and remain appropriate and keep current with changes in market
sophistication of a bank's governance function is expected to conditions, bank products and strategies, bank exposures and
align with the extent and sophistication of model usage. activities, and practices in the industry. All aspects of model risk
management should be covered by suitable policies, including
model and model risk definitions; assessment of model risk;
Board of Directors and Senior acceptable practices for model development, implementation,
Management and use; appropriate model validation activities; and gover­
nance and controls over the model risk management process.
Model risk governance is provided at the highest level by the
board of directors and senior management when they establish Policies should emphasize testing and analysis, and promote
a bank-wide approach to model risk management. As part of the development of targets for model accuracy, standards for
their overall responsibilities, a bank's board and senior man­ acceptable levels of discrepancies, and procedures for review
agement should establish a strong model risk management of and response to unacceptable discrepancies. They should
framework that fits into the broader risk management of the include a description of the processes used to select and retain
organization. That framework should be grounded in an under­ vendor models, including the people who should be involved in
standing of model risk— not just for individual models but also such decisions.
in the aggregate. The framework should include standards for The prioritization, scope, and frequency of validation activities
model development, implementation, use, and validation. should be addressed in these policies. They should establish
While the board is ultimately responsible, it generally delegates standards for the extent of validation that should be performed
to senior management the responsibility for executing and before models are put into production and the scope of ongo­
maintaining an effective model risk management framework. ing validation. The policies should also detail the requirements
Duties of senior management include establishing adequate for validation of vendor models and third-party products. Finally,
policies and procedures and ensuring compliance, assigning they should require maintenance of detailed documentation of
competent staff, overseeing model development and implemen­ all aspects of the model risk management framework, including
tation, evaluating model results, ensuring effective challenge, an inventory of models in use, results of the modeling and vali­
reviewing validation and internal audit findings, and taking dation processes, and model issues and their resolution.
prompt remedial action when necessary. In the same manner
Policies should identify the roles and assign responsibilities
as for other major areas of risk, senior management, directly within the model risk management framework with clear detail
and through relevant committees, is responsible for regularly on staff expertise, authority, reporting lines, and continuity. They
reporting to the board on significant model risk, from individual should also outline controls on the use of external resources for
models and in the aggregate, and on compliance with policy. validation and compliance and specify how that work will be
Board members should ensure that the level of model risk is integrated into the model risk management framework.
within their tolerance and direct changes where appropriate.
These actions will set the tone for the whole organization about
the importance of model risk and the need for active model risk Roles and Responsibilities
management.
Conceptually, the roles in model risk management can be
divided among ownership, controls, and compliance. While
Policies and Procedures there are several ways in which banks can assign the responsi­
bilities associated with these roles, it is important that reporting
Consistent with good business practices and existing
lines and incentives be clear, with potential conflicts of interest
supervisory expectations, banks should formalize model risk
identified and addressed.
management activities with policies and the procedures to
implement them. Model risk management policies should be Business units are generally responsible for the model risk asso­
consistent with this guidance and also be commensurate with ciated with their business strategies. The role of model owner

Chapter 8 Supervisory Guidance on Model Risk Management ■ 149

involves ultimate accountability for model use and performance possess sufficient expertise in relevant modeling concepts as
within the framework set by bank policies and procedures. well as their use in particular business lines. If some internal
Model owners should be responsible for ensuring that models audit staff perform certain validation activities, then they should
are properly developed, implemented, and used. The model not be involved in the assessment of the overall model risk man­
owner should also ensure that models in use have undergone agement framework.
appropriate validation and approval processes, promptly identify
Internal audit should verify that acceptable policies are in place
new or changed models, and provide all necessary information
and that model owners and control groups comply with those
for validation activities.
policies. Internal audit should also verify records of model use
Model risk taken by business units should be controlled. The and validation to test whether validations are performed in a
responsibilities for risk controls may be assigned to individu­ timely manner and whether models are subject to controls that
als, committees, or a combination of the two, and include appropriately account for any weaknesses in validation activities.
risk measurement, limits, and monitoring. Other responsibili­ Accuracy and completeness of the model inventory should be
ties include managing the independent validation and review assessed. In addition, processes for establishing and monitor­
process to ensure that effective challenge takes place. Appropri­ ing limits on model usage should be evaluated. Internal audit
ate resources should be assigned for model validation and for should determine whether procedures for updating models are
guiding the scope and prioritization of work. Issues and prob­ clearly documented, and test whether those procedures are
lems identified through validation and other forms of oversight being carried out as specified. Internal audit should check that
should be communicated by risk-control staff to relevant individ­ model owners and control groups are meeting documentation
uals and business users throughout the organization, including standards, including risk reporting. Additionally, internal audit
senior management, with a plan for corrective action. Control should perform assessments of supporting operational systems
staff should have the authority to restrict the use of models and and evaluate the reliability of data used by models.
monitor any limits on model usage. While they may grant excep­
Internal audit also has an important role in ensuring that valida­
tions to typical procedures of model validation on a temporary
tion work is conducted properly and that appropriate effective
basis, that authority should be subject to other control mecha­
challenge is being carried out. It should evaluate the objectivity,
nisms, such as timelines for completing validation work and lim­
competence, and organizational standing of the key validation
its on model use.
participants, with the ultimate goal of ascertaining whether
Compliance with policies is an obligation of model owners and those participants have the right incentives to discover and
risk-control staff, and there should be specific processes in place report deficiencies. Internal audit should review validation activi­
to ensure that these roles are being carried out effectively and ties conducted by internal and external parties with the same
in line with policy. Documentation and tracking of activities rigor to see if those activities are being conducted in accor­
surrounding model development, implementation, use, and vali­ dance with this guidance.
dation are needed to provide a record that makes compliance
with policy transparent.
External Resources
Although model risk management is an internal process, a bank
Internal Audit may decide to engage external resources to help execute cer­
tain activities related to the model risk management framework.
A bank's internal audit function should assess the overall effec­
These activities could include model validation and review, com­
tiveness of the model risk management framework, including
pliance functions, or other activities in support of internal audit.
the framework's ability to address both types of model risk
These resources may provide added knowledge and another
described in Section III, for individual models and in the aggre­
level of critical and effective challenge, which may improve the
gate. Findings from internal audit related to models should be
internal model development and risk management processes.
documented and reported to the board or its appropriately
However, this potential benefit should be weighed against the
delegated agent. Banks should ensure that internal audit oper­
added costs for such resources and the added time that external
ates with the proper incentives, has appropriate skills, and has
parties require to understand internal data, systems, and other
adequate stature in the organization to assist in model risk
relevant bank-specific circumstances.
management. Internal audit's role is not to duplicate model risk
management activities. Instead, its role is to evaluate whether W henever external resources are used, the bank should specify
model risk management is comprehensive, rigorous, and effec­ the activities to be conducted in a clearly written and agreed-
tive. To accomplish this evaluation, internal audit staff should upon scope of work. A designated internal party from the bank

150 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
should be able to understand and evaluate the results of valida­ with policy transparent, and helps track recommendations,
tion and risk-control activities conducted by external resources. responses, and exceptions. Developers, users, control and
The internal party is responsible for: verifying that the agreed compliance units, and supervisors are all served by effective
upon scope of work has been completed; evaluating and documentation. Banks can benefit from advances in information
tracking identified issues and ensuring they are addressed; and and knowledge management systems and electronic documen­
making sure that completed work is incorporated into the bank's tation to improve the organization, timeliness, and accessibility
overall model risk management framework. If the external of the various records and reports produced in the model risk
resources are only utilized to do a portion of validation or com­ management process.
pliance work, the bank should coordinate internal resources to
Documentation takes time and effort, and model developers
complete the full range of work needed. The bank should have a
and users who know the models well may not appreciate its
contingency plan in case an external resource is no longer avail­
value. Banks should therefore provide incentives to produce
able or is unsatisfactory.
effective and complete model documentation. Model develop­
ers should have responsibility during model development for
thorough documentation, which should be kept up-to-date as
Model Inventory
the model and application environment changes. In addition,
Banks should maintain a comprehensive set of information for the bank should ensure that other participants in model risk
models implemented for use, under development for imple­ management activities document their work, including ongoing
mentation, or recently retired. While each line of business monitoring, process verification, benchmarking, and outcomes
may maintain its own inventory, a specific party should also be analysis. Also, line of business or other decision makers should
charged with maintaining a firm-wide inventory of all models, document information leading to selection of a given model and
which should assist a bank in evaluating its model risk in the its subsequent validation. For cases in which a bank uses models
aggregate. Any variation of a model that warrants a separate from a vendor or other third party, it should ensure that appro­
validation should be included as a separate model and cross- priate documentation of the third-party approach is available so
referenced with other variations. that the model can be appropriately validated.

W hile the inventory may contain varying levels of information, Validation reports should articulate model aspects that were
given different model com plexity and the bank's overall level reviewed, highlighting potential deficiencies over a range of
of model usage, the following are some general guidelines. financial and economic conditions, and determining whether
The inventory should describe the purpose and products adjustments or other compensating controls are warranted.
for which the model is designed, actual or expected usage, Effective validation reports include clear executive summaries,
and any restrictions on use. It is useful for the inventory to with a statement of model purpose and an accessible synopsis
list the type and source of inputs used by a given model and of model and validation results, including major limitations and
underlying components (which may include other models), as key assumptions.
well as model outputs and their intended use. It should also
indicate whether models are functioning properly, provide
a description of when they were last updated, and list any
CONCLUSION
exceptions to policy. O ther items include the names of individ­
uals responsible for various aspects of the model developm ent
This document has provided comprehensive guidance on effec­
and validation; the dates of com pleted and planned valida­
tive model risk management. Many of the activities described
tion activities; and the time frame during which the model is
in this document are common industry practice. But all banks
expected to remain valid.
should confirm that their practices conform to the principles in
this guidance for model development, implementation, and use,
as well as model validation. Banks should also ensure that they
Documentation
maintain strong governance and controls to help manage model
Without adequate documentation, model risk assessment and risk, including internal policies and procedures that appropri­
management will be ineffective. Documentation of model devel­ ately reflect the risk management principles described in this
opment and validation should be sufficiently detailed so that guidance. Details of model risk management practices may vary
parties unfamiliar with a model can understand how the model from bank to bank, as practical application of this guidance
operates, its limitations, and its key assumptions. Documenta­ should be commensurate with a bank's risk exposures, its busi­
tion provides for continuity of operations, makes compliance ness activities, and the extent and complexity of its model use.

Chapter 8 Supervisory Guidance on Model Risk Management ■ 151

Information Risk
and Data Quality
Management
Learning Objectives
After completing this reading you should be able to:

Identify the most common issues that result in data errors. Describe the operational data governance process, including
the use of scorecards in managing information risk.
Explain how a firm can set expectations for its data quality
and describe some key dimensions of data quality used in
this process.

E x c e rp t is C h a p ter 3 o f Risk Management in Finance: Six Sigma and Other Next Generation Techniques, by A n th on y Tarantino and
D eborah Cernauskas.
It would not be a stretch of the imagination to claim that Business Impacts of Poor Data Quality
most organizations today are heavily dependent on the use
of information to both run and im prove the ways that they Many data quality issues may occur within different business
achieve their business objectives. That being said, the reliance processes, and a data quality analysis process should incorpo­
on dependable information introduces risks to the ability of rate a business impact assessment to identify and prioritize risks.
a business to achieve its business goals, and this means that To simplify the analysis, the business impacts associated with
no enterprise risk management program is complete without data errors can be categorized within a classification scheme
instituting processes for assessing, measuring, reporting, intended to support the data quality analysis process and help
reacting to, and controlling the risks associated with poor data in distinguishing between data issues that lead to material busi­
quality. ness impact and those that do not. This classification scheme
defines six primary categories for assessing either the negative
However, the consideration of information as a fluid asset,
impacts incurred as a result of a flaw, or the potential opportuni­
created and used across many different operational and ana­
ties for improvement resulting from improved data quality:
lytic applications, makes it difficult to envision ways to assess
the risks related to data failures as well as ways to monitor 1. Financial impacts, such as increased operating costs,
conformance to business user expectations. This requires some decreased revenues, missed opportunities, reduction or
exploration into types of risks relating to the use of information, delays in cash flow, or increased penalties, fines, or other
ways to specify data quality expectations, and developing a data charges.
quality scorecard as a management tool for instituting data gov­ 2. Confidence-based impacts, such as decreased organiza­
ernance and data quality control. tional trust, low confidence in forecasting, inconsistent
In this chapter we look at the types of risks that are attributable operational and management reporting, and delayed or
to poor data quality as well as an approach to correlating improper decisions.
business impacts to data flaws. Data governance (DG) 3. Satisfaction impacts such as customer, employee, or sup­
processes can contribute to the description of data quality plier satisfaction, as well as general market satisfaction.
expectations and the definition of relevant metrics and
4. Productivity impacts such as increased workloads,
acceptability thresholds for monitoring conformance to those
decreased throughput, increased processing time, or
expectations. Combining the raw metrics scores with measured
decreased end-product quality.
staff performance in observing data service-level agreements
contributes to the creation of a data quality scorecard for 5. Risk impacts associated with credit assessment, investment

managing risks. risks, competitive risk, capital investment and/or develop­

ment, fraud, and leakage.

6 . Compliance is jeopardized, whether that compliance is with

9.1 ORGANIZATIONAL RISK, government regulations, industry expectations, or self-
BUSINESS IMPACTS, AND DATA imposed policies (such as privacy policies).

QUALITY Despite the natural tendency to focus on financial impacts, in

many environments the risk and compliance impacts are largely
If successful business operations rely on high-quality data, compromised by data quality issues. Some examples to which
then the opposite is likely to be true as w ell: flawed data financial institutions are particularly sensitive include:
will delay or obstruct the successful com pletion of business
• Anti-money laundering aspects of the Bank Secrecy Act and
processes. Determ ining the specific impacts that are related
the USA PATRIOT Act have mandated private organizations
to the different data issues that em erge is a challenging
to take steps in identifying and preventing money laundering
process, but assessing im pact is sim plified through the char­
activities that could be used in financing terrorist activities.
acterization of im pacts within a business im pact taxonom y.
Categories in this taxonom y relate to aspects of the busi­ • Sarbanes-Oxley, in which section 302 mandates that the
ness's financial, confidence, and com pliance activities, yet all principal executive officer or officers and the principal finan­
business im pact categories deal with enterprise risk. There cial officer or officers certify the accuracy and correctness of
are two aspects of looking at information and risk; the first financial reports.
looks at how flawed information im pacts organizational risk, • Basel II Accords provide guidelines for defining the regula­
while the other looks at the types of data failures that create tions as well as guiding the quantification of operational
the exposure. and credit risk as a way to determine the amount of capital

154 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 financial institutions are required to maintain as a guard Employee Fraud and Abuse
against those risks.
In 1997, the Departm ent of Defense Guidelines on Data
• The Gramm-Leach-Bliley Act of 1999 mandates financial
Quality categorized costs into four areas: prevention, appraisal,
institutions with the obligation to "respect the privacy of its
internal failure, and external failure. In turn, the impacts were
customers and to protect the security and confidentiality of
evaluated to assess costs to correct data problems as opposed
those customers' nonpublic personal information."
to costs incurred by ignoring them. Further assessment looked
• Credit risk assessment, which requires accurate documenta­
at direct costs (such as costs for appraisal, correction, or
tion to evaluate an individual's or organization's abilities to support) versus indirect costs (such as customer satisfaction).
repay loans. That report documents examples of how poor data quality
• System development risks associated with capital investment impacts specific business processes: " . . . the inability to match
in deploying new application systems emerge when moving payroll records to the official employment record can cost
those systems into production is delayed due to lack of trust millions in payroll overpayments to deserters, prisoners, and
in the application's underlying data assets. 'ghost' soldiers. In addition, the inability to correlate purchase

While the sources of these areas of risk differ, an interesting orders to invoices is a major problem in unmatched

similarity emerges: not only do these mandate the use or pre­ disbursem ents."1

sentation of high-quality information, they also require means of The 2006 Association of Certified Fraud Examiners Report to
demonstrating the adequacy of internal controls overseeing that the Nation1
2 details a number of methods that unethical
quality to external parties such as auditors. This means that not employees can use to modify existing data to commit fraudulent
only must financial institutions manage the quality of organiza­ payments. Invalid data is demonstrated to have significant busi­
tional information, they must also have governance processes in ness impacts, and the report details median costs associated
place that are transparent and auditable. with these different types of improper disbursements.

Information Flaws
Underbilling and Revenue Assurance
The root causes for the business impacts are related to flaws in
the critical data elements upon which the successful comple­ NTL, a cable operator in the United Kingdom, anticipated

tion of the business processes depend. There are many types of business benefits in improving the efficiency and value of an

erred data, although these common issues lead to increased risk: operator's network through data quality improvement. Invalid
data translated into discrepancies between services provided
• Data entry errors
and services invoiced, resulting in a waste of unknown excess
• Missing data capacity. Their data quality improvement program was, to some
• Duplicate records extent, self-funded through the analysis of "revenue assurance
to detect under billing. For example, . . . results indicated leak­
• Inconsistent data
age of just over 3 percent of total revenue."3
• Nonstandard formats
• Com plex data transformations
• Failed identity management processes
Credit Risk
• Undocumented, incorrect, or misleading metadata In 2002, a PricewaterhouseCoopers study on credit risk data
indicated that a significant percentage of the top banks were
All of these types of errors can lead to inconsistent report­
deficient in credit risk data management, especially in the areas
ing, inaccurate aggregation, invalid data mappings, incorrect
product pricing, and failures in trade settlement, among other
process failures. 1 U.S. Dept, of Defense, "DoD Guidelines on Data Quality Manage­
ment," 1997, accessible via www.tricare.mil/ocfo/_docs/DoDGuidelines

9.2 EXAMPLES OnDataQualityManagement.pdf.

2 "2006 ACFE Report to the Nation on Occupational Fraud and Abuse,"
www.acfe.com/documents/2006-rttn. pdf.
The general approach to correlating business impacts to data
quality issues is not new, and in fact there are some interest­ 3 Herbert, Brian, "Data Quality Management—A Key to Operator
Profitability," Billing and OSS World, March 2006, accessible at www
ing examples that demonstrate different types of risks that are .billingworld.com/articles/feature/Data-Quality-Management-A-Key-to-
attributable to flaws (both inadvertent and deliberate) in data. Operator.html.

Chapter 9 Information Risk and Data Quality Management ■ 155

of counterparty data repositories, counterparty hierarchy data, exposed the organization to potential violation of the Anti-
common counterparty identifiers, and consistent data Kickback Statute.
standards.4

9.3 DATA QUALITY EXPECTATIONS

Insurance Exposure
These examples are not unique, but instead demonstrate pat­
A 2008 Ernst & Young survey on catastrophe exposure data terns that commonly emerge across all types of organizations.
quality highlighted that "shortcomings in exposure data quality Knowledge of the business impacts related to data quality issues
are common," and that "not many insurers are doing enough to is the catalyst to instituting data governance practices that can
correct these shortcomings," which included missing or inaccu­ oversee the control and assurance of data validity. The first step
rate values associated with insured values, locations, building toward managing the risks associated with the introduction of
class, occupancy class, as well as additional characteristics.5 flawed data into the environment is articulating the business user
expectations for data quality and asserting specifications that can
be used to monitor organizational conformance to those expec­
Development Risk
tations. These expectations are defined in the context of "data
Experience with our clients has indicated a common pattern in quality dimensions," high-level categorizations of assertions that
which significant investment in capital acquisitions and accom­ lend themselves to quantification, measurement, and reporting.
panying software development has been made in the creation of
The intention is to provide an ability to characterize business
new business application systems, yet the deployment of those
user expectations in terms of acceptability thresholds applied
systems is delayed (or perhaps even canceled) due to organiza­
to quantifiers for data quality that are correlated to the different
tional mistrust of the application data. Such delayed application
types of business impacts, particularly the different types of risk.
development puts investments at risk.
And although the academic literature in data quality enumerates
many different dimensions of data quality, an initial develop­
Compliance Risk ment of a data quality scorecard can rely on a subset of those
dimensions, namely, accuracy, completeness, consistency, rea­
Pharmaceutical companies are bound to abide by the federal sonableness, currency, and identifiability.
Anti-Kickback Statute, which restricts companies from offering or
paying remuneration in return for arranging for the furnishing of
items or services for which payment may be made under Medicare
Accuracy
or a state health care program. Pharmaceutical companies fund The dimension of accuracy measures the degree with which data
research using their developed products as well as market those instances compare to the "real-life" entities they are intended to
same products to potentially the same pool of practitioners and model. Often, accuracy is measured in terms of agreement with
providers, so there is a need for stringent control and segregation an identified reference source of correct information such as a
of the data associated with both research grants and marketing. "system of record," a similar corroborative set of data values

Our experience with some of our clients has shown that an from another table, comparisons with dynamically computed

assessm ent of party information contained within master values, or the results of manually checking value accuracy.

data sets indicated some providers within the same practice

working under research grants while others within the same Completeness
practice subjected to marketing. Despite the fact that no
The completeness dimension specifies the expectations regarding
individual appeared within both sets of data, the fact that
the population of data attributes. Completeness expectations can
individuals rolled up within the same organizational hierarchy
be measured using rules relating to varying levels of constraint—
mandatory attributes that require a value, data elements with
conditionally optional values, and inapplicable attribute values.
4 Inserro, Richard J., "Credit Risk Data Challenges Underlying the New
Basel Capital Accord," RMA Journal, April 2002, accessible at www.pwc
.com/tr/eng/about/svcs/abas/frm/creditrisk/articles/pwc_baselcreditdata- Consistency
rma.pdf.
Consistency refers to measuring reasonable comparison of
5 Ernst & Young, "Raising the Bar on Catastrophe Data," 2008, acces­
sible via www.ey.com/Global/assets.nsf/US/Actuarial_Raising_the_bar_ values in one data set to those in another data. Consistency is
catastrophe_data/$file/Actuarial_Raising_the_bar_catastrophe_data.pdf. relatively broad, and can encompass an expectation that two

156 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
data values drawn from separate data sets must not conflict The principal concept is that the selected dimensions character­
with each other, or define more complex comparators with a set ize aspects of the business user expectations and that they can
of predefined constraints. More formal consistency constraints be quantified using a reasonable measurement process.
can be encapsulated as a set of rules that specify relationships
between values of attributes, either across a record or message,
9.4 MAPPING BUSINESS POLICIES
or along all values of a single attribute.
TO DATA RULES
However, be careful not to confuse consistency with accuracy
or correctness. Consistency may be defined between one set of Having identified the dimensions of data quality that are relevant
attribute values and another attribute set within the same record to the business processes, we can map the information policies
(record-level consistency), between one set of attribute values and their corresponding business rules to those dimensions. For
and another attribute set in different records (cross-record con­ example, consider a business policy that specifies that personal
sistency), or between one set of attribute values and the same data collected over the web may be shared only if the user has
attribute set within the same record at different points in time not opted out of that sharing process. This business policy defines
(temporal consistency). information policies: the data model must have a data attribute
specifying whether a user has opted out of information sharing,
Reasonableness and that attribute must be checked before any records may be
shared. This also provides us with a measurable metric: the count
This dimension is used to measure conformance to consistency
of shared records for those users who have opted out of sharing.
expectations relevant within specific operational contexts. For
example, one might expect that the total sales value of all the The same successive refinement can be applied to almost every
transactions each day is not expected to exceed 105 percent of business policy and its corresponding information policies. As
the running average total sales for the previous 30 days. we distill out the information requirements, we also capture
assertions about the business user expectations for the result

Currency of the operational processes. Many of these assertions can be

expressed as rules for determining whether a record does or
This dimension measures the degree to which information is cur­ does not conform to the expectations. The assertion is a quanti­
rent with the world that it models. Currency measures whether fiable measurement when it results in a count of nonconforming
data is considered to be "fresh," and its correctness in the face records, and therefore monitoring data against that assertion
of possible time-related changes. Data currency may be mea­ provides the necessary data control.
sured as a function of the expected frequency rate at which
Once we have reviewed methods for inspecting and measuring
different data elements are expected to be refreshed, as well
against those dimensions in a quantifiable manner, the next step
as verifying that the data is up to date. Currency rules may be
is to interview the business users to determine the acceptability
defined to assert the "lifetim e" of a data value before it needs
thresholds. Scoring below the acceptability threshold indi­
to be checked and possibly refreshed.
cates that the data does not meet business expectations, and
highlights the boundary at which noncompliance with expecta­
Uniqueness tions may lead to material impact to the downstream business
This dimension measures the number of inadvertent duplicate functions. Integrating these thresholds with the methods for
records that exist within a data set or across data sets. Asserting measurement completes the construction of the data quality
uniqueness of the entities within a data set implies that no entity control. Missing the desired threshold will trigger a data quality
exists more than once within the data set and that there is a key event, notifying the data steward and possibly even recom­
that can be used to uniquely access each entity (and only that mending specific actions for mitigating the discovered issue.
specific entity) within the data set.
9.5 DATA QUALITY INSPECTION,
Other Dimensions of Data Quality CONTROL, AND OVERSIGHT:
This list is by no means complete— there are many other aspects OPERATIONAL DATA GOVERNANCE
of expressing the expectations for data quality, such as semantic
consistency (dealing with the consistency of meanings of data In this section we highlight the relationship between data issues
elements), structural format conformance, timeliness, and valid and their downstream impacts, and note that being able to con­
ranges, valid within defined data domains, among many others. trol the quality of data throughout the information processing

Chapter 9 Information Risk and Data Quality Management ■ 157

flow will enable immediate assessment, initiation of remediation, of noncompliant data as indicated by the business clients and
and an audit trail demonstrating the levels of data quality as well the defined thresholds for data quality acceptability. The degree
as the governance processes intended to ensure data quality. of acceptability becomes the standard against which the data is
measured, with operational data governance instituted within
O perational data governance is the manifestation of the pro­
the context of measuring performance in relation to the data
cesses and protocols necessary to ensure that an acceptable level
governance procedures. This measurement essentially covers
of confidence in the data effectively satisfies the organization's
conformance to the defined standards, as well as monitoring
business needs. A data governance program defines the roles,
staff agility in taking specific actions when the data sets do not
responsibilities, and accountabilities associated with managing
conform. Given the set of data quality rules, methods for mea­
data quality. Rewarding those individuals who are successful at
suring conformance, the acceptability thresholds defined by the
their roles and responsibilities can ensure the success of the data
business clients, and the SLAs, we can monitor data governance
governance program. To measure this, a "data quality scorecard"
by observing not only compliance of the data to the business
provides an effective management tool for monitoring organiza­
rules, but of the data stewards to observing the processes asso­
tional performance with respect to data quality control.
ciated with data risks and failures.
Operational data governance combines the ability to identify data
The dimensions of data quality provide a framework for defin­
errors as early as possible with the process of initiating the activi­
ing metrics that are relevant within the business context while
ties necessary to address those errors to avoid or minimize any
providing a view into controllable aspects of data quality man­
downstream impacts. This essentially includes notifying the right
agement. The degree of reportability and controllability may
individuals to address the issue and determining if the issue can
differ depending on one's role within the organization, and cor­
be resolved appropriately within an agreed-to time frame. Data
respondingly, so will the level of detail reported in a data quality
inspection processes are instituted to measure and monitor compli­
scorecard. Data stewards may focus on continuous monitoring in
ance with data quality rules, while service-level agreements (SLAs)
order to resolve issues according to defined SLAs, while senior
specify the reasonable expectations for response and remediation.
managers may be interested in observing the degree to which
Note that data quality inspection differs from data validation. poor data quality introduces enterprise risk.
While the data validation process reviews and measures confor­
Essentially, the need to present higher-level data quality scores
mance of data with a set of defined business rules, inspection is
introduces a distinction between two types of metrics. The
an ongoing process to:
simple metrics based on measuring against defined dimen­
• Reduce the number of errors to a reasonable and manage­ sions of data quality can be referred to as "base-level" metrics,
able level. and they quantify specific observance of acceptable levels of
• Enable the identification of data flaws along with a protocol defined data quality rules. A higher-level concept would be the
for interactively making adjustments to enable the comple­ "com plex" metric representing a rolled-up score computed as
tion of the processing stream. a function (such as a sum) of applying specific weights to a col­
• Institute a mitigation or remediation of the root cause within lection of existing metrics, both base-level and complex. The
an agreed-to time frame. rolled-up metric provides a qualitative overview of how data
quality impacts the organization in different ways, since the
The value of data quality inspection as part of operational data
scorecard can be populated with metrics rolled up across dif­
governance is in establishing trust on behalf of downstream
ferent dimensions depending on the audience. Com plex data
users that any issue likely to cause a significant business impact
quality metrics can be accumulated for reporting in a scorecard
is caught early enough to avoid any significant impact on
in one of three different views: by issue, by business process,
operations. Without this inspection process, poor-quality data
or by business impact.
pervades every system, complicating practically any operational
or analytical process.
Data Quality Issues View
9.6 MANAGING INFORMATION RISK Evaluating the impacts of a specific data quality issue across
VIA A DATA QUALITY SCORECARD multiple business processes demonstrates the diffusion of
pain across the enterprise caused by specific data flaws. This
While there are practices in place for measuring and monitoring scorecard scheme, which is suited to data analysts attempt­
certain aspects of organizational data quality, there is an oppor­ ing to prioritize tasks for diagnosis and remediation, provides
tunity to evaluate the relationship between the business impacts a rolled-up view of the impacts attributed to each data issue.

158 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Drilling down through this view sheds light on the root causes of is employed, each is supported by describing, defining, and
impacts of poor data quality, as well as identifying "rogue pro­ managing base-level and complex metrics such that:
cesses" that require greater focus for instituting monitoring and
• Scorecards reflecting business relevance are driven by a hier­
control processes.
archical rollup of metrics.
• The definition of metrics is separated from its contextual
Business Process View use, thereby allowing the same measurement to be used in
different contexts with different acceptability thresholds and
Operational managers overseeing business processes may be
weights.
interested in a scorecard view by business process. In this view,
the operational manager can examine the risks and failures • The appropriate level of presentation can be materialized
preventing the business process's achievement of the expected based on the level of detail expected for the data consumer's
results. For each business process, this scorecard scheme con­ specific data governance role and accountability.
sists of complex metrics representing the impacts associated
with each issue. The drill-down in this view can be used for
isolating the source of the introduction of data issues at specific SUMMARY
stages of the business process as well as informing the data
Scorecards are effective management tools when they can sum­
stewards in diagnosis and remediation.
marize important organizational knowledge as well as alerting
the appropriate staff members when diagnostic or remedial
Business Impact View actions need to be taken. Part of an information risk manage­
ment program would incorporate a data quality scorecard that
Business impacts may have been incurred as a result of a num­
supports an organizational data governance program; this
ber of different data quality issues originating in a number of
program is based on defining metrics within a business context
different business processes. This reporting scheme displays
that correlate the metric score to acceptable levels of business
the aggregation of business impacts rolled up from the dif­
performance. This means that the metrics should reflect the
ferent issues across different process flows. For example, one
business processes' (and applications') dependence on accept­
scorecard could report rolled-up metrics documenting the accu­
able data, and that the data quality rules being observed and
mulated impacts associated with credit risk, compliance with
monitored as part of the governance program are aligned with
privacy protection, and decreased sales. Drilling down through
the achievement of business goals.
the metrics will point to the business processes from which the
issues originate; deeper review will point to the specific issues These processes simplify the approach to evaluating risks to
within each of the business processes. This view is suited to a achievement of business objectives, how those risks are associated
more senior manager seeking a high-level overview of the risks with poor data quality and how one can define metrics that cap­
associated with data quality issues, and how that risk is intro­ ture data quality expectations and acceptability thresholds. The
duced across the enterprise. impact taxonomy can be used to narrow the scope of describing
the business impacts, while the dimensions of data quality guide
the analyst in defining quantifiable measures that can be cor­
Managing Scorecard Views
related to business impacts. Applying these processes will result
Essentially, each of these views composing a data quality score- in a set of metrics that can be combined into different scorecard
card require the construction and management of a hierarchy of schemes that effectively address senior-level manager, operational
metrics related to various levels of accountability for support the manager, and data steward responsibilities to monitor information
organization's business objectives. But no matter which scheme risk as well as support organizational data governance.

Chapter 9 Information Risk and Data Quality Management ■ 159

Validating Rating
Models
Learning Objectives
After completing this reading you should be able to:

Explain the process of model validation and describe best Describe challenges related to data quality and explain
practices for the roles of internal organizational units in steps that can be taken to validate a model's data quality.
the validation process.
Explain how to validate the calibration and the
Compare qualitative and quantitative processes for discriminatory power of a rating model.
validating internal ratings and describe elements of each
process.

E x c e rp t is C h a p ter 5 o f Developing, Validating and Using Internal Ratings: Methodologies and Case Studies, by G iacom o De
Laurentis, Renato M aino and Luca M olteni.

S e e bibliography on p p . 421-423.

161
10.1 VALIDATION PROFILES and qualitative validation should be correlated with the type of
credit portfolios examined, the overall complexity of the bank,
Ratings systems validation scopes and steps are presented in and the stability of markets.
this chapter. As a rating system 'comprises all of the methods, Rating systems must undergo a validation process consisting of
processes, controls, and data collection and IT systems that sup­ a set of formal activities, instruments, and procedures for assess­
port the assessment of credit risk, the assignment of internal ing the accuracy of the estimates of all material risk components
risk ratings, and the quantification of default and loss estimates' and the predictive power of the overall performance system.
(Basel Committee, 2004, §394), it is clear that the validation The Basel II regulation states that: 'The institution shall have a
scope is quite wide. regular cycle of model validation that includes monitoring of
The validation of internal ratings is strictly required by the Basel model performance and stability, review of model relationships,
Committee (2004, §530) for banks willing to opt for Internal Rat­ and testing of model outputs against outcomes.' (Basel Commit­
ing Based (IRB) approaches: 'banks must have a robust system in tee, 2004, §417). However, the same regulation underlines that
place to validate the accuracy and consistency of their internal the validation process lies not only on statistical comparisons of
models and modeling processes. A bank must demonstrate actual risk measures against the ex ante estimates, checking of
to its supervisor that the internal validation process enables it parameter calibrations, benchmarking and stress tests, but also
to assess the performance of its internal model and processes involves analyses of all the components of the internal rating
consistently and meaningfully'. However, the validation of an system, including operational processes, controls, documenta­
internal rating system is critical to the validation of the whole tion, IT infrastructure, as well as an assessment of their overall
credit risk management system of a bank, both from a regulatory consistency. Therefore, validation also requires the assessment
point of view and from a business management point of view. of the model development process, with particular reference to
the underlying logical structure and the methodological criteria
It is crucial to the former perspective because capital adequacy
supporting the risk parameter estimates.
depends on rating systems for banks adopting Internal Rat­
ing Based Approaches according to the Basel II regulation (the Validation includes, too, the critical verification that the rat­
use of IRB approaches for the purposes of calculating capital ing system is actually used (and how) in the various areas of
requirements is subject to an explicit approval by national super­ bank operations. This is known as the 'use test', also required
visory authorities and follows a 'supervisory validation' of rating by Basel II and better specified in Basel Committee (2006).
systems). In addition, it is critical because Pillar 2 of Basel II is The results of the validation process need to be adequately
focused on the adequacy of risk management systems in order documented and periodically submitted to the internal control
to safely and rationally manage the bank. It is also critical from functions and the governing bodies. The reports shall specifi­
the latter perspective because key decisions concerning indi­ cally address any problem areas.
vidual loans underwriting decisions as well as credit portfolio Figure 10.1 gives an overview of the essential steps of rating
management decisions depend on rating systems. systems validation.
Therefore, the difference in scope of 'regulatory validation' and
of 'internal validation' is more apparent than real. In addition,
consider that in order to be validated for regulatory purposes,
a system has to be previously internally validated; on top of
that, the technical contents of validation processes are very
similar in both cases. These are reasons why we are going to use
almost indifferent regulatory requirements as internal validation
requirements.

On an ongoing basis, in the validation process, the bank has to

verify the reliability of the results generated by the rating system
and its continued consistency with regulatory requirements and
operational needs. The validation instruments and methods are
periodically reviewed also, and adjusted and updated to ensure
that they remain appropriate in a context of continually evolv­
ing market variables and operating conditions. According to the
'proportionality principle', the scope and depth of quantitative validation p ro ce ss.

162 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
In summary, the validation process has the key role of reviewing In performing these tasks, senior management must consider
model building steps and application choices, detecting weak­ recommendations produced by the validation process and
nesses and limitations, verifying the proper use of the system, review reports produced by the internal audit unit.
and last, but not least, analyzing contingent solutions planned
The validation process is performed by a specific organi­
in case the robustness of the model falls or is lacking. Best
zational unit that may partially leverage on the support of
practices have to be monitored to minimize misalignments of
operational units in performing its activities. In smaller banks,
the whole process of internal credit risk management.
the least that is needed is the appointm ent of a manager
devoted to coordinate and oversee these activities.
10.2 ROLES OF INTERNAL
To perform these tasks, the validation unit has to be inde­
VALIDATION UNITS pendent of other functions devoted to develop and to main­
tain model tools and to handle credit risk processes and
The Basel II regulation is particularly innovative in terms of
procedures. It is advisable that the validation unit is also inde­
organizational requirements and internal controls. The rules lay
pendent from those involved in assigning ratings and lending.
down essential notions and criteria that banks must adopt in
Specifically, persons in charge of the function should not be
developing their rating systems. They also set down the orga­
subordinate to persons responsible for such activities.
nizational and quantitative requirements banks must comply
with for recognition of their methods for capital adequacy pur­ Specific attention has to be paid to ensure the appropriate skills
poses. The organizational requirements set rules which govern of human resources employed.
organization and controls, internal validation of rating systems,
Where compliance with this requirement would prove to be
characteristics of rating systems (e.g ., replicability, integrity,
excessively burdensome, the validation unit may be involved in
and consistency), their use in operations (use test), informa­
the rating system design and development process, provided
tion systems and data flows. The quantitative requirements
that appropriate organizational and procedural, precautions
regard the structure of rating systems, the determination of
are adopted and respected. In such a case, the internal audit
risk param eters, stress tests, and the use of models developed
function should verify that these activities are performed in an
by third-party vendors.
independent manner, fully achieving the intended objectives.
Specific requirements are set for the senior management and The validation unit should also be independent from the inter­
those who have roles in corporate governance and oversight. nal audit function, which should review the validation process
'All material aspects of the rating and estimation processes and findings.
must be approved by the bank's board of directors or a des­ In short, validation and control processes and organizational
ignated committee thereof and senior management. These roles involved are depicted in Table 10.1.
parties must possess a general understanding of the bank's risk
rating system and detailed comprehension of its associated Also, the internal audit function is deeply involved in validation
management reports. Senior management must provide notice processes, including the continued analysis of the com pli­
to the board of directors or a designated committee thereof of ance in the use of rating systems with internal and regulatory
material changes or exceptions from established policies that requirements. In particular, it is necessary to audit the inde­
will materially impact the operations of the bank's rating sys­ pendence of the validation unit and the quality of resources
tem ' (Basel Com m ittee, 2004, §438). involved.

'Senior management also must have a good understanding of Validation is mostly performed on the basis of the documenta­
the rating system's design and operation, and must approve tion received by functions in charge of the model development
material differences between established procedure and actual and implementation in banks' credit processes. Therefore, the
practice. Management must also ensure, on an ongoing basis, scope, transparency, and completeness of documentation are
that the rating system is operating properly. Management essential; these characteristics are important validation criteria.
and staff in the credit control function must meet regularly to Banking groups with significant cross-border operations may
discuss the performance of the rating process, areas needing have different organizational structures in different countries.
improvement, and the status of efforts to improve previously Nevertheless, in all cases the parent company has to ensure
identified deficiencies' (Basel Com m ittee, 2004, §439). Inter­ that the organization of the validation and review functions
nal ratings must also be an essential part of the reporting to within the group enable the unified management and control of
these parties. models and rating systems.

Chapter 10 Validating Rating Models ■ 163

Table 10.1 P ro ce sse s and R oles of V alidation and C o n tro l of Internal Rating S ystem s

Models Procedures Tools Management Decision

Basic Controls Task: model develop­ Task: credit Task: operations Task: lending policy
ment and back testing risk procedures maintenance applications
Owner: credit risk maintenance Owner: lending units/ Owner: central and
models development Owner: lending units/ IT/internal audit decentralized units/
unit internal control units internal control units

Second controls layer Task: continuous test of Task: lending policy

models/processes/tools suitability
performance Owner: validation unit/
Owner: lending unit/ internal audit
internal audit

Third controls layer Risk management/CRO Organisation/COO Lending unit/CLO /CO O Lending unit/CLO/CRO

Accountability for Top management/Surveillance board/Board of directors

supervisory purposes

CRO: Credit Risk Officer; CLO: Chief Lending Officer; COO: Chief Operating Officer; IT: Information Technology Department.

10.3 QUALITATIVE AND rating approach for specific rating segments has to be assessed.
A number of other areas must be investigated:
QUANTITATIVE VALIDATION
• consistency of model development processes and
There are two main areas of validation: qualitative and quanti­ methodologies,
tative. Qualitative validation ensures the proper application of
• adequate calibration of model output to default probabilities,
quantitative methods and the proper usage of ratings. Quanti­
• proper documentation of all model functions,
tative validation comprises all validation procedures of ratings
in which statistical indicators are calculated and interpreted on • analytical description of the rating process, with duties and
the basis of an empirical dataset. In recent years, many books responsibilities of key personnel,
and articles have dealt with this topic, included among which • the robust procedures in place for validation and regular review.
are Engelmann and Rauhmeier (2006) and Christodoulakis and
In addition, there are important organizational profiles of rating
Satchell (2008).
systems' qualitative validation; they concern the link between
Qualitative and quantitative validation complement each other. the model, process, procedures, approval powers, and con­
A rating procedure should only be applied in practice if it trols. Even the best model does not produce the expected
receives a positive assessment in the qualitative area. A positive added value to bank lending if it is misunderstood or if it is not
assessment by the quantitative validation is not sufficient p e r adequately supported in daily applications. In this perspective,
se. Conversely, a negative quantitative assessment should not adequate education, clear procedures, proper guidelines, and
be considered decisive because statistical estimates are subject support in tackling exceptions are fundamental. The assessment
to random fluctuations and a certain degree of tolerance in the of the actual use of rating systems in credit approval processes
interpretation of results should be allowed. It is, therefore, nec­ is a key component of qualitative validation. In fact, the model
essary to place emphasis on qualitative validation. must not only be a formal requirement for capital adequacy
purposes or portfolio decisions; it must be fully integrated in
the decision making process concerning single loans. If the bank
Qualitative Validation
credit culture does not accept the new model-based rating
Rating Systems Design assignment processes, the risk of having two different processes
(one being formal but inactive and the other informal but used
Rating systems design concerns the proper choice of the models
in daily lending decisions) is very high. The validation has to
architecture in relationship to the market segments in which the
detect these situations and suggest how to overcome them.
model is going to be used. It is necessary to ensure the trans­
parency of the assumptions and/or evaluations which form the In the earlier stages of rating systems development in a bank, it
basis of the rating models design. The general suitability of a commonly happens that credit risk functions spend a lot of time

164 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
on model building, number crunching, statistical testing, and so model in order to increase the completeness of the relevant risk
on. Procedural aspects are underestimated in terms of the time, factors should be verified. Usually, the computer-based pro­
resources, and investments needed, as they are erroneously cessing of information enables expert systems and fuzzy logic
considered less problematic and easier to overcome. Since these systems to take a larger number of characteristics into consider­
early stages, the role of the validation unit in detecting the orga­ ation, meaning that such systems can be more comprehensive if
nizational readiness to accept and to correctly apply the new properly modeled.
rating system is essential. The validation unit should have great
Rating sy ste m o b je ctiv ity A good rating system needs pro­
visibility to top management and should lever on it in order to
cedures that capture creditworthiness factors clearly and also
ask enough resources to properly take off the new process.
minimize room for interpretation. Achieving high discriminatory
The essential requirements of rating systems that need to be power of ratings requires that they are assigned as objectively
checked in qualitative validation can be summarized in the fol­ as possible, minimizing biases. In judgment-based approaches
lowing five main features: this can only be ensured by precise and plausible guidelines,
common cultural backgrounds, appropriate training, ongoing
• obtaining probabilities of default benchmarking, and adequate organizational choices (team work,
• completeness supervision, balancing individual analysts' specialization by sec­
• objectivity tor, and analysts' teams' cross-sector mix). In statistical models,
borrowers' characteristics are selected and weighed using an
• acceptance
empirical dataset and objective methods; therefore, we can
• consistency.
regard these models as the most 'objective' rating procedures.
O btaining probabilities o f default Ratings are the basis for When the model is fed by the same information, unavoidably
almost all risk management applications once they have been the same results are obtained. This is also the case for expert
quantified and probabilities of default have been obtained. In systems and neural networks, where borrowers' creditworthiness
this perspective, different methods of rating assignment pro­ is determined using defined algorithms and rules.
duce PDs in distinctive ways. Statistical models are developed Rating sy ste m a ccep ta n ce Rating systems have also to be
on the basis of an empirical dataset, which makes it possible accepted by users, above all, internal users such as credit ana­
to determine the PD for individual rating classes by calibrat­ lysts, credit officers, and loan officers. Therefore, some require­
ing results with the empirical data. Logistic regression enables ments are necessary:
the direct calculation of default probabilities, while for other
a. The rating system should not produce classifications that
methods (e.g., discriminant analysis) a specific adjustment is
are very often too far from those expected by bank analysts
needed. Likewise, it is possible to validate the calibration of the
and officers;
rating model (ex p o st) using data gathered from the operational
deployment of the model. Using this data, the default param­ b. For small and medium enterprises, mechanical rating mod­
eter can be constantly monitored and validated over time to els often have higher discriminatory power than a poorly
maintain PDs aligned with real world outcomes. structured judgment-based approach developed by poorly
experienced and trained credit officers. However, they
Rating sy ste m co m p le te n e ss Completeness is the next impor­ are less easily accepted because many actors do not have
tant feature of an internal rating system. In order to ensure enough technical knowledge to understand them. Hence,
the completeness of credit rating procedures, banks need to an adequate education and level of disclosure on model
take all available information into account when assigning rat­ frameworks for all actors involved in the lending process are
ings to borrowers or transactions (Basel Committee, 2004, indispensable.
§417). The nature of the chosen rating assignment approach
Therefore, the validation process has to verify that rating models
strongly impacts on this feature. Many default risk models use
are well understood and shared by the users.
a small number of characteristics of the borrower to infer its
creditworthiness. For this reason, it is important to verify the Different rating approaches have different degrees of acceptabil­
completeness of factors used to determine a counterpart's ity. Generally speaking, as heuristic models are designed on the
creditworthiness, at least in model building stages and/or in the basis of experts' experience in lending, these models are more
operational use (for instance, analyzing the scope of overrides easily accepted; their credit assessments are considered warmer
proposed by a credit analyst). In the estimation of statistical- by end-users because they replicate their common culture. The
based models, as a large number of borrowers' characteristics acceptance of fuzzy logic systems may be lower as they require
can be tested, the possibility to force variables to enter into the a greater degree of technical knowledge due to their fuzzy

Chapter 10 Validating Rating Models ■ 165

algorithms and changing variables' weights in different con­ that the data used to build the model are representative of the
texts. One severe disadvantage for the acceptance of artificial population of the bank's actual borrowers or facilities. When
neural networks lies in their 'black box' nature. The increase in combining model results with human judgem ent, judgements
discriminatory power achieved by such methods depends on the must take into account all relevant and material information not
network's ability to learn and on the parallel processing of infor­ considered by the model. The bank must have written guidance
mation within the network. However, it is precisely this com plex­ describing how human judgem ent and model results are to be
ity which makes it difficult to comprehend results. combined. The bank must have procedures for human review of
model based rating assignments. Such procedures should focus
R a tin g s y s te m c o n s is te n c y Consistency is the last but not
on finding and limiting errors associated with known model
least feature. Models have to be coherent and suitable for the
weaknesses and must also include credible ongoing efforts to
borrowers to which they are applied and with the theoretical
improve the model's performance . . . The influence of individual
frameworks of users. When developing a statistical rating model,
factors on rating results should be comprehensible and in line
relationships between indicators may arise which contradict eco­
with the current business research and practice. For example, if
nomic theory. Such contradictory indicators have to be excluded
a multivariate statistical method is applied, factors in a statistical
from further analyses; filtering out these problematic indicators
ratio analysis have to be plausible and comprehensible, accord­
serves to ensure consistency. Heuristic models do not contradict
ing to the fundamentals of financial statement analysis and the
recognized scientific theories and methods, as these models are
economic theory of the firm.'
based on the experience and observations of credit experts.
Pure statistical models depict business inter-relationships directly Therefore, in Paragraph 417 of the Basel II regulation, all five
from empirical datasets and consistency should be checked. essential requirements (obtaining probabilities of default, com­
pleteness, objectivity, acceptance, consistency) for a satisfactory
The Basel II regulation states specific validation requirements
rating system have been detailed.
in case statistical models and other mechanical methods are
used to assign borrower or facility ratings or in estimation of The same Basel II paragraph indicates two other important
PDs, LGDs, or EADs (Basel Committee, 2004, §417). First of all, aspects of validation processes, that is to say, the continuity of
it is recognized that 'Although mechanical rating procedures validation processes and the completeness of documentation:
may sometimes avoid some of the idiosyncratic errors made by 'The bank must have a regular cycle of model validation that
rating systems in which human judgement plays a large role, includes monitoring of model performance and stability; review
mechanical use of limited information also is a source of rating of model relationships; and testing of model outputs against
errors. Credit scoring models and other mechanical procedures outcomes . . . In statistical models, special emphasis is to be
are permissible as the primary or partial basis of rating assign­ placed on documenting the models statistical foundations, which
ments, and may play a role in the estimation of loss charac­ have to be in line with the standards of quantitative validation.'
teristics. Sufficient human judgem ent and human oversight is
In examining all these features, the validation unit also has to
necessary to ensure that all relevant and material information,
take carefully into account external benchmarks, such as special­
including that which is outside the scope of the model, is also
ist literature and competitors application. The rating system is
taken into consideration, and that the model is used appropri­
a decisional tool and can dramatically harm the bank's ability
ately'. This means that models must be part of a broader rating
to compete if it is not aligned with those used by direct incum­
system, in which other methodologies add further information
bents in the market.
and expertise assuring completeness.

Other requirements of §417 are as follows: 'the burden is on D ata Quality

the bank to satisfy its supervisor that a model or procedure has In statistical models, data quality is essential. Good data give
good predictive power and that regulatory capital requirements outstanding results also using simple models, whereas the most
will not be distorted as a result of its use. The variables that are advanced models cannot overcome poor data quality. There­
input to the model must form a reasonable set of predictors. fore, a comprehensive dataset is an essential prerequisite for
The model must be accurate on average across the range of quantitative validation. In this context, a number of qualitative
borrowers or facilities to which the bank is exposed and there aspects have to be considered:
must be no known material biases. The bank must have in place
• completeness of data,
a process for vetting data inputs into a statistical default or loss
prediction model which includes an assessment of the accuracy, • volume of available data,

completeness and appropriateness of the data specific to the • representativeness of samples used for model development
assignment of an approved rating. The bank must demonstrate and validation,

166 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• consistency and integrity of data sources,
• adequacy of procedures used to ensure data cleansing and,
in general, data quality.

The validation unit has a central role in confirming the dataset

quality.

Particularly relevant are the reliability and completeness of

defaulted observations because these are the actual limit to
develop adequately large datasets for model development,
rating quantification, and validation. The consistency of default
definition used throughout data collection processes (that per­ Fiqure 10.2 From sam p le s to m arket p o p u latio n :
haps take place in different institution of a bank group, in dif­ data relatio n sh ip s.
ferent periods and countries) and its compliance with the Basel
II definition of default (Basel Committee, 2004, §452) are both
critical. Sample size is important as well as sample homogeneity: conceptual structure of data links from the model development

ideally, a sample has to be generated from a unique popula­ dataset to the market the bank potentially confronts with.

tion using the same procedures, criteria, and methodology over Samples used in model building should have some desirable
the time. In other words, the sample must be generated by the technical properties (low heteroscedasticity, no abnormal values,
same 'lending technology'. This is the set of information, rules, and so forth). Actual populations do not share these properties.
contracts, and policies applied to credit origination and moni­ The best way to extend a model's findings to populations is to
toring; changing one or more of these components changes apply a proper calibration and to perform out-of-sam ple analy­
the credit portfolio generation and the borrowers' profile in the ses. These analyses are based on observations that are gener­
dataset (Berger and Udell, 2006) and can harm the consistency ated by the same lending technology but that were not included
between the model development dataset and the population to in the development sample. As a result, it is advisable to build
which the model is operationally applied to. various samples, one dedicated to support model building and
A further profile of data quality is the time span to which data others used for out-of-sample, out-of-time, and out-of-universe
refers. Ideally, the dataset should be generated by considering validations of a model's performance.
an entire credit cycle; otherwise, estimates will be dependent on The validation unit has an essential role in assessing two critical
specific favorable or unfavorable cycle stages. Macroeconomic aspects: (i) stability of the lending technology behind data and
conditions are one of the most important determinants of default (ii) proper model calibration in order to generalize results from
rates. If we miss a good representation of the credit cycle we sample to population. The two issues overlap, to some extent. If
miss something really relevant in describing default probability. the observed in-sample default rate diverges from the total pop­
The combination of the last two mentioned conditions (lending ulation, then calibration should reflect this divergence because
technology stability and credit cycle coverage) proves to be very the sample's central tendency would be different from the popu­
restrictive. We rarely observe procedures and processes that lation's central tendency. This may simply be due to the fact that
remain constant for five or more years of an entire credit cycle bank's lending technology is selecting borrowers better or worse
(the last started in 2002 and ended in 2008). Changes are more than competing banks. This circumstance may also occur when
frequent because of the increasing technological opportuni­ lending technology changes: if the model is not re-calibrated, it
ties to speed up processes and efficiency, discontinuities in the continues to apply old criteria to new states of business. This is
economic environment that lead to radically modifying credit typically the case when mergers, acquisitions, demergers and so
policies, and new market segments becoming relevant; banks' forth determine a change in the bank's lending technology.
mergers and acquisitions strongly impact on many aspects of The validation unit should be fully aware of the consequences
the lending technology, too. of lending technology changes as well as of misalignments
The validation process also has to pay attention to preliminary between borrowers' profiles in the original sample and popula­
data treatment activities (such as finding and managing outliers, tion's profiles. If the rupture is significant, an extraordinary phase
missing values, and poor data representativeness for some cus­ of model revision would be needed, at least in terms of model
tomers' segments). calibration.

Data quality is so relevant that the validation unit has to dedi­ Focus on calibration. Suppose that we use a balanced sam­
cate specific attention to these aspects. Figure 10.2 depicts the ple (50% performing, 50% defaulting borrowers) for model

Chapter 10 Validating Rating Models ■ 167

 Calibration effects on model scores
delicate issue that soon becomes a matter of discretion. The
calibration turns into a managerial decision, which is partly
based on empirical evidence and partly depends on strate­
gies and policies (such as fixing the implicit 'risk appetite' of
the organization). Optimistic estimates (default rate lower than
actual) reduce the risk perception and determine aggressive
competitive policies. If rating is also used for pricing purposes,
then prices would not fully reflect the credit risk embedded in
transactions (and loss provisions would be underestimated). On
the contrary, if the estimated default rate is pessimistic, a con­
Cumulated percentiles servative credit policy would be adopted, which would lead to
Balanced sample score distribution (def.rate 50%) missed business opportunities, to overestimated provisions, and
Population score distribution (calibration at def.rate 2,34%)
to lower credit market shares.
— — — Population score distribution (calibration at def.rate 1,0%)

Fiqure 10.3 C alib ratio n effects on m odel sco re In conclusion, the validation unit has an important role in verify­
estim a ted PD s using d ifferen t long term a v e ra g e ing the central tendency over time through back testing and
d efau lt rates. stress testing. It should carefully monitor market prices, signals
from marketing people, results of big ticket transactions (syndi­
cated loans, securities placing, securitisation, and so forth) and
development in order to assure the best conditions for applying
fully exploit any other opportunity to benchmark the bank (and
statistical methods: luckily, real banks' loan portfolios are much
models used) against direct competitors.
less risky. In other words, a normal long term annual default rate
may be close to 2.5%; this value is far away from the 50% of the
balanced sample. Moreover, defaults cluster together during the Quantitative Validation
credit cycle with significant changes in default co-dependencies.
Quantitative validation covers four main areas:
The impact on calibration is significant; even small changes in
model calibration have a big influence on a model's cut-off and 1. Sample representativeness of the reference population at
on estimated default rates. the time of the estimates and in subsequent periods.

Figure 10.3 illustrates estimated PDs in a balanced sample, in a 2. Discriminatory power: the accuracy of ratings assignments
population where the default rate is 2.4%, and in a population in terms of the models' ability to rank obligors by risk levels,
whose default rate is 1%. both in the overall sample and in its different breakdowns
(for example, based on business sector, size and location).
An inaccuracy in determining the long term average annual
default rate modifies default probability measures. In fact, the 3. Dynamic properties: the stability of rating systems and

lending process is relatively slow in producing evident results, properties of migration matrices.

also due to credit cycle movements. A credit cycle lasts years, 4. Calibration: the predictive power concerning probabilities
not days or weeks. The central tendency (in statistics) is the of default.
average value to which population characteristics converge after
We have already dealt with the issues of data quality exten­
many repetitions of the same process (this is the law of large
sively. Here we consider the perspective of samples size. Nowa­
numbers). Think about tossing a coin: after a few tosses, we
days, the real constraint is usually given by the subsample size
cannot understand if the coin has been manipulated or not; we
of defaulted firms, as some loan portfolios are characterized by
need a large number of trials in order to be sure that the coin is
very few defaults. As risks of these 'low-default portfolios' have
manipulated. The statistical repetitions in lending activities are
to be assessed in any case, rating systems have to be developed
relatively limited and it takes time to directly assess the effects
and validated. A set of principles should be taken into consid­
of an incorrect parameter. Normally, a robust check on the
eration. Firstly, we cannot exclude exposures from the scope of
validity of the central tendency is only possible after 18 or 36
application of the rating model simply because insufficient data
months, depending on markets, types of facilities, and custom­
are available to validate the risk parameter estimates on a sta­
ers' segments.
tistical basis. In these cases, the validation unit has to contribute
In any case, the central tendency is a compromise between to set an adequate margin of conservatism in the assumption
having long empirical series of observations and constant lend­ of risk parameters. Moreover, validation has to pay particular
ing technology. Therefore, to set the central tendency is a very attention to analysis techniques adopted in this estimation

168 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
process and to their limitations. Many statistical tests depend zero' and from the collection time of data which feeds model
on the amount of available information. For instance, for the explanatory variables.
Chi-square test to give accurate results when dealing with con­
On the basis of the resulting sample, various analyses of the
tingency tables cross-tabulating a dichotomous variable, such
rating discriminatory power are possible. The list of methods in
as default/non-default with many rating classes, no more than
Basel Committee (2005a) is:
20% of cells should contain expected default frequencies less
than five and no cells should have expected frequencies less • statistical tests such as Fisher's r2, Wilks' A,
than one. In many cases, minimum sample size requirements Hosmer-Lemeshow;
are not achieved, mainly due to the small number of defaults. • migration matrices;
This is particularly true when we are building models for market • accuracy indexes such as Lorentz's concentration curves
'niches' or for specific industries (that are maybe important for and Gini ratios (in different variants, for instance ROC and
their economic impact but that are composed by few com­ AuRO C);
petitors and counterparties). In these cases, we need to apply
• classification tests (binomial test, type 1 and type 2 errors, x 2
specific techniques to give more robustness to our estimates
test, normality test and so forth).
(Wehrspohn 2004, Basel Committee 2005b, Pluto and Tasche,
2004); among them, 'bootstrap procedures' have an important The frequency distribution of good and bad cases is particularly
place. These procedures randomly generate many samples. important. In fact, error rates are the best way to offer a glimpse
Retaining the number of (the few) available defaults, many bal­ on model performances. The validation unit has to carefully
anced samples can be iteratively generated by extracting an verify the cut-off choice, its calibration, and its consequence in
equal number of units from the non-defaulted group, without daily operations (as 'false good' cases create loss given default,
re-introduction. On each of these samples the rating model is and 'false bad' cases cause opportunity costs).
completely re-assessed, extracting the entire set of statistical
Ratings stability can be assessed by observing 'migration
information (variables selected, means, standard deviations, like­
matrices'. They can be built once the rating system has been
lihood tests, and so on). The set of models is then analyzed. If
operational for at least two years. Desirable properties of annual
a clear convergence on a final stable result (i.e., same final vari­
migration matrices are:
able selected, equivalent parameters, and so on) is found, we
can infer that the model solution is stable and robust enough. • Transition rates to default should be in ascending order as
If not, there would be a severe risk of instability and a more rating classes worsen.
in-depth analysis would be needed. A way to overcome these • High values should be on the diagonal and low values off-
problems is to find more homogenous subsets (applying cluster diagonal, which would signal that ratings are stable over
analysis, for instance). The model could be adapted to the spe­ time. This is also an indication of a through-the-cycle rating
cific features of these subsets, adopting different calibrations model, as opposed to point-in-time ratings, which are much
or integrating a specific successive qualitative analysis, maybe more dynamic during the credit cycle, moving frequently
based on experts' judgments. from one class to another.

The term 'discriminatory power' refers to the fundamental ability • Off-diagonal values should be in descending order when
of a rating model to differentiate between defaulting and per­ departing from the diagonal. That is to say, migration rates of
forming borrowers over the forecasting horizon. Note that the plus or minus one class should be higher than migration rates
forecasting horizon is usually set at 12 months for PD estimation of plus or minus two classes, and so forth. This means that
(this also is a Basel II requirement) but the relevant time horizon rating movements are gradual whereas sudden leaps of many
for rating validation is the one set for rating assessment: in this classes at one time are not that frequent.
last case, Basel II also requires a longer time horizon. Therefore, These properties have to also hold for longer time horizons
it is necessary to use longer forecasting horizons in order to than one year, despite a natural reduction in on-diagonal values
validate discriminatory power. For example, the discriminatory and an increase in off-diagonal values. This means that ratings
power of a scoring model for installment loans is often calcu­ change over time but without large leaps.
lated for the entire period of the credit transaction.
If analyses of firms' fundamentals are dominant in rating assign­
The discriminatory power of a model can only be reviewed ment, ratings change slowly over time because they are less
ex post using data on defaulted and non-defaulted cases sensitive to credit cycles and to transitory circumstances. There­
(back testing). Therefore, using a longer time horizon means fore, stability of the migration matrix is generally assumed as an
using an 'observation period' that is more distant from 'time indicator of an analytical process which is mainly centered on

Chapter 10 Validating Rating Models ■ 169

counterparty's fundamentals, and hence as an expression of a When back testing, realized default rates must regularly be com­
forward looking rating system. pared with estimated PDs for each rating grade. Where they do
not fall within the expected range for that grade, the validation
This is a desirable technical property for many economic rea­
unit should analyze the reasons of deviations. Internal standards
sons, such as lower pro-cyclical effects (on banks, firms and,
should be set for situations where deviations from expectations
hence, on the economy as a whole) and longer 'far-sightedness'
in realized PDs become significant enough to call the validity
of credit allocation (Draghi, 2009).
of estimates into question. These standards may take account
Calibration is a key topic in quantitative validation. It is also a of business cycles and similar systematic variability in default
critical issue because of the scarcity of statistical tools that are experiences. Where actual values continue to be higher than
available. A document issued by the Basel Committee which is expected values, the bank should revise estimates upwards to
entirely dedicated to the validation of internal rating systems, reflect their default experience.
clearly states that: 'compared with the evaluation of the discrimi­
When benchmarking, the validation unit establishes procedures
natory power, methods for validating calibration are at a much
to specify acceptable deviations between internal estimates and
earlier stage . . . Due to the limitations of using statistical tests
benchmark data and identifies, at least in general terms, the
to verify the accuracy of the calibration, benchmarking can be a
actions to be taken when such deviations significantly exceed
valuable complementary tool for the validation of estimates for
acceptable levels. Banks should also identify possible sources
the risk components PD, LGD and EAD. Benchmarking involves
of unexpected volatility that could affect benchmarking results
the comparison of a bank's ratings or estimates to results from
over time. This analysis should be conducted at least once a
alternative sources. It is quite flexible in the sense that it gives
year. The adequacy and reliability of benchmarks is obviously
banks and supervisors latitude to select appropriate bench­
critical. The comparisons of synthetic measures of rating perfor­
marks' (Basel Committee, 2005a, p. 3).
mance must be carefully considered, as some very common indi­
Therefore, validating calibration means analyzing differences cators are sample dependent (such as Gini ratio and AuRO C). It
between forecasted PDs and realized default rates. The Basel is much better to have benchmark datasets for testing different
Committee paper indicates a few tests to assess proper cali­ models on the same set of data.
bration: Binomial test, Chi-square test (or Hosmer-Lemeshow),
Regarding a model's stress testing, the validation unit should
Normal test, and Traffic lights approach. While the Binomial test
assess the robustness and reliability of models' results when
is applied to one rating category at a time, the Chi-square test
their independent variables are set to indicate extreme
simultaneously checks several rating categories. The normal test
conditions.
is applied to a single rating class but is a multiperiod test of cor­
rectness of default probability forecasts; it is based on a normal Benchmarking, stress testing and, above all, back testing should
approximation of the distribution of the time-averaged default be reported in an effective, easy to understand and transpar­
rates (and on the assumptions that the mean default rate does ent way to top managers. This would enhance the internal
not vary too much over time and that default events in different communication strategy of the validation unit: the clearer the
years are independent). The Traffic light approach is a multipe­ communication, the more effective a top manager's contribu­
riod back testing tool for a single rating category introduced tion (to improve rating systems and to enhance rating validation
with the 1996 Market Risk Amendment as a supervisory evalu­ activities) is.
ation tool of internal market risk models. Each of these tests As an example, suppose a bank has 15,000 internally rated cus­
bears important limitations. Therefore, we can conclude with the tomers; the internal rating system is based on 17 classes, with­
Basel Committee's words: 'at present no really powerful tests of out considering defaulted counterparties (Table 10.2).
adequate calibration are currently available' (Basel Committee,
Table 10.3 shows the loan portfolio by rating class at the begin­
2005a, p. 34).
ning and at the end of the observation period. As indicated
throughout this book, a number of performance measures and
Back Testing, Benchmarking and Stress Testing statistical tests can be calculated.

Back testing (accuracy of risk parameter estimates when com­ Effective and simple representation of this data is important to
pared with ex p o s t empirical evidence), benchmarking (relative communicate to top managers and other bank personnel as
performance of systems and risk parameter estimates against well. Table 10.4 and Figure 10.4 illustrate a comparison between
benchmarks), and stress testing (adequacy of models when expected and actual default rates per rating classes. Deviations
stress tests are applied) are three fundamental activities for vali­ from means are highly frequent, mainly because of the effects
dating rating systems. of credit cycles. In periods of economic expansion, lower quality

170 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 10.2 Internal Rating C lassificatio n

Probability of Default (%) Range (%)

Rating Class Min Mean Max Lower Bound Upper Bound
1 0.01 0.03 0.04 - 0 .0 2 0.01
2 0.04 0.05 0.06 - 0 .0 1 0.01
3 0.06 0.07 0.08 - 0 .0 1 0.01
4 0.08 0.10 0.12 - 0 .0 2 0.02
5 0.12 0.15 0.19 - 0 .0 3 0.04
6 0.19 0.25 0.30 - 0 .0 5 0.05
7 0.30 0.40 0.50 - 0 .1 0 0.10
8 0.50 0.60 0.75 - 0 .1 0 0.15
9 0.75 0.90 1.15 - 0 .1 5 0.25
10 1.15 1.35 1.70 - 0 .2 0 0.35
11 1.70 2.00 2.50 - 0 .3 0 0.50
12 2.50 3.00 3.75 - 0 .5 0 0.75
13 3.75 4.50 5.50 - 0 .7 5 1.00
14 5.50 7.00 8.50 - 1.50 1.50
15 8.50 10.00 13.00 - 1.50 3.00
16 13.00 15.00 20.00 - 2 .0 0 5.00
17 20.00 25.00 50.00 - 5.00 25.00

Table 10.3 Ex a m p le of Portfolio Evolution in th e O b se rv a tio n Period

Rating Initial Portfolio at Observation Period End Frequency Distribution by Class (%)
Classes Portfolio Defaults Non-defaulted Default Non-default
# Units % Cumulated Cumulated Cumulated Cumulated
1 15 0.1 0 0 15 15 0.0 0.0 0.1 0.1
2 38 0.3 0 0 38 53 0.0 0.0 0.3 0.4
3 23 0.2 1 1 22 74 0.3 0.3 0.1 0.5
4 105 0.7 0 1 105 179 0.0 0.3 0.7 1.2
5 150 1.0 0 1 150 329 0.0 0.3 1.0 2.2
6 375 2.5 3 4 372 701 0.8 1.1 2.5 4.8
7 1170 7.8 4 8 1166 1.867 1.1 2.2 8.0 12.8
8 2138 14.3 6 14 2132 3.999 1.6 3.8 14.6 27.3
9 1725 11.5 5 19 1720 5.719 1.4 5.2 11.8 39.1
10 1650 11.0 15 34 1635 7.354 4.1 9.3 11.2 50.3
11 2100 14.0 32 66 2068 9.422 8.7 18.0 14.1 64.4
12 2250 15.0 55 121 2195 11.617 15.0 33.0 15.0 79.4
13 1200 8.0 56 177 1144 12.761 15.3 48.2 7.8 87.2
14 750 5.0 58 235 692 13.453 15.8 64.0 4.7 91.9
15 675 4.5 72 307 603 14.056 19.6 83.7 4.1 96.1
16 525 3.5 45 352 480 14.536 12.3 95.9 3.3 99.3
17 113 0.7 15 367 98 14.633 4.1 100.0 0.7 100.0
15000 100.0 367 14633 100.0 100.0

Chapter 10 Validating Rating Models ■ 171

Table 10.4 Exam p le of A ctu al V alu es ag ain st E x p e cte d V alu es in a Portfolio during a Fav o ra b le C re d it C y cle

Default Rate (%)

Defaults Actual A Actual versus
Rating Classes # Central PD (%) Expected Defaults Actual Expected Survival Rate (%)
1 0.03 0 0 0.0 0.0 100.0
2 0.05 0 0 0.0 0.0 100.0
3 0.07 0 1 4.4 4.4 95.6
4 0.10 0 0 0.0 -0.1 100.0
5 0.15 0 0 0.0 -0.2 100.0
6 0.25 1 3 0.8 0.6 99.2
7 0.40 5 4 0.3 -0.1 99.7
8 0.60 13 6 0.3 -0.3 99.7
9 0.90 16 5 0.3 -0.6 99.7
10 1.35 22 15 0.9 -0.4 99.1
11 2.00 42 32 1.5 -0.5 98.5
12 3.00 68 55 2.4 -0.6 97.6
13 4.50 54 56 4.7 0.2 95.3
14 7.00 53 58 7.7 0.7 92.3
15 10.00 68 72 10.7 0.7 89.3
16 15.00 79 45 8.6 -6.4 91.4
17 25.00 28 15 13.3 - 11.7 86.7
447 367 2.4 97.6

deviations have a meaningful impact on portfolio performance.

Therefore, these effects need to be carefully managed to avoid
miscommunication (from this perspective, indicators like ROC
curve are particularly suitable).

Linking crude data of rating classifications to bank's lending

policy is useful for managers and for effective communication.
Figure 10.5 offers a way to illustrate this analysis. On the graph

Frequency distribution of default and no-default per rating classes

PD min Confidence at 67% (dx)
25.0%
PD central Confidence at 90% (dx)

PD max Confidence at 99% (dx)

20 . 0 %
£
Actual def.Rate Confidence at 99,9% (dx)

Fiqure 10.4
c/>

D efau lt rates p e r rating class and

c/>
J5
o
o> 15.0%
statistical co n fid en ce intervals. £5
0)
k_
Q_

£
0)
10 . 0 % Credit
restriction/
classes perform better than expected; the reverse would be true S'
recall/
withdrawal
in periods of recessions. This is a well known phenomenon, well <
~o 5.0% -

documented by rating agencies migration matrices observed in 0 .0 %

i— i— i— i— i— i— i— i— r
different periods. 7 8 9 10 11 12 13 14 15 16 17 18

Internal rating classes

When classes have few units, unexpected events hugely effect Type 2 errors ■ ■ ■ Actual default frequency

relative deviations but have a small economic impact (see class 3 Type 1 errors Actual non-default frequency

for instance). The opposite is true for larger classes: even small Figure 10.5 D efau lt rates and lending policy.

172 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the frequency distributions of actual defaulted and non-defaulted aggressive marketing is around 700 clients (the first 5% of the
counterparts are shown. O f course, the two groups have different portfolio) but three defaults were experimented (the first 1.1%
distributions and there is a large overlapping area. Rating classes of total defaults); see the gray area on the left in Figure 10.5. At
are often the main drivers for bank lending policies. Different the same time, if we withdraw credit to the worst three classes,
commercial policies are put into practice in respect of counter­ 130 defaults could be avoided but business with 1200 clients
party's credit risk, favoring aggressive marketing for safer clients would be lost (gray area on the right in Figure 10.5).
and conservative lending behaviors for riskier ones. Suppose that
The importance of a model's discriminatory power and ade­
aggressive marketing is pursued for better classes up to class 6,
quate calibration becomes evidently clear. The usefulness of
while a conservative approach is recommended from class 14
having clues on these performance measures of rating systems
onwards. This policy neither protects against defaults in classes
becomes apparent. Also, the value of a prompt detection of
that benefit from aggressive marketing, nor avoids restricting
fading discriminatory power and calibration becomes evident.
lending to solvent counterparties. In our example, the target for

Chapter 10 Validating Rating Models ■ 173

Assessing the
Quality of Risk
Measures
Learning Objectives
After completing this reading you should be able to:

Describe ways that errors can be introduced into models. Explain major defects in model assumptions that led
to the underestimation of systematic risk for residential
Explain how model risk and variability can arise through mortgage backed securities (RMBS) during the 2007-2009
the implementation of VaR models and the mapping of financial crisis.
risk factors to portfolio positions.

Identify reasons for the failure of the long-equity tranche,

short-mezzanine credit trade in 2005 and describe how
such modeling errors could have been avoided.

E x c e rp t is from C h a p ter 11 o f Financial Risk Management: Models, History, and Institutions, b y Allan M . Malz.
VaR has been subjected to much criticism. Previously we structured credit products, and was revealed during the sub­
reviewed the sharpest critique: that the standard normal return prime crisis. The press reported in May 2008 that Moody's had
model underpinning most VaR estimation procedures is simply incorrectly, given their own ratings methodology, assigned A A A
wrong. But there are other lines of attack on VaR that are rele­ ratings to certain structured credit products using materially
vant even if VaR estimates are not based on the standard model. flawed programming. Another example occurred when AXA
This chapter discusses three of these viewpoints: Rosenberg Group LLC, an asset-management subsidiary of the
French insurance company A XA , using a quantitative investment
1. The devil is in the details: Subtle and not-so-subtle differ­
approach, discovered a programming error in its models that
ences in how VaR is computed can lead to large differences
had likely induced losses for some investors.1
in the estimates.

2. VaR cannot provide powerful tests of its own accuracy. These episodes also provide examples of the linkages between
different types of risk. In the Moody's case, the model risk was
3. VaR is "philosophically" incoherent: It cannot do what it
closely linked to the reputational and liquidity risks faced by
purports to be able to do, namely, rank portfolios in order
Moody's. The error had been discovered by Moody's before
of riskiness.
being reported in the press, but had coincided with changes in
We will also discuss a pervasive basic problem with all models, the ratings methodology for the affected products, and had not
including risk models: the fact that they can err or be used resulted in changes in ratings while still known only within the
inappropriately. firm. Moody's therefore, once the bugs became public knowl­
edge, came under suspicion of having tailored the ratings model
to the desired ratings, tarnishing its reputation as an objective
11.1 MODEL RISK* ratings provider. Within a few days of the episode being
reported, S&P placed Moody's-issued commercial paper on
The basic modeling problem facing VaR is that the actual dis­ negative watch, illustrating the economic costs that reputational
tribution of returns doesn't conform to the model assumption risk events can cause. In the A X A Rosenberg episode, the dis­
of normality under which VaR is often computed. Using a VaR covery of the error had not been communicated in a timely fash­
implementation that relies on normality without appreciating ion to investors, resulting in loss of assets under management,
the deviations of the model from reality is an example of m odel an SEC fine, and considerable overall reputational damage.
risk. Models are used in risk measurement as well as in other
Even when software is correctly programmed, it can be used in
parts of the trading and investment process. The term "model
a way that is inconsistent with the model that was intended to
risk" describes the possibility of making incorrect trading or risk
be implemented in the software. One type of inconsistency that
management decisions because of errors in models and how
arises quite frequently concerns the mapping of positions to risk
they are applied. Model risk can manifest itself and cause losses
factors, which we'll discuss in a moment. Such inconsistencies
in a number of ways. The co n se q u e n ce s of model error can be
can contribute to differences in VaR results.
trading losses, as well as adverse legal, reputational, accounting,
and regulatory results.

All social science models are "w rong," in the sense that model Valuation Risk
assumptions are always more or less crude approximations to Model errors can occur in the valuation of securities or in hedging.
reality. In Friedman's (1953) view on the methodology of eco­ Errors in valuation can result in losses that are hidden within
nomics, deviation from reality is a virtue in a model, because the the firm or from external stakeholders. A portfolio can be more
model then more readily generates testable hypotheses that exposed to one or more risk factors than the portfolio manager
can be falsified empirically, adding to knowledge. The so-called realizes because of hedging errors.
Black-Scholes biases provide very useful insights into return
Valuation errors due to inaccurate models are exam ples of
behavior, and yet are defined as violations of the model predic­
market risk as well as of operational risk. As a market risk phe­
tions. A model may, however, be inherently wrong, in that it is
nomenon, they lead, for exam ple, to buying securities that
based on an incorrect overall view of reality. The data inputs can
are thought to be cheaply priced in the market, but are in fact
be inaccurate, or may be inappropriate to the application.

Error can be introduced into models in any number of ways. A

A seemingly trivial channel, but one that can have large conse­ On Moody's, see Sam Jones, Gillian Tett, and Paul J. Davies, "CPDOs
expose ratings flaw at Moody's," Financial Times, May 20, 2008. On
quences, is that the programming of a model algorithm can AXA Rosenberg, see Jean Eaglesham and Jenny Strasburg, "Big Fine
contain bugs. An example occurred in the ratings process for Over Bug in 'Quant' Program," Wall Street Journal, Feb. 4, 2011.

176 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
fairly priced or overpriced. As an operational risk phenomenon, of view. Netting arrangements, for example, may differ for
the difficulty of valuing some securities accurately makes it pos­ trades with different entities. Such issues become crucial if
sible to record positions or trades as profitable that have in fact counterparties file for bankruptcy. One important example
lost money. from the subprime crisis: Recovery by Lehman's counterpar­
ties depended in part on which Lehman subsidiary they had
Model errors can, in principle, be avoided and valuation risk
faced in the transactions.
reduced, by relying on market prices rather than model prices.
There are several problems with this approach of always Position data must be verified to match the firm's books and
marking-to-market and never m arking-to-m odel. Some types records. Position data may have to be collected from many
of positions, such as longer-term bank commercial loans, have trading systems and across a number of geographical loca­
always been difficult to mark-to-market because they do not tions within a firm.
trade frequently or at all, and because their value is determined
To compute a risk measure, software is needed to correctly
by a complex internal process of monitoring by the lender.
match up this data, and present it to a calculation engine. The
Accounting and regulatory standards mandating marking such
engine incorporates all the formulas or computation procedures
positions to market have been held responsible by some for
that will be used, calling them from libraries of stored proce­
exacerbating financial instability.
dures. The calculations have to be combined with the data
appropriately. Results, finally, must be conveyed to a reporting
Variability of VaR Estimates layer that manufactures documents and tables that human man­
agers can read. All of these steps can be carried out in myriad
VaR also faces a wide range of practical problems. To understand ways. We focus on two issues, the variability of the resulting
these better, we'll first briefly sketch the implementation process measures, and the problem of using data appropriately.
for risk computation. This entire process and its results are some­
The computation process we've just described applies to any
times referred to as the firm's "VaR model." We'll then discuss how
risk measure, not just to VaR, but for concreteness, we focus on
implementation decisions can lead to differences in VaR results.
VaR. The risk manager has a great deal of discretion in actually
Risk management is generally carried out with the aid of com­ computing a VaR. VaR techniques— modes of computation and the
puter systems that automate to some extent the process of user-defined parameters— can be mixed and matched in different
combining data and computations, and generating reports. ways. Within each mode of computation, there are major variants,
Risk-measurement systems are available commercially. Vendor for example, the so-called "hybrid" approach of using historical
systems are generally used by smaller financial firms. Large firms simulation with exponentially weighted return observations. This
generally build their own risk-measurement systems, but may freedom is a mixed blessing. On the one hand, the risk manager has
purchase some components commercially. the flexibility to adapt the way he is calculating VaR to the needs of
One particular challenge of implementing risk-measurement sys­ the firm, its investors, or the nature of the portfolio. On the other
tems is that of data preparation. Three types of data are involved: hand, it leads to two problems with the use of VaR in practice:

M arket data are time series data on asset prices or other data 1. There is not much uniformity of practice as to confidence
that we can use to forecast the distribution of future portfolio interval and time horizon; as a result, intuition on what con­
returns. Obtaining appropriate time series, purging them stitutes a large or small VaR is underdeveloped.
of erroneous data points, and establishing procedures for 2. Different ways of measuring VaR would lead to different
handling missing data, are costly but essential for avoiding results, even if there were standardization of confidence
gross inaccuracies in risk measurement. Even with the best interval and time horizon. There are a number of computa­
efforts, appropriate market data for some exposures may tional and modeling decisions that can greatly influence VaR
be unobtainable. results, such as
Secu rity m aster data include descriptive data on securi­ • Length of time series used for historical simulation or to
ties, such as maturity dates, currency, and units. Corporate estimate moments
securities such as equities and, especially, debt securities • Technique for estimating moments
present particular challenges in setting up security master • Mapping techniques and the choice of risk factors, for
databases. To name but one, issuer hierarchy data record example, maturity bucketing
which entity within a large holding company a transaction is • Decay factor if applying EW M A
with. Such databases are difficult to build and maintain, but • In Monte Carlo simulation, randomization technique and
are extremely important from a credit risk management point the number of simulations

Chapter 11 Assessing the Quality of Risk Measures ■ 177

Dramatic changes in VaR can be obtained by varying these Another example is convertible bond trading. Convertible
parameters. In one well-known study (Beder, 1995), the VaRs of bonds can be mapped to a set of risk factors including, among
relatively simple portfolios consisting of Treasury bonds and S&P others, implied volatilities, interest rates, and credit spreads.
500 index options were computed using different combinations Such mappings are based on the theoretical price of a convert­
of these parameters, all of them well within standard practice. ible bond, which is arrived at using its replicating portfolio.
For example, 100 or 250 days of historical data might be used However, at times theoretical and market prices of converts can
to compute VaR via historical simulation, or Monte Carlo VaR diverge dramatically. These divergences are liquidity risk events
might be computed using different correlation estimates. For a that are hard to capture with market data, so VaR based on the
given time horizon and confidence level, VaR computations dif­ replicating portfolio alone can drastically understate risk. This
fered by a factor of six or seven times. Other oddities included problem can be mitigated through stress testing.
VaR estimates that were higher for shorter time horizons.
In some cases, a position and its hedge might be mapped to the
A number of large banks publish VaR estimates for certain of same risk factor or set of risk factors. The mapping might be jus­
their portfolios in their annual reports, generally accompanied tified on the grounds that the available data do not make it pos­
by backtesting results. These VaR estimates are generated sible to discern between the two closely related positions. The
for regulatory purposes. Perusing these annual reports gives result, however, will be a measured VaR of zero, even though
a sense of how different the VaR models can be, as they use there is a significant basis risk; that is, risk that the hedge will
inconsistent parameters and cannot be readily compared. not provide the expected protection. Risk modeling of securi­
tization exposures provides a pertinent example of basis risk,
too. Securitizations are often hedged with similarly-rated corpo­
Mapping Issues rate CDS indexes. If both the underlying exposure and its CD X
hedge are mapped to a corporate spread time series, the mea­
Mapping, the assignment of risk factors to positions, can also
have a large impact on VaR results. Some decisions about map­ sured risk disappears.

ping are pragmatic choices among alternatives that each have For some strategies, VaR can be misleading for reasons over and
their pros and cons. An example is the choice between cash above the distribution of returns and VaR's dependence on spe­
flow versus duration-convexity mapping for fixed-income. Cash cific modeling choices. For some strategies, outcomes are close
flow mappings are potentially more accurate than duration map­ to binary. One example is event-driven strategies, a broad class
pings, since, in the former, each cash flow is mapped to a fixed of strategies that includes trades that depend on the occurrence
income security with a roughly equal discount factor, to which of terms of a corporate acquisition or merger, the outcome of
the latter is clearly only an approximation. But cash flow map­ bankruptcy proceedings, or of lawsuits. For many such trades,
ping requires using many more risk factors and more complex there is no historical time series of return data that would shed
computations, which are potentially more expensive and entail light on the range of results. Another example are dynamic
risks of data errors and other model risks. strategies, in which the risk is generated by the trading strategy

In other cases, it may be difficult to find data that address cer­ over time rather than the set of positions at a point in time.

tain risk factors. Such mapping problems may merely mirror

the real-world difficulties of hedging or expressing some trade Case Study: The 2005 Credit Correlation
ideas. An example is the practice, said to be widespread prior Episode
to the subprime crisis, of mapping residential mortgage-backed
securities (RMBS) and other securitized credit products to time An episode of volatility in the credit markets that occurred in the

series for corporate credit spreads with the same rating. Market late spring of 2005 provides a case study of model risk stemming
from misinterpretation and misapplication of models. Some trad­
data on securitization spreads generally is sparse, available only
for very generic types of bonds and hard to update regularly ers suffered large losses in a portfolio credit trade in which one

from observed market prices. Prior to the crisis, the spread vola­ dimension of risk was hedged in accordance with a model, while

tility of investment-grade securitizations was lower than those of another dimension of risk was neglected. We start by reviewing

corporate bonds with similar credit ratings. Yet during the finan­ the mechanics of the trade, which involved credit derivatives

cial crisis, spreads on securitizations widened, at least relatively, based on C D X .N A .IG , the investment grade CDS index.

far more than corporate spreads. This episode illustrates not

only the model risks attendant on proxy mapping, but also the
Description of the Trade and Its Motivation
inefficacy of VaR estimates in capturing large moves in market A widespread trade among hedge funds, as well as proprietary
prices and the importance of stress testing. trading desks of banks and brokerages, was to sell protection on

178 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the equity tranche and buy protection on the junior mezzanine is —$6,880. The defaultOI of the mezzanine is —0.07212 times
tranche of the C D X .N A .IG . The trade was thus long credit and the notional value, so the defaultOI of a $1,000,000 notional
credit-spread risk through the equity tranche and short credit position is —$721. With a hedge ratio of about 9.54—that is,
and credit-spread risk through the mezzanine. It was executed by shorting $9,540,000 of par value of the mezzanine for every
using several C D X.N A .IG series, particularly the IG3 introduced $1,000,000 notional of long equity— we create a portfolio that,
in September 2004 and the IG4 introduced in March 2005. at the margin, is default-risk neutral.

The trade was designed to be default-risk-neutral at initiation, Figure 11.1 illustrates how the trade was set up. At a default
by sizing the two legs of the trade so that their credit spread rate of 0.003, the portfolio has zero sensitivity to a small rise or
sensitivities were equal. The motivation of the trade was not decline in defaults. But the trade has positive convexity. The
to profit from a view on credit or credit spreads, though it was equity cheapens at a declining rate in response to spread widen­
primarily oriented toward market risk. Rather, it was intended ing. A noteworthy feature is that, because at low default rates,
to achieve a positively convex payoff profile. The portfolio of the mezzanine tranche has negative convexity, the short position
two positions would then benefit from credit spread volatility. adds positive convexity to the portfolio. The trade benefits from
In addition, the portfolio had positive carry; that is, it earned a changes in the default rate in either direction. The actual CD X
positive net spread. Such trades are highly prized by traders, for trade benefitted from large credit spread changes. It behaved,
whom they are akin to delta-hedged long option portfolios in in essence, like an option straddle on credit spreads. In contrast
which the trader receives rather than paying away time value. to a typical option, however, this option, when expressed using
the CD X standard tranches at the market prices prevailing in
To understand the trade and its risks, we can draw on the tools
early 2005, paid a premium to its owner, rather than having
we developed earlier. The securities in the extended example
negative net carry.
are similar enough in structure to the standard tranches of the
C D X.N A .IG that we can mimic the trade and understand what In the actual standard tranche trade, the mechanics were
went wrong. Let's set up a trade in tranches of illustrative CLO slightly different. Since the securities were synthetic CD O
that is similar in structure and motivation to the standard tranche liabilities, traders used spread sensitivities; that is, spreadOls
trade we have been describing. The trade takes a long credit or risk-neutral defaultOls, rather than actuarial defaultOls. The
risk position in the equity tranche and an offsetting short credit sensitivities used were not to the spreads of the underlying
position in the mezzanine bond. Bear in mind that
we would unlikely be able, in actual practice, to
take a short position in a cash securitization, since
the bond would be difficult to locate and bor­
row. We might be able to buy protection on the
mezzanine tranche through a CD S, but the dealer
writing it would probably charge a high spread
to compensate for the illiquidity of the product
and the difficulty of hedging it, in addition to the
default and correlation risk. The standard tranches
are synthetic CDS and their collateral pools also
consist of CDS. They are generally more liquid
than most other structured products, so it is eas­
ier to take short as well as long positions in them.

To determine the hedge ratio, that is, the amount

of the mezzanine we are to short, we use the
Fiaure 11.1 C o n v e x ity of C L O liabilities.
default sensitivities, the defaultOls. These are
credit-risk sensitivities, while the 2005 CD X trade The graph plots the P&L, for varying default rates, of a portfolio consisting of (1) a long
credit position in the equity tranche of the CLO with a notional amount of $1,000,000,
employed market-risk sensitivities, the spreadOls.
and (2) a short credit position in the mezzanine tranche of the same CLO with a notional
But the mechanics of hedging are similar. We amount of $1,000,000 times the hedge ratio of 9.54, that is, a par value of $9,540,000.
assume that, at the time the trade is initiated, The P&Ls of the constituent positions are also plotted. The default rates vary in the graph,
the expected default rate and implied correla­ but the correlation is fixed at 0.30. That is, the hedge ratio is set at a default rate of
3 percent, and a correlation of 0.30, but only the default rate is permitted to vary in
tion are 7r = 0.03 and p = 0.30. The defaultOI the plot. The default rates are measured on the horizontal axis as decimals. The P&L is
of a $1,000,000 notional position in the equity expressed on the vertical axis in millions of dollars.

Chapter 11 Assessing the Quality of Risk Measures ■ 179

constituents of the C D X .N A .IG , but to the tranche spread. The 125 constituents of the IG4. The market now contemplated the
hedge ratio in the actual trade was the ratio of the P&L impact possibility of experiencing several defaults in the IG3 and IG4.
of a 1bp widening of C D X.N A .IG on the equity and on the junior The probability of extreme losses in the IG3 and IG4 standard
mezzanine tranches. The hedge ratio was between 1.5 and 2 at equity tranches had appeared to be remote; it now seemed a
the beginning of 2005, lower than our example's 9.54, and at distinct possibility. Other credit products also displayed sharp
the prevailing tranche spreads, resulted in a net flow of spread widening; the convertible bond market, in particular, was experi­
income to the long equity/short mezz trade. However, the trade encing one of its periodic selloffs, as seen in Figure 17-2.
was set up at a particular value of implied correlation. As we will
The automotive and certain other single-name spreads w id­
see, this was the critical error in the trade.
ened sharply, among them G M AC and FM CC. The IG indexes
One additional risk should be highlighted, although it did not in widened in line with the widening in their constituents, many of
the end play a crucial role in the episode we are describing: The which did not widen at all. The pricing of the standard tranches,
recovery amount was at risk. In the event of a default on one or however, experienced much larger changes, brought about by
more of the names in the index, the recovery amount was not the panicky unwinding of the equity-mezzanine tranche trade.
fixed but a random variable. Figure 11.3 shows the behavior of credit spreads and the price
of the standard equity tranche during the episode.
The Credit Environment in Early 2005 • The mark-to-market value of the equity tranche dropped
In the spring of 2005, the credit markets came under pressure, sharply. This can be seen in the increase in points upfront
focused on the automobile industry, but not limited to it. The that buyers of protection had to pay.
three large U.S.-domiciled original equipment manufacturers • The implied correlation of the equity tranche dropped
(OEM s), Ford, General Motors (GM), and Chrysler, had long sharply. Stated equivalently, its mark-to-market value
been troubled. For decades, the O EM s had been among the dropped more and its points upfront rose more sharply than
most important companies in the U.S. investment-grade bond the widening of the IG4 spread alone would have dictated.
market, both in their share of issuance and in their benchmark • The junior mezzanine tranche experienced a small widen­
status. The possibility of their being downgraded to junk was ing, and at times even some tightening, as market partici­
new and disorienting to investors. They had never been constit­ pants sought to cover positions by selling protection on
uents of the C D X .N A .IG , but two "captive finance" companies, the tranche, that is, taking on long credit exposures via the
General Motors Acceptance Co. (GM AC) and Ford Motor Credit tranche.
Co. (FM CC), were.
• The relative value trade as a whole experienced large losses.
A third set of companies at the core of the automotive indus­
The implied correlation fell for two reasons. The automotive
tries were the auto parts manufacturers. Delphi Corp. had been
parts supplier bankruptcies had a direct effect. All were in the
a constituent of IG3, but had been removed in consequence of
IG4, which meant that about 10 percent of that portfolio was
its downgrade below investment grade. American Axle Co. had
now near a default state. But the correlation fell also because
been added to IG4.
the widening of the IG4 itself was constrained by hedging. The
From a financial standpoint, the immediate priority of the OEM s short-credit position via the equity tranche could be hedged
had been to obtain relief from the UAW auto workers union by selling protection on a modest multiple of the mezzanine
from commitments to pay health benefits to retired workers. tranche, or a large multiple of the IG4 index. Although spreads
The "hot" part of the 2005 crisis began with two events in mid- were widening and the credit environment was deteriorating, at
April, the inability of GM and the UAW to reach an accord on least some buyers of protection on the IG4 index found willing
benefits, and the announcement by GM of large losses. On May sellers among traders long protection in the equity tranche who
5, GM and Ford were downgraded to junk by S&P. Moody's did were covering the short leg via the index as well as via the mez­
the same soon after. The immediate consequence was a sharp zanine tranche itself.
widening of some corporate spreads, including G M A C and
FM CC and other automotive industry names. Collins and Aik- Modeling Issues in the Setup of the Trade
man, a major parts manufacturer, filed for Chapter 13 protection
The relative value trade was set up in the framework of the stan­
from creditors in May. Delphi and Visteon, another large parts
dard copula model, using the analytics described earlier. These
manufacturer, filed later in 2005.
analytics were simulation-based, using risk-neutral default prob­
The two captive finance arms and the two auto parts manufac­ abilities or hazard-rate curves derived from single-name CDS.
turers American Axle and Lear together constituted 4 out of the The timing of individual defaults was well modeled. Traders

180 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 generally used a normal copula. The cor­
relation assumption might have been
based on the relative frequencies of dif­
ferent numbers of joint defaults, or, more
likely, on equity return correlations or
prevailing equity implied correlations.

In any event, the correlation assump­

tion was static. This was the critical flaw,
rather than using the "wrong" copula
function, or even the "wrong" value
of the correlation. The deltas used to
set the proportions of the trade were
partial derivatives that did not account
for changing correlation. Changing cor­
relation drastically altered the hedge
ratio between the equity and mezzanine
tranches, which more or less doubled to
nearly 4 by July 2005. In other words,
traders needed to sell protection on
nearly twice the notional value of the
mezzanine tranche in order to maintain
spread neutrality in the portfolio.

Figure 11.2 displays the P&L profile of

the trade for different spreads and cor­
relations, again using the CLO example.
F iq u re 1 1 .2 C o rrela tio n risk of th e co n vexity tra d e .
The portfolio P&L plotted as a solid line
The graph plots the P&L of the convexity trade for default rates from 0.0075 to 0.0825 per annum in Figure 11.1 is a cross-section through
and constant pairwise Gaussian copula correlations from 0.0 to 0.5. The P&L is expressed on the
Figure 11.2 at a correlation of 0.30.
vertical (z) axis in millions of dollars.
Figure 11.2 shows that the trade was
profitable for a wide range of spreads,
but only if correlation did not fall. If correlation fell
abruptly, and spreads did not widen enough, the
trade would become highly unprofitable.

The model did not ignore correlation, but the trade

thesis focused on anticipated gains from convexity.
The flaw in the model could have been readily cor­
rected if it had been recognized. The trade was put
on at a time when copula models and the concept
of implied correlation generally had only recently
been introduced into discussions among traders,
who had not yet become sensitized to the potential
losses from changes in correlation. Stress testing
correlation would have revealed the risk. The trade
could also have been hedged against correlation
risk by employing an overlay hedge: that is, by
The graph plots the implied or base correlation of the equity (0-3 percent) tranche (solid going long single-name protection in high default-
line, percent, left axis), the price of the equity tranche (dashed line, points upfront, right probability names. In this sense, the "arbitrage"
axis), and the CDX IG 4 spread (dotted line, basis points, right axis). could not be captured via a two-leg trade, but
Source: JPMorgan Chase. required more components.

Chapter 11 Assessing the Quality of Risk Measures ■ 181

Case Study: Subprime Default
Models
Among the costliest model risk episodes was the
failure of subprime residential mortgage-based
security (RMBS) valuation and risk models. These
models were employed by credit-rating agencies to
assign ratings to bonds, by traders and investors to
value the bonds, and by issuers to structure them.
While the models varied widely, two widespread
defects were particularly important:

• In general, the models assumed positive future

house price appreciation rates. In the stress
case, house prices might fail to rise, but would
not actually drop. The assumption was based
Rolling indexes of AAA, A, and BBB- ABX. For each index, the graph displays the most
on historical data, which was sparse, but sug­ recent vintage.
gested there had been no extended periods
Source: JPMorgan Chase.
of falling house prices on a large scale in any
relevant historical period. House prices did in fact drop very have identified the potential conflict of interest arising from
severely starting in 2007. Since the credit quality of the loans compensation of rating agencies by bond issuers as a factor in
depended on the borrowers' ability to refinance the loans driving ratings standards lower. Others have focused on reach­
without additional infusions of equity, the incorrect assump­ ing for yield and the high demand for highly rated bonds with
tion on house price appreciation led to a severe underesti­ even modestly higher yields.
mate of the potential default rates in underlying loan pools in
As we saw earlier in this chapter, a number of instances of
an adverse economic scenario.
mapping problems, contributing to seriously misleading risk
• Correlations among regional housing markets were assumed measurement results, arose in securitization and structured
to be low. Bonds based on pools of loans from different geo­ credit products. Up until relatively recently, little time-series
graphical regions were therefore considered well-diversified. data was available covering securitized credit products. Highly
In the event, while house prices fell more severely in some rated securitized products were often mapped to time series
regions than others, they fell— and loan defaults were much of highly rated corporate bond spread indexes in risk measure­
higher than expected in a stress scenario— in nearly all. ment systems, or, less frequently, to the A B X index family,
Together, these model errors or inappropriate parameters led to introduced in 2006. VaR measured using such mappings would
a substantial underestimation of the degree of systematic risk in have indicated that the bonds were unlikely under any circum­
subprime RMBS returns. Once the higher-than-expected default stances to lose more than a few points of value. As can, how­
rates began to materialize, the rating agencies were obliged to ever, be seen in Figure 11.4, the A B X index of the most highly
downgrade most RMBS. The large-scale downgrades of A A A rated RMBS lost 70 percent of their value during the subprime
RMBS were particularly shocking to the markets, as it was pre­ crisis. Somewhat lower, but still investment-grade RMBS lost
cisely these that revealed the extent to which systemic risk had almost all their value. Securitizations suffered far greater losses
been underestimated and mispriced. As of the end of 2009, than corporate bonds. Losses varied greatly by asset class, the
about 45 percent of U.S. RMBS with original ratings of A A A had year in which they were issued, or "vintage," and position in
been downgraded by Moody's.2 the capital structure. The corporate-bond and A B X mappings
were highly misleading and would have understated potential
The inaccuracy of rating agency models for subprime RMBS is a
losses by several orders of magnitude for investment-grade
complex phenomenon with a number of roots. Some observers
bonds. Similar issues arose for CM BS, and their relationship
to the ratings curves and the CM BX, an index of CM BS prices
2 See Moody's Investors Service (2010), p. 19. analogous to the A BX.

182 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Risk Capital
Attribution and
Risk-Adjusted
Performance
Measurement
Learning Objectives
After completing this reading you should be able to:

Define, compare, and contrast risk capital, economic horizon, measuring default probability, and choosing a
capital, and regulatory capital, and explain methods and confidence level.
motivations for using economic capital approaches to
allocate risk capital. Calculate the hurdle rate and apply this rate in making
business decisions using RAROC.
Describe the risk-adjusted return on capital (RAROC)
methodology and its use in capital budgeting. Compute the adjusted RARO C for a project to determine
its viability.
Compute and interpret the RAROC for a project, loan, or
loan portfolio and use RARO C to compare business unit Explain challenges in modeling diversification benefits,
performance. including aggregating a firm's risk capital and allocating
economic capital to different business lines.
Explain challenges that arise when using RARO C for
performance measurement, including choosing a time Explain best practices in implementing an approach that
uses RAROC to allocate economic capital.

E x c e rp t is rep u b lish ed with perm ission o f M cGraw -Hill C om panies, from The Essentials of Risk Management, M ichel Crouhy, Dan
Galai, and R o b e rt M ark, 2n d edition (2014).

183
This chapter takes a look at the roles of risk capital and at how The new regulatory capital requirements imposed by Basel III
risk capital can be attributed to business lines as part of a risk- make it likely that for some activities, such as securitization,
adjusted performance measurement (RAPM) system. RAPM rep­ regulatory capital may end up much higher than economic capi­
resents a key challenge for financial institutions and nonfinancial tal. Still, economic capital calculation is essential for senior man­
firms around the world today. Only by forging a connection agement as a benchmark to assess the economic viability of the
between risk measurement, risk capital, risk-based pricing, and activity for the financial institution. When regulatory capital is
performance measurement can firms ensure that the decisions much larger than economic capital, then it is likely that over time
they take reflect the interests of stakeholders such as bondhold­ the activity will migrate to the shadow banking sector, which can
ers and shareholders. price the transactions at a more attractive level.

Risk capital measurement is based on the same concepts as the

value-at-risk (VaR) calculation methodology. Indeed, risk capital
12.1 WHAT PURPOSE DOES RISK numbers are often derived from, or supported by, sophisticated
CAPITAL SERVE? internal VaR models. However, the choice of the confidence
level and time horizon when using VaR to calculate risk capital
Risk capital is the cushion that provides protection against the are key policy parameters that should be set by senior manage­
various risks inherent in the business of a corporation so that ment (or the senior risk management committee). Usually, these
the firm can maintain its financial integrity and remain a going decisions should be endorsed by the board.
concern even in the event of a near-catastrophic worst-case
Risk capital should be calculated in such a way that the institu­
scenario. Risk capital gives essential confidence to the corpora­
tion's stakeholders, such as suppliers, clients, and lenders (for an tion can absorb unexpected losses up to a level of confidence in
line with the requirements of the firm's various stakeholders. No
industrial firm), or claimholders, such as depositors and counter­
parties in financial transactions (for a financial institution). firm can offer its stakeholders a 100 percent guarantee (or confi­
dence level) that it holds enough risk capital to ride out any
Risk capital is often called eco n o m ic capital, and in most eventuality. Instead, risk capital is calculated at a confidence
instances the generally accepted convention is that risk capital level set at less than 100 percent— say, 99.9 percent for a firm
and economic capital are identical (although later in this chapter with conservative stakeholders. In theory, this means that there
we introduce a slight wrinkle by defining economic capital as is a probability of around 1/10 of 1 percent that actual losses will
risk capital plus strategic capital). exceed the amount of risk capital set aside by the firm over the
We should be careful not to confuse the concept of risk capital, given time horizon (generally one year).2 The exact choice of
which is intended to capture the economic realities of the risks a confidence level is typically associated with some target credit
firm runs, and regulatory capital. First, regulatory capital only rating from a rating agency such as Moody's, Standard & Poor's,
applies to a few regulated industries, such as banking and insur­ and Fitch as these ratings are themselves explicitly associated
ance companies, where regulators are trying to protect the with a probability of default. It should also be in line with the
interests of small depositors or policy holders. Second, while firm's stated risk appetite.
regulatory capital performs something of the same function as
risk capital in the regulators' eyes, it is calculated according to a
set of industrywide rules and formulas and sets only a minimum 12.2 EMERGING USES OF RISK
required level of capital adequacy. It rarely succeeds in captur­ CAPITAL NUMBERS
ing the true level of risk in a firm—the gap between a firm's reg­
ulatory capital and its risk capital can be quite wide. Risk capital is traditionally used to answer the question, "How
Furthermore, even if regulatory and risk capital are similar num­ much capital is required for our firm to remain solvent, given our
bers at the level of the firm, they may not be similar for each risky activities?" As soon as a firm can answer this question, it
constituent business line (i.e., regulatory capital may suggest can move on to solve many other management problems.
that an activity is much riskier than management believes to be Recently, therefore, risk capital numbers have been used to
the case, or vice versa).1 answer more and more questions, particularly in banks and

This leads to various conundrums in allocating capital and capital costs 2 In reality, risk capital model suffers from the model risks we discussed
A

to business lines. For example, some practitioners square the circle by in Chapter 10, and the results require careful interpretation. Most firms
allocating the higher of regulatory capital or economic capital to the use the output of their capital model as one key input into a wider set of
business line. judgments about the amount of capital the firm should hold.

184 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 12.1 WHY IS ECONOMIC CAPITAL SO IMPORTANT TO FINANCIAL
INSTITUTIONS?
Allocating risk capital using economic capital approaches is with a poor credit rating will find itself excluded from many
important for financial institutions for at least four reasons. markets. Maintaining good creditworthiness is therefore an
ongoing cost of doing business for a bank.
First, capital is primarily used in a financial institution not only
to provide funding for investments (as for a manufacturing Third, although bank creditworthiness is critical, banks are
corporation) but also to absorb risk. The fundamental reason also highly opaque institutions. Banks use proprietary tech­
for this is that financial institutions can leverage themselves nology for pricing and hedging financial instruments, espe­
to a much higher degree than other corporations at a much cially complex financial transactions. A typical bank's balance
lower cost without raising equity, by taking retail deposits sheet is relatively liquid and can change very quickly. Any
or issuing debt securities. (Their debt-to-equity ratio might outside assessment of the creditworthiness of a bank is there­
be as high as 20 to 1, compared to perhaps 2 to 1 for an fore difficult to develop and rapidly becomes obsolete (as
industrial corporation.) Moreover, many activities undertaken the risk profile of the bank keeps on changing). Maintaining
by financial institutions, such as derivatives trading, writing enough risk capital and implementing a strong risk manage­
guarantees, issuing letters of credit, and other contingent ment culture allows the bank to reduce these "agency costs"
commitments, do not require significant financing. Yet all by convincing external stakeholders, including rating agen­
these activities draw to some extent on the bank's stock of cies, of the bank's financial integrity.
risk capital, and therefore a risk capital cost must be imputed
Fourth, banks operate in highly competitive financial mar­
to each activity.
kets. Increasingly, this makes bank profitability very sensitive
This brings us to the second reason: a bank's target solvency to the bank's cost of capital. Banks don't want to carry too
is a vital part of the product the bank is selling. In contrast much risk capital, because risk capital represents the money
to an industrial company, the primary customers of banks invested in the bank that does not have to be repaid under
and other financial institutions are also their primary liabil­ any fixed contractual agreement (e.g., equity capital). This
ity holders— e.g., depositors, derivatives counterparties, flexibility, which allows risk capital to act as a safety buffer for
insurance policy holders, and so on. These customers are the bank if times are hard, means that risk capital is relatively
concerned about default risk on contractually promised pay­ expensive to raise and hold (e.g., compared to debt capital).
ments. Customers make deposits with the expectation that But banks can't carry too little risk capital, for reasons we've
the safety of their deposits does not depend on the eco­ already made clear. So understanding the dynamic balance
nomic performance of the bank. In over-the-counter markets, between the capital the bank carries and the riskiness of its
institutions are concerned about counterparty risk: a bank activities is very important.

other financial institutions.3 (Box 12.1 explains why risk-based numbers can be used as part of scorecards to compensate
calculations are so important for financial institutions.) These the senior management of particular business lines, as well as
new uses include: the infrastructure group, for their contribution to shareholder
value. Since the 2007-2009 financial crisis, firms have laid a
• Perform ance m easurem ent and incentive com pensation at
greater emphasis on compensation schemes that adjust for
the firm, business unit, and individual levels. Risk capital can
risk in some manner (as well as on complementary mecha­
be plugged into risk-based capital attribution systems, often
nisms such as deferral periods and clawbacks).
grouped together under the acronym RAPM (risk-adjusted
performance measurement) or RARO C (risk-adjusted return • A ctive p o rtfo lio m anagem ent for entry/exit d ecision s. The
on capital). These systems, a key focus of this chapter, pro­ decision to enter or exit a particular business should be
vide both management and external stakeholders with a risk- based on both risk-adjusted performance measurement and
adjusted measure of performance of various businesses. The the "risk diversification effect" of the business. For example,
measure can be used to compare the economic profitability, a firm that is focused on corporate lending in a particular
as opposed to the accounting profitability (such as return on region is likely to find that its returns fluctuate in accordance
book equity) of different activities. At the same time, RAROC with that region's business cycle. Ideally, the firm might
diversify its business geographically or in terms of business
activity. Capital management decisions seek an answer to the
3 For an informal survey of how firms use economic capital and RAROC,
question, "How much value will be created if the decision is
see T. Baer et. al., The Use o f Economic Capital in Performance Man­
agement for Banks: A Perspective, McKinsey Working Papers on Risk, taken to allocate resources to a new or existing business, or
No. 24, January 2011. alternatively to close down an activity?"

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 185

• Pricing transactions. Risk capital numbers can be used to a unit of capital and, therefore, offers a uniform and comparable
calculate risk-based pricing for individual transactions. measure of risk-adjusted performance across all business activi­
Risk-based pricing is attractive because it ensures that a ties. If a business unit's RAROC is higher than the cost of the
firm is compensated for the economic risk generated by a bank's equity (the minimum rate of return on equity required by
transaction. For example, common sense tells us that a loan the shareholders), then the business unit is deemed to be add­
to a non-investment-grade firm that is in relatively fragile ing value to shareholders. Senior management can use this mea­
financial condition must be priced higher than a loan to an sure to evaluate performance for capital budgeting purposes,
investment-grade firm. However, the am ount of the differ­ and as an input to the compensation for managers of business
ential can be determined only by working out the amount of units.
expected loss and the cost of the risk capital that has to be
The generic RARO C equation is really a formalization of the
set aside for each transaction. Trading and corporate loan
trade-off between risk and reward. It reads:
desks in many banks rely on the "marginal economic capital
requirement" component in the RARO C calculation to price after-tax expected risk-adjusted net income
RAROC = t 77 |
deals in advance— and to decide whether those deals will econom ic capital
increase shareholder value rather than simply add to the vol­
We can see that the RARO C equation employs economic
ume of transactions.
capital as a proxy for risk and after-tax expected risk-adjusted
One problem is that a single measure of risk capital cannot net income as a proxy for reward. Later, we elaborate on how
accommodate the four different purposes that we have just to measure both the numerator and the denominator of the
described. We'll look at the solution to this later on. RAROC equation, and on how to tackle the "hurdle-rate"
issue—that is, once we know our RARO C number, how do
we know if this number is good or bad from a shareholder's
12.3 RAROC: RISK-ADJUSTED RETURN perspective?
ON CAPITAL Before beginning this discussion, however, we must acknowl­
edge that the generic RARO C equation is one of a family of
RAROC is an approach— simple at the conceptual level— that is
approaches, all with strengths and weaknesses. The definition
used to allocate risk capital to business units and individual trans­
of RARO C that we've just offered corresponds to industry prac­
actions for the purpose of measuring economic performance.
tice and can be thought of as the traditional RARO C definition.
Originally proposed by Bankers Trust in the late 1970s, the Box 12.2 presents several variants grouped under the label
approach makes clear the trade-off between risk and reward for RAPM (risk-adjusted performance measures).

BOX 12.2 RAPM (RISK-ADJUSTED PERFORMANCE MEASUREMENT) ZOOLOGY

It's long been recognized that traditional accounting-based • R A R O C (risk-adjusted return on capital ) = risk-adjusted
measures of performance at the consolidated level and for e x p e c te d n et in com e/econ om ic capital. RARO C makes
individual business units, such as return on assets (ROA) or the risk adjustment to the numerator by subtracting a risk
return on book equity (ROE), fail to capture the risk of the factor from the return— e.g ., expected loss. RARO C also
underlying activity. The amounts of both book assets and makes the risk adjustment to the denominator by substi­
book equity, which are accounting measures, are poor prox­ tuting economic capital for accounting capital.
ies for risk measures. Furthermore, accounting income misses • R O R A C (return on risk-adjusted capital ) = n et incom e/
some critical risk adjustments, such as expected loss. eco n o m ic capital. RO RAC makes the risk adjustment
RAPM (risk-adjusted performance measurement) is a generic solely to the denominator. In practical applications,
term describing all the techniques used to adjust returns for P&L(profit and loss)
the risk incurred in generating those returns. It encompasses RO RAC -------------------------
VaR
many different concepts, risk adjustments, and performance
• R O C (return on capital) = R O R A C . It is also called ROCAR
measures, with RARO C being the form that is most widely
(return on capital at risk).
used in the banking sector. These RAPM measures are not
fully consistent with one another. In the main text, we pro­ • R O R A A (return on risk-adjusted assets) = n et incom e/
pose an adjusted RARO C measure that is consistent with the risk-adjusted assets.
capital asset pricing model (CAPM) and, therefore, with the • R A R O A ( risk-adjusted return on risk-adjusted a ssets ) =
NPV measure defined here. risk-adjusted e x p e c te d n et incom e/risk-adjusted assets.

186 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 S (Sharpe ratio ) = (e x p e c te d return — risk-free rate)/ ventures in which the expected cash flows over the life of
volatility. The ex post Sharpe ratio— i.e., that based on the project can be easily identified.
actual returns rather than expected returns— can be • EVA (econ om ic value a d d ed ), or N IA C C (net incom e after
shown to be a multiple of R O C .1 capital charge), is the after-tax adjusted net income less
N PV (n et p re se n t value ) = d isco u n te d value o f future a capital charge equal to the amount of economic capital
e x p e c te d cash flow s, using a risk-adjusted expected rate attributed to the activity, times the after-tax cost of equity
of return based on the beta derived from the CAPM , capital. The activity is deemed to add shareholder value,
where risk is defined in terms of the covariance of changes or is said to be EVA positive, when its N IACC is positive
in the market value of the business with changes in the (and vice versa).12 An activity whose RARO C is above the
value of the market portfolio. In the CAPM , the definition hurdle rate is also EVA positive.
of risk is restricted to the systematic component of risk
that cannot be diversified away. For RARO C calculations,
the risk measure captures the full volatility of earnings, 1 See David Shimko, "See Sharpe or Be Flat," Risk 10(6), 1997, p. 33.
systematic and specific. NPV is particularly well suited for 2 EVA is a registered trademark of Stern Stewart & Co.

12.4 RAROC FOR CAPITAL BUDGETING • Transfers correspond to transfer pricing mechanisms, primar­
ily between the business unit and the treasury group, such as
The decision to invest in a new project or a new business ven­ charging the business unit for any funding cost incurred by
ture, or to expand or close down an existing business line, its activities and any cost of hedging interest rate and cur­
has to be made before the true performance of the activity is rency risks; it also includes overhead cost allocation from the
known— no manager has a crystal ball. When implementing the head office.
generic after-tax RARO C equation for capital budgeting, indus­ • Eco n o m ic capital is the sum of risk capital and strategic capi­
try practice therefore interprets it as meaning tal where

expected revenues - costs - expected losses strategic risk capital = goodwill + burned-out capital
R A R O C - ~~ taxes + return on risk capital + / - transfers Our last bullet point deserves some explanation. Risk capital is the
econom ic capital
capital cushion that the bank must set aside to cover the worst-
where case loss (minus the expected loss) from market, credit, opera­
tional, and other risks, such as business risk and reputation risk, at
• E x p e c te d revenues are the revenues that the activity is
the required confidence threshold (e.g., 99 percent). Risk capital is
expected to generate (assuming no losses).
directly related to the value-at-risk calculation at the one-year time
• C o sts are the direct expenses associated with running the horizon and at the institution's required confidence level.
activity (e.g., salaries, bonuses, infrastructure expenses, and
Strategic risk capital refers to the risk of significant investments
so on).
about whose success and profitability there is high uncertainty.
• E x p e c te d lo sses, in a banking context, are primarily the
If the venture is not successful, then the firm will usually face
expected losses from default; they correspond to the loan
a major write-off, and its reputation will be damaged. Cur­
loss reserve that the bank must set aside as the cost of doing
rent practice is to measure strategic risk capital as the sum of
business. Because this cost, like other business costs, is
burned-out capital and goodwill. Burned-out capital refers to
priced into the transaction in the form of a spread over fund­
the idea that capital is spent on, say, the initial stages of start­
ing cost, there is no need for risk capital as a buffer to absorb
ing up a business but the business may ultimately not be kicked
this risk. Expected losses also include the expected loss from
off due to projected inferior risk-adjusted returns. It should be
other risks, such as market risk and operational risk.
viewed as an allocation of capital to account for the risk of stra­
• Taxes are the expected amount of taxes imputed to the activ­ tegic failure of recent acquisitions or other strategic initiatives
ity using the effective tax rate of the company. built organically. This capital is amortized over time as the risk of
• Return on risk capital is the return on the risk capital allo­ strategic failure dissipates. The goodwill element corresponds
cated to the activity. It is generally assumed that this risk to the investment premium— i.e., the amount paid above
capital is invested in risk-free securities, such as government the replacement value of the net assets (assets — liabilities)
bonds. when acquiring a company. (Usually, the acquiring company is

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 187

prepared to pay a premium above the
E x p e c te d R e v e n u e s
fair value of the net assets because it - Cost____________
places a high value on intangible assets ^ E xpected Losses
- Taxes
that are not recorded on the target's bal­ + Return on
After-Tax Economic Capita Loss (Outside of the
ance sheet.) Goodwill is also depreciated Risk-Adjusted -♦-/-Transfer Confidence Level)
Expected Return
over time.

Some banks also allocate risk capital for RAROC =

Capital = Difference
unused risk limits, because risk capacity E c o n o m ic C a p it a l : = 150 bp
15 bp
that can be tapped at any moment by R is k C a p i t a l
165 bp
* Credit Risk -► Expevted Loss
the business units represents a poten­ * Market Risk Probability of Losses
tially costly facility (in terms of the adjust­ * Operational Risk Greater than This Amount is
* Etc. Equal to 1%
ments to risk capital the firm as a whole
S t r a t e g i c R is k C a p i t a l (Confidence Level of 99%)
might have to make if the credit line
were drawn upon). Figure 12.1 T h e R A R O C eq u atio n .
Figure 12.1 shows the linkage between a
risk loss distribution and the RARO C calculation. We show both the $1 billion in borrowed funds). $10 million is the expected
the expected loss— in this example, 15 basis points (bps)— and loss, and $3.75 million (= 0.05 X $75 million) is the return on
the worst-case loss, 165 bps, at the desired confidence level (in economic capital.
this example, 99 percent) for the loss distribution derived over
The RAROC for this loan portfolio is 14 percent. This number
a given horizon, say one year. The unexpected loss is, there­
can be interpreted as the annual after-tax expected rate of
fore, the difference between the total loss and the expected
return on equity needed to support this loan portfolio.
loss— that is, 150 bps at the 99 percent confidence level— over
a one-year horizon. The unexpected loss corresponds to the risk
capital allocated to the activity. 12.5 RAROC FOR PERFORMANCE
Now that we understand the trickiest part of the RAROC equa­ MEASUREMENT
tion, unexpected loss, we can look at a practical example of how
to plug numbers into the RAROC equation. We should emphasize at this point that RARO C was first sug­
gested as a tool for capital allocation on an anticipatory or ex
Let us assume that we want to identify the RAROC of a $1 billion
ante basis. Hence, e x p e c te d revenues and losses should be
corporate loan portfolio that offers a headline return of 9 percent.
plugged into the numerator of the RARO C equation for capital
The bank has an operating direct cost of $9 million per annum and
budgeting purpose. When RARO C is used for ex post, or after
an effective tax rate of 30 percent. We'll assume that the portfo­
the fact, performance evaluation, we can use realized revenues
lio is funded by $1 billion of retail deposits with a transfer priced
and realized losses, rather than expected revenues and losses, in
interest charge of 6 percent. Risk analysis of the unexpected
our calculation.
losses associated with the portfolio tells us that we need to set
economic capital of around $75 million (i.e., 7.5 percent of the
loan amount) against the portfolio. We know that this economic RAROC Horizon
capital must be invested in risk-free securities, rather than being
All of the quantities that we plug into the RARO C equation must
used to fund risky activities, and that the risk-free interest rate
be calculated on the basis of a particular time horizon, such as a
on government securities is 5 percent. The expected loss on this
one-year horizon or over the lifetime of a deal.4 Box 12.3
portfolio is assumed to be 1 percent per annum (i.e., $10 million).

If we ignore transfer price considerations, then the after-tax

RARO C for this loan is: 4 This chapter focuses on single-period RAROC models, while some
large banks have moved to a multiperiod RAROC modeling approach in
(9 0 - 9 - 6 0 - 10 + 3.75)(1 - 0.3) order to better measure RAROC over the life of long-running transac­
R A R O C = -------------------------- —-------------------------- tions and loans. However, major methodological issues are still unre­
/b
solved when the risk of a transaction, such as a swap, or a portfolio
= 0.14 = 14% changes substantially from one period to the next. In that case, which
amount of economic capital should be allocated to the transaction or
where $90 million is the expected revenue, $9 million is the the portfolio? Allocating some average amount of capital would lead to
operating cost, $60 million is the interest expense (6 percent of undercapitalization and overcapitalization depending on the period.

188 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 12.3 RISK TYPES AND TIME HORIZONS
Risk capital can be characterized as the one-year value-at-risk Figure 12B.1 illustrates the calculation of risk capital when
exposure of the firm, at a confidence level consistent with the the core risk level is lower than the current risk position.
firm's target credit risk rating. But how does the time horizon in
Across every bank, there are many other activities that must
this characterization relate to the risk measurement approaches
be allocated capital in a way that is sensitive to time horizons.
for market risk, for credit risk, and for operational risk?
For example, the bank should allocate capital to cover the
For credit risk, there is a straightforward equivalence risk of options that are embedded in many of its products.
between the one-year VaR produced by credit portfolio The option to prepay a mortgage is one obvious example,
models, such as CreditM etrics or KMV, and risk capital. The but there are many subtle twists on the risks generated by
same is also true for operational risk: most internal models different types of products. For example, mortgage port­
used by institutions have a one-year horizon. Therefore, for folios in Canada often incur commitment risks. These arise
both credit risk and operational risk, there is no need for any because the consumer automatically receives the lowest
adjustment in the one-year VaR to determine risk capital. mortgage rate looking backward over a prescribed commit­
ment period, as a function of the specific type of mortgage.
However, this is not the case for market risk. For trading
In effect, the consumer has what derivatives practitioners call
businesses, market risk is measured using only short-term
a "look-back option." The seriousness of the commitment
horizons— one day for risk monitoring on a daily basis and 10
risk is governed by the length of the commitment period; it
days for regulatory capital. So how do we translate a one-day
represents the component that cannot be entirely eliminated
risk measure into one-year risk capital attribution?
by delta hedging (e.g., the basis risk between the whole­
One approach might be to use what is commonly called the sale rates and the mortgage rate). All these considerations
"square root of tim e" rule. That is, the risk analyst might need to be taken into account in determining the risk capital
approximate the one-year VaR by multiplying the one-day needed to support a Canadian mortgage business.
VaR by the square root of the number of business days in one
year— e.g., 252 days. If we did this, however, we'd be miss­
ing the point of risk capital. Risk capital is there to limit the VaR
risk of failure during a period of crisis, when the bank has
suffered huge losses. As a worst-case scenario unfolds, the
bank will naturally reduce its risk exposures in any way that
it can. In the case of a proprietary trading desk, with highly
liquid positions and no clients to service, this risk reduction
can take place very quickly indeed. For other activities, risk
can often be reduced only to a core risk level for the remain­
der of the year, defined as the minimum realistic size at
which the business can be considered to be a going concern
(i.e., can maintain its franchise).
Thus, to work out a meaningful one-year economic capital
allocation, we need to analyze the business in question so
that we can understand the tim e to red u ce from the current
risk position to the core risk level, which in turn reflects the
relative liquidity of positions during adverse market condi­ Risk capital = square root [sum of squares (100, 97.62, 95.24, ... , 52.38)
tions. Estimations of the time to reduce should not make the + 502 x 231]
assumption that there will be a fire sale, but instead assume = 839
a relatively orderly unwinding of positions. This can take = 52.8% x annualized VaR
where annualized VaR = 100 x square root (252)
considerable time in some markets, as firms discovered to
their cost in the 2007-2009 financial crisis. Fiaure 12B.1 Risk capital calculation fo r m arket risk.

discusses one problem that this brings up: how to harmonize the However, the choice of a risk horizon for RARO C is somewhat
different time horizons used to measure credit, market, and arbitrary. One could choose to measure the volatility of risk and
operational risk. Practitioners usually adopt a one-year time hori­ returns over a longer period of time, say 5 or 10 years, in order
zon, as this corresponds to the business planning cycle and is to capture the full effect of the business cycle in measuring risk.
also a reasonable approximation of the length of time it might Calculating economic capital over a longer period of time does
take to recapitalize the company if it were to suffer a major not necessarily increase capital, as the level of confidence in any
unexpected loss. firm's solvency that we require decreases as the time horizon

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 189

is extended. If this seems surprising, consider the probability
of default of an AA-rated firm to be around 3 basis points over BOX 12.4 TECHNICAL DISCUSSION:
a one-year period; while this probability of default naturally CALCULATING THE HURDLE RATE
increases if we look at the same firm over a two-year or five-
Most firms use a single hurdle rate, hAT, for all business
year period, this increase clearly does not affect the one-year activities, based on the after-tax weighted-average cost of
credit rating of the firm. However, one of the practical chal­ equity capital:
lenges is that the risk and return data beyond one year may be CE x + P E x r DP
r rP___________________________________
r E

of low quality. AT~ C E + PE

where C E and PE denote the market value of common
equity and preferred equity, respectively, and rCE and
Default Probabilities: Point-in-Time (PIT) rPE are the cost of common equity and preferred equity,
vs. Through-the-Cycle (TTC) respectively.
The cost of preferred equity is simply the yield on the firm's
A point-in-time (PIT) probability of default (PD), which is the
preferred shares. The cost of common equity is determined
approach of KMV and other econom ic/structural approaches, via a model such as the capital asset pricing model:
is reasonable for calculating near-term expected losses
(EL) and for pricing financial instruments that are subject to r CE = rf + " O
credit risk. A through-the-cycle (TTC) PD, which is largely the where ry is the risk-free rate, RM is the expected return on
approach taken by the rating agencies, is more reasonable for the market portfolio, and /3Ce is the firm's common equity
market beta.
calculating econom ic capital, current profitability, and strate­
gic decisions regarding products, geographies, and new busi­
ness ventures.

The probability of a firm's staying in the same rating when

Hurdle Rate and Capital Budgeting
it is assessed using a PIT approach is smaller than when it is Decision Rule
assessed using a T TC approach. The T TC approach therefore
Most firms use a single hurdle rate for all business activities:
reduces the volatility of economic capital, compared to PIT the after-tax weighted-average cost of equity capital. Box 12.4
approaches. It is useful on a periodic basis to compare the
explains in more technical detail how this hurdle rate is calcu­
impact of using PIT PD versus T TC PD in the RARO C calculation
lated. The hurdle rate should be reset periodically, say every six
for both a normal part of the economic cycle and the worst part
months, or when it has changed by more than 10 percent.
of the cycle.
When a firm is considering investing in a business or closing
down an activity, it computes the after-tax RARO C for the busi­
ness or activity and compares it to the firm's hurdle rate. In
Confidence Level
theory, the firm can then apply a simple decision rule:
We mentioned earlier that the confidence level in the economic
• If the RARO C ratio is greater than the hurdle rate, the activity
capital calculation should be consistent with the firm's target
is deemed to add value to the firm.
credit rating. For exam ple, most banks today hope to obtain
• In the opposite case, the activity is deemed to destroy value
an A A credit rating from the agencies for their debt offerings,
for the firm and the activity should be closed down or the
which implies a one-year probability of default of 3 to 5 basis
project rejected.
points. This, in turn, corresponds to a confidence level in the
range of 99.95 to 99.97 percent. We can think of this confi­ However, one can show that applying this simple rule can lead
dence level as the quantitative expression of the risk appetite to a firm's accepting high-risk projects that will lower the value
of the firm. of the firm and rejecting low-risk projects that will increase the
value of the firm .5 High-risk projects, such as oil exploration, are
Setting a lower confidence level may significantly reduce the
characterized by very volatile returns, while low-risk projects,
amount of risk capital allocated to an activity, especially when
such as properly risk-managed retail banking, produce steady
the institution's risk profile is dominated by operational, credit,
revenues with low volatility.
and settlement risks (for which large losses occur only with some
rarity). Therefore, the choice of the confidence level can materi­
ally affect risk-adjusted performance measures and the resulting 5 See Michel Crouhy, Stuart Turnbull, and Lee Wakeman, "Measuring
capital allocation decisions of the firm. Risk-Adjusted Performance," Journal of Risk 2(1), 1999, pp. 5-35.

190 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 taking into account all the correlation effects between market
BOX 12.5 ADJUSTING RAROC risk, credit risk, and operational risk across all the business units
FOR THE RISK OF RETURNS of a company. Instead, banks tend to adopt a bottom-up decen­
tralized approach, under which distinct risk models are run for
Ideally, we would like to adjust the traditional RAROC
calculation to obtain a RARO C measure that takes into each portfolio or business unit.
account the systemic riskiness of returns, and for which the For capital adequacy purposes, running these business-specific
hurdle rate (the critical benchmark above which a business
models at the confidence level targeted at the top of the house,
adds value) is the same across all business lines. To correct
the inherent limitations of the traditional RARO C measure, for example 99.97 percent, produces an unnecessarily large
let's adjust the RARO C ratio as follows: amount of overall risk capital, precisely because it neglects
diversification effects (across both risk types and business
Adjusted RA RO C = RA RO C - - rf )
activities). It is therefore common practice to adjust for the
where RM is the expected rate of return on the market diversification effects by lowering the confidence level used
portfolio, rf denotes the risk-free interest rate— say, the at the business level to, say, 99.5 percent or lower— an adjust­
interest rate paid on three-month Treasury bills— and /3E is
ment that is necessarily more of an educated guess than a strict
the beta of the equity of the firm. The new decision rule is:
risk calculation.
A ccept (re je ct) projects whose adjusted
R A R O C is greater (sm aller) than rf If this sounds unsatisfactory, we can at least put some boundar­
ies around the problem. The aggregate VaR figure obtained
The risk adjustment, (3{Rm — rf), is the excess return above by this approach should fall in between the two extreme cases
the risk-free rate required to compensate the sharehold­
of perfect correlation and zero correlation between risk types
ers of the firm for the nondiversifiable systematic risk they
bear when investing in the activity, assuming that the and across businesses. For example, ignoring business risk,
shareholders hold a well-diversified portfolio. When the reputation risk, and strategic risk, for illustrative purposes, sup­
returns are thus adjusted for risk, the hurdle rate becomes pose that we've calculated the risk capital for each type of risk
the risk-free rate. as follows:

Market risk = $ 2 0 0
Credit risk = $700
To overcome this, we need to make an important adjustment
Operational risk = $ 3 0 0
to the RARO C calculation so that the systematic riskiness of the
returns from a business activity is fully captured by the decision Then aggregate risk capital at the top of the house is either
rule (see Box 12.5).
Simple summation of the three risks
(perfect correlation) = $1,200
Diversification and Risk Capital or
The risk capital for a particular business unit within a larger firm Square root of the sum of squares of the three risks
is usually determined by viewing the business on a stand-alone (zero correlation) = $787
basis, using the top-of-the-house hurdle rate that we discussed
earlier. However, intuition suggests that the risk capital for the We can say with some confidence, therefore, that any proposed
firm should be significantly less than the sum of the stand-alone approach for taking diversification effects into account should
risk capital of the individual business units, because the returns produce an overall VaR figure in the range of $787 to $1,200.
generated by the various businesses are unlikely to be perfectly While the simple logic of our boundary setting makes sense,
correlated.6 these boundaries are pretty wide! They also leave us with the
Measuring the true level of this "diversification effect" is reverse problem: how do we allocate any diversification benefit
extremely problematic. As of today, there is no fully integrated that we calculate for the business as a whole back to the busi­
VaR model that can produce the overall risk capital for a firm, ness lines? The allocation of the diversification effect can be
important for certain business decisions, such as determining
the performance of each unit.
6 It should be noted that from a purely economic point of view, disre­ Logically, a business whose operating cash flows are strongly
garding strategic considerations, the decision to enter or exit a business
activity should be based on the risk and return parameters of the single correlated with the earnings of the other activities in the firm
business activity. should require more risk capital than a business with the same

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 191

 Combination of Economic Marginal Marginal • M arginal capital is the additional capital required by an
Businesses Capital Business Economic Capital incremental deal, activity, or business. It takes into account
X +Y $100 the full benefit of diversification. In our example, the mar­
X X ginal risk capital for X (assuming that Y already exists) is $30
$60 $40
($100 - $70), and the marginal risk capital for Y (assuming
Y $70 Y $30
that X already exists) is $40 ($100 — $60). In the case where
Diversification $30 Total $70
Effect more than two activities are included in the business unit BU,
marginal capital is calculated by subtracting the risk capital
F ig u re 1 2 .2 D iversificatio n effect. required for the BU without this business from the risk capital
required for the full portfolio of businesses. Note that the
summation of the marginal risk capital, $70 in our example, is
volatility whose earnings move in a countercyclical fashion. less than the full risk capital of the BU.
Bringing together countercyclical business lines produces stable
As this example shows, the choice of capital measure depends
earnings for the firm as a whole; the firm can then operate to
on the desired objective. Fully diversified measures should be
the same target credit rating with less risk capital.
used for assessing the solvency of the firm and minimum risk
In truth, institutions continue to struggle with the problem of pricing. Active portfolio management or business mix decisions,
attributing capital back to business lines, and there are diverg­ on the other hand, should be based on marginal risk capital,
ing views as to the appropriate approach. For the moment, as a taking into account the benefit of full diversification. Finally,
practical solution, most institutions allocate the portfolio effect performance measurement should involve both perspectives:
pro rata with the stand-alone risk capital. stand-alone risk capital for incentive compensation, and fully
Diversification effects also complicate matters within busi­ diversified risk capital to assess the extra performance gener­
ness units. Let's look at this and other issues in relation to an ated by the diversification effects.
example business unit, BU, which comprises two activities, X However, we must be cautious about how generous we are in
and Y (Figure 12.2). When calculating the risk capital of the busi­ attributing diversification benefits.7 Correlations between risk
ness unit, let's assume that the firm's risk analysts have taken factors drive the extent of the portfolio effect, and these corre­
into account all the diversification effects created by combining lations tend to vary over time. During market crises, in particular,
activities X and Y and that the risk capital for BU is $100. The correlations sometimes shift dramatically toward either 1 or —1,
complication starts when we try to allocate risk capital at the reducing or totally eliminating portfolio effects for a period
activity level within the business unit. There are three different of time.
measures of risk capital:

• Stand-alone capital is the capital used by an activity taken

independently of the other activities in the same business 12.6 RAROC IN PRACTICE
unit— that is, risk capital calculated without any diversification
benefits. In our example, the stand-alone capital for X is $60 Economic capital is increasingly a key element in the assessment
and that for Y is $70. The sum of the stand-alone capitals of of business line performance, in the decision to exit or enter a
the individual constituents of the business unit is generally business, and in the pricing of transactions. It also plays a critical
higher than the stand-alone risk capital of the business unit role in the incentive compensation plan of the firm. Adjusting
itself (it is equal only in the case of perfectly correlated activi­ incentive compensation for risk in this way is important, because
ties X and Y) . managers tend to align their performance to maximize whatever
performance measures are imposed on them.
• Fully d iversified capital is the capital attributed to each
activity X and Y, taking into account all diversification Needless to say, in firms in which RARO C has been imple­
benefits from combining them under the same leader­ mented, business units often challenge the risk management
ship. In our example, the overall portfolio effect is $30 function about the fairness of the amount of economic capital
($60 + $70 — $100). Allocating the diversification effect is attributed to them. The usual complaint is that their economic
an issue here. Following our earlier discussion, we'll allocate
the portfolio effect pro rata with the stand-alone risk capital,
7 For a discussion of the common economic capital aggregation tech­
$30 X 60/130 = $14 for X and $30 X 70/130 = $16 for Y, so
niques and how they capture diversification benefits, see Range of
that the fully diversified risk capital becomes $46 for X and Practices and Issues in Economic Capital Frameworks, BIS, March 2009,
$54 for Y. pp. 24-31.

192 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
capital attribution is too high (never that it is too low!). Another down when the credit environment improves and goes up
complaint is that economic capital attribution is sometimes too when it deteriorates)? For market risk, volatility and correla­
unstable— the numbers can move up and down in a way that is tion parameters should be updated at least every month,
disconcerting for a business trying to hit a target. using standard statistical techniques. Other key factors, such
as the core risk level and "time to reduce" (see Box 12.3),
The best way to defuse this debate is for the RARO C group to
should be reviewed on an annual basis. For operational risk,
be transparent about the methodology used to assess risk and
the risk measurement approach is currently more judgmental
to institute forums where the issues related to the determination
and, as such, more open to heated discussions!
of economic capital can be debated and analyzed. From our
own experience, the VaR methodologies for measuring market 4. Maintaining the integrity o f the process. A s with other risk
risk and credit risk that underpin RARO C calculations are gener­ calculations, the validity of RAROC numbers depends critically
ally well accepted by business units (although this is not yet true on the quality of the data about risk exposures and positions
for operational risk). It's the setting of the parameters that feed collected from the management systems (e.g., in a trading
into these models, and that drive the size of economic capital, business, the front- and back-office systems). Only a rigorous
that causes acrimony. process of data collection and centralization can ensure accu­
rate risk and capital assessment. The same rigor should also
Here are a number of recommendations for implementing a
be applied to the financial information needed to estimate the
RARO C system:
adjusted-return element of the RAROC equation. Data collec­
1. Sen io r m anagem ent com m itm ent. Given the strategic tion is probably the most daunting task in risk management.
nature of the decisions steered by a RAROC system, the But the best recipe for failure in implementing a RAROC sys­
marching orders must come from the top management of tem is to base calculations on inaccurate and incomplete data.
the firm. Specifically, the C EO and his or her executive team The RAROC group should be accountable for the integrity of
should sponsor the implementation of a RARO C system and the data collection process, the calculations, and the report­
should be active in the diffusion, within the firm, of a new ing process. The business units and the finance group should
culture in which performance is measured in terms of con­ be accountable for the integrity of the specific data that they
tribution to shareholder value. The message to push down produce and feed into the RAROC system.
to the business lines is this: What counts is not how much
5. C om bine R A R O C with qualitative factors. Earlier in this
income is generated, but how well the firm is compensated
chapter, we described a simple decision rule for project
for the risks that it is taking on.
selection and capital attribution— i.e., accept projects where
2. Com m unication and education. The RAROC group should the RARO C is greater than the hurdle rate. In practice,
be transparent and should explain the RARO C methodol­ other qualitative factors should be taken into consideration.
ogy not only to the business's heads but also to the busi­ All the business units should be assessed in the context of
ness line managers and the CFO 's office, in order to gain the two-dimensional strategic grid shown in Figure 12.3.
acceptance of the methodology throughout all the manage­ The horizontal axis of this figure corresponds to the RAROC
ment layers of the firm.

3. O ngoing consultation. The firm should institute a forum such Quality of Earnings: Strategic Importance/Long-Term Growth Potentia
as a "parameter review group" that periodically reviews the
key parameters that drive risk and economic capital. This
group, composed of key representatives from the business
units and the risk management function, will bring legiti­
macy to the capital allocation process. For credit risk, the
parameters that should be reviewed include probabilities
of default, credit migration frequencies, loss given default,
and credit line usage given default. These parameters evolve
over the business cycle and should be adjusted as more
data become available. An important issue to settle is the
choice of a historical period over which these parameters
are calibrated— i.e., should this be the whole credit cycle (in
order to produce stable risk capital numbers) or a shorter
period of time to make capital more procyclical (capital goes F ig u re 1 2 .3 S tra te g ic grid.

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 193

 return calculated on an ex ante basis. The vertical axis Bank Management
is a qualitative assessment of the quality of the earnings
produced by the business units. This measure takes into
consideration the strategic importance of the activity for
the firm, the growth potential of the business, the sustain­
ability and volatility of the earnings in the long run, and any
synergies with other critical businesses in the firm. Priority Safety < ► Profitability
in the allocation of balance sheet resources should be given • Debt Holders • Shareholders
to the businesses in the upper right quadrant. A t the other • Deposit Holders • Analysts
• Counterparties on Derivatives
extreme, the firm should try to exit, scale down, or fix the • Transaction
activities of businesses that fall into the lower left quadrant. • Regulators
• Deposits Insurance Company
The businesses in the category "managed growth," in the
• Rating Agencies
lower right quadrant, are high-return activities that have low
strategic importance for the firm. In contrast, businesses in Fiq u re 1 2 .4 H ow R A R O C b alan ce s th e d e sire s
the category "investm ent," in the upper left quadrant, are various sta k e h o ld e rs.
currently low-return activities that have high growth poten­
tial and high strategic value for the firm.
such as energy trading companies. W herever risk capital is an
6 . Put an active capital m anagem ent p ro cess in place. Balance important concern, RARO C balances the divergent desires of
sheet requests from the business units, such as economic cap­ the various external stakeholders, while also aligning them with
ital, leverage ratio, liquidity ratios, and risk-weighted assets, the incentives of internal decision makers (Figure 12.4). When
should be channeled to the RAROC group every quarter. Lim­ business units (or transactions) earn returns in excess of the
its are then set for economic capital, leverage ratio, liquidity hurdle rate, shareholder value is created, while the allocated risk
ratios, and risk-weighted assets based on the kind of analysis capital indicates the amount of capital required to preserve the
we've discussed in this chapter. The treasury group often desired credit rating.
reviews limits to ensure that they are consistent with fund­
RAROC information allows senior managers to better under­
ing limits. This limit-setting process is a collaborative effort,
stand where shareholder value is being created and where it is
with any disagreements about the amount of balance sheet
being destroyed. It promotes strategic planning, risk-adjusted
resources attributed to a business put to arbitration by the
profitability reporting and incentive compensation schemes,
senior executive team. Leverage ratios may restrain manage­
proactive allocation of resources, better management of con­
ment from growing the bank beyond a certain level, but this
centration risk, and better product pricing.
in itself makes it more important that banks work every dollar
of capital hard— and RAROC analysis is one way to do this. Because RAROC is not just a common language of risk, but a
quantitative technique, we can also think of a RAROC-based
capital budgeting process as akin to an internal capital market
CONCLUSION in which businesses are competing with one another for scarce
balance sheet resources— all with the objective of maximizing
RARO C systems, developed first by large financial institutions, shareholder value. This makes RAROC a useful tool for capital
are being implemented in smaller banks and other trading firms, allocation, both for banks and for nonbank corporations.

194 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Range of Practices
and Issues in
Economic Capital
Frameworks
Learning Objectives
After completing this reading you should be able to:

Within the economic capital implementation framework, Explain benefits and impacts of using an economic capital
describe the challenges that appear in: framework within the following areas:
Defining and calculating risk measures Credit portfolio management
Risk aggregation Risk based pricing
Validation of models Customer profitability analysis
Dependency modeling in credit risk Management incentives
■ Evaluating counterparty credit risk
■ Assessing interest rate risk in the banking book Describe best practices and assess key concerns for the
governance of an economic capital framework.
Describe the BIS recommendations that supervisors
should consider to make effective use of internal risk
measures, such as economic capital, that are not designed
for regulatory purposes.

E x c e rp t is rep rin ted by perm ission from the Basel C om m ittee on Banking Supervision.

195
13.1 EXECUTIVE SUMMARY Therefore it covers issues related to the use and governance
of economic capital, the choice of risk measures, aggregation
Economic capital can be defined as the methods or practices of risk, and validation of economic capital. In addition, three
that allow banks to consistently assess risk and attribute capital important building blocks of economic capital (dependency
to cover the economic effects of risk-taking activities. Economic modelling in credit risk, counterparty credit risk and interest
capital was originally developed by banks as a tool for capital rate risk in the banking book) are examined in separate, stand­
allocation and performance assessment. For these purposes, alone annexes. This list of building blocks is chosen due to the
economic capital measures mostly need to reliably and accu­ significance and complexity of the topics, and (with the excep­
rately measure risks in a relative sense, with less importance tion of counterparty credit risk) partly because the topics are not
attached to the measurement of the overall level of risk or capi­ covered in Pillar 1 of the Basel II Framework. This list is by no
tal. Over time, the use of economic capital has been extended means exhaustive.
to applications that require accuracy in estimation of the level of
capital (or risk), such as the quantification of the absolute level Use of Economic Capital and Governance
of internal capital needed by a bank. This evolution in the use of
economic capital has been driven by both internal capital man­ The robustness of economic capital and the governance and

agement needs of banks and regulatory initiatives, and has been controls surrounding the process have become more critical as

facilitated by advances in risk quantification methodologies and the use of economic capital has extended beyond relative risk

the supporting technological infrastructure. measurement and performance to the determination of the
adequacy of a bank's absolute level of capital.
While there has been some convergence in the understand­
ing of key concepts of economic capital across banks with such The viability and usefulness of a bank's economic capital pro­

frameworks in place, the notion of economic capital has broad­ cesses depend critically on the existence of a credible com­

ened overtim e. This has occurred in terms of the underlying mitment or "buy-in" on the part of senior management to the

risks (or building blocks) that are combined into an overall eco­ process. In order for this to occur, it is necessary for senior

nomic capital framework and also in terms of the relative accep­ management to recognise the importance of using economic

tance and use of economic capital across banks. capital measures in conducting the bank's business. In addition,
adequate resources are required to ensure the existence of a
Economic capital can be analysed and used at various levels—
strong, credible infrastructure to support the economic capital
ranging from firm-wide aggregation, to risk-type or business-line process. Economic capital model results should be transparent
level, and down further still to the individual portfolio or expo­
and taken seriously in order to be useful for business decisions
sure level. Many building blocks of economic capital, therefore,
and risk management. A t the same time, management should
are complex and raise challenges for banks and supervisors.
fully understand the limitations of economic capital measures.
In particular, Pillar 2 (supervisory review process) of the Basel
Moreover, senior management needs to take measures to help
II Framework may involve an assessment of a banks' economic
ensure the meaningfulness and integrity of economic capital
capital framework. Accordingly, this paper makes recommen­
measures. It should also seek to ensure that the measures com­
dations of particular interest to supervisors and bankers where
prehensively capture all risks and implicit and/or explicit man­
economic capital models are used in the supervisory dialogue.
agement actions embedded in measurement processes are both
In addition, supervisors have an interest in promoting robust,
realistic and actionable.
transparent and effective risk management, which in many cases
requires an understanding of banks economic capital fram e­
works. Nevertheless, it is recognised that economic capital is a Risk Measures
business tool developed and used by individual institutions for
Banks use a variety of risk measures for economic capital pur­
internal risk management purposes.
poses with the choice of risk measure dependent on a number
This paper emphasises the importance of understanding the of factors. These include the properties of the risk measure, the
relationship between overall economic capital and its building risk- or product-type being measured, data availability, trade­
blocks, as well as ensuring that the underlying building blocks offs between the complexity and usability of the measure, and
(individual risk assessments) are measured in a consistent and the intended use of the risk measure. While there is general
coherent fashion. The main body of the paper focuses on issues agreement on the desirable properties a risk measure should
associated with the overall economic capital process, rather have, there is no singularly preferred risk measure for economic
than on the component risks measured by economic capital. capital purposes. All risk measures observed in use have

196 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
advantages and disadvantages which need to be understood a complex model works satisfactorily. Moreover, a model may
within the context of their intended application. embody assumptions about relationships between variables or
about their behaviour that may not hold in all circumstances
(e.g., under periods of stress). Validation can provide a degree
Risk Aggregation
of confidence that the assumptions are appropriate, increasing
One of the more challenging aspects of developing an eco­ the confidence of users (internal and external to the bank) in
nomic capital framework relates to risk aggregation. the outputs of the model. Additionally, validation can be also
useful in identifying the limitations of economic capital models,
Practices and techniques in risk aggregation are generally less
i.e., where embedded assumptions do not fit reality.
sophisticated than the methodologies that are used in measur­
ing individual risk components. They rely heavily on ad-hoc The validation of economic capital models is at a very prelimi­
solutions and judgment without always being theoretically nary stage. There exists a wide range of validation techniques,
consistent with the measurement of the components. Most each of which provides evidence for (or against) only some of
banks rely on the summation of individual risk components the desirable properties of a model. Moreover, validation tech­
either equally-weighted (i.e., assuming no diversification or a niques are powerful in some areas such as risk sensitivity but not
fixed percentage of diversification gains across all components) in other areas such as overall absolute accuracy or accuracy in
or weighted by an estimated variance-covariance matrix that the tail of the loss distribution. Used in combination, particularly
represents the co-movement between risks. Few banks attempt in combination with good controls and governance, a range of
technically more sophisticated aggregation methods such as validation techniques can provide more substantial evidence for
copulas or even bottom-up approaches that build overall eco­ or against the performance of the model. There appears to be
nomic estimates from the common relationship of individual risk scope for the industry to improve the validation practices that
components to underlying factors. shed light on the overall calibration of models, particularly in
cases where assessment of overall capital is an important appli­
Validation is a general problem with aggregation techniques.
cation of the model.
Diversification benefits embedded in inter-risk aggregation
processes (including in the estimation of entries in the variance-
covariance matrix) are often based on (internal or external)
Dependency Modelling in Credit Risk
"expert judgm ent" or average industry benchmarks. These have Portfolio credit risk models form a significant component of
not been (and very often cannot be) compared to the actual his­ most economic capital frameworks. A particularly important and
torical or expected future experience of a bank, due to lack of difficult aspect of portfolio credit risk modelling is the modelling
relevant data. of the dependency structure, including both linear relationships

Since individual risk components are typically estimated without and non-linear relationships, between obligors. Dependency

much regard to the interactions between risks (e.g., between modelling is an important link between the Basel II risk weight

market and credit risk), the aggregation methodologies used function (with supervisory imposed correlations) and portfolio

may underestimate overall risk even if "no diversification" credit risk models which rely on internal bank modelling of

assumptions are used. Moreover, harmonisation of the measure­ dependencies. Understanding the way dependencies are mod­

ment horizon is a difficult issue. For example, extending the elled is important for supervisors when they examine a bank's

shorter horizon applied to market risk to match the typically- internal capital adequacy assessment process (ICAAP) under

used annual horizon of economic capital assessments for other Pillar 2, since these dependency structures are not captured in

types of risk is often performed by using a square root of time regulatory capital measures.

rule on the economic capital measure. This simplification can The underlying methodologies applied by banks in the area of
distort the calculation. Similar issues arise when risk measured dependency modelling in credit risk portfolios have not changed
at one confidence level is then scaled to become (nominally) much over the past ten years. Rather, improvements have been
comparable with other risk components measured at a different made in the infrastructure supporting the methodologies (e.g.,
confidence level. improved databases) and better integration with internal risk
measurement and risk management. The main concern in this
area of economic capital continues to centre on the accuracy
Validation
and stability of correlation estimates, particularly during times of
Economic capital models can be complex, embodying many stress. The correlation estimates provided by current models still
component parts and it may not be immediately obvious that depend heavily on explicit or implicit model assumptions.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 197

Counterparty Credit Risk schedules less suitable for the calculation of economic capital.
Most banks use simulation approaches for determining their
The measurement and management of counterparty credit risk economic capital, based on losses that would occur given a set
creates unique challenges for banks. Measurement of counter­ of worst case scenarios. The magnitude of such losses and their
party credit risk represents a complex exercise, as it involves probability of occurrence determine the amount of economic
gathering data from multiple systems; measuring exposures capital. The choice of the techniques depends on the bank's
from potentially millions of transactions (including an increas­ preference towards either economic value or earnings, and
ingly significant percentage that exhibit optionality) spanning also on the type of business. Some businesses, such as com­
variable time horizons ranging from overnight to thirty or more mercial lending or residential mortgage lending, are managed
years; tracking collateral and netting arrangements; and cat­ on a present value basis, while others such as credit cards are
egorising exposures across thousands of counterparties. managed on an earnings basis. The use of an earnings based
This complexity creates unique market-risk-related challenges measure creates aggregation challenges when other risks are
(requiring calculations at the counterparty level and over mul­ measured on the basis of economic capital. Conversely, the use
tiple and extended holding periods) and credit risk-related of an economic value based approach may create inconsisten­
challenges (estimation of credit risk parameters for which the cies with business practices.
institution may not have any other exposures). In addition,
wrong-way risk, operational risk-related challenges, differences
Summary
in treatment between margined and non-margined counterpar­
ties, and a range of aggregation challenges need to be over­ Economic capital modelling and measurement practices
come before a firm can have a bank-wide view of counterparty continue to evolve. In some aspects, practices have converged
credit risk for economic capital purposes. Banks usually employ and become more consistent over time, however the notion of
one of two general modelling approaches to quantify coun­ economic capital has broadened as its use has expanded. There
terparty credit risk exposures, a value-at-risk (VaR)-type model remain significant methodological, implementation and business
or a Monte Carlo Simulation approach. The decision of which challenges associated with the application of economic capital in
approach to use involves a variety of trade-offs. The VaR-type banks, particularly if economic capital measures are to be used
model cannot produce a profile of exposures over time, which for internal assessments of capital adequacy. These challenges
is necessary for counterparties that are not subject to daily relate to the overall architecture of economic capital modelling
margining agreements, whereas the simulation approach uses and to the underlying building blocks.
a simplified risk factor representation and may therefore be
less accurate. While these models may be supplemented with
complementary measurement processes such as stress testing, 13.2 RECOMMENDATIONS*1
such diagnostics are frequently not fully comprehensive of all
counterparty credit risk exposures. Economic capital models and the overall frameworks for their
internal use can provide supervisors with information that is
complementary to other assessments of bank risk and capital
Interest Rate Risk in the Banking Book
adequacy. While there is benefit from engaging with banks on
The main challenges in the calculation of economic capital for the design and use of the models, supervisors should guard
interest rate risk in the banking book relate to the long holding against placing undue reliance on the overall level of capital
period for balance sheet assets and liabilities and the need to implied by the models in assessing capital adequacy. The follow­
model indeterminate cash flows on both the asset and liability ing recommendations identify issues that should be considered
side due to embedded optionality in many banking book items. by supervisors in order to make effective use of internal mea­
If not adequately measured and managed, the asymmetrical sures of risk that are not designed for regulatory purposes.
payoff characteristics of instruments with embedded option fea­
1. Use of economic capital models in assessing capital
tures can present risks that are significantly greater than the risk
adequacy. A bank using an economic capital model in its
measures suggest.
dialogue with supervisors, should be able to demonstrate
The two main techniques for assessing interest rate risk in the how the economic capital model has been integrated into
banking book are repricing schedules (gap and duration analy­ the business decision-making process in order to assess
ses) and simulation approaches. Although commonly used, the its potential impact on the incentives affecting the bank's
simple structure and restrictive assumptions make repricing strategic decisions about the mix and direction of inherent

198 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 risks. The bank's board of directors should also be able to 6. Risk aggregation. A bank's aggregation methods should
demonstrate conceptual awareness and understanding of address the implications stemming from the definition and
the gap between gross (stand alone) and net enterprise measurement of individual risk components. The accuracy of
wide (diversified) risk when they define and communicate the aggregation process depends on the quality of the mea­
measures of the bank's risk appetite on a net basis. surement of individual risk components, as well as on the

2. Senior management. The viability, usefulness, and ongoing interactions between risks embedded in the measurement

refinement of a bank's economic capital processes depend process. Aggregation of individual risk components often

critically on the existence of credible commitment or "buy- requires the harmonisation of risk measurement parameters

in" on the part of senior management to the process. In such as the confidence level or measurement horizon.

order for this to occur, senior management should recog­ Care must be taken to ensure that the aggregation meth­
nise the importance of using economic capital measures odologies used (e.g., variance-covariance matrices, use of
in conducting the bank's business and capital planning, broad market proxies, and simple industry averages of cor­
and should take measures to ensure the meaningfulness relations) are, to the extent possible, representative of the
and integrity of economic capital measures. In addition, bank's business composition and risk profile.
adequate resources should be committed to ensure the
7. Validation. Economic capital model validation should be
existence of a strong, credible infrastructure to support the
conducted rigorously and comprehensively. Validation of
economic capital process.
economic capital models should be aimed at demonstrating
3. Transparency and integration into decision-making. A that the model is fit for purpose. Evidence is likely to come
bank should effectively document and integrate economic from multiple techniques and tests. To the extent that a
capital models in a transparent way into decision-making. bank uses models to determine an overall level of economic
Economic capital model results should be transparent and capital, validation tools should demonstrate to a reason­
taken seriously in order to be useful to senior management able degree that the capital level generated by the model
for making business decisions and for risk management. is sufficient to absorb losses over the chosen horizon up to
A bank should take a careful approach to its use of eco­ the desired confidence level. The results of such validation
nomic capital in internal assessments of capital adequacy. work should be communicated to senior management to
For this purpose, greater emphasis should be placed on enhance economic capital model usage.
achieving robust estimates of stand-alone risks on an abso­
8. Dependency modelling in credit risk. Since the depen­
lute basis, as well as developing the flexible capacity for
dency structures embedded in portfolio credit risk models
enterprise-wide stress testing.
have an important impact on the determination of eco­
4. Risk identification. Risk measurement begins with a robust, nomic capital needs for credit risk, banks should carefully
comprehensive and rigorous risk identification process. If assess the extent to which the dependency structures they
relevant risk drivers, positions or exposures are not cap­ use are appropriate for their credit portfolio. Banks should
tured by the quantification engine for economic capital, identify and understand the main limitations of their credit
there is great room for slippage between inherent risk and portfolio models and their implementation. They should
measured risk. address those limitations by using adequate supplementary
Not all risks can be directly quantified. Material risks that risk management approaches (e.g., sensitivity analysis, sce­
are difficult to quantify in an economic capital framework nario analysis, timely review of parameters).
(e.g., funding liquidity risk or reputational risk) should be 9. Counterparty credit risk. A bank should understand the
captured in some form of compensating controls (sensitivity trade-offs involved in choosing between the currently used
analysis, stress testing, scenario analysis or similar risk con­ methodologies for measuring counterparty credit risk. Com ­
trol processes). plementary measurement processes such as stress testing
5. Risk measures. All risk measures observed in use have should also be used, though it should be recognised that such
advantages and disadvantages which need to be under­ approaches may still not fully cover all counterparty credit
stood within the context of their intended application. risk exposures. The measurement of counterparty credit risk
There is no singularly preferred risk measure for economic is complex and entails unique market and credit risk related
capital purposes. A bank should understand the limitations challenges. A range of aggregation challenges needs to be
of the risk measures it uses, and the implications associated overcome before a firm can have a bank-wide view of coun­
with its choice of risk measures. terparty credit risk for economic capital purposes.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 199

10. Interest rate risk in the banking book. Close attention Many banks appear to be sufficiently comfortable in using their
should be paid to measuring and managing instruments economic capital framework in discussions with external stake­
with embedded option features, which if not adequately holders. Moreover, to varying degrees of granularity, banks have
performed can present risks that are significantly greater in recent years disclosed qualitative and quantitative aspects of
than suggested by the risk measure. Trade-offs between their economic capital, including economic capital model
using an earnings-based or economic value based approach descriptions, risk thresholds, methodologies for particular risks,
to measuring interest rate risk in the banking book need to use of economic capital, capital allocation by risk type and busi­
be recognised. The use of an earnings based measure cre­ ness units, and diversification estim ates.2
ates aggregation challenges when other risks are measured
Despite the advances that have been made by banks in devel­
on the basis of economic value. Conversely, the use of an
oping their economic capital models, the further use and rec­
economic value based approach may create inconsistencies
ognition of risk measures derived from these models remain
with business practices.
subject to significant methodological, implementation and busi­
ness challenges. These challenges stem from:

13.3 INTRODUCTION1 • the wide variety of applications of economic capital models

(from business-line use to firm-wide decision-making to capi­
Economic capital, which can be defined as the methods or prac­ tal adequacy assessments);
tices that allow financial institutions to consistently assess risk • methodological challenges (particularly in the area of risk
and to attribute capital to cover the economic effects of risk­ aggregation, coverage of risks, validation challenges, and
taking activities, has increasingly become an accepted input into risks that are not easily quantifiable);
decision-making at various levels within banking organisations.
• the ability of economic capital models to adequately reflect
Economic capital measures may be one of several key factors
business-line operating practices and therefore provide
used to inform decision-making in areas such as profitability,
appropriate incentives to business units;
pricing, and portfolio optimisation— particularly at the business­
• potential gaps in the coverage of risks (e.g., valuation risks in
line level. Economic capital measures may also feed into senior
structured credit products);
management decisions relating to issues such as acquisitions
and divestitures. Such measures are also used, primarily at the • the feasibility of any single risk measure to capture ade­
consolidated entity level, to assess overall capital adequacy. The quately all the complex aspects of banking risks; and
increased use of economic capital by banks has been driven by • the ability of economic capital models to be extended from
rapid advances in risk quantification methodologies, greater being used as a common metric for relative risk measurement
complexity and sophistication of banks' portfolios, and super­ and performance to the determination of the adequacy of
visory expectations that banks must develop internal processes the absolute level of capital.
to assess capital adequacy, beyond regulatory capital adequacy
This paper provides an overview of the range of practices in
guidelines that are not designed to fully reflect all the underly­
economic capital modelling at large banking organisations, and
ing material risks in a given bank's business activities.
based on this review discusses a range of issues and challenges
Across banks there has been a narrowing in the range of defini­ surrounding economic capital models. The paper also discusses
tions and treatment of the majority of risks that form the build­ practices implemented by banks that attempt to address these
ing blocks of economic capital models, particularly the risks that challenges, and supervisory concerns relating to the current
are more readily quantifiable. At the same time, however, the state of practice.
notion of economic capital is broadening in terms of the risks
As economic capital has to varying degrees become a com­
that it encompasses and the extent to which it is gaining accep­
ponent of many banks' internal capital adequacy assessment
tance across banks. That is, the inputs (or risks) that feed into
processes (ICAAP), this paper is addressed to banks that have
the measurement of economic capital are subject to ongoing
implemented or are considering implementing economic capi­
change and evolution.
tal into their internal processes. The paper is also addressed
to supervisors, who are required under Pillar 2 of the Basel II
1 This paper was prepared by the Basel Committee's Risk Management
Framework, to review and evaluate banks' internal capital ade­
and Modelling Group (RMMG). The RMMG comprises risk management
specialists and supervisors from member countries within and outside quacy assessments.
the Basel Committee. The RMMG has developed its views based on
information sourced from a wide range of presentations and documents
provided by banks, supervisors and other industry participants. 2 See Samuel (2008).

200 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The main body of this paper focuses on aspects of the overall measurement and pricing profitability analysis followed by
architecture of economic capital models. First, the paper cov­ (ii) enterprise-wide relative performance measurement that
ers the use of economic capital models and the governance and migrates to capital budgeting/planning, acquisition/divestiture
control framework. Second, it reviews the range of risk measures analysis, external reporting and internal capital adequacy assess­
used by banks in their economic capital models. Next, it cov­ ment processes.
ers the range of practice in risk aggregation methods before
the paper moves to issues arising in the validation of economic
capital models. The main body of the paper therefore focuses on Business-Level Use
issues that are at a level above that of individual risks. The paper The effective use of economic capital at the business-unit level
does not discuss the estimation of important building blocks of depends on how relevant the economic capital allocated to
economic capital models, such as the estimation of probability or absorbed by a business unit is with respect to the decision­
of default (PD), loss given default (LGD) and exposure at default making processes that take place within it. Frequently, the
(EAD) in credit risk models. This is not to say that estimation of
success or failure of an economic capital framework in a bank
these parameters is simple or without issues. Rather, these issues can be assessed by looking at how business line managers
are outside the scope of this work and have been covered in
perceive the constraints economic capital imposes and the
detail in other publications. Nevertheless, the annexes to this opportunities it offers in the following areas: (i) credit portfolio
chapter discuss three building blocks of economic capital models, management; (ii) risk-based pricing; (iii) customer profitability
namely dependency modelling in credit risk, counterparty credit analysis, customer segmentation, and portfolio optimisation;
risk and interest rate risk in the banking book. These topics are and (iv) management incentives.
given closer attention in this paper due to a combination of their
significance, inherent challenges and (with the exception of coun­ Credit Portfolio Management
terparty credit risk) partly because the topics are not covered in
Pillar 1 (minimum capital requirements) of the Basel II Framework. Credit portfolio management refers to activities in which banks

Should the need arise, further work on other significant elements assess the risk/return profiles of credit portfolios and enhance

of economic capital may be undertaken in the future. their profitability through credit risk transfer transactions and/
or control of the loan approval process. In credit portfolio man­
Finally, it is worth noting that this work was initiated well before agement, the creditworthiness of each borrower is assessed in
the market turmoil that began in August 2007. This paper there­ a portfolio setting. A loan with a higher stand-alone risk does
fore examines general issues that are deemed to be relevant for not necessarily contribute more risk to the portfolio. A loan's
economic capital modelling. It does not attempt to analyse or marginal contribution to the portfolio, as a result, is critical to
assess the performance of economic capital models during the
assessing the concentration of the portfolio. Economic capital
market turmoil. is a measurement of the level of concentration. It is one of the
factors used to determine which hedging facilities to employ
in reducing concentration. According to the results presented
13.4 USE OF ECONOMIC CAPITAL in Rutter Associates LLC (2004), the use of credit portfolio
MEASURES AND GOVERNANCE management for reducing economic capital seems to be less
dominant than for "management of concentrations" and for
In order to achieve a common measure across all risks and busi­ "protection against risk deterioration."
nesses, economic capital is often parameterised as an amount
of capital that a bank needs to absorb unexpected losses over Risk-Based Pricing
a certain time horizon at a given confidence level. Because
The relevance of allocated economic capital for pricing certain
expected losses are accounted for in the pricing of a bank's
products (especially traditional credit products) is widely recog­
products and loan loss provisioning, it is only unexpected losses
nised. In theory, under the assumption of competitive financial
that require economic capital. Economic capital analysis typically
markets, prices are exogenous to banks, which act as price-
involves an identification of the risks from certain activities or
takers and assess the expected return (ex ante) and/or perfor­
exposures, an attempt to measure and quantify those risks, the
mance (ex post) of deals by means of risk-adjusted performance
aggregation of those risks, and an attribution or allocation of
measures, such as the risk-adjusted return on capital (RAROC).
capital to those risks.
In practice, however, markets are segmented. For example, the
Historically, banks have followed a path in their use of eco­ market for loans can be viewed as composed of a wholesale
nomic capital that begins with (i) business unit-level portfolio segment, where banks tend to behave more as price-takers,

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 201

and a commercial banking segment, where, due to well-known more efficiently to more profitable relationships. This task is
market imperfections (e.g., information asymmetries, monitor­ generally accomplished by segmenting customers in terms of
ing costs, etc.), banks have a greater ability to set prices for ranges of (net) return per unit of risk. Provided the underlying
their customers. inputs have been properly measured and allocated (not a simple
task as it concerns risks and, even more, costs), this technique
From an operational point of view, the difference is not so
provides a straightforward indication of areas for intervention in
straightforward, as decisions on deals will be based on ex ante
assessing customer profitability.
considerations with regard to expected RARO C in a price-taking
environment (leading to rejection of deals whose RAROC is By providing evidence on the relative risk-adjusted profitabil­
below a given threshold) and on the proposal of a certain price ity of customer relationships (as well as products), economic
(interest rate) to the customer in a price-setting environment. In capital can be used in optimising the risk-return trade-off in
both cases, decisions are driven by a floor (the minimum RAROC bank portfolios.
or minimum interest rate) computed according to the amount of
economic capital allocated to the deal.
Management Incentives
Risk-based pricing typically incorporates the variables of a
To become deeply engrained in internal decision-making
value-based management approach. For example, the pricing
processes, the use of economic capital needs to be extended
of credit risk products will include the cost of funding (such as
in a way that directly affects the objective functions of decision­
an internal transfer rate on funds), the expected loss (in order
makers at the business unit level. This is achieved by influenc­
to cover loan loss allowances), the allocated economic capital,
ing the incentive structure for business-unit management.
and extra-return (with respect to the cost of funding) as required
Anecdotal evidence suggests that incentives are the most
by shareholders. Economic capital influences the credit process
sensitive element for the majority of bank managers, as well
through the computation of a (minimum) interest rate consid­
as being the issue that motivates their getting involved in the
ered to be adequate for increasing (or, at least, not decreasing)
technical aspects of the economic capital allocation process.
shareholders' value. Depending on the product and the internal
However, evidence suggests that compensation schemes rank
rules governing the credit process, decisions regarding prices
quite low among the actual uses of economic capital measures
can sometimes be overridden. For example, this situation could
at the business unit level.
occur because of consideration about the overall profitability
of the specific customer relationship, or its desirability (e.g.,
due to reputational side-effects stemming from maintenance of
Enterprise-Wide or Group-Level Use
the customer relationship, even when it proves to be no longer
economically profitable). Generally, these exceptions to the rule Economic capital provides banks with a common currency for
are strictly monitored and require the decision be elevated to a measuring, monitoring, and controlling: (i) different risk types;
higher level of management. and (ii) the risks of different business units. The risk types that
are typically covered by banks' economic capital models are
Customer and Product Profitability Analysis, credit risk, market risk (including interest rate risk in the bank­
Customer Segmentation and Portfolio ing book— IRRBB) and operational risk. Concentration risk as an
Optimisation aspect of credit risk is also common. Other risks included are
business/strategic risk, counterparty credit risk, insurance risk,
Regardless of the role played by the bank as a price-taker or a
real estate risk and model risk.
price-maker, the process cannot be considered complete until
feedback has been provided to management about the final Quantitative approaches are generally applied to credit risk
outcome of the decisions taken. The measurement of perfor­ (including concentration and counterparty credit risk), market
mance can be extended down to the customer level, through risk, interest rate risk in the banking book and operational
the analysis of customer profitability. Such an analysis aims at risks. Strategic and reputational/legal risks are more likely to
providing a broad and comprehensive view of all the costs, reve­ be assessed by non-quantitative approaches (with an exception
nues and risks (and, consequently, economic capital absorption) being where reputational/legal risks are subsumed in opera­
generated by each single customer relationship. tional risk). For these risks, no best practices have emerged so
far within the industry. Challenges lie mainly in insufficient data
While implementation of this kind of analysis involves complex
and difficulties in modelling.
issues related to the aggregation of risks at the customer level,
its use is evident in identifying unprofitable or marginally profit­ Some risks are viewed by banks as better covered by ensuring
able customers who attract resources that could be allocated that internal control procedures are in order to mitigate risk

202 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and/or prepare contingency funding plans (e.g., liquidity risk). Capital Budgeting, Strategic Planning, Target
Consequently, capital typically is not allocated for such risks. Setting and Internal Reporting
Many banks allocate (hypothetical) capital to each business unit
Relative Performance Measurement
in their budgeting process, where economic capital measures
In order to assess relative performance on a risk-adjusted basis, play an important role. This process is also part of strategic
banks calculate risk-adjusted performance measures, where eco­ planning (e.g., defining the bank's risk appetite) and target
nomic capital measures play an important role. The most com­ setting (e.g., profit, capital ratio or external rating). In order to
monly used risk-adjusted performance measures are facilitate business growth that improves risk-adjusted profit­
risk-adjusted return on capital (RAROC) and shareholder value ability, while operating within an overall risk appetite set by
added (SVA).3 Many banks calculate these measures at various the board, many banks have established internal reporting/
levels of the enterprise (e.g., entity level, large business unit monitoring frameworks.
level and portfolio level). The major difference between these
Generally, banks have a number of ways to conduct capital
two measures is that RARO C is a relative measure, while SVA is
planning, most of which are not empirically-based, but instead
an absolute measure. RARO C provides information which is use­
are based on judgm ent and stress testing exercises. These
ful in comparing the performances of two portfolios with the
include scenario analysis and sensitivity analysis, which intro­
same amount of economic net income, but with substantially
duce forward-looking elements into the capital planning pro­
different economic capital measures.
cess. That is, banks place more emphasis on qualitative rather
One of the key issues in using both RARO C and SVA for perfor­ than quantitative tools and expect to rely on management
mance measurement is how to set the hurdle rate that reflects actions to deal with future events. It seems that banks take only
the bank's cost of capital. In this regard practices vary across a rough, judgmental approach to reviewing the performance
banks. Some banks set a single cost of capital (e.g., weighted and interaction of economic capital "dem and" figures and
average cost of capital or target return on equity— ROE) across available capital "supply" figures during times of stress. It does
all business units, while other banks set required returns that not appear that banks have a rigorous process for determining
vary according to the risks of the business units. their capital buffers, although some banks systematically set

Some banks use lower confidence levels for performance assess­ their capital buffers at levels above regulatory minimums (about
ment of business units than for their enterprise-wide capital 120%—140%). Banks' capital planning scenarios differ by chosen

adequacy assessment. This approach is based on the view time horizon, with some choosing one year, and others choos­

that economic capital measures calculated at high confidence ing three to five years. Banks usually look at adverse events

levels focus on extreme events and do not always provide that would affect the bank individually or would affect markets

appropriate information for senior management. Calculation more broadly (a pandemic is one scenario chosen by some

of risk-adjusted performance measures at the large business banks for the latter). Some banks stress certain parameters in

unit levels (e.g., wholesale banking, trading) is more commonly their economic capital models (e.g., they shock PDs based on

observed than at the smaller business unit levels. In calculating a severe recession scenario) to assess the potential impact on

economic net income, one of the challenges is how to allocate economic capital.

profits and costs to each unit, if more than one unit contrib­
utes a profit-generating transaction or benefits from a cost Acquisition/Divestiture Analysis
generating activity.
In corporate development activities, such as mergers and acqui­
Banks use risk-adjusted performance measures in their perfor­ sitions, some banks use the targets' economic capital measures
mance assessment (e.g., comparing performance with a target, as one of the factors in conducting due diligence. However, the
analysing historical performance) and compensation setting. number of banks using economic capital measures for corporate
Use of economic capital measures for risk-adjusted performance development activities is relatively smaller than the number of
measures in a capital budgeting process is much more common those using economic capital measures for the other purposes
practice than incorporating economic capital measures into the described above. According to the results of the IFRI and CRO
determination of compensation for business managers and staff. Forum (2007) survey, only 25% of participating banks use eco­
nomic capital measures for corporate development activities,
such as mergers and acquisitions. On the other hand, it seems
3 There are other risk-adjusted performance measures that could be that this approach is more often used for mergers and acquisi­
used. Some of these measures include RORAC (return on risk-adjusted
capital), ROCAR (return on capital at risk) and RAROA (risk-adjusted tions in emerging markets, where information on the targets'
return on risk-adjusted assets). See Crouhy et. al. (2006). market values is far less readily available.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 203

External Communication decision-making. Moreover, the viability of a bank's economic
capital processes depends critically on the existence of a cred­
The major external communication channels where economic
ible commitment on the part of senior management to the
capital measures could be used include disclosure (e.g., annual
process. In order for this to occur, however, senior management
reports, presentation materials for investors), dialogue with
must recognise the importance of using economic capital mea­
supervisory authorities and dialogue with rating agencies. Some
sures in running the bank's business.
banks disclose economic capital measures for each business unit
and/or risk category and provide comparisons with allocated This section examines the current range of practices with regard
capital in their annual reports. Many more banks disclose this to governance in the following areas: (i) senior management
kind of information in other documents, such as presentation involvement and experience in the economic capital process;
materials for investors. (ii) the unit involved in the economic capital process, e.g., risk
management, strategy planning, treasury, etc. and its level of
Capital Adequacy Assessment knowledge; (iii) the frequency of economic capital measure­
ments; and (iv) policies, procedures, and approvals relating to
Economic capital is a measure of risk, not of capital held. As
economic capital model development, validation, on-going
such, it is distinct from familiar accounting and regulatory capital
maintenance and ownership.
measures. Nevertheless, banks have extended the use of this
enterprise-wide metric beyond performance measurement and
Senior Management Involvement and Experience
strategic decision-making to include an assessment of the ade­
in the Economic Capital Process
quacy of the institution's overall capitalisation. This practice is
commonly observed at banks, including those whose economic The most widely cited reasons for adopting an economic capi­
capital implementation is in the earlier stages of development. tal framework are to improve strategic planning, define risk
appetite, improve capital adequacy, assess risk-adjusted busi­
The comparison of an internal assessment of capital needs
ness unit performance and set risk limits. For those institutions
against capital available is part of banks' overall ICAAP. Large
that have adopted or plan to adopt economic capital, the risk
banks (which are likely to adopt internal ratings-based— IRB—
management team, senior management, supervisors and the
approaches under Basel II) tend to use an economic capital model
board of directors were the most influential parties behind the
for their ICAAP, whereas some smaller banks primarily use the
decision. However, not all banks choose to adopt an economic
minimum regulatory capital numbers for the ICAAP. Some of these
capital framework, citing difficulties inherent in collecting and
banks adjust the Pillar 1 numbers (using multiples of the regula­
modelling data on infrequent and often unquantifiable risk at
tory capital requirements, using different model parameters, look­
extremely high confidence levels.
ing at different confidence levels, etc.). Beyond risks that feature
in regulatory capital computations, approaches are rather het­ There are clear signs that acceptance of the role played by eco­
erogeneous. Larger banks may use economic capital models for nomic capital is increasingly embedded in the business culture
quantifiable risks while relying upon more subjective approaches of banks, driven both by industry progress and supervisory pres­
for less quantifiable risks like reputational risk. Traditional eco­ sure. In addition, banks now seem to be broadly comfortable
nomic capital methods are used in some cases to calculate risks with the accuracy of the economic capital measures. This has
beyond minimum regulatory capital requirements. In other cases, resulted in increased use of economic capital in management
stress tests based on scenario analysis are used (e.g., for IRRBB). applications and business decisions, as well as use in discussions
with external stakeholders.

Governance The barriers to the successful implementation of economic capi­

tal vary widely. However, according to the PricewaterhouseCoo-
The corporate governance and control framework surround­ pers Survey (2005) only 14% of respondents cite lack of support
ing economic capital processes is an important indicator of from senior management as a barrier to successful implementa­
the reliability of economic capital measures used by banking tion of an economic capital fram ework.4
institutions. Important parts of an effective economic capital
framework include strong controls for making changes in risk
4 Among the other barriers selected by respondents, 64% cite difficulty
measurement techniques, thorough documentation regarding of integrating economic capital within management decision-making;
risk measurement and allocation methodologies and assump­ 62% cite difficulty in quantifying certain risk types; 59% cite problems
with data integrity; 31% cite lack of incentives for specific business lines
tions, sound policies to ensure that economic capital practices
and product areas to co-operate; 23% cite lack of in-house expertise;
adhere to expected procedures, and the meaningful applica­ and 23% cite uncertainty regarding supervisors attitudes toward
tion of economic capital measures to day-to-day business economic capital.

204 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Unit Involved in the Economic Capital Process and accurately conveying the actual financial condition of banks to
Its Level of Knowledge the market. In addition to quantitative economic capital mea­
sures, qualitative information on the governance surrounding
There is a wide range of organisational governance structures
the economic capital framework of banks is becoming more
responsible for the economic capital framework at banking insti­
important, since external market participants take into account
tutions. These governance structures range from involving highly
the sophistication of the economic capital framework and bank
concentrated responsibilities to involving highly decentralised
management in their assessments of banks.
responsibilities. For example, some banking institutions house a
centralised economic capital unit within corporate Treasury, with
Policies, Procedures, and Approvals Relating to
formal responsibilities. However, components of the overall eco­
Economic Capital Model Development, Validation,
nomic capital model or some parameters are outside the direct
On-Going Maintenance and Ownership
control of the economic capital owner. Other banks share
responsibility for the economic capital framework between the Most banks have formalised policies and procedures for eco­
risk function and the finance function, while others have a more nomic capital governance and analytics to ensure the consistent
decentralised structure, with responsibilities spread among a application of economic capital across the enterprise. For those
wider range of units.5 banks that have adopted enterprise-wide policies and proce­
dures, it is the responsibility of the business units to ensure that
Once capital has been allocated, each business unit then man­
those policies and procedures are being followed. Some insti­
ages its risk so that it does not exceed its allocated capital. In
tutions that do not have formal policies and procedures have
defining units to which capital is allocated, banks sometimes
economic capital processes and analytics (e.g., coverage of off-
take into account their governance structure. For example,
balance sheet items, confidence level and holding period) that
banks that delegate broader discretion to business unit heads
are inconsistent across organisational units.
tend to allocate capital to the business unit, leaving the business
unit's internal capital allocation within the business line's control. Change-control processes for economic capital models are
On the other hand, management is likely to be more involved in generally less formalised than for pricing or risk management
the allocation of capital within business units if the bank's gov­ models. They typically leverage off change-control processes of
ernance structure is more centralised. There seems to be diver­ the underlying models and parameters. Changes to economic
gence in the approach to this process. Some banks prefer rigid capital-specific methodologies (e.g., aggregation methodolo­
operation, where allocation units adhere to the original capital gies) are managed by the bank's economic capital owner, and
allocation throughout the budgeting period. On the other hand, may not be the same as the change control processes in other
other banks prefer a more flexible framework, allowing reallo­ areas on the banking institution. Diagnostics procedures are
cation of capital during the budgeting period, sometimes with typically run after an economic capital model change. Some
thresholds that trigger reallocation before consuming all the banks require responsible parties to sign-off on any changes to
allocated capital. methodology. However, formalised validation processes after
changes, or internal escalation procedures in the event of unex­
Frequency of Economic Capital Measurements pectedly large differences in the economic capital numbers,
and Disclosure are uncommon.

Economic capital calculations have a strong manual component Some banks specifically name an owner of the economic capi­
and data quality is a prominent concern. Hence, most banks cal­ tal model. Typically, the owner provides oversight of the eco­
culate economic capital on a monthly or quarterly basis. nomic capital framework. However, few formal responsibilities
are assigned the owner other than ensuring reports from all
Implementation of Basel II has fostered public disclosure of
model areas are received in a timely manner and mechanically
quantitative information on economic capital measures among
aggregating the individual components of the economic capital
banks. Although disclosure of quantitative economic capital
framework into a report.
measures is not mandatory under Pillar 3 (market discipline) of
Basel II, the aim of Pillar 3 is to encourage market discipline by
Supervisory Concerns Relating to Use of
5 According to the IFRI and CRO Forum (2007) survey, about 80% of the Economic Capital and Governance
economic capital work is undertaken centrally, and about 20% by the
business units. About 60% of the banks participating in the survey have Senior management needs to ensure that there are robust con­
economic capital functions that report directly to the Chief Risk Officer,
while others have reporting lines to the Chief Financial Officer or the trols and governance surrounding the entire economic capital
Corporate Treasury. process. There are several supervisory concerns relating to the

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 205

use of economic capital measures and governance surrounding difficult to model. Even if management actions are not explicitly
the economic capital framework. included in economic capital models due to unreliability, banks
would nevertheless prepare for them via contingency plans in
Standard for Absolute versus Relative Measures stress situations.
of Risk Potential management actions are grouped into two catego­
The robustness and conservativeness of economic capital as an ries: (i) those actions that increase capital supply; and (ii) those
estimate of risk becomes more important when a bank extends actions that reduce capital demand. Examples of the former
the use of measures designed initially as a common metric for are raising new capital, reducing costs and cutting dividends.
relative risk measurement and performance to the determination Examples of the latter include reducing new investment or
of the adequacy of the absolute level of capital. Critical issues selling assets with positive risk weights. In addition to explicit
include: (i) comprehensive capture of the risks by the model; (ii) actions, actions may be implicitly accounted for in the economic
diversification assumptions; and (iii) assumptions about manage­ capital model itself. In measuring market risk, for example, some
ment actions. assumptions may be made to adjust the short time horizon in
the model to the typically longer time horizon used in an eco­
Comprehensive Capture of Risks nomic capital framework.

The types of risk that are included in economic capital models Finally, banks do not seem to take into account constraints that
and the ICAAP vary across banks in a given country as well as could impede the effective implementation of management
across countries (partly because some risk types are more pro­ actions. Such constraints may relate to legal issues, reputa­
nounced in some countries). Risks that the economic capital tional effects, and cross-border operations. Further analysis
model cannot easily measure may be considered as a separate of the range and plausibility of these built-in assumptions
judgmental adjustment in the ICAAP. W hether a risk type is about management action, particularly in times of stress, may
included in the ICAAP may depend on the risk profile of the be warranted.
individual bank, and whether the individual bank regards these
risks as material. Role of Stress Testing
There can be variation between banks in the risks covered by Currently, many banks apply stress tests, including scenario
their economic capital models, since an identically named risk analysis and sensitivity analysis, to individual risks, although the
type may be defined differently across banks and across coun­ framework and procedures still need to be improved. The use
tries. The term business risk, for example, is sometimes con­ of integrated stress tests is gradually becoming more wide­
fused with or lumped together with less quantifiable legal and spread in the industry, probably reflecting the need to assess
reputational risk. the impact of stress events on overall economic capital mea­
sures and to provide complementary estimates of capital needs
Diversification Assumptions in the context of ICAAR At present, there exists wide variation
among banks in the level and extent of integrated stress tests
In most cases, intra-risk diversification assumptions are built into
being utilised. In general however, practices are still in the
the models for individual risk types. For inter-risk diversification
development stage.
assumptions, current practices vary among banks and the bank­
ing industry does not seem to have agreed on best practices. Stress test results do not necessarily lead to additional capital.
Thus, the methods remain preliminary and require further analy­ Rather, it seems more common that stress tests are used to
sis. In light of the uncertainty in estimating diversification effects, confirm the validity of economic capital measures, to provide
especially for inter-risk diversification, due consideration for con­ complementary estimates of capital needs, to consider contin­
servatism may be important. The issue of inter-risk diversification gency planning and management actions, and gradually to for­
is addressed in detail later in the chapter and intra-risk diversifica­ mulate capital planning. In some cases, banks use stress tests to
tion (within portfolio credit risk modelling) is discussed in Annex I. determine the effects of stressed market conditions on earnings
rather than on economic capital measures.
Assumptions about Management Actions
In some banks, potential management actions are taken into
Economic Capital Should Not Be the Sole
account in economic capital models. However, one of the
Determinant of Required Capital
main reasons that banks do not include management actions In general, both rating agencies and shareholders influence
in their economic capital models is that these actions are the level of a bank's capital, with the former stressing higher

206 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
capital for solvency and the latter lower capital for profitability. Senior Management Commitment to the
Banks also look to peers in targeting their capital ratios. Nearly Economic Capital Process
all large, internationally active banks set their economic capital
The viability and usefulness of a bank's economic capital pro­
solvency standard at a level they perceive to be required to
cesses depend critically on the existence of credible commit­
maintain a specific external rating (e.g., AA). Banks tend to look
ment or "buy-in" on the part of senior management to the
to peers in choosing external ratings and associated solvency
process. In order for this to occur, senior management must
standards. There is not a lot of evidence that bank counterparties
recognise the importance of using economic capital measures in
have an impact on capital levels, other than indirectly through
conducting the bank's business and capital planning. In addition,
the need to deal with institutions having an acceptably high
adequate resources must be committed to ensure the existence
external rating. Many banks claim to target a high external rating
of a strong, credible infrastructure to support the economic
because of their desire to access capital and derivatives markets.
capital process.

Definition of Available Capital Transparency and Meaningfulness of Economic

There is no common definition of available capital across banks,
Capital Measures
either within a country or across countries. Some of the confu­ Economic capital model results need to be transparent and taken
sion surrounding the notion of available capital may arise from seriously in order to be useful to senior management for making
the fact that economic capital has its origin in assessing relative business decisions and for risk management. The level of docu­
profitability for the shareholder on a risk-adjusted basis. To the mentation and integrity of calculations and model version control
extent that a bank recognises its capital needs are not limited increase with the scope and significance of economic capital
by the more quantifiable risks in its economic capital model, the models in a bank's decision-making process. Internal transpar­
broader it may choose to define available capital. ency is a necessary condition for internal acceptance and use.

While no common definition of available capital exists, there are

several elements that many banks have in common with regard 13.5 RISK MEASURES
to their available capital. At the root of many banks' definitions
of available capital are tangible equity, tier 1 capital or capital While risk is a notion with a clear intuitive meaning, it is less clear
definitions used by rating agencies. In order to cover losses at how risk should be quantified. Current practice in banks com­
higher levels of confidence, some banks consider capital instru­ monly involves trying to identify ways to characterise entire loss
ments that may be loss-absorbing, more innovative or uncertain distributions (i.e., going beyond estimating selected moments of
forms of capital such as subordinated debt. Among the various the loss distribution, such as the mean and standard deviation),
items that can be included in the definition of available capital resulting in a wide range of potential risk measures that may be
(some of them included in the regulatory definition of capital) used. The choice of risk measure has important implications for
are common equity, preferred shares, adjusted common equity, the assessment of risk. For example, the choice of risk measure
perpetual non-cumulative preference shares, retained earning, could have an impact on the relative risk levels of asset classes
intangible assets (e.g., goodwill), surplus provisions, reserves, and thus on the bank's strategy. Comparisons between ICAAP
contributed surplus, current net profit, planned earning, unre­ measures of capital under Pillar 2 with minimum regulatory capi­
alised profits and mortgage servicing rights. tal requirements under Pillar 1 should consider the impact of
This range of practices is confirmed by the IFRI and CRO Forum using different measures of risk in the two approaches.
(2007) survey of enterprise-wide risk management at banks and
insurance companies, which found 80% of participants adjusted Desirable Characteristics of Risk Measures
their tier 1 capital in arriving at available capital resources
An ideal risk measure should be intuitive, stable, easy to com­
against which economic capital was compared.
pute, easy to understand, coherent and interpretable in eco­
Banks do not limit themselves to a single capital measure. Some nomic terms. Additionally, risk decomposition based on the risk
banks manage their capital structure against external demands, measure should be simple and meaningful.
such as regulatory capital requirements or credit rating agency
Intuitive: The risk measure should meaningfully align with some
expectations. Often banks' definition of capital aligns with the
intuitive notion of risk, such as unexpected losses.
more tangible capital measures such as those used by rating
agencies and are, therefore, more restrictive than regulatory Sta b le: Small changes in model parameters should not produce
definitions of capital. large changes in the estimated loss distribution and the risk

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 207

measure. Similarly, another run of a simulation model in order since no single measure can capture all the complex elements of
to generate a loss distribution should not produce a dramatic risk measurement. As such, there is no ideal risk measure.
change in the risk measure. Also, it is desirable for the risk mea­ Table 13.1 presents (with some degree of subjective judgment)
sure not to be overly sensitive to modest changes in underlying the characteristics of the main types of risk measures.
model assumptions.
In practice, VaR and ES are the two most widely used risk
Easy to co m p u te: The calculation of the risk measure should be measures. W hile VaR is more easily explained and understood,
as easy as possible. In particular, the selection of more complex it may not always satisfy the subadditivity condition and this
risk measures should be supported by evidence that the incre­ (lack of coherence) can cause problems in banks' internal capi­
mental gain in accuracy outweighs the cost of the additional tal allocation and limit setting for sub-portfolios.8 ES, on the
complexity. other hand, is coherent, making capital allocation and internal
limit setting consistent with the overall portfolio measure of
Easy to understan d: The risk measure should be easily under­
risk. However, ES does not lend itself to easy interpretation
stood by the bank's senior management. There should be a link
and does not afford a clear link to a bank's desired target rat­
to other well-known risk measures that influence the risk man­
ing. A newer class of risk measures, known as spectral and
agement of a bank. If not understood by senior management,
distorted risk measures, allow for different weights to be
the risk measure will most likely not have much impact on daily
assigned to the quantiles of a loss distribution, rather than
risk management and business decisions, which would limit its
assuming equal weights for all observations, as is the case
appropriateness.
for E S .9
C o h eren t: The risk measure should be coherent and satisfy the
Banks typically use several of the aforementioned risk measures,
conditions of: (i) monotonicity (if a portfolio V is always worth at
and sometimes different measures for different purposes. How­
least as much as X in all scenarios, then Y cannot be riskier
ever, VaR is the most widely used risk measure. Some banks
than X); (ii) positive homogeneity (if all exposures in a portfolio
use VaR for measuring the absolute risk level, but increasingly
are multiplied by the same factor, the risk measure also multi­
ES is used (at a confidence level consistent with overall VaR) for
plies by that factor); (iii) translation invariance (if a fixed, risk-free
capital allocation within the bank. The argument is often made
asset is added to a portfolio, the risk measure decreases to
that VaR as an absolute risk measure or loss limit is still easier to
reflect the reduction in risk); and (iv) subadditivity (the risk mea­
communicate to senior management due to its link to a bank's
sure of two portfolios, if combined, is always smaller or equal to
target rating. On the other hand, ES is a more stable measure
the sum of the risk measures of the two individual portfolios). O f
than VaR with respect to allocating the overall portfolio capital
particular interest is the last property, which ensures that a risk
to individual facilities. ES is a loss measure estimate given a loss
measure appropriately accounts for diversification.6
range in the tail of the loss distribution, while VaR is a loss mea­
Sim ple and m eaningful risk d eco m p o sitio n (risk contributions or sure estimated given a particular point in the tail of the loss dis­
capital allocation): In order to be useful for daily risk manage­ tribution. It should be noted that, while a bank may use different
ment, the risk measured for the entire portfolio must be able risk measures, these measures are typically based on the same
to be decomposed to smaller units (e.g., business lines or indi­ estimated loss distribution.
vidual exposures). If the loss distribution incorporates diversifica­
tion effects, these effects should be meaningfully distributed to
the individual business lines.
8 VaR is subadditive for elliptical distributions, such as the Gaussian (or
normal) distribution, whereas it is not subadditive for non-elliptical dis­
tributions. The non-subadditivity of VaR can occur when assets in port­
Types of Risk Measures folios have very skewed loss distributions; when the loss distributions
of assets are smooth and symmetric, but their dependency structure
In practical applications, a wide range of risk measures are used.
or copula is highly asymmetric; and when underlying risk factors are
This section examines standard deviation, value-at-risk (VaR), independent but very heavy-tailed. The lack of subadditivity for VaR is
expected shortfall (ES), and spectral and distorted risk mea­ probably more of a concern for credit risk and operational risk than for
market risk, where an elliptical model may be a reasonable approximate
sures.7 All the risk measures have strengths and weaknesses,
model for various kinds of risk-factor data. For a detailed discussion,
see McNeil et. al. (2005). Many practitioners note however, that the
technical reservations concerning VaR are mainly academic in nature
and that the problems described are encountered by banks only rarely
6 See Artzner et. al. (1997) on coherent risk measures for a complete in practice.
discussion.
9 Spectral and distorted risk measures are not widely used in practice
7 See Hull (2007) for a detailed discussion of the various risk measures. and are currently largely of academic interest.

208 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 13.1 Risk M easu res

Spectral and Distorted

Standard Deviation VaR Expected Shortfall Risk Measures

Intuitive Sufficiently intuitive Yes Sufficiently intuitive No (involves choice of

spectrum or distortion
function)

Stable No, depends on No, depends on Depends on the loss Depends on the loss
assumptions about loss assumptions about loss distribution distribution
distribution distribution

Easy to compute Yes Sufficiently easy Sufficiently easy Sufficiently easy

(requires estimate of loss (requires estimate of (weighing of loss
distribution) loss distribution) distribution by spectrum/
distortion function)

Easy to understand Yes Yes Sufficiently Not immediately

understandable

Coherent Violates monotonicity Violates subadditivity Yes Yes

(for non-elliptical loss
distributions)

Simple and meaningful Simple, but not very Not simple, might Relatively simple and Relatively simple and
risk decomposition meaningful induce distorted choices meaningful meaningful

Calculation of Risk Measures target rating, with overlaps between different rating classes.
For example, the IFRI and CRO Forum (2007) survey found that
Confidence Level PDs mapped to a A A target rating range from two to seven
In their internal use of risk measures, banks need to deter­ basis points, while the range for an A target rating is four to ten
mine an appropriate confidence level for their economic capi­ basis points.
tal models that may vary for different business models. The Apart from considerations about the link to a target rating, the
banks' target rating plays an important role in the choice of choice of a confidence level might differ based on the question
confidence level. to be addressed. On the one hand, high confidence levels reflect
The link between a bank's target rating and the choice of con­ the perspective of creditors, rating agencies and supervisors in
fidence level may be interpreted as the amount of economic that they are used to determine the amount of capital required
capital that must be exceeded by available capital resources to to minimise bankruptcy risk. On the other hand, banks may use
prevent the bank from eroding its capital buffer at a given con­ lower confidence levels for management purposes in order to
fidence level. According to this view, which can be interpreted allocate capital to business lines and/or individual exposures and
as a going concern view, capital planning is seen more as a to identify those exposures that are critical for profit objectives
dynamic exercise than a static one, where it is the probability in a normal business environment. Consequently, banks typically
of eroding such a buffer (rather than all available capital) that is use different confidence levels for different purposes.
linked to the target rating. This would reflect the expectation (by
Another interesting aspect of the internal use of different risk
analysts, rating agencies and the market) that the bank operates
measures is that the choice of risk measure and confidence
with capital that exceeds the regulatory minimum requirement.
level heavily influences relative capital allocations to individual
Establishing the link between a bank's target rating and the exposures or portfolios. In short, the farther out in the tail of
choice of confidence level, however, is far from being an easy a loss distribution, the more relative capital gets allocated to
exercise. It involves the mapping between ratings and PDs, concentrated exposures. As such, the choice of the risk measure
which can change, depending on the rating agency scale as well as the confidence level can have a strategic impact since
adopted, and it suffers from significant statistical noise, espe­ some portfolios might look relatively better or worse under risk-
cially at the higher rating grades which are typically targeted by adjusted performance measures than they would based on an
banks. Banks can use a range of confidence levels for the same alternative risk measure.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 209

Time Horizon supervisors should consider the advantages and disadvantages
of the risk measure used at each bank. Stability in computation
All risk measures depend on the time horizon used in their mea­
is an important issue, as the calculation of risk measures typically
surement. The choice of an appropriate time horizon depends
involves the use of simulation techniques. The ability to easily
on a range of factors: the liquidity of the bank's assets under
and sensibly aggregate and decompose risk also determines the
consideration; the risk management needs of the bank; the
effective use of risk measures in the bank. The degree to which
bank's standing in the markets; the risk type, etc. Market risk
economic capital is engrained in the decision-making processes
is typically estimated over a very short time horizon (days or
is strongly affected by the availability of a broad assessment of
weeks). In contrast, credit risk is typically measured using a
risks at the senior management level, where strategic decisions
one-year time horizon, while an even longer time horizon may
are made with respect to capital management. In contrast, more
be appropriate for other portfolios (e.g., project finance). The
granular measures of risk are needed at the risk-taking levels
choice of time horizon is also influenced by regulatory require­
where economic capital is likely to influence operational deci­
ments. For example, a one-year time horizon is specified for
sions through factors such as capital allocation, limit setting, and
operational risk, while a 10-day time horizon is specified for gen­
performance measurement.
eral and specific market risk.
While each bank chooses both the risk measure and the confi­
The heterogeneity of time horizons used in risk measurement
dence level it deems most appropriate for its economic capital
poses an important challenge to banks in aggregating economic
purposes, the bank must be able to provide a convincing eco­
capital across different risk types. According to the IFRI and
nomic rationale for the choice. If different risk measures and/
CRO Forum (2007) survey about 80% of participants use a time
or confidence levels are used for external and internal manage­
horizon of one year for their economic capital calculations, with
ment purposes, a clear and convincing link must be established
the remainder using various time horizons.
between the two risk measures.

Aggregation/Decomposition Supervisors should be aware of differences between internal and

regulatory measures of capital that stem from different risk mea­
Measurement of risk is typically performed at the portfolio
sures and/or confidence levels and take these into account when
level. However the ability to easily and sensibly aggregate and
evaluating a banks' ICAAP. A simple comparison of internal and
decompose risks is an important feature of any risk measure.
regulatory capital figures will not tell supervisors much about the
In order to be effectively used, risk measures should be flex­ underlying risks in a bank's portfolio.
ible and able to be computed at either a broad or narrow level.
More specifically:

• Decomposition: Within a portfolio, risk needs to be decom ­

13.6 RISK AGGREGATION
posed in order to establish for each subset (e.g., positions
Typically, economic capital is calculated using an approach that
assigned to each desk) its risk contribution (taking into
first assesses individual risk components, and then proceeds to
account any diversification effects). Decomposition of risk
aggregate these components up to the level of the entire bank.
is fundamental for capital allocation, limit setting, pricing of
The aggregation process is characterised by identification of the
products, risk-adjusted performance measurement and value-
individual risk types and by the methodological choices made in
based management.
aggregating these risk types.
• Aggregation: Adopting a wider point of view, risks arising
from several portfolios need to be aggregated in order to con­
vey a representation of risk at the business unit or entity level. Aggregation Framework
Aggregation also deals with different types of risk (credit, mar­
Risk aggregation begins with a classification of risk types that
ket, operational, liquidity, legal, etc.). Typically, the outcome of
are combined to produce the overall economic capital measure.
risk aggregation is the bank's total economic capital.
Banks typically classify risk into different types along two dimen­
sions: (i) the economic nature of the risk (market risk, credit risk,
Supervisory Concerns Relating to Risk operational risk, etc.); and (ii) the organisational structure of the
Measures bank (along business lines or legal entities).

From a supervisory point of view, there is no obvious prefer­ In contrast to classification along organisational lines, which
ence for one risk measure over another among the measures presents few conceptual difficulties, classification along risk
most widely used for calculating economic capital. Rather, types can be imprecise. Definitions of risk types may differ

210 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
across institutions, or even across portfolios within a single bank­ beyond balance-sheet items to fee-generating services, such as
ing organisation, often reflecting the nature of the bank's busi­ origination, cash management, asset management, securities
ness or the degree of sophistication of its risk measurement. As underwriting and client advisory services.
discussed below, this imprecision has implications for the aggre­
For business or (local) regulatory reasons, some banks may
gation process.
select to distinguish individual types of risk within the listed cat­
The following list provides a brief description of the main cat­ egories. For example, they may isolate real estate risk, or pen­
egories into which the typical framework classifies risks. sion risk. Some banks may also distinguish other risk types such
as liquidity risk and legal risk.
M arket risk: Refers to portfolio value changes due to changes
in rates and prices that are perceived as exogenous from the
Range of Practices in the Choice of Risk Types
viewpoint of the bank. These comprise exposures to asset
classes such as equities, commodities, foreign exchange and All the risk types discussed above can be simultaneously pres­
fixed-income, as well as to changes in discount factors such as ent in a bank's portfolio. For example, a traded bond portfolio
the risk-free yield curve and risk premiums. A specific type of will have an important credit and market risk component, as well
market risk is IRRBB, which stems from repricing risk (arising as operational risk related to the efficiency of trading execution
from differences in the maturity and repricing terms of customer and settlement. In practice, however, risks are often measured
loans and liabilities), yield curve risk (stemming from asymmetric by reference to different lines of business and/or portfolios.
movements in rates along the yield curve), and basis risk (arising A loan portfolio that is held to maturity and managed on an
from imperfect correlation in the adjustment of the rates earned accrual accounting basis is often considered as representing
and paid on different financial instruments with otherwise similar credit risk and not market risk. By contrast, a trading portfolio
repricing characteristics). IRRBB also arises from the em bed­ of credit derivatives is often taken to represent mainly market
ded option features of many financial instruments on banks' risk by virtue of it containing actively traded exposures that are
balance sheets. marked-to-market.

C red it risk: Refers to portfolio value changes due to shifts in the The majority of banks prefer to aggregate risk initially into silos
likelihood that an obligor (or counterparty) may fail to deliver by risk-type across the entire bank before combining the silos.
cash flows (principal and interest) as previously contracted. The This approach, however, is by no means the only approach fol­
distinction between market and credit risk, while fairly clear lowed, with the business unit silo approach preferred by other
on the surface, is less so in practice since individual exposures banks. Some banks use a mixed approach, which combines
typically contain elements of both risks. For example, prices of elements of both approaches. This practice is observed where
corporate bonds can vary because of changes in the perceived either particular business units or risk exposures are too small to
likelihood of issuer default but also because shifts in the risk-free be meaningfully measured separately.
yield curve. In addition, credit and market risk factors can inter­ Grouping of risks first across homogeneous risk types has a
act in ways that complicate the distinction between the two (see benefit of addressing these questions at a single stage and in
the next section). a centralised and potentially more consistent way. By compari­
O perational risk: Refers to the risk of loss associated with human son, grouping risks first by business unit leverages the existing
or system failures, as well as fraud, natural disaster and litiga­ organisational structures within the bank and deals with inter­
tion. While not a pure economic risk it does represent losses risk relationships at an earlier stage of aggregation.
(either outright outlays or foregone earnings) from all types of
activity where banks engage, and it is indirectly linked to the
Aggregat i° n Methodologies
level, intensity and complexity of these activities.
The risk aggregation methodology used by a bank has two
Business risk: Captures the risk to the firm's future earnings, divi­
(interrelated) components: the choice of the unit of account and
dend distributions and equity price. In leading practice banks,
the approach taken to combining risk components.
business risk is more clearly defined as the risk that volumes
may decline or margins may shrink, with no opportunity to offset
the revenue declines with a reduction in costs. For example,
The Unit of Account
business risk measures the risk that a business may lose value Before risk types are aggregated into a single measure, they
because its customers sharply curtail their activities during a need to be expressed in comparable units, often referred to as a
market down-turn or because a new entrant takes market share common risk currency. Meaningful aggregation requires that the
away from the bank. Moreover, this risk increasingly extends underlying risk measures conform to each other, especially when

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 211

they relate to single number summaries of the corresponding characteristics of the exposures (including their liquidity) and on
risk distributions. There are three main characteristics of the unit the purpose for which they are held. However, for the purpose
of risk accounting. of risk measurement and, especially, risk aggregation the use of
different horizons will result in improper comparisons between
Risk m etric: The choice of the risk metric for economic capital
risk components. The difficulty that arises for the latter purposes
depends on the metrics that are used in the quantification of dif­
can be overcome by methods similar to the constant level of risk
ferent risk components. In particular, whether the chosen metric
over a common horizon approach outlined in the consultative
satisfies the subadditivity property is relevant for quantifying
paper of the BCBS on computing incremental risk in the trading
diversification across risk typ es.101
book.13
C o n fid en ce level: The fact that the loss distribution for different
risk types are typically assumed to have different shapes (i.e., Inter-Risk Diversification
different families of probability distributions are assumed to bet­
The way that individual risks are combined relates closely to the
ter capture the characteristics of different types of risk) may also
scope of inter-risk diversification, namely to the notion that the
suggest a difference in terms of the relevant confidence levels.
combination of two portfolios would result in lower risk per unit
For example, long-tailed risk distributions would suggest using
of investment in the combined portfolio than the (weighted)
higher confidence levels. Lack of harmonisation in terms of the
average of the two component portfolios. The basic intuition
choice of confidence level creates additional complexity in
stems from the fact that the variance of the pooled portfolio's
aggregation approaches.11 Moreover, the choice of confidence
return will be no greater (and typically smaller) than a similarly
level can influence the ranking of risks since risk types that have
sized portfolio which is exposed to only one or the other risk
a loss distribution with a longer loss tail tend to dominate as the
factor. This logic will carry over to measures of risk that are
confidence level increases.
directly related to variance.
Tim e horizon: The choice of the horizon over which risk is mea­
In the context of risk aggregation across different portfolios
sured is one of the thorniest issues in risk aggregation. Business
or business units, some of the assumptions that underpin the
practice, accounting standards and regulatory requirements
above logic may fail to hold. One issue is purely technical and
combine to imply that different types of risk are managed over
relates to the choice of VaR as a metric because it can fail to sat­
different horizons. Traded portfolios are managed over horizons
isfy the subadditivity property. That is, it is possible for the VaR
that are typically measured in days. Less liquid exposures, such
of a pooled portfolio to be higher than the sum of the VaR of
as loans, are managed over longer horizons of one year or lon­
the individual constituent portfolios.
ger.12 Combining risk measures that have been calculated on
the basis of different horizons is problematic regardless of the A more important reason why aggregate risk may be larger than
specific methodology used. The conflict between business prac­ the sum of its components is independent of the choice of met­
tices and risk aggregation requirements is typically resolved by ric (i.e., it applies to metrics other than VaR) and relates to the
using a common (usually one year) horizon. This means that it is economic underpinnings of the portfolios that are pooled. The
necessary for time aggregation of certain types of risk (most logic outlined above assumes that covariance (a linear measure
often market risk) by using scaling-up methods such as the of dependence) fully captures and summarises the dependen­
square-root-of-time rule. It should be noted that there is no con­ cies across risks. While this may be a reasonable approximation
ceptual inconsistency in the use of different horizons for risk in many cases, there are instances where the risk interactions are
measurement and EC purposes, on the one hand, and for the such that the resulting combination may represent higher, not
actual management of underlying exposures, on the other. Deci­ lower, risk. For example, measuring separately the market and
sions related to the management of portfolios are based on the credit risk components in a portfolio of foreign currency denom­
inated loans can underestimate risk, since probabilities of obli­
gor default will also be affected by fluctuation in the exchange
10 See the section on risk measures for a more detailed discussion of the rate, giving rise to a compounding effect.14 Similar types of
properties of different metrics of risk.
11 More sophisticated methods that use full simulation approaches or
those that describe the entire loss distribution (such as those based on
copulas) would not be influenced by this choice. 13 Basel Committee on Banking Supervision (2009).
12 Even with the same time horizon for default, the practice of active 14 See Breuer et. al. (2008) for further details. The forthcoming working
credit portfolio management can result in the use of point-in-time paper on the "Interactions between market and credit risk" produced by
default probabilities for day-to-day risk management with through-the- the Research Task Force of the Basel Committee also offers an elabora­
cycle estimates for economic capital computations. tion on this set of issues.

212 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
"wrong-way" interactions could occur in the context of portfolio (iv) C opulas: This is a much more flexible approach to combin­
positions that may be simultaneously affected by directional ing individual risks than the use of a covariance matrix. The
market moves and the failure of counterparties to a hedging copula is a function that combines marginal probability
position.15 From a more "macro" perspective, asset price volatil­ distributions into a joint probability distribution. The choice
ity often interacts with the risk appetite of market participants of the functional form for the copula has a material effect
and feeds back to market liquidity leading to a magnification of on the shape of the joint distribution and can allow for rich
risk rather than diversification. interactions between risks.

A final issue that relates to the degree of diversification has to (v) Full modelling of common risk drivers across all portfolios:
do with the granularity of the classification system of risks. The This represents the theoretically pure approach. Common
more granular the classification system (i.e., the finer the system underlying drivers of risk are identified and their interac­
of categories where risk is slotted) the more reduced should be tions modelled. Simulation of the common drivers (or
the scope for intra-risk diversification and the higher the scope scenario analysis) provides the basis for calculating the dis­
for inter-risk diversification. For example, holding everything tribution of outcomes and economic capital risk measure.
else equal, some of the overall diversification between the retail Applied literally, this method would produce an overall risk
and wholesale credit portfolio of a bank will be subsumed in measure in a single step since it would account for all risk
the measure of overall credit risk for a bank that does not dis­ interdependencies and effects for the entire bank. A less
tinguish between the two types of risks in its economic capital comprehensive approach would use estimated sensitivities
framework, while it will be picked up by the aggregation pro­ of risk types to a large set of underlying fundamental risk
cess in the case that the bank maintains a separation between factors and construct the joint distribution of outcomes
the two components until the final aggregation stage. by tracking the effect of simulating these factors across all
portfolios and business units.
Typically Used Aggregation Methodologies
Table 13.2 provides a summary of the trade-offs between
Banks differ in their choice of methodology for the aggregation numerical accuracy, methodological consistency, intuitive
of economic capital. The list below provides an overview of the appeal, practicality, flexibility, and resource implications associ­
main approaches followed by a brief discussion of their advan­ ated with each of the aggregation methodologies.
tages and disadvantages. The approaches are listed in increas­
ing order of complexity (decreasing order of restrictiveness). Although the most restrictive of the alternative m ethod­
ologies, the main advantages of the summation and fixed
(i) Sim ple sum m ation: This simple approach involves adding
diversification m ethodologies are sim plicity in term s of data
the individual risk components. Typically, this is perceived
and com putational requirem ents, and ease of com m unica­
as a conservative approach since it ignores potential diver­
tion about the method and interpretation of the outcom e.
sification benefits and produces an upper bound to the
Abstracting from the possibility of m ism easurem ent and
true economic capital figure. Technically, it is equivalent
negative correlation between the underlying risk com ponents,
to assuming that all inter-risk correlations are equal to one
the simple summation approach could also produce a conser­
and that each risk component receives equal weight in the
vative measure of overall risk (i.e ., overstatem ent of risk). The
summation.
degree of conservatism associated with the fixed diversifica­
(ii) Applying a fixe d diversification percentage: This approach
tion method depends on the chosen diversification param ­
is essentially the same as the simple summation approach
eter. Both methods are relatively crude and do not allow for
with the only difference that it assumes the sum delivers a
meaningful interactions between risk types or for differences
fixed level of diversification benefits, set at some pre-speci-
in the way these risk types may create diversification benefits.
fied level of overall risk.
In addition, both methods ignore com plications stemming
(iii) Aggregation on the basis of a risk variance-covariance from using different confidence levels in measuring individual
m atrix: The approach allows for a richer pattern of inter­ risk com ponents.
actions across risk types. However, these interactions are
The use of a variance-covariance matrix (or correlation matrix)
still assumed to be linear and fixed over time. The overall
diversification benefit depends on the size of the pairwise which summarises the interdependencies across risk types

correlations between risks. provides a more flexible framework for recognising diversifica­
tion benefits, while still maintaining the desirable features of
being intuitive and easy to communicate. The correlation matrix
15 See Annex 2 on counterparty credit risk for a fuller discussion. between risks is of key importance. This matrix can vary across

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 213

Table 13.2 C o m p ariso n of Risk A g g re g a tio n M eth o d o lo g ie s

Aggregation Methodology Advantages Disadvantages

Summation: Adds together individual Simplicity It does not discriminate across risk types;
capital components Typically considered to be conservative imposes equal weighting assumption
Does not capture nonlinearities
Constant diversification: Similar Simplicity and recognition of The fixed diversification effect is not
to summation but subtracts fixed diversification effects sensitive to underlying interactions between
percentage from overall figure components.
Does not capture nonlinearities

Variance-Covariance: Weighted sum Better approximation of analytical method Estimates of inter-risk correlations difficult
of components on basis of bilateral Relatively simple and intuitive to obtain
correlation between risks Does not capture nonlinearities

Copulas: combine marginal More flexible than covariance matrix Parameterisation very difficult to validate
distributions through copula functions Allows for nonlinearities and higher order Building a joint distribution very difficult
dependencies

Full modelling/Simulation: Simulate Theoretically the most appealing method Practically the most demanding in terms of
the impact of common risk drivers on Potentially the most accurate method inputs
all risk components and construct the Intuitive Very high demands on IT
joint distribution of losses Time consuming
Can provide false sense of accuracy

banks reflecting differences in their business mix, and the cor­ Range of Practices in the Choice of
relations that reflect these institution-specific characteristics
Aggregation Methodology
can be difficult as well as costly to estimate and validate. This
is particularly true for operational risk, where data are scarce Currently, there is no established set of best practices con­
and do not cover long time periods. In addition, by focusing on cerning risk aggregation in the industry. Generally the cho­
average covariance between risks, the linearity assumption will sen approaches tend to be towards the simpler end of the
tend to underestimate dependence in the tail of loss distribu­ spectrum, with very few (typically large) banks using the more
tions and underestimate the effects of skewed distributions and sophisticated methodologies. The vast majority of banks use
non-linear dependencies. some form of the summation approach, where risks are either
explicitly weighted, as in the case of the variance-covariance
Copulas offer even greater flexibility in the aggregation of risks
approach, or implicitly weighted (as in the case of simple aggre­
and promise a better approximation of the true risk distribu­
gation). The IFRI and CRO Forum (2007) survey suggests that
tion. This comes at the expense of more demanding input
more than 60% of banks use the variance-covariance approach
requirements: complete distributions of the individual risk
while less than 20% use the simulation approaches. Reportedly,
components rather than simple summary statistics (such as VaR)
the stability of the latter approach over time is an attractive
and at least as much data as the variance-covariance approach
aspect from a governance perspective, since it leads to a more
for estimating the copula param eters. As for the variance-
stable allocation of diversification benefits back to individual
covariance method, these estimates are hard to derive and to
business units.
validate. Many of the same drawbacks apply to the case of full
models of economic capital, including full simulation methods. Banks use a variety of approaches in setting values for the inter­
The input requirements in terms of data on exposures and risk variance-covariance matrix. These approaches include direct
underlying risk factor dynamics, as well as the computational estimation using historical time series on underlying risks, expert
demands associated with large scale simulations represent a judgment, and industry benchmarks (frequently supplied by con­
strain for most banks, especially those banks with more com­ sulting firms). The estimation based on internal data is arguably
plex business risk profiles. more appropriate since it reflects the actual experience of the

214 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
bank and is more directly applicable to its business and risk pro­ sophisticated economic capital methodologies to follow a prin­
file. As suggested above, the interactions between risk compo­ ciple of conservatism in their approaches.
nents can be complex, non-linear, time varying, and dependent
W hatever the method and the estimates used, there are a num­
on measurement choices. If the bank possesses relevant data of
ber of commonalities in the assumptions made by banks. For
sufficient quality and length, these data should provide the most
instance, a high correlation between market and credit risks is
appropriate indicators of inter-risk dependencies. These data
usually assumed, a lower correlation between business risk and
can be related to the performance of portfolios (P&L, earnings,
credit or market risk, and a very low correlation between opera­
loss history, etc.). Often risks that present greater quantification
tional risk and all other risks.
challenges need to be approximated by banks with less well
developed IT systems. In these cases, the correlation between Related to the calibration of the covariance matrix of risks is
risk components is in practice often approximated by the co­ the overall level of diversification across risk types. Accord­
movement of asset price indices representative of these risk fac­ ing to the IFRI and CRO Forum (2007) survey, the estimated
tors, or similar proxies. range of inter-risk diversification is 10% to 30% for banking
organisations (with 40% of banks reporting gains between 15%
Very often bank-specific data are simply not available or of poor
and 20%). This range depends on the method used by banks
quality. In this case the entries in the variance-covariance matrix
in order to take into account inter-risk diversification and the
are filled on the basis of expert judgm ent, in the form of param­
varying estimates of correlation between risk types. Academ ic
eters that reflect the consensus of risk officers and business
studies on this issue indicate that this range can vary very sub­
managers within the firm, and this is frequently complemented
stantially depending on the applied methodology and the data
with input from external consultants and industry benchmarks.
used. Rosenberg and Schuermann (2006) estimate this diver­
This is particularly true when it applies to some risk compo­
sification at more than 40% at the 99.9% confidence level but
nents such as operational risk or business risk. The reliance on
underscore that this might vary depending on the specific port­
externally supplied inputs may be a necessity for medium and
folio composition. Dimakos and Aas (2004) on the other hand
small-sized institutions that lack the capacity, scope and scale
find only 10%—12% diversification at confidence intervals of
economies to develop risk correlation measures based on their
95% to 99%, but a number closer to 20% at confidence interval
own experience. The same applies to proportionately small
of 99.97% .
exposures in the case of larger institutions.

There is a tendency for banks to use what they consider as a

"conservative" variance-covariance matrix. The correlations are Supervisory Concerns Relating to Risk
often reported to be approximate (e.g., rounded up to multiples Aggregation
of 25 percentage points) and biased upwards (i.e., towards
An important overall message is that meaningful aggregation
unity). In an effort to reduce the need for expert judgment
of risk necessarily involves co m p ro m ises and ju d g m e n t to aug­
banks might consciously limit the dimensionality of the matrix by
ment quantitative methods. Risk measurement in portfolios
consolidating risk categories to a small number, not recognising
that are more homogeneous in terms of their risk drivers can
that such consolidation itself represents a form of aggregation
be quite detailed and can address different facets of risk. The
and embeds correlation assumptions. One drawback of this
combination of different types of risk into a common metric,
practice is that each category becomes less homogeneous and
however, presents many more complications stemming either
thus harder to quantify. In light of uncertainties for estimating
from the different statistical profiles of risk types or from dif­
inter-risk diversification effects as well as the possibility that cor­
ferences in the perspective and requirements of the business
relations may be time-varying, some (but not all) banks use
units that manage different portfolios (e.g., the use of different
stressed values that refer to the periods when these correlations
metrics and/or management horizons). Aggregation, therefore,
may be higher than they are on average, or even set equal to
typically requires that some of the richness of assessments
unity.16*Even in those cases where average values are used,
made on the individual components is sacrificed in order to
banks report that they examine the effect on the calculated eco­
achieve comparability.
nomic capital from using such stressed correlations as a robust­
ness check. Generally, there is a tendency for banks with less In particular, supervisory concerns with the economic capital
aggregation relate to validation of the inputs, methodology, and
outputs of the process.
16 Using stressed correlations is also justified on the basis that, in peri­
ods of stress, available capital resources might be less "fungible" across Economic capital frameworks are very difficult to validate. Eco­
risks/business units as implicitly assumed in the aggregation of its uses. nomic capital refers to holistic measures of risk in often very

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 215

diverse business environments. Moreover, the more tailored the 13.7 VALIDATION OF INTERNAL
process to the character and needs of the individual bank, the
more difficult for an external observer to independently vali­
ECONOMIC CAPITAL MODELS
date the inputs. Additionally, the short history of available data
In some cases the term validation is used exclusively to refer to
renders backtesting impracticable in most cases. Many supervi­
statistical ex post validation, while in other cases it is seen as
sors report that validation processes typically do not meet their
a broader but still quantitative process that also incorporates
expectations. In particular, many supervisors are sceptical as to
evidence from the model development stage. In this paper, the
the validity of the size of diversification benefit estimates and do
term "validation" is used in a broad sense, meaning all the p ro ­
not accept them for supervisory use.
ce sse s that p ro vid e evid en ce-b a sed assessm ent about a m odel's
As mentioned above, the degree of diversification is linked to fitness fo r p u rp o se . This assessment might extend to the man­
the measurement methodology of individual components. From agement and systems environment within which the model is
an applied point of view the potential complications with risk operated. Moreover, it is advisable that validation processes are
measurement are primarily related to the common practice of designed alongside development of the models, rather than
identifying risk categories with individual portfolios. For a num­ chronologically following the model building process.
ber of practical reasons that have to do with the way banks man­
Validation provides evidence that a model works as planned.
age different types of risk, with financial reporting practices, and
Economic capital models can be complex, embodying a lot of
with the regulatory framework, different types of risk are often
moving parts and it may not be immediately obvious that a com­
identified with single portfolios. For example, market risk is
plex model works satisfactorily. Moreover, a model may embody
thought of being primarily associated with portfolios that are
assumptions about relationships between variables or about
held with the intention of active trading, are managed on a short
their behaviour under periods of stress. Validation can permit
risk horizon, and are often marked-to-market. Credit risk is asso­
a degree of confidence that the assumptions are appropriate,
ciated mainly with the banking book which contains exposures
increasing the confidence of users (internal and external to the
with a longer holding horizon, that they are often illiquid and
bank) in the outputs of the model. Notably, validation also aids
valued on an accrual basis. This simplistic distinction can give
in identifying model limitations, since no model (even when fully
rise to mistaken assessments of market and credit risk compo­
validated) is ever a perfect representation of reality. While vali­
nents that can bias the aggregation process.17 The main mes­
dation can provide powerful tools for the assessment of many
sage from the supervisory perspective is that diversification
aspects of models, such as its risk sensitivity, it is less powerful
cannot be taken as given irrespective of the portfolio of risks
where other aspects of models are concerned, such as confirm­
and risk measurement practices. There is a theoretical possibility
ing the accuracy of high quantiles in a loss distribution.
that risk components may be mis-measured and that aggregate
risk may be higher than the sum of the risk components. This Achieving an accurate fit may not always be the prime consider­
may be the exception rather than the rule, but the fact remains ation. For example, some models may be developed because of
that mis-measurement can often lead to under-estimation of their usefulness as a framework for analysis or decision-making
overall risk. rather than because of their ability to fit historical data. Some
macroeconomic models of economic behaviour may fall into
Finally a possible drawback of the more sophisticated method­
this category.
ologies is more of a behavioural nature. Often greater meth­
odological sophistication leads to greater confidence in the Our interpretation of validation is consistent with that devel­
accuracy of the outcomes. Given the diversity in the nature of oped by the Basel Committee (2005a) in relation to the Basel II
inputs, the importance of assumptions that underline the param­ Framework, which is phrased in terms of the IRB param eters18
eters used, and the scale of the task in practical applications, and was developed in the context of assessment of risk esti­
the scope for hard-to detect and quantify inaccuracies is con­ mates for use in minimum capital requirements. However, valida­
siderable. Com plex approaches that are not accompanied by tion of economic capital models differs to the validation of an
robustness checks and estimates of possible specification and IRB model as the output is a distribution rather than a single
measurement error can prove misleading.

18 From the 2005 Validation principles: "In the context of rating systems,
the term 'validation' encompasses a range of processes and activities
17 A working paper of the Basel Committee's Working Group on the that contribute to an assessment of whether ratings adequately differen­
Interaction of Market and Credit Risk contains a more in-depth discus­ tiate risk, and whether estimates of risk components (such as PD, LGD or
sion of these issues and references to relevant papers. EAD) appropriately characterise the relevant aspects of risk."

216 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
predicted forecast against which actual outcomes may be com­ would be covered by our broad definition of validation, creating
pared. Economic capital models are conceptually similar to VaR a layered approach. The more layers that can be provided, the
models, though the long time horizon, high confidence levels, more comfort that validation is able to provide evidence for or
and the scarcity of data force validation methods to differ in against the performance of the model. Conversely, where fewer
practice to those used for VaR. Full internal economic capital layers of validation are used, the level of comfort diminishes.
models are not used for Pillar 1 minimum capital requirements, Second, that each validation process provides evidence for (or
and so fitness for purpose needs to cover a range of uses, most against) only some of the desirable properties of a model. The
of which and perhaps all are internal to the firm in question. It list presented below moves from the more qualitative to the
should also be noted that economic capital models and regula­ more quantitative validation processes, and the extent of use is
tory capital serve different objectives and so may reasonably dif­ briefly discussed.
fer in some of the details of their implementation for these
differing purposes. Qualitative Processes
Principle 1 of the Basel Committee's validation principles refers (i) Use test. The philosophy of the use test has been fully
to assessment of the predictive ability of credit rating system s.19 incorporated into the Basel II Framework. Its relevance as a
The emphasis is on the performance of forecasts generated by tool of validation is straightforward. If a bank is actually
the model. As it stands, Principle 1 is about rating systems: the using its risk measurement systems for internal purposes,
natural development of this principle for economic capital mod­ then supervisors can place more reliance on the systems'
els is that validation is concerned with the predictive properties outputs for regulatory capital. Applying the use test suc­
of those models. Economic capital models embody forward- cessfully will entail gaining a careful understanding of which
looking estimates of risk and their validation is intimately bound model properties are being used and which are not.21
up with assessing those estimates and so this (re-stated) princi­ (ii) Q ualitative review. Banks tend to subject their models to
ple remains appropriate. The validation processes as set out in some form of qualitative assessment process. This process
this paper are, in their different ways, all providing insight into could entail review of documentation, review of develop­
the likely predictive ability of the model, interpreted broadly. ment work, dialogue with model developers, review and
The other Basel II principles related to validation principles are: derivation of any formulae, comparison with what other
the bank has primary responsibility for validation; validation is an firms are known to do, comparison with publicly avail­
iterative process, there is no single method, validations should able information. Qualitative review is best able to answer
encompass both quantitative and qualitative elements; and questions such as: Does the model work in theory? Does it
validation processes and outcomes should be subject to inde­ incorporate the right risk drivers? Is any theory underpin­
pendent review. The notion of validation expressed in this paper ning it conceptually well-founded? Is the mathematics of
is consistent with these principles. Our discussion of validation the model right?
does not address, however, the question of who needs to per­ (iii) System s im plem entation. Production-level risk measure­
form the model assessment or which party needs to be satisfied ment systems should go through extensive testing prior to
by that model assessment. implementation, such as user acceptance testing, check­
ing of model code, etc. These processes could be viewed
as part of the overall validation effort, since they would
What Validation Processes Are in Use? assist in evaluating whether the model is implemented with
Most of this section describes the types of validation processes integrity.
that are in use or could be used. The list is not comprehensive,
and it is not suggested that all techniques should be used by
banks. Other surveys that provide fuller descriptions of tech­
niques are available.20 Our purpose is to make two points. First, 21 Paragraph 4 of the Basel Committee's validation principles sets out
some of the uses of capital models. In discussing the use test for IRB,
to demonstrate that there is a wide range of techniques that the paper notes " . . . as a quality check of IRB components and under­
lying processes, the use test is a necessary supplement to the overall
validation process. . . . the use test plays a key role in ensuring and
encouraging the accuracy, robustness and timeliness of a bank's IRB
19 Principle 1 reads: "Validation is fundamentally about assessing the
components, confirms the bank's trust in those components and allows
predictive ability of a bank's risk estimates and the use of ratings in
supervisors to place more reliance on their robustness and thus on the
credit processes."
adequacy of regulatory capital." We think that this philosophy still holds
20 See BCBS (2005b). true when considering internal capital models.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 217

(iv) M anagem ent oversight. Management oversight refers to complement to the examination of assumptions and sensi­
the involvement of senior management in the validation tivity testing described in the preceding paragraph.
process, in reviewing output from the model, and using the
It is worth noting that checking of model inputs is unlikely
results in business decisions. Senior management need to
to be fully satisfactory since every model is based on
be clear how the model is used and how the model outputs
underlying assumptions. The richer or more sophisticated
are interpreted, taking account of the specific implementa­
the model, the more susceptible it may be to model error.
tion framework that their firm has adopted and the assump­
Checking of input parameters will not shed light on this
tions underlying the model and its parameterisation.
area. However, model accuracy and appropriateness can
(v) Data quality checks. Not traditionally viewed by the industry be assessed, at least to some degree, using the processes
as a form of validation but increasingly forming a major part described in this section.
of regulatory thinking. Data quality checks refers to the pro­
(ii) M o d e l replication. A useful quantitative technique is to try
cesses designed to provide assurance of the completeness,
to replicate the model results obtained by the bank. A truly
accuracy and appropriateness of data used to develop, vali­
independent replication would use independently devel­
date and operate the model. These processes could include
oped algorithms and an alternative source of data but in
qualitative review (e.g., of data collection and storage), data
practice replication might be done by leveraging some of
cleaning processes such as identifying errors, reviews of the
the bank's processes. For example, it could be done by run­
extent of proxy data, review of any processes that need to
ning the bank's algorithms on a different data set or using
be followed to convert raw data into suitable model inputs
the bank's own databases with independently derived algo­
(e.g., scaling processes), and verification of transaction data
rithms, once the banks' processes have been validated and
such as exposure levels. Such a list is often a helpful indica­
are reliable. This technique (and the questions that often
tion of the level of understanding of the model.
arise in attempting to replicate results) can help to identify
(vi) Exam ination o f assum ptions— sensitivity testin g. Models whether or not the definitions and the algorithms that the
rest on assumptions of various kinds, some of which are bank says it is using are correctly understood by staff in
obvious, but some are less so. As such, certain aspects of the bank who develop, maintain, operate and validate the
models are "built-in" and cannot be altered without chang­ model and that they are used in practice by the bank. The
ing the model. To illustrate, these assumptions could be: technique also facilitates code checking and may be help­
assumptions about fixed model parameters such as cor­ ful in determining whether the databases analysed in the
relations or recovery rates; assumptions about the shape validation process are those used by the bank to obtain its
of tail distributions; and assumptions about the behaviour results. This technique is rarely sufficient to validate mod­
of senior management or of customers. Some banks go els and in practice there is little evidence of it being used
through a deliberate process of detailing the assumptions by banks for either validation or to explore the degree of
underpinning their models. This should include examination accuracy of their models. Note that replication simply by
of the impact on model outputs, and the limitations that the re-running a set of algorithms to produce an identical set
assumptions place on model usage and applicability. of results would not be sufficient model validation due
diligence.
Quantitative Processes (iii) Benchm arking and hypothetical p o rtfo lio testin g. This refers
(i) Validation o f inputs and param eters. Some model param­ to the examination of whether the model produces results
eters may be estimated. Examples include the main IRB comparable to a standard reference model or comparing
parameters and correlation parameters. A complete model models on a set of reference portfolios. Examples of bench­
validation would involve validation of the inputs themselves. marking could include comparison of risk ranking provided
Validation of input parameters to economic capital models by internal rating systems and agency ratings, or compari­
would entail validation of those parameters not included in son of an in-house portfolio credit model to other well-
IRB, such as correlations. Techniques could include check­ known models after standardisation of parameters. In the
ing model parameters against historical data, comparison regulatory field, this permits comparison of several banks'
of parameters against outcomes over time, comparison of models against the same reference model. It would allow
model parameters to market-implied parameters such as identification of models that produce outliers. Hypotheti­
implied volatility or implied correlation, and assessing mate­ cal portfolio testing means comparison of models against
riality of model output to input and parameters through the same reference portfolio. It is capable of addressing
sensitivity testing. Testing of input parameters would be a similar questions to benchmarking by different means. The

218 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 technique is a powerful one and can be adapted to anal­ systems in use whose outputs cannot be interpreted in
yse many of the preferred model properties such as rank­ this way. Examples could include rating systems, sensitivity
ordering and relative risk quantification. But there are also tests and aggregated stress losses. Such risk measurement
limitations. In particular, benchmarking can only compare approaches might nevertheless be valuable tools for banks.
one model against another and may provide little assurance The role of backtesting for such models, if they were to be
that the model accurately reflects reality or about the abso­ used, would need elaboration.
lute levels of model output. In a benchmarking exercise, In practice, backtesting is not yet a key component of
there may be good reasons why models produce outliers. banks' validation practices for economic capital purposes.
They may, for example, be designed to perform well under
(v) Profit and loss attribution. Analysis of profit and loss on
differing circumstances, or may be conservatively param-
a regular basis (e.g., annually) and comparison between
eterised, or may differ in their economic foundations, all of
causes of actual profit and loss and the risk drivers in the
which complicate interpretation of the results.
model. Attribution is not widely used except for market risk
Benchmarking is a commonly used form of quantitative pricing models.
validation. Comparisons are made with industry survey
(vi) Stress testing. This covers both stressing of the model and
results, against alternative models such as a rating agency
comparison of model outputs to stress losses.
model, industry-wide models, consultancy firms, academic
papers and regulatory capital models. However, as a valida­ The outputs of the model might be examined under conditions
tion technique, benchmarking has limitations, providing of stress, where model inputs and model assumptions might be
comparison of one model against another or one calibration stressed. This process can reveal model limitations or highlight
to others, but not testing against "reality." It is therefore capital constraints that might only become apparent under
difficult to assess the degree of comfort provided by such stress. Stress testing of regulatory capital models, particularly
benchmarking methods, as they may only be capable of IRB models, is undertaken by banks but there is more limited
providing broad comparisons confirming that input param­ evidence of stress testing of economic capital models.
eters or model outputs are broadly comparable. Through a complementary programme of stress testing, the
(iv) Backtesting. Backtesting addresses the question of how bank may be able to quantify the likely losses that the firm
well the model forecasts the distribution of outcomes. Back­ would confront under a range of stress events. Comparison of
testing may take many forms and there is a wide literature stress losses against model-based capital estimates may provide
on the subject. All backtesting approaches entail some a modest degree of comfort of the absolute level of capital.
degree of comparison of outcomes to forecasts, and there Banks report some use of this stress testing technique to vali­
is a wide literature on the subject. date the approximate level of model output.

For portfolio credit models, the weak power of backtesting Internal audit is not included in the above list, however vali­
is noted in BCBS (1999). As has been suggested by some dation of the overall implementation framework and process
authors, there are variations to the basic backtesting should also be subject to independent and periodic review and
approach which can increase the power of the tests. Exam ­ this work should be made by parties within the banking organ­
ples include: performing backtesting more frequently over isation that are independent of those accountable for the design
shorter holding periods (e.g., using a one-day market risk and implementation of the validation process. One possibility
backtesting standard versus the 10-day regulatory capital could be that internal audit would be in charge of undertaking
standard); using cross-sectional data by backtesting on a this review process. As such it could be viewed as comprising
range of reference portfolios;22 using information in fore­ a part of the management oversight process listed above. The
casts of the full distribution;23 testing expected losses only; paper does not otherwise discuss the role of internal audit in the
and comparing outcomes against the expected values of validation process.
distributions as opposed to high quantiles. The list of validation tools does not address the issue of ade­
Backtesting is useful principally for models whose outputs quate standards. Banks may operate internal standards that are
can be characterised by a quantifiable metric with which relevant for validation. For example, a description of the issues
to compare an outcome. There may be risk measurement that need to be addressed as part of validation, the standards
that capital models are expected to achieve, a series of quanti­
tative thresholds that models need to meet, warning indicators
22 See Lopez and Saidenberg (1999). for particular monitoring metrics, assessment against model
23 See Frerichs and Loffler (2002) and Berkowitz (2000). development standards.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 219

What Aspects of Models Does Validation models, typified by the IACPM and ISDA study (2006) on portfo­
lio credit risk models. There is some evidence that banks wish to
Cover?
ensure that models are sensitive to the expected drivers of risk,
The validation steps presented above can be used in assessing and that models generate outputs that permit adequate evalu­
most of the desirable properties of models. This is an encourag­ ation of the relative risk between business lines and to provide
ing observation and stands in contrast to the fairly negative view suitable trend analysis. Although there is scope for practices to
of validation taken in BCBS (1999). improve further, the signs of progress in these areas are moder­

Opinions may reasonably differ about the strength or weakness ately encouraging.

of any particular process in respect of any given property. The In other respects industry validation practices are weak, par­
properties that could be assessed using a powerful tool and ticularly when the total capital adequacy of the bank and the
hence that are capable of robust assessment include: integrity of overall calibration of the model is an important consideration. It
implementation; grounded in historical experience; risk sensitiv­ is recognised that this validation task is intrinsically difficult since
ity; sensitivity to the external environment; good marginal prop­ it will typically require evaluation of high quantiles of loss distri­
erties; rank ordering; and relative quantification. The properties butions over long periods combined with data scarcity coupled
for which only weaker processes are available include: concep­ with technical difficulties such as tail estimation. Moreover, it is
tual soundness; forward-looking; and absolute risk quantifica­ recognised that validation practices will depend on what the
tion. Again, it is important to stress the judgmental evaluation of model is being used for. Nevertheless, difficult as the validation
the power of individual tests and to acknowledge that views as task might be, weaknesses in validation practices targeted at
to strength and weakness are likely to differ. evaluation of overall performance might result in banks operat­

The difficulty of validating the conceptual soundness of a capital ing with inappropriately calibrated models. This could be of con­
cern if assessment of overall capital adequacy is an important
model needs some elaboration. In developing a model, sev­
eral assumptions about the model and its inputs are likely to application of the model. Improvements in these areas could
include further benchmarking and industry-wide exercises, back­
be made. These could include assumptions about the family of
statistical distributions, the economic processes driving default testing, profit and loss analysis and stress testing.

or loss, the dependency structure among defaults or losses, Additionally, institutions should recognise clearly that when vali­
the likely behaviour of management or other economic agents, dation is difficult and has limitations, i.e., when for one reason or
and the extent to which these vary over time. Moreover, some another models cannot be appropriately validated, users of those
internal capital models are risk aggregation models, where risk models and senior management should be informed that full
estimates for individual categories (e.g., market, credit and validation could not be conducted. Such communication is nec­
operational risk) are aggregated to generate a single total eco­ essary so that model users and senior management understand
nomic capital figure, with the method of aggregation relying on that there is greater uncertainty around the output from models
some underpinning assumptions. These assumptions, however, that have not been validated and that such model output should
may be untestable. As a result it may be impossible to be cer­ generally be treated with extra conservatism. In that vein, model
tain that a model is conceptually sound. While the conceptual users and senior management should understand and explore the
underpinnings may appear coherent and plausible, they may in potential costs of using models that have not been fully validated
practice be no more than untested hypotheses. (i.e., if key assumptions in the models prove to be inaccurate).

This section presented the main validation tools available with

which to assess internal capital models and provided some eval­
uation of their power and their use in practice. The conclusion is 13.8 ANNEX 1: DEPENDENCY
that tools are powerful in some areas such as risk sensitivity but MODELLING IN CREDIT RISK MODELS*
not in other areas such as overall absolute accuracy.
A particularly important and difficult aspect of portfolio credit

Supervisory Concerns Relating to risk modelling is the modelling of the dependency structure
between borrowers. This encompasses linear and non-linear
Validation
dependency relationships between obligors. Dependency
Compared to practice at the time of the BCBS (1999) report, modelling is important because it forms an important distinc­
there is greater emphasis currently on the validation of mod­ tion between the Basel II risk weight function (with supervisory
els. The main areas of improvement are in benchmarking of imposed correlations) and portfolio credit risk models which rely
model parameters and the conduct of cross-firm comparisons of on banks' internal modelling of dependencies.

220 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Understanding the way dependencies are modelled is important
for supervisors when they assess a bank's ICAAP under Pillar 2, BOX 13.1 CONTAGION APPROACH
since internal bank modelling of portfolio credit risk may be an
Motivated by the financial crises in South East Asia and
important element of a bank's ICAAP and can generate the big­ the US in the 1990s, and the Enron default crisis in late
gest reduction of capital needs in comparison with the Pillar 1 2001, where the downfall of a small number of firms had
minimum capital requirement for credit risk. an economy-wide impact, academic researchers have
attempted to incorporate counterparty relationships, or
This annex briefly describes the main methods used for model­ microstructure correlation, into portfolio credit models
ling credit dependencies and discusses progress since the pub­ (Davis and Lo (2001), and Jarrow and Yu (2001)). The com­
lication of the BCBS (1999) report. It also discusses the impact mon feature of contagion models is that they distinguish
that different methods have on banks' economic capital, and between macrostructure and microstructure dependencies.
In contrast to macrostructure dependencies, microstruc­
makes some observations linked to recent developments in
ture dependencies attempt to capture business relation­
dependency modelling. Finally, it raises some supervisory con­ ships and legal dependencies within and across sectors.
cerns about the current state of industry practice. This approach is also relevant for pricing CDSs, CD O s, and
basket derivatives, since the prices for these products are
influenced by dependencies between the firms in a basket,
Types of Models a business (e.g., suppliers and competitors), etc.

The majority of banks use one of three types of credit models. The microstructure contagion effect can be integrated
using different approaches, (e.g., reduced-form models).
These models, often referred to by their commercial names, are
The idea behind contagion models is that contagion risk
Moody's/KMV (MKMV), CreditM etrics, and CreditRisk-h The produces upward jumps in the default intensity of non-
annex follows the same convention even though other vendors defaulted firms, implying a higher conditional default
offer similar models and some banks have developed their own probability for these firms given additional information
internal models that are consistent with the structure of one of on other firms' defaults. The driving principle behind
such modelling is that considering only macroeconomic
these model types.24
dependencies for a portfolio subject to microstructure
Most models of credit portfolio risk estimate asset correla­ dependencies could potentially underestimate credit
tions among obligors in terms of common dependence on risk. By integrating microstructure dependencies into the
model, the standard deviation of rating changes over time
systematic risk factors. The assumption is that these underlying
is increased, even for well-diversified credit portfolios with
factors— e.g., country, region, or industry of a borrower— fluctu­
moderate microstructure dependencies.
ate over time and typically follow a (joint) normal distribution. All
Generally, the contagion approach is supposed to be con­
borrowers are linked to these underlying systematic risk factors
servative since it lengthens the tail of the loss distribution
to varying degrees and tend to move in a correlated way. Thus, and therefore increases the capital needed to cover credit
by modelling dependencies, banks account implicitly for con­ risk. However, it is difficult to gauge whether the increase
centration (both single name and sectoral) because large parts in capital is sufficient to capture the risk dependencies.
of their books are subject to the same underlying risk factors or Additionally, practical and theoretical issues need to be
addressed, such as the reliability of the required expert
to multiple risk factors.
judgment and ability to identify the frailty/contagion factors.
Extensions of the three credit portfolio models are used by
some banks. For example, this is the case for a few banks with
specialised portfolios (e.g., small and medium-size European portfolios that are linked to bank specific portfolio concentration
corporate loans) which have integrated a contagion approach and exposure mix.
into variants of the standard credit portfolio models (see
In addition, few banks model dependencies using copulas (see
Box 13.1). By integrating information on business relationships
Box 13.2), at least for their economic credit risk modelling. This
among borrowers into the credit portfolio model, this approach
technique can be used to capture several alternative general
tries to address the clustering of defaults observed within their
types of dependencies, as opposed to the more restrictive
Gaussian copula models.25

Some banks also use models that are based on the asymptotic
24 The discussion of these model types is descriptive and is not intended single-risk-factor (ASRF) model, which is the basis for the Basel II
as an endorsement of any of the vendor models. Reference to these
prototype models should not be construed as an endorsement of these
models, or as an indication of their standing relative to other models
that might be used by banks or offered by other vendors. 25 See for example Hull (2007) for a discussion of copulas.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 221

 BOX 13.2 COPULAS
Some banks model dependencies using copulas. Within the which are 1 if default occurs during a specified period and 0
context of credit risk modelling, copulas are used to model otherwise. If q, is the underlying random variable denoting
dependencies between the defaults of credit obligations in for example the time to default of obligor /', and li T is the
a portfolio. Given that one obligor has defaulted, other obli­ indicator random variable denoting default before time T, the
gors in the portfolio might be more likely to default because relation between q ,■and li T is:
they are connected to the defaulted obligor directly (e.g., if
the defaulted obligor is the creditor of another) or indirectly \ if q < T
/i j
(e.g., if another obligor is in the same industry). 0, if g. > T

For a collection of random variables with given marginal If the distributions of these time-to-default variables are
distributions (the univariate probability distribution of each combined using a copula, a joint distribution function for the
random variable) a copula specifies how these random vari­ time-to-default variables is obtained. Taking random samples
ables combine into a multivariate distribution, and thus speci­ from this joint distribution, and given a specified time hori­
fies the dependencies between the random variables. Some zon, each sample from the distribution will translate into a set
copulas like the Gaussian copula are characterised by a corre­ of defaulting and non-defaulting obligations within the port­
lation matrix, while other copulas describe dependencies that folio over that time period.
are non-linear or too complicated to be accurately described
The first copula to be widely used in the context of credit
by correlation parameters. A copula is a mapping that trans­
modelling was the Gaussian copula. One important short­
forms the marginal distributions for a collection of random
coming of the Gaussian copula is that it displays zero tail
variables into a joint distribution for all the random variables.
dependence. Besides the Gaussian copula, copulas based
When copulas are used in credit risk modelling, the underly­ on other multivariate distributions (particularly the Student-t
ing random variables of interest may be the time to default distribution) are often used with the goal of capturing depen­
of each obligation in a portfolio, or in Merton type models, dencies between defaults that have a stronger impact on the
the asset values of the obligors. In the latter case, the obligor tail of the loss distribution. For example, the t-copula has a
defaults when its asset value falls below a certain threshold. parameter for "tail association" or dependence. The distribu­
These underlying variables are continuous random variables, tions produced by copulas are usually not tractable analyti­
and they express the likelihood of default in a different way cally, and as a result, copulas are most frequently used in
from the more familiar (discrete) indicator random variables, running portfolio default simulations.

risk weights for credit risk.26 Within this modelling approach, what extent the economic capital estimates produced by the
banks may use their own estimates of correlations or may use models differ from each other. To shed some light on this empiri­
multiple systematic risk factors in order to address concentra­ cal question, the International Association of Credit Portfolio
tions. Such a modelling approach raises several supervisory con­ Managers (IACPM) and International Swaps and Derivatives Asso­
cerns about the method used to calibrate the correlations and ciation (ISDA) conducted a study in 2006 to explore the economic
the ways in which the bank addresses the infinite granularity and credit capital models in use by their member institutions.
single-factor structure of the ASRF model.
The IACPM and ISDA (2006) study evaluated the degree of con­
Under the impetus of the Basel II Framework, banks have also vergence of economic capital estimates across commercially
increased their use of bottom-up approaches in their credit risk available credit portfolio models and across internally developed
dependency modelling. As a result, credit portfolio models are credit risk models implemented by banks. Given that most
much more integrated into daily risk measurement and manage­ banks use one of the three main commercially available credit
ment than was the case in 1999. risk models mentioned above or internally developed imple­
mentations of the same types of models, the study was effec­
The IACPM and ISDA Study tively a comparison of the economic capital estimates generated
by these commercially available models, run either in default
Given the differing approaches to modelling dependencies
mode or in mark-to-market m ode.27 The study applied the
between borrowers described above, the question arises as to

26 The ASRF model is also referred to as a single-factor Gaussian copula 27 Credit RiskH- is exclusively a "default mode" model. Default mode
model. For this model, the capital charge for an exposure depends on refers to the situation where credit losses arise only if a borrower
the risk characteristics of this exposure only (i.e., PD, LGD, EAD, matu­ defaults within the planned time horizon. Mark-to-market credit losses
rity) and does not depend on the composition of the portfolio to which can arise in response to deterioration in an asset's credit quality before
the exposure is added. the end of the planning horizon.

222 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
different credit models to a representative portfolio of transac­ Supervisory Concerns Relating to
tions that was assembled with pre-specified data assumptions
Currently Used Credit Portfolio Models
regarding risk characteristics. By eliminating different data char­
acteristics and portfolio composition as sources of potential dif­ Shortcomings of Dependency Modelling
ferences in economic capital estimates, remaining differences Regarding dependency assumptions used in credit portfolio
are largely due to differences in the modelling approaches. O ut­
models, supervisors can question the accuracy and robustness
comes of the study may also be dependent on the composition of correlation estimates used by banks since these estimates
and characteristics of the test portfolios used in the study. depend heavily on (explicit or implicit) model assumptions and
The study showed significant differences in economic capital can significantly influence economic capital calculations. These
estimates between the different models, in default-only mode assumptions are even more problematic when the dependency
as well as in mark-to-market mode. The differences in economic modelling and calibration methods used are embedded in pro­
capital estimates between the models can be explained in prietary third-party vendor credit risk models, which essentially
terms of the following factors: correlation structure; treatment can be viewed as "black boxes."
of interest payments due between time zero (point of valua­ Beyond the issues raised by the basic approaches used in struc­
tion) and the time horizon (point of default) and whether this tural and reduced-form credit portfolio models, the validity of
was accounted for in the definition of loss; and other modelling several other assumptions has been examined in the academic
differences. literature. For example, the validity of the following assump­
O f special interest in the context of this annex is the question: tions has been drawn into question: the asymptotic single-factor
How much of the difference in economic capital is due to corre­ Gaussian copula approach; the normal distribution for the vari­
lation structure/dependency modelling assumptions? In default- ables driving default; the stability of correlations through time;
only mode, the differences could be explained to a large extent and the joint assumptions of correctly specified default probabil­
by the different treatment of interest payments (i.e., by the dif­ ities and doubly-stochastic processes, which imply that default
ference in definition of loss), with the correlation structure play­ correlation is adequately captured by common risk factors.
ing only a minor role. However, in mark-to-market mode, where Several academic papers question the ability of some models
changes in revaluations at the horizon for non-defaulted assets using such assumptions to explain the time-clustering of defaults
may also be correlated, and where the impact of differences in that is observed in some markets. This in turn, when combined
the modelling of correlations is larger, roughly a quarter of the
with inadequately integrating the correlation between PD and
observed difference in economic capital estimates is attributable LGD in the models and inadequately modelling LGD variability,
to correlation assumptions.
can lead to an underestimation of economic capital needed. In
Another issue involves the sensitivity of economic capital esti­ addition, it will make it difficult to identify the different sources
mates to changes in portfolio concentrations and model param­ of correlations and the clustering of defaults and losses.
eters. Sensitivity analysis performed in the IACPM and ISDA For example, Das et. al. (2007) found that U.S. corporate default
study showed that a change in the sector or country composi­ rates between 1979 and 2004 vary beyond what can be
tion of the representative portfolio had a large impact on eco­ explained by a model that only includes observable covariates.
nomic capital estim ates.28 Furthermore, the impact differed
Moreover, Duffie et. al. (2006) found evidence of the presence
between the different types of credit risk models. This evidence among U.S. corporate default rates of one or more unobserv­
provides empirical support for the notion that the output of able common sources of default risk that increase default corre­
credit risk models significantly depends on the underlying corre­ lation and extreme portfolio loss beyond that implied by
lation structure. Differences in correlations could be structural in observable common and correlated macroeconomic and firm-
nature since different models may use different data to calibrate specific sources of default risk.30 However, there are practical
correlations (e.g., historical equity returns versus default rate limitations of the "frailty approach" (i.e., modelling default clus­
data), or could be due to time-varying correlations.29 tering with latent risk factors) including the computational cost,
and the failure to identify the frailty factor, hampering the ability
28 For example, it could double the amount of economic capital for
credit risk.
29 The IACPM and ISDA study concludes that when loss assumptions are 30 As pointed out by Das et. al. (2007) and others, known factors
aligned across both vendor and internal credit portfolio models, esti­ account for a very large fraction of the default correlation observed in
mates of economic capital for credit risk can be shown to converge for the data. As a result, a practical approach to overcoming the shortcom­
default-mode models. Differences in the capital estimates for mark-to- ing of the frailty factor is to use conservative estimates of asset correla­
market models can be reduced, but not eliminated. tions and to conduct stress testing.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 223

of banks to make practical decisions in managing the risk from the distribution of asset returns)31 can lead to significant inaccu­
the frailty factor. racies in measures of portfolio credit risk and economic capital.

With respect to the stable correlation hypothesis, Bangia et. al.

(2000) found that rating transitions are sensitive to the business
Use of Credit Dependency Modelling
cycle and are explained by different models during expansion­ One of the main supervisory concerns is that some banks use
ary and recessionary periods. Therefore, the sample period and credit portfolio models without always having a full understand­
approach used to calibrate the dependency structure could be ing of all the underlying assumptions and modelling techniques
important in assessing whether correlation estimates are overes­ embedded in them. W hether such models are suitable for differ­
timated or underestimated, and therefore whether they should ent portfolios (retail, structured products, etc.) as well as for the
be reviewed. specific concentration and exposure mix characteristics of their
own portfolios should be assessed.
Other assumptions can also impact correlation calibration.
For example, when a model assumes that unobservable asset For example, it seems that the use of asset return correlations
returns can be approximated by changes in equity prices, it derived from equity prices has become a market standard for
does not account for the fact that the relationship between portfolios of large corporates, despite the limitations associated
asset returns and equity prices is unobservable and could also with such an approach.
be non-linear. Similarly, when equity prices are used to estimate
It is important to consider whether the uncritical use of asset
credit default probability, the issue arises that although such
correlations for other portfolios such as SME and retail borrow­
prices can cover a wide range of industries and geographical
ers is adequate. The estimated correlations could be meaning­
locations, they also reflect information that is unrelated to credit
fully used as long as they are applied to large, publicly traded
risk. Consequently, the use of equity prices can introduce some
borrowers. The appropriateness of using such data to estimate
noise in the correlation estimates.
correlations for other exposures such as non-traded, small and
On the other hand, when banks use a regulatory-type approach, medium-sized enterprises and retail borrowers is less clear. Spe­
with single or multiple risk factors, the assumptions of such cifically, corporate, SME and retail portfolios are data-rich, which
an approach poses two important issues for both banks and means that the derivation of different default correlations from
supervisors: internal bank data could be envisaged in some cases. For non
traded SME portfolios, there are third-party vendors that might
• Since the correlation estimates are explicit parameters in the
also provide relevant data for some local markets.
Basel ASRF model, they would need to be estimated. There
may be limited historical data on which to base the correla­ However, banks do not generally calibrate their retail and SME
tion estimates, and the assumptions used to generate the correlations separately. Instead they use shortcuts, such as assign­
correlations may not align with the underlying assumptions of ing retail borrowers to the no industry category in a credit portfo­
the Basel II credit risk model. lio model. It remains to be seen whether these shortcuts provide
• If a bank uses the Basel II risk weight model (either with a meaningful measure of risk for SME and retail portfolios.
supervisory or with its own correlations), it must account for The use of more complex models (e.g., contagion models and
concentration risk (single name and industry/regional con­ Gaussian and non-Gaussian copulas), which need technical,
centrations) by other measures and/or management methods judgmental and modelling expertise, could also be viewed as
(e.g., limit setting), and supervisors will have to evaluate too burdensome, uncertain, unstable or inappropriate to imple­
these approaches. ment. Assuming that banks gather enough data to estimate
The concern about assumptions is important since they can have more reliable correlations using internal data in the future, it
a significant impact on measures of portfolio credit risk and the would be useful for the industry to make progress in estimating
measurement of economic capital. For example, Tarashev and correlations for other exposures, such as SM E, retail, and struc­
Zhu (2007) demonstrate, by comparing the loss distributions tured products, and to analyse which data, models, and tech­
produced by the KMV and the ASRF models, that the single­ niques are the most relevant for these portfolios.
risk-factor and infinite granularity assumptions of the ASRF
model have small impacts on measurement of capital needs,
especially for large, well-diversified portfolios. By contrast, the 31 With respect to the loss distributions, they are more likely to follow
double-t distributions with medium to high degrees of freedom instead
use of misspecified or incorrectly calibrated correlations and the of normal distributions. Such misspecification can imply an underestima­
use of a normal distribution (which fails to replicate the tails of tion of economic capital that ranges from 22-86%.

224 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
13.9 ANNEX 2: COUNTERPARTY which measures the exposure if the counterparty were to default
today, and potential exp o su re, which measures the potential
CREDIT RISK increase in exposure that could occur between today and some
time horizon in the future. One feature of derivatives and securi­
Counterparty credit risk (CCR) at large, complex banks centres
ties financing relationships is that, while the amount of current
on the measurement and management of financial exposure
exposure to a counterparty is known, the amount of potential
and the resulting credit risk associated with core credit exten­
exposure to a counterparty is an unknown quantity (in fact,
sion activities of these financial institutions to a wide range of
given the nature of derivatives contracts and securities financing
counterparty types. Counterparty credit risk takes a variety of
arrangements, there may be no exposure to the financial institu­
forms, including credit risk emanating from activities in O TC and
tion at the time of a counterparty default). Therefore, counter­
exchange-traded derivatives, from securities financing activities,
party credit exposure is generally measured as some statistic
and from foreign exchange settlements. The counterparties to
(such as a mean or a percentile) of the distribution of possible
these financial institutions take a wide variety of forms, ranging
future exposures to the counterparty.
from sovereigns and local government entities, to regulated
financial concerns and potentially unregulated financial parties The second part of the counterparty credit measurement is
such as hedge funds, to corporate entities (both investment- converting the exposure to a risk amount for economic capital
grade and below-investment-grade). purposes or risk management purposes more generally (for
example, to inform a counterparty credit risk limit system). The
This annex is organized in two sections. The first section high­
risk measurement will be a function of the probability of default
lights the challenges that the industry faces in quantifying coun­
(PD) for the counterparty, the loss given default (LGD) for the
terparty credit risk for economic capital purposes, while the
exposure, and the exposure measurement, which is effectively
second section addresses the range of practices that financial
the exposure at default (EAD) value. The EAD value is driven by
institutions undertake in quantifying this risk. The primary focus
market-risk-related factors (the volatility and correlation among
is on modelling challenges in the quantification of counterparty
market risk factors and how they affect the derivative contract
credit risk, and thus there is no explicit consideration of the
or valuation of the securities being financed), while the PD and
comprehensive set of risk management practices that are meant
LGD are effectively determined by firm's assessment of the
to mitigate risks or to provide compensating controls for model
credit quality of the counterparty.
deficiencies, unless those practices (such as initial margin and
ongoing collateral practices related to counterparty credit risk) Counterparty credit risk measurement, therefore, necessarily
directly influence the quantification of risk. combines the tools from standard market risk measurement with
the tools from standard credit risk determination. Market risk mea­

Counterparty Credit Risk Challenges surement practices are used, for example, in mapping derivatives
exposures to a set of market risk factors, simulating those factors
Measurement of counterparty credit risk represents a complex out to a forward-looking time horizon, and determining the distri­
exercise, as it involves gathering data from multiple systems; bution of the level of exposures over various risk factor realisations
measuring exposures from potentially millions of transactions in the simulation. Separately, standard credit risk processes provide
(including an increasingly significant percentage that exhibit assessments of the credit quality of the counterparty, frequently
optionality) spanning variable time horizons ranging from over­ resulting in a credit rating of the counterparty, both from the PD
night to thirty or more years; tracking collateral and netting and LGD perspectives. Counterparty credit risk measurement
arrangements; and categorising exposures across thousands of offers unique challenges related to both the market-risk-related
counterparties. The complexities of the processes highlighted and the credit-risk-related processes, which are described next.
below indicate a need for institutions to have specialised pro­
cesses and personnel to tackle these issues and challenges. Market-Risk-Related Challenges to Counterparty
EAD Estimation
Measuring Exposure and Measuring Risk
Counterparty credit exposure measurement requires simulation
A bank's counterparty credit measurement can be conceptually of market risk factors and the revaluation of counterparty posi­
broken down into two distinct steps. First is the measurement tions under the simulated risk factor shocks, much like a value-
of counterparty cred it exp o su re — that is, how much money the at-risk (VaR) model requires. Two unique challenges present
counterparty will owe the bank in the event of default. This themselves when attempting to leverage a VaR model technol­
exposure number is further broken down into current exp o su re, ogy for counterparty credit exposure measurement.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 225

First, market risk VaR models combine all positions in a port­ credit rating, and an associated PD and ability to calculate an
folio into a single simulation, so that gains from one position LGD for the exposure. However, some important derivatives
are allowed to fully offset the losses in another position in the and securities financing activities are done with counterparties
same simulation run. Counterparty credit risk exposure mea­ (such as hedge funds) with which the financial institution may
surement, however, cannot allow netting across counterparties have no other exposures. In those cases, the financial firm must
(e.g ., a decline in exposure to one counterparty cannot be net­ determine a PD and LGD associated with the counterparty and
ted against an increased exposure to another counterparty). the facility. In the case of hedge funds, the counterparty may
Therefore, the analysis of counterparty exposure must be done have little transparency in terms of underlying fund volatility,
at the "netting set" level (that is, on each set of transactions leverage, or types of investment strategies employed, which
that form the basis of a legally enforceable netting agree­ creates a significant challenge. In the cases of counterparties to
ment). Most banks have many thousands of counterparties, which the institution has other credit exposures (e.g., a corpo­
and each of these counterparties may have many different rate client), the institution will typically be using the same PD
netting agreem ents (segregated, for exam ple, by product type used for the other exposures, but will need to arrive at a facility-
or legal jurisdiction). This situation, therefore, requires the specific LGD.
counterparty exposure measurement to perform a calculation
at the netting-set level, thereby increasing the computational Interaction between Market Risk and Credit
intensity of the calculation. Risk—Wrong-Way Risk
Second, market risk VaR calculations are traditionally performed While counterparty credit risk can conceptually be broken down
for a single short-term holding period— for example, for a single into a market-risk-driven EAD calculation and a credit-risk-driven
day or a ten-day holding period. Counterparty credit exposure PD-LGD determination, these two processes are frequently not
measurement, however, must be performed for multiple hold­ independent. This interaction, where PD and LGD may tend
ing periods into the future, as certain derivatives contracts, for to rise at the same time as the exposure to the counterparty is
example, can extend years, or even decades, into the future. rising, is known as "wrong-way risk." For counterparty credit
As a result, market risk factors have to be simulated over much exposure systems that separate EAD estimation from PD-LGD
longer time periods than in the standard VaR calculation, and estimation, the incorporation of wrong-way risk in the economic
revaluation of the potential exposure in the future must be done capital calculation is not directly feasible, but may be incorpo­
for the entire portfolio at certain points in the future. rated via an add-on in the economic capital process. Challenges
The combination of the large number of counterparties and the arise when trying to capture wrong-way risk. Wrong-way risk
large number of holding periods in the future implies that the is sometimes difficult to identify, as it requires understanding
computation challenges in effectively measuring VaR are dra­ the market risk factors that the counterparty is exposed to, and
matically increased when financial institutions attem pt to mea­ relating those factor sensitivities to the factor sensitivities of the
sure counterparty exposures for derivatives transactions. As a institution's own exposures to the counterparty. Understanding
result, a bank may decide to reduce the number of market risk the counterparties' risk factor sensitivities can be challenging,
factors considered in the simulation for counterparty credit risk especially for counterparties (such as some hedge funds) that
relative to the number considered in the market risk VaR calcu­ tend to be opaque. Even when wrong-way risk can be identified
lation. The resulting simplification can result in a reduction in directionally, it is often difficult to quantify its magnitude in an
precision of the final result, but the materiality of the reduced economic capital model (in particular, over a one-year horizon at
precision is highly dependent on the circumstances of the posi­ a high confidence level).
tions relative to the model. For exam ple, ignoring the volatil­
ity smile in a business with few trades might not be material, Operational-Risk-Related Challenges in Managing
but using a single-factor term structure of interest rate model Counterparty Credit Risk
may result in significant reduction in accuracy of the model for
Managing counterparty credit risk is a very resource-intensive
these exposures. activity, and requires specialised systems and personnel to effec­
tively implement. Daily limit monitoring, marking-to-market,
Credit-Risk-Related Challenges to PD and LGD collateral management processes, and intraday liquidity and
Estimation
credit extensions are all complicated and interlinked processes
Frequently, counterparties to financial firms for derivatives or that give rise to the possibility of operational risk difficulties.
securities financing transactions have other credit-risk-related Such operational risk exposure is generally not captured for eco­
relationships, so that the financial firm would already have a nomic capital purposes within counterparty credit risk, but may

226 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
be captured within an operational risk quantification process. Aggregation Challenges
Operational risks related to counterparty risk that are particu­
While calculation of counterparty credit risk for an individual
larly difficult to quantify involve risks of new or rapidly growing
counterparty has its challenges, these challenges are magnified
businesses, risks in new products or processes, risks in intraday
when attempting to get a firm-wide view of risk for economic
extensions of credit which are not properly captured in systems
capital purposes. Independently of the challenges in arriving at
designed for end-of-day exposure capture, and risks in areas
a counterparty credit risk economic capital measure outlined
where there have been few historical instances of losses but
above, this risk measure must be aggregated in a sensible, rigor­
where potential "tail events" may have severe consequences.
ous, and risk-sensitive way with other exposures at the financial
firm in order for the overall economic capital measure to be a
Differences in Risk Profiles between Margined reliable indicator of the aggregate inherent risk-taking by the
and Non-Margined Counterparties firm. If a single counterparty has both derivatives and securities
One important input in the measurement of counterparty financing transactions, the firm may face challenges in aggrega­
credit risk among firms' counterparties is whether the coun­ tion across the counterparty's exposures, as the various models
terparty is a margined counterparty or not. A margined coun­ and systems architectures may not be conducive to aggregation.
terparty has agreed to post collateral, either in the form of Furthermore, a firm's counterparty credit risk must be aggre­
cash or securities, when their exposure to the financial firm is gated with other credit risk-taking activities of the firm, both in
positive. W hile there are wide variations in the practices sur­ terms of loans in the banking book and credit risk in the trading
rounding margining of counterparties (minimum thresholds book. Finally, these more comprehensive credit risk measures
before a margin call is made, the frequency of margin calls, must be aggregated with overall market and operational risk in
the treatm ent of valuation of illiquid products, etc.), an impor­ order to arrive at the final economic capital measure.
tant distinction in the modelling approaches must be made A related challenge involves the ability of the counterparty credit
between counterparties who have agreed to margining (also risk system to allow risk management to have a detailed under­
known as "having a C S A "— a credit support annex to the standing of the various breakdowns of risk that are common in
master netting agreem ent that lays out the terms of the mar­ the market risk world. Breakdowns by product, by risk factor, by
gining agreement) and those who have not. Frequently, the geography, by business line, or by legal entity are difficult for
modelling difference between these classes of counterparties many firms to produce, for a variety of reasons. The computation
surrounds the treatm ent of the look-ahead forecasting period: intensity of the calculations makes the provision of such "drill
For margined counterparties, the forecasting period is short, down capabilities" expensive in terms of time to produce on a
associated with a reasonable "cure period" between when a daily basis. Fragmented computer systems and IT infrastructures,
counterparty misses a margin call and when the underlying frequently driven by a variety of legacy infrastructures from
positions can be closed out; for non-margined counterparties, merger and acquisition activity, are frequently cited culprits to
the forecasting period is generally much longer, as long as the the limitations associated with counterparty credit risk systems'
life of the contract. The variation in modelling horizons makes lack of flexibility. The IT requirements associated with Basel
the aggregation of risk across these two classes of counterpar­ M's internal models approach to the use of counterparty credit
ties a challenge, as most risk modelling approaches take a sin­ risk for regulatory capital purposes were often mentioned as a
gle modelling horizon (e.g., one day for VaR models, one year possible mechanism to address some of the existing systems'
for economic capital models) for all positions. Aggregation is rigidities, but it remains uncertain how much of the planned IT
further com plicated if, for a given counterparty, some positions investments will address the existing systems' limitations.
are margined but others are not.

Note that there still is a gap risk, even for margined counterpar­
Range of Practices
ties, which needs to be modelled and accounted for. In stress
situations that adversely affect the assets being financed, there Given the variation in size and complexity of counterparty credit
could be a risk of market gapping and rapid loss of value. Banks exposures across large financial firms, these institutions display
may need to take possession of collateral at a time when its a range of practices in measuring CCR for economic capital pur­
value is deteriorating and the market for it may be illiquid. This poses. Firms employ one of two general modelling approaches
risk may be amplified by the presence of exposure concentra­ to quantify the counterparty credit risk exposures. While these
tions within the firm, or by "crowded trades," where several models may be supplemented with complementary measure­
firms may be taking possession of similar collateral and seeking ment processes, firms typically have adopted one of two mea­
to liquidate it at the same time. surement "engines":

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 227

The first is a stand-alone simulation engine, typically im ple­ Counterparty Credit Risk Processes for High Risk
menting a Monte Carlo approach ("M onte Carlo M odel"). This Counterparties
simulation normally spans a long forecasting horizon— often
Firms continue to be challenged by the opacity of risks for cer­
encompassing the contractual life of the transaction— and then
tain counterparties, such as hedge funds, and have developed
selects an average exposure measurement or a percentile of
enhanced processes to identify, measure, monitor, limit, control
the resulting exposure distribution to quantify the exposure
and report the risks from these counterparty relationships.
for a transaction or a portfolio of transactions at different
points in time over the forecasting horizon. The banks em ploy­
ing this approach for collateralised counterparties will typically Ancillary Processes to View Counterparty
use the same approach to measure uncollateralised counter­ Credit Risk
party exposures. Due to the challenges of developing a highly nuanced view of
The second approach is a "value-at-risk" ("VaR")-type CCR counterparty credit risk for economic capital purposes, banks
exposure engine ("VaR M odel"), typically achieved by leverag­ have developed ancillary processes to help manage and measure
ing the firm's existing market risk VaR processes. This approach these risks. Concentration risk identification and stress testing
estimates the distribution of CCR exposures over a relatively are two of the key risk management processes that attempt to
short-term liquidation (or "closeout") horizon. The banks quantify the risks in counterparty credit relationships that may be
employing this approach for collateralised counterparties still poorly measured by the core counterparty credit risk engines.
typically use a Monte Carlo approach to measure uncollater­ Concentration risk identification involves a set of ancillary analyt­
alised exposures with longer-term horizons. ics, mostly outside of the main counterparty credit risk engine,
which attempts to identify large exposures by individual coun­
The decision of whether to use Monte Carlo Model or VaR-type
terparty, by the set of counterparties of lower credit ratings,
model to quantify CCR exposures for collateralised counterpar­
by underlying risk factor, or by other dimensions that the firms
ties involves a variety of trade-offs.
have identified as important measures of concentration that are
The VaR-type model leverages well-developed and already vali­ deemed worthy of monitoring. However, one should keep in mind
dated data and analytical systems, thereby permitting usage of that concentration of positions with larger counterparties— ones
a large set of risk factors deployed for market risk measurement. that may actually enjoy enhanced diversification benefits dur­
Due to the computational intensity, however, the VaR-type model ing moments of stress— may be less harmful than the aggregate
is practical only for quantifying the exposure profile over a single exposure of trades with a collection of smaller counterparties.
short-term forecasting horizon, which can be utilised for collat­
Stress testing, also performed outside of the main counterparty
eralised counterparty credit risk assessments. Consequently, the
credit risk engines, involves a variety of diagnostic tools designed
VaR-type model exhibits the limitation that it cannot produce a
to identify risk vulnerabilities that the main risk engine may not cap­
profile of exposures over time, which is necessary for counterpar­
ture or identify. Stress tests, however, are frequently not fully com­
ties that are not subject to daily margining agreements.
prehensive of all counterparty credit risk exposures. Stress tests
The Monte Carlo model, on the other hand, allows for the quan­ may be performed on a subset of the entire universe of counter­
tification of longer-term exposures but at the potential expense parties (for example, on only counterparties that do not have daily
of a less accurate measurement of CCR exposure given the nec­ margining agreements, or on only "highly leveraged" counterpar­
essary use of simplified risk factor representation. ties). Sometimes, not all counterparty positions are included in the
stress tests (for example, positions that are treated with "add-ons"
Use of Add-Ons may be excluded from the stress tests, as the simple add-on may
deemed to be a sufficiently conservative treatment of the risks for
Counterparty credit risk engines may not effectively capture
stress testing purposes). Finally, stress tests are frequently treated
the risks of all financial products. For products not effectively
as a diagnostic tool of risk management, and may have no associ­
captured by counterparty credit exposure measurements, many
ated limits or escalation procedures associated with them.
firms revert to an "add-on" factor, which provides a simplified
but conservative measurement of the exposure for that product. Additionally, while wrong-way risk may be missed in the main
While generally calibrated to be conservative, the add-on factors counterparty credit risk quantification process, many firms have
are frequently not risk sensitive (e.g., the factors may not change separate processes to measure and to limit the level of wrong­
as market volatility rises and falls) and frequently do not allow for way risk in their counterparty credit risk relationships, where it
netting, hedging or diversification effects across risk factors. can be measured.

228 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Haircut Determination for Securities Financing An indirect effect can also occur, which is linked to the impact
Activities that rate changes can have on business volumes. Although inter­
est rate risk in the banking book is a normal part of financial
The processes for determining haircuts for securities financing
intermediation, excessive interest rate risk poses a significant
activities generally do not consider stressful market conditions,
threat to an institution's earnings and capital adequacy.
but are based on the range of historical experience, including
normal market environments. When economic capital is calcu­ The main challenges in the calculation of economic capital for
lated for these positions, however, the market risk factors are interest rate risk in the banking book come from the long hold­
shocked to a stressed level, and the risks beyond the haircut are ing period assumed for a bank's structural balance sheet and the
included in the determination of economic capital of the securi­ need to model indeterminate cash flows on both the asset and
ties financing activity. liability side due to the embedded optionality of many banking
book items.
Counterparty Credit Risk Model Validation Many banks use some type of internal transfer funds pricing
Counterparty credit risk models for economic capital purposes to move structural interest rate into a centralised place within
generally do not have specialised validation processes associ­ the organisation, typically the bank's treasury unit, in order to
ated with them, but rather use the results of validation work achieve matched funds transfer pricing between all other busi­
done by others, such as by risk management, to support the use ness units of the bank. This unit is responsible for interest rate
of the counterparty credit risk model. When there is a difference modelling and maintaining gap positions within agreed upon
between the counterparty credit risk model for economic capital risk limits.
purposes and the counterparty credit risk model for risk man­
agement purposes (for example, the holding period may vary),
Sources of Interest Rate Risk
there appears to be little additional testing or validation to
support the difference, as the differences are generally viewed The main sources of interest rate risk in the banking book
as mechanic differences in implementation and not as separate are repricing risk (arising from differences in the maturity and
models requiring separate validation. For example, backtesting, repricing terms of custom er loans and liabilities), yield curve
an established practice for market risk exposures, is still in the risk (stemming from asym m etric movements in rates along
early stages of development for counterparty credit risk models. the yield curve), and basis risk (arising from im perfect cor­
relation in the adjustment of the rates earned and paid on
different financial instruments with otherwise similar repricing
13.10 ANNEX 3: INTEREST RATE RISK characteristics).
IN THE BANKING BOOK Interest rate risk in the bankinq book also arises from the option
features of many financial instruments.33 Retail products in the
Interest rate risk refers to the exposure of a bank's financial con­
banking book that have embedded options include bonds and
dition to adverse movements in interest rates. It should be inter­
notes with call or put provisions, loans such as mortgages which
preted for the purposes of this annex as the current or
give borrowers the option to prepay balances, adjustable-rate
prospective risk to both the earnings and capital of an institution
loans with explicit interest rate caps and floors that limit the
arising from adverse movements in interest rates, which affect
amount by which the rate may adjust, and various types of non­
the institution's banking book. Changes in interest rates affect
maturity deposits which give depositors the option to withdraw
an institution's earnings by altering interest-sensitive income and
funds at any time often without penalty. If not adequately mea­
expenses, and the underlying value of an institution's assets, lia­
sured and managed, the asymmetrical payoff characteristics of
bilities, and off-balance sheet instruments because the present
instruments with embedded option features can pose significant
value of future cash flows changes when interest rates change.32
interest rate risks.

32 Interest rate risk arises from the natural mismatch between repricing
characteristics desired by investors and depositors and those desired 33 According to Principle 16 of the Basel Committee's Principles for the
by borrowers. As such, interest rate risk derives from the mismatched Management and Supervision of Interest Rate Risk (BCBS, 2004), "An
maturities or durations of assets which are typically longer than the additional and increasingly important source of interest rate risk arises
liabilities. A sudden change in the shape of the term structure will affect from the options embedded in many bank assets, liabilities, and off-
the values of assets differently from those of liabilities. balance sheet portfolios."

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 229

Interest Rate Measurement Techniques may be adapted to allow for the rolling over of current posi­
tions. In its dynamic version EVE may provide forward risk mea­
and Indicators
sures that also take into account future growth in existing or
There are two basic techniques for assessing interest rate risk in new business activities.
the banking book: repricing schedules (gap and duration analy­
When the EVE model is complemented with an estimate of the
ses) and simulation approaches. Although commonly used, the
probabilities of the interest-rate scenarios used, the EVE model
simple structure and restrictive assumptions make repricing
becomes a value-at-risk (VaR) model, which builds a statistical
schedules less suitable for the calculation of economic capital.34
distribution of profit and losses that may occur over a specified
Most banks use simulation approaches for determining their
time horizon at a given confidence level owing to movements in
economic capital, based on estimated losses occurring in case
interest rates. The method not only measures the magnitude of
of a set of worst case scenarios. The magnitude of such losses
the loss, but also the probability of the loss.
and their probability of occurrence determine the amount of
economic capital. In practice the calculation of economic capital follows three
steps: in the first step, the change in economic value of both
The banking book is traditionally based on accrual accounting
assets and liabilities is modelled as a result of changes in interest
and measures such as earnings volatility or Earnings at Risk (EaR)
rates and an EVE is derived. The second step involves modelling
are used. EaR measures the loss of net interest income result­
the term structure of interest rates or the yield curve.37 Some
ing from interest rate movements, either gradual movements
banks model volatility changes o vertim e, while other banks
or one-off large interest rate shock, over a given time horizon
assume volatility is constant. In the third step the economic
(typically one to two years). A disadvantage of the EaR method
value of assets and liabilities and the term structure of interest
is that it only measures the short-term earnings effect (accrued
rates are combined to produce the final value distribution which
interest) resulting from interest rate fluctuations and not the
can be used to compute VaR or economic capital. It is worth
economic value effects (capital gains/capital losses).
mentioning that many of the assets and liabilities in the banking
Some banks have moved towards an economic value orientation book are not regularly traded and are therefore difficult to value
and measures based on Economic Value of Equity (EVE), VaR, at market prices. Most assets and liabilities are valued on a
and Extreme Value Theory (EVT) are becoming popular. EVE, mark-to-model basis, using path-dependent projections of run­
which is defined as the present value of assets minus liabilities, off and future cash flows.38
measures the change in the market value of equity resulting
In contrast to EVE, EVT is well suited to the estimation of
from interest rate shock scenarios, compared with the market
extreme probabilities and quantiles of a distribution. This
value of equity under a base scenario. It is a comprehensive risk
approach is based on the extreme value theorem, which indi­
measure, consistent with the Basel standard interest rate shock
cates what the limiting distribution of extreme values should
used to identify outliers.35 The accuracy of the valuation of bal­
look like and importantly demonstrates that it is not the nor­
ance sheet positions is strongly dependent upon the calculated
mal distribution. Drawbacks are the scarcity of extreme value
cash flows and discount rates used.36 For practical purposes,
observations, and the model risk associated with EVT estimates,
most EVE models use static or liquidation concepts, in the sense
which are usually very sensitive to the precise assumptions
that they show a snapshot in time of the risk based upon the
made by users.
current portfolio or balance sheet composition. In principle, EVE
The choice of techniques used in assessing interest rate risk
depends on the bank's orientation towards either economic
value or earnings, and also on the type of business model pur­
34 Particularly for larger banks, gap analysis is nothing more than the first
sued by the bank. Some businesses, such as commercial lend­
step (in this case, the distribution of the relevant assets and liabilities
according to maturity) in analyzing the interest rate risk in the banking ing or residential mortgage lending, are managed on a present
book.
35 Under current guidelines, interest rate risk is identified as the banking
book economic value sensitivity with respect to a standard interest rate 37 Single-factor models, such as Cox et. al. (1985), Black and Karasin-
shock of plus/minus 200 basis points; outlier banks are then identified sky (1991), or Black et. al. (1990) may be used, or more advanced term
as those having greater than 20% sensitivity with respect to regulatory structure models, such as Heath et. al. (1992), Dai and Singleton (2000),
capital. and the lognormal forward-LIBOR model of Brace et. al. (1997) may be
used.
36 When the cash flows are calculated, account needs to be taken of the
fact that the size and the timing of the cash flows may differ under the 38 Although this can be true also for instruments held in the trading
various scenarios as a result of customer behavior regarding changes in book, the typical short term horizon of the instruments held in the trad­
deposit balances and also prepayment speeds. ing book provides a more frequent test of model prices.

230 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
value approach, while others, such as credit cards, are managed and identically distributed over time. Factors to be taken into
on an earnings approach. This poses issues when the bank account in the calculation are that interest rates may be serially
wants to convert risk measures to a common metric, for aggre­ correlated39 and that management intervention may affect the
gation purposes. interest rate risk profile over the course of the time horizon.
Although most economic capital models are calibrated over a
one-year holding period, many banks that use simulations will
Modelling Issues run multi-year simulations in order to value those instruments

The main modelling issues involve the type of simulation, the held at the one-year horizon which are not valued via closed

assumptions surrounding the timing of interest rate shocks, the form analytical formula.

holding period and time horizon. As for simulation, computa­

tional intensity derives from the large number of points along Main Challenges for the Measurement of
the term structure of interest rates, the large number of curren­
Interest Rate Risk in the Banking Book
cies to track, with different implied volatilities for each currency/
term structure combination, the availability of many related, Optionality in the Banking Book
but not identical interest rate curves. Many banks adopt some
One of the most fundamental challenges in the measurement
dimension-reduction techniques, such as principal component
of interest rate risk in the banking book is the identification and
analysis, to address the magnitude of the computational burden.
incorporation of non-linear risk deriving from long-dated fixed-
Simulation can be static or dynamic. Static simulation models
income obligations with embedded options for the borrower
are mostly based on the current on- and off-balance sheet expo­
to prepay, frequently without penalty, and from the embedded
sures, although they generally do take into account interest rate
options in non-maturity deposits.
sensitivities of prepayments and rollovers. Some models include
also expected balance sheet growth, but generally not the Prepayment risk options are the predominant form of em bed­
interest-tare-induced changes in the rate of growth, which are ded optionality on the asset side of the balance sheet. Con­
difficult to project. Dynamic simulation models allow for changes sumer loans, mortgages, and mortgage-backed securities
in business activities, incorporate optionality, prepayments, sav­ (MBSs) are examples of assets with prepayment risk. Prepayment
ing behaviour, etc. under different scenarios, explicitly model­ risk arises because borrowers have a call option on the loans:
ling management and customer action. Although this approach for example, in the case of fixed-rate mortgages, borrowers
offers a more realistic setting, it comes at a cost. Dynamic will choose to exercise this option and prepay their mortgages
models require the use of more assumptions, lead to a loss of as interest rates fall sufficiently below the contract mortgage
tractability and an increase in computing time. Moreover, the coupon rates. Because of the prepayment option, the cash flows
longer the horizon of the analysis, the less accurate assumptions associated with a mortgage are uncertain and the expected life
regarding future business may be. In order for economic capi­ of a mortgage is much shorter than its stated maturity.
tal numbers to be realistic, the assumptions need to be tested Since the rate of prepayments increases as rates fall (especially
against internal processes and management action. as they fall below the mortgage contract rate), the price-yield
As for the type of interest rate shock, it is important to consider curve for mortgages exhibits negative convexity and price com­
whether a scenario is assumed to occur gradually, giving banks pression. This occurs because interest rate decreases do not
time to actively manage their interest rate position, or whether produce increases in the values of mortgages as large as those
an interest rate shock is assumed to occur suddenly. The pace of of option-free bonds. In addition, holders of mortgages are
the interest rate movements affects interest income during the forced to invest the cash flows that are prepaid at a lower rate
horizon of the analysis and may also affect customer behaviour, of interest.40 When interest rates increase above mortgage con­
resulting in an impact on the result of the (dynamic) simulation. tract coupon rates, the speed of mortgage prepayments by

When using simulation-based approaches, a time horizon should

be considered that is consistent with the policy intention of 39 There are different reasons underlying this serial correlation of interest
holding asset and liability positions for a long period of time. rate risk factors returns: the bid-ask spreads, the discontinuity in trading
For capital calculations in the banking book, typically an eco­ volumes of some interest rate sensitive instruments, the structural fac­
tors of some markets (i.e., low thickness and liquidity), etc.
nomic capital measure (VaR) over a short time horizon (one to
ten days) is scaled up to the one-year horizon used in the eco­ 40 Contraction risk is that part of prepayment risk that derives from the
decrease in the duration of mortgages and the reinvestment risk associ­
nomic capital framework. When scaling up VaR numbers, often ated with the speedup of prepayments resulting from a decline in inter­
the assumption is made that VaR realisations are independently est rates within the negatively convex region of the price-yield curve.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 231

borrowers slows. The rate increase produces an increase in the evolution of the legislation and prevailing market practices in
duration of mortgages and a steeper decline in the value of the jurisdictions.
these instruments than is the case for option-free bonds. This
Income simulation models, such as EaR, are generally unable
occurs because holders of mortgages are not able to reinvest
to analyse option risk fully and generally are only accurate for
the expected principal cash flows at the higher interest rate
the short-term (i.e., two to three years) earnings component.
because of slower actual prepayments.41 Prepayment risk is
Economic value approaches, such as EVE, provide better mea­
therefore related to the variability or uncertainty in the rate at
surements of exposures with embedded options. However,
which the borrowers will prepay, depending on the evolution of
accurately representing these exposures requires the use of
the interest rates. It should be observed that mortgages also
stochastic-path evaluation techniques, which are computation­
contain a second type of embedded option, whereby borrowers
ally demanding, and mostly developed in the jurisdictions where
have a put option to default on their mortgage loans.42
market practice makes the optionality issues, such as mortgage
On the liability side of the balance sheet, the embedded options prepayment, more relevant. Standard practice is to use dis­
in non-maturity deposits are the most common. In effect, non­ counted cash flows on those positions that have linear or highly
maturity deposits contain two embedded options: (i) the institu­ uncertain valuation profiles, and use stochastic-path techniques
tion holds the option to determine the interest rate offered to on those parts of the balance sheet that have non-linear valua­
depositors and when to change the rate; and (ii) the depositor tion profiles.
holds the option to withdraw all or part of the balance in the
In such instances, most firms combine in simulation models
deposit account at par. The first option makes the deposit
stochastic interest rate modelling techniques with behavioural
behave as a floating-rate bond, while the second option allows
assumptions on prepayments and on decisions to remain cus­
the depositor to put the bond back to the institution.43 As such,
tomers or not (deposit modelling or credit card customer reten­
non-maturity deposits can be viewed essentially as floating-rate,
tion modelling). A prepayment model must not only be able to
putable bonds. Moreover, the two embedded options induce a
predict current prepayment speeds, but also expected future
volume risk, which cannot be hedged directly since the volume
prepayment speeds, which are largely a function of expected
is not traded in the market.
future mortgage interest rates. Larger institutions use more
Although non-maturity deposits can be withdrawn by deposi­ sophisticated statistical prepayment models to forecast prepay­
tors on demand, most of these deposits stay at the institution ment speeds and account for the statistical relationships among
for months or years. In addition, while banking institutions may the factors that drive prepayments. A modelling approach is
change the offered deposit rates when market interest rates required in which prepayment models are often combined with
change, they do so with a lagged response, and by less than a term structure model of interest rates and dynamic simulation
the full amount of the change in market rates. This is particu­ models, in producing mortgage valuations based on option-
larly true when rates increase. The interaction between the two adjusted spreads. The prepayment/non-maturity deposit mod­
embedded options found in non-maturity deposits makes the elling may be carried out at local business level, to generate
valuation and interest rate sensitivity of these liabilities one of sensitivity to rate shocks at various stress levels, producing dif­
the most widely debated issues currently in measuring interest ferent prepayment/customer retention forecasts across interest
rate risk in the banking book. rate shocks. Incorporating such assumptions should involve also
considering model uncertainty on those assumptions, and incor­
Although optionality is an important issue, the degree of
porating a measure of model risk (e.g., prepayment error risk).
sophistication in the techniques used by the institutions varies,
depending not only on the type of institution, but also on the Industry use of competing risks models for mortgage prepay­
ment and default is in its infancy, although several of the largest
institutions have embraced this approach.
41 Extension risk is that part of prepayment risk that derives from the
increase in the duration of mortgages and the reinvestment risk associ­
ated with a rise in interest rates. Banks' Pricing Behaviour
42 Typically, they will choose to exercise this option when the remain­ An important aspect of interest rate risk modelling is the effec­
ing loan balance exceeds the market value of the property. As such, tive responsiveness of individual bank interest rates to changes in
mortgage lenders are essentially selling embedded American straddle
options (i.e., combined call and put options) to mortgagors. market rates. The measurement of the interest rate risk of bank­
ing book items requires: (i) a model for the analysis of the persis­
43 Holding other things equal, customer's options have an impact on
both principal and interest cash flows, while issuer's options have a tence of the volumes of different non-maturity banking products;
direct impact on interest cash flows only. and (ii) a model for the determination of bank interest rates,

232 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
taking into account general market conditions, customer relation­ systems with transparent interest rate shocks. As such, stress
ships, bank commercial power, and optimal commercial policies. test results serve as a benchmark risk measure.49

The degree by which the interest rates set by banks react to Following the guiding principles of the Basel Committee, the
market rates (interest rates pass-through) may depend on indi­ current regulatory choice of a stress scenario focuses on parallel
vidual bank characteristics and may differ for different products. shifts in the yield curve of + /— 200 basis points.50 The Commit­
Changes in market interest rates may also result in changes in tee acknowledges that the parallel shifts of + /— 200 basis points
banks' interest rate policy, driven by changes in the competitive are relatively simplistic, but it argues that these shocks appear
environment and the need to defend market share.44 to adequately cover volatilities across G10 countries, even
though the appropriateness of the proposed shock needs to be
A typical finding in the literature is that banking interest rates
monitored on an onqoinq basis, and recalibrated should the rate
pass-through is relatively slow and heterogeneous across both
environment shift materially.51
products and countries. It is slower for retail banking products
(e.g., deposits, consumer loans, mortgages) than for corporate The benefits of using simple interest rate shocks of + /— 200
products; short-term products are more responsive than long­ basis points are that these shocks are very simple and easy to
term products.45 Individual bank characteristics, such as the communicate and that it is easier to compare the impact of
bank's liability structure, its liquidity, and capitalisation position these shocks on different portfolios. The drawbacks are that the
or the proportion of long-term lending, are also relevant for shocks are not probabilistic and hence very hard to integrate
interest rate determ ination; heterogeneity in the banking rates into economic capital models based on VaR;52 it is not
pass-through exists only in the short run.46 There is also some
evidence of asymmetries in the interest rate pass-through,
existing also in the short run: banks adjust their loan lending
49 The Committee on Global Financial Stability survey on stress test­
rate faster during periods of monetary tightening, and their ing (CGFS, 2005) reveals that a majority of banks run interest rates risk
deposit rates faster during periods of monetary easing.47 stress tests. Popular historical scenarios are the bond market sell-offs
in 1994 and 2003; the Asian crisis in 1997, LTCM and Russia in 1998,
A relevant aspect for determining bank interest rates is the pric­ or September 11, 2001. hypothetical scenarios look at changes in the
ing for credit risk, which influences the duration of bank loans national or global economic outlook, increases in inflation expectations
or unexpected changes in monetary policy. Scenarios generally cover
and represents a "spread duration" component with a non-mar­
environments where not only the level but also the slope and curvature
ginal effect on economic value, especially on longer term loans. of the yield curve are changing.
To determine the price of credit risk applied on different bank­
50 The Basel Committee (BCBS, 2004) has suggested several guiding
ing products would ultimately require a pricing rule that links principles for the selection of interest rate risk scenarios. The three most
the credit spread to changes in macroeconomic conditions and important are: the rate shock should reflect a fairly uncommon and stress­
interest rate variations.48 This also indicates that interest rate ful rate environment; the magnitude of the rate shock should be signifi­
cant enough to capture the effects of embedded options and convexity
risk on the banking book is not independent from credit risk, within bank assets and liabilities so that underlying risk may be revealed;
and that interest rate stress scenarios should also incorporate and the rate shock should be straightforward and practical to implement,
the possible interaction of interest rate and credit risk factors. and should be able to accommodate the diverse approaches inherent in
single-rate-path simulation models and statistically driven value-at-risk
models for banking book positions. As a practical guidance, in addition to
The Choice of Stress Scenarios considering 200 bps scenarios, the Committee also suggests looking at
parallel shifts using the 1st and 99th percentile of observed interest rate
Stress testing is commonly used in interest rate modelling as a changes with a one year horizon and five years of data.
way to complement the complexities of interest rate risk
51 Further, the Committee argues that, "while more nuanced rate
scenarios (such as twists and turns in the yield curve) might tease out
certain underlying risk characteristics, for the more modest objectives
of supervisors in detecting institutions with significant levels of interest
44 As such, some banks may not regard such policy changes as part of
rate risk, a simple parallel shock is adequate. Such an approach also
their interest rate risk, but rather as part of business risk.
recognises the potential for spurious precision that occurs when undue
45 For Europe, see Campa and Gonzales-Minguez (2006). attention to fine detail is placed on one aspect of a measurement sys­
tem without recognition that assumptions employed for certain asset
46 Gambacorta (2007).
and liability categories, such as core deposits, are by necessity blunt
47 Gambacorta and lannotti (2007). and judgmental. Such judgmental aspects of an interest rate risk model
often drive the resulting risk measure and conclusion, regardless of the
48 The price of credit risk varies with the counterparty credit rating in
detailed attention paid to other aspects of the risk measure."(Annex 3,
a way which is also influenced by the level of interest rates and more
para7, BCBS, 2004).
generally by the position in the economic cycle, especially if the banks rq

adopt forward-looking economic capital calculations and provisioning Even though the scenario has been calibrated on the 1°/99° percen­
and pricing policies. tile of observed interest rate changes.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 233

necessarily sensitive to the current rate or economic environ­ the yield curve and/or the correlation structure of the data.
ment; it doesn't take into account changes in the slope or curva­ Correlation can be stressed by modifying the matrix of factor
ture of the yield curve; and that it doesn't allow for an weights (the so called factor loadings), while assuming constant
integrated analysis of interest rate and credit risk on banking volatility. Conversely, one can shock the volatility of interest rate
book items. changes while maintaining the matrix of factor loading fixed at
historical values.
Among the possible developments are: (i) scenarios based on
historical distributions; (ii) scenarios based on principal compo­ The main advantage of this simulation procedure is that it
nent (PC) decomposition of the yield curve; (iii) scenarios based assigns a level of confidence to all plausible scenarios (in terms
on the GARCH models; (iv) scenarios based on options; (v) sce­ of percentiles of the simulated distributions). The plausibility of
narios based on macroeconomic factors; and (vi) scenarios link­ scenarios is derived from the calibration of the procedure to the
ing credit and interest rate risk. correlation structure observed in the market.

Scenarios Based on Historical Distributions Scenarios Based on GARCH Models

The suggestion in BCBS (2004) to use the 1st and 99th per­ Simple autoregressive (AR) models with GARCH effects could be
centile of the observed interest rate changes over the last five used to simulate the evolution of individual interest rates over a
years would be an easy way to look at a probabilistic scenario. specific horizon. Such an approach would be forward looking and
However the historical distribution is backward-looking, which is partially condition on the current environment in terms of level
inherently problematic for a forward-looking risk measurement. and volatility. At the same time it is relatively easy to implement.
For example, given long interest rate cycles it may be the case
that there are limited observations in one direction. It should Scenarios Based on Options
also be observed that the empirical distribution generally does
A distribution of future changes of interest rates could also be
not include both a plus and minus 200 basis points shock.
extracted from options. The key (and so far not successfully
solved) problem for such an approach is to translate the risk-
Scenarios Based on Principal Component neutral PDs (necessary for trading and pricing) to real-world or
Decomposition of the Yield Curve physical PDs (important for risk management).55
A possible solution is to build a scenario simulation procedure
based on PC decomposition of the yield curve in order to pro­ Scenarios Based on Macroeconomic Factors
duce realistic scenarios of interest rates changes along various
Similar to credit risk models, it is conceptually possible to simu­
points of the term structure.53
late a distribution of future yield curve changes based on macro-
The PC distribution functions are used in a Monte Carlo simula­ economic fundamentals.56 Whereas there has been much
tion in order to reproduce the correlation observed between the progress in this field, explanatory power of macroeconomic fac­
original risk factors. The usual assumption is that the PC are nor­ tors remains weak and forecast and estimation errors are sub­
mally distributed; some recent work has applied a non-paramet- stantial. Even though these models could be used to condition
ric simulation to account for the fact that PCs are skewed and changes on the current and future macroeconomic environment,
heavy-tailed, recovering the empirical distribution through a ker­ technical difficulties could impede a consistent use of these
nel density estimation.54 models for economic capital calculation.

In the context of PC representation, stress testing analysis can

be performed by changing the volatility of interest rates along
Scenarios Linking Credit and Interest Rate Risk
It is a well established fact that interest rates are an important
negative driver of the credit quality of banks' assets— one

53 In the PC representation, interest rate changes at different maturities

are expressed as a function of the new risk factors PCs, where the weight­
ing coefficients (the so called "factor loading") capture the correlation in 55 It has to be noted however that for stochastic-path modelling, risk
the system. The factor loadings account for the contribution of each risk neutral implied volatilities are necessary to validate the model by check­
factor to the overall variance. The PC decomposition of the yield curve ing for convergence to market prices at a reasonable Option Adjusted
usually reveals the existence of three underlying risk factors explaining Spread (OAS), a key validation test for mortgage models.
a large part of total variance (around 95%): the parallel shift of the yield
56 See for example Ang and Piazzesi (2003), Cochrane (2007). Rude-
curve; the tilt or rotation; the twist, that is a change in the curvature.
busch and Williams (2007) provide an up-to date survey of the literature
54 See Fiori and lannotti, 2007. linking macro factors to yield curves.

234 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
indication that credit risk and interest rate risk in the banking Bank of Japan (2005): A dvan cin g In teg ra ted Risk M anagem ent,
book are interdependent.57 The integration of credit and interest http ://www. boj .or.jp.
rate risk requires a sophisticated framework. First, the loss distri­
Bank o f Ja p a n (2007): E co n o m ic Capital W orkshop Sum m ary
bution of credit risk must condition on the macro and interest
R eco rd , http://www.boj.or.jp.
rate environment. Second, decreased net interest income due to
default must be taken into account. Finally, for an earnings per­ Basel Committee on Banking Supervision (1999): C red it risk

spective, future cash flows need to be simulated. This necessi­ m odelling: current p ra ctices and applications, Basel, April.

tates a robust framework to price assets in the future conditional — (2004): Principles for the m anagem ent and supervision o f
on the simulated macro and interest rate environment. in terest rate risk, Basel, July.

— (2005a): "Update on work of the Accord Implementation

Banking versus Trading Book
Group related to validation under the Basel II Fram ework", Basel
The exclusion of the trading book from the measurement of C om m ittee N ew sletter, No 4, January.
interest rate risk eliminates the problem of double counting
— (2005b): "Studies on the validation of internal rating systems"
arising from the presence of a market risk requirement for inter­
W orking Paper, no 14, May.
est rate sensitive positions held in the trading book. However
it should be pointed out that the problem of double counting — (2009): G uidelines for com puting capital for increm ental risk
does not preclude the possibility that the exposures in the trad­ in the trading b o o k, Consultative Document, Basel, January.

ing book and in the banking book offset each other. Berkowitz, J (2000): "Testing Density Forecasts, with Applica­

In certain cases, the interest rate risk exposure of the trading tions to Risk M anagement", U niversity o f California, December,
book compensates partially the exposure of the banking book. mimeo.

For example, it is possible that the trading book has a short Black, F, E Derman and W Toy (1990): "A one-factor model of
position with respect to interest rate shocks (in the sense that interest rates and its application to treasury bond options",
a rise in interest rates causes an increase in the economic value Financial A nalysts Journal, vol 46.
of the trading book), while the position in the banking book is
Black, F and P Karasinski (1991): "Bond and Option Pricing when
long with respect to interest rate shocks (in the sense that a rise
Short Rates are Lognormal", Financial A nalysts Journal, vol 47.
in interest rates causes a decrease in the economic value of the
banking book). In cases such as this, it might be appropriate to Brace, A, D Gatarek and M Musiela (1997): "The Market Model
consider the net exposure of the entire balance sheet. of Interest Rate Dynamics", M athem atical Finance, vol 7.

Breuer, T, M Jandacka, K Rheinberger and M Summer (2008):

"Regulatory capital for market and credit interaction: is current
References regulation always conservative?", forthcoming, Jou rn a l o f Bank­
ing and Finance.
Akhavein, J D and A E Kocagil (2005): "A comparative empirical
study of asset correlation", Fitch Ratings: Q uantitative Financial Burns, R L (2004): "Econom ic Capital and the Assessment of
Capital Adequacy", Su p erviso ry Insights, vol 1, no 2, pp 5-16.
Research Sp ecia l R ep o rt, 14 July.
Burtschell, X, J Gregory and J P Laurent (2007): B eyo n d the
Ang, A and M Piazzesi (2003): "A no-arbitrage vector autore­
Gaussian C opula: Sto ch a stic and Local Correlation, January,
gression of term structure dynamics with macroeconomics and
mimeo.
latent variables", Jou rn a l o f M on etary Eco n om ics, vol 50, no 5.
Campa, J M and J M Gonzalez Minguez (2006): "Differences in
Artzner, P, F Dalbaen, J M Eber and D Heath (1999): "Coherent
exchanges rate pass-through in the euro area", European E c o ­
measures of risk", M athem atical Finance, no 9, pp 203-228.
nom ic Review , vol 50.
Bangia, A , F X Diebold and T Schuermann (2000): "Rating
Cochrane, J H (2007): "Com m entary", Fed era l R eserve Bank o f
migration and the business cycle, with applications to credit
S t Louis Review , July/August.
portfolio stress testing", The W harton Sch ool, working paper
00-26. Committee of the Global Financial System (2005a): Stress te st­
ing at m ajor financial institutions: su rvey results and p ractice,
Basel, January.
57 Drehmann et. al. (2007) show that interactions between credit risk
and interest rate risk can indeed be substantial and should be taken into — (2005): The role o f ratings in stru ctu red finance: issues and
account. im plications, Basel, January.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 235

Cox, J C, J E Ingersoll and S A Ross (1985): "A theory of the Frey, R and A J McNeil (2003): "Dependence modelling, model
term structure of interest rates", Econom etrica 53, pp 385-467. risk and model calibration in models of portfolio credit risk",
Jou rn a l o f Risk 6(1).
Crouhy, M, D Galai and R Mark (2006): The Essentials o f Risk
M anagem ent, McGraw-Hill. Gambacorta L (2007) "How do banks set interest rates", Eu ro ­
pean Eco n o m ic Review , forthcoming.
Dai, Q, and K J Singleton (2000): "Specification Analysis of
Affine Term Structure M odels", Jou rn a l o f Finance, vol 55. Gambacorta L and S lannotti (2007): "Are There Asymmetries
in the Response of Bank Interest Rates to Monetary Shocks?",
Das, S R, D Duffie, N Kapadia and L Saita (2007) "Common fail­
A p p lie d Econ om ics, forthcoming.
ings: how corporate defaults are correlated", Jou rn a l o f Finance,
vol LXII, no 1, February. Heath, D, R Jarrow and A Morton (1992): "Bond Pricing and the
Term Structure of Interest Rates: A New M ethodology", E c o n o ­
Davis, M and V Lo (2001): "Infectious Default", Q uantitative
m etrica, vol 60.
Finance, vol 1, no 4, pp 382-387.

De Nederlandsche Bank (2005): G uidelin es on In terest Rate Risk Hull, J C (2007): Risk m anagem ent and financial institutions,

in the Banking Book, Amsterdam. Pearson Prentice Hall, New Jersey.

Diebold, F X, G D Rudebush and S B Arouba (2006) "The IACPM and ISDA (2006): C o n verg e n ce o f C red it Capital M o d els.

macroeconomy and the yield curve: a dynamic latent factor IFRI and CRO Forum (2007): Insights from the Jo in t IFRI/C R O
approach", Jou rn a l o f Eco n o m etrics, vol 131. Forum Su rvey on Eco n om ic Capital Practice and A pplications.

Dimakos X K and K Aas (2004): "Integrated risk modelling", Sta ­ Jarrow, R A and F Yu (1999): "Counterparty risk and the pricing
tistical M o dellin g 4, pp 265-277. of defaultable securities," September, mimeo.
Drehmann, M, S Sorensen and M Stringa (2008): "The inte­ Jarrow, R A and F Yu (2001): "Counterparty risk and pric­
grated impact of credit and interest rate risk on banks: An ing of defaultable securities", Jou rn a l o f Finance, vol 53,
economic value and capital adequacy perspective", Bank o f p p .2225-2243.
En gland W orking Paper 339.
Lopez J A and M R Saidenberg (1999): "Evaluating Credit Risk
Duffie, D, A Eckner, G Horel and L Saita (2006): "Frailty corre­ M odel", Fed era l R eserve Bank o f San Francisco, Working paper
lated default", October 19, mimeo. no 99-06.
Duffie, D and D Lando (2001): "Term structures of credit spreads McNeil, A, R Frey and Embrechts (2005): Q uantitative Risk M an­
with incomplete accounting information", Econ om etrica, vol 69, a g em en t; C o n ce p ts, Techniques, and Tools. Princeton Series in
no 3, pp 633-664. Finance.
Duffie, D, L Saita and K Wang (2005): "Multi-period corporate PriceW aterhouseCoopers (2005): E ffe ctive Capital M anagem ent:
default prediction with stochastic covariates", September, mimeo. Eco n o m ic Capital as an Industry Stan dard?
Egloff, D, M Leippold and P Vanini (2004): "A simple model of Rosenberg J V and T Schuermann (2006): "A general approach
credit contagion", mimeo. to integrated risk management with skewed, fat-tailed risks",
Fabozzi, F (2000): B o n d M arkets, Analysis and Stra teg ies, Fourth Jou rn a l o f Financial Econ om ics, vol 9, no 3, pp 569-614.
Edition, Prentice Hall, New Jersey. Rudebusch, G D and J C Williams (2007): "Forecasting reces­
Fender, I and J Kiff (2004): "C D O rating methodology: Some sions: The puzzle of the enduring power of the yield curve",
thoughts on model risk and its implications", BIS W orking Paper, Fed era l R eserve Bank o f San Francisco, Working Paper, No
no 163, Basel, November. 2007-16.

Fermanian, J D and M Sbai (2005): A comparative analysis of Rutter Associates LLC (2004): 2004 R utter A sso cia te s Survey o f
dependence levels in intensity based and Merton style credit C red it Portfolio M anagem ent Practices.
risk models.
Samuel (2008): "Disclosure of Economic Capital", Fed era l
Fiori, R and S lannotti S (2007): "Scenario based Principal Com ­ R eserve Bank o f N ew York, Available from the author or Policy
ponent Value-at-Risk: an application to Italian banks' interest Department, Federal Reserve Bank of New York, email: Jeffrey.
rate risk exposure", Jou rn a l o f Risk, vol 9, no 3, pp 63-99. [email protected]. April 18.

Frerichs, H and G Loffler (2002): "Evaluating credit risk models: Tarashev, N and H Zhu (2007): "Modelling and calibration errors in
A critique and a proposal", May, mimeo. measures of portfolio credit risk", BIS Working Paper, Number 230.

236 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Capital Planning at
Large Bank Holding
Companies
Supervisory Expectations and
Range of Current Practice

Learning Objectives
After completing this reading you should be able to:

Describe the Federal Reserve's Capital Plan Rule and Capital policy, including setting of goals and targets
explain the seven principles of an effective capital and contingency planning
adequacy process for bank holding companies (BHCs) Stress testing and stress scenario design
subject to the Capital Plan Rule. Estimating losses, revenues, and expenses, including
quantitative and qualitative methodologies
Describe practices that can result in a strong and effective Assessing the impact of capital adequacy, including
capital adequacy process for a BHC in the following areas: risk-weighted asset (RWA) and balance sheet
■ Risk identification projections
Internal controls, including model review and validation
Corporate governance

E x c e rp t is co u rtesy o f B oard o f G overn ors o f the Fed era l R eserve System .

14.1 INTRODUCTION CCAR is the Federal Reserve's supervisory program for assessing
the capital plans. In 2013, CCAR covered 18 BHCs that partici­
The Federal Reserve has previously noted the importance of pated in the 2009 Supervisory Capital Assessment Program
capital planning at large, com plex bank holding companies (SCAP).3 The Federal Reserve's assessment of a BHC's capital
(BHCs). Capital is central to a BHC's ability to absorb unex­ planning process includes an evaluation of the risk-identification,
pected losses and continue to lend to creditworthy businesses -measurement, and -management practices that support the
and consumers. It serves as the first line of defense against BHC's capital planning and stress scenario analysis, an assessment
losses, protecting the deposit insurance fund and taxpayers. of stressed loss and revenue estimation practices, and a review of
As such, a large BHC's processes for managing and allocating the governance and controls around these practices. The pream­
its capital resources are critical not only to its individual health ble to the Capital Plan Rule outlines the elements on which the
and perform ance, but also to the stability and effective func­ Federal Reserve evaluates the robustness of a BHC's internal capi­
tioning of the U.S. financial system. The Federal Reserve's tal planning— also referred to as the capital adequacy process, or
Capital Plan Rule and the associated annual Com prehensive "CAP." These principles are summarized in Figure 14.1.4
Capital Analysis and Review (CCAR) have emphasized the This publication describes the Federal Reserve's expectations
importance the Federal Reserve places on BHCs' internal capi­ for internal capital planning at the large, complex BHCs subject
tal planning processes, and on the supervisory assessment of to the Capital Plan Rule in light of the seven CAP principles. It
all aspects of these processes, which is a key elem ent of a expands on previous articulations of these supervisory expecta­
supervisory program that is focused on promoting resiliency at tions by providing examples of observed practices among the
the largest B H C s.1 BHCs participating in CCA R 2013 and by highlighting those
These initiatives have focused not just on the amount of capital practices considered to be stronger or leading practices at these
that a BHC has, but also on the internal practices and policies a firms. In addition, it identifies practices that the Federal Reserve
firm uses to determine the amount and composition of capital deems to be weaker, or in some cases unacceptable, and thus in
that would be adequate, given the firm's risk exposures and cor­ need of significant improvement. However, practices identified
porate strategies as well as supervisory expectations and regula­ in this publication as leading or industry-best practices should
tory standards. BHCs have long engaged in some form of capital not be considered a safe harbor. The Federal Reserve antici­
planning to address the expectations of shareholders, creditors, pates that leading practices will continue to evolve as new data
customers, and other stakeholders. The Federal Reserve's inter­ become available, economic conditions change, new products
est in and expectations for effective capital planning reflect and businesses introduce new risks, and estimation techniques
the importance of the ongoing viability of the largest BHCs advance further.
even under stressful financial and economic conditions. Even if While the supervisory scenarios and supervisory stress tests
current assessments of capital adequacy suggest that a BHC's that are required under the Dodd-Frank A ct5 play an important
capital level is sufficient to withstand potential economic stress, role in C C A R ,6 they are not meant to be and should not be
robust capital planning helps ensure that this outcome will con­ viewed as providing for an all-encompassing assessment of the
tinue to hold in the future. Robust internal capital planning can possible risks a BHC may face. A robust internal capital plan­
also help ensure that BHCs have sufficient capital in a broad ning process should include modeling practices and scenario
range of future macroeconomic and financial market environ­ assumptions that reflect BHC-specific factors. In certain
ments by governing the capital actions— including dividend pay­ instances, these practices and assumptions may differ consider­
ments, share repurchases, and share issuance and conversion— a ably from those used by the Federal Reserve. Indeed, design­
BHC takes in these situations. ing an internal capital planning process that simply seeks to
The Federal Reserve's Capital Plan Rule requires all U.S.-domiciled, mirror the Federal Reserve's stress testing is a weak practice.
top-tier BHCs with total consolidated assets of $50 billion or
more to develop and maintain a capital plan supported by
a robust process for assessing their capital adequacy.2
3 The plans of the remaining BHCs subject to the Capital Plan Rule have
been assessed through a separate process (the Capital Plan Review).
Beginning in 2014, the capital plans of all BHCs subject to the Capital
Plan Rule will be evaluated in a single, unified process through CCAR.
1 See SR Letter 12-17, "Consolidated Supervision Framework for Large
4 See 76 Fed. Reg. 74631, 74634 (December 1, 2011).
Financial Institutions," (December 17, 2012), www.federalreserve.gov/
bankinforeg/srletters/sr1217.htm; 12 CFR 225.8. 5 12 CFR part 225, subpart F.
2 12CFR 225.8. 6 See 12 CFR 225.8(d)(2), 225.8(e)(1).

238 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Figure 14.1 Seven principles of an effective capital adequacy process.

Principle 1: Sound foundational risk management

The BHC has a sound risk-measurement and risk-management infrastructure that supports the identification, measurement,
assessment, and control of all material risks arising from its exposures and business activities.

Principle 2: Effective loss-estimation methodologies

The BHC has effective processes for translating risk measures into estimates of potential losses over a range of stressful scenarios
and environments and for aggregating those estimated losses across the BHC.

Principle 3: Solid resource-estimation methodologies

The BHC has a clear definition of available capital resources and an effective process for estimating available capital resources
(including any projected revenues) over the same range of stressful scenarios and environments used for estimating losses.

Principle 4: Sufficient capital adequacy impact assessment

The BHC has processes for bringing together estimates of losses and capital resources to assess the combined impact on capital
adequacy in relation to the BHC's stated goals for the level and composition of capital.

Principle 5: Comprehensive capital policy and capital planning

The BHC has a comprehensive capital policy and robust capital planning practices for establishing capital goals, determining
appropriate capital levels and composition of capital, making decisions about capital actions, and maintaining capital
contingency plans.

Principle 6: Robust internal controls

The BHC has robust internal controls governing capital adequacy process components, including policies and procedures; change
control; model validation and independent review; comprehensive documentation; and review by internal audit.

Principle 7: Effective governance

The BHC has effective board and senior management oversight of the CAP, including periodic review of the BHC's risk
infrastructure and loss- and resource-estimation methodologies; evaluation of capital goals; assessment of the appropriateness
of stressful scenarios considered; regular review of any limitations and uncertainties in all aspects of the CAP; and approval of
capital decisions.

Many lagging practices identified in this publication involve and further recognizes that these BHCs will continue to develop
modeling approaches or BHC stress scenarios that fail to reflect and enhance their capital planning systems and processes to
BHC-specific factors or that rely on generic assumptions or meet supervisory expectations.
"standard" modeling techniques, without sufficient consider­
The purpose of this publication is two-fold. First, it is intended
ation of whether those assumptions or techniques are the most
to assist BHC management in assessing their current capi­
appropriate ones for the BHC.
tal planning processes and in designing and implementing
The supervisory expectations summarized here are broad and improvements to those processes. Second, it is intended to
reflect, at a general level, the key characteristics of a sound and assist a broader audience in understanding the key aspects of
robust internal capital planning process. While certain aspects capital planning practices at large, complex U.S. BHCs and the
of the detailed discussion that follows may be less relevant to importance the Federal Reserve puts on ensuring that these
individual BHCs based on their business mix and risk profile, the firms have robust capital resources.
core tenets espoused are broadly applicable to all BHCs subject
The sections that follow provide greater detail on supervisory
to the Capital Plan Rule.
expectations and the range of current practice across several
Importantly, the Federal Reserve has tailored expectations for dimensions of BHCs' internal capital planning processes. The
BHCs of different sizes, scope of operations, activities, and first section discusses foundational risk management, including
systemic importance in various aspects of capital planning. identification of risk exposures. The next two sections focus on
For example, the Federal Reserve has significantly heightened controls and governance around internal capital planning pro­
supervisory expectations for the largest and most complex cesses. The fourth section covers expectations and the range of
BHCs— in all aspects of capital planning— and expects these current practice concerning BHCs' capital policies— the internal
BHCs to have capital planning practices that are widely consid­ guidelines governing the capital action decisions made by a
ered to be leading practices. In addition, the Federal Reserve BHC under a range of potential future conditions for the firm
recognizes the challenges facing BHCs that are new to CCAR and for the macroeconomic and financial market environments

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 239

in which it operates. The subsequent three sections focus on needs.9 These processes should evaluate the full set of potential
the key elements of BHCs' internal enterprise-wide scenario exposures stemming from on- and off-balance sheet positions,
analysis: design of the stress scenarios and modeling the impact including those that could arise from provisions of noncontrac­
of the scenarios on losses, revenues, balance sheet composition tual support to off-balance-sheet entities, and risks conditional
and size, and capital. The final section summarizes the Federal on changing economic and financial market conditions during
Reserve's conclusions on the current range of practice at BHCs. periods of stress. BHCs should have a systematic and repeatable
process to identify all risks and consider the potential impact to
capital from these risks. In addition, BHCs should closely assess
14.2 FOUNDATIONAL RISK any assumptions about risk reduction resulting from risk transfer
MANAGEMENT and/or mitigation techniques, including, for example, analysis of
the enforceability and effectiveness of any guarantees or netting
BHCs are expected to have effective risk-identification, -mea­ and collateral agreements and the access to and valuation of
surement, -management, and -control processes in place to sup­ collateral as exposures and asset values are changing rapidly in
port their internal capital planning.7 In addition to the a stressed market.
assessments of a BHC's stress scenario analysis and stressed
Stronger risk-identification practices include standardized pro­
loss- and revenue-estimation practices, supervisory assessments
cesses through which senior management regularly update risk
of BHCs' internal capital planning will continue to focus on fun­
assessments, review risk exposures and consider how their risk
damental risk-identification, -measurement, and -management
exposures might evolve under a variety of stressful situations.
practices, as well as on internal controls and governance. W eak­
For example, many BHCs maintain a comprehensive inventory
nesses in these areas may contribute to a negative supervisory
of risks to which they are exposed, and refresh it as conditions
assessment of a BHC's capital planning process that could lead
warrant (such as changes in the business mix and the operat­
to an objection to a BHC's capital plan.8
ing environment) with input from various units across the BHC.
A key lesson from the recent financial crisis is that many financial Senior representatives from major lines of business, corporate
companies simply failed to adequately identify the potential risk management, finance and treasury, and other business and
exposures and risks stemming from their firm-wide activities. risk functions with perspectives on BHC-wide positions and risks
This was in part a failure of information technology and man­ provide input to the process. Consideration of the risks inherent
agement information systems (MIS), the often fractured nature in new products and activities should be a key part of risk-iden­
of which made it difficult for some companies to identify and tification and -assessment programs, which should also consider
aggregate exposures across the firm. But more importantly, risks that may be associated with any change in the BHC's stra­
many companies failed to consider the full scale and scope tegic direction.
of exposures, and to analyze how the size and risk character­
Risk measures should be able to capture changes in an institu­
istics of their exposures and business activities might evolve
tion's risk profile— whether due to a change in the BHC's strate­
as economic and market conditions changed. Combining a
gic direction, specific new products, increased volumes, changes
comprehensive identification of a firm's business activities and
in concentration or portfolio quality, or the overall economic
associated positions across the organization with effective
environment— on a timely basis. These risk measures should
techniques for assessing how those positions and activities may
support BHCs' assessments of capital adequacy and may be
evolve under stressful economic and market conditions, and
helpful in capital contingency plans as early warning indicators
assessing the potential impact of that evolution on the capital
or contingency triggers, where appropriate.
needs of the firm, are critical elements of capital planning. A
robust internal capital adequacy assessment process relies on BHCs should be able to demonstrate how their identified risks
the underlying strength of each of these elements. are accounted for in their capital planning processes. If certain
risks are omitted from the enterprise-wide scenario analysis,
BHCs should note how these risks are accounted for in other
Risk Identification aspects of the capital planning process (see Box 14.1 for illustra­
BHCs should have risk-identification processes that ensure that tion of how BHCs identified and captured certain risks that are
all risks are appropriately accounted for when assessing capital more difficult to quantify in their capital planning process). If
a BHC employs risk quantification methodologies in its capital

7 12CFR 225.8(d)(2).
8 12CFR 225.8(e)(2). 9 12 CFR 225.8(d)(2).

240 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 planning that are not scenario-based, it should identify which
BOX 14.1 INCORPORATING RISKS risks each of the methodologies covers, to facilitate comparabil­
THAT ARE MORE DIFFICULT TO ity and informed decision-making with respect to overall capital
QUANTIFY adequacy. BHCs with lagging practice did not transparently link
their evaluation of capital adequacy to the full range of identi­
Scenario-based stress testing is a critical element of
fied risks. These BHCs were not able to show how all their risks
robust capital planning. However, stress testing based on
a limited number of discrete scenarios cannot and is not were accounted for in their capital planning processes. In some
expected to capture all potential risks faced by a BHC, cases, staff responsible for capital planning operated in silos
and therefore, it should serve as one of several inputs to and developed standalone risk inventories not linked to the
the capital planning process. Given the scope of opera­ enterprise-wide risk inventory or to other risk governance func­
tions at and the associated breadth of risks facing large,
tions within their BHCs.
complex BHCs— including the risk of losses from expo­
sures and of reduced revenue generation—they are often
exposed to risks, other than credit or market risk, that are
either difficult to quantify or not directly attributable to 14.3 INTERNAL CONTROLS
any of the specific integrated firm-wide scenarios that are
evaluated as part of the BHC's scenario-based stress test­ As with other aspects of key risk-management and finance area
ing ("other risks"). Examples of these other risks include functions, a BHC should have a strong internal control fram e­
reputational risk, strategic risk, and compliance risk. As
work that helps govern its internal capital planning processes.
noted in the section on risk identification, a BHC should
identify and assess all risks as part of its risk-identification These controls should include (1) regular and comprehensive
process and should capture the potential effect of all risks review by internal audit; (2) robust and independent model
in its capital planning process. A BHC's capital planning review and validation practices; (3) comprehensive documenta­
process should assess the potential impact of these other tion, including policies and procedures; and (4) change controls.
risks on the BHC's capital position to ensure that its capital
provides a sufficient buffer against all risks to which the
BHC is exposed. Scope of Internal Controls
There is a wide range of practices around how BHCs
A BHC's internal control framework should address its entire
account for other risks as part of their capital planning
process. Many BHCs used internal capital tar gets to capital planning process, including the risk measurement and
account for such risks, putting in place an incremental management systems used to produce input data, the models
cushion above their targets to allow for difficult-to- and other techniques used to generate loss and revenue esti­
quantify risks and the inherent uncertainty represented mates; the aggregation and reporting framework used to pro­
by any forward-looking capital planning process. Other duce reports to management and boards; and the process for
BHCs assessed the effect of in terms of some combination
making capital adequacy decisions. While some BHCs may natu­
of reduced revenue, added expenses, or a management
overlay on top of loss estimates. BHCs with lagging prac­ rally develop components of their internal capital planning along
tices did not even attempt to account for other risks in separate business lines, the control framework should ensure
their capital planning process. that BHC management reconciles the separate components in a
To the extent possible, BHCs should incorporate the effect coherent manner. The control framework also should help assure
of these other risks into their projections of net income that all aspects of the capital planning process are functioning as
over the nine-quarter planning horizon. BHCs should intended in support of robust assessments of capital needs.
clearly articulate and support any relevant assumptions
and the methods used to quantify the effect of other risks BHCs with stronger control coverage reviewed the controls
on their revenue, expenses, or losses. around capital planning on an integrated basis and applied
For those BHCs that did not incorporate the potential them consistently. Management responded quickly and
impact of these other risks into their capital targets, stron­ effectively to issues identified by control areas and devoted
ger practices included a clear articulation of which risks appropriate resources to continually ensure that controls were
were being addressed by putting in place a cushion above functioning effectively.
the capital target, and how this cushion is related to identi­
fied risks. BHCs should clearly support the method they
used to measure the potential effect of such risks. Using Internal Audit
a simple rule (such as a percent of capital) or expert judg­
ments to determine the cushion above the capital target, Internal audit should play a key role in evaluating internal capital
without providing analysis or support, is a lagging practice. planning and its various components. Audit should perform a
review of the full process, not just of the individual components,

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 241

periodically to ensure that the entire end-to-end process is func­ produce projections or estimates used by the models that gener­
tioning in accordance with supervisory expectations and with a ate the final loss, revenue or expense projections. Consideration
BHC's board of directors' expectations as detailed in approved should be given to the validity of the use of a model under
policies and procedures. Internal audit should review the man­ stressed conditions as models designed for ongoing business
ner in which deficiencies are identified, tracked, and remedi­ activities may be inappropriate for estimating net income and
ated. Audit staff should have the appropriate competence and capital under stress conditions. BHCs should also maintain a pro­
influence to identify and escalate key issues, and the internal cess to incorporate well-supported adjustments to model esti­
audit function should report regularly on the status of all aspects mates when model weaknesses and uncertainties are identified.
of the capital planning process— including any identified defi­
BHCs continue to face challenges in conducting outcomes
ciencies related to the BHC's capital plan—to senior manage­
analysis of their stress testing models, given limited realized
ment and the board of directors.
outcomes against which to assess loss, revenue, or expense pro­
BHCs with stronger audit practices provided a comprehensive, jections under stressful scenarios. BHCs should attempt to com­
robust review of all components of the capital planning process, pensate for the challenges inherent in backtesting stress models
including all of the control elements noted earlier.10*BHCs with by conducting sensitivity analysis or by using benchmark or
leading internal audit practices around internal capital planning "challenger" models. BHCs should ensure that validation covers
had strong issue identification and remediation tracking as well. all models and assumptions used for capital planning purposes,
They also ensured that audit staff had strong technical expertise, including any adjustments management has made to the model
elevated stature in the organization, and proper independence estimates (management overlay).
from m anagem ent.11
Supervisory reviews have found that, in general, BHCs should
give more attention to model risk management, including
Independent Model Review strengthening practices around model review and validation.
Nonetheless, some BHCs exhibited stronger practices in their
and Validation
capital planning, including
BHCs should conduct independent review and validation of all
• maintaining an updated inventory of all models used in the
models used in internal capital planning, consistent with existing
process;
supervisory guidance on model risk management (SR Letter
11-7).12 Validation staff should have the necessary technical • ensuring that models had been validated for their intended

competencies, sufficient stature within the organization, and use; and

appropriate independence from model developers and business • being transparent about the validation status of all models
areas, so that they can provide a critical and unbiased evaluation used for capital planning and appropriately addressing any
of the models they review. models that had not been validated (or those that had identi­
fied weaknesses) by restricting their use, or using benchmark
• The model review and validation process should include
or challenger models to help assess the reasonableness of
• an evaluation of conceptual soundness; the primary model output.
• ongoing monitoring that includes verification of processes
BHCs with lagging practices were not able to identify all mod­
and benchmarking; and
els used in the capital planning process. They also did not for­
• an "outcomes analysis." mally review all of the models or assumptions used for capital
BHCs should maintain an inventory of all models used in the cap­ planning purposes (including some high-impact stress testing
ital planning process, including all input or "feeder" models that models). In addition, they did not have validation staff that were
independent and that could critically evaluate the models.

10 See 12CFR 225.8(d)(1)(iii).

Policies and Procedures
See SR Letter 13-1, "Supplemental Policy Statement on the Internal
11

Audit Function and Its Outsourcing," (January 23, 2013) www.feder- BHCs should ensure they have policies and procedures covering
alrserve.gov/bankinforeg/srletters/sr1301.htm, for detailed guidance the entire capital planning process.13 Policies and procedures
on expectations for the governance and operational effectiveness of an
institution's internal audit function. should ensure a consistent and repeatable process for all

12 See SR Letter 11-7, "Supervisory Guidance on Model Risk Manage­

ment," (April 4, 2011), www.federalreserve.gov/bankinforeg/srletters/
sr1107.htm. 13 See FR Y-14A reporting form: Summary Schedule Instructions, pp. 5-7.

242 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
components of the capital planning process and provide trans­ Many BHCs have systems that are antiquated and/or siloed and
parency to third parties regarding this process. Policies should not fully compatible, requiring substantial human intervention to
be reviewed and updated at least annually and more frequently reconcile across systems.
when warranted. There should also be evidence that manage­
ment and staff are adhering to policies and procedures in prac­
tice, and there should be a formal process for any policy
Documentation
exceptions. Such exceptions should be rare and approved by BHCs should have clear and comprehensive documentation for
the appropriate level of management. all aspects of their capital planning processes, including their
risk-measurement and risk-management infrastructure, loss- and
resource-estimation methodologies, the process for making cap­
Ensuring Integrity of Results
ital decisions, and efficacy of control and governance func­
BHCs should have internal controls that ensure the integrity of tions.15 Documentation should contain sufficient detail,
reported results and the documentation, review, and approval accurately describe BHCs' practices, allow for review and chal­
of all material changes to the capital planning process and its lenge, and provide relevant information to decision-makers.16
components. A BHC should ensure that such controls exist at all
levels of the capital planning process. Specific controls should
be in place to 14.4 GOVERNANCE
• ensure that MIS are sufficiently robust to support capital
BHCs should have strong board and senior management over­
analysis and decision-making, with sufficient flexibility to run
sight of their capital planning processes.17 This includes ensur­
ad hoc analysis as needed;
ing periodic review of the BHC's risk infrastructure and loss- and
• provide for reconciliation and data integrity processes for all resource-estimation methodologies; evaluation of capital goals
key reports; and targets; assessment of the appropriateness of stress scenar­
• address the presentation of aggregate, enterprise-wide ios considered; regular review of any limitations in key processes
capital planning results, which should describe any manual supporting internal capital planning, such as uncertainty around
adjustments made in the aggregation process and how those estimates; and approval of capital decisions. Together, a BHC's
adjustments compensate for identified weaknesses; and board and senior management should establish a comprehen­
• ensure that reports provided to senior management and the sive capital planning process that fits into broader risk-manage­
board contain the appropriate level of detail and are accurate ment processes and that is consistent with the risk-appetite
and timely. The party responsible for this reporting should framework and the strategic direction of the BHC.
assess and report whether the BHC is in compliance with its
internal capital goals and targets, and ensure the rationale for
Board of Directors
any deviations from stated capital objectives is clearly docu­
mented and obtain any necessary approvals.14 A BHC's board of directors has ultimate oversight responsibility
and accountability for capital planning and should be in a posi­
BHCs with stronger practices in this area ensured that good
tion to make informed decisions on capital adequacy and capital
information flows existed to support decisions, with significant
actions, including capital distributions.18 The board of directors
investment in controls for data and information. For example,
should receive sufficient information to understand the BHC's
some BHCs had an internal audit group review the data for
material risks and exposures and to inform and support its deci­
accuracy and ensured that any data reported to the board
sions on capital adequacy and planning. The board should
and senior management were given extra scrutiny and cross­
receive this information at least quarterly, or when there are
checking. In addition, BHCs with stronger practices had strong
material developments that affect capital adequacy or the man­
MIS in place that enabled them to collect, synthesize, analyze,
ner in which it is assessed. Capital adequacy information
and deliver information quickly and efficiently. These systems
also had the ability to run ad hoc analysis to support capital
planning as needed without employing substantial resources.
Other BHCs, however, continue to face challenges with MIS. 15 See id.
16 See id.
17 See 12 CFR 225.8(d)(1 )(iii)(A)-(B).
14 See id. 18 See 12 CFR 225.8(d)(1)(iii)(C).

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 243

provided to the board should include capital measures under practices also supplied their boards with information about past
current conditions as well as on a post-stress, pro forma basis capital planning performance to provide a perspective on how
and should be framed against the capital goals and targets the capital planning process has functioned over time.
established by the BHC.
BHCs with weaker practices provided insufficient information
The information provided to the board should include sufficient to the board of directors. For example, at some BHCs, capital
details on scenarios used for the BHC's internal capital plan­ distribution recommendations did not include all relevant sup­
ning so that the board can evaluate the appropriateness of the porting information and appeared to be based on optimistic
scenarios, given the current economic outlook and the BHC's expectations about how a given scenario may affect the BHC.
current risk profile, business activities, and strategic direction. In addition, the information did not specifically identify and
The information should also include a discussion of key limita­ address key assumptions that supported the capital planning
tions, assumptions, and uncertainties within the capital planning process. In other cases, the board of directors did not receive
process, so that the board is fully informed of any weaknesses information about governance and controls over internal capital
in the process and can effectively challenge reported results planning, making it difficult to assess the strength of its
before making capital decisions. The board should also receive capital planning processes and whether results were reliable
summary information about mitigation strategies to address key and credible.
limitations and take action when weaknesses in internal capital
planning are identified, applying additional caution and conser­
vatism as needed.
Senior Management
BHCs with stronger practices had boards that were informed of Senior management is responsible for ensuring that capital plan­
and generally understood the risks, exposures, activities, and ning activities authorized by the board are implemented in a sat­
vulnerabilities that affected the BHC's capital adequacy. They isfactory manner and is accountable to the board for the
also understood the major drivers of loss and revenue changes effectiveness of those activities. Senior management should
under the scenarios used. The boards of BHCs with stronger ensure that effective controls are in place around the capital
practices had sufficient expertise and level of engagement planning process— including ensuring that the BHC's stress sce­
to understand and critically evaluate information provided by narios are sufficiently severe and cover the material risks and
senior management. Importantly, they recognized that internal vulnerabilities facing the BH C .20
capital planning results are estimates and should be viewed as Senior management should make informed recommendations
part of a range of possible results. In addition, the boards of to the board of directors about the BHC's capital, including
BHCs with stronger practices discussed weaknesses identified capital goals and distribution decisions. Senior management
in the capital planning process, whether they needed to take also should ensure that proposed capital goals have sufficient
immediate action to address those weaknesses, and whether the analytical support and fully reflect the expectations of important
weaknesses were material enough to alter their view of current stakeholders, including creditors, counterparties, investors, and
capital planning results. They also discussed whether a sufficient supervisors. Senior management should identify weaknesses and
range of potential stress events and conditions had been con­ potential limitations in the capital planning process and evaluate
sidered in assessing capital adequacy. them for materiality. In addition, it should develop remediation
plans for any weaknesses affecting the reliability of internal capi­
tal planning results. Both the specific identified limitations and
Board Reporting
the remediation plans should be reported to the board.
The board of directors is required to approve a BHC's capital
Senior management with stronger practices recognized
plan under the Capital Plan Rule.19 In order for boards to carry
the imprecision and prevalence of uncertainty in predicting
out this requirement, management should provide adequate
future outcomes when reviewing information and results from
reporting on key areas of the analysis supporting capital plans.
enterprise-wide scenario analysis. At BHCs with stronger prac­
BHCs with stronger practices included information about the
tices, senior management maintained an ongoing assessment of
independent review and validation of models, information on
all capital planning areas, identifying and clearly documenting
issues identified by internal audit, as well as key assumptions
any weaknesses, assumptions, limitations, and uncertainties, and
underpinning stress test results and a discussion of the sensitiv­
did not consider a one-time assessment of the capital planning
ity of capital levels to those assumptions. BHCs with stronger

19 Id. 20 12 CFR 225.8(d)(2)(i)(A)-(D).

244 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
process to be sufficient. Furthermore, management developed processes and links to and is supported by other policies (risk-
clear remediation plans with specific timelines for resolving management, stress testing, model governance, audit, and oth­
identified weaknesses. In some cases, based on its review of ers). A capital policy should provide details on how a BHC
the full capital planning process, senior management made manages, monitors, and makes decisions regarding all aspects
more cautious or conservative adjustments to the capital plan, of capital planning. The policy should also address roles and
such as recommending less aggressive capital actions. Manage­ responsibilities of decision-makers, process and data controls,
ment also included key assumptions and process weaknesses in and validation standards. Finally, the capital policy should
reports and specifically pointed them out to the board, in some explicitly lay out expectations for the information included in
cases providing analysis showing the sensitivity of capital to the BHC's capital plan.
alternative outcomes.
A capital policy should describe targets for the level and compo­
sition of capital and provide clarity about the BHC's objectives
Documenting Decisions in managing its capital position. The policy should explain how
the BHC's capital planning practices align with the imperative of
BHCs should document decisions about capital adequacy and maintaining a strong capital position and being able to continue
capital actions taken by the board of directors and senior man­ to operate through periods of severe stress. It should include
agement, and describe the information used to reach those quantitative metrics such as common stock dividend (and other)
decisions.21 Final decisions regarding capital planning of the payout ratios as maximums or targets for capital distributions.
board or of a designated committee thereof should be recorded The policy should include an explanation of how management
and retained in accordance with the company's policies and concluded that these ratios are appropriate, sustainable, and
procedures. consistent with its capital objectives, business model, and capital
BHCs with stronger documentation practices had board minutes plan. It should also specify the capital metrics that senior man­
that described how decisions were made and what informa­ agement and the board use to make capital decisions. In addi­
tion was used. Some documentation provided evidence that tion, a capital policy should include governance and escalation
the board challenged results and recommendations, including protocols that are clear, credible, and actionable in the event an
reviewing and assessing how senior management challenged actual or projected capital ratio target is breached.
the same information. BHCs with weaker documentation prac­ The policy should describe processes surrounding how common
tices had board minutes that were very brief and opaque, with stock dividend and repurchase decisions are made and how the
little reference to information used by the board to make its BHC arrives at its planned capital distribution amounts. Specifi­
decisions. Some BHCs did not formally document key decisions. cally, the policy should discuss the following:

• the main factors and key metrics that influence the size, tim­

14.5 CAPITAL POLICY ing, and form of capital distributions

• the analytical materials used in making capital distribution
As noted earlier, a capital policy is the principles and guidelines decisions (e.g., reports, earnings, stress test results, and
used by a BHC for capital planning, capital issuance, and usage others)
and distributions. A capital policy should include internal capital • specific circumstances that would cause the BHC to reduce
goals; quantitative or qualitative guidelines for dividends and or suspend a dividend or stock repurchase program
stock repurchases; strategies for addressing potential capital
• factors the BHC would consider if contemplating the replace­
shortfalls; and internal governance procedures around capital
ment of common equity with other forms of capital
policy principles and guidelines.22 The capital policy, as a com­
• key roles and responsibilities, including the individuals or
ponent of a capital plan, must be approved by the BHC's board
of directors or a designated committee of the board.23 It groups responsible for producing the analytical material ref­
erenced above, reviewing the analysis, making capital distri­
should be a distinct, comprehensive written document that
addresses the major components of the BHC's capital planning bution recommendations, and making the ultimate decisions

BHCs should establish a minimum frequency (at least annually)

and other triggers for when its capital policy is reevaluated and
ensure that these triggers remain relevant and current. The
21 See FR Y-14A reporting form: Summary Schedule Instructions, p. 6.
capital policy should be reevaluated and revised as necessary to
22 12CFR 225.8(c)(4). address changes to organizational structure, governance struc­
23 See 12 CFR 225.8(d)(1)(iii)(C), 225.8(d)(2)(iii). ture, business strategy, capital goals, regulatory environment,

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 245

risk appetite, and other factors potentially affecting a BHC's economic and market environments and other factors on their
capital adequacy. BHCs should develop a formal process for overall capital adequacy and ability to raise additional capital,
approvals, change management, and documentation retention including the potential impact of contingent exposures and
relating to their capital policies. broader market or systemic events, which could cause risk to
increase beyond the BHC's chosen risk-tolerance level. BHCs
Weak capital policies were typically characterized by a limited
should have contingency plans for such outcomes.
scope. They only addressed parts of the capital planning pro­
cess, did not provide sufficient detail to convey clearly how Additionally, BHCs should calculate and use several capital
capital action decisions will be made, were not well integrated measures that represent both leverage and risk, including
with or supported by other risk and finance policies, and/or did quarterly estimates of regulatory capital ratios (including tier 1
not contain all of the elements described above (e.g., clearly common ratio) under both baseline and stress conditions. BHCs
defined capital goals, guidelines for capital distributions and with weaker practices in this area did not clearly link decisions
capital composition, etc.). In some cases, the capital policy regarding capital distributions to capital adequacy metrics or
was overly generic and not tailored to the BHC's unique internal capital goals.
circumstances. For example, the policy appeared to be restat­
Weak practices observed in this area included establishing capi­
ing supervisory expectations without concrete examples or
tal goals based solely on regulatory minimums and the ratios
BHC-specific considerations. In other cases, the more detailed
required to be considered well-capitalized without consideration
procedures were not presented to the board, thus limiting the
of a BHC's specific capital needs given its risk profile, financial
board's ability to understand the analysis underlying its capital
condition, business model and strategies, overall complexity, and
planning decisions.
sensitivity to changing conditions. Some BHCs did not recognize
uncertainties and limitations in capturing all potential sources of
Capital Goals and Targets loss and in projecting loss and revenue estimates, which reduced
the BHCs' ability to establish effective capital goals and targets.
BHCs should establish capital goals aligned with their risk appe­ Other BHCs were not transparent about how they determined
tites and risk profiles as well as expectations of internal and the capital goals and targets in their capital policies.
external stakeholders, providing specific goals for the level and
composition of capital, both current and under stressed condi­
tions. Internal capital goals should be sufficient to allow a BHC Capital Contingency Plan
to continue its operations during and after the impact of stress­
BHCs should outline in their capital policies specific capital con­
ful conditions. As such, capital goals should reflect current and
tingency actions they would consider to remedy any current or
future regulatory capital requirements, as well as the expecta­
prospective deficiencies in their capital position.25 In particular, a
tions of shareholders, rating agencies, counterparties, creditors,
BHC's policy should include a detailed explanation of the
supervisors, and other stakeholders.
circumstances— including deterioration in the economic environ­
BHCs should also establish capital targets above their capital ment, market conditions, or the financial condition of the BHC—
goals to ensure that capital levels will not fall below the goals in which it will reduce or suspend a dividend or repurchase
during periods of stress. Capital targets should take into consid­ program or not execute a previously planned capital action. The
eration forward-looking elements related to the economic out­ policy also should define a set of capital triggers and events that
look, the BHC's financial condition, the potential impact of stress would correspond with these circumstances. These triggers
events, and the uncertainty inherent in the capital planning pro­ should be established for both baseline and stress scenarios and
cess. The goals and targets should be specified in the capital measured against the BHC's capital targets in those scenarios.
policy and reviewed and approved by the board.24 These triggers and events should be used to guide the frequency
with which board and senior management will revisit planned
In developing their capital goals and targets, particularly with
capital actions as well as review and act on contingency capital
regard to setting the levels of capital distributions, BHCs should
plans. The capital contingency plan should be reviewed and
explicitly take into account general economic conditions and
updated as conditions warrant, such as where there are material
their plans to grow their on- and off-balance-sheet size and risks
changes to the BHC's organizational structure or strategic direc­
organically or through acquisitions. BHCs should consider the
tion or to capital structure, credit quality, and/or market access.
impact of external conditions during both normal and stressed

24 12 CFR 225.8(c)(4). 25 Id.

246 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Capital triggers should provide an "early warning" of capital The range of observed practice for developing BHC stress sce­
deterioration and should be part of a management decision­ narios was broad. Some BHCs designed stress scenarios using
making framework, which should include target ranges for a internal models and expertise. Other BHCs used vendor-defined
normal operating environment and threshold levels that trig­ macroeconomic scenarios or used vendor models to define
ger management action. Such action should include escalation customized macroeconomic scenarios. For BHCs with internally
to the board, potential suspension of capital actions, and/or developed scenarios, those with stronger scenario-design prac­
activation of a capital contingency plan. Triggers should also be tices used internal models in combination with expert judgment
established for other metrics and events that measure or affect rather than relying solely on either models or expert judgment
the financial condition or perceived financial condition of the to define scenario conditions and variables. Among BHCs that
firm— for example, liquidity, earnings, debt and credit default used third-party scenarios, those with stronger practices tai­
swap spreads, ratings downgrades, stock performance, supervi­ lored third-party-defined scenarios to their own risk profiles and
sory actions, or general market stress. unique vulnerabilities.

Contingency actions should be flexible enough to work in a Regardless of the method used to develop the scenario, BHCs
variety of situations and be realistic for what is achievable during should have a scenario-selection process that engages a broad
periods of stress. The capital plan should be prepared recogniz­ range of internal stakeholders such as risk experts, business man­
ing that certain capital-raising and capital-preserving activities agers, and senior management. Although they are required to sub­
may not be feasible or effective during periods of stress. BHCs mit only one BHC stress scenario for CCAR, BHCs should develop
should have an understanding of market capacity constraints a suite of scenarios that collectively capture their material risks and
when evaluating potential capital actions that require accessing vulnerabilities under a variety of stressful circumstances and should
capital markets, including debt or equity issuance and also con­ incorporate them into their overall capital planning processes.
templated asset sales. Contingency actions should be ranked
according to ease of execution and their impact and should
incorporate the assessment of stakeholder reactions (e.g.,
Scenario Design and Severity
impacts on future capital-raising activities). As indicated in the preamble to the Capital Plan Rule, "the bank
Weak capital contingency plans provided few options to address holding company-designed stress scenario should reflect an indi­
contingency situations and/or did not consider the feasibility of vidual company's unique vulnerabilities to factors that affect its
options under stressful conditions. Plans with overly optimistic firm-wide activities and risk exposures, including macroeconomic,
assumptions or excessive reliance on past history (in terms of market-wide, and firm-specific events."27 Thus, BHC stress sce­
both possible contingency situations and options to address narios should reflect macroeconomic and financial conditions that
those situations) were also considered weak, as were plans that are tailored specifically to stress a BHC's key vulnerabilities and
lacked support for the feasibility and availability of possible idiosyncratic risks, based on factors such as its particular business
contingency actions. Other weak practices included establishing model, mix of assets and liabilities, geographic footprint, portfo­
triggers based on actual results but not on projected results, or lio characteristics, and revenue drivers. A BHC stress scenario
based on minimum regulatory capital ratios only with no con­ that simply features a generic weakening of macroeconomic con­
sideration of the expectations of other stakeholders including ditions similar in magnitude to the supervisory severely adverse
counterparties, creditors and investors, or of other metrics or scenario does not meet these expectations.
market indicators. BHCs with stronger scenario-design practices clearly and
creatively tailored their BHC stress scenarios to their unique
business-model features, emphasizing important sources of risk
14.6 BHC SCENARIO DESIGN not captured in the supervisory severely adverse scenario. Exam ­
ples of such risks observed in practice included a significant
Under the Capital Plan Rule, a BHC is required to use a BHC- counterparty default; a natural disaster or other operational-risk
developed stressed scenario that is appropriate for its business event; and a more acute stress on a particular region, industry,
model and portfolios.26 Accordingly, BHCs should have a pro­ and/or asset class as compared to the stress applied to gen­
cess for designing scenarios for enterprise-wide scenario analy­ eral macroeconomic conditions in the supervisory adverse and
sis that reflects the BHC's unique business activities and severely adverse scenarios.
associated vulnerabilities.

26 12CFR 225.8(d)(2)(i)(A). 27 See 77 Fed. Reg. 74631, 74636 (December 1, 2011).

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 247

At the same time, BHC stress scenarios should not feature trading activities and revenues included a limited set of relevant
assumptions that specifically benefit the BHC. For example, financial variables. Other BHCs with significant regional and/or
some BHCs with weaker scenario-design practices assumed that industry concentrations did not include relevant geographic or
they would be viewed as strong compared to their competitors industry variables.
in a stress scenario and would therefore experience increased
market share. Such assumptions are contrary to the supervisory
expectations for and the intent of a stress testing exercise that
Clear Narratives
informs capital planning. The scenario should be supported by a clear narrative describ­
While a broad-based recession adversely affects a wide range of ing how the scenario addresses the particular vulnerabilities
most BHCs' business activities, BHCs may have business mod­ and material risks facing the BHC. BHCs with stronger scenario-
els or important business activities that generate vulnerabili­ design practices provided narratives describing how the sce­
ties that are not particularly well captured by scenario analysis nario variables related to the risks faced by a BHC's significant
based on a stressed macroeconomic environment (or for which business lines and, in some cases, how the scenario variables
even a severe recession is not the primary source of potential corresponded to variables in the BHC's internal risk-manage­
vulnerability). These BHCs should incorporate into their stress ment models. The narratives also provided explanations of how
scenarios elements that address the key revenue vulnerabilities a scenario stressed a BHC's unique vulnerabilities specific to
and sources of loss for their specific businesses and activities. its business model and how the paths of the scenario variables
In combination, the recession incorporated into the BHC stress related to each other in an economically intuitive way. Weaker
scenario and any additional elements intended to address spe­ practices included scenario narratives that did not provide any
cific businesses or activities should result in a substantial stress context for the variable paths as well as scenario narratives that
for the organization, including a significant reduction in capital described features that were not reflected in any variables con­
ratios relative to baseline projections. However, a BHC stress sidered in a BHC's internal capital planning.
scenario that produces post-stress capital ratios lower than
those under the supervisory severely adverse scenario is not,
in and of itself, a safe harbor. The stress scenario included in a 14.7 ESTIMATION METHODOLOGIES
BHC's capital plan should place substantial strains on its abil­ FOR LOSSES, REVENUES, AND
ity to generate revenue and absorb losses, consistent with its EXPENSES
unique risks and vulnerabilities.
A BHC's capital plan must include estimates of projected reve­
nues, expenses, losses, reserves, and pro forma capital levels,
Variable Coverage including any minimum regulatory capital ratios, the tier 1 com­

The set of variables that a BHC includes in its stress scenario mon ratio and any additional capital measures deemed relevant
by the BHC, over the planning horizon under expected condi­
should be sufficient to address all material risks arising from its
exposures and business activities. A business line could face tions and under a range of stressed scenarios.28

significant stress from multiple sources, requiring more than one

risk factor or macroeconomic variable. The scenario should gen­ General Expectations
erally contain the relevant variables to facilitate pro forma finan­
cial projections that capture the impact of changing conditions Projections of losses, revenues, and expenses under hypotheti­
and environments. BHCs should have a consistent process for cal stressed conditions serve as the fundamental building blocks
determining the final set of variables and provide this rationale of the pro forma financial analysis supporting enterprise-wide
as part of the scenario narrative. scenario analysis. BHCs should have stress testing method­
ologies that generate credible estimates that are consistent
Overall, BHCs with stronger scenario-design practices gener­
with assumed scenario conditions. It is important for BHCs to
ated scenarios in which the link between the variables included
understand the uncertainties around their estimates, including
in the scenario and sources of risk to the BHC's financial outlook
the sensitivity of the estimates to changes in inputs and key
were transparent and straightforward. Clear narratives helped
assumptions. Overall, BHCs' estimates of losses, revenues, and
make these links more transparent. BHCs with weaker scenario-
expenses under each of the scenarios should be supported by
design practices developed stress scenarios that excluded
some variables relevant to the BHC's risk profile and idiosyn­
cratic vulnerabilities. For example, some BHCs with significant 28 12 CFR 225.8(d)(1).

248 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
empirical evidence, and the entire estimation process should type, size, and composition of the BHC's portfolio. For example,
be transparent and repeatable. The Federal Reserve generally a more diverse portfolio— both in terms of borrower risk char­
expects BHCs to use models or other quantitative methods as acteristics and performance— would generally require a greater
the basis for their estimates; however, there may be instances number of segments to account for the heterogeneity of the
where a management overlay or other qualitative approaches portfolio. However, when segmenting portfolios, it is important
may be appropriate due to data limitations, new products or to ensure that each risk segment has sufficient data observations
businesses, or other factors. In such instances, BHCs should to produce reliable model estimates.
ensure that such processes are well supported, transparent, and
As a general practice, BHCs should separately estimate losses,
repeatable over time.
revenues, or expenses for portfolios or business lines that are
sensitive to different risk drivers or sensitive to risk drivers in a
Establishing a Quantitative Basis markedly different way. For instance, losses on commercial and
for Enterprise-Wide Scenario Analysis industrial loans and commercial real estate (CRE) loans are, in
Generally, BHCs should develop and use internal data to esti­ part, driven by different factors, with the path of property values
mate losses, revenues, and expenses as part of enterprise-wide having a more pronounced effect on CRE loan losses. Similarly,
scenario analysis.29 However, in certain instances, it may be although falling property value affects both income-producing
more appropriate for BHCs to use external data to make their CRE loans and construction loans, the effect often differs mate­
models more robust. For example, BHCs may lack sufficient, rel­ rially due to structural differences between the two portfolios.
evant historical data due to factors such as systems limitations, Such differences can become more pronounced during periods
acquisitions, or new products. When using external data, BHCs of stress. BHCs with leading practices have demonstrated clearly
should take care to ensure that the external data reasonably the rationale for selecting certain risk drivers over others. BHCs
approximate underlying risk characteristics of their portfolios, with lagging practices used risk drivers that did not have a clear
and make adjustments to modeled outputs to account for iden­ link to results, either statistically or conceptually.
tified differences in risk characteristics and performance
Many models used for stress testing require a significant number
reflected in internal and external data.
of assumptions to implement. Further, the relationship between
BHCs can use a range of quantitative approaches to estimate macroeconomic variables and losses, revenues, or expenses
losses, revenues, and expenses, depending on the type of port­ could differ considerably in the hypothetical stress scenario from
folio or activity for which the approach is used, the granularity what is observed historically. As a result, while traditional tools
and length of available time series of data, and the materiality for evaluating model performance (such as comparing projec­
of a given portfolio or activity. While the Federal Reserve does tions to historical out-of-sample outcomes) are still useful, the
not require BHCs to use a specific estimation method, each BHC Federal Reserve expects BHCs to supplement them with other
should estimate its losses, revenues, and expenses at sufficient types of analysis. Sensitivity analysis is one tool that some BHCs
granularity so that it can identify common, key risk drivers and have used to test the robustness of models and to help model
capture the effect of changing conditions and environments. developers, BHC management, the board of directors, and
For example, loss models should be estimated at a sufficiently supervisors identify the assumptions and parameters that mate­
granular subportfolio or segment level so that they can capture rially affect outcomes. Sensitivity analysis can also help ensure
observed variations in risk characteristics and performance that core assumptions are clearly linked to outcomes. Using
across the subportfolios or segments and across time, and results from different estimation approaches (challenger models)
account for changing exposure or portfolio characteristics over as a benchmark is another way BHCs can gain greater comfort
the planning horizon. around their primary model estimates, as the strengths of one
approach could potentially compensate for the weaknesses of
While BHCs often segment their portfolios and activities along
another. When using multiple approaches, however, it is impor­
functional areas, such as by line of business or product type, the
tant that BHCs have a consistent framework for evaluating the
leading practice is to determine segments based on common
results of different approaches and supporting rationale for why
risk characteristics (e.g., credit score ranges or loan-to-value
they chose the methods and estimates they ultimately used.
ratio ranges) that exhibit meaningful differences in historical per­
formance. The granularity of segments typically depends on the In certain instances, BHCs may need to rely on third-party
models— for example, due to limitations in internal modeling
capacity. In using these third-party models (vendor models or
29 BFICs are required to collect and report a substantial amount of risk
information to the Federal Reserve on FR Y-14 schedules. These data consultant-developed models), BHCs should ensure that their
may help to support the BHC's enterprise-wide scenario analysis. internal staff have working knowledge and a good conceptual

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 249

understanding of the design and functioning of the models and shortcomings should be investigated and communicated to
potential model limitations so that management can clearly decision-makers. In addition, any management overlay or quali­
communicate them to those governing the process. An off-the- tatively derived projections should be subject to effective review
shelf vendor model often requires some level of firm-specific and challenge. BHCs should evaluate a range of potential esti­
analysis and customization to demonstrate that it produces esti­ mates and conduct sensitivity analysis for key assumptions used
mates appropriate for the BHC and consistent with scenario in the estimation process. For example, if a BHC makes exten­
conditions. Sensitivity analysis can be particularly helpful in sive adjustments to its modeled estimates of losses, revenue,
understanding the range of possible results of vendor models and expenses, the impact of such adjustments should be quanti­
with less transparent or proprietary elements. Importantly, all fied relative to unadjusted estimates, and these results should
vendor and consultant-developed models should be validated in be documented and made available to BHC management and
accordance with SR 11-7 guidelines.30 the board of directors. Finally, extensive use of management
judgment to adjust modeled estimates should trigger review
Some BHCs generated annual projections for certain loss, rev­
and discussion as to whether new or improved modeling
enue, or expense items and then evenly distributed them over
approaches are needed. In reporting to the board of directors,
the four quarters of each year. This practice does not reflect a
management should always provide both the initial results and
careful estimate of the expected quarterly path of losses, net
the results after any judgmental adjustments.
revenue, and capital, and thus is only acceptable when a BHC
can clearly demonstrate that the projected item is highly uncer­
Conservatism and Credibility
tain and the practice likely results in a conservative estimate.
Given the uncertainty inherent in a forward-looking capital plan­
Qualitative Projections, Expert Judgment, ning exercise, the Federal Reserve expects BHCs to apply gen­
and Adjustments erally conservative assumptions throughout the stress testing
process to ensure appropriate tests of the BHCs' resilience to
While quantitative approaches are important elements of
stressful conditions. In particular, BHCs should ensure that mod­
enterprise-wide scenario analysis, BHCs should not rely on
els are developed using data that contain sufficiently adverse
weak or poorly specified models simply to have a modeled
outcomes. If a BHC experienced better-than-average perfor­
approach. In fact, most BHCs use some forms of expert judg­
mance during previous periods of stress, it should not assume
ment for some purposes— generally as a management adjust­
that those prior patterns will remain unchanged in the stress
ment overlay to modeled outputs. And BHCs can, in limited
scenario. BHCs should carefully review the applicability of key
cases, use expert judgm ent as the primary method to produce
assumptions and critically assess how historically observed pat­
an estimate of losses, revenue, or expenses. BHCs may use a
terns may change in unfavorable ways during a period of severe
management overlay to account for the unique risks of certain
stress for the economy, the financial markets, and the BHC.
portfolios that are not well captured in their models, or oth­
erwise to compensate for specific model and data limitations. In the context of C C A R loss and revenue estimates, BHCs
Material changes in BHCs' businesses or limitations in relevant should generally include all applicable loss events in their analy­
data may lead some BHCs to rely wholly on expert judgm ent sis, unless a BHC no longer engages in a line of business or its
for certain loss, revenue, or expense projections. In using activities have changed such that the BHC is no longer exposed
expert judgm ent, BHCs should ensure that they have a trans­ to a particular risk. BHCs should not selectively exclude losses
parent and repeatable process, that management judgm ents based on arguments that the nature of the ongoing business or
are well supported, and that key assumptions are consistent activity has changed—for example, because certain loans were
with assumed scenario conditions. underwritten to standards that no longer apply or were acquired
and, therefore, differ from those that would have been origi­
As with quantitative methods, the assumptions and processes
nated by the acquiring institution.
that support qualitative approaches should be clearly docu­
mented so that an external reviewer can follow the logic and Similarly, BHCs should not rely on favorable assumptions that
evaluate the reasonableness of the outcomes.31 Any potential cannot be reasonably assured to occur in stressed environments
given the high level of uncertainty around market conditions.
BHCs should also not assume any foresight of scenario condi­

30 See SR Letter 11-7, "Supervisory Guidance on Model Risk Manage­ tions over the projection horizon beyond what would reasonably
ment," (April 4, 2011), www.federalreserve.gov/bankinforeg/srletters/ be knowable in real-life situations. For example, some BHCs
sr1107.htm. have used the path of stress scenario variables to make optimis­
31 See FR Y-14A reporting form: Summary Schedule Instructions, pp. 5-6. tic assumptions about possible management actions ex ante in

250 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
anticipation of stressful conditions, such as preemptively rebal­ to a given scenario and also improve the overall fit of the model.
ancing their portfolios or otherwise adjusting their risk profiles Any models used to produce additional risk drivers are key com­
to mitigate the expected impact. In the event of a downturn, ponents of the loss-estimation process and, therefore, should be
the future path or progression of economic and market condi­ included in BHCs' model inventories and receive the same model
tions would not be clearly known, and this uncertainty should be risk-management treatment as core loss-estimation models.
reflected in the capital plans.
Generally, BHCs sum up losses from various portfolios and
activities to produce aggregate losses for the enterprise-wide
Documentation of Estimation Practices
scenario analysis. BHCs should have a repeatable process to
The Federal Reserve expects BHCs to clearly document their aggregate losses, particularly when they transform model esti­
key methodologies and assumptions used to estimate losses, mates to combine disparate risk measures (such as accounting-
revenues, and exp enses.32 BHCs with stronger practices pro­ based and economic loss concepts), different measurement
vided documentation that concisely explained m ethodologies, horizons, or otherwise dissimilar loss estimates.
with relevant macroeconomic or other risk drivers, and dem on­
BHCs with leading practices used automated processes that
strated relationships between these drivers and estim ates.
showed a clear audit trail from source data to loss estimation
Documentation should clearly delineate among model out­
and aggregation, with full reconcilement to source systems and
puts, qualitative overlays to model outputs, and purely qualita­
regulatory reports and mechanisms requiring approval and log­
tive estim ates.33 BHCs with w eaker practices often had limited
ging of judgmental adjustments and overrides. These systems
documentation that was poorly organized and that relied
often leveraged existing enterprise-wide financial and regulatory
heavily on subjective management judgm ent for key model
consolidation processes.
inputs with limited empirical support for and documentation of
these adjustm ents. BHCs with lagging practices exhibited a high degree of manual
intervention in the aggregation process, and applied aggregate-
level management adjustments that were not transparent or
Loss-Estimation Methodologies well supported.

As noted earlier, a BHC's internal stress testing processes should

Retail and Wholesale Credit Risk
be designed to capture risks inherent in its own exposures and
business activities. Consistent with any good modeling prac­ BHCs used a range of approaches to produce loss estimates
tices, when developing loss-estimation methodologies, BHCs on loans to retail and corporate customers, often using differ­
should first determine whether there is a sound theoretical basis ent estimation methods for different portfolios. This section
for macroeconomic and other explanatory variables (risk drivers) describes the observed range of practice for the methods used
used to estimate losses, and then empirically demonstrate that to project losses on retail and wholesale loan portfolios.
a strong relationship exists between those variables and losses.
For example, most BHCs' residential-mortgage loss models Data and Segmentation
used some measure of unemployment and a house price index Sources of data used for loss estimation have often differed
as explanatory variables, which affect a borrower's ability and between retail and wholesale portfolios. Due to availability
incentive to repay. of a richer set of retail loss data, particularly from the most
Beyond the core set of macroeconomic variables that typically recent downturn, BHCs generally used internal data to estimate
represents a given scenario, such as gross domestic products defaults or losses on retail portfolios and only infrequently used
(GDP), unemployment rate, Treasury yields, credit spreads, and external data with longer history to benchmark estimated losses
various price indices, BHCs often project additional variables on portfolios that had more limited loss experience in the recent
that have a more direct link to particular portfolios or exposures. downturn. For wholesale portfolios, some BHCs supplemented
Some examples of these variables include regional macro- internal data with external data or used external data to cali­
economic variables that better capture the BHC's geographic brate their models due to a short time series (5-10 years) that
exposures and sector-specific variables, such as office vacancy included only a single downturn cycle.
rates and corporate profits. Using these additional variables to BHCs with stronger practices accounted for dynamic changes
estimate the model can enhance the sensitivity of loss estimates in their portfolios, such as loan modifications or changes in
portfolio risk characteristics, and made appropriate adjustments
32 See id. to data or estimates to compensate for known data limitations
33 See id. (including lack of historical periods of stress).

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 251

BHCs with weaker practices failed to compensate for data limi­ BHCs with leading practices were able to break down losses
tations or adequately demonstrate that external data reasonably into PD, LGD, and EAD components, separately identifying key
reflect the BHC's actual exposures, often failing to capture geo­ risk drivers for each of those components, though they typically
graphic, industry, or lending-type concentrations. did not demonstrate this level of granularity consistently across
all portfolios. For certain wholesale portfolios, some BHCs used
The level of segmentation used for modeling varied depending
long-run average PD, LGD, and EAD for a particular segment,
on the type and size of portfolio and estimation methods used.
such as a rating grade, to estimate losses. By design, estimates
For example, BHCs often segmented the retail portfolio based
based on long-run average behavior over a mix of conditions,
on some combinations of product; lien position; risk characteris­
including periods of economic expansion and downturn, are not
tics such as credit score, loan-to-value ratio, and collateral; and
appropriate for projecting losses under stress and should not be
underlying collateral information (e.g., single-family home ver­
used for these purposes.
sus condominium), though some models were estimated at the
loan-level and others at the portfolio level. BHCs with leading practices clearly tied LGD to underlying
risk drivers, accounted for collateral and guarantees, and also
BHCs with stronger practices had segmentation schemes that
incorporated the likelihood of a decline in collateral values
were well supported by the BHC's data and analysis, with suf­
under stress. However, most BHCs have more limited data on
ficient granularity to capture exposures that react differently to
LGD and, as a result, BHCs often applied a simple, conserva­
risk drivers under stressed conditions.
tive assumption (e.g., 100 percent LGD for credit cards), based
BHCs with weaker practices used a single model for multiple stressed LGD on their experience during the crisis, or scaled
portfolios, without sufficiently adjusting modeling assumptions up the historical average LGD using expert judgment. In using
to capture the unique risk drivers of each portfolio. For example, such methods, it is important for BHCs to ensure that the pro­
in estimating losses on wholesale portfolios, these BHCs did not cess is well supported and transparent in line with the Federal
adequately allow for variation in loss rates commonly attributed Reserve's general expectation for expert judgment-based esti­
to industry, obligor type, collateral, lien position, or other rel­ mates. W herever possible, BHCs should benchmark their esti­
evant information. mates with external data or research and analysis.

BHCs with lagging practices modeled LGD using a weighted-

Common Credit Loan Loss-Estimation Approaches
average approach at an aggregate portfolio level, without some
BHCs have used a wide range of methods to estimate credit level of segmentation (e.g., by lending product, priority of claim,
losses, depending on the type and size of portfolios and collateral type, geography, vintage, or LTV). Or, they failed to
data availability. These methods can be based on either an demonstrate that LGD estimates were consistent with the sever­
accounting-based loss approach (that is, charge-off and recovery) ity of the scenario.
or an economic loss approach (that is, expected losses). BHCs
Although some BHCs found a relationship between EAD and
have flexibility in selecting a specific loss or estimation approach;
credit quality, most BHCs did not model EADs to vary according
however, it is important for BHCs to understand differences
to the macroeconomic environment, in large part due to data
between the two loss approaches, particularly in terms of the tim­
limitations. Rather, many BHCs applied a static assumption to
ing of loss recognition, and to account for the differences in set­
estimate stressed EAD.
ting the appropriate level of reserves at the end of each quarter.
BHCs with stronger practices included the use of loan equiva­
Expected Loss Approaches lent calculations (i.e., estimated additional draw-downs as a
percentage of unused commitments, which are added to the
Under the expected loss approach, losses are estimated as a func­
outstanding or drawn balance) and credit-conversion factors
tion of three components— probability of default (PD), loss given
(i.e., additional drawdowns during the period leading up to
default (LGD), and exposure at default (EAD). PD, LGD, and EAD
default— usually one year prior— as a percentage of both drawn
can be estimated at a segment level or at an individual loan level,
and undrawn commitments) to capture losses associated with
and using different models or assumptions. In general, BHCs used
undrawn commitments.
econometric models to estimate losses under a given scenario,
where the estimated PDs were conditioned on the macroeconomic BHCs with weaker practices did not project stressed exposures
environment and portfolio or loan characteristics. Some BHCs associated with undrawn commitments and/or relied on the
used other approaches, such as rating transition models, to esti­ assumption that they can actively manage down committed lines
mate stressed default rates as part of an expected loss framework. during stress scenarios.

252 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Rating Transition Models BHCs with stronger practices typically had more granular ratings
system and accounted for limitations in their data and/or credit
Many BHCs have used a rating transition-based approach
rating systems by making adjustments to model assumptions or
to produce a stressed rating transition matrix for each quar­
estimates, or by supplementing internal data with external data.
ter, which is then used to estimate losses for their wholesale
portfolios under stress. These approaches used credit ratings BHCs with weaker practices often failed to demonstrate that
applied to individual loans by the BHC and projected how supplemented external data adequately reflected the ratings
these ratings would change over time given the macroeco­ performance of the BHC's portfolio. BHCs with weaker practices
nomic scenario. Although the details of techniques used to link also sometimes relied on a risk rating process that historically
rating transitions to scenario conditions varied across firms, resulted in lumpiness in rating upgrades and downgrades or
the process usually involved the following steps: (1) convert­ material concentrations in one or two rating categories. As
ing the rating transition matrix into a single summary measure; a result, these BHCs often produced transition matrices with
(2) estimating a time-series model linking the summary mea­ limited sensitivity to scenario variables, and resulting estimates
sure to scenario variables; (3) projecting the summary measure were more consistent with long-term average default rates than
over the nine-quarter planning horizon, using the parameter with default rates that would be experienced under severe eco­
estimates from the time-series model; and (4) converting the nomic stress.
projected summary measure into a full set of quarterly transi­
tion matrices. BHCs using such an approach should be able to
Roll-Rate Models
demonstrate that the summary measure responds to changes Many BHCs have used roll-rate models to estimate losses for
in economic conditions as expected (that is, worsens as the various retail portfolios. Roll-rate models generally estimate
economic condition deteriorates) and results in projected rat­ the rate at which loans that are current or delinquent in a given
ing transition matrices that are consistent with the severity of quarter roll into delinquent or default status in the next period.
scenario. Judgm entally selecting transition matrices from past As a result, they are conceptually similar to rating transition
stress periods is a weak practice, as it may produce loss esti­ models. The Federal Reserve expects BHCs that use roll-rate
mates that are not consistent with a given scenario and fails to models to have a robust time series of data with sufficient gran­
recognize that conditions in the future may not precisely mirror ularity. The robust time series data allow the BHC to establish
conditions observed by the BHC in the past. a strong relationship between roll rates and scenario variables,
while the availability of granular data enables BHCs to model
Sound rating transition models require two fundamental build­
all relevant loan transitions and to segment the portfolio into
ing blocks: a robust time series of data and well-calibrated,
subportfolios that exhibit meaningful variations in performance,
granular-risk rating systems. The Federal Reserve expects
particularly during the period of stress. In general, BHCs should
BHCs that use rating transition models to have robust time
estimate roll rates using models that are conditioned on sce­
series of data that include a sufficient number of transitions,
nario variables. For certain transition states where statistical rela­
which allows BHCs to establish a statistically significant rela­
tionships between roll rates and scenarios are weak (such as late
tionship between the transition behavior and macroeconomic
stage loan delinquency), BHCs should incorporate conservative
variables. Data availability has been a widespread constraint
assumptions rather than relying solely on statistical relationships.
inhibiting the developm ent of granular transition models
because a sufficient number of upgrades and downgrades are While roll-rate models have some advantages, including trans­
necessary to preclude sparse matrices. In order to overcome parency and ease of use, they often have a weak predictive
these data limitations, BHCs have often relied on third-party power outside the near future, particularly if they are not prop­
data to develop rating transition models. Consistent with the erly conditioned on scenario variables. As a result, some roll-rate
Federal Reserve's general expectations, when using third-party models have limited usefulness for stress testing over a longer
data, BHCs should be able to demonstrate that the transition horizon, such as the nine-quarter planning horizon required in
matrices estimated with external data are a reasonable proxy CC A R. Some BHCs have used roll-rate models in conjunction
for the migration behavior of their portfolios. Rating transition with other estimation approaches (such as a vintage model
models also require granular ratings systems that capture dif­ described below) that project losses for later periods. In general,
ferences in the potential for defaults and losses for a given set it is a weaker practice to combine two different models, as it can
of exposures in various economic environments. BHCs that lack introduce unexpected jumps in estimated losses over the plan­
well-calibrated, granular credit-risk rating systems are often ning horizon, though some BHCs have judgmentally weighed
unable to produce useful transition matrices. two different estimation methods to smooth projected losses. If

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 253

BHCs combine two models, they should be able to demonstrate NCO models often exhibit lower explanatory power than mod­
that such an approach is empirically warranted based on output els that consider distinct portfolio risk drivers. In addition, NCO
analysis, including sensitivity analysis, and that the process of models implicitly assume that historical charge-off performance
transitioning from one set of results to the other is consistent, is a good predictor of future performance; however, the histori­
well supported, and transparent. cal relationship between charge-offs and macro variables may
not be realized under very stressful scenarios that fall outside
Vintage Loss Models the portfolio's actual historical experience. Accordingly, a NCO
model that is estimated without using sufficient segmentation or
Some BHCs use vintage loss models, also known as age-cohort-
does not account for current or changing portfolio composition
time models, to estimate losses for certain retail portfolios.
is unlikely to produce robust loss estimates. Thus, BHCs should
BHCs that use vintage loss models generally segment their retail
avoid using such a NCO model as the primary loss-estimation
portfolios by vintage and collateral- or credit-quality-based
approach for a material portfolio.
segments. Losses are estimated using a multistep process—
developing a baseline seasoning curve for each segment and
using a regression model to estimate sensitivity of losses to
Scalar Adjustments
macroeconomic variables at each seasoning level (e.g., four Some BHCs have used simple scalars to adjust portfolio loss
quarters after origination). This technique is commonly used in estimate under a baseline scenario upward for stress scenarios.
several vendor models, but BHCs also have developed and used Scalars have been calibrated based on some combination of
proprietary models using this technique. historical performance, the ratio of modeled stressed losses to
baseline losses estimated for other portfolios, and expert judg­
These models have several advantages (such as natural seg­
ment. Scalar adjustments are easy to develop, implement, and
mentation of portfolio by cohort and maturity) and ease of
communicate; however, the approach has significant shortcom­
application to credit products (such as auto loans) that exhibit
ings, including lack of transparency and lack of sensitivity to
lifecycle effects. However, vintage models can be very challeng­
changes in portfolio composition and scenario variables. Con­
ing to construct, calibrate, and validate. In particular, it may be
sequently, the use of these types of approaches should be, at
difficult to separately identify vintage effects from the effects of
most, limited to immaterial portfolios.
macroeconomic variables, which can result in poorly specified
models. These models also assume that different cohorts will
experience similar losses over time, generating results that are
Available-for-Sale (AFS) and Held-to-Maturity
(HTM) Securities
representative of average years, rather than during the period of
stress. In using vintage models, it is important for a BHC to be BHCs should test all credit-sensitive AFS and HTM securities for
able to demonstrate that the approach appropriately reflects its potential other-than-temporary impairment (OTTI) regardless of
portfolio composition and history, and that modeled outputs are current impairment status. The threshold for determining OTTI
consistent with stressed conditions. for structured products should be based on cash-flow analysis
and credit analysis of underlying obligors. Most BHCs used a
Charge-Off Models ratings-based approach to determine OTTI of direct obligations
such as corporate bonds, based on the projection of ratings
A minority of BHCs have used net charge-off (N CO ) models as
migration under a stress scenario and a ratings-based OTTI
either a primary loss-estimation model or a benchmark model.
threshold. However, some BHCs with weaker practice used a
Typically, the N CO models BHCs used estimated a statistical
ratings-based approach that kept the ratings static over the sce­
relationship between charge-off rates and macroeconomic
nario horizon.
variables at a portfolio level, and often included autoregres­
sive terms (lagged N CO rates). W hile some BHCs also incorpo­ BHCs should have quantitative methods that capture appropri­
rated variables that describe the underlying risk characteristics ate risk drivers and explicitly translate assumed scenario condi­
of the portfolio, N CO models that BHCs used for capital plan­ tions into estimated losses. Estimation methods should generate
ning generally did not capture variation in sensitivities to risk results that conform to standard accounting treatment, are con­
drivers across important portfolio segm ents nor accounted for sistent with scenario conditions, and are appropriately sensitive
changes in portfolio risk characteristics over tim e. As a mat­ to changes in key variables. Any assumptions (e.g., assumptions
ter of general practice, BHCs should not use models that do related to loss recognition) should be consistent with the intent
not capture changes in portfolio risk characteristics over time of a stress testing exercise. Additionally, models should be inde­
and in scenarios used for stress testing as part of their internal pendently validated for their use in projecting OTTI losses for
capital planning. specific classes of securities.

254 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
OTTI processes for A FS and HTM securities portfolios varied in processes, people, or systems or from external events. Generally,
sophistication across BHCs. BHCs with leading practices used operational-risk events are grouped into one of several event-
estimation methods that capture both security-specific and type categories, such as internal fraud, external fraud, or damage
country-specific performance data for relevant portfolios. For to physical assets.35 In general, BHCs should use internal
securitized products, they modeled the credit risk of underlying operational-loss data as a starting point to provide historical per­
exposures (e.g., commercial real estate loans) to estimate poten­ spective, and then incorporate forward-looking elements, idio­
tial losses. Where BHCs used management judgment, it was lim­ syncratic risks, and tail events to estimate losses. Most BHCs
ited and well supported in the methodology documentation. have supplemented their internal loss data with external data
when modeling operational-risk loss estimates and scaled the
In addition, BHCs with leading practices chose conservative
losses to make the external loss data more commensurate with
approaches and assumptions for OTTI loss estimation, such as
their individual risk profiles. The Federal Reserve expects such
recognizing losses in early quarters rather than over the entire
scaling approaches to be well supported. Few BHCs have incor­
scenario horizon. Though, under current accounting rules, OTTI
porated business environment and internal control factors such
losses are recognized only up to the amount of unrealized
as risk control self-assessments and other risk indicators into their
losses, some BHCs have taken a conservative approach to allow
operational-risk methodology. While the Federal Reserve does
OTTI losses to exceed projected unrealized losses.
not expect BHCs to use these qualitative tools as direct inputs in
BHCs with lagging practices did not test all credit-sensitive a model, they can help identify areas of potential risk and help
securities for potential O TTI; rather, they tested only currently BHCs select appropriate scenarios that stress those risks.
impaired positions or securities that met a certain criteria (e.g.,
only securities rated below investment grade) for O TTI. BHCs Internal Data Collection and Data Quality
should not rely solely on a ratings-based threshold to deter­
The Federal Reserve expects BHCs to have a robust and com­
mine OTTI for structured products. BHCs with lagging practices
prehensive internal data-collection method that captures key
had OTTI loss-estimation methodologies that did not capture
elements, such as critical dates (i.e., occurrence, discovery, and
appropriate risk drivers or scenario conditions and/or were not
accounting), event types, and business lines. In general, BHCs
applied at a sufficiently granular level. In some cases, BHCs
should use complete data sets of internal losses when modeling,
excluded key explanatory variables for certain asset classes.
and not judgmentally exclude certain loss data.
For example, the unemployment rate was used to project OTTI
losses for non-agency residential mortgage-backed securities Data quality and comprehensiveness have varied consider­
(RMBS), but the housing price index (HPI) was excluded even ably across BHCs. BHCs with lagging practices often excluded
though the theory and empirical evidence points to a strong certain internal loss data from model input for various reasons.
relationship between mortgage losses and housing prices. As a Examples include
result of these methodology deficiencies, these BHCs projected
• excluding large items such as legal reserves and tax/ compli­
OTTI losses that were inconsistent with the risk characteristics of
ance penalties;
the portfolio and assumed scenario conditions.
• omitting losses from merged or acquired institutions mergers
or acquisitions due to complications in collection and aggre­
Operational Risk
gation; and
Best practices in operational-risk models are still evolving, and
• excluding loss data from discontinued business lines, even
the Capital Plan Rule does not require BHCs to use advanced
though the loss events were reasonably generic and appli­
measurement approach (AMA) models for stressed operational-
cable to remaining business lines within the organization.
risk loss estimation.34 However, BHCs that have developed a
rich set of data to support the AM A should consider leveraging Some BHCs have addressed observed outliers by omitting them
the same data and risk-management tools to estimate opera­ from the data set, modeling them separately, or applying an add­
tional losses under a stress scenario, regardless of a particular on based on scenario analysis or management input. If BHCs do
methodology they choose to estimate losses. not have the data from potential mergers and acquisitions, one

Most operational-risk models use historical data on operational-

risk loss "events"— incidences in which a BHC has experienced a
35 For example, the seven event-type categories used for AMA are inter­
loss or been exposed to loss due to inadequate or failed internal nal fraud; external fraud; employment practices and workplace safety;
clients, products, and business practices; damage to physical assets;
business disruption and system failures; and execution, delivery, and
34 12 CFR part 225, appendix G. process management.

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 255

way to account for this limitation is to scale existing internal data where no correlation with macroeconomic factors was identified.
using the size of operations and apply an add-on to applicable A simple approach may be acceptable depending on the size
business lines or units of measure. If a BHC excludes data or uses and complexity of the BHC as well as data and sophistication of
data-smoothing techniques, especially as they affect large losses, models available to them. Very few BHCs have yet developed
it should have a well-supported rationale for doing so, and clearly benchmarks to either challenge or further support the projec­
document the rationale and the process.36 tions provided by their main models.

The Federal Reserve expects BHCs to segment their loss data

Regression Models
into units of measure that are granular enough to capture similar
losses while balancing it with the availability of data. Most BHCs Most BHCs have used a regression model, either by itself or with
have segmented datasets by event type; however, some BHCs another approach described below, to estimate operational-
have segmented the loss data by consolidated business lines, risk losses for stress scenarios. Some BHCs also have used a
event types, or some combination of the two. regression model for the baseline scenarios, albeit with different
parameters. Operational-risk regression models are generally
Correlation with Macroeconomic Factors used to estimate two variables: loss frequency (i.e., the number
of operational-risk losses) and loss severity (i.e., the loss amount).
Most BHCs have attempted to identify correlation between
macroeconomic factors and operational-risk losses, but some BHCs that were able to identify significant correlation between
have struggled to identify a clear relationship for some types macroeconomic variables and operational-risk losses have
of operational-risk loss events. BHCs that did not identify a used regression models to stress the loss frequency or total
significant correlation typically developed other methodolo­ operational-risk losses. Some macroeconomic variables were
gies, such as scenario analysis layered onto modeled results, to adjusted for the purpose of correlation analysis or to reflect
project stressed operational-risk losses. These approaches can time-lag assumptions. Most BHCs judgmentally chose time peri­
be reasonable alternatives if BHCs can demonstrate that their ods for estimation and model specification rather than justifying
approach results in sufficiently conservative loss estimates that them with statistical evidence.
are consistent with the stress scenario. Most BHCs were not able to find meaningful correlation
BHCs that identified correlations between macroeconomic fac­ between macroeconomic variables and operational-risk loss
tors and operational-risk elements typically had large data sets severity. As a result, BHCs that used a regression model to esti­
and often used external loss data to supplement internal data. mate loss frequency typically applied the loss-severity assump­
These BHCs often identified correlations between loss fre­ tion (e.g., static or four-quarter moving average) based on the
quency and macroeconomic factors for certain event types and most recent crisis period to estimate operational losses.
adjusted the frequency distributions for the respective event
type accordingly. Modified Loss-Distribution Approach (LDA)
The LDA is an empirical modeling technique commonly used
Common Operational-Loss-Estimation Approaches by BHCs subject to the AM A to estimate annual value-at-risk
Most BHCs have used their annual budgeting or forecasting (VaR) measures for operational-risk losses based on loss data
process to estimate operational losses in the baseline scenario. and fitted parametric distributions. The LDA involves estimat­
The process typically uses a combination of historical loss data ing probability distributions for the frequency and the severity
and management input at a business-line level. Some BHCs of operational loss events for each defined unit of measure,
have used historical averages from internal loss data to estimate whether it is a business line, an event type, or some combination
losses in the baseline scenario. of the two.

BHCs with stronger practices used a combination of approaches The estimated frequency and severity distributions are then
to incorporate historical loss experience, forward-looking ele­ combined, generally using a Monte Carlo simulation, to esti­
ments, and idiosyncratic risks into their stressed loss projections. mate the probability distribution for annual operational-risk
Using a combination of approaches can help address model losses at each unit of measure.
and data limitations. Some BHCs used separate models for For purposes of C C A R , LDA models have generally been used
certain events types such as fraud or litigation, and used other in one of two ways: (1) by using a lower confidence interval than
approaches (e.g., using historical averages) for event types the 99.9th percentile used by the AM A, or (2) by adjusting the
frequency based on outcomes of correlation analysis. BHCs
36 See FR Y-14A reporting form: Summary Schedule Instructions, p. 5. that modified the LDA by using a lower confidence interval

256 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
typically have used either the mean or median for the baseline BHCs should support the chosen time periods, thresholds,
estimates and higher confidence intervals—typically ranging and any excluded or adjusted outliers and demonstrate that
from 70th percentile to 98th percentile— for the stressed esti­ loss estimates are consistent with what are expected in the
mates. Additionally, some BHCs have used different confidence stress scenario.
intervals for different event types. The Federal Reserve does not
require BHCs to use a particular percentile to produce stressed Legal Exposures
estimates. However, it expects BHCs to implement a credible,
Since legal exposure represents a significant portion of opera­
transparent process to select a percentile; be able to demon­
tional losses for many BHCs, a number of BHCs have analyzed
strate why the percentile is an appropriate choice given the
and projected legal losses separately from non-legal losses. The
specific scenario under consideration; and perform sensitivity
Federal Reserve expects BHCs to include all legal reserves and
analyses around the selection of a percentile to test the impact
settled legal losses in their total loss estimate for operational
of this assumption on model outputs. Some BHCs modified the
risk. BHCs have used various methods to estimate legal losses,
LDA by adjusting frequency distributions based on the observed
such as applying a judgment-based add-on for significant losses;
correlation between macroeconomic variables and operational-
using legal reserves; using historical averages; or creating sepa­
risk losses.
rate regression models for the clients, products, and business
practices event type. To estimate litigation losses resulting from
Scenario Analysis
representations and warranties liabilities related to mortgage
Scenario analysis is a systematic process of obtaining opinions underwriting activities, some BHCs have developed hazard-rate
from business managers and risk-management experts to assess models based on historical loan performance to estimate default
the likelihood and loss impact of plausible severe operational- rates and then estimated repurchase claim rates.
loss events. Some BHCs have used this process to determine a
management overlay that is added to losses estimated using a Market Risk and Counterparty Credit Risk
model-based approach. BHCs have used this overlay to incor­
BHCs that have sizeable trading operations may incur significant
porate idiosyncratic risks (particularly for event types where cor­
losses from such operations under a stress scenario due to valu­
relation was not identified) or to capture potential loss events
ation changes stemming from credit and/or market risk, which
that the BHC had not previously experienced. BHCs should be
may arise as a result of moves in risk factors such as interest
able to demonstrate the quantitative effect of the management
rates, credit spreads, or equity and commodities prices, and
overlay on final loss estimates.
counterparty credit risk owing to potential deterioration in the
Scenario analysis, if used effectively, can help compensate for credit quality or outright default of a trading counterparty.37
data and model limitations, and allows BHCs to capture a wide BHCs use different techniques for estimating such potential
range of risks, particularly where limited data are available. The losses. These techniques can be broadly grouped into two
Federal Reserve expects BHCs using scenario analysis to have a approaches: probabilistic approaches that generate a distribu­
clearly defined process and provide an appropriate rationale for tion of potential portfolio-level profit/loss (P/L) and deterministic
the specific scenarios included in their loss estimate. The pro­ approaches that generate a point estimate of portfolio-level
cess for choosing scenarios should be credible, transparent, and losses under a specific stress scenario.
well supported.
Both approaches have different strengths and weaknesses. A
probabilistic approach can provide useful insight into a range of
Historical Averages
scenarios that generate stress losses in ways that a deterministic
Some BHCs used historical averages of operational-risk losses, stress testing approach may not be able to do. However, the
in combination with other approaches noted above, to estimate probabilistic approach is complex and often lacks transparency,
operational-risk losses under stress scenarios. For example, and as a result, it can be difficult to communicate the relevant
BHCs have used historical averages for event types where no scenarios to senior managers and the board of directors. In addi­
correlation between macroeconomic factors and operational- tion, the challenges inherent in tying probabilistic loss estimates
risk losses was identified but used a regression model for
event types where correlations were identified. A small number
of BHCs have used historical averages as the sole approach 37 Under the Federal Reserve's stress testing rules, BHCs with greater
than $500 billion in total consolidated assets who are subject to the
to develop stressed loss estimates. When used alone, this
market risk rule (12 CFR part 225, appendix E) are required to apply the
approach is backward-looking and excludes potential risks the global market shock as part of their annual Dodd-Frank Act company-
BHCs have not experienced. When using historical averages, run stress tests.

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 257

to specific underlying scenarios can make it difficult for manage­ developed the overlays using expert judgm ent based on the
ment and the board of directors to readily discern what actions knowledge of their positions and market developments.
could be taken to mitigate portfolio losses in a given scenario.
The Federal Reserve expects BHCs to consider multiple market
Combined, these factors complicate the use of probabilistic
shock scenarios as part of their internal stress testing. BHCs
approaches as the primary element in an active capital planning
should develop and use stress scenarios that severely stress
process that reflects well-informed decisions by senior manage­
BHCs' mark-to-market positions and account for BHCs' idiosyn­
ment and the board of directors. The Federal Reserve expects
cratic risks, in the event of a market-wide or firm-specific stress.
BHCs using a probabilistic approach to provide evidence that
In developing scenarios, BHCs should ensure that stress scenar­
such an approach can generate scenarios that are potentially
ios appropriately stress positions or products in which the BHC
more severe than what was historically experienced, and also to
has a large market share (net or gross) or is a dominant player
clearly explain how BHCs use the scenarios associated with tail
and should also consider more unusual basis risks arising from
losses to identify and address their idiosyncratic risks.
complex interlocking and interdependent positions, if such
By comparison, a deterministic approach generally produces moves could result in large losses. BHCs that only use a scenario
scenarios that are easier to communicate to senior management that closely mirrors the Federal Reserve's global market shock
and the board of directors. However, a deterministic approach component of the severely adverse and adverse scenarios
often uses a limited set of scenarios, and may miss certain should be aware that such an approach may omit significant
scenarios that may result in large losses. The Federal Reserve risks that are unique to their positions, and that such omissions
expects BHCs using a deterministic approach to demonstrate could lead to a negative assessment of a firm's capital planning
that they have considered a range of scenarios that sufficiently process. BHCs should clearly document the process they use to
stress their key exposures. select stress scenarios, with sufficient justification and clear artic­
ulation of key aspects of the scenarios.38
For CC A R, most BHCs generally relied on a deterministic
approach. BHCs using deterministic approaches often relied
on statistical models— for example, to inform the magnitude of
Translating Scenarios to Risk Factor Shocks
risk-factor movements and covariances between risk factors— Once broad scenarios were developed, BHCs translated these
and also considered multiple scenarios as part of the broader scenarios into concrete specification of individual risk factors
internal stress testing supporting their capital planning process. that were the actual inputs to pricing models, typically using the
BHCs using deterministic approaches used a three-step process existing risk infrastructures and processes used for risk manage­
to generate P/L losses under a stress scenario: ment, such as VaR and credit valuation adjustment (CVA). Most
BHCs used instantaneous market shocks for stress testing, which
1. Design and selection of stress scenarios
assumed highly stressful outcomes that have typically occurred
2. Construction and implementation of the scenario (that is,
over a period of time (days, weeks, or months) will occur instan­
translation to risk-factor moves) taneously. Given the uncertainty surrounding a firm's ability to
3. Revaluation (and aggregation) of position and portfolio- exit or manage positions during a period of severe market
level P&L under the stress scenarios stress, this is an appropriate practice and suitably conservative
for capital planning. Consistent with general supervisory expec­
The Federal Reserve expects BHCs to have robust operational
tations around risk-measurement processes, BHCs should clearly
and implementation practices in all areas, including position
document the approximations and assumptions used as part of
inclusion, risk-factor representations, and revaluation methods.
their measurement of risks under stress, assess the potential
impacts, and address any deficiencies identified.39
S tre ss Scenarios
The size of shocks assumed in the stress scenario is often quite
Most BHCs using deterministic approaches developed a set of
large. As a result, mechanical application of such shocks to cur­
broad narratives and considered a number of market shock sce­
rent levels of risk factors could result in implausible outcomes
narios that address the breadth of the BHCs' risks before select­
such as negative riskfree rates or negative forward rates. BHCs
ing the scenario included in their capital plans. In general, these
should ensure that the proposed shocks produce results that are
BHCs used some combination of historical events and hypo­
thetical projections to inform and develop the market shock
scenarios. They also developed certain core themes or narra­
tives for each scenario, which was sometimes supplemented 38 See FR Y-14A reporting form: Summary Schedule Instructions, pp. 5-6.
with an overlay to capture additional nuances. BHCs generally 39 See id., p. 6.

258 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
plausible. In particular, BHCs should take care in modeling dislo­ market shock scenario. BHCs often use a model similar to that
cations and discordant moves of risk factors that normally move used for the incremental risk regulatory capital charge— a proba­
similarly. Additionally, while dislocations and discordant moves bilistic approach based on some measure of PD, LGD, and EAD
are expected under stress, BHCs should have a process to of counterparties or issuers—to estimate losses from possible
assess that the resulting joint moves of risk factors are reason­ defaults over some future horizon (e.g., to the typical margin
able. Also, the dislocations and discordant moves implied by a period of risk). BHCs with leading practices also considered for
stress scenario may require risk-factor mappings that deviate their internal stress testing an explicit default scenario of one
from the normal mappings. BHCs should clearly document or more of their largest counterparties and/or customers. This
instances of such deviation and provide support.40 approach has the benefit of allowing the BHC to consider tar­
geted defaults of counterparties and customers to which the
Revaluation Methodologies and P/L Estimates BHC has large exposures.

In principle, revaluation for stress testing can be carried out

using the same infrastructure and calculators as conventional Risk Mitigants and Other Assumptions
risk-measurement tools. However, practical revaluation methods Some BHCs have incorporated management responses to the
may embed a number of approximations, which could introduce stress, assuming, for example, some positions would be sold
mismeasurement into the stress test results. In particular, VaR or hedged over time under the stress scenario. The Federal
methodologies often use approximation methods for a number Reserve expects any assumptions about risk mitigation to be
of reasons— for example, to economize on computational costs conservative. Where BHCs assume management actions that
related to running a large number of scenarios daily. Although have the effect of reducing losses under the scenario, they
approximation methods may perform adequately for the risk- should be able to demonstrate that such actions are consistent
factor moves that are considered in normal conditions (for a with established policy, supported by historical experience,
small number of scenarios), BHCs should generally use "full- and executable with high confidence in the market environ­
revaluation" methods for stress testing, given the very large ment contemplated by the scenario. BHCs should recognize
risk-factor moves, especially for nonlinear positions with value that their ability to take mitigating actions may be more limited
dependent on multiple risk factors. BHCs can use approximation in the stress scenario. For example, it may not be reasonable
methods on a limited basis if extensive tests and analyses sug­ to assume that BHCs can easily sell their positions to other
gest that the potential mismeasurement from using such meth­ BHCs under the stress scenario. In addition, BHCs should avoid
ods is not significant. BHCs should clearly support the process making unrealistic assumptions about their ability to foresee
they use to ascertain the extent of such mismeasurements. Also, precisely how a scenario would play out, and take action on the
for certain parameters that are not easily "market-observable" basis of that information.
and, therefore, cannot be inferred from traded instruments
(e.g., correlations for credit-default baskets and correlations for
certain interest-rate and exchange-rate pairs), BHCs should con­ PPNR Projection Methodologies
sider suitably perturbed values of the model parameters.
The Capital Plan Rule requires BHCs to estim ate revenue and
In addition, BHCs should ensure that P/L estimates under the stress expenses over the nine-quarter planning horizon.41 A cco rd­
scenario are relatively easy to interpret and explain. For example, ingly, BH Cs should have effective processes for projecting
BHCs with leading practices easily identified key P&L drivers in PPNR and its revenue and expense subcom ponents over the
terms of positions, asset classes, and risk types. BHCs should also same range of stressful scenarios and environm ents used for
conduct sensitivity analysis to ensure that P/L estimates under the estim ating losses. In projecting these amounts, BHCs should
stress scenario are robust, without being unduly sensitive to small consider not only their current positions, but also how their
changes in inputs, assumptions, and modeling choices. activities and business focus may evolve over time under the
varying circum stances and operating environm ents reflected
Counterparty and Issuer Defaults in the scenarios being used.
Defaults of counterparties or issuers and/or reference entities
are typically not embedded directly within the instantaneous

40 See id., pp. 5-6. 41 12CFR 225.8(d)(2)(i).

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 259

General Considerations for Robust Observed PPNR Projection Practices
PPNR Projections The translation of macroeconomic assumptions into projections
As part of a comprehensive enterprise-wide scenario analysis of PPNR over a range of stressful scenarios and environments
program, BHCs should have methodologies that generate can take many forms, and BHCs used a variety of approaches
robust projections of PPNR consistent with the current and and models to make these projections. BHCs with stronger
projected paths of on- and off-balance-sheet exposures, risk- practices demonstrated strong interactions among central
weighted assets (RWA), and other exposure assumptions used planning functions, business lines, and the treasury group, with
for related loss estimation. PPNR projections should also be an open flow of information and a robust challenge process.
consistent with assumed scenario conditions and be projected in A t these BHCs, the role of the central group was not just to
accordance with the same accounting basis that would be used aggregate components of PPNR projections. In some cases,
to calculate relevant capital ratios. BHCs should project all key the corporate planning areas also provided independent pro­
elements of PPNR at a level of granularity consistent with the jections that were compared to the aggregated business line
materiality of revenue and expense components and sufficient results as a part of the challenge process. A t other BHCs, the
to capture differing drivers of revenue and expenses across corporate planning group derived the PPNR projections, which
the organization. Finally, BHCs should consider the effects that were then discussed and challenged by business lines. Both
regulatory changes (e.g., changes in deposit insurance coverage approaches resulted in better-supported assumptions and
limits) may have on their ability to replicate historical perfor­ projections than approaches in which the central group simply
mance or achieve stated goals. aggregated projections made by others.

Key assumptions that may materially affect PPNR estimates In addition, BHCs with stronger practices made projections
should be consistent with assumed scenario conditions and based on a full exploration of the most relevant relationships
internally consistent within each scenario, particularly assump­ between assumed scenario conditions and revenues and
tions related to the business model and strategy (e.g., deposit expenses. At these BHCs, business-line expertise was leveraged
growth, pricing assumptions, expense reductions, and other in the development of methodologies. A key part of this explo­
management actions). Management is expected to evaluate the ration was determining the way that revenues and expenses
reasonableness and timing of projected strategies, including were segmented for projection purposes. BHCs with stronger
mitigating actions taken in a stressful scenario, to ensure that practices did not rely exclusively on the line-item definitions in
the assumptions reflect realistic and achievable outcomes for regulatory reports, though these BHCs often established a pro­
a given scenario. Where possible, assumptions should be sup­ cess to clearly map internal BHC reporting conventions to the
ported by quantitative analysis or empirical evidence. various line items on the FRY-14 schedules.

In all cases, BHCs should ensure that projections (including In contrast, BHCs with lagging practices lacked clear processes
those of PPNR, loss, balance sheet size and composition, and for translating assumed scenario conditions into revenue and
RWA) present a coherent story within each scenario. BHCs expense projections. Frequently, it was observed that one or
should clearly establish a relationship among revenue, expenses, more material components of their projections appeared incon­
the balance sheet, and any applicable off-balance-sheet items sistent with scenario conditions. In some cases, projections of
and document how their process generates a consistent and certain revenue and expense components relied heavily on
coherent evolution of these items over the course of the sce­ management judgment, which was not transparent, well sup­
nario.42 For example, origination assumptions should be the ported, or subject to a robust challenge process. In other cases,
same for projecting loan balances, related loan fees, origination revenue estimates varied from historical experience and conven­
costs, and loan losses. Similarly, there should be coherence tional expectations, and management provided no documented
among trading revenue projections, trading assets, trading lia­ support or analysis around the reasonableness and sensitivity
bilities, and trading RWA projections. Management should doc­ of modeling assumptions. Overall, data limitations, unclear or
ument the relationships among these items and avoid cases unsubstantiated management assumptions, and poor documen­
where outcomes move in counterintuitive directions.43 tation were the problems most prevalent across the BHCs.

Another commonly observed practice for estimating PPNR

under stressed conditions was the adjustment of budget or
42 See 12 CFR 225.8(d)(i)-(ii); FR Y-14A reporting form: Summary baseline estim ates, with budget estimates largely qualitatively
Schedule Instructions, pp. 5-6. derived through input from a variety of business lines and/or
43 See id. stakeholders across the BHC. Although a process of adjusting

260 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
baseline estimates is not problematic in itself, some BHCs the assumption of mitigating actions) that were not consistent
relied heavily on baseline estim ates to develop stress scenario with stressed scenario conditions and the intent of a capital
outcomes without considering favorable strategic actions and planning and stress testing exercise. For example, management
assumptions incorporated into baseline results that might not assumed it would be able to drastically reduce loan origina­
be realistic or feasible under stressed conditions. If a BHC tion activity, cut expenses, or take other mitigating actions in a
derives stressed estimates by applying a stress overlay to base­ severely adverse scenario without considering the longer-term
line estim ates, it should demonstrate the link between baseline consequences on the BHC's strategy and operating structure.
estimates and baseline conditions, demonstrate the appro­
The following sections provide specific expectations for project­
priateness of the overlay based on the differing conditions
ing key components of PPNR, as well as summary points on
between the scenarios, and appropriately consider changes
observed range of practice.
in management actions or other related assumptions under a
stress scenario. Net Interest Income
BHCs with weaker practices used models with low predictive Net interest income projections are closely linked to many other
power, in part due to data limitations. BHCs should not use elements of a BHC's capital plan. Balance sheet assumptions
weak models just for the sake of using a modeled approach to used to project net interest income should be consistent with
PPNR. Some BHCs used weak models either as a frame of refer­ balance sheet assumptions considered as part of loss estimation
ence or a starting point to translate economic factors into esti­ as well as with other asset and liability management assump­
mates of key PPNR components, but then adjusted the results tions. Loan pricing should be consistent with both scenario
using expert judgment. In such cases, BHCs should thoroughly conditions and competitive and strategic factors, including pro­
explain and document why results, once adjusted, are consistent jected changes to the size of the portfolio. Deposit projections
with the scenario conditions.44 In cases where models have low should incorporate the impact of strategic plans and pricing on
predictive power, BHCs with stronger practices found other deposit growth or decline, in addition to scenario factors.
ways to compensate, such as using industry-level models with
Net interest income projections are expected to incorporate
BHC-specific market share assumptions to project revenue. In all
the balances and contractual terms of current portfolio holdings
cases, BHCs with stronger practices provided supplemental
as well as the behavioral characteristics of these portfolios. The
analysis describing why the approach was appropriate.
methods BHCs use to project their net interest income should
In cases where BHC-specific data were limited, BHCs with be able to capture dynamic conditions for both current and pro­
stronger practices used external data to augment and extend jected balance sheet positions. Such conditions include but are
their internal data. BHCs with weaker practices relied on not limited to prepayment rates, new business spreads, re-pric­
models that were overly influenced by limited data covering a ing rates due to changes in yield curves, behavior of embedded
single economic cycle. This approach is particularly problem ­ optionality such as caps or floors, call options, and/or changes in
atic if the BHC also experienced favorable conditions, such as loan performance (that is, transition to nonperforming or default
a significant recovery, during the single cycle, which might not status) consistent with loss estimates.
recur in future downturns. In some cases, data were limited to
Some BHCs specified product characteristics and conducted
as few as 10 quarters, which would not encompass a period
analysis around these characteristics (e.g., repricing behavior,
of economic weakening or be sufficient to estimate a robust
line utilizations) both for current assets and new originations in
model, and thus would not be appropriate for considering
order to understand the variance in behaviors under the different
potential results in a downturn. Many BHCs cited challenges
scenarios considered. They also attempted to capture the prod­
due to systems mergers or changes that limited data availabil­
uct mix changes that would occur as a result of customer and
ity, but failed to adequately compensate for these limitations
market conditions (e.g., changes in domestic deposit mix due to
by supplementing internal data with external industry data,
anticipated growth in demand for time deposits for a specified
where appropriate, or by considering whether longer time
scenario). BHCs with stronger documentation practices provided
series of available aggregate data would be preferable to a
detailed tables explaining underlying assumptions such as bal­
shorter time series of more granular data.
ance drivers and spread and growth assumptions by product.
Some BHCs with weaker practices made business model and
Some BHCs partially integrated loss projections into net interest
strategy assumptions (e.g., new business, expense reductions,
income projections but did not adequately align all projection-
related assumptions. For example, these BHCs might take the
44 See id. full loan loss projections and allocate them across the portfolios

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 261

based on the current mix of nonperformance across those trading assets, trading liabilities, and trading RWA and how all
loan portfolios, without considering the changing relative per­ these elements are consistent with conditions in the stress sce­
formance of those portfolios over the course of the scenario. nario.46 BHCs with business profiles driven by off-balance-sheet
Other BHCs were unable to demonstrate coherence between items should document how revenue projections are linked to
net interest income projections and loss projections, generally on- and off-balance-sheet behavior.47 Although relationships
because one or both modeling approaches did not fully capture between revenue and trading assets or off-balance-sheet items
the behavioral characteristics of the loan portfolio. may be weak over short periods, BHCs should nevertheless
establish a procedure for projecting relevant balance sheet and
BHCs with stronger practices had net interest income projection
RWA categories in support of those revenues and test for the
methodologies that captured adjustments in the amortization of
reasonableness of the implied return on assets (ROA). If a BHC
discounts or premiums for assets held at a value other than par
estimates trading or private equity revenue by tying balance
that would occur under various scenarios. Under FASB State­
changes to changes in broad indices, the BHC should establish
ment No. 91,45 yields would adjust under varying scenarios as
the level of sensitivity of its positions relative to the indices and
amortization schedules change due to changes in expected pay­
not automatically assume a perfect correlation between the two.
ment speeds.
BHCs with mortgage servicing right (MSR) assets should ensure
For pricing, many BHCs assumed a constant spread to a desig­
that delinquency, default, and voluntary prepayment assump­
nated index. BHCs with stronger practices considered whether
tions are robust and scenario-dependent. These models should
this assumption was consistent with historical experience and
capture macroeconomic variables, especially home prices. For
assumed scenario conditions as well as the BHC's strategy as
those BHCs that routinely hedge MSR exposure, hedge assump­
reflected in the balance sheet projections. Some BHCs rec­
tions and results for enterprise-wide scenario analysis should
ognized that new business pricing could differ as a result of
reflect the stress scenario. Some BHCs assumed a perfect or
tightening or widening of spreads and documented these
near-perfect hedge relationship between changes in the value of
assumptions.
their MSR and hedge portfolio, and captured the ineffectiveness
of the hedge under the stress scenario through the net carry,
Non-Interest Income
transaction costs, and/or bid-ask spread components. BHCs with
BHCs are expected to produce stressed projections of non­ stronger practices used an optimization routine that dynamically
interest income that are consistent with assumed scenario rebalanced the hedge portfolio each quarter.
conditions, as well as with stated business strategies. Due to
BHCs with stronger practices considered individual business
inherent challenges in estimating certain non-interest income
models and client profiles when projecting revenue and fee
components, some BHCs used more than one method and/
income from various business activities. BHCs with stronger
or employed benchmark analysis to inform estimates. Stronger
practices also considered capacity constraints when estimating
methodologies estimated non-interest income at a granular-
mortgage loan production and loan sales over the scenario hori­
enough level to capture key risk factors or characteristics
zon, whereas BHCs with weaker practices assumed significant
specific to an activity or product. For example, for asset man­
increases in volume without regard to market saturation or other
agement, many BHCs used different methods to project revenue
factors. Other weaker practices observed included using the
from brokerage activities and fund management activities.
same strategic business assumptions in both the baseline and
Like all aspects of PPNR, internal consistency between non­ stress scenarios and making favorable assumptions around new
interest income and other assumptions such as projected paths business and/or market share gains. For example, some BHCs
for the balance sheet and RWA is important. BHCs should estab­ assumed that all baseline initiatives would be implemented
lish relationships between material components of non-interest in stress scenarios without interruption or changes to the
income and the balance sheet for components that are highly outcomes.
correlated with the path of the balance sheet, such as some
In addition, BHCs with weaker practices did not show sufficiently
kinds of loan-related fee income. BHCs with trading assets
stressed declines in revenue relative to assumed scenario condi­
should document how trading revenue projections are linked to
tions, despite stated correlations to macroeconomic and other

45 Financial Accounting Standards Board, "Accounting for Nonrefund-

able Fees and Costs Associated with Originating or Acquiring Loans
46 See FR Y-14A reporting form: Summary Schedule Instructions, p. 5.
and Initial Direct Costs of Leases—an Amendment of FASB Statements
No. 13, 60, and 65 and a Rescission of FASB Statement No. 17 (Issued 47 12 CFR 225.8(d)(3)(iii); see also FR Y-14A reporting form: Summary
12/86)," FASB Statement No. 91. Schedule Instructions, pp. 5-6.

262 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
drivers. For example, while many BHCs showed significant to evaluate the timing of projected strategies and their impact
declines in credit card gross-interchange fee revenue due to on future revenue, expenses, and operating structure.
declines in consumer spending, some BHCs also assumed that
BHCs with stronger practices had estimation methodologies
significant declines in marketing expenses recorded as contra-
that considered the drivers of individual expense items and the
revenue would more than offset the declines in gross inter­
sensitivity of those drivers to changing scenario conditions and
change revenue, resulting in an increase in net revenue. Other
business strategies. They considered the timing of non-interest
BHCs assumed revenue components, such as fees or trading
expense cuts and recognized that the BHC might not be able
revenue, could not fall below historical levels.
to react to a developing stressful scenario immediately or might
Further, BHCs with weaker practices considered only a very lim­ be subject to existing contractual obligations that could not be
ited set of scenario variables and/or drivers in establishing rela­ altered. BHCs with weaker practices generated non-interest
tionships, which resulted in estimates that appeared inconsistent expense estimates that appeared unrealistic in light of assumed
with the scenario. For example, some BHCs used interest rates scenario conditions. Some BHCs assumed that they could
only to project origination activity or solely used asset balances immediately reduce costs through dramatic cuts in marketing
(instead of the number of accounts) to estimate account fees. and rewards programs, compensation, or other discretionary
Other BHCs simply regressed high-level revenue items against expenses. Projecting sizeable reductions in key expense compo­
scenario factors rather than considering how scenario condi­ nents without providing sufficient support as to the reasonable­
tions would affect the key drivers of those line items (such as ness of the cuts, how management intends to realize the cuts,
volume). For instance, modeling interchange revenues or asset and how the cuts will affect future revenue is not acceptable.
management fees is likely to be less effective than modeling Additionally, such assumptions imply perfect knowledge of
customer spending or assets under management, respectively, the conditions as they unfold, rather than a series of indepen­
given the scenario being used, and then considering fee and/or dent decisions that would be made by management as the
rate movement. scenario unfolds.

Non-Interest Expense
BHCs should fully consider the various impacts of the assumed
14.8 ASSESSING CAPITAL
scenario conditions on their non-interest expense projections, ADEQUACY IMPACT
including costs that are likely to increase during a downturn.
For example, items such as other real estate owned or credit- Balance Sheet and RWAs
collection costs may spike, whereas management may have
BHCs should have a well-documented process for generating
some ability to control other expenses. Like other projections,
projections of the size and composition of on- and off-balance
non-interest expense projections should be consistent with bal­
sheet positions and RWA over the scenario horizon.48 Balance
ance sheet and revenue estimates and should reflect the same
projections are a key input to enterprise-wide scenario analysis
strategic business assumptions. BHCs with weaker practices did
given their direct impact on the estimation of losses, PPNR, and
not account for additional headcount needs in certain areas, nor
RWA. Estimating the evolution of balance sheet size and com­
for any corresponding changes to compensation expense asso­
position under stress integrates many interrelated features. For
ciated with increased collections activity resulting from declines
example, loan balances and the stock of A FS securities at a
in portfolio quality and/or increased underwriting activity to sup­
point in time will depend upon origination, purchase, and sale
port any assumed portfolio growth.
activity from period to period, as well as maturities, prepay­
To the extent the projections assume mitigating actions to offset ments, and defaults. Due to complexities related to dynamically
revenue declines, BHCs should demonstrate that such actions projecting and integrating various components (e.g., origina­
are attainable in the scenario, given assumed asset levels and tions, prepayments and defaults), most BHCs made direct pro­
the resources necessary to support operations. If the projections jections of balances for each major segment of the balance
embed material expense reductions, such assumptions should sheet (e.g., loans, deposits, trading assets and liabilities, and
be supported with analysis of historical data or empirical evi­ other assets) for each quarter of the scenario horizon.
dence and subject to challenge and review. BHCs with weaker
practices assumed mitigating actions consistent with past
actions but failed to consider how differences in the business
environment and the severity of the economic conditions might 48 12 CFR 225.8(d)(2)(i)(A); see also FR Y-14A reporting form: Summary
affect their ability to execute such actions. BHCs are expected Schedule Instructions, p. 6.

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 263

BHCs often faced challenges in integrating the ultimate bal­ changes in scenario variables into risk-parameter estimates that
ance projections with other aspects—for example, borrower drive RWA calculations (e.g., the potential for RWA per dollar of
or depositor behavior. BHCs with stronger practices separately some trading book positions to increase in periods of higher lev­
considered the drivers of change to asset and funding balances, els of general market volatility). Where RWA projections are
such as contractual paydowns, modeled prepayments, nonper­ based on internal risk models, BHCs should not assume any
formance, and new business activity for assets, rather than sim­ RWA reductions from potential data or model enhancements to
ply projecting targeted balances directly. At these BHCs, each RWA calculation methodologies over the projection period. In
element was separately assessed for consistency with scenario all cases, BHCs should document any assumptions made as part
conditions and other management assumptions. BHCs with of the balance sheet and RWA projection process and perform
stronger practices also either directly considered the impact of independent reviews and validations of balance sheet and RWA
these various factors in their balance projections or had proce­ projection methodologies and resulting estim ates.49
dures to evaluate the reasonableness of any implied behavior
by including input from businessline leaders in the process and
iterating to reasonable estimates in a well-supported and trans­
Allowance for Loan and Lease
parent manner. Losses (ALLL)
BHCs should clearly establish and incorporate into their sce­ BHCs should maintain an adequate A LLL along the scenario
nario analysis the relationships among and between revenue, path and at the end of the scenario horizon. Reserve adequacy
expense, and on- and off-balance-sheet items under stressful should be assessed against projected size, composition, and
conditions. Most BHCs used asset-liability management (ALM) risk characteristics of the loan portfolio throughout the scenario
software as a part of their enterprise-wide scenario-analysis horizon. In general, the A LLL build and release should be consis­
toolkit, which helps integrate these items. BHCs that do not use tent with the scenario path, portfolio credit quality, loss recogni­
ALM software must have a process that integrates balance sheet tion approach, loan loss estimates, and loan portfolio balance
projections with revenue, loss, and new business projections. projections (including any portfolio growth assumptions). If
BHCs with more tightly integrated procedures were better able BHCs use estimation approaches that implicitly delay the rec­
to ensure appropriate relationships among the scenario condi­ ognition of losses, such as net charge-off models, they should
tions, losses, expenses, revenue, and balances. adequately build reserves to account for losses not recognized
during the scenario horizon. If the approach relies on top-down
As noted above, BHCs should not rely on favorable assumptions
coverage levels, BHCs should compare coverage ratios and
that cannot be reasonably assured in stress scenarios given the
loss-emergence periods to historical stress environments and
high level of uncertainty around market conditions. Examples
to internal policies and explain the differences if material differ­
of aggressive or favorable balance sheet assumptions include
ences exist.
(1) large changes in asset mix that serve to decrease BHCs' risk
weights and improve post-stress capital ratios but that are not
adequately supported or reflected in PPNR or loss estimates; Aggregation of Projections
(2) "flight-to-quality" assumptions and funding mix changes
that increase deposits and reduce the dollar cost of funding; (3) BHCs should have a well-established and consistently executed

significant balance sheet shrinkage with no consideration of the process for aggregating loss, revenue and expense, and on- and

potential losses associated with reducing positions in periods off-balance sheet and RWA estimates, as part of enterprise-wide

of market stress; and (4) operating margin improvement. BHCs scenario analysis, to assess the post-stress impact of those esti­

that make favorable assumptions should have sufficient evi­ mates on capital ratios. BHCs that are more effective at imple­

dence that they can be reasonably assured in the assumed stress menting such a process have established centralized groups

scenario. with responsibility for

BHCs' RWA projections should be based on corresponding pro­ • combining loss, revenue, balance sheet, and RWA

jections of on- and off-balance-sheet exposures and their risk projections;

attributes and should be consistent with the severity of the • providing strong governance and controls around the
stress conditions under each scenario. For general credit-risk process;
exposures, BHCs should project balances for material asset cat­
egories with sufficient granularity to facilitate application of reg­
ulatory risk-weighting approaches associated with different asset
categories. For trading exposures, BHCs should translate 49 See id.

264 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• ensuring coherence of component estimates and aggregate BHCs with weaker practices had limited or no reconciliation
results; and procedures or other controls in place to ensure the integrity,
• applying and documenting any adjustments.50 completeness, and accuracy of the consolidated post-stress
capital metrics. BHCs with weaker practices also had no process
These centralized groups have been able to source estimates from
to ensure consistency in the BHC-wide application of scenario
a range of internal parties involved in enterprise-wide scenario
assumptions and management adjustments, and had weak gov­
analysis and develop consolidated pro forma financial results that
ernance and documentation standards.
are internally consistent and conform to accounting standards.

BHCs should develop a governance structure around the

enterprise-wide scenario analysis process that provides for a 14.9 CONCLUDING OBSERVATIONS
robust analysis and challenge of the coherence of the aggregate
results and determine whether any adjustments need to be The goal of this publication is to outline the Federal Reserve's
made based on the analysis. In particular, BHCs should assess expectations for internal capital planning at large BHCs and to
whether the paths of individual loss and revenue components highlight the range of current practice as observed during the
are consistent with the paths of balance sheet and RWA esti­ 2013 C C A R. This discussion is intended to provide a more com­
mates and the overall scenario path. For example, an increase prehensive set of criteria to assist BHC management in assess­
in PPNR amid declining balances would appear generally ing their current capital planning processes and in designing and
inconsistent and should warrant further investigation. In assess­ implementing improvements to those processes, as well as to
ing consolidated financial results, BHCs should account for any provide insight to a broader audience about the key aspects of
potential changes in relationships between losses and financial BHCs' capital planning practices.
performance drivers during periods of stress. Internal capital planning practices have evolved considerably
BHCs should have good understanding of instances when expo­ since the financial crisis and the implementation of the Federal
sures with similar underlying risk characteristics that are part of Reserve's Capital Plan Rule in 2011. BHCs have made advances
different portfolios or business lines exhibit different sensitivities in the identification and measurement of the risks to their capital
to scenario conditions. BHCs should identify instances where and in the integration of stress testing and capital planning into
the differences are due to inconsistent assumptions or model­ their broader strategic planning processes. The fundamental
ing approaches that require management attention, rather insight governing the Federal Reserve's expectations about capi­
than differences in accounting treatment. In addition, if a BHC's tal planning is the importance of having a forward-looking per­
enterprise-wide scenario analysis results in post-stress outcomes spective on the risks to a BHC's capital resources under severely
that are more favorable than those under baseline conditions, stressful conditions. In particular, a forward-looking perspective
BHCs should critically evaluate the reasonableness and consis­ involves understanding how a BHC's revenue-generating capac­
tency of assumptions across portfolios, business lines, and other ity and potential losses could be affected in stressed economic
areas of loss and revenue estimation. and financial market conditions; understanding the particular
vulnerabilities arising from its business model and activities; and
BHCs that had an effective aggregation process leveraged their
having a capital policy in place that governs the BHC's capital
business planning and financial and regulatory reporting systems
actions under both "normal" and stressed economic conditions.
as part of that process. Using standalone tools or spreadsheets
These elements represent substantial conceptual and opera­
in the aggregation process is a weak process. If a BHC needs to
tional improvements in capital planning that go well beyond sim­
use standalone tools or spreadsheets due to systems limitation,
ple consideration of current and expected future capital ratios.
management should ensure robust controls are in place, includ­
ing access and change controls, and should maintain an audit While many of the large BHCs subject to the Capital Plan Rule
trail and document all approvals for any adjustments made. have made substantial improvements in capital planning, there
BHCs should also have reconciliation procedures and data qual­ is still considerable room for advancement across a number of
ity and logic checks in place to ensure that the results from the dimensions. Areas where some BHCs continue to fall short of
enterprise-wide scenario analysis reconcile to both management leading practice include
reporting and regulatory reports, with a transparent mapping • not being able to show how all their risks were accounted for
between various reporting taxonomies. in their capital planning processes;
• using stress scenarios and modeling techniques that did not
address the particular vulnerabilities of the BHC's business
50 See id. model and activities;

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 265

• generating projections for at least some components of loss, All the BHCs that participated in CCA R faced challenges across
revenue, or expenses using approaches that were not robust, one or more of these areas. And although many BHCs demon­
transparent, and/or repeatable, or that did not fully capture strated leading practices in several dimensions of capital plan­
the impact of stressed conditions; ning, the leading capital planning practices identified in this
• having capital policies that did not clearly articulate a BHC's paper will continue to evolve as new data become available,
capital goals and targets, did not provide analytical sup­ economic conditions change, new products and businesses
port for how these goals and targets were determined to introduce new risks, and estimation techniques advance fur­
be appropriate, and/or were not comprehensive or detailed ther. As the frontier of capital planning practice advances, the
enough to provide clear guidance about how the BHC would Federal Reserve's expectations for how BHCs implement the
respond as its capital position changed in different economic requirements of the Capital Plan Rule and the related company-
circumstances; and run stress testing required under the Dodd-Frank Act will
also evolve.51 Such advances in capital planning practices will
• having less-than-robust governance or controls around the
enhance the health and stability of individual BHCs and of the
capital planning process, including around fundamental risk-
overall banking system.
identification, -measurement, and -management practices
that are among the critical elements that support robust capi­
tal planning.

51 12 CFR part 252, subpart G.

266 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Stress Testing
Banks
Learning Objectives
After completing this reading you should be able to:

Describe the evolution of the stress testing process Explain challenges in modeling a bank's revenues, losses,
and compare the methodologies of historical European and its balance sheet over a stress test horizon period.
Banking Association (EBA), Comprehensive Capital
Analysis and Review (CCAR), and Supervisory Capital
Assessment Program (SCAP) stress tests.

Explain challenges in designing stress test scenarios,

including the problem of coherence in modeling risk
factors.

E x c e rp t b y Til Schuerm ann is rep rin ted from the International Journal of Forecasting 30, no. 3, (2014) p p . 717-728.

267
ABSTRACT and Basel 1 (Wachovia), the OTS (WaMu), and O FH EO (Fannie and
Freddie)—the last actually based on a narrow stress scenario. All
How much capital and liquidity does a bank need to support its firms had a broad exposure to residential real estate assets, in the
risk taking activities? During the recent (and still ongoing) finan­ form of either whole loans (mortgages) or securities (MBS), or
cial crisis, answers to this question using standard approaches, both, and all had internal risk models which may or may not have
e.g., regulatory capital ratios, were no longer credible, and thus deviated materially from the regulatory models (we do not know
broad-based supervisory stress testing became the new tool. this, as it is/was firm proprietary information).3 Yet the answer to
Bank balance sheets are notoriously opaque and susceptible to the question of what is the capital you need vs. the capital you
asset substitution (easy swapping of high risk for low risk assets), have came out wrong in each case. Of course, neither firm-internal
so stress tests, tailored to the situation at hand, can provide clarity (economic) nor regulatory capital and liquidity models can guaran­
by openly disclosing details of the results and approaches taken, tee failure prevention; indeed, that is not their purpose, as every
allowing trust to be regained. With that trust re-established, the firm accepts some probability of failure, sized by its risk appetite.
cost-benefit of stress testing disclosures may tip away from bank- Nevertheless, the cascading of defaults, and the resulting deep
specific towards more aggregated information. This paper lays skepticism of the market's stated capital adequacy, forced regula­
out a framework for the stress testing of banks: why it is useful tors to turn to a new tool for assessing the capital adequacy of
and why it has become such a popular tool for the regulatory banks in a credible way. That tool turned out to be stress testing.4
community in the course of the recent financial crisis; how stress This paper lays out a framework for the stress testing of banks:
testing is done (design and execution); and finally, with stress test­ why it is useful and why it has become such a popular tool for
ing results in hand, how one should handle their disclosure, and the regulatory community in the course of the recent financial
whether it should be different in crisis vs. "normal" times. crisis; how stress testing is done (design and execution); and
finally, with stress testing results in hand, how one should handle
their disclosure, and whether it should be different in crisis vs.
15.1 INTRODUCTION "normal" times. The framework is equally applicable to capital
and liquidity adequacy, but for the sake of simplicity, the bulk of
There are three kinds of capital and liquidity: (1) the capital/liquid- the discussion will focus on capital.
ity you have; (2) the capital/liquidity you need (to support your
business activities); and (3) the capital/liquidity the regulators A successful macro-prudential stress testing program, particu­

think that you need.1 Stress testing, regulatory capital/liquidity larly in a crisis, has at least two components: first, a credible

and bank-internal (so-called "economic capital/liquidity") models assessment of the capital strength of the tested institutions, to

all seek to do the same thing: to assess the amount of capital and size the capital "hole" that needs to be filled, and second, a
liquidity which is needed to support the business activities of the credible way of filling that hole. The US bank stress test in 2009,

financial institution. Capital adequacy addresses the right side of the Supervisory Capital Assessment Program or SCAP, may

the balance sheet (net worth), and liquidity the left side (share of serve as a useful example. The US entered 2009 with an enor­

assets that are "liquid", however defined). If all goes well, both mous uncertainty about the health of its banking system. In the

the economic and regulatory capital/liquidity are less than the absence of a more concrete and credible understanding of the

required regulatory minimum, and their difference (between eco­ problems with bank balance sheets, investors were reluctant to

nomic and regulatory) is small, that is, regulatory models do not commit capital, especially given the looming threat of possible

deviate substantially from the results of internal models. government dilution. With a credible assessment of losses under
a sufficiently stressful macroeconomic scenario, the supervisors
Prior to their failure or near-failure, financial institutions such as
hoped to draw a line in the sand for the markets: fill this hole,
Bear Stearns, Washington Mutual, Fannie Mae, Freddie Mac,
and you won't risk being diluted later because the scenario
Lehman and Wachovia were adequately or even well capitalized,
wasn't tough enough. Moreover, if some institutions could not
at least according to the regulatory capital rules disclosed in their
public filings.2 This set of institutions spans a broad range of regu­
latory capital regimes and regulators: the SEC and Basel 2 capital 3 Lester, Reynolds, Schuermann, and Walsh (2012) report that, out
of 16 banks (US and non-US) that publicly disclosed their economic
rules (Bear Stearns, Lehman), the O CC and the Federal Reserve
capital before the crisis, four actually experienced losses exceeding
those requirements, all of which were calibrated to at least the 99.9%
level (implying an acceptable annual default probability of no more
1 This pithy summary I owe to Peter Nakada. than 10bp).
2 Kuritzkes and Scott (2009) make the case for a more market-oriented 4 Flannery (2012) argues that stress tests should be evaluated on a fair
assessment of capital adequacy. value (rather than book capital) basis.

268 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
convince investors to fill the hole, a US government program, At first glance, the results of the 2011 EBA stress test of 90
namely the Treasury's Capital Assistance Program (CAP), stood banks in 21 countries were mild, similar to the previous year's.9
ready to supply the required capital. Importantly, the US Trea­ Eight banks were required to raise a total of only €2.5 bn.
sury was a sufficiently credible debt issuer that the CAP promise However, the degree of disclosure was much more extensive,
was itself credible.5 All banks with assets greater than $100 bn approaching the high bar set by the Central Bank of Ireland in
(YE 2008) were included, accounting for two-thirds of the total March 2011, including information on exposure by asset class
assets and about half of the total loans in the US banking sys­ by geography. Importantly, all bank level results were available
tem. In the end, ten of the 19 SCAP banks were required to to download in spreadsheet form, to enable market analysts to
raise a total of $75 bn in capital within six months, and indeed easily impose their own loss rate assumptions. In this way, the
raised $77 bn of Tier 1 common equity in that period.6 None "official" results were no longer so final: analysts could (and
needed to draw on CAP funds. did) easily apply their own sovereign haircuts on all exposures,
and thus test the solvency of any of the 90 institutions
The European experience in 2010 and 2011 stands in stark con­
themselves.
trast to the 2009 SCAP. Against the background of a looming
sovereign debt crisis in the peripheral eurozone countries, the In an uncomfortable parallel to the Irish experience in 2010, the
Committee of European Bank Supervisors (CEBS) conducted a 2011 EBA stress test did nothing to alleviate concerns about the
stress test of 91 European banks in 2010, covering about two- Spanish banking system. Five of the 25 Spanish banks in the
thirds of the total European bank assets and at least half of that EBA stress test did not pass, though once provisions and man­
in any given participating country. The stress test included impos­ datory bond conversions (to equity) were taken into account,
ing haircuts on the market value of sovereign bonds held in the the required additional capital raise was €0. By the spring of
trading book; however, the bulk of the sovereign exposure was 2012, Spain was engaged in or had announced several addi­
(and is) in the banking book. O f the 91 banks, only seven were tional stress tests. First was the IMF's Financial Sector Assess­
required to raise a total of €3.5 bn (<$5 bn at the time) in capital. ment Program (FSAP), conducted jointly with the Banco de
The level of disclosure provided was rather less than in the SCAP. Espana. The results of this were released on June 8, 2012,101
For instance, loss rates by firm were only made available for two with 11 of the 29 banks requiring a total of €17.7 bn capital
sub-categories: overall retail and overall corporate.7 By contrast, using a post-stress hurdle similar to that of the SCAP (4% core
the SCAP results released loss rates by major asset class such as Tier 1 capital), or 17 banks requiring a total of €37.1 bn using
first-lien mortgages, credit cards, commercial real estate, and so the higher hurdle of 7% core Tier 1 capital.11 Second was a short
on. Markets reacted benignly nonetheless— until a few months (4-week) top-down exercise conducted by two outside advisers
later, when Ireland requested financial assistance from the EU and (working in parallel to provide, ostensibly, two further indepen­
the IMF. Subsequent stress tests of just the Irish banks, con­ dent assessments), and those results were released on June 21,
ducted largely by outside independent advisors (Black-Rock) 2012. No firm-specific results were provided, only an overall
revealed a total capital need of €24 bn; all of these banks had capital need. The first estimate, provided by Roland Berqer, was
previously passed the CEBS stress test. Moreover, to help close €51.8 bn, while Oliver Wyman provided a range of €51-62 bn.12
the credibility gap, the extent and degree of disclosure was far A more detailed and intensive bottom-up analysis by Oliver
greater than in any of the stress testing exercises to date.8 The Wyman followed, with results released on September 28, 2012,
markets reacted favorably, with both bank and Irish sovereign showing that 7 of 14 the banking groups needed a total of
credit spreads tightening. The stakes for the 2011 European €57.3 bn using the post-stress core Tier 1 threshold of 6%;
stress test, now conducted by the successor to the C EBS— the
European Banking Authority (EBA)— had risen substantially.

9 http://www.eba.europa.eu/EU-wide-stress-testing/2011/2011 -EU-wide-
stress-test-results.aspx.
5 Note that the act of a sovereign recapitalizing its banks involves that
10 http://www.imf.org/external/pubs/ft/scr/2012/cr12137.pdf.
sovereign issuing debt and then investing ("downstreaming") it as equity
in the bank(s). 11 Most European exercises have tested to a post-stress hurdle of 6%
core Tier 1; see the discussion in Section 3.
6 http://www.federalreserve.gov/bankinforeg/scap.htm.
12 Roland Berger: http://www.bde.es/webbde/GAP/Secciones/
7 http://www.eba.europa.eu/EU-wide-stress-testing/2010/2010-EU-wide-
SalaPrensa/Informacionlnteres/ReestructuracionSectorFinanciero/
stress-test-results.aspx.
Ficheros/en/informe_rolandbergere.pdf; Oliver Wyman: http://www
8 http://www.centralbank.ie/regulation/industry-sectors/credit-institutions/ .bde.es/webbde/GAP/Secciones/SalaPrensa/lnformacionlnteres/
Documents/The%20Financial%20Measures%20Programme%20Report ReestructuracionSectorFinanciero/Ficheros/en/informe_oliverwymane
.pdf. .pdf.

Chapter 15 Stress Testing Banks ■ 269

Table 15.1 Summary of Disclosures Across Stress Test Exercises

Exposure detail Bank vs.

Base and stress Bank level Asset/product (asset class, maturity, supervisory/3rd
scenario results level loss rates geography) party estimates

SCAP Stress / / — —

March 2009

CEBS Both / Retail, all — —

corporate only
July 2010

CCAR — — — — —

March 2011

Ireland Both / / Sovereign only /

March 2011

EBA Both / Retail, corporate, High —

CRE
July 2011

CCAR Stress / / — —

March 2012
Spain (IMF) Both — —
Asset class (aggregate) —

June 8, 2012

Spain (top-down) Both —

/ Asset class (aggregate) —

June 21, 2012

Spain (bottom-up) Both / / Asset class (aggregate) —

Sept. 28, 2012

merger activity had resulted in a significant reduction in inde­ Table 15.2 F e a tu re s of S tre ss Testing, Pre- and
pendent banking entities.13 P o st-S C A P

A summary of the major macro-prudential stress tests to date Pre-SCAP Post-SCAP

is provided in Table 15.3, and a summary of their disclosures is
• Mostly single shock • Broad macro scenario and
given in Table 15.1.
• Product or business market stress
The SCAP was the first of the macro-prudential stress tests of this unit level • Comprehensive, firm-wide
crisis, but the changes at the micro-prudential or bank-specific • Static • Dynamic and path dependent
• Not usually tied to • Explicit post-stress common
level were at least equally significant, and they are summarized
capital adequacy equity threshold
in Table 15.2. With the SCAP, stress testing at banks went from
• Losses only • Losses, revenues and costs
mostly single factor shocks (or a handful) to using a broad macro
scenario with market-wide stresses; from product or business
unit stress testing, focusing mostly on losses, to firm-wide and
a discussion of how to design the stress scenario, includ­
comprehensive testing, encompassing losses, revenues and costs;
ing the choice of a post-stress capital hurdle. Section 4
and with all of these tied to a post-stress capital ratio to ensure a
d escribes m odeling approaches for the three com ponents
going concern.
needed to im plem ent stress testin g : losses, net revenues
The rem ainder of the paper proceeds as follow s. Section 2 (profitability), and balance sheet dynam ics. Section 5 reviews
briefly review s the scant literature, and Section 3 provides the disclosure regim es across the different stress tests to
date in more detail, and presents a discussion of disclosure
13 http://www.bde.eS/f/webbde/SSICOM/20120928/informe_ow280912e in "norm al" tim es, after which Section 6 provides some con­
.pdf. cluding rem arks.

270 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Table 15.3a Summary of Macroprudential Stress Tests to Date

Risk types included:

# of Total required market, credit,
Target capital participating Participation criteria (total Balance sheet capital raise (for liquidity (funding),
ratio3 banks coverage) assumptions # of banks) operational

SCAP • 4% T1C 19 • All bank holding compa­ Constant RWA $75 bn (19) Mb, C
• 6% T1 nies with at least $100 bn
March 2009
total assets
• (~2/3 of total banking
assets)

C EBS • 6% T1 91 (20 countries) • Largest banks in country Constant total €3.5 bn (7) M, C
until at least 50% of total assets
July 2010
assets are included
• (~2/3 of total banking
assets)

CCAR • 5% T1C 19 • Original SCAP-19 None M, C

March 2011

Ireland • 6% T1C 4 • Largest banks not in wind- Allowed for balance €24 bn (4) M, C, L, O
• 10.5% T1C down mode sheet shrinkage
March 2011
(in base)

EBA • 5% T1C 90 (21 countries) • Largest banks in country Constant total €2.5 bn (8) M, C, Lc, O
until at least 50% of total assets
July 2011
Chapter 15 Stress Testing Banks

assets are included

• (~2/3 oftotal banking
assets)

CCAR • 5% T1C 19 • SCAP-19 None __ d M, C, O

• 4% T1; 8% Total; • An additional 11 BHCs
March 2012
3%-4% leverage with assets > $50 bn

a T1: Tier 1 capital ratio; T1C: Tier 1 common (or core) capital ratio.
b Only banks with at least $100 bn in trading assets were required to conduct the market risk stress test.
c Liquidity risk was not assessed directly, though funding stresses were taken into account, especially as they related to sovereign stress impacting the funding costs for financia
institutions.
Four of the 19 did not pass, in the sense of not having gained non-objection to their submitted capital plans.
■ 271
Table 15.3b Summary of Macroprudential Stress Tests to Date—Spain 2012

Risk types
included:
market, credit,
# of Balance Total required liquidity
Target participating Participation criteria sheet capital raise (for (funding),
capital ratio3 banksb (total coverage) assumptions # of banks) operational

IMF • 7% T1C 29 • Large and medium Deleveraging • €37.1 (17) C, L

banks and cajas, under 7% T1C
June 8, 2012
together making
up -9 0 % of total
bank assets

Top-down • 9% T1C 14 entities • Large and medium Deleveraging • €16-25 [base] C, L

[base] banks and cajas, • €51-62 [stress]
June 21, 2012
• 6% T1C together making
[stress] up -9 0 % of total
bank assets

Bottom-up • 9% T1C 14 entities • Large and medium Deleveraging • €24.1 (5) [base] C, L
[base] banks and cajas, • €57.3 (7) [stress]
Sept. 28, 2012
• 6% T1C together making
[stress] up -9 0 % of total
bank assets

a T1:Tier1 capital ratio; T1C: Tier 1 common (or core) capital ratio.
b The 14 entities are the result of mergers.

15.2 STRESS TESTING IN THE Risk management as a technical discipline came into its own with
the publication of the RiskMetrics technical document in 1994,
LITERATURE and stress testing (of both kinds, sensitivities and scenarios) is
mentioned throughout. The first edition of Jorion's
Stress testing has been part of the risk manager's toolkit for a
standard-setting VaR book (Jorion, 1996) had a subsection
long tim e. It is perhaps the most basic of risk-based questions
devoted to the topic (which was elevated to a chapter in subse­
to want to know the resilience of an exposure to deteriorating
quent editions), and there must surely be earlier examples. Stress
conditions, be it a single position or loan or a whole portfolio.
testing as a risk management discipline was found largely in the
Typically, the stresses take the form of sensitivities (spreads
relatively data rich environment of the trading room, with the
double, prices drop, volatilities rise) or scenarios (black
closely related treasury function of conducting interest rate sce­
Monday 1987, autumn of 1998, post- Lehman bankruptcy,
narios and shocks.14 The Committee on Global Financial Systems
severe recession, stagflation). These types of stresses lend
(CGFS) of the BIS conducted a survey on stress testing in 2001,
them selves naturally to understanding financial risks, particu­
and it reinforces this view.15 In their summary of the CG FS report,
larly in a data rich environment such as that found in a trading
Fender et al. (2001) point out that most of the scenarios involve
operation. Nonfinancial risks, such as operational, reputational
shocks to market rates, prices or volatilities. Typical examples are
and other business risks, are much harder to quantify and
equity market crashes such as October 1987, rates shocks such
param eterize yet rely heavily on scenario analysis (earthquakes
as 1994, credit spread widening such as during the fall of 1998,
and other natural disasters, com puter hacking, legal risks, and
and so on. Such stress scenarios have the virtue of being
so on). W hile the original Basel I Accord of 1988 did not make
any formal mention of stress testing, it merited its own sec­
tion in the Market Risk Am endm ent of 1995, and thus became 14 See Berkowitz (2000) and Kupiec (1998) for more extensive discus­
em bedded in the regulatory codex. Indeed, evidence of stress sions of VaR-based stress testing.
testing capabilities is a requirem ent for regulatory approval of 15 See CGFS (2001) and the summary of its principal findings by Fender,
internal models. Gibson, and Mosser (2001).

272 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
unambiguously articulated and defined, and are thus transparent and implementation of their stress tests. Brian Peters, then head of
and easy to implement and communicate, at least on assets that risk in bank supervision at the New York Fed, observed at an indus­
have themselves natural market prices or analogs, as is mostly try conference in March 2007 that no firm had a fully-developed
the case in the trading book. More typical banking assets, such program of integrated stress testing that captured all major finan­
as corporate loans (especially to privately held firms) and con­ cial risks on a firmwide basis.19 Market risk stress tests were most
sumer loans (e.g. auto loans), are less naturally amenable to this advanced, while corporate or enterprise-wide stress testing,
approach. whereby all businesses were subjected to a common set of stress
scenarios, was in a developmental phase at best.
Formal stress testing of the banking book, which is dominated by
credit risk, is more recent, partly because quantitative credit risk
modeling is itself a newer discipline.16 Perhaps stimulated by the
success of RiskMetrics, the late 1990s saw a spurt of activity in the
15.3 STRESS TESTING DESIGN
development of credit portfolio models, with the two most promi­
Perhaps the most fundamental choice in stress testing design is the
nent examples being CreditMetrics (Gupton, Finger, & Bhatia,
risk appetite of the authorities: how severe and how long the stress
1997) and CreditRisk+ (Wilde, 1997).17 However, stress testing
scenario should be, and what the post-stress hurdle is. To take a
did not feature in these papers. At the same time, as Koyluoglu
sailing analogy: how severe and how long is the storm, and how
and Hickman (1998) show quite clearly, all of these credit portfolio
solid does the boat still need to be once the storm has passed? In
models share a common framework of mapping outcomes in the
stark contrast to standard capital regimes, the target calibration is
real economy, often represented by an abstract state vector, to
not strict solvency (i.e., just enough capital to have a positive net
the credit loss distribution, and thus, they should lend themselves
worth), but rather some notion of adequate capitalization p o st­
naturally to stress testing. With that in mind, Bangia, Diebold, Kro-
stress. For instance, the 2009 SCAP in the US presented a two-year
nimus, Schagen, and Schuermann (2002), broadly following the
scenario with a post-stress hurdle of 4% Tier 1 common capital. The
CreditMetrics framework, show how to use credit migration matri­
2012 bottom-up Spanish stress test used a three-year scenario with
ces to conduct macroeconomic stress tests on credit portfolios.
a post-stress hurdle of 6% core Tier 1 capital, suggesting a lower
Foglia (2008) provides a survey of the literature (at least through
risk appetite by the Spanish authorities than by the American.
to late 2008) of stress testing credit risk, both for individual banks
or portfolios and for banking systems. More recently, Rebonato While length and post-stress hurdles are easy to compare across
(2010), with his suggestively titled book C oherent stress testing macro-prudential stress tests, scenario severity is not. Authori­
(we return to the problem of coherence below), argues for a ties are reluctant to make statements like "a 1 in 100 scenario"
Bayesian approach to financial stress testing, i.e., one which is which would allow such comparisons, in part because such a
able to formally include expert knowledge in the stress testing statement is very difficult to make credibly. In its stress testing
design, with an emphasis on exploring causal relationships using program, the Federal Reserve makes available time series of
Bayesian networks. relevant variables to allow users to assess the severity of a given
scenario, at least for those variables.20 O f course, a multivariate
With few exceptions, regulatory requirements for stress testing
assessment is much more difficult.
were thin prior to the crisis, though considerable expectations of
stress testing capabilities were voiced in supervisory guidance in Once the risk appetite has been established, one of the principal
the US. Examples include the Joint Policy Statement on Interest Rate challenges faced by both the supervisors and the firms when
Risk (SR 96-13), guidance on counterparty credit risk (SR 99-0318), designing stress scenarios is coherence. The scenarios are inher­
and country risk management (SR 02-05). However, banks had a ently multi-factor: we are seeking to develop a rich description of
significant degree of discretion with regard to the specific design adverse states of the world in the form of several risk factors, be
they financial or real, taking on extreme yet coherent (or possi­
ble) values. It is not sufficient to specify only high unemployment
or only a significant widening of credit spreads or only a sudden
16 Of course, the credit rating agencies, having been in the business
of rating corporate bonds for nearly a century, probably employ stress drop in equity prices; when one risk factor moves significantly,
testing in their bond rating methodology, but old documentation to this
effect is hard to come by.
17 For an excellent overview and comparison of these and related mod­
els, see Koyluoglu and Hickman (1998). 19 Presentation delivered at Marcus Evans conference "Implement­
ing stress tests into the risk management process", Washington DC,
18 The most recent guidance on counterparty credit risk, SR 11-10, has
March 1-2, 2007.
greatly expanded on stress testing expectations. All SR letters can be
found at http://www.federalreserve.gov/bankinforeg/srletters/srletters.htm. 20 See http://www.federalreserve.gov/bankinforeg/bcreg20121115a3.xlsx.

Chapter 15 Stress Testing Banks ■ 273

the others move too. The real difficulty is in specifying a coher­ economists at the ECB with reference to the EU Commission
ent joint outcome of all of the relevant risk factors. For instance, baseline economic forecast.
not all exchange rates can depreciate at once; some have to
All supervisory stress tests to date have imposed the same sce­
appreciate. A high inflation scenario needs to account for likely
nario on all banks. Naturally, any scenario may be more severe for
monetary policy responses, such as an increase in the policy
some banks and much less so for others, depending on the busi­
interest rate. Every market shock scenario resulting in a flight
ness mix and geographic footprint. This one-size-fits-all approach
from risky assets— "flight to quality"— must have a (usually small)
is analogous to the problem of regulatory vs. internal economic
set of assets that can be considered safe havens. These are typi­
capital models: the former is the same for all banks by design,
cally government bonds from the safest sovereigns (e.g., the US,
while the latter, being limited to a given bank, takes the particular
Japan, Germany, Switzerland). O f course, as sovereign govern­
business mix of that bank into account directly. This problem of
ment budgets are increasingly strained, questioning the ultra-low
same vs. specific stress scenarios becomes especially acute when
risk assumption of such treasury instruments would certainly be a
we move from crisis times, when there may be less debate about
worthwhile stress scenario, but it would need to define an alter­
what a relevant adverse scenario might look like, to "normal"
native "risk-free" asset class to which capital can flee.
times. The US CCAR program, which has been in operation since
While the problem of coherence is generic to scenario design, it is 2011, recognized this problem and asks banks to submit results
especially acute when considering stress scenarios for market risk, using their own scenarios (baseline and stress) in addition to results
i.e., for portfolios of traded securities and derivatives. These port­ under the common supervisory stress scenario. This was an impor­
folios are typically marked to market as a matter of course, and risk tant step forward from the 2009 SCAP: by asking banks to develop
managed in the context of a value-at-risk (VaR) system. In practice, their own stress scenario(s), thus revealing the particular sensitivi­
this means that the hundreds of thousands (or more) of positions in ties and vulnerabilities of their specific portfolio and business mix,
the trading book are mapped to tens of thousands of risk factors, supervisors could learn what the banks themselves thought to be
which are tracked on a (usually) daily basis and form the "data" the high risk scenarios. This is useful not just for micro-prudential
used to estimate risk parameters like volatilities and correlations. supervision— learning about the risk of a given bank— but also
Finding coherent outcomes in such a high dimensional space, for macro-prudential supervision, by allowing for the possibility
short of resorting to historical realizations, is daunting indeed. of learning about common risks across banks which may hitherto
have been undiscovered or under-emphasized. With this dual
Compounding the problem is the challenge of finding a scenario
approach, supervisors could compare results across banks from the
in which the real and financial factors are jointly coherent. The
common scenario directly, without sacrificing risk-discovery.
2009 SCAP had a rather simple scenario specification. The state
space had only three dimensions— GDP growth, unemployment,
and the house price index (HPI)— and the market risk scenario was
based in historical experience: an instantaneous risk factor impact
15.4 EXECUTING THE STRESS
reflecting changes from June 30 to December 31, 2008. This SCENARIO: LOSSES AND REVENUES
period represented a massive flight to quality, with the markets
experiencing the failure of at least one global financial institution With the macro-scenario in hand, how does one arrive at the

(Lehman), and risk premia at the time arguably placed a signifi­ corresponding micro-outcomes: losses and revenues under

cant probability on the kind of adverse real economic outcome adverse market and macroeconomic conditions? To date, there

painted by the tri-variate SCAP scenario. This solution achieved has been very little discussion in the public domain on how to

a loose coherence of the real and financial stresses. However, the solve this problem, except perhaps for stress testing the trading

price that one pays for choosing a historical scenario is the usual book. Indeed, one of the more important contributions of the

one: it does not test for anything new. Figures 15.3 and 15.4 com­ supervisory stress tests in the US and Europe has been the

pare some of these risk factors (real GDP, unemployment, equity accompanying methodology documents that have been dis­

and home prices indices) across the four US stress tests to date, closed by the supervisors, which are, understandably, more

both to each other and to actual realizations since 2008 Q4. heavily focused on the banking book.21

For the 2011 EBA test, the supervisors specified over 70 risk
factors for the trading book, eight macro-factors for each of
21 For SCAP, see http://www.federalreserve.gov/bankinforeg/
21 countries (macro-factors such as GDP growth, inflation, bcreg20090424a1.pdf. For EBA, see http://www.eba.europa
unemployment, real estate price indices, both residential and .eu/EU-wide-stress-testing/2011/The-EBA-publishes-details-of-it
commercial, short and long term government rates, and stock s-stress-test-scena.aspx. For the 2011 and 2012 CCAR, see http://
www.federalreserve.gov/newsevents/press/bcreg/bcreg20110318a 1
prices), plus sovereign haircuts across seven maturity buck­ .pdf and http://www.federalreserve.gov/newsevents/press/bcreg/
ets. The macroeconomic stress scenario was generated by bcreg20120313a1 .pdf respectively.

274 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Modeling Losses provided on stressed probabilities of default (PDs) and stressed
LGDs. Note that such guidance presumes that a bank has imple­
For a firm which is active in many markets (product and geogra­ mented an internal credit rating system for its commercial loan
phy), the first task is to map from the few macro-factors to the portfolio. For a Basel II bank this may not be unreasonable, since
many intermediate risk factors that drive losses for particular internal ratings, mapped to a common external scale such as
products by geography. The EBA was forced to confront the those used by the rating agencies, are a cornerstone of the
problem of geographic heterogeneity directly, since it spans 21 Accord. With a credit rating (internal or external) in hand, com­
sovereign nations with rather different economies. US supervisors, puting stressed default rates for the portfolio becomes a straight­
in stress testing an economic region only slightly smaller than that forward exercise, either by assigning higher PDs to a given rating,
of the EBA, left the task of accounting for the not-inconsiderable or by imposing a downward migration on the current portfolio.22
geographic heterogeneity to individual firms. Regional differences Since the EBA stress test was based on risk weighted assets
are critical in modeling losses for real estate lending (residential (RWA) computed using Basel II risk weights, which are ratings
and commercial), but are hardly limited to those products. Since sensitive, banks were forced to make use of stress migration
the US experiences regional business cycles—the national busi­ matrices to compute not only increased defaults (the last column
ness cycle obscures a considerable degree of variation across of the matrix), but also the entire future ratings distribution, to
states— nearly all lending has some geographic component. For arrive at the correct RWA value. The US stress tests were con­
example, credit card losses are especially sensitive to unemploy­ ducted under Basel I risk weights, which are not obligor ratings
ment, and in July 2011, with the national rate at 9.1%, the state- sensitive. The fuss about RWA calculations is important, since the
level unemployment rate ranged from 3.3% in North Dakota to denominator of capital ratios, used to determine whether or not
12.9% in Nevada. Similar dynamics are at work in wholesale lend­ a bank needs to raise capital, is RWA. Clearly, this complicates
ing, particularly for SME (small and medium enterprise) lending, any comparison of US and European stress test results.
whose performance has a strong geographic component.
Implementation in the trading book is more straightforward, and
The problem of mapping from macro to more intermediate risk has been discussed extensively in the public domain; see inter
factors is not limited to geography. An interesting example is alia Allen, Boudoukh, and Saunders (2004), Jorion (2007), or
auto lending and leasing, where the collateral assets are used Rebonato (2010). In a nutshell, existing positions are simply
cars. While auto sales invariable decline during a recession, and repriced using the stress scenario risk factors, subject to the pro­
the decline in 2008-2009 was unprecedented in the post-war viso that the risk factor mapping problem, discussed in Section 3,
period, used car sales typically suffer less. Yes, households buy has been solved. The corresponding problem of stressing the
fewer cars in a recession, but if they do need to purchase a counterparty credit risk that comes with the activities of deriva­
car, it is relatively more likely to be a used car. Thus, even if the tives has received less attention.23 Counterparty credit risk arises
default rate on auto loans increases significantly during a reces­ when, in a derivative transaction which is revalued to the stress
sion, the corresponding loss given default (LGD) or loss severity scenario, the bank finds itself in the money (i.e., enjoys a deriva­
need not. A useful indicator of the health of the used car mar­ tive receivable), but cannot be sure that the counterparty to the
ket, and thus the collateral of an auto lending portfolio, is the transaction will be solvent in order to make good on the pay­
Manheim index. Over the course of the most recent recession ment. Thus, the value is discounted, where the discount is a func­
(Dec. 2007-June 2009), the index rose 4%, while total new auto tion of the expected default likelihood of the counterparty under
and light truck sales declined by 37%. the stress scenario, which is presumably higher than today. This

The problem of loose coupling of the loss severity to the busi­ adjustment is called a credit value adjustment (CVA), and banks

ness cycle is not limited to auto loans. Acharya, Bharath, and with significant derivative activities manage CVA as a matter of

Srinivasan (2007) show that for corporate credit, an important course. As Canabarro (2010) and Hopper (2010) point out, the

determinant of LGD is whether the industry of the defaulted modeling challenge of stress testing counterparty credit risk is

firm is in distress at the time of default. The authors make a considerable. Not only does the PD of the counterparty change

compelling asset specificity argument: if the airline industry is in in a stressful environment, the exposure does likewise. Thus, any

distress, and a bank is stuck with the collateral on defaulted air­ CVA stress test involves two distinct simulation exercises. If the

craft loans or leases, it will be hard to sell those aircraft except

at very depressed prices. The healthcare sector may be relatively 22 Of the 90 participating banks, 59 were so-called IRB (internal ratings
robust at the time, as indeed it was in the recent recession, but based) banks, meaning that their internal models were validated to the
it is difficult to transform an airplane into a hospital. supervisor's satisfaction for at least one regulatory portfolio (e.g., corpo­
rate, commercial real estate, etc.). Non-IRB banks were given very non­
The EBA disclosure on methodology is especially rich. In the specific guidance (EBA, 2011, Section 5.5.1.1).
March 2011 document, for example, detailed guidance is 23 For an excellent treatment, see Canabarro (2010) and Hopper (2010).

Chapter 15 Stress Testing Banks ■ 275

 2 0 0 9 S C A P P/L co ve ra g e
</) 5
0
< 4
V/)) 3
Median:58%
O
2

Q.
Z
Q.
1
0 a
-1 x 0 u o 0 if) (/> 00 _co
LU
E o 08
00 >- o
c o < E O CD
CD
CD CO 0
00 <J
-M =3
z f-C
< £ U)
CO
00 00 CD T3 0
-M
CO
•-M
...
Q. O 0 CD
cn—
(D CD CD
O -M =3
CD CO
u <
CD +-»
CO

2 0 1 2 C C A R P/L co v e ra g e
5
4
V) 3 Median:63%
<
<//))
CD
2
O 1
0
or -1 □
Z
-2
0
Q.
Q- x I— 2 0
•
-M
1
“O o c U CL (/)
0 co CO —
LU
E o 08
00
C
U •
<
CD
E
_0 Z C
o 0 lo “55
00
>- O

< 00 z o
Q_
0 C Q_ +-*
co
h- :> CD
CD U *CD CO
>> -M 0
•-t—* -M o
CO 0
c
M— O 0
CL
CD
•—
—
LL O CD
+-*
CD
-M
co
CD CO

2011 E B A P/L c o v e ra g e (a d ve rse scen ario )

+-*
C
V)
0
3
0
E
V)
(/)
2 Median:66%
_o
•
CD 'v )
1
a U)
E l I__ I_____i___ » i ■it. i 11. i > ■i 1___ 11■■i i .hi L
0 liin n im n a a iiiiiiiin m - 1■- t■1 --1 llllllllllllu . A • im m iiiiim iiim i
c
•
•
i c
0 1-
cu
oZ 0
-1
T-rOLnNCOO(N^r\CM>^-OCN^OCX)OCNJ^'OOOOCNCNi ,v f O ^ T“ T“ ^LONO'-rOLnNC>r:oOLO^-ON
Oooo^-CNCNCNCNCNJOr-^sOvOvOONrsNNNCDCD^t-^-cDorororororo^-^^-^j-^-LnmLncocoLn
o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o o q o o o o o o g o o o o o
|— |— L U > - L 1 J L U L U L U L I J L I J ^ ^ C O C O C O C O C O C O C O C O C O C O C O C O l l Q ^ Q ^ Q Q C O Q ^ Q ^ Q ^ L 1 J L 1 J | — |— —) _ J — I O |— I— LU LU TT;
< < co( J Q Q Q Q Q Q Q Q l u l u l u l u l u l u l u l u l u l u l u l u l l l l o O O O O ” _j Z Z z Q- " Q-
n ----
co co

Fiaure 15.1 Projected coverages of losses with profits in the 2009 SCAP and 2011 EBA stress tests.

collateral posted by the counterparty is anything other than conditions. Banks' total income can be divided roughly into
cash or a cash equivalent, a revaluation of that collateral interest and non-interest income. The interest income is clearly
under the same stress scenario needs to be added to the a function of the yield curve and credit spreads posited under
process. 24 the stress scenario, but the net impact of rising or falling rates
on bank profitability remains ambiguous, perhaps in part
because of interest rate hedging strategies (English, 2002;
Modeling Revenues Purnanandam, 2007). The impact of stress scenarios on the
Implementing stress scenarios on the revenue side of the equa­ noninterest income, which includes service charges, fiduciary,
tion remains largely a black box, and seems far less well devel­ fees, and other income (e.g., from trading), is far harder to
oped than stress testing for losses. Neither the 2009 SCAP nor assess, and there has been precious little discussion of its
the otherwise richly documented 2011 EB A disclosures determinants in the literature. This is concerning, since Stiroh
devoted much space or revealed much detail about the meth­ (2004) shows that not only has the share of noninterest income
ods and approaches for computing revenues under stressful2
*
4 in US banks been rising steadily, from 25% in 1985 to 43% in
2001, but it is associated with a greater volatility and lower
risk-adjusted returns. If we compare the 2009 SCAP, the 2011
EBA and the 2012 C C A R stress tests, the median bank in the
24 There is the added complication that major derivatives dealers actively
manage CVA risk using a range of strategies and instruments that them­ US was able to cover about 58% of its total projected losses
selves vary in price and availability depending on market conditions. with profits (including reserve releases, if any) in 2009 and 63%

276 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Two year dynamic forecast

Starting Q1 end Q2 end Q8 end

balance Q1 income balance Q2 income balance balance
sheet I y statement sheet statement sheet sheet

L L L L
A A A A

E E E E

M Capital
V i?
Capital
and and
liquidity liquidity
ratios ratios

Fig u re 1 5 .2 S tre ss testin g b alan ce sh e e t and incom e sta te m e n t dynam ics.

in 2012,25 compared with 66% in the European case. As years.26 This is illustrated in Figure 15.2 below. The point of
Figure 15.1 shows, there is a considerable degree of variability departure is the current balance sheet, at which point the bank
across banks, especially in the EBA test, where in some cases meets the required capital (and, if included, liquidity) ratios. The
profits are projected to outpace losses 4:1, even under the starting balance sheet generates the first quarter's income and
stress scenario! loss, which in turn determines the quarter-end balance sheet.
The modeler is then faced with the problem of considering the
nature and amount of new assets originated and/or sold during
Modeling the Balance Sheet the quarter, and any other capital depleting or conserving
Recall that capital adequacy is defined in terms of a capital actions such as acquisitions or spin-offs, dividend changes or
ratio, roughly capital over assets. O f course, both the numera­ share (re-)purchase or issuance programs, including employee
tor and denominator are nuanced. All supervisory stress tests stock and stock option programs. The problem of balance sheet
have insisted, to varying degrees, that the relevant form of modeling exists under a static (be it in raw form, as in the 2011
capital be common equity. The 2010 C EBS test allowed for EBA, or in risk weighted form, as in the 2009 SCAP) or dynamic
some forms of hybrid capital which are typical of state partici­ balance sheet assumption. The bank should not drop below the
pations, but the requirements were tightened a year later. As required capital (and liquidity) ratios in any quarter. Moreover, at
was discussed in Section 4.1, the denominator is typically risk- the end of the stress horizon, the bank needs to estimate the
weighted assets (RWA), where the risk weights are determined amount of reserves needed to cover expected losses on loans
by the prevailing regulatory capital regime, namely Basel I (in and leases for the following year. In this way, the stress tests are
the US cases of the SCAP and CCAR) and Basel II (in the Euro­ really three years (or T + 1 years for a T-year stress test).
pean stress tests). The many subtleties of what this implies are
beyond the scope of this paper; suffice it to say that a bank
15.5 STRESS TESTING DISCLOSURE
may be forced to raise capital under one regime but not the
other, and there is no way to know which regime will result in a Stress testing is here to stay, whether because it is just good
more favorable treatm ent without knowing about the portfolio risk management practice, or because it is enshrined in legisla­
in considerable detail. tion (through the Dodd-Frank Act). In the debate on disclosure
Regardless of the risk weight regime, determining the post­ regimes, it is not clear that more is always better. We divide the
stress capital adequacy requires modeling of both the income discussion into crisis and noncrisis or normal times, with the simple
statement and the balance sheet, both flows and stocks, over point that normal times may not require or even desire the same
the course of the stress test horizon, which is typically two degree of transparency as is clearly needed in times of crisis.

We have seen very large differences in disclosure across the dif­

ferent supervisory stress tests, as summarized in Table15.1. The
25 PPNR calculations in the 2012 CCAR were net of operational risk
related losses and OREO expenses, as well as mortgage repurchase and
put-back costs, meaning that these items were not reported separately 26 The horizon is 9 quarters for the CCAR, as it is based on Q3, not Q4,
(though they totaled $115 bn for all 19 banks) (Board of Governors, 2012). balance sheets.

Chapter 15 Stress Testing Banks ■ 277

Real GDP growth Unemployment rate
Stress-test scenarios vs. recent historical observations Stress-test scenarios vs. recent historical observations

Stressed quarter
CCA R 1 from 2010 Q4 -------CCA R 1 from 2010 Q4
CCA R 2 from 2011 Q3 -------CCA R 2 from 2011 Q3
— CCA R 3 "severely adverse" from 2012 Q3 CCAR 3 "severely adverse" from 2012 Q3
— CCA R 3 "adverse" from 2012 Q3 CCAR 3 "adverse" from 2012 Q3
— SC A P "more adverse scenario" from 2008 Q4 SCA P "more adverse scenario" from 2008 Q4
— Historical from 2008 Q4 Historical from 2008 Q4
F ig u re 1 5 .3 US real G D P and u n em p lo ym en t sce n a rio s co m p are d .

Source: Fed, The Supervisory Capital Assessment Program: Design and Implementation, 24 April 2009; Fed, Comprehensive Capital Analysis and
Review: Objectives and Overview, 18 March, 2011; Fed, "Comprehensive Capital Review" document and "Capital Plan review" 22 November 2011;
Fed, "Supervisory Scenarios" 15 November 2012; Datastream.

SCAP in 2009 opened Pandora's box by disclosing projected accompanying rules (final and proposed27), gave a glimpse of
stress losses for each of the 19 participating banks, for eight dif­ what regular disclosure might look like. The 2012 CCAR dis­
ferent categories or asset classes, as well as resources other than closed nearly the same level of detail as the 2009 SCAP, namely
capital for absorbing losses (mostly pre-provision net revenue bank-level loss rates and dollar losses by major regulatory asset
and reserve releases, if any). Until then, regulatory disclosures classes (following the categories of the FR Y-9C bank holding
(e.g., Y-9C reports for US bank holding companies) reported only company reports): first and second lien mortgages, commercial
realized losses (the past), not projected losses (a possible future). and industrial (C&l) lending, C RE, credit cards, other consumer,
This allowed the market to check the severity of the stress test and other loans. In addition, the Fed reported the dollar PPNR,
easily, not just in terms of the scenario, but also, and much more gains/losses on the AFS/HTM securities portfolio, and trading
importantly, in terms of the resulting outcomes at the bank and counterparty losses for those firms who were required to
level. Given the crisis of confidence which was prevalent in the conduct the trading book stress.28 Again, as with the 2009 SCAP,
market at the time, this amount of transparency was crucial. Two the numbers reported were supervisory estimates, not the banks'
years later, the CCA R displayed a radically different disclosure own estimates of losses (and PPNR) under the stress scenario.
regime: only the macro-scenario was published, with no bank-
By contrast, the 2011 Irish and 2011 Europe-wide EBA stress tests,
level results. The only indications of bank-level outcomes were
both of which were disclosed after the CCAR, were consider­
the subsequent dividend and other capital actions announced by
able in their detail, including comparisons of bank and third-party
some banks: banks which were allowed to raise their dividends
were interpreted as having "passed" the stress test. The market
digested this meager information event without a hiccup.
27 http://www.gpo.gov/fdsys/pkg/FR-2011 -12-01/pdf/2011-30665.pdf.
Dodd-Frank, however, requires the Fed to disclose the results of OR
In 2012, these were the six institutions with the largest trading
regular stress testing, and the 2012 CC A R, with the portfolios.

278 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Dow Jo nes total stock market index level House Price index
Stress-test scenarios vs. recent historical observations Stress-test scenarios vs. recent historical observations

18,000 -1

16,000 -

14.000 -

12.000 -

10,000 -

8,000 -

6,000 -

4.000 -

2.000 -

0 -t----1---- 1---- 1---- 1---- 1 1---- 1----1---- 1---- 1---- 1 1--- 1—

0 1 2 3 4 5 6 7 8 9 10 11 12 13
Stressed quarter Stressed quarter
-------CCA R 1 from 2010 Q4 -------C C A R 1 from 2010 Q4
-------CCA R 2 from 2011 Q3
-------CCA R 2 from 2011 Q3
— CCAR 3 "severely adverse" from 2012 Q3
— CCA R 3 "severely adverse" from 2012 Q3
— CCA R 3 "adverse" from 2012 Q3
CCAR 3 "adverse" from 2012 Q3
— SCA P "more adverse scenario" from 2008 Q4
— Historical from 2008 Q4 — Historical from 2008 Q4
Fig u re 1 5 .4 US eq u ity and house p rice in d ices co m p ared .

Source: Fed, The Supervisory Capital Assessment Program: Design and Implementation, 24 April 2009; Fed, Comprehensive Capital Analysis and
Review: Objectives and Overview, 18 March, 2011; Fed, "Comprehensive Capital Review" document and "Capital Plan review" 22 November 2011;
Fed, "2013 Supervisory Scenarios" 15 November 2012; Datastream.

estimates of losses in the Irish case (revealing the bias that any Clearly, some disclosure is still preferable to no disclosure, and
bank is likely to have when estimating its own potential losses), Goldstein and Sapra propose the disclosure of aggregated but
and data in electronic, downloadable form in the EBA case. Ire­ not necessarily bank-specific results, with sufficient information
land in particular was suffering from an acute credibility problem, about category outcomes (loss rates by major asset class, for
having emerged from the CEBS stress test with flying colors in instance). Aggregation has the advantage of being less wrong,
July 2010, only to require massive external aid four months later. since the idiosyncratic errors in estimating bank conditions
under hypothesized stress scenarios are averaged out. In this
This difference in experiences between Europe and the US
way, supervisors can still provide the useful macro-prudential
provides some hints on how to design a disclosure regime dur­
information which only they can provide— loss rates by asset
ing "normal" times. The discussion of the benefits and costs of
class, total capital decline in the system (or significant fraction
stress test disclosures by Goldstein and Sapra (2012) is helpful.
of the banking system)— without drowning out signals about
They argue persuasively that in a world with frictions and stra­
individual banks from the market participants themselves. Such
tegic environments, the benefits (better market discipline) may
a disclosure gives the market an anchor point for system-wide
not outweigh the costs: banks may make poor portfolio choices
possibilities, without diluting the incentive to dig hard into a
which are designed to maximize the chance of passing the test
particular firm's financials.
(window dressing), thereby giving up longer term value; while
traders may place too much weight on the public information of During times of crisis, with the enormous uncertainty about
stress test disclosure and lose their incentive to produce private the health of the banking system, the benefit of detailed bank-
information about the banks; and finally, with the information specific stress test disclosure is significant, given the ability of
content of market prices having been damaged, market disci­ supervisors to assess the health of individual firms correctly, and
pline is harmed, and supervisors will find market prices less use­ the resulting inability of the market distinguish between a good
ful for policy decisions (micro- as well as macro-prudential). bank and a bad. Indeed, Goldstein and Sapra argue that stress

Chapter 15 Stress Testing Banks ■ 279

test disclosures, when more disaggregated, ought to be accom­ CONCLUSION
panied by detailed descriptions of the exposures of the banks.
This is precisely what was done in the Irish bank stress test of The problem of sizing the amount of capital needed to support a
2011, an acute case of loss of confidence (and a subsequent bank's risk taking is not new, but the use of broad-based super­
regaining of confidence), as well as in the 2011 EBA stress test. visory stress tests for an entire banking system is. The first use of
Because the credibility of European supervisors was rather low such tests was in the US in 2009, and its success there has made
by that point, only with a very detailed disclosure, bank by bank, it the supervisory and risk management hammer for dealing with
of their exposures by asset class, by country and by maturity all nails. A critical component of the exercise is the disclosure of
bucket, could the market do its own math and arrive at its own the results. The reason why stress testing became an imperative
conclusions. was precisely because existing approaches that were publicly dis­
Between March 2009 and March 2011, the 19 SCAP banks had closed, such as regulatory capital ratios, were no longer informa­
raised about $300 bn in capital and the S&P500 had increased tive, and were heavily (if not entirely) discounted by the market.
by 65%; by the end, the economy was no longer in recession, In order to regain their credibility, supervisory authorities needed
and, arguably, the supervisory agencies had regained credibility. to disclose enough to allow the market to "check the math".
The non-event of the nondisclosure of the 2011 CCA R suggests However, broad-based supervisory stress testing has not been
that the market seems content to live in a state of "symmetric universally successful, as the 2010-2011 European experience
ignorance", to borrow a term from Dang, Gorton, and Holm- has shown. Nor is it clear how useful such broad supervisory
strom (2010). O f course, this might change were the economy to stress testing with concomitant disclosure would be as a mat­
receive another adverse shock, but until it does, it is not clear ter of routine. Its value in the crisis was undoubtedly due to its
that an EBA-like disclosure regime is necessarily either desirable "pop quiz" nature. It was sprung on the banks at short notice,
or stability-enhancing. In contrast, Europe is not yet out of the and thus was very difficult for them to manipulate through care­
woods (at the time of writing); yet even the EBA was not limit­ ful pre-positioning; and it was tailored to the situation at hand,
less with its disclosure of the 2011 stress test results. It is worth genuinely revealing new information to all participants and the
noting that funding liquidity was also stressed for banks, but public. As a result, trust was regained. Once that trust has been
without disclosing the results. Because liquidity positions are re-established, the cost-benefit of stress testing disclosures may
highly dynamic, and thus subject to rapid change, snapshot dis­ tip away from bank-specific towards more aggregated informa­
closure, especially with a delay (the as-of date for the 2011 EBA tion. This still provides the market with unique information (after
stress test was Y E 2010), is unlikely to be informative at the time all, supervisors have access to proprietary bank data) without
of disclosure.29 taking away market participants' incentives to produce private
Recall the discussion in the introduction: regulatory capital information and trade on it— with all the downstream benefits of
models (risk weighting), internal economic capital models and information-rich prices and market discipline.
stress testing all have the same goal, namely to determine the
amount of capital needed to support the business (risk taking)
of the bank. Both regulatory and economic capital models (and
ACKNOWLEDGMENTS
especially the former) evolve very slowly, and thus have difficulty
I would like to thank John Fell, Mark Flannery, Itay Goldstein,
in adapting to financial innovations and rapidly changing macro
Bengt Holmstrom, Bill Janew ay, Umit Kaya, Ugur Koyluoglu,
conditions. Indeed, some of the innovation is motivated by those
Andy Kuritzkes, John Lester, Clinton Lively, Hashem Pesaran,
slowly evolving, one-size-fits-all regulatory capital rules. More­
Brian Peters, Barry Schachter, Hal Scott, and members of the
over, bank balance sheets are notoriously opaque and subject to
Committee for Capital Markets Regulation for helpful discus­
easy-to-hide asset substitution (higher risk for lower risk assets);
sions and suggestions. I am also thankful to Cary Lin for helpful
see Morgan (2002). Stress tests, especially macro-prudential
research assistance, as well as the participants in the workshop
supervisory stress tests, are adapted to the then-current envi­
on "Predicting Rare Events" sponsored by the IF/Federal
ronment and bank portfolios by construction. Between balance
Reserve Bank of San Francisco. All errors remain mine, of course.
sheet opacity, asset substitution and regulatory arbitrage, it is
easy to see the value of a "pop quiz" in the form of bespoke
stress testing (Acharya, Mehran, Schuermann, & Thakor, 2011). References

Acharya, V. V., Bharath, S. T., & Srinivasan, A. (2007). Does

29 Reuters, Sept. 2, 2011, "EBA won't seek disclosure of bank liquidity".
Available at http://www.reuters.com/article/2011/09/02/ industry-wide distress affect defaulted firms? Evidence from
idUSL5E7K23PI20110902. creditor recoveries. Jou rn al o f Financial Econom ics, 85, 787-821.

280 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Acharya, V., Mehran, H., Schuermann, T., & Thakor, A. (2011). Gupton, G . M., Finger, C ., & Bhatia, M. (1997).
R o b u st capital regulation. Federal Reserve Bank of New York C re d itM e tricsT M — technical docum ent. This version: April 2.
Staff report no. 490. J.P. Morgan. Available at: http://www.defaultrisk.com/_pdf6j4/
creditm etrics_techdoc.pdf.
Allen, L., Boudoukh, J ., & Saunders, A. (2004). U nderstanding
m arket, cre d it and operational risk: the value at risk approach. Hopper, G. (2010). Stress testing and scenario analysis: some
Blackwell: New York, NY. second generation approaches. In E. Canabarro (Ed.), Counter­
party credit risk (C hapter 11). London, UK: Risk Books.
Bangia, A ., Diebold, F. X ., Kronimus, A ., Schagen, C ., &
Schuermann, T. (2002). Ratings migration and the business cycle, Jorion, P. (1996). Value at risk: the new benchm ark for m anaging
with applications to credit portfolio stress testing. Jou rn al o f financial risk (1st ed.). New York, NY: M cGraw Hill.
Banking and Finance, 26(2-3), 235-264.
Jorion, P. (2007). Value at risk: the new benchm ark for m anaging
Berkowitz, J . (2000). A coherent framework for stress testing. financial risk (3rd ed.). New York, NY: McGraw Hill.
Jou rn a l o f Risk, 2, 1-11.
Koyluoglu, H. U., & Hickman, A. (1998). Credit risk: reconcilable
Board of Governors of the Federal Reserve System (2012). Com­ differences. Risk, 77(10), 56-62.
prehensive capital analysis and review 2012: methodology and
Kupiec, P. H. (1998). Stress testing in a value at risk framework.
results for stress scenario projections. 13 March, 2012. Available
Jou rn a l o f D erivatives, 6(1), 7-24.
at: http://www.federalreserve.gov/newsevents/press/bcreg/
bcreg20120313a1 .pdf. Kuritzkes, A ., & Scott, H. (2009). Markets are the best judge of
bank capital. Financial Tim es, Septem ber 23.
Canabarro, E. (2010). Pricing and hedging counterparty risk: les­
sons relearned? In E. Canabarro (Ed.), C oun terparty cred it risk Lester, J ., Reynolds, P, Schuermann, T., & Walsh, D. (2012).
(C hapter 6). London, UK: Risk Books. Stra teg ic capital: defining an effective real w orld view o f capital.
Oliver Wyman financial services report. Available at: http://www
Committee on the Global Financial System (2001). A survey of
.oliverwyman.com/strategic-capital-defining-an-effective-real-
stress tests and current practice at major financial institutions.
world-view-of-capital.htm.
Available at: http://www.bis.org/publ/cgfs18.htm.
Morgan, D. P. (2002). Rating banks: risk and uncertainty in an
Dang, T.V., Gorton, G ., & Holmstrom, B. (2010). Financial crises and
opaque industry. A m erican Eco n o m ic Review , 92(4), 874-888.
the optimality o f d e b t for liquidity provision. Working paper. Avail­
able at: http://mfi.uchicago.edu/publications/papers/ignorance- Purnanandam, A. (2007). Interest rate risk management at com­
crisis-and-the-optimality-of-debt-for-liquidity-provision.pdf. mercial banks: an empirical investigation. Jou rn a l o f M onetary
Econ om ics, 54, 1769-1808.
English, W. B. (2002). Interest rate risk and bank net interest
margins. BIS Q uarterly Review , D ecem b er, 67-82. Rebonato, R. (2010). C o h eren t stress testin g : a Bayesian
approach to the analysis o f financial stress. New York: John
European Banking Authority (2011). 2011 EU-wide stress test:
Wiley & Sons.
methodological note. 18 March 2011. Available at: http://www
.eba.europa.eu/EU-wide-stress-testing/2011/The-EBA-publishes- Stiroh, K. (2004). Diversification in banking: is noninterest
details-of-its-stress-test-scena.aspx. income the answer? Jou rn a l o f M on ey, C red it and Banking,
36(5), 853-882.
Fender, I., Gibson, M. S., & Mosser, P. C. (2001). An international
survey of stress tests. Current Issues in Economics and Finance, W ilde, T. 1997. C reditRiskT — a credit risk management fram e­
7(10), Federal Reserve Bank of New York. work. Available at: http://www.csfb.com/institutional/research/
assets/creditrisk.pdf.
Flannery, M. J . (2012). M easuring eq u ity capital fo r stress-testin g
large financial institutions. Working paper. Wyman, O. (2012a). Bank of Spain stress testing exercise. Avail­
able at: http://www.bde.es/webbde/GAP/Secciones/SalaPrensa/
Foglia, A. (2008). Stress testin g cred it risk: a survey o f authori­
Informacionlnteres/ReestructuracionSectorFinanciero/Ficheros/
tie s' approaches. Banca d'ltalia occasional paper, No. 37.
en/informe_oliverwymane.pdf.
Goldstein, I., & Sapra, H. (2012). Sh ou ld banks' stress te st results
Wyman, O. (2012b). Asset quality review and bottom-up stress
b e d isclo se d ? A n analysis o f the co sts and b en efits. Working
test exercise. Available at: http://www.bde.es/f/webbde/
paper. Available at: http://finance.wharton.upenn.edu/~itayg/
SSICOM /20120928/inform e_ow280912e.pdf.
Files/disclosure.pdf.

Chapter 15 Stress Testing Banks ■ 281

Guidance
on Managing
Outsourcing Risk

Learning Objectives
After completing this reading you should be able to:

Explain how risks can arise through outsourcing activities Describe topics and provisions that should be addressed
to third-party service providers and describe elements of in a contract with a third-party service provider.
an effective program to manage outsourcing risk.

Explain how financial institutions should perform due

diligence on third-party service providers.

E x c e rp t is Su p erviso ry L e tte r SR 13-19/CA 13-21 from the B oard o f G overn ors o f the Fed era l R eserve System , D e ce m b e r 2013.
16.1 PURPOSE • C ountry risks arise when a financial institution engages a
foreign-based service provider, exposing the institution to
In addition to traditional core bank processing and information possible economic, social, and political conditions and events
technology services, financial institutions1 outsource operational from the country where the provider is located.
activities such as accounting, appraisal management, internal • O perational risks arise when a service provider exposes a finan­
audit, human resources, sales and marketing, loan review, asset cial institution to losses due to inadequate or failed internal
and wealth management, procurement, and loan servicing. The processes or systems or from external events and human error.
Federal Reserve is issuing this guidance to financial institutions • Legal risks arise when a service provider exposes a financial
to highlight the potential risks arising from the use of service institution to legal expenses and possible lawsuits.
providers and to describe the elements of an appropriate ser­
vice provider risk management program. This guidance supple­
ments existing guidance on technology service provider (TSP) 16.3 BOARD OF DIRECTORS
risk,1
2 and applies to service provider relationships where busi­ AND SENIOR MANAGEMENT
ness functions or activities are outsourced. For purposes of this
guidance, "service providers" is broadly defined to include all
RESPONSIBILITIES
entities3 that have entered into a contractual relationship with a
The use of service providers does not relieve a financial insti­
financial institution to provide business functions or activities.
tution's board of directors and senior management of their
responsibility to ensure that outsourced activities are conducted

16.2 RISKS FROM THE USE in a safe-and-sound manner and in compliance with applicable
laws and regulations. Policies governing the use of service
OF SERVICE PROVIDERS providers should be established and approved by the board
of directors, or an executive committee of the board. These
The use of service providers to perform operational functions
policies should establish a service provider risk management
presents various risks to financial institutions. Some risks are
program that addresses risk assessments and due diligence,
inherent to the outsourced activity itself, whereas others are
standards for contract provisions and considerations, ongoing
introduced with the involvement of a service provider. If not
monitoring of service providers, and business continuity and
managed effectively, the use of service providers may expose
contingency planning.
financial institutions to risks that can result in regulatory action,
financial loss, litigation, and loss of reputation. Financial institu­ Senior management is responsible for ensuring that board-
tions should consider the following risks before entering into approved policies for the use of service providers are appro­
and while managing outsourcing arrangements. priately executed. This includes overseeing the development
and implementation of an appropriate risk management and
• C om pliance risks arise when the services, products, or activi­
reporting framework that includes elements described in this
ties of a service provider fail to comply with applicable U.S.
guidance. Senior management is also responsible for regularly
laws and regulations.
reporting to the board of directors on adherence to policies
• C oncentration risks arise when outsourced services or prod­
governing outsourcing arrangements.
ucts are provided by a limited number of service providers or
are concentrated in limited geographic locations.
• Reputational risks arise when actions or poor performance of 16.4 SERVICE PROVIDER RISK
a service provider causes the public to form a negative opin­ MANAGEMENT PROGRAMS
ion about a financial institution.
A financial institution's service provider risk management pro­
1 For purpose of this guidance, a "financial institution" refers to state gram should be risk-focused and provide oversight and controls
member banks, bank and savings and loan holding companies (includ­ commensurate with the level of risk presented by the outsourc­
ing their nonbank subsidiaries), and U.S. operations of foreign banking
ing arrangements in which the financial institution is engaged.
organizations.
It should focus on outsourced activities that have a substantial
2 Refer to the 'FFIEC' Outsourcing Technology Services Booklet (June
2004) at http://ithandbook.ffiec.gov/it-booklets/outsourcing-technology- impact on a financial institution's financial condition; are critical
services.aspx. to the institution's ongoing operations; involve sensitive cus­
3 Entities may be a bank or nonbank, affiliated or non-affiliated, regu­ tomer information or new bank products or services; or pose
lated or non-regulated, or domestic or foreign. material compliance risk.

284 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The depth and formality of the service provider risk manage­ B. Due Diligence and Selection of Service
ment program will depend on the criticality, complexity, and
Providers
number of material business activities being outsourced. A com­
munity banking organization may have critical business activities A financial institution should conduct an evaluation of and
being outsourced, but the number may be few and to highly perform the necessary due diligence for a prospective service
reputable service providers. Therefore, the risk management provider prior to engaging the service provider. The depth and
program may be simpler and use less elements and consider­ formality of the due diligence performed will vary depending
ations. For those financial institutions that may use hundreds or on the scope, complexity, and importance of the planned out­
thousands of service providers for numerous business activities sourcing arrangement, the financial institution's familiarity with
that have material risk, the financial institution may find that they prospective service providers, and the reputation and industry
need to use many more elements and considerations of a ser­ standing of the service provider. Throughout the due diligence
vice provider risk management program to manage the higher process, financial institution technical experts and key stake­
level of risk and reliance on service providers. holders should be engaged in the review and approval process
as needed. The overall due diligence process includes a review
While the activities necessary to implement an effective service
of the service provider with regard to:
provider risk management program can vary based on the scope
and nature of a financial institution's outsourced activities, effec­ 1. Business background, reputation, and strategy;
tive programs usually include the following core elements: 2. Financial performance and condition; and
A. Risk assessments; 3. Operations and internal controls.
B. Due diligence and selection of service providers;
1. Business Background, Reputation, and Strategy
C. Contract provisions and considerations;
Financial institutions should review a prospective service pro­
D. Incentive compensation review;
vider's status in the industry and corporate history and qualifi­
E. Oversight and monitoring of service providers; and cations; review the background and reputation of the service
F. Business continuity and contingency plans. provider and its principals; and ensure that the service provider
has an appropriate background check program for its employees.

The service provider's experience in providing the proposed ser­

A. Risk Assessments
vice should be evaluated in order to assess its qualifications and
Risk assessment of a business activity and the implications of competencies to perform the service. The service provider's busi­
performing the activity in-house or having the activity per­ ness model, including its business strategy and mission, service
formed by a service provider are fundamental to the decision philosophy, quality initiatives, and organizational policies should be
of whether or not to outsource. A financial institution should evaluated. Financial institutions should also consider the resiliency
determine whether outsourcing an activity is consistent with and adaptability of the service provider's business model as factors
the strategic direction and overall business strategy of the in assessing the future viability of the provider to perform services.
organization. After that determination is made, a financial insti­
Financial institutions should check the service provider's references
tution should analyze the benefits and risks of outsourcing the
to ascertain its performance record, and verify any required licenses
proposed activity as well as the service provider risk, and deter­
and certifications. Financial institutions should also verify whether
mine cost implications for establishing the outsourcing arrange­
there are any pending legal or regulatory compliance issues (for
ment. Consideration should also be given to the availability
example, litigation, regulatory actions, or complaints) that are asso­
of qualified and experienced service providers to perform the
ciated with the prospective service provider and its principals.
service on an ongoing basis. Additionally, management should
consider the financial institution's ability and expertise to pro­
vide appropriate oversight and management of the relationship
2. Financial Performance and Condition
with the service provider. Financial institutions should review the financial condition of the
service provider and its closely-related affiliates. The financial
This risk assessment should be updated at appropriate intervals
review may include:
consistent with the financial institution's service provider risk
management program. A financial institution should revise its • The service provider's most recent financial statements and
risk mitigation plans, if appropriate, based on the results of the annual report with regard to outstanding commitments, capi­
updated risk assessment. tal strength, liquidity and operating results.

Chapter 16 Guidance on Managing Outsourcing Risk ■ 285

• The service provider's sustainability, including factors such as strategy for providing those services will determine the terms
the length of time that the service provider has been in busi­ of the contract. Elements of well-defined contracts and service
ness and the service provider's growth of market share for a agreements usually include:
given service.
• S c o p e : Contracts should clearly define the rights and respon­
• The potential impact of the financial institution's business sibilities of each party, including:
relationship on the service provider's financial condition.
• Support, maintenance, and customer service;
• The service provider's commitment (both in terms of financial • Contract timeframes;
and staff resources) to provide the contracted services to the
• Compliance with applicable laws, regulations, and regula­
financial institution for the duration of the contract.
tory guidance;
• The adequacy of the service provider's insurance coverage.
• Training of financial institution employees;
• The adequacy of the service provider's review of the financial
• The ability to subcontract services;
condition of any subcontractors.
• The distribution of any required statements or disclosures
• Other current issues the service provider may be facing that
to the financial institution's customers;
could affect future financial performance.
• Insurance coverage requirements; and

3. Operations and Internal Controls • Terms governing the use of the financial institution's prop­
erty, equipment, and staff.
Financial institutions are responsible for ensuring that services
provided by service providers comply with applicable laws and • Cost and com pensation: Contracts should describe the
regulations and are consistent with safe-and-sound banking compensation, variable charges, and any fees to be paid
practices. Financial institutions should evaluate the adequacy of for non-recurring items and special requests. Agreements
standards, policies, and procedures. Depending on the charac­ should also address which party is responsible for the pay­
teristics of the outsourced activity, some or all of the following ment of any legal, audit, and examination fees related to
may need to be reviewed: the activity being performed by the service provider. Where
applicable, agreements should address the party responsible
• Internal controls;
for the expense, purchasing, and maintenance of any equip­
• Facilities management (such as access requirements or shar­ ment, hardware, software or any other item related to the
ing of facilities); activity being performed by the service provider. In addition,
• Training, including compliance training for staff; financial institutions should ensure that any incentives (for
• Security of systems (for example, data and equipment); example, in the form of variable charges, such as fees and/or
commissions) provided in contracts do not provide potential
• Privacy protection of the financial institution's confidential
incentives to take imprudent risks on behalf of the institution.
information;
• Right to audit: Agreements may provide for the right of the
• Maintenance and retention of records;
institution or its representatives to audit the service provider
• Business resumption and contingency planning; and/or to have access to audit reports. Agreements should
• Systems development and maintenance; define the types of audit reports the financial institution will
• Service support and delivery; receive and the frequency of the audits and reports.

• Employee background checks; and • Establishm ent and m onitoring o f p erfo rm a n ce standards:
Agreements should define measurable performance stan­
• Adherence to applicable laws, regulations, and supervisory
dards for the services or products being provided.
guidance.
• Confidentiality and secu rity o f inform ation: Consistent with
applicable laws, regulations, and supervisory guidance, ser­
C. Contract Provisions and Considerations
vice providers should ensure the security and confidentiality
Financial institutions should understand the service contract of both the financial institution's confidential information and
and legal issues associated with proposed outsourcing arrange­ the financial institution's customer information. Information
ments. The terms of service agreements should be defined in security measures for outsourced functions should be viewed
written contracts that have been reviewed by the financial insti­ as if the activity were being performed by the financial insti­
tution's legal counsel prior to execution. The characteristics of tution and afforded the same protections. Financial institu­
the business activity being outsourced and the service provider's tions have a responsibility to ensure service providers take

286 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 appropriate measures designed to meet the objectives of the • O w n ersh ip and license: Agreements should define the abil­
information security guidelines within Federal Financial Insti­ ity and circumstances under which service providers may use
tutions Examination Council (FFIEC) guidance,4 as well as financial institution property inclusive of data, hardware, soft­
comply with section 501(b) of the Gramm-Leach-Bliley Act. ware, and intellectual property. Agreements should address
These measures should be mapped directly to the security the ownership and control of any information generated by
processes at financial institutions, as well as be included or service providers. If financial institutions purchase software
referenced in agreements between financial institutions and from service providers, escrow agreements may be needed
service providers. to ensure that financial institutions have the ability to access
Service agreements should also address service provider use the source code and programs under certain conditions.8
of financial institution information and its customer informa­ • Indem nification: Agreements should provide for service pro­
tion. Information made available to the service provider vider indemnification of financial institutions for any claims
should be limited to what is needed to provide the con­ against financial institutions resulting from the service pro­
tracted services. Service providers may reveal confidential vider's negligence.
supervisory information only to the extent authorized under • D efault and term ination: Agreements should define events
applicable laws and regulations.5 of a contractual default, list of acceptable remedies, and pro­
If service providers handle any of the financial institution cus­ vide opportunities for curing default. Agreements should also
tomer's Nonpublic Personal Information (NPPI), the service define termination rights, including change in control, merger
providers must comply with applicable privacy laws and regu­ or acquisition, increase in fees, failure to meet performance
lations.6 Financial institutions should require notification from standards, failure to fulfill the contractual obligations, failure
service providers of any breaches involving the disclosure of to provide required notices, and failure to prevent viola­
NPPI data. Generally, NPPI data is any nonpublic personally tions of law, bankruptcy, closure, or insolvency. Contracts
identifiable financial information; and any list, description, or should include termination and notification requirements that
other grouping of consumers (and publicly available informa­ provide financial institutions with sufficient time to transfer
tion pertaining to them) derived using any personally identifi­ services to another service provider. Agreements should also
able financial information that is not publicly available.7 address a service provider's preservation and timely return of
Financial institutions and their service providers who main­ financial institution data, records, and other resources.
tain, store, or process NPPI data are responsible for that • D ispute resolution: Agreements should include a dispute
information and any disclosure of it. The security of, retention resolution process in order to expedite problem resolution
of, and access to NPPI data should be addressed in any con­ and address the continuation of the arrangement between
tracts with service providers. the parties during the dispute resolution period.
When a breach or compromise of NPPI data occurs, financial • Limits on liability: Service providers may want to contractually
institutions have legal requirements that vary by state and limit their liability. The board of directors and senior manage­
these requirements should be made part of the contracts ment of a financial institution should determine whether the
between the financial institution and any service provider that proposed limitations are reasonable when compared to the
provides storage, processing, or transmission of NPPI data. risks to the institution if a service provider fails to perform.9
Misuse or unauthorized disclosure of confidential customer
• Insurance: Service providers should have adequate insurance
data by service providers may expose financial institutions
and provide financial institutions with proof of insurance.
to liability or action by a federal or state regulatory agency.
Further, service providers should notify financial institutions
Contracts should clearly authorize and disclose the roles and
when there is a material change in their insurance coverage.
responsibilities of financial institutions and service providers
regarding NPPI data.
8 Escrow agreements are established with vendors when buying or leas­
ing products that have underlying proprietary software. In such agree­
ments, an organization can only access the source program code under
4 For further guidance regarding vendor security practices, refer to the specific conditions, such as discontinued product support or financial
'FFIEC' Information Security Booklet (July 2006) at http://ithandbook. insolvency of the vendor.
ffiec.gov/it-booklets/infornnation-security.aspx.
9 Refer to SR letter 06-4, "Interagency Advisory on the Unsafe and
5 See 12 CFR Part 261. Unsound Use of Limitations on Liability Provisions in External Audit
Engagement Letters," regarding restrictions on the liability limitations
6 See 12 CFR Part 1016.
for external audit engagements at http://www.federalreserve.gov/
7 See 12 U.S.C. 6801(b). boarddocs/srletters/2006/SR0604.htm.

Chapter 16 Guidance on Managing Outsourcing Risk ■ 287

• C u sto m e r com plaints: Agreements should specify the a review of whether existing governance and controls are
responsibilities of financial institutions and service provid­ adequate in light of risks arising from incentive compensation
ers related to responding to customer complaints. If service arrangements. As the service provider represents the institu­
providers are responsible for customer complaint resolu­ tion by selling products or services on its behalf, the institution
tion, agreements should provide for summary reports to should consider whether the incentives provided might encour­
the financial institutions that track the status and resolution age the service provider to take imprudent risks. Inappropri­
of complaints. ately structured incentives may result in reputational damage,
• Business resum ption and co n tin g en cy plan o f the service increased litigation, or other risks to the financial institution.
p ro vid er: Agreements should address the continuation of An example of an inappropriate incentive would be one where
services provided by service providers in the event of opera­ variable fees or commissions encourage the service provider to
tional failures. Agreements should address service provider direct customers to products with higher profit margins without
responsibility for backing up information and maintaining due consideration of whether such products are suitable for
disaster recovery and contingency plans. Agreements may the customer.
include a service provider's responsibility for testing of plans
and providing testing results to financial institutions.
E. Oversight and Monitoring of Service
• Fo reig n -b a sed service p ro vid ers: For agreements with
Providers
foreign-based service providers, financial institutions should
consider including express choice of law and jurisdictional To effectively monitor contractual requirem ents, financial
provisions that would provide for the adjudication of all dis­ institutions should establish acceptable perform ance metrics
putes between the two parties under the laws of a single, that the business line or relationship m anagem ent determ ines
specific jurisdiction. Such agreements may be subject to to be indicative of acceptable perform ance levels. Financial
the interpretation of foreign courts relying on local laws. institutions should ensure that personnel with oversight and
Foreign law may differ from U.S. law in the enforcement of management responsibilities for service providers have the
contracts. As a result, financial institutions should seek legal appropriate level of expertise and stature to manage the
advice regarding the enforceability of all aspects of proposed outsourcing arrangem ent. The oversight process, including
contracts with foreign-based service providers and the other the level and frequency of management reporting, should be
legal ramifications of such arrangements. risk-focused. Higher risk service providers may require more
frequent assessm ent and monitoring and may require finan­
• Su b con tra ctin g : If agreements allow for subcontracting, the
cial institutions to designate individuals or a group as a point
same contractual provisions should apply to the subcontrac­
of contact for those service providers. Financial institutions
tor. Contract provisions should clearly state that the primary
should tailor and implement risk mitigation plans for higher
service provider has overall accountability for all services that
risk service providers that may include processes such as addi­
the service provider and its subcontractors provide. A gree­
tional reporting by the service provider or heightened moni­
ments should define the services that may be subcontracted,
toring by the financial institution. Further, more frequent and
the service provider's due diligence process for engaging and
stringent monitoring is necessary for service providers that
monitoring subcontractors, and the notification and approval
exhibit perform ance, financial, com pliance, or control con­
requirements regarding changes to the service provider's
cerns. For lower risk service providers, the level of monitoring
subcontractors. Financial institutions should pay special
can be lessened.
attention to any foreign subcontractors, as information secu­
rity and data privacy standards may be different in other juris­ Financial condition: Financial institutions should have estab­
dictions. Additionally, agreements should include the service lished procedures to monitor the financial condition of service
provider's process for assessing the subcontractor's financial providers to evaluate their ongoing viability. In performing
condition to fulfill contractual obligations. these assessments, financial institutions should review the
most recent financial statements and annual report with regard
to outstanding commitments, capital strength, liquidity and
D. Incentive Compensation Review
operating results. If a service provider relies significantly on
Financial institutions should also ensure that an effective process subcontractors to provide services to financial institutions, then
is in place to review and approve any incentive compensation the service provider's controls and due diligence regarding the
that may be embedded in service provider contracts, including subcontractors should also be reviewed.

288 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Internal controls: For significant service provider relationships, • Document the roles and responsibilities for maintaining and
financial institutions should assess the adequacy of the provider's testing the service provider's business continuity and contin­
control environment. Assessments should include reviewing gency plans;
available audits or reports such as the American Institute of • Test the service provider's business continuity and contin­
Certified Public Accountants' Service Organization Control gency plans on a periodic basis to ensure adequacy and
2 report.101If the service provider delivers information technology effectiveness; and
services, the financial institution can request the FFIEC Technol­
• Maintain an exit strategy, including a pool of comparable ser­
ogy Service Provider examination report from its primary federal
vice providers, in the event that a contracted service provider
regulator. Security incidents at the service provider may also
is unable to perform.
necessitate the institution to elevate its monitoring of the
service provider.
G. Additional Risk Considerations
Escalation o f o versig h t activities: Financial institutions should
ensure that risk management processes include triggers to S u sp icio u s A c tiv ity R e p o r t (SAR) re p o rtin g fu n ctio n s:
escalate oversight and monitoring when service providers are The confidentiality of suspicious activity reporting makes
failing to meet performance, compliance, control, or viability the outsourcing of any SAR-related function more com plex.
expectations. These procedures should include more frequent Financial institutions need to identify and monitor the risks
and stringent monitoring and follow-up on identified issues, associated with using service providers to perform certain
on-site control reviews, and when an institution should exercise suspicious activity reporting functions in com pliance with
its right to audit a service provider's adherence to the terms of the Bank Secrecy A ct (BSA). Financial institution m anage­
the agreement. Financial institutions should develop criteria for ment should ensure they understand the risks associated
engaging alternative outsourcing arrangements and terminating with such an arrangem ent and any BSA-specific guidance in
the service provider contract in the event that identified issues this area.
are not adequately addressed in a timely manner. F o re ig n -b a se d se rv ice p ro v id e rs: F inancial institutions should
ensure that foreign-based service providers are in compliance
F. Business Continuity and Contingency with applicable U.S. laws, regulations, and regulatory guid­
ance. Financial institutions may also want to consider laws
Considerations
and regulations of the foreign-based provider's country or
Various events may affect a service provider's ability to provide regulatory authority regarding the financial institution's ability
contracted services. For example, services could be disrupted by to perform on-site review of the service provider's operations.
a provider's performance failure, operational disruption, financial In addition, financial institutions should consider the authority
difficulty, or failure of business continuity and contingency plans or ability of home country supervisors to gain access to the
during operational disruptions or natural disasters. Financial insti­ financial institution's custom er information while examining the
tution contingency plans should focus on critical services pro­ foreign-based service provider.
vided by service providers and consider alternative arrangements
Internal audit: Financial institutions should refer to existing
in the event that a service provider is unable to perform .11 When
guidance on the engagement of independent public accounting
preparing contingency plans, financial institutions should:
firms and other outside professionals to perform work that has
• Ensure that a disaster recovery and business continuity plan been traditionally carried out by internal auditors.12 The
exists with regard to the contracted services and products; Sarbanes-Oxley Act of 2002 specifically prohibits a registered
• Assess the adequacy and effectiveness of a service provider's
disaster recovery and business continuity plan and its align­
12 Refer to SR 13-1, "Supplemental Policy Statement on the Internal
ment to their own plan;
Audit Function and Its Outsourcing," specifically the section titled,
"Depository Institutions Subject to the Annual Audit and Reporting
Requirements of Section 36 of the FDI Act" at http://www.federalreserve
,gov/bankinforeg/srletters/sr1301.htm. Refer also to SR 03-5, "Amended
10 Refer to www.AICPA.org.
Interagency Guidance on the Internal Audit Function and Its Outsourc­
11 For further guidance regarding business continuity planning with ser­ ing," particularly the section titled, "Institutions Not Subject to Section
vice providers, refer to the 'FFIEC' Business Continuity Booklet (March 36 of the FDI Act That Are Neither Public Companies Nor Subsidiaries of
2008) at http://ithandbook.ffiec.gov/it-booklets/business-continuity- Public Companies" at http://www.federalreserve.gov/boarddocs/
planning.aspx. srletters/2003/sr0305.htm.

Chapter 16 Guidance on Managing Outsourcing Risk ■ 289

public accounting firm from performing certain non-audit ser­ institution's exposures and risks.13 Financial institutions should
vices for a public company client for whom it performs financial also have standards and processes in place for ensuring that ser­
statement audits. vice providers offering model risk management services, such as
validation, do so in a way that is consistent with existing model
Risk m anagem ent a ctivities: Financial institutions may out­
risk management guidance.
source various risk management activities, such as aspects of
interest rate risk and model risk management. Financial institu­
tions should require service providers to provide information
that demonstrates developmental evidence explaining the 13 Refer to SR 11-7, "Guidance on Model Risk Management" which informs
financial institutions of the importance and risk to the use of models and
product components, design, and intended use, to determine the supervisory expectations that financial institutions should adhere to
whether the products and/or services are appropriate for the http://www.federalreserve.gov/bankinforeg/srletters/sr1107.htm.

290 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Management of
Risks Associated
with Money
Laundering
and Financing
of Terrorism
Learning Objective
After completing this reading you should be able to:

Explain best practices recommended for the assessment,

management, mitigation, and monitoring of money
laundering and financial terrorism (ML/FT) risks.

By M ark Carey o f the G A R P Risk Institute.

Many nations and international bodies have developed laws, Some others appear in the list of references at the end of this
regulations or guidelines focused on limiting the use of banking chapter.
services to support criminal activities, particularly money laun­
On Decem ber 3, 2018, several financial regulatory agencies
dering (ML) or financing of terrorism (FT). Though involvement
of the U.S. government issued a "Jo int Statement on Innovative
with ML or FT is an operational risk, management of this risk
Efforts to Com bat Money Laundering and Terrorist Financing,"
has become a separate subfield due to the intensity of regula­
which expressed their openness to "innovative efforts" and
tory attention to the issue, the significant level of fines, and the
noted that some banks have been experimenting with machine
creativity of criminals and terrorists.
learning models and digital identity technologies to identify
This chapter summarizes the Basel Committee's 2016 "Sound risks, monitor transactions, and aid in the reporting of suspi­
Management of Risks Related to Money Laundering and Financing cious activity. To date, Bank Secrecy Act (BSA) and Anti-Money
of Terrorism," as well as some of the Financial Action Task Force's Laundering (AML) supervisory activity in the United States has
(FATF) 2016 "The FATF Recommendations" and other documents. focused on compliance, with detailed guidance influencing
bank internal procedures. The agencies state that any flaws
Note that this chapter is only an overview. Risk managers in areas
found in banks' internal procedures as a result of innovative
where management of ML/FT risks is central should examine this
activities will not be used against these firms by supervisors.
topic in further readings and undergo any requisite training.
Although the agencies imply that internal procedures might
someday be permitted to depart from existing compliance
17.1 BACKGROUND requirements where innovations are successful, they also imply
that for the moment banks must continue to satisfy existing
Criminals and terrorists use payment services to finance their
compliance requirements.
activities, or to convert funds linked to criminal activity (includ­
ing tax evasion) to an untainted or laundered form. Because
banks are at the heart of the global payment system, they are
uniquely vulnerable to being ensnared in such activities, which
17.2 APPLICATION OF STANDARD
can expose them to reputational losses, fines, convictions, and PRACTICES
restrictions on their ability to do business.
Banks should apply (though not limit themselves to) standard
In addition to the usual attention to governance arrangements, risk management practices:
policies and procedures, M L/FT risk management includes some
specific activities that supervisors and other authorities expect • G overnance: The board of directors should approve and

at every bank: oversee risk assessm ents, policies, organization, risk

management and com pliance in the specific context
• Risk assessment
of ML/FT. To that end, a chief M L/FT officer should be
• Customer due diligence and acceptance (CDD) [aka Know appointed.
Your Customer (KYC)]
• As in other risk areas, banks are expected to have three lines
• Transaction and other monitoring of defense
• Reporting of suspicious activity and freezing assets
1. Business units must identify, assess and control M L/FT
• Addressing risks associated with global operations risks; have written policies and procedures as well as
• Attention to third-party risk and correspondent banking risks em ployee training; and screen potential em ployees.

• Awareness of an array of official sector pronouncements. 2. The risk function and/or the function under the chief

Among the most important are standards issued by the ML/FT officer must monitor the effectiveness of first line

Financial Action Task Force (FATF), an intergovernmental management of ML/FT risks and compliance with all

coordinating body.*1 policies and procedures. Conflicts of interest on the part

of second line employees should be avoided. The chief
ML/FT officer should have direct reporting lines to senior
management or the board.
A 3. Internal auditors and/or external equivalents should
FATF, "International Standards on Combating Money Laundering
and the Financing of Terrorism and Proliferation," February 2012; and independently evaluate M L/FT risk m anagem ent and
"Methodology" February 2013. controls.

292 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
17.3 RISK ASSESSMENT • Though information about a customer's previous banking
relationships may be helpful, the fact that a customer previ­
Banks should assess and understand the M L/FT risks inherent ously had accounts at another bank is not sufficient to classify
within their businesses and customer base: the customer as low-risk or as well-identified. For example,
the previous bank may have ejected the customer due to
• All relevant risk factors at the country, sector, bank and
ML/FT concerns.
business relationship levels should be considered. Charac­
• Due diligence and monitoring may be more com plex for
teristics of the customer base, products and services offered,
banks operating internationally, particularly for those
and delivery channels should be considered.
operating in jurisdictions that do not permit customer
• For each customer or business relationship, a profile of
information to cross borders. However, information should
normal activity should be built to support identification of
be combined and analyzed across the group as much as
abnormal activity.
possible.
• Risk assessments should be documented for potential
• In some jurisdictions, banks may be permitted to rely on
inspection by authorities.
third parties for some customer due diligence. Banks should
• International banks should be attentive to national risk ensure that the third parties' own management of ML/FT
assessments and country reports. risks is sound and are ultimately responsible even if deci­
sions are made by third parties. Arrangements, controls and
reviews should be documented.
17.4 CUSTOMER DUE DILIGENCE
AND ACCEPTANCE*•
17.5 TRANSACTION AND OTHER
Some customers pose a low risk of involving a bank in ML/FT MONITORING AND REPORTING
activity (e.g., a long established client employed in the commu­
nity with regular, small account inflows and outflows) and some Banks should monitor customer and transaction activity for
pose a high risk (e.g., a person with a past record of criminal unusual patterns to identify potential ML/FT activity.
activity with large and intermittent account inflows and outflows).
• A profile of normal activity and transactions must be built
If a bank chooses to do business with a high-risk customer,
in order to aid identification of abnormal activity, such as
more intensive ongoing monitoring of that customer's activity is
unusual business relationships and transactions.
needed. Moreover, to classify customers by level of risk, a bank
• The higher the assessment of the risk posed by a customer,
should have well-developed customer identification and accep­
the more intense and wide-ranging the monitoring.
tance policies and procedures. Such policies and procedures
should not prevent the general public, nor people who are finan­ • Changes in a customer's risk profile should trigger changes in
cially or socially disadvantaged, from accessing banking services. the intensity of monitoring.

• Written policies and procedures should exist to ensure that • Monitoring should cover all accounts and transactions.

a customer is not accepted, and business is not done, until • CDD information should be used.
the customer's identity has been satisfactorily established. • The larger and more complex the bank and its businesses,
Reliable, independent source documents and information and the more international its operations, the more likely that
should be used in identification. Consideration should be automated monitoring applications will be needed.
given to a customer's home jurisdiction(s), including whether
• Monitoring activity should be documented.
that jurisdiction is known to have ML/FT deficiencies. The
• Especially where required by law, suspicious activity revealed
reasons the customer is opening accounts should also be
by monitoring should be reported to appropriate law
considered.
enforcement authorities.
• Politically exposed persons (PEP), such as former high gov­
ernment officials, pose higher risk given the possibility that
some wealth may have been obtained through corruption. 17.6 CORRESPONDENT BANKING
• Consider the potential customer's background, occupation,
source of wealth and income, and country of origin and Correspondent banking involves the provision of banking ser­
residence. vices by one bank to another bank. O f most concern in the

Chapter 17 Management of Risks Associated with Money Laundering and Financing of Terrorism ■ 293
context of ML/FT is execution of cross-border payments by a 17.8 INTERNATIONAL SCOPE
correspondent bank for a respondent bank's customer.

• Because the correspondent bank does not have a rela­ Banks with a presence in multiple countries should:
tionship with the ultimate customer, it must perform due • Understand and abide by laws and regulations in each
diligence on the respondent bank. Details of the services country. If a country's laws and regulations prevent adequate
provided and of counterparties are relevant to the risk. management of ML/FT risks, consider cessation of business
The quality of the respondent banks' management of ML/ in the country.
FT risks is vitally important. As such, due diligence must
• Apply consistent group-wide policies and procedures.
be done on such management, and agreem ents among
correspondent and respondent banks should set out • Share information across the group and usie groupwide
information and understanding in monitoring and risk
responsibilities.
assessment.
• Some correspondent banking activity involves nested
respondent banks (i.e., the ultimate customer may have a Good official-sector supervisory examination and enforcement
relationship with the respondent bank's respondent bank). in each country of bank management of M L/FT risks is important
For example, a small bank might use a medium-sized bank, to global containment of M L/FT activity.
which in turn uses a large international bank as correspon­
dent. Though many legitimate transactions and activities are
conducted through such nested relationships, ML/FT risks are
References
higher. This is especially true if relationships among respon­
dent banks cross borders. Basel Committee on Banking Supervision, 2016, "Sound Manage­
• When information about the risk changes, termination of ment of Risks Related to Money Laundering and Financing of
correspondent banking relationships with a respondent bank Terrorism."
may be appropriate.
Financial Action Task Force, 2016, "The FATF Recommendations."

Board of Governors of the Federal Reserve System, Federal

17.7 WIRE TRANSFERS Deposit Insurance Corporation, Financial Crimes Enforce­
ment Network, National Credit Union Administration, Office
Wire transfers are accomplished by sending payment messages of the Comptroller of the Currency, 2018, "Joint Statement on
among banks. Information about the originating bank and the Innovative Efforts to Combat Money Laundering and Terrorist
customer should appear in the messages, and such information Financing."
should be monitored.

294 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Regulation of the
Derivatives
Market
Learning Objectives
After completing this reading you should be able to:

Summarize the clearing process in O TC derivatives

markets.

Describe changes to the regulation of O TC derivatives

which took place after the 2007-2009 financial crisis and
explain the impact of these changes.

E x c e rp t is C h a p ter 17 of Risk Management and Financial Institutions, Fifth Edition, by Jo h n C. Hull.

The exchange-traded market is a market where products devel­ Variation margin is the collateral posted to reflect the change in
oped by an exchange are bought and sold on a trading platform the value of a derivatives portfolio. Consider the situation where
developed by the exchange. A market participant's trade must Party A is trading with Party B and the collateral agreement
be cleared by a member of the exchange clearing house. The states that variation margin (with no threshold or minimum
exchange clearing house requires margin (i.e., collateral) from transfer amount) has to be posted by both sides.1 This means
its members, and the members require margin from the brokers that, if the value of outstanding transactions changes during a
whose trades they are clearing. The brokers in turn require mar­ day so that they increase in value by $X to A (and therefore
gin from their clients. decrease in value by $X to B), B has to provide A with $X of
acceptable collateral. The cumulative effect of variation margin
The O TC market is a market where financial institutions, fund
is that, if outstanding derivatives have a value of + $ V to A and
managers, and corporate treasurers deal directly with each other.
—$ V to B at a particular time, B should have posted a total of %V
An exchange is not involved. Before the 2007-2008 credit crisis,
of collateral with A by that tim e.*2
the O TC market was largely unregulated. Two market participants
could enter into any trade they liked. They could agree to post Variation margin provides some protection against a counterparty
collateral or not post collateral. They could agree to clear the default. It would provide total protection in an ideal world where
trade directly with each other or use a third party. Also, they were (a) the counterparty never owes any variation margin at the time
under no obligation to disclose details of the trade to anyone else. of default and (b) all outstanding positions can be replaced at
mid-market prices as soon as the counterparty defaults.
Since the crisis, the O TC market has been subject to a great
In practice, defaulting counterparties often stop posting collateral
deal of regulation. This chapter will explain the regulations and
several days before they default, and the non-defaulting
show that regulatory pressure is leading to the O TC market
counterparty is usually subject to a bid-offer spread as it replaces
becoming more like the exchange-traded market.
transactions.3 To allow for adverse movements in the value of the
portfolio during a period prior to defaulting when no margin is

18.1 CLEARING IN OTC MARKETS being posted, market participants sometimes require initial mar­
gin in addition to variation margin. Note that, in this context,
We start by describing how transactions are cleared in the adverse market movements are increases in the value of the port­
O TC market. There are two main approaches: central clear­ folio to the non-defaulting party, not decreases. This is because
ing and bilateral clearing. They are illustrated schematically in increases in the value during a period when variation margin is not
Figure 18.1 (which makes the simplifying assumption that there being posted lead to increases in replacement costs.4 Initial mar­
are only eight market participants and only one CCP). In bilateral gin, which can change through time as the outstanding portfolio
clearing, market participants clear transactions with each other. and relevant volatilities change, reflects the risk of a loss due to
In central clearing, a third party, known as a central counterparty adverse market moves and the costs of replacing transactions.5
(CCP), clears the transactions.
A

A and B could be two derivatives dealers or a derivatives dealer and

one of its clients. Also, one of A and B could be a CCP. A threshold is a
Margin minimum value of the portfolio to one side before it can demand mar­
gin, and the minimum transfer amount is the minimum change in value
Before proceeding to describe bilateral and central clearing necessary for a margin to have to be posted.
in more detail, we review the operation of margin accounts.
2 In this context, note that if A buys an option from B for $10,000, it
Margin is the word now used to describe the collateral posted must pay $10,000 to B, but B must then return the $10,000 to A as varia­
in O TC markets as well as exchange-traded markets. tion margin.
3 As explained later, the non-defaulting counterparty is able to claim
from the defaulting party the cost related to the bid-offer spread that it
would incur in replacing the transaction.
4 It may seem strange that a market participant would be worried about
the value of its transactions increasing. But suppose a transaction with a
defaulting counterparty is hedged with another transaction entered into
with another counterparty (as is often the case). The transaction with the
other party can be expected to lose value without any compensating
gain on the defaulted transaction.

Bilateral clearing Clearing through a single CCP 5 As indicated earlier, the non-defaulting party is allowed to keep all
margin posted by the defaulting party up to the amount that can be
F ia u re 18.1 Bilateral and central clearing . legitimately claimed.

296 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Most margin is cash, but the agreements in place may specify The OTC Trade
that securities can be posted instead of cash. The securities
may be subject to a h a ircu t This means that the market value
of the securities is reduced to determine their value for margin
purposes. For example, a Treasury bond might be subject to
a 10% haircut, indicating that, if its market value were $100, it
would cover only $90 of a margin requirement. Role of CCP
Should cash margin earn interest? There is a difference between
futures markets and O TC markets here. A futures exchange clear­
ing house requires both initial margin and variation margin from
F ia u re 1 8 .2 Role of C C P in O T C m arkets.
members. Members earn interest on the initial margin. But they
do not do so on variation margin because futures contracts are
settled daily so that variation margin does not belong to the mem­
Consider the swap in Figure 18.2. Suppose for simplicity that
ber posting it. In the case of O TC trades, interest is usually earned
it is the only transaction each side has with the CCP. The CCP
on all cash margin posted because trades are not settled daily.
might require an initial margin of $0.5 million from each side. If,
on the first day, interest rates fall so that the value of the swap
to A goes down by $100,000, Party A would be required to pay
Central Clearing
a variation margin equal to this to the CCP, and the CCP would
In central clearing, a central counterparty (CCP) handles the be required to pay the same amount to B. There could also be
clearing. A CCP operates very much like an exchange clearing a change to the initial margin requirements determined by the
house. When two companies, A and B, agree to an over-the- CCP. If required margin is not paid by one of its members, the
counter derivatives transaction and decide to clear it centrally, CCP closes out its transactions with that member. Cash and
they present it to a CCP. Assuming that the CCP accepts it, the Treasury instruments are usually accepted as margin by CCPs.
CCP acts as an intermediary and enters into offsetting transac­ Typically the interest rate paid on cash balances is close to the
tions with the two companies. overnight federal funds rate for U.S. dollars (and close to similar
overnight rates for other currencies).
Suppose, for example, that the transaction is an interest rate
swap where company A pays a fixed rate of 5% to company B In practice, market participants are likely to have multiple
on a principal of $100 million for five years and company B pays transactions outstanding with the CCP at any given time. The
LIBOR to company A on the same principal for the same period initial margin required from a participant at any given time
of time. Two separate transactions are created. Company A has reflects the volatility of the value of its total position with the
a transaction with the C C P where it pays 5% and receives LIBOR CCP. The role of a CCP in the O TC market is similar to the
on $100 million. Company B has a transaction with the CCP role of a clearing house in the exchange-traded market. The
where it pays LIBOR and receives 5% on $100 million. The two main difference is that transactions handled by the CCP are
companies no longer have credit exposure to each other. This is usually less standard than transactions in the exchange-traded
illustrated in Figure 18.2. If one or both parties to the transac­ market so that the calculation of margin requirements is more
tion are not members of the CCP, they can clear the transaction complicated.
through members.
The key advantage of clearing a transaction through a CCP
Three large CCPs are is that O TC market participants do not need to worry about
the creditworthiness of the counterparties they trade with.
1. SwapCIear (part of LCH Clearnet in London),
Credit risk is handled by the C C P using initial and variation
2. ClearPort (part of the CM E Group in Chicago), and margin.
3. ICE Clear Credit (part of the Intercontinental Exchange).
A CCP requires its members to contribute to a default fund.
A CCP requires its members to provide initial margin and varia­ (As mentioned, if one or both parties to a transaction are not
tion margin for the transactions being cleared. Typically, the members of the CCP, they can clear the transaction through
initial margin is calculated so that there is a 99% probability that members. They will then have to post margin with the mem­
it will cover market moves over five days. This protects the CCP bers.) If a member fails to post margin when required, the
from losses as it tries to close out or replace the positions of a member is in default and its positions are closed out. In closing
defaulting member. out a member's positions, the C C P may incur a loss. A waterfall

Chapter 18 Regulation of the OTC Derivatives Market ■ 297

defines who bears the loss. The order in which the loss is funded initial margin for the portfolio is likely to be less than that for the
is usually as follows: two transactions separately.

1. The initial margin of the defaulting member

2. The default fund contribution of the member Events of Default

3. The default fund contributions of other members Derivatives transactions are treated differently from other
4. The equity of the C C P 6 transactions in the event that a market participant fails to
meet its obligations. For exam ple, in ISDA master agreem ents
This is similar to the way losses in the event of a default are
there is an early termination provision that takes precedence
funded by an exchange clearing house.
over bankruptcy rules. This states that, if there is an "event of
default," the non-defaulting party has the right to term inate
all transactions with the defaulting party after a short period
Bilateral Clearing
of time has elap sed .7 Events of default include declarations of
In bilateral clearing, each pair of m arket participants enters bankruptcy, failure to make payments as they are due, and
into an agreem ent describing how all future transactions failure to post collateral when required.8 Non-derivative con­
between them will be cleared. Typically this is an ISD A tracts cannot always be term inated in this way. Another
m a ster a g re e m e n t. (ISDA is short for International Swaps important difference between derivatives transactions and
and D erivatives A ssociation.) An annex to the agreem ent, non-derivatives transactions is that in the case of derivatives
known as the c re d it s u p p o rt a n n ex (CSA ), defines collateral transactions the non-defaulting party can take immediate
arrangem ents. In particular, it defines what collateral (if any) possession of any collateral that has been posted by the
has to be posted by each side, what assets are acceptable as defaulting party. It does not have to get a court order to allow
collateral, what haircuts will be applied, and so on. The main it to do this.
body of the agreem ent defines what happens when one side
If there is an event of default under an ISDA master agree­
defaults (e.g ., by declaring bankruptcy, failing to make pay­
ment, the non-defaulting party calculates the mid-market value
ments on the derivatives as they are due, or failing to post
of outstanding transactions. It then adjusts this valuation in
collateral when required). We will discuss this in more detail
its favor by half the bid-offer spreads on the transactions for
shortly.
the purposes of calculating a settlem ent amount. This adjust­
ment is compensation for the fact that it will have to trade with
other dealers to replace the transactions and it will be subject
Netting to their bid-offer spreads when it does so. Suppose that one
We discussed netting in connection with the Basel I rules in the transaction has a mid-market value of $20 million to the non­
section "N etting." Netting is a feature of ISDA master agree­ defaulting party and that the transaction is bid $18 million,
ments and a feature of the agreements between CCPs and offer $22 million. For the purposes of settlem ent, the trans­
their members. It states that all transactions between two action would be valued at $22 million because this is what it
parties are considered to be a single transaction when would cost the non-defaulting party to replace the defaulting
(a) collateral requirements are being calculated and (b) early party's position in the transaction. If the non-defaulting party
terminations occur because of a default. As explained in the had the other side of the transaction so that its mid-market
section "N etting," netting reduces credit risk because it means value was —$20 million, it would be valued at —$18 million for
that the defaulting party cannot choose to default on transac­ settlem ent purposes. In this case, the assumption is that a third
tions that are out-of-the-money while keeping transactions that party would be prepared to pay only $18 million to take the
are in-the-money. defaulting party's position.

Netting can also save initial margin. Suppose Party A has two
transactions with a CCP that are not perfectly correlated. The
7 The non-defaulting party is not obliged to terminate transactions.
Counterparties that are out-of-the-money sometimes consider that it is
in their best interests not to terminate.
8 Failure resolution mechanisms have been proposed where transactions
6 In some cases, the non-defaulting members are required to provide are stayed (i.e., not terminated) for a period of time even if there is a
additional default fund contributions when there is a default, with a cap bankruptcy filing, provided margin/collateral continues to be posted.
on the amount of these additional contributions. (This is true of both These would allow the derivatives portfolios of bankrupt market partici­
exchange clearing houses and CCPs.) pants to be unwound in an orderly way.

298 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
18.2 POST-CRISIS REGULATORY provides regulators with important information on the risks
being taken by participants in the O TC market. It is partly a
CHANGES response to the AIG fiasco where regulators were not aware
of the huge risks being taken by a subsidiary of AIG until
The O TC derivatives market was considered by many to have
the insurance company asked to be bailed out.
been partly responsible for the 2008 credit crisis. When the G20
leaders met in Pittsburgh in September 2009 in the aftermath of The first two of these requirements apply only to transactions
the 2008 crisis, they wanted to reduce systemic risk by regulat­ between two financial institutions (or between a financial insti­
ing the O TC market. The statement issued by the leaders after tution and a non-financial company that is considered to be
the meeting included the following paragraph: systemically important because of the volume of its O TC deriva­
tives trading). Derivatives dealers can therefore continue to
All standardized O TC derivative contracts should be
trade with many of their non-financial corporate clients in the
traded on exchanges or electronic trading platforms,
same way that they did pre-crisis.
where appropriate, and cleared through central coun­
terparties by end-2012 at the latest. O TC derivative About 25% of O TC transactions were cleared through CCPs pre­
contracts should be reported to trade repositories. crisis and the remaining 75% were cleared bilaterally. As a result
Non-centrally cleared contracts should be subject to of the new rules, these percentages have flipped so that approx­
higher capital requirements. We ask the FSB and its rel­ imately 75% of O TC transactions are now cleared through CCPs,
evant members to assess regularly implementation and while 25% are cleared bilaterally.
whether it is sufficient to improve transparency in the
derivatives markets, mitigate systemic risk, and protect
against market abuse. Uncleared Trades
The results of this were three major changes affecting O TC Following another G20 meeting in 2011, the rules have been
derivatives: tightened for non-standard O TC derivatives. These are the

1. A requirement that all standardized O TC derivatives be derivatives that are not covered by the rules just mentioned.

cleared through CCPs. Standardized derivatives include They are cleared bilaterally rather than centrally and are referred

plain vanilla interest rate swaps (which account for the to as uncleared trades. Regulations, which are being imple­

majority of O TC derivatives traded) and default swaps on mented between 2016 and 2020, require uncleared trades

credit indices. The purpose of this requirement is to reduce between two financial institutions (or between a financial insti­

systemic risk (see Business Snapshot 21.1). It leads to deriv­ tution and a non-financial company that is considered to be

atives dealers having less credit exposure to each other so systemically important) to be subject to rules on the margin that

that their interconnectedness is less likely to lead to a col­ has to be posted. Previously, one of the attractions of bilateral

lapse of the financial system. clearing was that market participants were free to negotiate any
credit support annex to their ISDA master agreements.
2. A requirement that standardized O TC derivatives be traded
on electronic platforms. This is to improve transparency. The The rules state that both initial margin and variation margin must
thinking is that, if there is an electronic platform for matching be posted for uncleared trades by both sides. Variation margin
buyers and sellers, the prices at which products trade should was fairly common in the O TC market pre-crisis (particularly in
be readily available to all market participants.9 The platforms trades between derivatives dealers), but initial margin was rare.
are called swap execution facilities (SEFs) in the United When entering into a transaction with a much less creditworthy
States and organized trading facilities (OTFs) in Europe. In counterparty, a derivatives dealer might insist on the counterparty
practice, standardized products, once they have been traded posting initial margin. But the posting of initial margin by both
on these platforms, are passed automatically to a C C P sides was almost unheard of in the bilaterally cleared market.

3. A requirement that all trades in the O TC market be Variation margin is usually transmitted directly from one coun­
reported to a central trade repository. This requirement terparty to the other. Initial margin when posted by both sides
cannot be handled in this way. If, for example, A transmitted
$1 million of initial margin to B and B transmitted $1 million of
9 An issue here is that the type of electronic platform that is appropriate initial margin to A, the initial margin would not serve the desired
for swaps may not be the same as the one that is used by exchanges. purpose because the transfers would cancel each other. For this
Swaps are traded intermittently with large notional principals. Futures
and options on an exchange trade continually and the size of trades is reason the regulations require initial margin to be transmitted to
usually much smaller. a third party, where it is held in trust.

Chapter 18 Regulation of the OTC Derivatives Market ■ 299

Determination of Initial Margin: SIMM To calculate the incremental effect on initial margin of gamma
risk, SIMM first considers the situation where all deltas are zero
For the new rules on uncleared transactions to work, the two and there is no cross gamma. The mean and standard deviation
sides to an ISDA master agreement must agree on the varia­ of the change in the value of the portfolio over one day are:
tion margin and initial margin. The variation margin requires
agreement on the valuation of outstanding transactions, e (a p )
and procedures have been established for resolving any dis­
agreements on this. The calculation of initial margin is more S D (A P ) = p27.Y.G20 2
r !J 7 V
I J
complicated than valuing the transactions and there is more
scope for different models to give different results. As a result
where y i s the gamma with respect to the /th risk factor.
there have been attempts to develop an industry standard.
Estimates of the mean and standard deviation of portfolio
Initial margin is specified in the regulations for portfolios of change over 10 days are obtained by replacing a ; with VTOer,-.
uncleared transactions between two parties as the gain in value Defining
over 10 days that we are 99% certain will not be exceeded in
stressed market conditions. Note that initial margin is the mirror C . = —y. (\ f\ 0 a ■
i 2 '\ i
image of VaR. When we are calculating VaR, we are determining
extreme percentiles of the loss distribution, but when we are the mean, m, and standard deviation, s, of the 10-day change
calculating initial margin we are determining extreme percen­ are therefore given by
tiles of the gain distribution. This is because exposure increases
as the uncollateralized value of a portfolio increases.

The Basel Committee proposed a grid approach for calculating

initial margin, which specified initial margin as a percentage of
notional principal for different types of transactions. This was
unpopular because it did not incorporate netting. If a market SIMM then sets
participant entered into a certain transaction on Day 1 and an IM(Gamma) = m +
almost offsetting transaction on Day 5, both with the same
counterparty, the initial margin on Day 5 would be almost The parameter A in this equation is (see Problem 18.14) defined
double that on Day 1— even though the net exposure to the in terms of
counterparty would be close to zero. ISDA proposed what is
known as the Standard Initial Margin Model (SIMM) as a way
of overcoming this. This model has now been approved by
regulators.
as indicated in Figure 18.3. This relationship produces results
Delta and vega risks are handled using the weighted sensitivities that have the right properties and correspond closely with tests
and risk weights so that carried out using Monte Carlo simulation.

In n

IM (Delta and Vega) = j

ll /=i y=i

where the W, is the risk weight for risk factor / (specified by the
regulators), 8, is the sensitivity of the position held to risk factor /
(determined by the bank), and is the correlation between
risk factors / and j (specified by the regulators). Because a
10-day time horizon with 99% confidence is used, a possible
formula for VV(- is

Wj = VlO x N~\ 0.99)o 7 (18 ^

where cr, is the daily volatility (or standard deviation, in the case
of interest rates, credit spreads, and volatilities) of the /th risk
factor in stressed market conditions. F ig u re 1 8 .3 Relation b e tw e e n A and /3.

300 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
There are a number of other details in SIMM. To 100
simplify matters, gamma is calculated from vega A < (§ > B
using the relationship between the two that holds ◄

for European options. Risk factors are divided into

buckets, and some risk factors involve term struc­
tures with vertices. There are rules specified for
calculating the correlations p ti both within buckets
and between buckets.

18.3 IMPACT OF THE E x p o s u re E x p o s u re

CHANGES E x p o s u re after a fter n ettin g a fter n ettin g
D ea lve r bilateral n ettin g D ealer in clu d in g C C P e x c lu d in g C C P

The new regulations have led to a world where A 0 A 120 0

B 100 B 120 120
more collateral is required for O TC derivatives
C 20 C 90 90
transactions. Pre-crisis, most O TC transactions
Average 40 Average 110 70
were cleared bilaterally and an initial margin was
usually not required. Under the new regulations, F ia u re 1 8 .4 E x a m p le w h e re th e re are th re e m arket p articip an ts,

most transactions will be cleared through CCPs one CCP, and tw o p ro d u ct ty p e s. O n e p ro d u ct ty p e (re p re se n te d by

where both initial and variation margin will be d o tte d lines) can be cle a re d ; th e o th e r (re p re se n te d by solid lines)

required from both sides. Furthermore, transac­ cann ot.

tions that are cleared bilaterally between financial

institutions will require even more collateral than are three market participants and one CCP. For example, in B's
they would if they could be cleared through CCPs. dealings with A, the nonstandard transactions are worth 100 to

As discussed by Duffie and Zhu, there is one potential partial B and —100 to A ; the standard transactions are worth +50 to A

offset to the huge increase in collateral requirements mandated and —50 to B.

by the new rules.10 Under central clearing there is the potential Without central clearing, the average exposure before collateral
for more netting. In Figure 18.1, under bilateral clearing a mar­ of the three parties is +40. With central clearing, the average
ket participant has many different netting sets, one for each of exposure is 110 when the exposure to the C C P is included and
the other market participants. Under central clearing, there is 70 when it is not. Central clearing is likely to increase the col­
only one netting set. Bank A can, for example, net its transac­ lateral market participants have to post in this simple situation.
tions where Bank B is the counterparty with its transactions This happens because without the central clearing rules stan­
where Bank C is the counterparty, provided that all go through dard transactions can be netted with nonstandard transactions,
the same CCP. but with the central clearing rules this is no longer possible.

Figure 18.1, however, is a simplification. It suggests that the Most experts think that there will be an increase in netting,
choice is between a 100% bilateral world and a world where but the overall effect of the changes will be an increase in
all transactions are cleared through a single CCP. The reality is margin requirements. Pre-crisis, relatively few O TC derivatives
that (a) there will be a number of CCPs and it is quite likely that attracted initial margin. Post-crisis, the vast majority of O TC
they will not cooperate with each other to reduce initial margin derivatives will require initial margin. A related consideration is
requirements, and (b) some transactions will continue to be that, as more transactions are cleared through CCPs, more of
cleared bilaterally; so banks will face a situation that is a mixture the funds of a financial institution will be tied up in default fund
of the two worlds depicted in Figure 18.1. contributions.

It is even possible that the new rules requiring the use of CCPs
could reduce rather than increase netting in some cases. This is
Liquidity
illustrated by Figure 18.4, which shows the situation where there
Most of the collateral required under the new regulations will
have to be in the form of cash or government securities. An
10 See D. Duffie and H. Zhu, "Does a Central Counterparty Reduce increasingly important consideration for all derivatives market
Counterparty Risk?" Review of Asset Pricing Studies 1 (2011): 74-95. participants is therefore liquidity. Not only will the collateral

Chapter 18 Regulation of the OTC Derivatives Market ■ 301

posted at any given time be a drain on liquidity, but banks will new collateral was posted.11 In other words, each item of collat­
have to keep a sufficient quantity of liquid assets on hand to eral was used on average four times. Rehypothecation will be
ensure that they are able to meet any margin calls. (Margin calls restricted under new rules developed by the Basel Committee
from a CCP have to be met almost immediately.) As we saw in and the International Organization of Securities Commissions
Chapter 22, Basel III has recognized the importance of liquidity (IOSCO). These rules allow initial margin to be rehypothecated
by proposing two new liquidity ratios that banks must adhere to. once, but only if certain conditions are satisfied. Variation margin
Capital has in the past been the key metric in determining the can be rehypothecated. But increasingly dealers themselves
profitability of different business units and different projects at impose restrictions on rehypothecation because they do not
a bank. In the future, a two-dimensional metric involving capital want to be disadvantaged in the same way that some of
and liquidity is likely to be used. Often there will be a trade-off Lehman's counterparties were (see Business Snapshot 18.1).
between capital and liquidity in that a project will look attractive
from a capital perspective and unattractive from a liquidity per­
spective, or vice versa.
The Convergence of OTC and
Exchange-Traded Markets
The developments we have been discussing are blurring the
Rehypothecation distinction between O TC derivatives and exchange-traded

Liquidity pressures are likely to increase because of another derivatives. Many O TC transactions are now traded on platforms

post-crisis change. What is known as "rehypothecation" was similar to exchanges and cleared through organizations simi­
lar to exchange clearing houses. As time goes by, more O TC
common in some jurisdictions (particularly the United Kingdom)
pre-crisis. (See Business Snapshot 18.1.) It involved a dealer transactions are likely to be classified as "standard" so that the

using collateral posted with it by one counterparty to satisfy a percentage of O TC transactions handled similarly to exchange-

collateral demand by another counterpart. It is estimated that traded transactions will increase. What is more, even those

pre-crisis about $4 trillion of collateral was required in derivatives O TC transactions between financial institutions that are cleared

markets, but that because of rehypothecation only $1 trillion of bilaterally may begin to look more like exchange-traded transac­
tions. This is because margin has to be posted with a third party,
and we can expect organizations (somewhat similar to exchange
clearing houses) to be set up to facilitate this.
BUSINESS SNAPSHOT 18.1 It is also the case that exchanges are increasingly trying to offer
REHYPOTHECATION less standard products to institutional investors in an attempt
A practice in the management of collateral known as rehy­ to take business away from the O TC market. As a result, while
pothecation can cause problems. If Party A posts collateral O TC markets are moving in the direction of becoming more like
with Party B and rehypothecation is permitted, Party B can exchange-traded markets, exchange-traded markets are moving
use the same collateral to satisfy a demand for collateral in the opposite direction and becoming more like O TC markets.
from Party C; Party C can then the use the collateral to Many CCPs and exchanges have a common ownership and will
satisfy a demand for collateral from Party D; and so on. In find areas for cooperation on margin requirements and business
2007, it was estimated that U.S. banks had more than practices. W hether a transaction is being cleared through an
$4 trillion of collateral, but that this was created by exchange or a C C P may not be important in the future because
using $1 trillion of original collateral in conjunction with it will be handled in the same way by the same organization.
rehypothecation. Rehypothecation was particularly com­
mon in the United Kingdom, where title to collateral is
transferred. 18.4 CCPS AND BANKRUPTCY
After Lehman declared bankruptcy in Septem ber 2008,
The key objective of regulators is to reduce systemic risk. Some
clients (particularly European hedge fund clients) found it
commentators have criticized the new derivatives regulations as
difficult to get a return of the collateral they had posted
replacing too-big-to-fail banks by too-big-to-fail CCPs.
with Lehman because it had been rehypothecated. As a
result of this experience, many market participants are
more cautious than they used to be, and clauses in CSAs
11 See M. Singh and J. Aitken, "The (Sizable) Role of Rehypothecation in
banning or limiting rehypothecation are now common. the Shadow Banking System," Working Paper, International Monetary
Fund, 2010.

302 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
It certainly would be a disaster for the financial system if a major variation margin to be posted by both sides. Nonstandard trans­
CCP such as LCH Clearnet's SwapCIear and CM E's ClearPort actions between financial institutions will continue to be cleared
were to fail.12 In theory, as described in Hull (2012), it is possible bilaterally, but are subject to regulation on the collateral that
to design the contract between CCPs and their members so that must be posted. Specifically, transactions between financial
it is virtually impossible for a C C P to fail. In practice, it is consid­ institutions are subject to initial margin (segregated) and varia­
ered important that a CCP has "skin in the gam e." It is then tion margin (transferred from one side to the other when the
motivated to take good decisions with respect to key issues value of outstanding transactions changes).
such as whether a new member should be admitted, how initial
What will the derivatives world look like in 15 or 20 years? Pres­
margins should be set, and so on.
ent trends indicate the there will be a convergence between
The main reason why it makes sense to replace too-big-to-fail O TC and exchange-traded markets, and the distinction between
banks by too-big-to-fail CCPs is that CCPs are much simpler the two will become blurred. But it should be acknowledged
organizations than banks. They are therefore much simpler to that there is no certainty that this trend will continue. The O TC
regulate than banks. In essence, regulators need ensure only market as it existed before the crisis was very profitable for a
that the C C P follows good practices in (a) choosing members, few large banks. It is possible that they will chip away at the reg­
(b) valuing transactions, and (c) determining initial margins and ulations so that they are able eventually to find a way of creating
default fund contributions. In the case of banks, a myriad of dif­ a new O TC market somewhat similar to the one that existed
ferent, much more complex activities must be monitored. It is before the crisis. A battle is likely to take place pitting the deter­
of course important for regulators to ensure that C C Ps are not mination of regulators against the ingenuity of banks.
allowed to become more complex organizations by expand­
ing outside their core activity of intermediating derivatives
transactions. Further Reading

Basel Committee on Banking Supervision and IO SCO .

SUMMARY "Margin Requirements for Non-Centrally Cleared Derivatives,"
September 2013.
Prior to the 2007-2008 credit crisis, the over-the-counter (OTC)
derivatives market was largely unregulated. Two market partici­ Duffie, D., and H. Zhu. "Does a Central Counterparty Reduce
pants could agree to any transaction they liked and then reach Counterparty Risk?" R eview o f A s s e t Pricing Stu d ies 1 (2011):
any agreement they liked on how the transaction would be 74-95.
cleared. They were also free to choose any arrangements they Hull, J . "C C P s, Their Risks, and How They Can Be Reduced."
liked for the posting of collateral. This is no longer the case. Jou rn al o f D erivatives 20, no. 1 (Fall 2012): 26-29.
The O TC derivatives market is now subject to a great deal of
Hull, J . "The Changing Landscape for Derivatives." Jou rn a l o f
regulation throughout the world. The extent to which the O TC
Financial En gin eerin g 1, no. 2 (2014).
derivatives market should be blamed for the crisis is debatable,
but post-crisis regulatory changes are having more effect on this Hull, J. "O TC Derivatives and Central Clearing: Can All Transac­
market than on almost any other sector of the economy. tions Be Cleared?" Financial Stability Review 14 Ouly 2010): 71-89.

Most standard O TC derivatives between two financial institu­ Singh, M., and J . Aitken. "The (Sizable) Role of Rehypothecation
tions must be cleared through central counterparties. These in the Shadow Banking System ." Working Paper, International
are very similar to exchanges. They require initial margin and Monetary Fund, 2010.

12 See J. Hull, "CCPs, Their, Risks, and How They Can Be Reduced,"
Journal of Derivatives 20, no. 1 (Fall 2012): 26-29.

Chapter 18 Regulation of the OTC Derivatives Market ■ 303

Capital Regulation
Before the Global
Financial Crisis
Learning Objectives
After completing this reading you should be able to:

Explain the motivations for introducing the Basel Compare the standardized internal ratings-based (IRB)
regulations, including key risk exposures addressed, approach, the foundation IRB approach, and the advanced
and explain the reasons for revisions to Basel regulations IRB approach for the calculation of credit risk capital under
over time. Basel II.

Explain the calculation of risk-weighted assets and the Calculate credit risk capital under Basel II utilizing the IRB
capital requirement per the original Basel I guidelines. approach.

Describe measures introduced in the 1995 and 1996 Compare the basic indicator approach, the standardized
amendments, including guidelines for netting of credit approach, and the advanced measurement approach for
exposures and methods for calculating market risk capital the calculation of operational risk capital under Basel II.
for assets in the trading book.
Summarize elements of the Solvency II capital framework
Describe changes to the Basel regulations made as part for insurance companies.
of Basel II, including the three pillars.

By M ark Carey o f the G A R P Risk Institute.

305
Financial regulation has developed incrementally over the cen­ • Customers of failed financial institutions were unhappy (at the
turies, often in response to stressful periods which exposed the very least) when large fractions of their wealth disappeared.
limitations of previous regulations. Fraud was not uncommon, but even when a failure was not
associated with fraud, customers complained of unfairness
In the days before government regulation, banks or insurance
and of the difficulty of adequately monitoring a financial insti­
companies could be created without official approval. Success
tution's safety-and-soundness.
(or failure) was based primarily on whether they could persuade
clients to use their services. • Globalization was the fourth trigger of regulation ,and espe­
cially of international coordination of regulation. Central
As such, these businesses have often found it essential to
banks have facilitated international transfers and capital
establish trustworthy reputations. They did this by enlisting
movements for centuries. As international trade blossomed
the support of prominent people in the community, carrying
in the 1960s and 1970s, and as multinational corporations
large amounts of capital at creation, and constructing promi­
became more numerous, foreign exchange flows and capital
nent buildings. These measures provided comfort that deposits
flows grew ever larger.
would be returned and claims paid as promised. Later, govern­
ments required new financial institutions to obtain a license Multinationals valued financial service providers who operated
before being allowed to operate in many countries, which gave rise to several issues.

Financial institution failures were frequent, and sometimes • First, large financial firms, especially international banks,
occurred not because of insolvency but because of a loss became interlinked, so a failure of one would cause problems
of client confidence. When losses occurred, clients naturally in many countries, not just its home country.
attempted to withdraw funds from the institution in question. • Second, as described further below, banks and regulators
When these withdrawals grew into a run or panic, even a solvent became concerned about competitive (dis)advantages flow­
institution could fail if it could not liquidate assets or raise new ing from differences in capital requirements across nations.
funds quickly enough. • Third, technical arrangements in clearing and settlement
The first "regulations" were the result of financial firms band­ proved to be important. For example, when Herstatt Bank
ing together to share resources in the event of runs. The Bank failed in the summer of 1974, differences in the required
of England, for example, was originally a private-sector entity delivery times for currencies across countries and time zones
that would provide support to other banks. In addition, early caused large amounts of foreign exchange transactions to fail
clearinghouses were partly arrangements for mutual support. to clear. In turn, this raised concerns about a potential col­
Specifically, clearinghouse members shared financial statements lapse of the global financial system.
with each other and had rights of inspection, and so monitoring It became evident that only official-sector cooperation and
and enforcement of solvency was a part of the arrangements.
coordination could address these risks. As a result, what is now
However, this was done privately. called the Basel Committee on Banking Supervision (BCBS) was
Such private arrangements had several limitations. created 1974, following the Herstatt failure. Perhaps motivated
in part by the perceived success of the BCBS, the International
• If a panic was big enough, no entity without the power to
Association of Insurance Supervisors (IAIS) and the International
print money would have enough resources to support the
Organization of Securities Commissioners (IOSCO) were created
financial system. As a result, government controlled central
in 1994 and 1983, respectively.
banks gradually replaced clearinghouses and private banks as
lenders of last resort.1 This chapter focuses on solvency regulation of banks and insur­

• Governments learned that financial crises imposed large ance companies before the Global Financial Crisis (i.e., before

costs on the economy as a whole (e.g., crises were often fol­ 2009), with a particular attention to the Basel Accord. Later
chapters focus on regulation after the crisis.
lowed by depressions). Desiring stability, governments began
making attempts to ensure that financial institutions were sol­
vent and liquid enough to survive plausible levels of distress.
19.1 THE BASEL ACCORD: BASEL I
Such regulations became more wide-ranging in the wake of
each crisis.
VARIANT
In the late 1980s, the BCBS developed a specification for capital
1 Central banks may operate independently from political interference (solvency) regulation. First published in December 1987, it was
but are usually considered governmental entities. formally agreed in July 1988 fully implemented by the end of 1992.

306 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
This accord, which has come to be known as Basel I, was ini­ The Ratio and Minimum Values
tially agreed upon by the members of the BCBS (roughly, the
Basel I required consolidated banking organizations to maintain2
G10 nations). By the early 2000s, however, it became a de facto
global minimum capital standard. Note that Basel I has no legal
Tier 1 capital > 4%
RWA
standing in and of itself. Rather, nations haven chosen to incor­
porate its standards through domestic law and regulation. and
Total capital > 8%
Two events motivated creation of Basel I. RWA
• First, the growth of cross-border finance continued after Her- Total capital is the sum of Tier 1 capital and Tier 2 capital. By
statt's failure and it was evident that the G10 nations had a design, Tier 2 capital may comprise no more than half of total
common interest in ensuring that banks had enough equity capital. To the extent that Tier 1 capital exceeded 4 percent of
to absorb large losses. risk-weighted assets, the excess could be included with Tier 2
• Second, international banks were competing vigorously in capital to satisfy the second (8%) requirement.
each other's home countries. However, minimum levels of
required capital varied significantly across nations, creating
"Capital"
a perception that banks headquartered in countries with Under the Basel I framework, Tier 1 capital consists of common
low minimums had a com petitive advantage. In response, equity and disclosed reserves (i.e., retained earnings plus some
members of the BCBS decided to develop a global mini­ types of minority interest in subsidiaries) minus goodwill. Later
mum standard to "level the playing field" and avoid a race frameworks include a limited amount of non-cumulative per­
to the bottom. That is, while the Basel Accord was partly petual preferred stock.
about ensuring safety and soundness, negotiations also
In contrast, Tier 2 capital consists of
had an elem ent of maneuvering for perceived competitive
advantage. • loan loss reserves not already allocated to impairment of
particular assets;
The central elements of Basel I are a risk-based capital ratio, a
• undisclosed reserves (including some revaluation reserves); and
minimum level of this ratio, and definitions of the numerator and
denominator. • hybrid instruments (i.e., unsecured, subordinated, not
redeemable at the investor's behest, on which payment
default would not precipitate bankruptcy or resolution, and
The Risk-Based Capital Ratio on which interest or dividend payments could be deferred.)
A goal of Basel I was to ensure that financial institutions would A limit was placed on the proportion of loan loss reserves
have sufficient assets to remain solvent during periods of stress.
allowed into capital (originally 2%, later reduced to 1.25% of
However, the BCBS had to find a way of measuring sufficiency.
RWA). Some kinds of subordinated debt and preferred stock
Since banks differ greatly in size, specifying minimum amounts were in the latter category. In the years after Basel I was imple­
of capital (in dollars, pounds, etc.) would be infeasible. A ratio mented, consultants and investment bankers invented instru­
of capital to the book value of assets (i.e., "leverage ratio"), on ments that would qualify as Tier 1 or Tier 2 capital.
the other hand, would seemingly allow for a universal standard Though never expressed by the BCBS, two assumptions were
that could apply to institutions of all sizes. However, banks can
implicit in these definitions.
also differ greatly in the composition and riskiness of their bal­
ance sheets. • First, preservation of solvency was the job of Tier 1 capital,
whereas Tier 2 capital would provide resources for recapi­
Given the perception that minimums specified in terms of talization of an entity in resolution and reduce the impact of
leverage ratios would disadvantage banks with low-risk port­
failures on depositors.
folios and advantage those with high-risk portfolios, the BCBS
• Second, although general loan loss reserves were often viewed
decided on a risk-based capital ratio (i.e., a ratio of capital to
as covering losses that are likely already embedded in the
risk-weighted assets (RWA)) instead. Moreover, these assets
entity's portfolio but that have not yet occurred, they were not
included not only assets on the balance sheet according to
counted as loss-absorbing capacity that could preserve solvency.
accounting conventions (e.g., loans or securities), but also off-
balance-sheet exposures (e.g., loan commitments) and deriva­
tive exposures. Though crude by modern standards, these 2 The ratios are sometimes referred to as "Cooke" ratios, for Peter
risk-based ratios represented a major innovation at the time. Cooke of the Bank of England.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 307

Table 19.1 Risk Weights by Asset Category

Risk Weight Asset Category

0% Cash; claims on O EC D governments such as bonds issued by the central government; other
instruments with a full guarantee from an O EC D government

20% Claims on O EC D banks and on O EC D public sector entities, such as claims on municipalities or on
Fannie Mae and Freddie Mac

50% Uninsured residential mortgages

100% All other exposures, such as commercial or consumer loans

Risk-Weighted Assets off-balance-sheet exposures (along with as nontraditional on-

balance-sheet exposures such as derivatives).
To make the ratio risk-sensitive, the on-balance-sheet amount of
each type of asset is multiplied by a percentage weight accord­ Traditional off-balance-sheet exposures were converted to a
ing to the risk it poses. The RWA is the sum of such products credit-equivalent amount (i.e., on-balance-sheet equivalent) by
N multiplying by one of the credit conversion factors shown in
RW A = ^ wiAi Table 19.2. The risk weight was then determined by the nature
1=1 of the counterparty.

where w, is the risk weight and A, is the size of the asset. For exam ple, a $100 million five-year loan commitment to an
O EC D municipality would first be converted to a $20 million
In Basel I, the weights are as shown in Table I, which includes a
summary of the assets in each category. In the absence of other credit equivalent, and then be assigned a 20 percent risk

adjustments, the maximum amount that a position could con­ weight. Thus, its contribution to RWA would be only $4 million.

tribute to RWA was the book value of its assets (since the maxi­ With respect to derivatives, Basel I offered authorities in each
mum risk weight was 100 percent). nation a choice between two methods of computing a credit
equivalent amount (this structure was revised in 1995 with the
Implicit in Table 19.1 is a view that no O EC D government would
addition of a maturity bucket greater than five years)
ever default on its obligations as well as that residential mort­
gages and claims on banks are much less likely to impose losses 1. Current Exposure Method:
than a typical bank loan. Though these assumptions appear
a. First, calculate the current market value of the contract
unreasonable today, they were consistent with what was experi­
V. If the current market value is negative (making it a
enced in the decades preceding Basel I.3
liability rather than an asset), set V = 0.
b. Second, add an amount D to account for changes in the
Example 19.1: contract's future market value. For interest rate swaps,
D was
The assets of a Canadian bank consist of C$200 million of loans
i. zero for for maturities of less than one year,
to corporations, C$100 million of Canadian central government
ii. 0.5% of the notional value of the swap for remaining
bonds, C$100 million of residential mortgages insured by the
maturities of five years or less; and
central government, and C$100 million of uninsured residential
iii. 1.5% for more than five years.
mortgages. Though the book value of assets is C$500 million,
c. For foreign exchange swaps, D was
the sum of risk-weighted assets is C$250 million since
i. 1% of notional value for maturities of less than one
RWA = 100% X 200 + 0% x 100 + 0% x 100 + 50% X 100 = 250 year,
ii. 5% of notional value for maturities between one and
Though the concept of RWA was natural for traditional five years, and

balance-sheet exposures, banking organizations also had many

iii. 7.5% of notional value for maturities greater than
five years.
2. Original Exposure Method (only for interest rate and foreign
exchange contracts)
3 Implicit in the beneficial treatment of sovereign debt is the expectation
that governments can print money to address potential defaults. This a. Nations could ignore the current market value of the
assumption does not hold when debt is borrowed in foreign currencies,
or where a national government is not fully in control of its own mone­ contract and choose whether to use the original or
tary policy, as could be the case in the European Monetary Union today. remaining maturity.

308 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 19.2 Credit Conversion Factors for Traditional Off-Balance-Sheet Exposures
Credit Conversion Factor Off-balance-sheet Category

100% Guarantees on loans and bonds, bankers acceptances, and equivalents

50% Warrantees and standby letters of credit related to transactions

20% Loan commitments with original maturity greater than or equal to one year

0% Loan commitments with original maturity less than one year

b. For interest rate contracts, D was Netting

i. 0.5% for maturities of less than one year,
A market convention is that entities engaged in over-the-counter
ii. 1% for maturities between one and two years, and
derivatives transactions sign an International Swaps and Deriva­
iii. 1% + 1% X IN T [M — 1 ] for maturities greater than
tives Association master agreement specifying that, in the event
two years respectively4
of a default by a counterparty, the defaulting entity's transactions
c. For foreign exchange contracts, D was
with each other counterparty could be considered as a single
i. 2%, for maturities of less than one year,
transaction. Choices in these agreements permit bilateral trans­
ii. 5%, for maturities between one and two years, and
actions with positive and negative values to offset one another.
iii. 5% + 3% X IN T [M — 1]fo r maturities of greater
than two years For exam ple, Bank A might enter an interest rate swap to buy
Equity and commodity derivatives were not discussed in Basel I. protection from Bank B against an increase in interest rates, and
The risk weight was set according to the nature of the counter­ later enter another swap with an identical notional amount with
party, except that no risk weight could be more than 50%. The Bank B to sell protection. If rates did not move in the interim
1995 Amendm ent included add-on factors for such derivatives. between these two agreements, their combined impact on
Bank A's (and Bank B's) net exposure and portfolio value is zero.
The 1995 and 1996 Amendments ("Market Risk Amendment")
Put bluntly, the handling of derivative exposures in Basel I was However, the original Basil I allowed almost no capital credit for
crude. However, as Basel I was being developed, the 1987 stock netting. Though changes in interest rates would have offsetting
market crash had not yet occurred, value-at-risk (VaR) was not in effects on the market value of the two swaps in the previous
widespread use, and quantitative market risk management was example, the treatment in the original Basil I would apply an
in its infancy. By 1995, all of this had changed. add-on to each swap, disincentivizing hedging. The rationale
for this was that (as of 1988) master agreements had not been
Example 19.2: sufficiently tested in bankruptcy courts.

By 1995, the members of the BCBS were more confident that

The derivatives book of an international bank contains $300 mil­
such agreements would function as intended and thus the 1995
lion of notional value of interest rate swaps with $100 million
Amendment allowed reductions in credit equivalent amounts
each having remaining maturity of 0.5, 1.5 and 2.5 years. Their
when enforceable bilateral netting agreements were in place.
market value is $30 million.
In calculating credit equivalent amounts, the complete net­
The book also has $300 million of foreign exchange swaps with
ting of the market values of all positions was allowed for each
a similar maturity profile and a market value of -$10 million.
counterparty i, and add-ons Dj for future changes in value were
All counterparties are private corporations, so the risk weight is reduced for each category of derivative j
100 percent. Under the exposure method described above, the
credit equivalent amount would be: C E A = m a x 0 + ^^[0.4 * Dj + 0.6 * Dj * N R R ]
CE = 30 + 0% x 100 + 0.5% x 200 + 1% x 100 + 5% x200 i =1 ./
= $42 million where NRR (i.e., the net replacement ratio) is

Under the original exposure method, it would be m a x ( Z i = i V t , 0)

N R R =

£ f=1 max(l/j, 0)
CE = 0.5%x 100+ l% x 100 + 2% x 100 + 2% x 100 + 5% x 100
The numerator is the market value of positions of type j with net­
+ 8%x 100= SI8.5 million
ting, while the denominator is the market value with no netting.
Note that the net replacement ratio is an average across all posi­
tions; although add-on factors and the impact of netting may differ
4 where INT[X] returns the closes integer to X. across types of derivatives, the impact of the latter is ignored.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 309

Example 19.3 Credit Equivalent Am ount for Derivatives
Suppose a bank has a portfolio of five derivatives with two counterparties, as described in the following table

Counterparty Type Maturity Notional Market value Add-on factor

1 Interest rate 2 100 -5 0.5%

1 Interest rate 3 100 0 0.5%

1 Foreign exch. 2 200 10 5%

2 Equity option 6 100 0 10%

2 W heat option 0.5 300 -1 0 10%

With netting, the current exposure portion of the credit equiva­ The standardized approach details separately for five categories
lent amount is 5 for the first counterparty (i.e., the —5 exposure of positions:
on the first interest rate derivative is netted against the 10 expo­
• fixed income securities and interest rate derivatives other
sure on the foreign exchange derivative) and 0 for the second,
than options, for which remaining maturity was a key driver;
for a total of 5. Note that current exposure may not be less than
• equity securities and equity derivatives other than options;
zero, and the —10 market value on the wheat option may only
be netted against positive exposures at the second counter­ • foreign exchange;
party, not at the first counterparty. • commodities; and

In this case, NRR = 0.5 because the numerator of NRR is the • all types of options.
current exposure of 5 and the denominator is the sum of the These approaches were relatively simple for some categories,
positive exposures (i.e., 10). while for others there were many operational complexities (e.g.,
The add-on for potential future exposure must be calculated the separate treatment of sp e cific risk and g en eral m arket risk,
separately for each type of derivative, multiplying the total where the latter is due to general movements in market prices
notional value for each type by the add-on factor to obtain and the former is driven by idiosyncratic changes in a specific
values of Dj. For the interest rate derivatives, 200 X 0.5% yields position's value).
a value of 1, while for the remaining types in the table D is 10, The internal models-based approach embodied a major change
10, and 30 for the foreign exchange, equity, and wheat types, in philosophy by permitting banks to use internally developed
respectively. Applying the formula for C E A risk measures as the inputs to formulas specified by regulators.
CEA = 5 + (0.4* I+0.6* l *.5) + (0.4* 10+0.6* 10*.5) + (0.4* 10+0.6* 10*.5) To limit manipulation of the internal measures, monitoring was
+ (0.4*30+0.6*30*.5) = 5 + .7 + 7 + 7 + 21= 40.7 built in. In contrast, the standardized approach specified most of
the details and was based on observable characteristics of posi­
tions (e.g., remaining maturity).

Capital for Market Risks Associated with Trading Under both approaches, capital charges were calculated sepa­
Activities rately for specific risk (SR) and general market risk (MR) for each
of the five categories. These were summed and multiplied by
While market risk (i.e., changes in market value of trading
12.5 so that the usual multipliers on risk weighted assets could
book assets) is the primary risk for the trading book, it was not
also be applied to them 5
captured by the requirements described previously. The 1996
Amendment to Basel I offers two ways to measure of for market Total capital for trading assets = 0.08 * 12.5£y=1(MR; + S R j)
risk: a standardized approach and an internal models-based
approach. To measure market risk, a bank using the internal models-based
approach must calculate value-at-risk (VaR) for each asset
For banks with trading books of material size, the internal
models-based approach was preferred because it generally
yielded smaller capital requirements. This is in part due to the
5 12.5 is the inverse of 8%. The multiplier has the effect of turning a
fact that asset values were not assumed to be perfectly corre­ capital requirement into an RWA measure. This adjustment is based on
lated, as they were in the standardized approach. the total capital requirement rather than Tier 1 adjustment.

310 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
category. A 10-day VaR at the 99th percentile was required, 19.2 THE BASEL ACCORD: BASEL II
based on at least one year of daily data, usually using a scaled
one-day VaR multiplied by V 10. Correlations within a category
VARIANT
of position were considered by the internal model, whereas
Some supervisors had become concerned by the mid-1990s that
adjustments for correlations across categories were allowed at
Basel I, while more risk-based than capital requirements based
the discretion of the national supervisor.
on equity-to-asset ratios, was not risk-based enough. The 100
Thus, market risk was given by percent risk weight, for example, incorporated exposures pos­
MR = max(VaRt-i, m*VaRavg) ing a wide range of risk, from very safe loans made to highly-
rated corporations to very risky loans to commercial real estate
where VaRavg was the average VaR over the past 60 days and m development projects.
was a multiplier that was never less than 3 (and could be larger
Moreover, banking crises in the Nordic countries had dem­
if national supervisors found deficiencies in the bank's models
onstrated that systemic problems could occur even in well-
or other systems, or if monitoring implied other deficiencies.)
capitalized banking systems. Meanwhile, there had been several
Given a multiplier of 3, the second term was usually larger
technical advances in market and credit risk measurement and
than the 10-day VaR computed for the preceding business day
management since 1987, signaling a potential for more precise
(i.e., t — 1).
risk weighting and vastly improved risk management at all levels
Capital for specific risk, which was required for fixed income, of banking organizations.
equity instruments, and derivatives, could be determined using
Basel II was the reaction to such concerns. Discussions among
either the standardized approach or the bank's internal models.
supervisors about a revised accord began in the late 1990s
In the latter case, the approach was similar to that for market
and the "final" revision was published in 2004 (further revisions
risk, but the multiplier was 4 rather than 3 and capital for spe­
occurred frequently in the years that followed).
cific risk could not be less than half of capital calculated using
the standardized approach.6 While retaining much of Basel I, Basel II contained four signifi­
cant innovations:
The 1996 Amendment created a new class of capital (i.e., Tier 3
capital), composed mainly of unsecured subordinated debt with 1. Risk weight formulas for credit risk based on modern
an original maturity of at least two years, that could be used to credit risk management concepts and banks' internal risk
meet part of the market risk capital requirement. However, only measures;
about 70 percent of the market risk capital requirements could
2. Required capital for operational risk, in addition to credit
be satisfied with Tier 3 capital.
risk and market risk.
The 1996 Am endm ent specified several qualitative criteria
3. In addition to minimum capital requirements (Pillar 1), Basel
that banks using the internal m odels-based approach must
II included specific requirements for supervision related to
m eet (e .g ., sound risk m anagem ent, independent risk man­
capital and risk management (Pillar 2) and required public
agem ent units, lim its, active involvem ent of the board, and
disclosures (Pillar 3).
so on).
4. Repeated use of Quantitative Impact Studies (QIS) to fine-
It also required daily back testing. Each day, for each model,
tune the design of the accord. In each QIS, banks contrib­
the bank was required to use its current model and procedures
uted detailed data which was then analyzed by supervisors.
to calculate one-day 99% VaR for each of the most recent 250
days, and to compare the actual loss for the day to the VaR. Although the first two innovations have received the most
Each day with actual loss larger than VaR was termed an e x c e p ­ attention from the public, the three pillars represented a major
tion. Five or less exceptions enabled the multiplier m to be 3, development as well. Through the early 2000s, regulatory phi­
but larger numbers of exceptions could lead to larger multipliers losophy differed across nations, ranging from supervision-heavy
at the discretion of the supervisor. With 10 or more exceptions, approaches (in which rules played much less of a role than the
a multiplier of 4 was required. judgment of field supervisors) to rules-heavy approaches (in which
regulators presented detailed rules and field supervisors focused
on evaluating compliance with the rules). Moreover, at the time of
Basel II development, disclosures of bank condition and risk also
6 Thus, as a practical matter, a bank using internal models was also varied widely across nations. For example, banks in some nations
required to calculate capital under the standardized approach. did not disclose Basel I capital ratios or risk weighted assets.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 311

The three pillars represented a push toward convergence of The Standardized Approach
national practices. Specifically, Pillar 2 mandated that supervi­
As under Basel I, the Basel II standardized approach was
sors require banks to have more than the minimum amount of
intended for banks with internal risk measures and risk man­
capital as well as internal capital adequacy and assessment pro­
agement practices that were insufficient to support the IRB
cesses (ICAAP) that take their risk profile into account. Supervi­
approaches. However, the risk weights were somewhat more
sors were to assess bank ICAAPs and were to act if they were
sensitive to variations in risk. Under Basel I, the headline risk
not satisfied. Additionally, supervisors were to intervene early if
weights depended on asset type and nationality of the obligor.
there was danger that a bank's capital would fall below the mini­
Under the Basel II standardized approach, the headline risk
mum by requiring prompt corrective actions. Supervisors were
weights depended on obligor type and rating for some obli­
also to encourage banks to improve risk management practices
gor types, and on asset type for others. Examples appear in
and to actively push for improvement of deficiencies. National
Table 19.3:
discretion regarding enforcement of the accord's provisions was
reduced, and national regulators were to be transparent about Although the risk weights appear less generous for banks and
their implementation efforts, including those concerning the sovereigns than was the case under Basel I (e.g., the ratings of
requirements in excess of the minimums. many banks and sovereigns were such that risk weights of 20 or
50 percent or more would apply), much of the generosity was
Pillar 3 required more qualitative and quantitative disclosures,
restored at national discretion:
in the hope that pressure from market participants would help
improve banks' practices. Qualitative disclosures included • A supervisor could choose to apply risk weight of 0 on a
aspects of corporate structure, applicability of the accord and bank's holding of claims on its own sovereign debt that were
approaches used, accounting practices, and other matters. issued in the nation's own currency. Where a supervisor
Meanwhile, quantitative disclosures included many characteris­ exercises such discretion, banks in other nations could also
tics of a bank's capital, exposures, and risk measures. risk-weight claims on that sovereign at 0%. This option was
widely exercised.
However, some found the requirements difficult to interpret and
disclosure practices remained uneven for many years, until addi­ • Claims issued by banks had a risk weight of one category

tional clarity (and pressure) was provided by the Basel Committee. less favorable than the sovereign's (and capped at 100%) or
a risk weight based on the bank's own ratings, (or one cat­
egory more favorable where the obligation had no more than
Capital for Credit Risk
3 months' original maturity, subject to a floor of 20%). Risk
At Basel II was developed, supporting data and analysis weights on bank obligations could be capped at 100 percent.
remained limited, and many supervisors were concerned that
The Standardized Approach included two ways of adjusting for
banks would manipulate internal risk measures to reduce collateral. Under the "simple approach," which was similar to
required capital. Negotiators addressed such concerns by
Basel I, the risk weight of a counterparty could be replaced by
including three options for determination of minimum capital
the risk weight of collateral for the portion of exposure covered
requirements for credit risk:
by the collateral. A minimum risk weight on the collateral was
1. The standardized approach. Like Basel I, this included some set at 20 percent, unless the collateral was sovereign debt in the
increased sensitivity of risk weights to credit quality for bor­ same currency as the exposure.
rowers with external ratings.7
The alternative "com prehensive approach" required changes in
2. The Foundation Internal Ratings-Based (IRB) approach. exposure and collateral amounts to allow for possible changes
Here, risk weights were sensitive to internal measures of in the value. The risk weight of the collateral was applied to
default probability, with the use of regulatory-specified loss the reduced amount of collateral, and the counterparty's risk
given default parameters. weight was applied to the remaining exposure. Any netting
3. The Advanced IRB approach. Risk weights were sensitive to was applied separately to exposures and collateral, and either
internal measures of default probability, loss given default, Basel rules or (approved) internal models could be used to
and exposure at default. make the adjustments.

7 The United States chose not to implement the Standardized Approach. The IRB Approach
Internationally active banks were required to use IRB approaches, while
all other banks were required to use an updated version of the Basel I The Gordy (2003) "asym ptotic single risk factor" model of
requirements. credit losses, now more commonly referred to as a one-factor

312 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 19.3 Risk Weights Under the Standardized Approach
Obligation of: A A A to A A - A + to A — BBB+ to B B B — BB+ to B B — B-f- to B — Unrated

Countries 0 20 50 100 150 100

Banks 20 50 50 100 150 50

Corporation 20 50 100 100 150 100

Obligation type:

Retail 75

Mortgage 35

Cash 0

Other 100

Gaussian copula model, was an expression of the thinking that Because the Basel Committee did not view loan loss reserves
led to the IRB Approach.8 The paper demonstrates that in as Tier 1 capital, and yet loan loss reserves were thought to be
large, well-diversified credit portfolios, a positive relationship approximately equal to expected losses, the Committee chose
exists between the probability of default of an obligor and that to make capital a function only of unexpected losses (i.e., net
obligor's contribution to the capital needed to limit the proba­ of expected losses). In cases where loan loss reserves are less
bility of portfolio losses exceeding a percentile of the than EL, a reduction in capital is made for the shortfall. See
loss distribution. Figure 19.1 for a depiction of the capital for total stress losses,
expected losses, and unexpected losses.
Using the Basel Committee's choices of a one-year time horizon
for credit losses and a desire that capital be enough to absorb This setup allowed the Basel Committee to specify a loss per­
losses up to the 99.9th percentile of the credit loss distribution, centile and an asset correlation p for each type of asset.10 Each
the formula is: individual asset's contribution to capital at any bank would then
Capital = £ [ EA D t * LGDj * D R 99.9i\ - E L depend only on the bank's estimates of EAD , LGD and PD for
that asset.
where
Basel II included two variants of the IRB approach:
• Capital is expressed in dollars;
• Foundation IRB, in which the bank would provide only the
• EADj is the exposure at default for asset i (i.e., the amount
PD, with the accord specifying values of EAD and LGD for
expected to be owed by the counterparty on asset i at the
each class of asset; and
time of default);
• Advanced IRB, in which the bank would provide all three
• LGD, is the expected loss given default for asset i (i.e., the
values.
fraction of EAD, that is expected to be lost);9*
Earlier work had found that, at least in the United States, most
• DR99.9j is the default rate at the 99.9th percentile for a large
large banks had internal rating systems that could be used to
portfolio of assets of type i. Gordy's research provides a for­
obtain a PD for each loan.11 Thus, supervisors expected that
mula for DR99.9
Foundation IRB would be feasible for most large banks. The lim­
yfp N ~ 1(0.999) ited available data on EAD and LGD made it likely that fewer
D R99.9i = N N- ' i PDt ) +
V 1 ~ P
banks would be able to use Advanced IRB.

• EL is the expected loss (i.e., the expected mean annual credit

loss) on a portfolio and is given by
10 For large banks, with diversified portfolios representative of the mar­
E L = 'Z[EAD i * LGDt * P D t] ket, correlations were not expected to differ very much across banks. An
assumption is made that exposures are infinitely granular and that no
individual credit could affect the overall loss metrics. The development
of the Large Exposure Framework in 2014 was necessary when banks
8 Gordy, M. B., 2003, A risk-factor model foundation for ratings-based were found to have sizable exposures to single counterparties.
capital ratios, Journal of Financial Intermediation 12, 199-232. 11
Carey, Mark S., and William F. Treacy, 1998, Credit risk rating at large
9 In the United States, the historical average LGD value was around 0.3 U.S. banks, Federal Reserve Bulletin, November.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 313

 period and may have deteriorated in credit
quality. The maturity adjustment factor is

b (M - 2.5)
MA = 1 +
1 - 1.5 b

where MA is remaining maturity of the asset and

b = [0.11852 - 0.05478ln(PD)]2

Com bining all the elem ents discussed previ­

ously, and recalling that Basel II expressed
required capital in term s of risk-weighted assets,
the RWA for bank, corporate and sovereign
exposures is

RWA = 12.5 * EAD * LC D * (DR-PD) * MA

Under Foundation IRB, PD can be no lower than

F iq u re 19.1 Loss distribution, expected and unexpected loss, and .0003 for bank and corporate exposures (implicitly
capital. it can be zero for sovereigns). LGD is 45 percent
for senior assets and 75 percent for subordinated
Even Foundation IRB made capital quite risk-sensitive, as shown assets. When an asset is protected by collateral, the comprehen­
in Table 19.4, which shows the values of DR given by the formula sive approach discussed earlier is applied (i.e., LGD is reduced
for different values of PD and p at the 99.9th percentile. by the ratio of adjusted collateral to adjusted exposure. MA is
set to 2.5 in most cases.
Bank, Corporate, and Sovereign Exposures As mentioned previously, values of PD, EAD , LGD and MA
Under IRB
under the Advanced IRB are given by the bank based on its own
For bank, corporate and sovereign exposures, Basel II assumes data, models, estimates and analysis.
that p and PD are related based on the work of Lopez (2004)12
For example, suppose that a bank's assets consist only of $100
1 — e x p {—50PD ) 1 — e x p (-S O P D ) million BB-rated drawn loans with a remaining maturity of 3
p = 0.12 + 0.24 1 -
1 — e x p {—50) 1 — e x p {—50) years. PD is estimated to be 0.01 and the LGD is 30 percent.
Then
The formula implies that p decreases as PD increases, which
MA=1/(1-1.5*0.137) = 1.26
agrees with the idea that the determinants of default for very
high-risk borrowers are often rather idiosyncratic, whereas DR is 0.14, so RWA = 12.5*100*.3*(0.14—0.01 )*1.26 =
middle-risk borrowers tend to default mainly when the mac­ $61.4 million.
roeconomy is distressed (i.e., middle-risk borrowers are more
Under Basel I, RWA would have been $100 million, and under
likely to default together). That defaults of the safest borrowers
the Basel II standardized approach RWA would have also been
are also rather idiosyncratic is ignored, but this does little harm
$100 million.
because values of DR for them are sma

The effect of the specified relationship between p and PD is that

DR increases somewhat less quickly with PD than in Table 19.4. Retail Exposures Under IRB
The capital calculation for bank, corporate and sovereign expo­ For retail exposures, only a treatment like the Advanced IRB
sures also includes a maturity adjustment to account for the approach is used (i.e., banks provide internal estimates of PD,
fact that assets with more than 1 year of remaining maturity will LGD and EAD). However, there is no maturity adjustment.
remain on the balance sheet at the end of the loss-forecasting Rather, three correlations are used: p = 0.15 for residential
mortgages; p = 0.04 for qualifying revolving assets (mostly
credit card balances), and for all other retail assets
12 Lopez, J., 2004, The empirical relationship between average asset
1 — e x p (—35PD) 1 — e x p (—35PD )
correlation, firm probability of default, and asset size, Journal of Finan­ p = 0.03 + 0.16 1 -
cial Intermediation 13(2), 265-283. 1 — e x p (—35) 1 — e x p {—35)

314 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 19.4 DR Values for different combinations of PD and p

PD = 0.001 PD = 0 .0 0 5 PD = 0.01 PD = 0 .0 2

p — 0.0 0.001 0.005 0.01 0.02

p = 0.2 0.028 0.092 0.146 0.226

p = 0.4 0.071 0.211 0.316 0.449

p — 0.6 0.135 0.387 0.542 0.705

That is, correlations are lower for retail than for wholesale years of negative gross incom e.13 This could be a material
exposures. amount of capital, given that gross income is usually far
larger than net income. However, this approach is relatively
Like the previous example, suppose a bank has
easy to implement and may be chosen by banks that do not
$100 million of residential mortgages with a PD = .01
expect to be constrained by capital requirements.
and an LGD of 30 percent. DR is 0.09 rather than 0.14, so
RWA = 12.5*100*.3*(0.09 - 0.01) = $30 million. This is less 2. Standardized Approach: Like the basic indicator approach,
than Basel I's $50 million for such a portfolio and the Basel II but different multipliers are applied to gross income from
Standardized Approach's value of $35 million. different business lines.

3. The Advanced Measurement Approach (AMA): Internal

models are used to calculate a one-year VaR-like measure of
Credit Mitigants Other Than Collateral
operational risk losses at the 99.9th percentile. Operational
A credit substitution approach is used to handle arrangements risk capital is this amount less expected operational losses.
like guarantees and credit default swaps. Under this approach, This approach allows recognition of risk mitigants such as
the credit rating of the guarantor is substituted for that of the insurance under some circumstances.
obligor in capital calculations, up to the amount covered by the
mitigant.

However, this approach is not quite generous enough relative E x a m p le 1 9 .4 Capital for the Basic Indicator and
to the actual loss outcomes, given that a double default (both Standardized Approaches ($billions)
guarantor and borrower) is implied in the treatment. How­ The table above provides an example of a bank's gross income
ever, Basel II assumes relatively low correlations of wholesale for each of the eight business lines specified in the Standardized
counterparty defaults, meaning that double defaults should be Approach over a period of three years. It also shows the opera­
infrequent. tional risk capital levels each year for each business line under
As an alternative, in 2005 the Basel Committee amended the the Standardized Approach, which are obtained by multiplying
accord to allow capital without the mitigant to be multiplied by gross income times the business-line-specific multiplier.
0.15 + 160*PDg, where PDg is the one-year PD of the guarantor. Negative capital may offset positive capital within a year, but
years for which total estimated capital is negative are ignored in

Capital for Operational Risk computing the three-year average. Thus, under the Standard­
ized Approach, operational risk capital in this example would be
The Basel Com m ittee defined o p era tio n a l risk as the risk of (8.73 + 9.69)72 = $9.21 billion.
loss resulting from inadequate or failed internal processes,
people and system s, or from external events. In the wake of
rogue trader losses at Barings Bank in the mid-1990s, the
possibility of large losses from sources other than credit or 13 The definition of "gross income" provided by the BCBS for
market risk became more concrete. Basel II implemented the first quantitative impact study was: Net interest income
(interest received minus interest paid) + net fees and commissions
capital requirements for operational risk, permitting three
(fees and commissions received minus fees and commissions paid)
approaches: + net trading income + gross other income. Income should be reflected
gross of any provisions (e.g. for unpaid interest) and gross of any opera­
1. Basic Indicator Approach: 15 percent of the bank's average tional costs and losses. Income should exclude extraordinary or irregular
annual gross income over the past three years, ignoring any items and also income derived from insurance.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 315

 Business Line Multiplier Gross Income Capital

Year 1 Year 2 Year 3 Year 1 Year 2 Year 3

Corporate Finance 18% 5 3 6 .90 .54 1.08

Trading & Sales 18% 1 -5 3 .18 - .9 0 .54

Retail Banking 12% 20 25 30 2.40 3.00 3.60

Commercial Banking 15% 30 40 35 4.50 6.00 5.25

Payment & Settlement 18% 2 3 -100 0.36 0.54 -1 8 .0 0

Agency Services 15% 1 1 1 0.15 0.15 0.15

Asset Management 12% 1 2 2 0.12 0.24 0.24

Retail Brokerage 12% 1 1 2 0.12 0.12 0.24

Sum 61 70 -2 1 8.73 9.69 - 6 .9 0

Under the Basic Indicator approach, total gross income for each The BCBS requires the inclusion of both expected and unex­
year is multiplied by 15 percent, (again ignoring years of nega­ pected losses, and that the overall program use internal data
tive total gross income) and so the capital requirement in this (at least five years of experience), external data, scenario analy­
example would be 0.15*(61 + 70)/2 = $9.83 billion. sis, and a consideration of the business environment and the
bank's controls. Though each supporting element need not be

Some Details of the AMA Approach included directly in calculations, the overall process must include
all four. Moreover, a bank must make a convincing argument
Banks using the AM A approach are expected to estimate a dis­ that its process can capture bad-tail events and, if it chooses to
tribution of operational risk losses in seven categories that incor­ assume that losses across business lines and loss categories are
porates estimates of both the incidence of operational loss anything but perfectly correlated, it must convincingly defend
events and their severity.14 its correlation assumptions. A bank may offset at most 20 per­
AM A methodologies vary widely across different banks, but two cent of the operational risk capital charge with insurance, and
broad approaches are most popular: only insurance arrangements that meet stringent requirements
are acceptable.
• A parametric and Monte Carlo approach, in which data are
used to parameterize the bank's choice of probability dis­ In recent years, required capital for operational at some banks
tribution for incidence (e.g., Poisson) and for severity (e.g., risk was a material fraction of total required capital, in part
Weibull). These distributions are then used to produce large because the internal loss data that was required to be used
numbers of simulated loss observations from which the value under the AM A included many large penalties for compliance
at the 99.9th percentile can be read; and/or failures, scandals, or misbehavior. As a result, the AM A approach
• Generate a moderate number of detailed scenarios in which has lost favor and is no longer permitted.
losses occur, and then measure operational losses in each
scenario. Separate scenario analyses are often conducted for
each category of operational losses. Scenario analysis has the
Solvency II
advantage of generating informative narratives and being Minimum capital requirements also exist for insurance compa­
forward-looking. However, the number of data points gener­ nies in many nations. Though international standards do not yet
ated is usually small and it is not obvious how to best convert exist, sophisticated approaches have been implemented in the
such data into losses at the 99.9th percentile. As a result, many United States and the European Union.
banks use a combination of scenario and parametric methods.
In the mid-1990s, the U.S.-based National Association of Insur­
ance Commissioners (NAIC) promulgated a capital standard that
14 The categories are: Clients, Products and Business Practices; Execu­
anticipated some elements of Basel II. In addition to capital
tion, Delivery and Process Management; External Fraud; Internal Fraud;
Damage to Physical Assets; Employee Practices and Workplace Safety; requirements covering the risks associated with liabilities, capital
Business Disruption and System Failures. is required for risky assets at levels that depend on ratings

316 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
assigned by the NAIC to each asset.15 Insurance regulation is at Also similar to Basel II, requirements may be satisfied by a com­
the state level in the United States, but most states have imple­ bination of Tier 1 capital (equity, retained earnings, and equiva­
mented these requirements. lents), Tier 2 capital (liabilities subordinated to policyholders and
available for write-off in liquidations), and Tier 3 capital (subor­
In Europe, regulation of insurance companies is done by the Euro­
dinated to policyholders but not satisfying the other criteria for
pean Union's (EU) European Insurance and Occupational Pensions
Tier 2).
Authority (EIOPA). The first capital regulations at the EU level were
known colloquially as Solvency I, which has recently been replaced
by Solvency II. More than 10 years in the making, Solvency II
resembles Basel II in that many elements of its capital requirements
SUMMARY
are based on a one-year VaR concept (at the 99.5th percentile) and
This chapter has provided an overview of internationally agreed
it has three pillars (quantitative requirement, internal governance
capital requirements that were created before the Global Finan­
and official supervision, and disclosure and transparency). Under­
cial Crisis. The 1988 Basel Accord (Basel I) introduced risk-based
writing risk, credit and market risk, and operational risk are all
capital requirements, while the 1995 and 1996 amendments
considered. Underwriting risk is further subdivided into risks arising
introduced much more sophisticated treatments of netting and
from life insurance, property & casualty, and health insurance.
market risk than had been previously available.
Solvency II also has elements found in Basel III (see Chapter ##),
Basel II introduced additional approaches to capital for credit
such as required buffers of capital above the minimum amount.
risk that were much more risk-sensitive and more aligned with
If an insurance company breaches Solvency ll's minimum capital
modern credit risk management analysis. It also introduced
requirement (MCR), supervisors may prevent the stressed firm
two new pillars in addition to quantitative capital requirements:
from writing new policies or put it into resolution (e.g., a sale to
supervision and disclosure.
a stronger company, or liquidation). The required buffer above
the MCR is defined by the solvency capital requirement" (SCR)
less the MCR. If the SCR is breached, the insurance company
References
should present a plan for capital restoration, and the supervisor
might impose additional requirements. Bank for International Settlements, 2006, "Basel II: International
Solvency II includes both standardized and internal model-based Convergence of Capital Measurement and Capital Standards."
approaches to calculating the SCR. Internal models must satisfy
Bank for International Settlements, 1988, "International conver­
three criteria. gence of capital measurement and capital standards."
• First, the data and methodology must be sound. Carey, Mark S., and William F. Treacy, 1998, Credit risk rating at
• Second, risk assessments must be calibrated to be in accor­ large U.S. banks, Federal Reserve Bulletin, November.
dance with target criteria set by the regulator.
Gordy, M. B., 2003, A risk-factor model foundation for ratings-
• Finally, the model must be used in actual business based capital ratios, Journal of Financial Intermediation 12,
decision-making. 199-232.

Lopez, J ., 2004, The empirical relationship between average

15 Unlike at banks, liabilities are a major source of risk at insurance com­
panies, since most insurance policies are liabilities for the insurer and asset correlation, firm probability of default, and asset size,
variation in claim amounts has the potential to impose large losses. Journal of Financial Intermediation 13(2), 265-283.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 317

Solvency, Liquidity,
and Other
Regulation After
the Global Financial
Crisis
Learning Objectives
After completing this reading you should be able to:

Describe and calculate the stressed VaR introduced in Describe the motivations for and calculate the capital con­
Basel 2.5 and calculate the market risk capital charge. servation buffer and the countercyclical buffer, including spe­
cial rules for globally systemically important banks (G-SIBs).
Explain the process of calculating the incremental risk
capital charge for positions held in a bank's trading book. Describe and calculate ratios intended to improve the
management of liquidity risk, including the required lever­
Describe the comprehensive risk (CR) capital charge for
age ratio, the liquidity coverage ratio, and the net stable
portfolios of positions that are sensitive to correlations
funding ratio.
between default risks.
Describe the mechanics of contingent convertible bonds
Define in the context of Basel III and calculate where
(CoCos) and explain the motivations for banks to issue them.
appropriate:
Tier 1 capital and its components Explain motivations for "gold plating" of regulations and
Tier 2 capital and its components provide examples of legislative and regulatory reforms
Required Tier 1 equity capital, total Tier 1 capital, and that were introduced after the 2007-2009 financial crisis.
total capital

By M ark Carey o f the G A R P Risk Institute.

319
The financial crisis that began in the summer of 2007 revealed converted to VaR by multiplying by v 10). During periods of
limitations and gaps in the existing solvency and liquidity regula­ low volatility, such a practice causes measured VaR to gradually
tions. It also revealed market practices and product designs that decline because all or nearly all of the historical observations
proved ill-suited to stressed environments. Global regulators have small changes in value. When volatility rises again, as it did
reacted with more restrictive regulations and supervision and in 2007 for many assets, VaR from historical simulation was slow
with more coordination across nations. to follow because most historical observations were from a low-
volatility period.

20.1 THE FINANCIAL The Basel Committee introduced a requirement for use of
stressed-VaR measures to counter such tendencies. Rather
STABILITY BOARD than drawing daily observations from the most recent historical
period, a bank is required to identify the one-year (i.e., 250 day)
The Financial Stability Forum, a body that undertook occa­
period from the most recent seven years that was most stress­
sional studies, was reconstituted as the Financial Stability
ful for its current p ortfolio. Because this will be the sub-period
Board (FSB) in the wake of the financial crisis. The FSB is com­
with the highest fraction of portfolio-weighted large declines
posed of representatives from finance ministries, central banks,
in value, the resulting 1-day VaR will be relatively large and will
prudential regulators, securities regulators, and others from
not change much as time passes (unless a period of low volatility
dozens of nations.
persists for 7 years).
Although organizations like the Basel Com m ittee and IO SCO
Stressed VaR was combined with the traditional VaR measure in
appeared to retain their independence and authority, as a
an expanded formula
practical matter the FSB became the body in which many
changes in international standards were approved. Later, as MR 2.5 - max(VaRt-i, m,*VaRaVg) + max(SVaRt-i, ms*SVaRavg)
the regulatory tsunami receded, the FSB's began to focus on
where VaR,..-! and VaRavg are the traditional 10-day, 99 percent
other matters.
VaR calculated by drawing from the the previous day and the
average of the 60 most recent days, respectively. SVaR^ and
SVaRavg are calculated by drawing from the equivalent times
20.2 BASEL 2.5 during the most stressful period in the past seven years. The
multipliers mr and ms must be at least 3 as under the 1996
Market prices of financial assets fell sharply during 2007-2009. In
Amendment.
addition, many assets not already illiquid became so, the sound­
ness of securitizations was doubted, and many hedging strate­ Because the definition of the stress period is such that the
gies failed. It was clear that minimum capital charges under the most recent period cannot be more stressed than the stressed
market risk amendment were inadequate for the trading-book period, and the charges based on traditional and stressed VaR
risks revealed during the crisis. are summed, MR2 5 must be at least twice as large as MR cal­
culated under the 1996 Am endm ent as long as the multipliers
The Basel Committee responded with updated rules for capital
are equal.
for the trading book, making three major changes:

1. VaR calculations were expanded to include a stressed-VaR

component; Incremental Risk Charge
2. Capital for incremental risk was added (roughly capturing
The incremental risk charge (IRC) combines two strands of
the jump-to-default risk);
work, one released in 2005 as a reaction to regulatory arbitrage
3. C om preh en sive risk capital requirements were added for opportunities between the banking and trading book, and the
securitizations and related instruments. other released in the wake of the crisis.
These changes were implemented by the end of 2011. Although the specific risk charge was intended to capture
default risk (as well as other sources of idiosyncratic risk), banks
had learned by the early 2000s that even with the specific
Stressed VaR
risk charge, most banking-book exposures had smaller capital
Most banks computed capital under the market risk amend­ requirements in the trading book than in the banking book.
ment using historical simulation, (i.e., 1-day VaR was computed Thus, many illiquid instruments posing default risk were placed
by drawing daily changes in value from recent history and then in the trading book.

320 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
To remove this incentive, the Basel Committee proposed adding Table 20.1 C o m p re h e n siv e Risk C ap ital C h a rg e
an incremental default risk charge (IDRC). Two variants were U n d er th e S ta n d a rd ize d A p p ro a ch
proposed:
<BB,
• An internal model of default risk calibrated to the same AAA, AA A BBB BB unrated
99.9th percentile at a one-year horizon as the Committee's Securitizations 1.6% 4% 8% 28% 100%
IRB approach
Re-securitizations 3.2% 8% 18% 52% 100%
• Or, in the absence of such a model, either a "standardized"
or a "current exposure" approach that had some similarity to
Basel I capital charges for specific risk. The Basel Committee addressed this issue by replacing the IRC
As a practical matter, capital in the trading book would be the and specific risk charge with a comprehensive risk (CR) charge
greater of market risk capital and banking book capital.1 for the correlation book. Under the new rules, banks may use a
standardized approach (summarized in Table 20.1) that depends
Late in the crisis, however, the Committee had realized that
only on the rating of the instrument. (Note that percentages are
most losses in portfolio value associated with credit risk had
capital as a fraction of the exposure, not risk weights.)
been due to changes in ratings, credit spreads, or liquidity, not
defaults. As a result, the scope of the proposal was increased to Because re-securitizations (for which the underlying pool of
include changes in ratings. The same 99.9th percentile was used, assets are the tranched liabilities of securitization vehicles) are
but in addition to defaults, banks were required to estimate more vulnerable to changes in correlations, capital requirements
losses associated with rating downgrades. Portfolio credit qual­ are much higher for them. Meanwhile, tranches rated below BB
ity is held approximately constant by an assumption that any are the most exposed to losses in the underlying pool (i.e., in
position that is downgraded or that defaults is replaced by a effect they must be financed entirely with capital).
position with the same pre-downgrade rating. A loss is recorded Banks may also use an internal model to estimate the CR
from sale of the downgraded or defaulted position. The period charge if approved to do so by supervisors, though the model-
over which replacement could occur differs across positions based charge may not be less than a fraction of the charge
according to their liquidity but is never less than three months.1
2*• under the standardized approach. Given the com plexity of
the underlying instruments and the rationale for using an
Correlations and the Comprehensive internal model, which often includes the capture of hedges
with more sophistication than the standardized approach, the
Risk Measure
internal models must be unusually com plete, complicated and
An assumption embedded in Basel II is that the correlation robust. Multiple default and rating change events; volatility
parameter in the Gordy (2003) model is constant across obli­ in correlations and credit spreads; basis risk (e.g., the differ­
gors and over time (though not across types of assets). This ence between CDS and underlying index values); the dynamics
assumption is reasonable for portfolios of debt instruments of hedges; and volatility in recovery rates must be modeled,
for purposes of determining banking-book capital, but not ideally with simulations that revalue the whole portfolio for
for instruments in the correlation b o o k (e.g., securitizations, each iteration of a simulation.
re-securitizations and derivatives written on securitizations).

Such instruments place a portfolio in a special-purpose vehicle

and create tranched liabilities that differ in seniority, and thus in
20.3 BASEL 3
their exposure to credit losses in the portfolio. In reality, correla­
In addition to the need for more capital for risks in the trading
tions change over time and such changes can have large effects
book, the crisis revealed many other weaknesses of the Basel II
on the value of tranches For example, the market prices of A A A ­
framework:
rated tranches were consistent with a near-zero probability of
default pre-crisis, but during the crisis market estimates of PD • In the depths of the crisis, market participants cared only
increased significantly and tranche prices fell. about tangible Tier 1 common equity capital (i.e., capital that
could absorb losses and maintain a bank as a going concern).
Many elements of the pre-crisis definition of capital proved
1 See BCBS, The Application of Basel II to Trading Activities and the
Treatment of Double Default Effects, July 2005. limited in their ability to maintain banks as going concerns.

2 See BCBS, Guidelines for computing capital for incremental risk in the • The official sector came to believe that distress at some
trading book, July 2009. banks posed greater threats to society than distress at other

Chapter 20 Solvency, Liquidity, and Other Regulation After the Global Financial Crisis ■ 321
 banks, and that those in the former category should be bet­ The Definition of Capital
ter able to manage distress. Categories of "systemically
important" financial firms were created and embedded in a Basel III eliminated Tier 3 Capital and divided Tier 1 Capital into
wide range of regulatory and supervisory practices. Tier 1 Equity Capital (also known as Core Tier 1 Capital) and
Additional Tier 1 Capital, restricting the former to high-quality
• Risk-based capital ratios were thought to have been too sus­
capital.
ceptible to gaming. Leverage-ratio capital requirements were
needed as a backstop, especially since market participants Minimum capital requirements were also changed: Core Tier 1
who focused only on tangible common equity tended to also must be at least 4.5 percent of risk-weighted assets, and Total
focus only on leverage ratios. Tier 1 (i.e., the sum of Core and Additional Tier 1) capital must

• It was not enough for banks to remain solvent up to the be at least 6 percent of risk-weighted assets. The Total Capital

point of maximum losses - they also had to be able to requirement (Tier 1 plus Tier 2) was left unchanged at 8 percent.

operate as a going concern thereafter, which meant they The components of each category are:
needed substantial capital a fter absorbing the losses.
• Tier 1 Equity Capital includes
In many cases, governments provided capital, but such
provision was unpopular. Buffers of capital above the • common equity,
minimum requirements were needed, as were means of • retained earnings, and
recapitalizing failed banks. • a limited amount of minority interest and unrealized gains
• Entities that were thought to be solvent by regulators nev­ and losses.
ertheless suffered runs and, in some cases, failed. This was Goodwill and other intangibles are deducted, as are deferred
in part because their liquid reserves proved inadequate to tax assets and any shortfall of reserves relative to IRB
cover withdrawn funding and in part because wholesale fund­ expected losses.
ing proved to be unstable. Thus, liquidity requirements were
• Additional Tier 1 Capital includes:
needed.
• Unsecured, unguaranteed, non-cumulative perpetual
• Especially after the failure of Lehman, which did not honor
preferred equity instruments subordinated to depositors and
its commitments as a counterparty in derivative contracts, it
subordinated debt, and callable only after five years or more.
became clear that capital was needed to cover counterparty
• Debt with appropriate triggers that cause conversion to
credit risk.
equity or write-downs.
• In addition, a Large Exposures Framework was created in
• Approved minority interest not included in Core Tier 1.
2014 to set a common global standard to limit exposure
concentrations to a single counterparty, particularly between • Tier 2 capital is designed to absorb losses after failure,
systemically important institutions. Specifically, there limits protecting depositors and other creditors. It includes:
are 25% of capital (and 15% between global systemically • Subordinated debt. Specifically, unsecured, unguaranteed,
important banks). This framework assumes 100% probability debt instruments subordinated to depositors and subordi­
of default and 100% loss given default (after netting and col­ nated debt, with five years or more original maturity, and
lateral adjustments), limited use of models that failed in the
callable only after five years or more.
crisis, and aggregates across wholesale credit, trading and • General loan loss reserves. These are reserves not allo­
other books. LEF also addresses a limitation of the capital
cated to absorb losses on specific positions. Reserves
framework, which does not adjust capital requirements for included in capital are capped at 1.25% of standardized
significant concentrations under either the Standardized
approach RWAs, or 0.6% of IRB RWAs.
Approach or the Gordy Model used in IRB (which assumes
exposures are granular, not concentrated). A number of other deductions are required, such as

Proposals to remedy the deficiencies were published in 2010 • defined-benefit pension plan deficits,

and 2011 and amended in later years.3 • certain cross-holdings within a group, and
• mortgage servicing rights greater than 10 percent of com­
mon equity.
3 BCBS, "Basel III: A global regulatory framework for more resilient Overall, capital requirements were significantly increased rela­
banks and banking systems," June 2011; and BCBS, "Basel III: Interna­
tional framework for liquidity risk measurement standards and monitor­ tive to Basel 2 because minimum ratios were increased, and
ing," December 2010. allowable capital was constricted.

322 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Leverage Ratio Capital Requirements be recapitalized without government assistance. As described
ahead, systemically important firms are often subjected to more
Prior to Basel 3, minimum capital ratios specified by the Basel wide-ranging supervision and regulation.
Committee were expressed as a percentage of risk-weighted
assets (RWA). However, during and after the crisis many observ­
ers felt that RWA had understated the risks borne by banking Buffers
organizations and thus led them to be over-leveraged. Though
As of early 2019, the Basel specifications feature three require­
known weaknesses in the calculation of RWA were addressed,
ments for capital above the minimum fractions of RWA:
the possibility of future mismeasurement remained. Moreover,
during the crisis market participants had focused on simple 1. A 2.5 percent capital conservation buffer (CCB) requirement.
ratios of equity to unweighted assets as they assessed the 2. An additional G-SIB requirement that depends on an
soundness of banking organizations, making risk-weighted ratio organization's score when the Committee applies its
values peripheral to the debates of the time. method to identify G-SIBs. These additions are 1, 1.5, 2,

The Committee's reaction was to introduce a "sim ple" lever­ 2.5 and 3.5 percent.4

age ratio capital requirement as a supplement to the risk-based 3. A Countercyclical Capital Buffer (CCyB) that varies at the
requirements: banking organizations must maintain a ratio of discretion of national supervisors and is between 0 and
Core Tier 1 Capital to Leverage Exposure of 3 percent or more. 2.5 percent.

Leverage Exposure includes both on-balance-sheet assets and The rationales for the buffers differ somewhat. In the case of the
fractions of off-balance-sheet assets (e.g., derivatives or poten­ C C B , the rationale roughly follows that for the Prompt Correc­
tial futures exposures). Though the IFRS and G A A P accounting tive Action (PCA) system built into U.S. capital regulation begin­
standards differ somewhat in their handling of off-balance sheet ning in 1991 (i.e., a bank with ratios that begin to approach the
assets, the Committee's Leverage Exposure measure is specified minimums should be subject to increasingly stringent supervi­
in some detail to promote comparability across nations. sory intervention in order to induce a return to well-capitalized
status). Though the only restrictions formally imposed by the
Committee involve restrictions on dividend payments and
Systemically Important Financial bonuses, as well as a requirement for plans to restore capital
Institutions ratios, supervisors may try to act more broadly as w ell.5

The FSB publishes lists of globally systemically important banks In the case of the G-SIB buffer, the rationale is similar to that
(G-SIBs) and (in cooperation with the IAIS) globally systemically for the C C B but also recognizes the very large costs to society
important insurers (G-SII). Some nations also designate other of distress at G-SIBs (and the higher volatility of losses at some
banks as domestically systemically important (D-SIBs). of them). Thus, larger buffers are specified to further reduce
the chance of failure. A breach of the G-SIB buffer has conse­
Collectively, these and other firms fall into the category of sys­
quences similar to a breach of the C C B.
temically important financial institutions (SIFIs). To determine
whether an entity is a G-SIB, the FSB combines variables that The CCyB has two rationales. One is to provide an instrument
proxy for size, interconnectedness, complexity, international for macroprudential restraint of overheating; the other is atten­
activity and other matters. tive to the cost of capital.

An entity is systemically important if its failure or distress would The overheating rationale posits that higher bank capital
cause substantial problems in the financial system or the real requirements tend to restrict credit supply by banks, and thus
economy. For example, the aftermath of Lehman's failure dem­
onstrated that it was systemically important because many finan­
cial markets were disrupted, and many counterparties suffered 4 The 2018 list of G-SIBs contained 29 entities. Since the list of G-SIBs
because Lehman failed to satisfy its obligations. was first published in 2011, none have been in the 3.5 percent category,
and since 2013 only HSBC and JP Morgan Chase have appeared in the
SI FIs are often presumed to be "too big to fail," but key goals 2.5 percent category.
of reforms include reducing the likelihood of failure while also 5 Supervisors have a range of tools at their disposal and may be
making it possible for any entity to "fail" without disrupting constrained from certain actions when a bank is still meeting its
the financial system or the real economy. Though shareholders minimums. In stressed environments it may be difficult to achieve asset
sales, capital raises, or mergers that provide a remedy to deal with a
likely would be wiped out in a failure and some creditors would weak bank. A failure to meet a buffer is less severe than failing to meet
suffer losses, the goal is for the entity to keep operating and a minimum requirement.

Chapter 20 Solvency, Liquidity, and Other Regulation After the Global Financial Crisis ■ 323
overheating in the credit markets, thereby damping the amplitude K e y C h a n g e s - S ta n d a rd ize d A p p ro a ch
of the credit cycle and perhaps reducing the frequency and sever­ • Risk weights for banks have been adjusted, with one set of
ity of financial crises. A consequence of the overheating rationale weights linked to external rating agencies, and another to
is that computation of the CCyB requirement is complicated for credit risk assessments (i.e., Grade A, B or C) used when
banks with international operations. This is beucase the CCyB may a country does not permit external ratings to be used for
differ across nations, and a bank with operations in several nations capital measures. Range is 20% RWA for A A A up to 150%
will have a consolidated CCyB requirement that is a weighted RWA for lower than B-.
average of the requirements in each nation in which it operates. • Covered bonds (i.e., bonds issued by banks and secured by
The cost-of-capital rationale presumes that a bank's costs of a portfolio of collateral) meeting specific criterial carry a risk
increasing its capital ratio are smaller in good times than in weight of between 10% and 100%.
bad times, which implies that increased financial stability can • Corporate bonds carry risk weights of 20%, 50%, 75%, 100%
be obtained at lower cost by increasing the CCyB during good and 150% tied to ratings. In countries that do not allow
times and reducing it during bad times. Implicitly, this rationale ratings, a 65% risk weight applies to investment grade and
focuses on capital market costs for the entity as a whole, without 100% to non-investment grade. Favorable treatment is pro­
regard to conditions in different nations' credit markets. vided to loans to small and medium enterprises (SMEs).
As a practical matter, different supervisors have given different • Specialized lending has several buckets (e.g., project finance
weights to the two rationales. The consequences of violating or object finance) with detailed definitions and specific risk
the CCyB are similar to those of violating the C C B . However, weights.
because national supervisors can reduce the CCyB at any • Equities have a 400% risk weight (with exceptions) and
time, such consequences can be mitigated by changing the sub-debt or other instruments have a 150% risk weight.
requirement.
• New risk weights were set for real estate tied to loan value
All of the aforementioned requirements apply only to risk-based and type (e.g., retail versus commercial).
capital ratios. In 2017, the Committee introduced a leverage • New credit conversion factors were set for a range of
ratio buffer for G-SIBs as well, equal to one-half of its risk-based off-balance sheet exposures.
G-SIB buffer (not including the C C B or C C yB ).6 Earlier, the U.S.
• A definition of default was added. It includes payments past
had implemented a 2 percentage point leverage buffer require­
due for 90 days, non-accrual assets, write-offs in anticipation
ment for G-SIB consolidated organizations, and a 3 percentage
of default, sale of asset at loss, distressed restructuring, bank­
point buffer for subsidiary banks, for an aggregate minimum of
ruptcy, and inability to pay without recourse to collateral.
5 and 6 percent, respectively. In 2018, the U.S. proposed to
change its G-SIB leverage buffer to half of the sum of C C B and • Treatment of hedges and collateral was expanded into
G-SIB risk-based buffer requirements. significant detail.

Basel III Finalizing the Post-Crisis Reforms K e y C h a n g e s - IRB

• Categories include corporate, sovereign, bank, retail, and
In December 2017, the BCBS finalized a set of reforms that
equity. Within retail there are three subtypes. Five subcat­
include revisions to
egories of specialty lending include project finance, object
a) the standardized approach to credit, finance, commodities, income producing real estate and high
b) the Internal ratings-based approach, volatility real estate.

c) the CVA framework for counterparty credit, • IRB is not permitted for large corporates or banks where
modeling is problematic, given few historical defaults and a
d) operational risk, and
limited number of exposures in the data set.
e) the leveraged ratio.
• Banks must apply IRB to all assets in a given asset class and
In addition, an output floor was introduced to ensure that cannot cherry pick some exposures to be covered under SA
capital calculations under the ratings-based and other modelled alone and IRB for others.
approaches is constrained at not less than 72.5% of the stan­
• Minimum UL risk weights apply for specialized lending.
dardized approach.
Collateral haircuts are applied for secured lending.
• Input floors for LGD calculations are provided for corporates,
6 Though it will not be implemented until 2022. with 25% minimum LGD on unsecured exposures and a

324 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 range of 0% to 15% minimum on secured exposures. Retail a substantial fraction of retail deposits was withdrawn and North­
exposures have a 50% minimum LDG on credit cards, 30% ern Rock's wholesale funding fell. With most of its remaining assets
on other unsecured exposures, and a similar 0% to 15% mini­ illiquid, Northern Rock found itself in imminent danger of being
mum LGD on secured loans. unable to meet further requests for withdrawals. By the following
Monday, the government announced that all deposits would be
guaranteed for all U.K. banks.
K e y C h a n g e s - C V A Risk
• Two approaches are available for calculating CVA risk: Basel 3 addressed liquidity risk by specifying two requirements,
the standardized approach (SA-CVA) and basic approach the liquidity coverage ratio (LCR) and the net stable funding
(BA-CVA). ratio (NSFR).

The LCR is designed to give banks and authorities a month to

K e y C h a n g e s - O p e ra tio n a l Risk manage a crisis by selling liquid assets. The idea is that if the
• The standardized approach replaces existing Basel II bank has more liquid assets than it needs to meet liquidity
approaches for operational risk. Key elements include the demands during the month, it can sell the assets while attempt­
business indicator (Bl) and the Business indicator component ing to restore confidence in itself. To be "liquid," the likelihood
(BIC), which equals the Bl times an Internal Loss Multiplier must be high that the asset can be sold quickly and with little
(ILM) (i.e., a scaling factor based upon historical losses). reduction in price. The requirement is defined as
j rD _ High, q u a l i t y liq u id a s s e t s .
Bl =ILDC + SC + FC L L t x — ---------------------------------------------> 1
N e t cash o u t f l o w s in a 30 d a y p e r i o d

Where ILDC = Min [(Abs(lnterest Income — Interest Expense);

The quantity of a bank's high-quality liquid assets (HQLA) is
2.25% X Income Earning Assets T Dividend Income); SC —
measured by placing assets in categories and applying hair­
Max [Other Operating Income; Other Operating Expense] +
cuts according to the likely availability of buyers at prices near
Max [Fee Income; Fee Expense]; and FC = Abs(Net P&L
normal-times values.
Trading book) + Abs(Net P&L Banking book)
For example, included in HQLA without a haircut are deposits
at central banks and securities issued by central governments
B IC
with a 0 percent risk weight in the standardized approach.
Bucket 1 (under Euro 1 billion) 12%
In contrast, corporate debt and equity have 50 percent
Bucket 2 (1 to 30 billion Euro) 15%
haircuts and individual mortgage loans are excluded from
Bucket 3 (over 30 billion Euro) 18%
HQLA entirely.

ILM Net cash outflows are computed by applying assumptions about

ILM =Ln(exp(l)-l+(LC/BIC)A0.8)) the tendency of different classes of liabilities to be withdrawn in
stress situations, and the tendency credit line holders to draw on
them. For example, only 3 percent of insured retail deposits are
Liquidity Requirements assumed to be withdrawn, whereas that number is 100 percent

Solvent financial institutions can sometimes fail because their for most non-operational wholesale deposits and 30 percent

depositors and counterparties withdraw more rapidly than for undrawn capacity of lines of credit to nonfinancial wholesale

assets can be sold. Regardless of the causes of a run, authorities customers. These examples only scratch the surface of a vast

value having time to diagnose the problem and find a solution, structure of asset/commitment categories and their associated

ideally one not involving government guarantees. percentages. As such, the definition of the LCR is simple but the
implementation is complicated.
During the crisis, perhaps the most notable example of a failure
involving a run was that of Northern Rock. Heavily dependent The NSFR uses a one-year period and is conceptually slightly

on securitization markets to fund its mortgage business, the different, in that it focuses not on what can be sold but rather

bank had trouble finding enough wholesale funding to finance what funding would remain after a stressful year. It is defined as

its pipeline of mortgage loans when securitization became A v a ila b le a m o u n t o f s t a b l e f u n d i n g

N S F R = > 1
difficult. Required a m o u n t o f sta b le f u n d i n g

The trouble began when news broke on September 13 (a

Thursday) that the Bank of England would provide liquidity sup­ 7 At the time, deposit insurance in the U.K. was relatively meaqer (up to
port. In the response to the prospect of government intervention,7 GBP 31,700).

Chapter 20 Solvency, Liquidity, and Other Regulation After the Global Financial Crisis ■ 325
The available amount of stable funding is calculated by Using a 5% runoff rate for the stable retail deposits, a 100%
multiplying the amount in several categories of funding by runoff rate for the one-third of wholesale CDs that mature in the
available stable funding (ASF) factors (which are similar to next month, and a 0% runoff rate for senior bonds and equity,
haircuts). However, these categories are different from those net 30-day cash outflows are 25 + 67 = 92, so
of the LCR. The required stable funding is similarly calculated
LCR = = 2.72
by multiplying amounts in each category of asset by required
stable funding (RSF) factors, where the factor is higher the
Thus, the bank in this example would be in compliance with the
more illiquid the asset (since it cannot be sold as easily when
LCR and NFSR. Note that a very large number of categories,
funding runs off).
factors and haircuts were not discussed in this example and the
The new liquidity requirements represent a major change in liquidity requirements are operationally complex.
bank regulation and management. Prior to the crisis, the pre­
sumption was that regulators would instantly know whether a
bank was solvent or not. If a bank was solvent, central banks Derivatives Counterparty Credit Risk
could immediately provide enough emergency funding until
Banks calculate a credit valuation adjustment (CVA) for
market participants became comfortable with its solvency, each derivatives counterparty, which is the difference in
whereas insolvent banks would be closed immediately. value between a risk-free portfolio of derivatives with that
One lesson of Northern Rock is that provision of funding by counterparty and the actual portfolio. CVA increases with the
central banks can make funding stresses worse, not better, counterparty's credit spread and also changes with the market
and doing so for one bank can destabilize a banking system. value of the portfolio. The component from changes in market
Thus, banks must be much better prepared to survive periods values affects profit, while the component associated with
of funding stress with their own resources. This means that bal­ counterparty credit spreads appears in market risk capital.
ance sheet composition is somewhat constrained, with a smaller
proportion of illiquid assets and a larger proportion of illiquid
liabilities. 20.4 RESOLUTION PLANNING
AND PREPARATION
E x a m p le o f L C R and N S F R
Banks will fail in the future in spite of Basel I, II, III and later
A bank's liabilities consist of USD 500 of stable retail deposits
reforms. To limit the disruptions caused by such failures, the
with 9 months or less remaining maturity, USD 200 of 3-month
FSB agreed in 2014 that national resolution regimes for G-SIBs
wholesale certificates of deposit with one-third maturing each
would have 12 key attributes and that each G-SIB should have
month, USD 200 of 10-year senior bonds with none maturing
sufficient total loss absorbing capacity (TLAC) to enable it to
in the next year, and USD 100 of common equity. A SF factors
recapitalize itself.
for these categories of liability are 95%, 0%, 100%, and 100%,
respectively. Recapitalization might be accomplished by causing convertible
bonds to become equity or by bail-in, in which certain whole­
The bank's assets consist of USD 100 of vault cash, USD 100 of
sale debt liabilities are either written down or converted to
the debt of its sovereign, USD 100 of corporate debt securities
equity. The terms of conversion are written into the indentures
rated BBB in the trading account, and USD 700 of loans to busi­
of convertible bonds and often require conversion when a bank
nesses with more than one year of remaining maturity and risk
appears to be solvent, whereas bail-ins are governed by national
weights of 50% or more. The RSF factors for these assets are
law and details are generally chosen by authorities after they
0%, 5%, 50%, and 85%, respectively. Thus
have seized control of a bank.
475 + 0 + 200 + 100
N SFR = 1.19
0 + 5 + 50 + 595
CoCos
For the LCR, HQ LA factors (1-haircut) are 100%, 100%, 50%,
0%, presuming the supervisory allows inclusion of the corporate Traditionally, convertible bonds were issued by non-financial
debt securities. Note that the corporate debt securities are firms who wished to avoid the dilution of issuing equity before
Level 2 assets, which may not comprise more than 40% of HQLA the firm's performance improved. Such bonds would, at the
after the haircut. This is satisfied since total HQLA is USD 250, of option of the holder, convert into equity when the firm's share
which USD 50 is the corporate debt securities. price exceeded thresholds specified in the indenture.

326 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
For banks, contingent convertible bonds (CoCos) are the mirror Though participating countries are not supposed to promulgate
image: they cause a bank's equity to increase when distress domestic laws and regulations that are less onerous for inter­
occurs, as reflected by triggers written into the indenture, and nationally active banks, they may enact requirements that are
not at the option of the holder. With CoCos, equity increases superequivalent (i.e., imposing a different but higher, or just a
either because the bond converts to equity or because its value higher standard than Basel requires).
is written down.
This approach sometimes acts as a safety valve in the Basel
Triggers have varied somewhat across CoCos, but a common negotiations, allowing those who want stronger standards for
trigger is when the ratio of Core Tier 1 Capital to RWA falls everyone to at least have them domestically, and sometimes it
below a threshold, or when a bank's primary regulator declares reflects a nation's special circumstances. Switzerland's choices
it to be nonviable. CoCos may be included in Additional Tier 1 are in the latter category: as a small country with two huge
Capital if the threshold is 5.125 percent or higher, and Tier 2 G-SIBs, it found itself during the crisis in the uncomfortable situ­
capital otherwise. ation of being unable to recapitalize its G-SIBs should that have
Economically, it is not obvious why the market would price been necessary. Thus, its capital requirements are more onerous
CoCos to make the cost of capital for them less than the cost than those of Basel 3, and in resolution planning it has required
of equity. Because CoCos are debt instruments when issued, the G-SIBs to structure themselves so that domestic opera­
holders receive little or none of the high returns received by tions could continue even if international operations failed. The
equity holders when a bank does well, but holders bear losses United Kingdom has taken a somewhat similar step, requiring

not so different from those of equity holders when a bank fails. that retail operations be ringfenced (i.e., separated from) whole­
Thus, they should be expensive for a bank to issue. But they do sale operations.
have an accounting advantage: because they do not appear in Basel anticipates that in addition to minimum standards, each
the equity account until converted, a bank can report a higher jurisdiction will supervise banks and take other actions to ensure
return on equity. they have adequate capital and liquidity, and strong risk man­
agement and governance. In the U.S., coordinated stress tests

Living Wills based upon supervisory designs and scenarios ensure that banks
have capital and liquidity planning processes, risk management,
In many countries, G-SIBs (and sometimes D-SIBs) are required and sufficient buffers to allow compliance with minimum capital
to prepare detailed resolution plans in which they specify and liquidity standards even in a stressed situation.
how they would fund themselves when distressed, how they
The Federal Reserve's Com prehensive Capital Analysis and
would recapitalize, how they would continue to operate as a
Review (C C A R ), which requires participation by G-SIBs and
going concern even if some subsidiaries failed, and many other
D-SIBs with material operations in the United States, includes
related matters.
a supervisory severe scenario that has been one of the more
severe stress tests. For some banks, C C A R stress testing is

20.5 STRESS TESTING AND OTHER the binding capital constraint, as restrictions on dividend
payments and share buybacks apply if the bank's capital
LOCAL APPLICATIONS OF BASEL ratios fall below the requirem ent minimums after losses in
the "severely adverse" scenario are included. This approach
W hile Basel I, II and III have achieved some level of
requires banks to hold buffers that should allow them to
harmonization across countries, significant differences persist.
meet their minimum capital requirem ents even in stressed
Little effort has been made to fully adjust for differences
scenarios and is consistent with past expectations that
in accounting standards, bankruptcy laws, or other rules or
banks should have a cushion above Basel minimum capital
regulations with differences across countries. Even where
requirem ents. Furtherm ore, that cushion is likely greater
there is agreem ent in Basel, some jurisdictions apply tighter
than in the past.
treatm ents than others. For exam ple, many European
countries treat all banks as internationally active and Similarly, there is a program for liquidity known as CLAR that
subject to Basel rules, while the U.S. considers only its assesses bank stress testing and supervisory provided stress
largest banks as internationally active, with less stringent tests to ensure liquidity buffers are maintained. In 2019, ele­
requirem ents applied to many regional and community ments of CCA R have been relaxed to reduce in future periods
banks that only operate in one or a few states with little the use of qualitative criteria (relating to bank risk management
international activity. and capital planning processes) in judging results.

Chapter 20 Solvency, Liquidity, and Other Regulation After the Global Financial Crisis ■ 327
20.6 OTHER REFORMS consumers of financial products and to curb abuses by finan­
cial firms of all kinds.
A vast array of legislation and regulations was implemented • In the United States, mortgage lenders were required to
across the globe in the decade after 2007. These include: determine whether borrowers have the ability to repay the
loans they take. The legal and financial liabilities associated
• Capacity to conduct macroprudential policy was added
with mistakes in such determinations have caused many
through institutional reforms in some nations where legal
banks to exit the mortgage market.
authority was previously lacking. For example, in the United
States, bank regulators' missions often restricted them to • In the United States, large banks were required to have
consider only the soundness of individual banks, not the board risk committees where at least one member has risk
financial system as a whole. The Financial Stability Oversight management experience at a large financial firm.
Council (FSOC) was created to take a more macropruden­ • In the United States and the European Union, issuers of secu­
tial view, though its legal authority was somewhat limited. ritizations were required to retain at least 5 percent of each
In the United Kingdom, the Financial Policy Committee was tranche, in an attempt to better-align the incentives of issuers
created at the Bank of England, with some power to take and investors.
macroprudential policy actions and to recommend others to
Parliament.
• Pre-crisis compensation practices at large banks that made References
pay effectively independent of risk-taking were widely
blamed for imprudent risk taking. The FSB promulgated prin­ Basel Committee on Banking Supervision, "The Application
ciples for better compensation practices, and many nations of Basel II to Trading Activities and the Treatment of Double
responded with increased supervision and regulation. Some Default Effects," Ju ly 2005.
elected to take a more formulaic approach, in some cases
Basel Committee on Banking Supervision, "Guidelines for
restricting the level of pay, while other nations focused on
computing capital for incremental risk in the trading book,"
supervision of the presence of risk-sensitive features in com­
January 2009.
pensation arrangements.
Basel Committee on Banking Supervision, "Revisions to the
• In the United States, the Volcker Rule (part of the Dodd Frank
Basel II market risk fram ework," Ju ly 2009 and February 2011.
Act) restricts proprietary trading and investments in hedge
funds and private equity at deposit-taking financial firms. The Basel Committee on Banking Supervision, "Guidelines for comput­
rationale is that banks should not be permitted to "specu­ ing capital for incremental risk in the trading book," Ju ly 2009.
late" while being funded by insured depositors. However, the
Basel Committee on Banking Supervision, "Basel III: A global
Volcker Rule has proved difficult to enforce because of chal­
regulatory framework for more resilient banks and banking
lenges in identifying the intent of a trade and in separating
systems - revised version June 2011," Ju n e 2011.
hedging activity from speculative activity. Nevertheless, most
banks shut down their proprietary trading desks. Basel Committee on Banking Supervision, "Basel III: A global
regulatory framework for more resilient banks and banking
• In the United States and in the European Union, some over-
system s," D e ce m b e r 2010.
the-counter derivatives (i.e., those that are relatively standard
in form and terms) must be traded on swap execution facili­ Basel Committee on Banking Supervision, "Basel III: the net
ties (SEFs), which are electronic platforms that promote price stable funding ratio," O c to b e r 2014.
transparency. Derivatives traded between financial institu­
Basel Committee on Banking Supervision, "Basel III: the
tions must be cleared by central counterparties (CCPs).
Liquidity Coverage Ratio and liquidity risk monitoring tools,"
• In the United States, an Office of Credit Ratings was created at January 2013.
the Securities and Exchange Commission to provide oversight
Basel Committee on Banking Supervision: Basel III Finalising
of rating agencies, though its powers were somewhat limited.
Post Crisis Reforms, December 2017
Prior to the crisis, rating agencies had been subject to rela­
tively little regulatory oversight and they were widely blamed Basel Committee on Banking Supervision: Minimum capital
for underestimates of the credit risks posed by securitizations. Requirements for Market Risk, R evised 14 January 2019.

• In the United States, a Consumer Financial Protection Basel Committee on Bank Supervision: Large Exposures
Bureau (CFPB) was created to improve information flows to Framework, A p ril 2014.

328 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
High-Level
Summary of
Basel III Reforms
Learning Objectives
After completing this reading you should be able to:

Explain the motivations for revising the Basel III framework ■ The CVA risk framework
and the goals and impacts of the December 2017 reforms
■ The operational risk framework
to the Basel III framework.
■ The leverage ratio framework
Summarize the December 2017 revisions to the Basel III
framework in the following areas: Describe the revised output floor introduced as part of
the Basel III reforms and approaches to be used when
■ The standardized approach to credit risk
calculating the output floor.
The internal ratings-based (IRB) approaches for credit
risk

Basel C om m ittee on Banking Supervision Publication, D e ce m b e r 2017. R e p rin ted with perm ission o f the Bank for International
Settlem en ts. The full publication is available on the BIS w eb site free o f charge: w w w .b is.o rg .

329
This note summarises the main features of the finalised Basel III requirements under the internal ratings-based (IRB) approach
reforms. The standards text, which provides the full details of for credit risk and by removing the use of the internal model
the reforms, is published separately and is available on the BIS approaches for CVA risk and for operational risk;
website at www.bis.org/bcbs/publ/d424.htm . • introducing a leverage ratio buffer to further limit the lever­
The Basel III framework is a central element of the Basel Com ­ age of global systemically important banks (G-SIBs); and
mittee's response to the global financial crisis. It addresses a • replacing the existing Basel II output floor with a more robust
number of shortcomings in the pre-crisis regulatory framework risk-sensitive floor based on the Committee's revised Basel III
and provides a foundation for a resilient banking system that will standardised approaches.
help avoid the build-up of systemic vulnerabilities. The fram e­
work will allow the banking system to support the real economy
through the economic cycle. STANDARDISED APPROACH
The initial phase of Basel III reforms focused on strengthening FOR CREDIT RISK*•
the following components of the regulatory framework:
Credit risk accounts for the bulk of most banks' risk-taking activi­
• improving the quality of bank regulatory capital by placing a
ties and hence their regulatory capital requirements. The stan­
greater focus on going-concern loss-absorbing capital in the
dardised approach is used by the majority of banks around the
form of Common Equity Tier 1 (CET1) capital;
world, including in non-Basel Committee jurisdictions.
• increasing the level of capital requirements to ensure that
banks are sufficiently resilient to withstand losses in times of The Committee's revisions to the standardised approach for
stress; credit risk enhance the regulatory framework by:

• enhancing risk capture by revising areas of the risk-weighted • improving its granularity and risk sensitivity. For example, the
capital framework that proved to be acutely miscalibrated, Basel II standardised approach assigns a flat risk weight to all
including the global standards for market risk, counterparty residential mortgages. In the revised standardised approach
credit risk and securitisation; mortgage risk weights depend on the loan-to-value (LTV)
• adding macroprudential elements to the regulatory fram e­ ratio of the mortgage;
work, by: (i) introducing capital buffers that are built up in • reducing mechanistic reliance on credit ratings, by requiring
good times and can be drawn down in times of stress to banks to conduct sufficient due diligence, and by developing
limit procyclicality; (ii) establishing a large exposures regime a sufficiently granular non-ratings-based approach for juris­
that mitigates systemic risks arising from interlinkages across dictions that cannot or do not wish to rely on external credit
financial institutions and concentrated exposures; and (iii) ratings; and
putting in place a capital buffer to address the externalities • as a result, providing the foundation for a revised output
created by systemically important banks; floor to internally modelled capital requirements (to replace
• specifying a minimum leverage ratio requirement to constrain the existing Basel I floor) and related disclosure to enhance
excess leverage in the banking system and complement the comparability across banks and restore a level playing field.
risk-weighted capital requirements; and
The revisions to the standardised approach for credit risk,
• introducing an international framework for mitigating exces­ relative to the existing standardised approach, are outlined in
sive liquidity risk and maturity transformation, through the Table 21.1. In summary, the key revisions are as follows:
Liquidity Coverage Ratio and Net Stable Funding Ratio.
• A more granular approach has been developed for unrated
The Committee's now finalised Basel III reforms complement exposures to banks and corporates, and for rated exposures
these improvements to the global regulatory framework. The in jurisdictions where the use of credit ratings is permitted.
revisions seek to restore credibility in the calculation of risk-
• For exposures to banks, some of the risk weights for rated
weighted assets (RWAs) and improve the comparability of
exposures have been recalibrated. In addition, the risk-
banks' capital ratios by:
weighted treatment for unrated exposures is more granular
• enhancing the robustness and risk sensitivity of the stan­ than the existing flat risk weight. A standalone treatment for
dardised approaches for credit risk, credit valuation adjust­ covered bonds has also been introduced.
ment (CVA) risk and operational risk; • For exposures to corporates, a more granular look-up
• constraining the use of the internal model approaches, by table has been developed. A specific risk weight applies to
placing limits on certain inputs used to calculate capital exposures to small and medium-sized enterprises (SMEs).

330 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 In addition, the revised standardised approach includes a is used to facilitate transactions rather than a source
standalone treatment for exposures to project finance, object of credit).
finance and commodities finance. • For commercial real estate exposures, approaches have
• For residential real estate exposures, more risk-sensitive been developed that are more risk-sensitive than the flat risk
approaches have been developed, whereby risk weights weight which generally applies.
vary based on the LTV ratio of the mortgage (instead of the • For subordinated debt and equity exposures, a more granu­
existing single risk weight) and in ways that better reflect lar risk weight treatment applies (relative to the current flat
differences in market structures. risk weight).
• For retail exposures, a more granular treatm ent applies, • For off-balance sheet items, the credit conversion factors
which distinguishes between different types of retail (CCFs), which are used to determine the amount of an
exposures. For exam ple, the regulatory retail portfolio exposure to be risk-weighted, have been made more risk-
distinguishes between revolving facilities (where credit is sensitive, including the introduction of positive C C Fs for
typically drawn upon) and transactors (where the facility unconditionally cancellable commitments (UCCs).

Table 21.1 O v e rv ie w of R evised S ta n d a rd ise d A p p ro a ch to C re d it Risk

Exposures to banks

Risk weights in jurisdictions where the ratings approach is permitted

External rating AAA to A A — A+ to A — BBB+ to B B B - BB + to B - Below B— Unrated

Risk weight 20% 30% 50% 100% 150% As for SCRA below

Short-term exp o su res

Risk weight 20% 20% 20% 50% 150% As for SCRA below

Risk weights where the ratings approach is not permitted and for unrated exposures

Standardised Credit Risk Grade A Grade B Grade C

Assessment Approach (SCRA)
grades

Risk weight 40% 1 75% 150%

Short-term exposures 20% 50% 150%

Exposures to covered bonds

Risk weiahts for rated covered bonds

External issue-specific rating AAA to A A — A+ to B B B - BB+ to B - Below B -

Risk weight 10% 20% 50% 100%

Risk weights for unrated covered bonds

Risk weight of issuing bank 20% 30% 40% 50% 75% 100% 150%

Risk weight 10% 15% 20% 25% 35% 50% 100%

Exposures to general corporates

Risk weights in jurisdictions where the ratings approach is permitted

External rating AAA to A A — A+ to A — BBB+ to B B B - BB+ to B B - Below BB— Unrated

of counterparty

Risk weight 20% 50% 75% 100% 150% 100% or 85%

if corporate SME

(C ontinued)

1 A risk weight of 30% may be applied if the exposure to the bank satisfies all of the criteria for Grade A classification and in addition the counterparty
bank has (i) a CET1 ratio of 14% or above; and (ii) a Tier 1 leverage ratio of 5% or above.

Chapter 21 High-Level Summary of Basel III Reforms ■ 331

Table 21.1 Continued
Risk weights where rating approach is not permitted

SCRA grades Investment grade All other

General corporate (non-SME) 65% 100%

SM E general corporate 85%

Exposures to project finance, object finance and commodities finance

Exposure (excluding real estate) Project finance Object and commodity finance

Issue-specific ratings available Same as for general corporate (see above)

and permitted

Rating not available or not 130% pre-operational phase 100%

permitted
100% operational phase
80% operational phase (high quality)

Retail exposures excluding real estate

Regulatory Regulatory retail (revolving) Other retail

retail
Transactors Revolvers
(non-revolving)

Risk weight 75% 45% 75% 100%

Residential real estate exposures

LTV bands Below 50% 50% to 60% to 70% to 80% to 90% to above Criteria not met
60% 70% 80% 90% 100% 100%

G eneral R R E

Whole loan 20% 25% 30% 40% 50% 70% RW of counterparty

approach RW

Loan-splitting 20% RW of counterparty RW of counterparty

approach2 RW

Incom e-producing residential real esta te (IPRRE)

Whole loan 30% 35% 45% 60% 75% 105% 150%

approach RW

Commercial real estate (CRE) exposures

G eneral C R E

Whole loan approach LTV < 60% LTV > 60% Criteria not m et

Min (60%, RW of counterparty) RW of counterparty RW of counterparty

Loan-splitting LTV < 55% LTV > 55% Criteria not m et

approach2
Min (60%, RW of counterparty) RW of counterparty RW of counterparty

Incom e-producing com m ercial real esta te (IPCRE)

Whole loan LT V < 60% 60% < LTV < 80% LT V > 80% Criteria not m et
approach
70% 90% 110% 150%

2 Under the loan-splitting approach, a supervisory specified risk weight is applied to the portion of the exposure that is below 55% of the property
value and the risk weight of the counterparty is applied to the remainder of the exposure. In cases where the criteria are not met, the risk weight of
the counterparty is applied to the entire exposure.

332 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Land acquisition, d e ve lo p m e n t and construction (AD C) e xp o su res

Loan to company/SPV 150%

Residential A D C loan 100%

Subordinated debt and equity (excluding amounts deducted)

Subordinated debt Equity exposures "Speculative unlisted All other equity

and capital other than to certain legislated equity" exposures
equities programmes

Risk weight 150% 100% 400% 250%

Credit conversion factors for off-balance sheet exposures

UCCs Commitments, NIFs and RUFs, ST self-liquidating Direct credit

except UCCs and certain trade letters of credit substitutes and
transaction- related arising from the other off balance
contingent items movement of goods sheet exposures

CCF 10% 40% 50% 20% 100%

INTERNAL RATINGS-BASED Table 2 1 .2 R evised S co p e of IRB A p p ro a ch e s

APPROACHES FOR CREDIT RISK for A sse t C la sse s

Basel III:
As noted above, the financial crisis highlighted a number Portfolio/ Basel II: Available Available
of shortcomings related to the use of internally modelled Exposure Approaches Approaches
approaches for regulatory capital, including the IRB approaches
Large and mid­ A-IRB, F-IRB, SA F-IRB, SA
to credit risk. These shortcomings include the excessive com­
sized corporates
plexity of the IRB approaches, the lack of comparability in banks' (consolidated
internally modelled IRB capital requirements and the lack of revenues >
robustness in modelling certain asset classes. €500m)

To address these shortcomings, the Committee has made the Banks and A-IRB, F-IRB, SA F-IRB, SA
following revisions to the IRB approaches: (i) removed the other financial
institutions
option to use the advanced IRB (A-IRB) approach for certain
asset classes; (ii) adopted "input" floors (for metrics such as Equities Various IRB SA
probabilities of default (PD) and loss-given-default (LGD)) to approaches
ensure a minimum level of conservativism in model parameters Specialised A-IRB, F-IRB, A-IRB, F-IRB,
for asset classes where the IRB approaches remain available; and lending3 slotting, SA slotting, SA
(iii) provided greater specification of parameter estimation prac­
tices to reduce RWA variability.
of RWA variability as it applies fixed values to the LGD and EAD
parameters. In addition, all IRB approaches are being removed

Removing the Use of the Advanced IRB for exposures to equities, which are typically a small component
of the credit risk of banks.
Approach for Certain Asset Classes
Table 21.2 outlines the revised scope of approaches available
The revised IRB framework removes the use of the A-IRB
under Basel III for certain asset classes relative to the Basel II
approach— which allows banks to estimate the PD, LGD, expo­
framework.
sure at default (EAD) and maturity of an exposure - for asset
classes that cannot be modelled in a robust and prudent man­
ner. These include exposures to large and mid-sized corporates,
3 With respect to specialised lending, banks would be permitted to
and exposures to banks and other financial institutions. As a
continue using the advanced and foundation IRB approaches. The
result, banks with supervisory approval will use the foundation Committee will review the slotting approach for specialised lending in
IRB (F-IRB) approach, which removes the two important sources due course.

Chapter 21 High-Level Summary of Basel III Reforms ■ 333

Table 21.3 Minimum Parameter Values in the Revised IRB Framework4

Loss-Given-Default (LGD)
Probability of Exposure at
Default (PD) Unsecured Secured Default (EAD)

Corporate 5 bp 25% Varying by collateral type:

• 0% financial
• 10% receivables
• 10% commercial or residen­
tial real estate
• 15% other physical EAD subject to a floor
that is the sum of (i) the
Retail classes: on-balance sheet expo­
Mortgages 5 bp N/A 5% sures; and (ii) 50% of the
off-balance sheet exposure
Q RRE transactors 5 bp 50% N/A
using the applicable Credit
Q RRE revolvers 10 bp 50% N/A Conversion Factor (CCF) in
Other retail 5 bp 30% Varying by collateral type: the standardised approach
• 0% financial
• 10% receivables
• 10% commercial or residen­
tial real estate
• 15% other physical

Specification of Input Floors CVA RISK FRAMEWORK

The revised IRB framework also introduces minimum "floor" val­
The initial phase of Basel III reforms introduced a capital charge
ues for bank-estimated IRB parameters that are used as inputs
for potential mark-to-market losses of derivative instruments as
to the calculation of RWA. These include PD floors for both the
a result of the deterioration in the creditworthiness of a coun­
F-IRB and A-IRB approaches, and LGD and EAD floors for the
terparty. This risk - known as CVA risk - was a major source of
A-IRB approach. In some cases, these floors consist of recali­
losses for banks during the global financial crisis, exceeding
brated values of the existing Basel II floors. In other cases, the
losses arising from outright defaults in some instances.
floors represent new constraints for banks' IRB models. Table 21.3
summarises the set of input floors in the revised IRB framework. The Committee has agreed to revise the CVA framework to:

• enhance its risk sensitivity: the current CVA framework does

Additional Enhancements not cover an important driver of CVA risk, namely the expo­
sure component of CVA. This component is directly related
The Committee agreed on various additional enhancements to to the price of the transactions that are within the scope of
the IRB approaches to further reduce unwarranted RWA variabil­ application of the CVA risk capital charge. As these prices are
ity, including providing greater specification of the practices that sensitive to variability in underlying market risk factors, the
banks may use to estimate their model parameters. Adjustments CVA also materially depends on those factors. The revised
were made to the supervisory specified parameters in the F-IRB CVA framework takes into account the exposure component
approach, including: (i) for exposures secured by non-financial of CVA risk along with its associated hedges;
collateral, increasing the haircuts that apply to the collateral and
• strengthen its robustness: CVA is a complex risk, and is
reducing the LGD parameters; and (ii) for unsecured exposures,
often more complex than the majority of the positions in4
reducing the LGD parameter from 45% to 40% for exposures to
non-financial corporates.
4 The LGD and EAD floors are only applicable in A-IRB approaches. The
Given the enhancements to the IRB framework and the introduc­ EAD floors are for those exposures where EAD modelling is still permit­
tion of an aggregate output floor (discussed further below), the ted. The LGD floors for secured exposures apply when the exposure is fully
Committee has agreed to remove the 1.06 scaling factor that is secured (ie the value of collateral after the application of haircuts exceeds
the value of the exposure). The LGD floor for a partially secured exposure is
currently applied to RWAs determined by the IRB approach to calculated as a weighted average of the unsecured LGD floor for the unse­
credit risk. cured portion and the secured LGD floor for the secured portion.

334 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 banks' trading books. Accordingly, the Committee is of the where:
view that such a risk cannot be modelled by banks in a robust
• Business Indicator Component (BIC) = ^ ( a , .Bl,)
and prudent manner. The revised framework removes the
• Bl (Business Indicator) is the sum of three components: the
use of an internally modelled approach, and consists of: (i) a
interest, leases and dividends component; the services com­
standardised approach; and (ii) a basic approach. In addition,
ponent and the financial component
a bank with an aggregate notional amount of non-centrally
cleared derivatives less than or equal to €100 billion may • a, is a set of marginal coefficients that are multiplied by the
calculate their CVA capital charge as a simple multiplier of its Bl based on three buckets (i = 1, 2, 3 denotes the bucket), as
counterparty credit risk charge. given below:

• improve its consistency: CVA risk is a form of market risk as

Marginal Bl
it is realised through a change in the mark-to-market value of
Bl Bucket Bl Range Coefficients (« j)
a bank's exposures to its derivative counterparties. As such,
the standardised and basic approaches of the revised CVA 1 < €1 bn 0.12
framework have been designed and calibrated to be con­ 2 €1 bn < Bl < € 3 0 bn 0.15
sistent with the approaches used in the revised market risk
3 > € 3 0 bn 0.18
framework. In particular, the standardised CVA approach, like
the market risk approaches, is based on fair value sensitivities • ILM (the Internal Loss Multiplier) is a function of the BIC
to market risk factors and the basic approach is benchmarked and the Loss Component (LC), where the latter is equal to
to the standardised approach. 15 times a bank's average historical losses over the preceding
10 years. The ILM increases as the ratio of (LC/BIC) increases,
although at a decreasing rate.5
OPERATIONAL RISK FRAMEWORK At national discretion, supervisors can elect to set ILM equal
to one for all banks in their jurisdiction. This means that capital
The financial crisis highlighted two main shortcomings with the
requirements in such cases would be determined solely by the
existing operational risk framework. First, capital requirements
BIC. That is, capital requirements would not be related to a bank's
for operational risk proved insufficient to cover operational risk
historical operational risk losses. However, to aid comparability,
losses incurred by some banks. Second, the nature of these
all banks would be required to disclose their historical operational
losses— covering events such as misconduct, and inadequate
risk losses, even in jurisdictions where the ILM is set to one.
systems and controls— highlighted the difficulty associated with
using internal models to estimate capital requirements for opera­
tional risk. LEVERAGE RATIO FRAMEWORK
The Committee has streamlined the operational risk framework.
The advanced measurement approaches (AMA) for calculating Buffer for Global Systemically
operational risk capital requirements (which are based on banks' Important Banks
internal models) and the existing three standardised approaches
The leverage ratio complements the risk-weighted capital
are replaced with a single risk-sensitive standardised approach
requirements by providing a safeguard against unsustainable
to be used by all banks.
levels of leverage and by mitigating gaming and model risk
The new standardised approach for operational risk determines across both internal models and standardised risk measurement
a bank's operational risk capital requirements based on two approaches. To maintain the relative incentives provided by
components: (i) a measure of a bank's income; and (ii) a measure both capital constraints, the finalised Basel III reforms introduce
of a bank's historical losses. Conceptually, it assumes: (i) that a leverage ratio buffer for G-SIBs. Such an approach is consis­
operational risk increases at an increasing rate with a bank's tent with the risk-weighted G-SIB buffer, which seeks to mitigate
income; and (ii) banks which have experienced greater opera­ the externalities created by G-SIBs.
tional risk losses historically are assumed to be more likely to
The leverage ratio G-SIB buffer must be met with Tier 1 capital
experience operational risk losses in the future.
and is set at 50% of a G-SIB's risk- weighted higher-loss absor­
The operational risk capital requirement can be summarised as bency requirements. For example, a G-SIB subject to a 2%
follows:

Operational risk capital = BIC X ILM 5 Specifically, ILM = In [exp(1) - 1 + (LC/BIC)08].

Chapter 21 High-Level Summary of Basel III Reforms ■ 335

risk-weighted higher-loss absorbency requirement would be definition of the leverage ratio exposure measure. These
subject to a 1% leverage ratio buffer requirement. refinem ents include modifying the way in which derivatives
are reflected in the exposure measure and updating the treat­
The leverage ratio buffer takes the form of a capital buffer
ment of off-balance sheet exposures to ensure consistency
akin to the capital buffers in the risk-weighted framework. As
with their m easurem ent in the standardised approach to
such, the leverage ratio buffer will be divided into five ranges.
credit risk.
As is the case with the risk-weighted framework, capital distribu­
tion constraints will be imposed on a G-SIB that does not meet The Committee has also agreed that jurisdictions may exercise
its leverage ratio buffer requirement. national discretion in periods of exceptional macroeconomic
circumstances to exempt central bank reserves from the lever­
The distribution constraints imposed on a G-SIB will depend on
age ratio exposure measure on a temporary basis. Jurisdictions
its CET1 risk-weighted ratio and Tier 1 leverage ratio. A G-SIB
that exercise this discretion would be required to recalibrate
that meets: (i) its CET1 risk-weighted requirements (defined as
the minimum leverage ratio requirement commensurately to
a 4.5% minimum requirement, a 2.5% capital conservation buf­
offset the impact of excluding central bank reserves, and require
fer and the G-SIB higher loss-absorbency requirement) and; (ii)
their banks to disclose the impact of this exemption on their
its Tier 1 leverage ratio requirement (defined as a 3% leverage
leverage ratios.
ratio minimum requirement and the G-SIB leverage ratio buffer)
will not be subject to distribution constraints. A G-SIB that does The Committee continues to monitor the impact of the Basel III
not meet one of these requirements will be subject to the asso­ leverage ratio's treatment of client-cleared derivative transac­
ciated minimum capital conservation requirement (expressed tions. It will review the impact of the leverage ratio on banks'
as a percentage of earnings). A G-SIB that does not meet both provision of clearing services and any consequent impact on the
requirements will be subject to the higher of the two associated resilience of central counterparty clearing.
conservation requirements.

As an example, Table 21.4 shows the minimum capital conser­ OUTPUT FLOOR
vation standards for the CET1 risk-weighted requirements and
Tier 1 leverage ratio requirements of a G-SIB in the first bucket The Basel II framework introduced an output floor based on
of the higher loss-absorbency requirements (ie where a 1% risk- Basel I capital requirements. That floor was calibrated at 80%
weighted G-SIB capital buffer applies). of the relevant Basel I capital requirements. Implementation of
the Basel II floor has been inconsistent across countries, partly

Refinements to the Leverage Ratio because of differing interpretations of the requirement and also

Exposure Measure because it is based on the Basel I standards, which many banks
and jurisdictions no longer apply.
In addition to the introduction of the G-SIB buffer, the
The Basel III reforms replace the existing Basel II floor with a
Com m ittee has agreed to make various refinem ents to the
floor based on the revised Basel III standardised approaches.
Consistent with the original floor, the revised floor places
Table 21.4 C ap ital C o n se rv a tio n R atios for a G -SIB a limit on the regulatory capital benefits that a bank using
S u b je ct to a 1 % R isk-W eig h ted Buffer and 0 .5 % internal models can derive relative to the standardised
L e v e ra g e Ratio Buffer approaches. In effect, the output floor provides a risk-based
backstop that limits the extent to which banks can lower their
Minimum Capital
capital requirem ents relative to the standardised approaches.
Conservation
This helps to maintain a level playing field between banks
CET1 Risk- Ratios (Expressed
using internal models and those on the standardised
Weighted Tier 1 Leverage as a Percentage
approaches. It also supports the credibility of banks' risk-
Ratio Ratio of Earnings)
weighted calculations, and improves com parability via the
4.5-5.375% 3-3.125% 100% related disclosures.
> 5 .3 7 5 -6 .2 5 % > 3 .1 2 5 -3 .2 5 % 80% Under the revised output floor, banks' risk-weighted assets
> 6 .2 5 -7 .1 2 5 % > 3 .2 5 -3 .3 7 5 % 60% must be calculated as the higher of: (i) total risk-weighted assets
calculated using the approaches that the bank has supervisory
> 7 .1 2 5 -8 % > 3 .3 7 5 -3 .5 0 % 40%
approval to use in accordance with the Basel capital fram e­
> 8.0% > 3.50% 0% work (including both standardised and internal model-based

336 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
§0 2 3 3 ^ 3 Im p lem en tation D a te s of B asel III P o st-C risis R eform s and Transitional A rra n g e m e n t for Phasing in the
A g g re g a te O u tp u t Flo o r

Revision Implementation Date

Revised standardised approach for credit risk • 1 January 2022

Revised IRB framework • 1 January 2022

Revised CVA framework • 1 January 2022

Revised operational risk framework • 1 January 2022

Revised market risk framework • 1 January 20226

Leverage ratio • Existing exposure definition:7 1 January 2018

• Revised exposure
definition: 1 January 2022
• G-SIB buffer: 1 January 2022

Output floor • 1 January 2022: 50%

• 1 January 2023: 55%
• 1 January 2024: 60%
• 1 January 2025: 65%
• 1 January 2026: 70%
• 1 January 2027: 72.5%

approaches); and (ii) 72.5% of the total risk-weighted assets • Market risk: the standardised (or simplified standardised)
calculated using only the standardised approaches. approach of the revised market risk framework. The SEC-
ERBA, the SEC-SA or a 1250% risk weight must also be used
The standardised approaches to be used when calculating the
when determining the default risk charge component for
output floor are as follows:
securitisations held in the trading book.
1• • 1 1 . 1 1• 1 1 ^ l*i°l
• Credit risk: the standardised approach tor credit risk
• O perational risk: the standardised approach for opera-
outlined above. When calculating the degree of credit
tional risk.
risk m itigation, banks must use the carrying value when
applying the sim ple approach or the com prehensive Banks will also be required to disclose their risk-weighted assets
approach with standard supervisory haircuts. This also based on the revised standardised approaches. Details about
includes failed trades and non-delivery-versus-paym ent these disclosure requirements will be set forth in a forthcoming
transactions as set out in Annex 3 of the Basel II fram ework consultation paper.
(June 2006).
• Counterparty credit risk: to calculate the exposure for
TRANSITIONAL ARRANGEMENTS
derivatives, banks must use the standardised approach for
measuring counterparty credit risk (SA-CCR). The exposure
Table 21.5 sum m arises the im plem entation dates and
amounts must then be multiplied by the relevant borrower transitional arrangem ents related to the standards
risk weight using the standardised approach for credit risk described above.
to calculate RWA under the standardised approach for
credit risk. In addition, at national discretion, supervisors may cap
the increase in a bank's total RWAs that results from the
• Credit valuation adiustment risk: the standardised approach
application of the output floor during its phase-in period.
for CVA (SA-CVA), the Basic Approach (BA-CVA) or 100% of a
bank's counterparty credit risk capital requirement (depend­
ing on which approach the bank is eligible for and uses for
CVA risk). 6 This will constitute both the implementation and regulatory reporting
date for the revised market risk framework published in January 2016.
• Securitisation framework: the external ratinas-based
7 Based on the January 2014 definition of the leverage ratio exposure
approach (SEC-ERBA), the standardised approach (SEC-SA) measure. Jurisdictions are free to apply the revised definition of the
or a 1250% risk weight. exposure measure before 1 January 2022.

Chapter 21 High-Level Summary of Basel III Reforms ■ 337

The transitional cap on the increase in RWAs will be set at More generally, a jurisdiction which does not implement some
25% of a bank's RWAs before the application of the floor. or all of the internal-modelled approaches but instead only
Put differently, if the supervisor uses this discretion, the bank's implements the standardised approaches is compliant with the
RWAs will effectively be capped at 1.25 tim es the internally Basel framework. More generally, jurisdictions may elect to
calculated RWAs during that tim e. The cap would apply for implement more conservative requirements and/or accelerated
the duration of the phase-in period of the output floor transitional arrangements, as the Basel framework constitutes
(i.e., the cap would be removed on 1 January 2027). minimum standards only.

338 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Basel III: Finalising
Post-Crisis Reforms
Learning Objectives
After completing this reading you should be able to:

Explain the elements of the new standardized approach Describe general and specific criteria recommended by
to measure operational risk capital, including the business the Basel Committee for the identification, collection and
indicator, internal loss multiplier, and loss component, and treatment of operational loss data.
calculate the operational risk capital requirement for a
bank using this approach.

Compare the Standardized Measurement Approach (SMA)

to earlier methods of calculating operational risk capital,
including the Advanced Measurement Approaches (AMA).

Basel C om m ittee on Banking Supervision Publication, D e ce m b e r 2017. R e p rin ted with perm ission o f the Bank for International
Settlem en ts. The full publication is available on the BIS w eb site free o f charge: w w w .b is.o rg .
22.1 INTRODUCTION In the formula below, a bar above a term indicates that it is cal­
culated as the average over three years: t, t-1 and t-2, and:3
Operational risk is defined as the risk of loss resulting from
inadequate or failed internal processes, people and systems or ILD C = Min A b s (Interest Income - Interest Exp en se );
from external events. This definition includes legal risk,1 but 2.25% ■Interest Earning A ssets ] + Dividend Income
excludes strategic and reputational risk. SC = Max [ Other Operating Incom e; Other Operating
The standardised approach for measuring minimum operational Expen se + Max [ Fee Income; Fee Expense
risk capital requirements replaces all existing approaches in the FC = A b s (Net P & LTrading B ook ) + A b s (N et P & L
Basel II fram ework.1
2 That is, this standard replaces paragraphs
Banking Book)
644 to 683 of the Basel II framework.

Consistent with Part I (Scope of Application) of the Basel II The definitions for each of the components of the Bl are
Framework, the standardised approach applies to internationally provided in the annex of this section.
active banks on a consolidated basis. Supervisors retain the dis­
cretion to apply the standardised approach framework to non-
internationally active banks.
The Business Indicator Component
To calculate the BIC, the Bl is multiplied by the marginal
coefficients (a,). The marginal coefficients increase with the

22.2 THE STANDARDISED APPROACH size of the Bl as shown in Table 22.1. For banks in the first
bucket (ie with a Bl less than or equal to €1bn) the BIC is

The standardised approach methodology is based on the fol­ equal to Bl X 12%. The marginal increase in the BIC result­

lowing components: (i) the Business Indicator (Bl) which is a ing from a one unit increase in the Bl is 12% in bucket 1,

financial-statement-based proxy for operational risk; (ii) the 15% in bucket 2 and 18% in bucket 3. For example, given

Business Indicator Com ponent (BIC), which is calculated by a Bl = €35b n, the BIC = (1 X 12%) + (3 0 -1 ) X 15% +

multiplying the Bl by a set of regulatory determined marginal (3 5 -3 0 ) X 18% = €5.37b n.

coefficients (a,); and (iii) the Internal Loss Multiplier (ILM), which
is a scaling factor that is based on a bank's average historical
The Internal Loss Multiplier
losses and the BIC.
A bank's internal operational risk loss experience affects the
calculation of operational risk capital through the Internal Loss
The Business Indicator Multiplier (ILM). The ILM is defined as:

/ \
The Business Indicator (Bl) comprises three components: the
interest, leases and dividend component (ILDC); the services ILM = Ln e x p fl
component (SC), and the financial component (FC). V 7

The Bl is defined as: where the Loss Com ponent (LC) is equal to 15 tim es average
annual operational risk losses incurred over the previous 10
Bl = ILDC + SC + FC years. The ILM is equal to one when the loss and business
indicator com ponents are equal. W hen the LC is greater
than the BIC , the ILM is greater than one. That is, a bank
with losses that are high relative to its BIC is required to hold
higher capital due to the incorporation of internal losses into
1 Legal risk includes, but is not limited to, exposure to fines, penalties, the calculation m ethodology. Conversely, where the LC is
or punitive damages resulting from supervisory actions, as well as pri­
vate settlements.
2 Basel Committee on Banking Supervision, Basel II: International
Convergence o f Capital Measurement and Capital Standards: A 3 The absolute value of net items (eg, interest income - interest
Revised Framework—Comprehensive Version, June 2006, www.bis.org/ expense) should be calculated first year by year. Only after this year
pub7bcbs128.htm. by year calculation should the average of the three years be calculated.

340 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 22.1 Bl R an g es and M arginal C o e fficie n ts Minimum operational risk capital (ORC) is calculated by multiply­
ing the BIC and the ILM :5
Bl Marginal
Bucket Bl Range (in €bn) Coefficients («i) ORC = BIC ■ILM

1 < 1 12%

2 1 < Bl < 30 15% 22.3 APPLICATION OF THE

3 > 30 18% STANDARDISED APPROACH
WITHIN A GROUP
At the consolidated level, the standardised approach cal­
lower than the BIC , the ILM is less than one. That is, a bank culations use fully consolidated Bl figures, which net all the
with losses that are low relative to its BIC is required to hold intragroup income and expenses. The calculations at a sub-con­
lower capital due to the incorporation of internal losses into solidated level use Bl figures for the banks consolidated at that
the calculation m ethodology. particular sub-level. The calculations at the subsidiary level use
The calculation of average losses in the Loss Component must the Bl figures from the subsidiary.
be based on 10 years of high-quality annual loss data. As part of Similar to bank holding companies, when Bl figures for sub-con­
the transition to the standardised approach, banks that do not solidated or subsidiary banks reach bucket 2, these banks are
have 10 years of high-quality loss data may use a minimum of required to use loss experience in the standardised approach
five years of data to calculate the Loss Com ponent.4*Banks that calculations. A sub-consolidated bank or a subsidiary bank uses
do not have five years of high-quality loss data must calculate only the losses it has incurred in the standardised approach cal­
the capital requirement based solely on the Bl Component. culations (and does not include losses incurred by other parts of
Supervisors may however require a bank to calculate capital the bank holding company).
requirements using fewer than five years of losses if the ILM is
In case a subsidiary of a bank belonging to bucket 2 or higher
greater than 1 and supervisors believe the losses are representa­
does not meet the qualitative standards for the use of the Loss
tive of the bank's operational risk exposure.
Component, this subsidiary must calculate the standardised
approach capital requirements by applying 100% of the Bl Com ­
ponent. In such cases supervisors may require the bank to apply
The Standardised Approach Operational
an ILM which is greater than 1.
Risk Capital Requirement
The operational risk capital requirement is determined by the
product of the BIC and the ILM. For banks in bucket 1 (ie with 22.4 MINIMUM STANDARDS FOR
Bl < €1 billion), internal loss data does not affect the capital THE USE OF LOSS DATA UNDER
calculation. That is, the ILM is equal to 1, so that operational risk THE STANDARDISED APPROACH
capital is equal to the BIC (=12% • Bl).

At national discretion, supervisors may allow the inclusion of Banks with a Bl greater than €1bn are required to use loss data
internal loss data into the framework for banks in bucket 1, sub­ as a direct input into the operational risk capital calculations.
ject to meeting the loss data collection requirements. In addi­ The soundness of data collection and the quality and integrity
tion, at national discretion, supervisors may set the value of ILM of the data are crucial to generating capital outcomes aligned
equal to 1 for all banks in their jurisdiction. In case this discretion with the bank's operational loss exposure. National supervisors
is exercised, banks would still be subject to the full set of disclo­ should review the quality of banks' loss data periodically.
sure requirements. Banks which do not meet the loss data standards are required
to hold capital that is at a minimum equal to 100% of the BIC.
In such cases supervisors may require the bank to apply an ILM

4 This treatment is not expected to apply to banks that currently use the
advanced measurement approaches for determining operational risk
capital requirements. 5 Risk-weighted assets for operational risk are equal to 12.5 times ORC.

Chapter 22 Basel III: Finalising Post-Crisis Reforms ■ 341

which is greater than 1. The exclusion of internal loss data due on which the bank became aware of the event ("date of dis­
to non-compliance with the loss data standards, and the applica­ covery"); and the date (or dates) when a loss event results in
tion of any resulting multipliers, must be publicly disclosed. a loss, reserve or provision against a loss being recognised in
the bank's profit and loss (P&L) accounts ("date of account­
ing"). In addition, the bank must collect information on
22.5 GENERAL CRITERIA ON LOSS recoveries of gross loss amounts as well as descriptive infor­
DATA IDENTIFICATION, COLLECTION mation about the drivers or causes of the loss event.6 The

AND TREATMENT level of detail of any descriptive information should be com­

mensurate with the size of the gross loss amount.

The proper identification, collection and treatment of internal f. Operational loss events related to credit risk and that are
loss data are essential prerequisites to capital calculation under accounted for in credit risk RWAs should not be included
the standardised approach. The general criteria for the use of in the loss data set. Operational loss events that relate to
the LC are as follows: credit risk, but are not accounted for in credit risk RWAs
should be included in the loss data set.
a. Internally generated loss data calculations used for regula­
tory capital purposes must be based on a 10-year observa­ g. Operational risk losses related to market risk are treated as
tion period. When the bank first moves to the standardised operational risk for the purposes of calculating minimum
approach, a five-year observation period is acceptable on regulatory capital under this framework and will therefore be
an exceptional basis when good-quality data are unavail­ subject to the the standardised approach for operational risk.
able for more than five years. h. Banks must have processes to independently review the
b. Internal loss data are most relevant when clearly linked to a comprehensiveness and accuracy of loss data.
bank's current business activities, technological processes and
risk management procedures. Therefore, a bank must have
documented procedures and processes for the identification, 22.6 SPECIFIC CRITERIA ON LOSS
collection and treatment of internal loss data. Such proce­ DATA IDENTIFICATION, COLLECTION
dures and processes must be subject to validation before the AND TREATMENT
use of the loss data within the operational risk capital require­
ment measurement methodology, and to regular indepen­ Building of the Standardised Approach
dent reviews by internal and/or external audit functions.
Loss Data Set
c. For risk management purposes, and to assist in supervisory
Building an acceptable loss data set from the available internal
validation and/or review, a supervisor may request a bank
data requires that the bank develop policies and procedures to
to map its historical internal loss data into the relevant Level
address several features, including gross loss definition, refer­
I supervisory categories as defined in Annex 9 of the Basel
ence date and grouped losses.
II Framework and to provide this data to supervisors. The
bank must document criteria for allocating losses to the
specified event types. Gross Loss, Net Loss, and Recovery
d. A bank's internal loss data must be comprehensive and Definitions
capture all material activities and exposures from all appro­
Gross loss is a loss before recoveries of any type. Net loss is
priate subsystems and geographic locations. The minimum
defined as the loss after taking into account the impact of recov­
threshold for including a loss event in the data collection
eries. The recovery is an independent occurrence, related to the
and calculation of average annual losses is set at €20,000.
original loss event, separate in time, in which funds or inflows of
At national discretion, for the purpose of the calculation of
economic benefits are received from a third party.7
average annual losses, supervisors may increase the thresh­
old to €100,000 for banks in buckets 2 and 3 (ie where the
Bl is greater than €1 bn). 6 Tax effects (eg reductions in corporate income tax liability due to
operational losses) are not recoveries for purposes of the standardised
e. Aside from information on gross loss amounts, the bank must approach for operational risk.
collect information about the reference dates of operational
7 Examples of recoveries are payments received from insurers, repay­
risk events, including the date when the event happened or ments received from perpetrators of fraud, and recoveries of misdi­
first began ("date of occurrence"), where available; the date rected transfers.

342 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Banks must be able to identify the gross loss amounts, non­ The following items should be excluded from the gross loss
insurance recoveries, and insurance recoveries for all operational computation of the loss data set:
loss events. Banks should use losses net of recoveries (including
a. Costs of general maintenance contracts on property, plant
insurance recoveries) in the loss dataset. However, recoveries
or equipment;
can be used to reduce losses only after the bank receives pay­
ment. Receivables do not count as recoveries. Verification of b. Internal or external expenditures to enhance the business

payments received to net losses must be provided to supervi­ after the operational risk losses: upgrades, improvements,

sors upon request. risk assessment initiatives and enhancements; and

c. Insurance premiums.
The following items must be included in the gross loss computa­
tion of the loss data set: Banks must use the date of accounting for building the loss data
set. The bank must use a date no later than the date of account­
a. Direct charges, including impairments and settlements, to
ing for including losses related to legal events in the loss data
the bank's P&L accounts and write-downs due to the opera­
set. For legal loss events, the date of accounting is the date
tional risk event;
when a legal reserve is established for the probable estimated
b. Costs incurred as a consequence of the event including loss in the P&L.
external expenses with a direct link to the operational risk
event (eg legal expenses directly related to the event and Losses caused by a common operational risk event or by related

fees paid to advisors, attorneys or suppliers) and costs of operational risk events over time, but posted to the accounts
over several years, should be allocated to the correspond­
repair or replacement, incurred to restore the position that
was prevailing before the operational risk event; ing years of the loss database, in line with their accounting
treatment.
c. Provisions or reserves accounted for in the P&L against the
potential operational loss impact;

d. Losses stemming from operational risk events with a defini­

22.7 EXCLUSION OF LOSSES
tive financial impact, which are temporarily booked in tran­
sitory and/or suspense accounts and are not yet reflected in
FROM THE LOSS COMPONENT
the P&L ("pending losses").8 Material pending losses should
Banking organisations may request supervisory approval to
be included in the loss data set within a time period com­
exclude certain operational loss events that are no longer rel­
mensurate with the size and age of the pending item; and
evant to the banking organisation's risk profile. The exclusion of
e. Negative economic impacts booked in a financial account­ internal loss events should be rare and supported by strong jus­
ing period, due to operational risk events impacting the tification. In evaluating the relevance of operational loss events
cash flows or financial statements of previous financial to the bank's risk profile, supervisors will consider whether
accounting periods ("timing losses").9 Material "timing the cause of the loss event could occur in other areas of the
losses" should be included in the loss data set when they bank's operations. Taking settled legal exposures and divested
are due to operational risk events that span more than one businesses as examples, supervisors expect the organisation's
financial accounting period and give rise to legal risk. analysis to demonstrate that there is no similar or residual legal
exposure and that the excluded loss experience has no rel­
evance to other continuing activities or products.

The total loss amount and number of exclusions must be dis­

8 For instance, in some countries, the impact of some events (e.g., legal closed under Pillar 3 with appropriate narratives, including total
events, damage to physical assets) may be known and clearly identifi­
loss amount and number of exclusions.
able before these events are recognised through the establishment of a
reserve. Moreover, the way this reserve is established (e.g., the date of
A request for loss exclusions is subject to a materiality thresh­
discovery) can vary across banks or countries.
old to be set by the supervisor (for example, the excluded loss
9 Timing impacts typically relate to the occurrence of operational risk
event should be greater than 5% of the bank's average losses).
events that result in the temporary distortion of an institution's finan­
cial accounts (e.g., revenue overstatement, accounting errors and In addition, losses can only be excluded after being included in
mark-to-market errors). While these events do not represent a true a bank's operational risk loss database for a minimum period (for
financial impact on the institution (net impact over time is zero), if the
example, three years), to be specified by the supervisor. Losses
error continues across more than one financial accounting period, it
may represent a material misrepresentation of the institution's financial related to divested activities will not be subject to a minimum
statements. operational risk loss database retention period.

Chapter 22 Basel III: Finalising Post-Crisis Reforms ■ 343

22.8 EXCLUSIONS OF DIVESTED disclose their annual loss data for each of the ten years in the ILM
calculation window. This includes banks in jurisdictions that have
ACTIVITIES FROM THE BUSINESS opted to set ILM equal to one. Loss data is required to be reported
INDICATOR on both a gross basis and after recoveries and loss exclusions. All
banks are required to disclose each of the Bl sub-items for each of
Banking organisations may request supervisory approval to the three years of the Bl component calculation window.10
exclude divested activities from the calculation of the Bl. Such
exclusions must be disclosed under Pillar 3.
22.11 ANNEX: DEFINITION OF
22.9 INCLUSION OF LOSSES AND Bl BUSINESS INDICATOR COMPONENTS
ITEMS RELATED TO MERGERS AND The following P&L items do not contribute to any of the items of
ACQUISITIONS the Bl:

• Income and expenses from insurance or reinsurance

Losses and the measurement of the Bl must include losses and Bl
businesses
items that result from acquisitions of relevant business and mergers.
• Premiums paid and reimbursements/payments received from
insurance or reinsurance policies purchased
22.10 DISCLOSURE • Administrative expenses, including staff expenses, outsourcing
fees paid for the supply of non-financial services (e.g., logisti­
All banks with a Bl greater than €1 bn, or which use internal loss cal, IT, human resources), and other administrative expenses
data in the calculation of operational risk capital, are required to (e.g., IT, utilities, telephone, travel, office supplies, postage).

Business Indicator Definitions

P&L or Balance
Bl Component Sheet Items Description Typical Sub-Items

Interest, lease Interest income Interest income from all financial • Interest income from loans and advances, assets
and dividend assets and other interest income available for sale, assets held to maturity, trading
(includes interest income from assets, financial leases and operational leases
financial and operating leases • Interest income from hedge accounting derivatives
and profits from leased assets) • Other interest income
• Profits from leased assets

Interest Interest expenses from all finan­ • Interest expenses from deposits, debt securities
expenses cial liabilities and other interest issued, financial leases, and operating leases
expenses • Interest expenses from hedge accounting derivatives
• Other interest expenses
(includes interest expense from
• Losses from leased assets
financial and operating leases,
• Depreciation and impairment of operating leased
losses, depreciation and impair­
assets
ment of operating leased assets)

Interest earning Total gross outstanding loans, advances, interest bearing securities (including government
assets (balance bonds), and lease assets measured at the end of each financial year
sheet item)

Dividend Dividend income from investments in stocks and funds not consolidated in the bank's finan­
income cial statements, including dividend income from non-consolidated subsidiaries, associates
and joint ventures

1n
The Committee will undertake a separate public consultation on the
operational risk disclosure templates.

344 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Business Indicator Definitions

P&L or Balance
Bl Component Sheet Items Description Typical Sub-Items

Services Fee and com­ Income received from provid­ Fee and commission income from:
mission income ing advice and services. Includes
• Securities (issuance, origination, reception, transmis­
income received by the bank as
sion, execution of orders on behalf of customers)
an outsourcer of financial services
• Clearing and settlement; Asset management; Cus­
tody; Fiduciary transactions; Payment services;
Structured finance; Servicing of securitisations; Loan
commitments and guarantees given; and foreign
transactions

Fee and Expenses paid for receiving Fee and commission expenses from:
commission advice and services. Includes
• Clearing and settlement; Custody; Servicing of
expenses outsourcing fees paid by the
securitisations; Loan commitments and guarantees
bank for the supply of financial
received; and Foreign transactions
services, but not outsourcing
fees paid for the supply of non-
financial services (eg logistical, IT,
human resources)

Other operat­ Income from ordinary banking • Rental income from investment properties
ing income operations not included in other • Gains from non-current assets and disposal groups
Bl items but of similar nature classified as held for sale not qualifying as discontin­
ued operations (IFRS 5.37)
(income from operating leases
should be excluded)

Other operat­ Expenses and losses from ordi­ • Losses from non-current assets and disposal groups
ing expenses nary banking operations not classified as held for sale not qualifying as discontin­
included in other Bl items but of ued operations (IFRS 5.37)
similar nature and from opera­ • Losses incurred as a consequence of operational loss
tional loss events (expenses from events (eg fines, penalties, settlements, replacement
operating leases should be cost of damaged assets), which have not been provi-
excluded) sioned/reserved for in previous years
• Expenses related to establishing provisions/reserves
for operational loss events

Financial Net profit (loss) • Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity
on the trading securities, loans and advances, short positions, other assets and liabilities)
book • Net profit/loss from hedge accounting
• Net profit/loss from exchange differences

Net profit (loss) • Net profit/loss on financial assets and liabilities measured at fair value through profit and
on the banking loss
book • Realised gains/losses on financial assets and liabilities not measured at fair value through
profit and loss (loans and advances, assets available for sale, assets held to maturity,
financial liabilities measured at amortised cost)
• Net profit/loss from hedge accounting
• Net profit/loss from exchange differences

Chapter 22 Basel III: Finalising Post-Crisis Reforms ■ 345

• Recovery of administrative expenses including recovery of • Expenses due to share capital repayable on demand
payments on behalf of customers (e.g., taxes debited to • Impairment/reversal of impairment (e.g., on financial assets,
customers) non-financial assets, investments in subsidiaries, joint ven­
• Expenses of premises and fixed assets (except when these tures and associates)
expenses result from operational loss events) • Changes in goodwill recognised in profit or loss
• Depreciation/amortisation of tangible and intangible assets • Corporate income tax (tax based on profits including current
(except depreciation related to operating lease assets, which tax and deferred).
should be included in financial and operating lease expenses)
• Provisions/reversal of provisions (e.g., on pensions, commit­
ments and guarantees given) except for provisions related to
operational loss events

346 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The Cyber-Resilient
Organization
Learning Objectives
After completing this reading you should be able to:

Describe elements of an effective cyber-resilience Explain methods that can be used to assess the financial
framework and explain ways that an organization can impact of a potential cyber-attack and explain ways to
become more cyber-resilient. increase a firm's financial resilience.

Explain resilient security approaches that can be used to

increase a firm's cyber resilience and describe challenges
to their implementation.

E x c e rp t is C h a p ter 8 from Solving Cyber Risk: Protecting Your Company and Society, by A n d re w C oburn, Eireann Leverett, and
G ordon W oo.

347
23.1 CHANGING APPROACHES $120 billion industry today. Projections expect the industry to
continue to grow rapidly to reach hundreds of billions annually
TO RISK MANAGEMENT worldwide in a few years.

Identify, Protect, Detect, Respond, However, the type of expenditure for typical cyber security bud­

Recover gets is shifting. Traditional purchasing of hardware IT security

components, such as servers, networking gear, data centers, and
The cyber risk management framework proposed by the physical infrastructure, is being augmented by broader security
National Institute of Standards and Technology (NIST) consists solutions, such as personnel training, non-computer platforms,
of five functions:1 and internet of things (loT) security.3

1. Identify. Develop an organizational understanding to man­ Key trends include increasing emphasis on incident response,
age cyber security risk to systems, people, assets, data, and shifting from intrusion prevention to intrusion tolerance, com-
capabilities. partmentalization and 'credential silos' with protected end­
2. Protect. Develop and implement appropriate safeguards to points, and risk management in the supply chain. We discuss
ensure delivery of critical services. each of these in this chapter.

3. D e te ct. Develop and implement appropriate activities to

identify the occurrence of a cyber security event. Threat Analysis
4. R esp o n d . Develop and implement appropriate activities to
Most cyber security assessments begin with threat analysis.
take action regarding a detected cyber security incident.
In Chapter 5, 'Know Your Enem y', we provide a profile of the
5. Recover. Develop and implement appropriate activities to main threat actors and their driving motivations. An organiza­
maintain plans for resilience and to restore any capabili­ tion needs to evaluate the likelihood of being the primary
ties or services that were impaired due to a cyber security target of each of the main threat groups, or being caught
incident. in the collateral damage from their activities. Organizations
will monitor their cyber events - attempted attacks, malware
Cyber security in an organization typically places em pha­
discovered, suspicious activity - typically in an incident log.
sis on maintaining a secure perimeter, with an emphasis on
Analysis of the incident log provides important insights into the
technology tools for monitoring internal traffic and external
characteristics and frequencies of attem pted attacks and the
communications, and with minimal tolerance of external pen­
overall threat.
etration, malware, or unauthorized software. Cyber security
tools include antivirus software, firewalls, network traffic deep-
packet inspection, data management systems, email security
systems, server gateways, web application firewalls, and many
23.2 INCIDENT RESPONSE AND
others. CRISIS MANAGEMENT
Cyber security system design is a com plex and skillful process,
matching the specific operations and needs of an organization
Real-time Crisis Management: How
with the threats it faces, the tools available, and the budget
Fighter Pilots Do It
allocated. The values of individual components of security are On May 1, 1983, high over the Negev desert of Israel, an F-15
hard to evaluate independently, because security depends Israeli Air Force jet collided with an A-4 Skyhawk plane. The
on the weakest link in the chain - if one component is weaker impact sheared off the right wing of the F-15 jet, which was
than others, then that is the one that will be exploited by sent spinning. A second before pressing the ejector button,
attackers. the pilot pushed the throttle, lit the afterburner, gained speed,
Companies spend on average around 3% of their information and regained control of the plane. At twice the normal speed,
technology (IT) capital expenditure budget on cyber security.1
2 he managed to land at an airbase, stopping just 20 feet from
Cyber security expenditure has grown rapidly, generating a the end of the runway. The ability to recover from unexpected
precarious and hazardous situations is the essence of resilience.

1 NIST (2018a), Cybersecurity Framework v1.1.

2 Pacific Crest analyst Rob Owens, quoted in Investor's Business Daily
News, 10 June 2016. 3 Cybersecurity Ventures, Cybersecurity Market Report Q4 2016.

348 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
This astonishing feat of resilience was accomplished through Cyber Risk Awareness in Staff
a highly effective man-machine partnership. First, the intrinsic
aeronautic design of the F-15 meant that it acted like a rocket, Microsoft provides considerations for a cyber resilience pro­
with sufficient lift being provided by the large surface area of gram .4 Amongst the recommendations is that every person with
the stabilizers, fuselage, and what remained of the wings. Sec­ corporate network access, including full-time employees, con­
ond, the enterprising pilot had the presence of mind to light the sultants, and contractors, should be regularly trained to develop
afterburner and accelerate his way out of a deep crisis. a cyber-resilient mindset. This should include not only adhering
to IT security policies around identity-based access control, but
There is much to learn from this example of surprisingly success­
also alerting IT to suspicious events and infections as soon as
ful real-time crisis management. Technology should be designed
possible to help minimize time to remediation.
to be robustly adaptive to threats both foreseen and unfore­
seen. The man-machine interface is crucial. Corporate staff Training programs specifically geared towards developing a
have to be trained and prepared for both the expected and the cyber- resilient mindset are particularly productive. Many, cor­
unexpected. The aim of cyber resilience is to maintain a system's porate training programs exist to help staff to deal safely with
capability to deliver the intended outcome at all times, including social engineering scams. Even the most savvy of staff members
times of crisis when regular delivery has failed. A wide range of may fall victim to one of these scams, which prey upon all man­
measures, from backups to full disaster recovery, contribute to ner of psychological, emotional, and cognitive weaknesses.
cyber resilience, and to maintaining business continuity under Magicians exploit these weaknesses to fool people with their
the most testing, unusual, and unexpected circumstances. illusions. In the cognitive science literature, it is established that
providing misinformation about past events can reduce memory
accuracy and even create false memories. Phishing attacks and
Rapid Adaptation to Changing Conditions social engineering use a wide variety of con tricks, misdirection,
As defined by a Presidential Policy Directive, resilience is the and scams to try to get staff to reveal credentials, open toxic
ability to prepare for and adapt to changing conditions and attachments, follow false links, and carry out other tasks. Spot­
withstand and recover rapidly from disruptions. Cyber resilience ting these tricks, questioning their veracity, and identifying the
analysts assess system deficiencies in disruption response, and clues to their fakeness are skills that need to be learned and
develop means of rectifying these weaknesses through cyber reinforced in staff behavior.
security enhancements in prevention, detection, and reaction.
Organizations need to be agile in crisis response. Organizations
Business Continuity Planning
need to prepare, prevent, respond, and recover from any crisis
that may emerge.
and Staff Engagement
Cyber resilience requires a coherent strategy encompassing All staff members need a good understanding of business con­

people, processes, and technology. The human dimension is tinuity issues. Those assigned specialist duties, such as planning

especially important, because people can make imprudent secu­ testing and incident response, need extra specific training, as all

rity decisions and take risky actions. On the other hand, under emergency responders do. Middle and senior managers have

crisis situations, people can rise in an extraordinary way to the their own responsibilities, and are required to understand and

challenge of adversity. They can make excellent decisions under adopt integrated cyber resilience management best practice

intense pressure, coping well with the uncertainty over the trou­ and compliance to standards. The key cyber resilience standards

ble they find themselves in and the viability of their emergency that should be adopted are:

response plan. • ISO 27001, the international standard describing best prac­

Corporate decision making starts with the board of directors, tice for an information security management system.

who have to drive forward the cyber resilience agenda and • ISO 22301, the international standard for business continuity.
involve the whole organization, extending to the supply chain,
Successful training can be achieved only with full staff engage­
partners, and customers. To balance risk with opportunity, a
ment. If the training is perceived as dull, tedious, and boring,
corporate risk-based strategy needs to be put in place that man­
the results are likely to be disappointing. No matter how tech­
ages the vulnerabilities, threats, risks, and impacts. This strategy
nically expert the training is, eliciting an enthusiastic human
has to include preparation for and recovery from a cyber attack.
response requires addressing an extra dimension: psychology.
At the same time, costs need to be kept under control, user
convenience must be taken into account, and business require­
ments should be satisfied. 4 Johnson (2017).

Chapter 23 The Cyber-Resilient Organization ■ 349

One way of adding a psychological dimension to cyber resil­ it becom es for the adversary to score points by causing
ience training is to reward staff positively for good cyber major cyber loss and disruption. Adversarial exercises, such
hygiene. Rewards might be handed out across the whole spec­ as 'C apture the Flag' are good training for security staff and
trum of cyber security issues of concern: reporting phishing technologists.
emails; preventing tailgating; reporting attempted intrusions
via social engineering; reporting any USB memory sticks lost
or found; keeping desktop software patched and updated;
Nudging Behavior
maintaining strong, confidential passwords; attending secu­ Another way of using psychology to change staff behavior
rity seminars and webinars; not leaving laptops unattended; is through adopting the nudge principle: encouraging good
and reporting bugs or vulnerabilities. Such incentivized train­ cyber hygiene without having to reward staff accordingly. One
ing achieves measurable and impressive results. In one major of the most famous original examples of nudging, quoted by
corporation, after 18 months participants were 50% less likely economics Nobel laureate William Thaler, one of the authors
to click on a phishing link and 82% more likely to report a of the nudge principle, is that of hygiene in men's restrooms.
phishing em ail.5 Men can be nudged to make less floor mess simply by having a
marked target in the center of a urinal. No reward (or penalty)

Gaming and Exercises of any kind is needed to encourage better hygiene. In line with
the previous golf tournament metaphor, one actual example of
One familiar field of human endeavor in which incentivized train­ a marked target is a golf flag pin. At the Cyber Security Summit
ing is proven to work well is in playing competitive games. The and Expo 2017, the chief operating officer at the UK Finan­
application of gaming principles to business is given the self- cial Conduct Authority suggested that staff members may be
explanatory if contrived name 'gamification'. It actually started nudged to talk more about cyber security, and explained that
in marketing, as companies realized they could attract custom­ far better cultural outcomes are then seen than with traditional
ers more readily by enticing them with a game or competition. annual mandatory training regimes. She further suggested that
Some businesses have been using gamification in the workplace the same technique could be used with suppliers, who may be
as a way to boost employee morale.6 The application to adver­ an unsuspecting weak link in overall security. In addition to usual
sarial situations like combating cyber risk may be more compel­ due diligence, a regular conversation with suppliers on security
ling and relevant than most. Amongst other cyber security firms, sets a positive nudging tone for a mutually beneficial enhanced
Kaspersky Lab has been adopting gamification technology in cyber security relationship.
its security awareness training programs. In 2017, Kaspersky
awarded a young talent lab prize to the US-based creators of a
gamification app designed to raise information security aware­ 23.3 RESILIENCE ENGINEERING
ness amongst millennials.

There are four principles to gam ification: defining a goal,

Safety Management
defining rules for reaching that goal, setting up a feedback In traditional safety management, the focus is on identifying
m echanism , and making participation voluntary. Gam ification and defending against a prescribed set of hazards, using tech­
usually means awarding points to em ployees who do the right niques with limited ability to realistically represent the intricacies
thing, with various forms of recognition, including badges, of human and organizational influences adequately.7 Also, the
prizes, and a leader board listing point totals. Treating cyber search for causal factors of failures is obscured by the social,
security as a com petitive gam e, with scores posted as in a cultural, and technical characteristics of complex engineered
golf tournam ent, is not inappropriate. Unlike natural hazards systems. The concepts of resilience engineering address these
resilience, security against cyber attacks is a persistent adver­ shortcomings, integrating safety, process, and financial manage­
sarial game - the attackers are rewarded for their efforts and ment. Resilience engineering builds on safety engineering, but
industry, and so also should the defenders be rew arded. The treats faults and failures in socio-technical systems rather than
more points that staff m embers manage to accrue, the harder in purely technical systems. The focus of resilience engineering
is on the organization and on the socio-technical system in the

5 Wood (2014). ___________

6 Penenberg (2013). 7 Wreathall (2006).

350 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 THE CHALLENGE OF CYBER RESILIENCE: TRUMP HOTELS
Hotels are at high risk of data breach attacks, particularly consumer notifications regarding compromised data. Tim eli­
major chains. Seven of the luxury hotels owned by presiden­ ness of security response is also a requirement of resilience.
tial candidate Donald Trump were infected between May Trump Hotels duly enhanced security measures, including
2014 and June 2015 with malware that stole payment infor­ employee training, comprehensive risk assessments, and reg­
mation. This data breach ended up exposing 70,000 credit ularly scheduled testing of systems - but not before another
card numbers and customer records, and was discovered data breach was discovered in March 2016.
only when multiple banks spotted hundreds of fraudulent
Later that year, hackers broke into the Sabre SynXis Central
transactions on customer accounts where the last legitimate
Reservations System, which facilitates online hotel booking
transaction was at Trump Hotels.
for some of the largest hotel chains. The intrusion remained
Cardholders were unaware of the breach until a notice was undetected on the Sabre network for seven months, steal­
posted on the Trump Hotels website four months after ing data between August 2016 and March 2017. This was
the hotel chain had learned of the major data exfiltration. the third credit card data breach affecting Trump Hotels in
This delay violated New York state laws stipulating timely three years.8

presence of accidents, errors, and disasters. In particular, resil­ President Trump gave a public commitment to keeping America
ience engineering is well suited to systems that are tightly cou­ safe in the cyber era.9 This commitment extended to resilience:
pled but intractable in the sense that they cannot be completely building defensible government networks and improving the
described or specified. ability to provide uninterrupted and secure communications
and services under all conditions. Although a strident critic of
In general terms, resilience is the ability of an organization to
big government, as a victim of data breaches in his hotel chain,
recover to a stable state, allowing it to continue operations dur­
Trump may recognize that stronger cyber security regulations
ing and after a major mishap or in the presence of continuous
may be needed and may need to be better enforced.
significant stresses. Both of these contingencies are relevant for
cyber resilience. The management challenge of building and
leading a resilient organization increases in complexity as more
products and services are online and open to cyber disruption
23.4 ATTRIBUTES OF A
by malevolent hackers. CYBER-RESILIENT ORGANIZATION
Anticipate, Withstand, Recover,
Hotel Keycard Failure Example and Evolve
A simple example is a hotel where room keycards fail after a
In general, the complexity of a system makes it difficult to clas­
cyber attack. Black hats have demonstrated how some digital
sify failure states following a cyber attack, which can impact
hotel keys can be read with a simple portable device. Even in
an organization in innumerable ways. Yet, complexity is a vital
this dire situation, there has to be a backup plan to allow guests
system attribute enabling adaptation under external stress. The
to access their rooms securely. Availability is a vital pillar of resil­
individual links between people and their environment should
ient cyber security; even after keycard failure, continuity of hotel
adapt under stress in a resilient manner. Because resilience is
service must be maintained, and guest rooms have to be avail­
an emerging property of complex systems, it can be developed
able for use. Along with availability, confidentiality and integrity
through focus on attaining specific goals.
of information are two other vital pillars of cyber security. These
also are major issues for the hotel industry because of data A cyber-resilient organization should aim to anticipate, with­
breach of the hotel booking and payments system, and the stand, recover, and evolve. Given their intrinsic interconnected­
theft of credit card data. Hotels have become popular targets ness, all four of these goals should be addressed simultaneously.
because they have a business hospitality culture of openness. A For example, even while withstanding or recovering from
cyber attack hit 1200 franchised InterContinental hotels in the
last quarter of 2016. Hackers have declared open season on
the reservation and point-of-sale systems of the hospitality and 8 Seals (2017).
tourism industry. 9 Trump (2017).

Chapter 23 The Cyber-Resilient Organization ■ 351

a cyber attack, a business manager must anticipate further consumers and businesses whose information was collected by
attacks. Even while anticipating, withstanding, or recovering Equifax would have expected the agency to have been a para­
from attacks, business processes that rely on them are con­ digm of resilience. But based on information publicly disclosed
stantly evolving to address changing operational and technical after the breach, Equifax may have possessed all too few of the
environments. And part of anticipation is withstanding stresses following six attributes of a resilient organization. Indeed, in
within some bounded range. respect of human performance, the CEO personally blamed a sin­
gle member of the company's security team, rather than recognize
Cyber resilience is just one aspect of resilience in general. An
that all errors are the outcome of organizational deficiencies, such
organization that aspires to be cyber resilient should aim further
as a lack of resilience, for which the C EO is ultimately responsible.
to be resilient against all potential stresses. A highly resilient
organization will share the six attributes listed in Section 8 .4 .3 .10 1. Top-level com m itm ent to recognizing and valuing human
In this list of attributes, which are not cyber-specific, there is a performance concerns, in both word and deed. An orga­
well-merited emphasis on human performance within the orga­ nization should provide continuous and extensive follow-
nization. This is appropriate since not only are security decision through to actions related to human performance.
making and preparedness the responsibility of the organiza­ 2. A ju s t culture supporting the reporting of issues up through
tion's employees, but the staff members themselves are also a the organization. Without a just culture, the willingness of
primary source of vulnerability to cyber attack, being susceptible staff to report problems will be eroded, as will the organiza­
to social engineering deception, as well as the source of human tion's ability to learn about defensive weaknesses.
error in undertaking corporate security tasks.
3. A learning culture benefiting from both good and bad
experiences, and not responding to questions about secu­
Negative Attributes rity issues with denial.

Case studies of organizations that have suffered major data 4 . A w a ren ess of the true state of defenses, and their state of
breaches often highlight missing attributes for a resilient organiza­ degradation. Also, insight into the quality of human perfor­
tion. For example, security commentators referred negatively to mance, and the extent to which it is a problem.
the security culture at Equifax, which discovered a massive data 5. P rep a redn ess for problems, especially in human perfor­
breach on July 29, 2017, and announced it six weeks later on mance. The organization should actively anticipate prob­
September 7. In his testimony to a US House of Representatives lems and prepare for them.
subcommittee on consumer protection, the Equifax C EO , Rick
6. Flexibility to adapt that maximizes ability to solve problems
Smith, justified the delay in communicating the data breach on the
without loss of functionality. It requires that important secu­
grounds of avoiding further attacks and ensuring consumer protec­
rity decisions may be made at lower organizational levels.
tion measures could be put in place. A resilient organization would
have had detailed contingency plans in place for a data breach, These six attributes are qualitative organizational attributes, which
which would have expedited its crisis communication response. have a significant bearing on quantitative resilience metrics: the
time and cost to restore operations, the time and cost to restore
The Equifax C EO also excused the communication delay with
system configurations, the time and cost to restore functionality
reference to Hurricane Irma, which took down two large call cen­
and performance, the degree to which the pre-disruption state is
ters in September, soon after the breach announcement. This is
restored, the potential disruption circumvented, and successful
a classic failure of resilience. Corporate preparedness for natural
adaptations within time and cost constraints.
hazards should include plans to overcome breakdowns in infra­
structure. Professional resilience engineers would not have been
astonished that some of the 15 million Britons affected by the Cyber Resilience Objectives
Equifax data breach were only notified eight months afterwards.
Because the cyber threat is so dynamic, many actions to improve
resilience may be effective for only a short duration. However,
Six Positive Attributes for Resilience common to all actions are various general cyber resilience objec­
tives, which are summarized next.
For a consumer credit reporting agency, corporate resilience
should have been a business priority. The many millions of • Adaptive Response
An adaptive response involves executing and monitoring the
effectiveness of actions that best change the attack surface,
10 Wreathall (2006). maintain critical capabilities, and restore functional capabilities.

352 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• Analytic Monitoring perpetrators are outside Western jurisdiction, and even if they
Analytic monitoring involves gathering and analyzing data on are within the same jurisdiction as the victim, successful prosecu­
an ongoing basis and in a coordinated way to identify poten­ tion is difficult to achieve.
tial vulnerabilities, adversary activities, and damage. However, where a significant corporate cyber crime has been
• Coordinated Defense com m itted, some level of criminal investigation is required for
In any conflict situation, having multiple defenses is advanta­ legal reasons, as well as to comply with obligations to share­
geous, but they have to be carefully coordinated so that they holders and other corporate stakeholders, and to enhance
do not interfere negatively with each other, but rather have a resilience. This involves com puter forensics. As with any
maximum positive effect. forensic investigation, diligence is needed when attending the
scene of a crim e, to ensure that significant evidence gathered
• Deception
is adm issible. In particular, the following four principles must
Sun Tzu's dictum that 'All war is based on deception' applies
be upheld:11
to cyber warfare as well as older traditional forms of conflict.
Deception is an essential weapon of cyber defense, espe­ 1. No action taken by law enforcement agencies, persons
cially against a powerful adversary, such as a state-sponsored employed within those agencies, or their agents should
threat actor. change data, which may be subsequently relied upon in
court.
• Privilege Restriction
Violation of privilege restriction has facilitated some major 2. Where a person finds it necessary to access original data,
cyber attacks. To minimize the impact of criminal action, privi­ that person must be competent to do so, and be able to
leges should be carefully restricted. give evidence explaining the relevance and the implications
of his or her actions.
• Random Changes
3. An audit trail or other record of all processes applied to
Static security, however strong, is progressively liable to be
digital evidence should be created and preserved. An inde­
eroded over time. Frequent randomized security actions that
pendent third party should be able to examine those pro­
make it more perplexing for an adversary to predict behavior
cesses and achieve the same result.
increase the chance of adversary detection.
• Redundancy 4. The person in charge of the investigation has overall
responsibility for ensuring adherence to the law and these
The value of redundancy in enhancing system safety is evi­
principles.
dent from elementary reliability analysis. If the chance of fail­
ure of a key component is one in a thousand, then the chance Forensic investigators not only must comply with these prin­
of failure of two such components, assumed to have indepen­ ciples; they also have to cope with insidious attempts to thwart
dent failure rates, is as low as one in a million. computer forensic analysis. This may include encryption, the
• Segmentation overwriting of data, and the modification of file metadata. And
even where no such anti-forensic efforts have been made, a
The attack surface of a system can be reduced if system com­
shrewd defense lawyer can query in court the quality of evi­
ponents can be segmented based on criticality to restrict the
dence of an intrusion - maybe the log file had been tampered
damage from exploits. Segmentation often employs either
with, or the origination of the internet protocol (IP) address was
physically distinct entities or virtualization of computing sub­
faked.1
12 Thinking through defense arguments is a valuable intel­
1
networks to provide the desired separation.
lectual exercise in cyber resilience, because it raises technical
• Substantiated Integrity
issues that could lead to ideas for improving the cyber security
It is crucial that critical systems and backups have not been cor­ environment. One argument might be over identifying when
rupted by an adversary. Their integrity needs to be substanti­ exactly a cyber security incident occurred. For example reconcil­
ated and data checked that they are not invalid or out of range. ing the timestamp for a connection to a Webserver might involve
clients in London, a server in Tokyo and various time zones and

23.5 INCIDENT RESPONSE PLANNING daylight-saving adjustments.

Forensic Investigation
The vast majority of internet crimes are left unreported. A tiny 11 ACPO (2012).
proportion of cyber crimes are successfully prosecuted. Most 12 Grimes (2016).

Chapter 23 The Cyber-Resilient Organization ■ 353

Initial Breach Diagnosis Security should be fully integrated within the development pro­
cess, with built-in features such as defense in depth, running
An initial step in incident response is to assess when security with least privilege, and avoidance of security by obscurity. A
was first breached. This is far from being a straightforward mat­ software development life cycle (SDLC) is a series of phases that
ter, as shown by the 2014 and subsequent 2013 Yahoo breach provide a framework for developing software and managing it
revelations. The next step is to discover what systems have been through its entire life cycle. There is no specific technique or sin­
compromised, and what data has been exfiltrated or corrupted. gle way to develop applications and software components, but
An essential aspect of any first response to an unfolding crisis is there are established methodologies that organizations use and
conducting triage, which consists of classifying incidents, priori­ models they follow to address different challenges and goals.
tizing them, and assigning incidents to appropriate personnel.13
However well written and resilient the software is, and however
Containment of damage and prevention of its spreading are
much the network perimeter defense has been hardened, a
then urgent actions before eradication of the threat and removal
determined, highly motivated (perhaps state-sponsored) cyber
of malware from the network. The mark of resilience in incident
attacker can eventually manage to find an entry point into any
response is restoration of systems to their normal operation. The
system through some social engineering deception or zero day
main challenges in recovery are in reconnecting networks and
exploit. Treating a twenty-first-century software system as a
confirming that systems have been successfully restored.
medieval fortress with impregnable entry points is itself a coun­
Thinking ahead is characteristic of a resilient mindset. Even terproductive form of self-deception, and self-denial of reality
before, and preferably well before a major incident occurs, of the virtual world. This is detrimental to cyber security in gen­
plans should be drawn up for investigating incidents, as and eral, and to maintaining resilience in particular. It is prudent to
when they might occur, and undertaking extensive postincident accept that system intrusion will occur in the future, and to plan
investigations. Communicating lessons learned to all stakehold­ a maximally resilient response. The three pillars of successful
ers in a transparent and timely manner is a crucial element of a response identified by Dr Eric Cole are detection, containment,
resilient response. Amongst the lessons will be insights into the and control.15
effectiveness of security measures, and the costs and impacts
of cyber incidents. From such lessons the cost-effectiveness of
enhanced security measures can be better gauged. Detection, Containment, and Control
In biology, a system's capacity to absorb and resist any dam­
age from internal or external mechanisms, and recover quickly,
23.6 RESILIENT SECURITY SOLUTIONS is a measure of its resilience. The universal process of evolution
embodies natural selection for resilience. A key criterion for fit­
Resilient Software ness is resilience. In healthcare, a doctor would advise a patient
Resilient software should have the capacity to withstand a fail­ that prevention is always better than cure. Hence those who
ure in a critical component, such as from a cyber attack, but spend hours in the sun are urged to use sunscreen. Regular use of
still recover in an acceptable predefined manner and duration. sunscreen can halve the incidence of melanoma, which is a type
Factors affecting resilience include complexity, globalization, of skin cancer. If excessive sun exposure does eventually cause
interdependency, rapid change, level of system integration, melanoma, the sooner this is detected the better, so that effective
and behavioral influences. The complex networked systems treatment can be given. Most importantly, any malignant tumor
prevalent in many organizations make it hard to provide a should be found before it spreads to other parts of the body.
service platform with consistent levels of resilience. When a Rapid threat detection lies at the heart of resilient cyber secu­
critical system fails, the required service may not be readily rity. Imagine a cyber attack that targets a perceived security
deliverable, especially when there is high demand. Furthermore, weakness in a peripheral device such as a printer. If system
net-centricity can introduce complexities that lead to greater security extends to intrusion detection that monitors the device
chances of errors.14 Learning from failure is essential for a memory for malicious attacks, then threat detection can auto­
resilient organization. When software fails, this is an opportunity matically instigate a reboot from a safe copy of the device's
for additional resilience features to be introduced. operating system. By restoring the peripheral device without
business interruption, cyber resilience is achieved.

13 CREST (2013).
14 Murray et al. (2017). 15 Cole (2015).

354 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 CASE STUDIES IN GERMAN STEEL RESILIENCE
In February 2016, Southeast Asian hackers exfiltrated tech­ shock not just to the steel mill security staff, but to the entire
nological intellectual property data from Thyssenkrup, one cyber security industry in Germany and beyond. Surprise is
of the world's largest steelmakers, Early detection and timely the enemy of resilience.
countermeasures limited the loss from this professional
cyber espionage attack, which was discovered, continuously It would not have been feasible for an outside vandal to have
observed, and analyzed by Thyssenkrup's computer emer­ physically gained access to the steel mill and sabotaged a
gency response team. This admirably resilient response to blast furnace. Basic site security would have detected the
a cyber attack contrasts with what happened when a steel unauthorized intrusion and prevented this kind of criminal
mill in an undisclosed location in Germany was targeted for damage. The cyber attack was not detected because it was
a cyber attack in 2014. (Thyssenkrup denied it was one of an advanced persistent threat (APT), executed carefully in
its steel mills.) The motive for this apparently senseless act stages in a slow and stealthy way, keeping a low profile to
of cyber vandalism remains unknown, but it does provide an make detection difficult.16 Apart from remaining undetected,
instructive contrasting case study in cyber nonresilience. the attack was neither contained nor controlled.

The attackers used spear phishing emails to access the steel A more resilient cyber defense strategy would have had a
mill office IT network, compromise a multitude of systems, network intrusion detection system (NIDS) deployed. This
and spread over to the production network. Failures accumu­ strategy should also have maintained a strict separation
lated in individual control components, and a blast furnace between business and production networks to contain the
was unable to be shut down in a regulated manner, which attack, preventing it from spreading from the entry point to
resulted in extensive damage. This cyber attack came as a the key industrial target.

Minimize Intrusion Dwell Time anomaly detection, when dealing with an intelligent adversary
striving to keep illicit activities hidden within the noise, is the
A resilient strategy for coping with a cyber attack should mini­ possibility of false negatives. The international prize for smart
mize the intrusion dwell time, which is the time from initial sys­ detection avoidance might be awarded to the Soviets who vio­
tem compromise to the time the malware ceases to be effective. lated nuclear test ban treaties by automatically timing the deto­
Controlling dwell time means early detection with an appropri­ nation of nuclear test explosions to coincide with the occurrence
ate effective response. Just as with malignant cancer, the lateral of regional earthquakes. The seismic signal of a nuclear explo­
spread of intrusion should also be contained and controlled, so sion (the observational basis for nuclear test forensics) would
as to minimize the number and extent of compromised systems. be hidden within the tail of the earthquake signal. This kind of
Dwell times can be measured in months rather than days or subtle trickery to evade detection ended with the Cold War, but
weeks because attackers are often ingeniously adaptive to new the ingenious cunning of the Russian chess mind in the age of
security systems, and may change their threat signatures from state-sponsored cyber attacks should not be underestimated.
those detected by threat intelligence service providers. Spotting
anomalous behavior is a crucial aspect of resilient cyber security.
A network behavior anomaly detection (NBAD) program tracks
Anomaly Detection Algorithms
critical network characteristics in real time and generates an Anomaly detection algorithms use state-of-the-art artificial
alarm if an anomaly or unusual trend is detected that might sig­ intelligence methods, incorporating sophisticated Bayesian
nal a threat. Examples of such characteristics include increased techniques of statistical inference. These probabilistic tools
traffic volume, bandwidth, and protocol use. Such a program for searching for discrepancies have been refined using ideas
can also monitor the behavior of individual network subscribers. developed for Big Data analysis. Faster, cheaper, simpler - but
less powerful - are signature-based detection methods. Rather
For NBAD to be optimally effective, a baseline of normal
like a police biometric database of fingerprints or DNA samples,
network or user behavior must be established over a period
these methods rely on a database of signatures carried by
of time. A large volume of network data can enable even a
packets known to be sources of malicious activities. Signature-
comparatively modest anomaly to be tracked and flagged up.
based methods check for automated procedures supplied by
Inevitably, as in any anomaly detection system, there may be
well-known hacker tools. These tend to have the same traffic
false positives, such as when an employee decides to back
up the contents of a hard drive on a Saturday evening before
going away on vacation the following morning. The flip side of 16 Bartman and Kraft (2016).

Chapter 23 The Cyber-Resilient Organization ■ 355

signatures every time, because computer programs repeat over A penetration test (pen test to its friends) is the process of
and over again the same instructions. conducting simulated attacks to discover how successful cyber
attacks might occur. Conducting a pen test to prove that a miss­
Both anomaly and signature-based detection approaches should
ing patch is a security issue typically raises the cost of testing,
be incorporated within an overall NIDS. As anyone who lives
and runs the expensive risk of potential system downtime. Not
in a gated community knows, reliance on the detection of an
all pen testing is expensive; the simplest type of pen testing
intruder is far from being a resilient strategy for mitigating the
involves a handful of social engineering tricks, or taking advan­
risk of burglary. The probability of detection can never be very
tage of an easily guessable password. Some loT gadgets such
close to certainty, because the price of false alarms would be
as a kitchen kettle leave the factory with a basic default pass­
unacceptable. Each house needs its own security system to
word, which may not be changed by the forgetful or ignorant
contain and control the criminal action of an intruder. Defense in
purchaser. Like all professional occupations, pen testers come
depth is a cornerstone of resilient security. Recognition of lateral
with a wide range of knowledge, ability, and experience. The
movements of a cyber attacker requires continuous monitoring
best pen testers have deep knowledge of operating systems,
of the internal network, and a visual interface that provides the
networking, scripting languages, and the like, and use a clever
right metrics for security analysts to gain situation awareness of
combination of manual and automated tools to simulate attacks
any intrusion. With these metrics, an intrusion can begin to be
with the same complexity as might be conceived by a black hat.
contained and controlled.
Pen test results are typically reported on severity, exploit-
Containment of the adverse impacts of security breaches will
ability, and associated remediation actions. The information
help avoid an escalation of loss and blunt the force of a cyber
obtained from pen testing can be used to plug security gaps,
attack, so as to make incident response more effective. Con­
improve attack response, and enhance cyber resilience. Con­
tainment might be achieved through network segmentation,
trolling network entry and exit points and reducing the overall
and redundancy measures such as having logical and physi­
attack surface will make it easier to respond to an attack, and
cal duplication. Another containment approach that increases
enable functionality to be restored more quickly. This therefore
resilience is designing systems so that they continue to function
increases an organization's resilience against cyber attacks.
and perform their tasks even when connectivity to external sys­
tems is lost. With any security initiative, there is also an intrinsic
human component that needs to be considered. Dealing with The Risk-Return Trade-Off
an intrusion effectively requires a degree of security staff pre­
Whereas junior security personnel may work obsessively to
paredness that merits training and rehearsal of an emergency
reduce vulnerability where they find it, cost-conscious senior
response plan.
management and their accountants are particularly interested
in the risk-return trade-off. The actual level of risk reduction
Penetration Testing achieved may in fact be lower than is optimistically perceived,
given the large security budget. For example, within days of a
In cyberspace, it is essential to understand the interrelationship
pen test, network changes may create new security challenges.
between vulnerability assessment and risk analysis.17 Much more
effort is directed towards the former than the latter. But mea­ Pen testing is commonly used to address the problem of cyber
suring work on vulnerability assessment is not measuring risk risk mitigation, instead of more empirical and scientific practices.
reduction. For example, a vulnerability scanner might determine Although pen testers know what to charge for their professional
that a server is missing critical operating system patches by services, most pen testers cannot put a price on their success or
detecting an outdated version of the operating system during a failure. Pen testers can make recommendations on how to close
network probe. This vulnerability might be remedied simply by security gaps, and how to prioritize the necessary tasks. But no
a software update and a reboot. Assessing the corresponding two pen testers go about their assignment in the same way, and
cyber risk reduction is not so straightforward. This would involve pen testing is usually done on a limited set of targets. Accord­
explicitly devising an exploit to show that the missing patch ingly, pen testing is not strictly a risk management exercise.
would allow an attacker to gain access to the server. This might To provide another perspective on security risk management,
be a difficult task, not necessarily cost-effective for a work- consider the pen testing analog of red-teaming in counterterror­
averse hacker. ism studies. Ever since 9/11, security consultancies with exten­
sive military expertise have undertaken vulnerability assessments
for specific locations and events that might be targeted for a
17 George (2016). terrorist attack. Red-teaming exercises are particularly valuable

356 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
in identifying gaps in security that would make a location or shock that might be foreseeable. In the United States public
event a comparatively soft target relative to other alternative companies are expected to file annual 10-K submissions to the
targets. By hardening any one potential target, e.g. deploying Securities and Exchange Commission that identify the key risks
additional perimeter security guards and installing CCTV, the to their business and to notify their shareholders and counter­
risk may be transferred to another soft target, in a process that parties of those risks. The UK equivalent is the Long Term Viabil­
terrorism risk analysts recognize as target substitution.18 This ity Statement (LTVS) reporting to the Financial Reporting Council
tactic should extend to cyber risk as well. Hackers (like terrorists) on liquidity. Cyber risk is one of the most commonly reported
follow the path of least resistance in their targeting, and if an risks by companies, declared in their 10-K and LTVS filings.
attractive designated target for a cyber attack has been hard­
A cyber attack can cause sufficient loss to cause damage to a
ened, others lacking the benefit of pen testing or red-teaming
company's balance sheet, even for fairly sizeable organizations.
knowledge may become more likely to be attacked.
Examples include companies having to issue profit warnings,
suffer credit downgrades, make emergency loan provisions, and

23.7 FINANCIAL RESILIENCE see reduction in stock price, and ultimately the loss could be
severe enough to force the organization to cease trading. The

Financial Consequences of a Cyber Attack likelihood of cyber attacks causing a loss sufficient to trigger
each of these thresholds depends on the type of risk analysis we
A major cyber attack on a corporation can impact it in numer­ have described, defining the odds of experiencing a cyber loss
ous adverse ways. Intellectual property and other confidential of these levels of severity, combined with the financial structure
information may be stolen; important computer system files may of the organization, its liquidity, its access to capital reserves,
be corrupted or encrypted; denial of service may bring systems and analysts' interpretation of the event in terms of how it
down; physical damage to corporate facilities and property may might affect the future business model and position relative to
be inflicted; psychological and bodily harm may be caused to its competitors.
staff and customers; reputational damage may be incurred, and
Balance sheet resilience for the levels of financial shock that
liability lawsuits may be filed. W hatever the impact, business
might be inflicted by a cyber event can be achieved by having
will be disrupted to an extent that depends on the resilience of
all of the standard financial engineering processes to minimize
the organization. We describe many of these consequences and
earnings volatility, including having sufficient liquidity margins,
illustrate some of these costs in the first two chapters: Chap­
reducing debt ratios, having access to emergency loan provi­
ter 1, 'Counting the Costs of Cyber Attacks', and Chapter 2,
sions, being able to cut costs to meet earnings targets, and
'Preparing for Cyber Attacks'.
having cyber insurance to provide a level of financial indemnity
The bottom line for any commercial organization is the ultimate against the loss.
financial cost. Each of the adverse impacts results in a financial
loss to the corporation. For publicly listed corporations, the stock
price is a resilience measure. For those publicly listed corporations Reverse Stress Testing
for which cyber security is paramount for customer confidence, For any specified cyber attack scenario designed as a financial
the impact of a severe cyber attack on stock price can be devas­ stress test, the implications for a corporation can be evaluated,
tating. As fallout from a massive identity theft data breach, the taking account of the myriad ways that it might affect business.
stock price of Equifax fell precipitously by about one-third in one For a particularly severe scenario, a corporation's credit rat­
week, before a new C EO was appointed in late September 2017 ing might be downgraded. The implications of cyber attacks
and started to turn the consumer credit reporting agency around. could start taking a higher priority in credit analysis. Moody's
But with further revelations that the data breach was worse than Investors Service views material cyber threats in a similar vein
previously thought, the stock price in mid-February 2018 was still as other extraordinary event risks, such as those arising from
lower by 20% than it had been before the breach disclosure. natural disasters, with any subsequent credit impact depending
on the duration and severity of the event.19 While Moody's does
Financial Risk Assessment not explicitly incorporate cyber risk as a principal credit factor,
its fundamental credit analysis incorporates numerous stress­
Companies have to make assessments of their risk and build testing scenarios, and a cyber event could be the trigger for one
resilience into their balance sheet to withstand the types of

18 Woo (2011). 19 Moody's Investors Service (2015).

Chapter 23 The Cyber-Resilient Organization ■ 357

of those stress scenarios. In a 2015 report, Moody's identified Having extra personnel available for patching provides defense
several key factors to examine when determining a credit impact in depth. Operational redundancy of course costs money - this is
associated with a cyber event, including the nature and scope of the price of resilience. Deciding on how much defense in depth
the targeted assets or businesses, the duration of potential ser­ a corporation should have depends partly on regulation, and
vice disruptions, and the expected time to restore operations. partly on corporate risk appetite. The irony of the Equifax data
breach is that the C EO might well have stipulated a tight limit
Both the disruption duration and the operational restoration
to the cyber risk to which Equifax should have been exposed.
time are basic defining characteristics of resilience. A cyber-
Given the extreme sensitivity of the identity data retained by
resilient organization should know just how bad a cyber attack
Equifax, customers would have been dismayed by any other
would need to be to threaten its viability, or to have its credit
cyber security policy. However, there was a disconnect between
rating downgraded. This is called reverse stress testing. Through
C EO instruction and actual operation. The implementation of
systematic reverse stress testing, measures can be developed to
this policy lacked the resilience required to ensure its practical
protect a corporation against such unacceptable outcomes.
effectiveness in a perpetually hostile cyber threat environment.
For insurance companies in the context of Solvency II, the con­
cept of reverse stress testing for an insurer's own risk and sol­
vency assessment (ORSA) is endorsed by the European Insurance Enterprise Risk Management
and Occupational Pensions Authority.20 A number of practical
Enterprise risk management (ERM) envisages an organizational
cyber reverse stress tests have been developed.21 They have
process applied in developing strategy across the enterprise. It
been used as management desktop exercises to identify opera­
is designed to identify events that might affect the organization,
tional weaknesses and areas that need attention.
and to help manage risk to within its risk appetite. The degree
of cyber resilience sought by an organization should be com­
Defense in Depth mensurate with its risk appetite. Traditional ERM measures of
cyber risk typically do not quantify severity of financial loss in
The principles of engineering resilience go a long way in cyber
the event of a cyber incident. As the importance of cyber risk
resilience. Defense in depth is a crucial objective in build­
increases amongst organizations worldwide, ERM studies will
ing in system resilience. Even if one system fails, overlapping
help to specify optimal levels of cyber resilience investment.
system design will mean there is no single point of failure.
Too often, when a large corporation suffers a massive cyber
This contrasts markedly with a standard check-box approach
attack loss, the C EO is unable to explain whether the negative
to security, which sanctions systems with a minimum level of
outcome was consistent with its risk appetite or resilience objec­
redundancy as having sufficient security. If this standard check­
tives. It is easier to attribute blame to staff error.
box approach were routine in the passenger airline industry,
there would be just a single pilot in the cockpit, rather than
two or three. Cyber Value at Risk
The Equifax C EO singled out one of the company's 250 security
Cyber value at risk (VaR) is based on the general notion of VaR,
personnel as responsible for allowing the data breach: 'We now
widely used in the financial services industry. In finance, VaR is a
know that the vulnerable version of Apache Struts within Equifax
risk measure for a given portfolio and time horizon, defined as a
was not identified or patched. The human error was that the
threshold loss value. Specifically, given a low designated prob­
individual who's responsible for communicating in the organiza­
ability value X, e.g. 0.05, VaR expresses the threshold loss value
tion to apply the patch, did not'.22 Cyber security should not
such that the probability of the loss exceeding the VaR value is
be reliant on the error-free human action of any individual, just
the low number X. As with other types of risks, the concern is
as airline safety should not be reliant on the perfect, impec­
not only with expected losses from cyber threats, but should
cable job performance of any one pilot. No computer user can
incorporate an understanding of potentially more significant
presume that computer software is bug-free, and no C EO can
losses that could occur with a small but finite probability. Cyber
presume that the successful management of such bugs can be
VaR can be perceived as the value exposed given both common
achieved without some occasional human error.
and significant attack risks. Technically, financial value at risk
is defined as the maximum loss for a given confidence interval
20 EIOPA (2017). (say, with 95% certainty) on a given time horizon, e.g. one year.
21 See References for list of publications by CCRS. Traditionally, the confidence levels have been estimated under
22 Harmer (2017). the simplifying hypothesis that the underlying loss variability

358 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
can be represented by a bell-shaped normal distribution. This is but this would be little consolation to an organization that suf­
very convenient for mathematical analysis, because the sum of fered loss through a Xen bug.
any number of normal distributions is still normal. However, the
normal approximation is invalid for open-ended risks like cyber
risks, which recognize no bounds of geography and can increase
Counterfactual Analysis
in severity scale by orders of magnitude. A problem faced by Counterfactual analysis can also quantify the benefit from past
cyber risk analysts is the brief observational period of historical security enhancements, such as regular penetration testing, as
data, which may not represent accurately the tail of the loss dis­ well as from the introduction of resilience measures to mitigate
tribution, which could have a much fatter shape than any bell. the loss from cyber attacks. For example, measures to stream­
line the process of restoring backup systems in the event of a

Re-Simulations of Historical Events ransomware attack might be assessed retrospectively for the
W annaCry attack of May 2017. Suppose that the kill switch had
The historical record of cyber attacks is just a couple of decades not been found early on by Marcus Hutchins, and that Wanna­
long. By conducting stochastic simulations of past cyber attacks Cry had spread widely within the United States. How much
within this time window, cyber risk analysts can look beyond the worse might the corporate cyber loss have been if an improved
near horizon of history and scan the far horizon, gaining insight backup restoration process had not been implemented? Due
into how large cyber losses might potentially have been. For consideration of past near misses such as this would encour­
example, suppose that a major bug (such as H eartbleed) had age improved future preparedness for, and resilience against,
been discovered by a black hat rather than by a white hat; what another ransomware attack.
might the cyber loss have been? Even though H ea rtb leed was
This kind of counterfactual analysis would also help decide on
found first in 2014 by the Google security team, the alarming
the cost-effectiveness of additional cyber resilience measures.
potential for data exfiltration was demonstrated by Chinese
Suppose that an additional resilience technology had been
hackers who, after the bug was disclosed, stole the personal
introduced several years ago. How much would the cyber losses
data of about 4.5 million patients of hospital group Community
over this period have been reduced? A positive answer would
Health Systems Inc. The hackers used stolen credentials to log
then lead to a quantitative assessment of whether the substan­
into the network posing as employees. Once in, they hacked
tial expenditure on this resilience enhancement is warranted by
their way into a database and stole millions of records. If this
prescribed corporate limits on its cyber risk appetite. Resilient
bug had not been found by white hats and patched, many
organizations are less prone to strategic surprise.
criminal hacking groups might have followed this basic modus
operandi of using the H ea rtb leed bug to steal credentials, which
would then be a gateway of opportunity to exfiltrate very large Building Back Better
volumes of valuable data. With a complete medical record sell­
In the depth of the financial crisis in November 2008, President­
ing on the dark web for high prices, the economic loss from tens
elect Obama's chief of staff, Rahm Emanuel, looked forward
of millions of medical records alone might have been many bil­
optimistically: 'You never let a serious crisis go to waste. And
lions of dollars.
what I mean by that - it's an opportunity to do things you
The sensitivity of corporate vulnerability to cloud failure might could not do before'.24 In earthquake engineering, there is an
also be assessed by revisiting the most severe historical cloud extended resilience concept that reconstruction after an earth­
outages involving a cloud service provider, and contemplating quake should not merely aim to restore a building to its pre­
some downward counterfactuals where the situation, which was earthquake state, which was evidently seismically vulnerable,
bad already, turned for the worse because of poor resilience but to make it more earthquake-resistant in the future. This is
of the cloud service provider. In 2015, a notable bug, XSA -148, called building back better. The same concept applies to recon­
was found in the Xen hypervisor software by the cloud platform figuring a computer system after a major cyber attack. Merely
security team at the Chinese multinational A libaba.23 This bug restoring previous functionality with its exposed security vulner­
would have allowed malicious code to be written into a hypervi­ abilities is a poor short-term option; far superior is building in
sor's memory space. This vulnerability was probably the worst more robust, enhanced security from the outset. For example, if
ever seen affecting Xen, which is a free software project. It is overall system failure can be traced back to a single item failure,
claimed that Xen has fewer critical bugs than other hypervisors, which could have either a technological or human source, then

23 Luan (2016). 24 Selb (2008).

Chapter 23 The Cyber-Resilient Organization ■ 359

introducing some extra redundancy could mitigate this source of the proliferation of carcinogenic asbestos in buildings, which
cyber risk in the future. made it prohibitively expensive and risky to run internet cables
through old school walls. Wi-Fi was the innovative and resilient
After Target suffered a massive data breach in 2013, the task of
answer to a seemingly formidable obstacle. In a most timely
building back better started with Target doing something it had
fashion, Wi-Fi was invented and first released for consumers the
never done before - appoint a chief information security officer
year afterwards, 1997.
(CISO). An experienced CISO was hired from General Motors to
lead the post-breach response. Upgrading payment terminals Transcending the physical barriers of old building construc­
was clearly essential, and $100 million was spent to support tion, this seminal advance in educational opportunity has been
chip-and-PIN credit and debit cards, which had been introduced crucial in making internet access a basic right of a US citizen.
in Europe some years before. W hether it was the cost of hiring a Wi-Fi has also been a major opportunity for cyber criminals,
top CISO or upgrading payment terminals, even a simplified VaR especially public W i-Fi. Data over this type of open connec­
analysis would have demonstrated these to be cost-effective tion is often unencrypted and unsecured, and consequently
security enhancements, considering that customer confidence vulnerable to man-in-the-middle attacks whereby sensitive data
decline would have sharply limited its corporate cyber risk can be intercepted. To keep at least one step ahead of cyber
appetite. criminals, a continuous investment increase in security educa­
tion will be essential.

Events Drive Change

Education for Cyber Resilience
Cyber criminals learn from each other, and so do their victims.
Organizations can build back better, not just when they them­ The universal availability to US schoolchildren of Wi-Fi is now
selves have suffered loss, but when others have had this mis­ crucial for filling the looming cyber security skills gap. Demand
fortune. The Target breach was a wake-up call not just for the for cyber security professionals is growing faster than the overall
retailer's own management, but for management right across IT job market. Many more of the millennial cohort are needed
corporate America. A survey conducted of 20,000 IT practitio­ to train and work as cyber security professionals. The increasing
ners in the United States by the Ponemon Institute found that demand for young cyber security staff should serve a valuable
respondents' security budgets increased by an average of 34% societal purpose in providing gainful employment for hackers of
in the year following the Target breach, with most of those funds rather modest IT skill and knowledge, who might struggle to get
used for security information and event management (50%), end a well-paying job in a tight IT labor market.
point security (48%), and intrusion detection and prevention Such average hackers might otherwise drift into a life of petty
(44%).25 Some 60% of respondents also said they made changes cyber crim e, purchasing from better-skilled cyber criminals
to their operations and compliance processes in response to off-the-shelf exploit toolkits that they could use to make
recent well-publicized data breaches: 56% created an incident money illegally in cyberspace. With demand for talented cyber
response team, 50% conducted training and awareness activi­ security professionals outstripping supply now and into the
ties, 48% added new policies and procedures, 48% began using foreseeable future, a life of cyber crime makes little sense for
data security effectiveness metrics, 47% added specialized edu­ a highly able cyber security professional, unless he or she has
cation for the IT security staff, and 41% added monitoring and a penchant for illegal hacking, in which case legitimate and
enforcement activities. fulfilling governm ent employment at the National Security
From such substantial remedial security measures, organiza­ Agency (NSA) or Governm ent Communications Headquarters
tions show they can be fast learners in cyberspace, and the (GCHQ ) beckons. Collectively, NSA and G C H Q may have
cyber security market is seen to be highly adaptive, swift, and the best offensive cyber attack capability, which in itself is an
responsive to new commercial opportunity. Indeed, the digital employment draw.
revolution would not have happened so rapidly had it not been Aviation resilience in the skies ultimately depends on the skill,
for the spirit of technical enterprise and ingenuity that digital training, and experience of airline pilots. The safety of airlines
pioneers have abundantly displayed in overcoming enormous varies quite significantly, even though their fleets of Boeing arid
challenges. Back in 1996, the Clinton-Gore vision of having Airbus aircraft may be quite similar. The cyber security of corpo­
the internet in every American school seemed blighted by rations also varies quite significantly, even though their Micro­
soft and Apple computer systems may also be quite similar.
Cyberspace resilience ultimately depends on the skill, training,
25 Ponemon Institute (2015). and experience of smart cyber security professionals who have

360 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the knowledge, capability, and motivation to defend their orga­ Cyber Academ y to defend the nation in cyberspace. This acad­
nization effectively against a continuous barrage of targeted and emy would be rather like the existing sea, land, and air acad­
random cyber attacks, some of which are masterminded by elite emies at Annapolis, West Point, and Colorado Springs. The
state-sponsored hacking teams. underlying rationale for this investment is the realization that
winning in cyberspace is fundamentally a matter of cyber secu­

Improving the Cyber Profession rity skill and expertise.

Beyond the government, recruiting and retaining the best cyber

In any professional adversarial contest, the outcome depends
security staff should be a priority of every cyber-resilient organi­
heavily on the quality of the best players. Nobody appreciates
zation. In 2018, 70% of CISO s reckoned that lack of competent
this as much as the North Koreans, Chinese, and Russians, with
in-house staff was their top security threat. Other than being tar­
their prestigious and highly competitive cyber academies. To
geted by a cyber attack, the resilience of a corporation may be
match such training centers of cyber excellence, the UK National
severely tested if one or more of its leading cyber security team
Cyber Security Centre has offered bursaries, specialist training,
were to leave. From the CISO downwards, robust backup plans
and paid work placements to a thousand young British students.
need to be prepared for this contingency. Management consul­
This training initiative has had the support of major international
tants highlight the importance of both CISO succession planning
defense contractors, as well as the City of London Police.
and developing others to represent the CISO . The sooner that
More ambitiously, with additional US expenditure on national individuals are trained and prepared for this role, the more resil­
security programs, the Pentagon could establish a US National ient a corporation will be.

Chapter 23 The Cyber-Resilient Organization ■ 361

 Learning Objectives
After completing this reading you should be able to:

Define cyber-resilience and compare recent regulatory Explain and assess current practices for the sharing of
initiatives in the area of cyber-resilience. cybersecurity information between different types of
institutions.
Describe current practices by banks and supervisors in
the governance of a cyber-risk management framework, Describe practices for the governance of risks of
including roles and responsibilities. interconnected third-party service providers.

Explain methods for supervising cyber-resilience, testing

and incident response approaches, and cybersecurity and
resilience metrics.

E x c e rp t is rep rin ted from Cyber-Resilience: Range of Practices, by the Basel C om m ittee on Banking Supervision, D e ce m b e r 2018.
R e p rin ted with perm ission o f the Bank for International Settlem en ts. The full publication is available on the BIS w eb site free o f
charge: w w w .b is.o rg .

363
24.1 INTRODUCTION resilience beyond the purview of operational risk management
and minimum capital requirements, and established the O pera­
In March 2017, the G20 Finance Ministers and Central Bank tional Resilience Working Group (ORG) with the intention of
Governors noted that "the malicious use of information and contributing to, inter alia, the international effort related to
communication technologies (ICT) could disrupt financial cyber-risk in close coordination with the other international bod­
services crucial to both national and international financial ies involved. The Committee therefore requested that the ORG
systems, undermine security and confidence, and endanger provide this first assessment of observed cyber-resilience prac­
financial stab ility".1 tices at authorities and firms.

Regulated institutions' use of technology includes greater levels of The objective of this report is to identify, describe and compare
automation and integration with third-party service providers and the range of observed bank, regulatory and supervisory cyber­
customers.*2 This results in an attack surface that is growing and is resilience practices across jurisdictions. In preparing this range
accessible from anywhere, and it incentivises cyber-adversaries to of practices document, ORG members used the input provided
increase their capabilities. Increased use of third-party providers by their organisation to an FSB survey in April 2017, which led
means that the perimeter of interest to financial sector regulators to the publication of its stocktake of publicly released cyber­
has gotten bigger, and greater use of cloud services means that security regulations, guidance and supervisory practices at both
the perimeter is also shared. Shared service models require regu­ the national and international level issued in October 2017.
lated institutions to think differently about how they build and According to the FSB cyber-security stocktake, banking is the
maintain their cyber-resilience in partnership with third parties. only sector in financial services for which all FSB jurisdictions
have issued at least a regulation, guidance or supervisory prac­
Given the increase in the frequency, severity and sophistication
tices. In addition, the FSB found that member jurisdictions drew
of cyber-incidents in recent years, a number of legislative, regu­
upon a small body of previously developed national or interna­
latory and supervisory initiatives have been taken to increase
tional guidance or standards of public authorities or private
cyber-resilience. At the international level, the G7 issued Funda­
bodies in developing their cyber-security regulatory and supervi­
mental Elements of Cyber-security for the financial sector,3 and
sory schemes (mainly the 2016 CPIM I-IOSCO guidance, the US
the Committee on Payments and Market Infrastructures (CPMI)
National Institute of Standards and Technology (NIST) cyber­
issued, jointly with the International Organization of Securities
security framework and the ISO 27000 series).6
Commissions (IO SCO ), guidance on cyber-resilience for financial
market infrastructures (FMIs) in June 2016.4 In the European Besides reviewing and completing their jurisdiction's responses
Union (EU), the European Commission's (EC) Fintech Action Plan to the FSB survey questions, ORG members shared their direct
invites the European Supervisory Authorities to consider issuing experiences and insights in order to provide a more concrete
guidelines to achieve convergence on ICT risk.5 and specific understanding of the main trends, progress and
gaps in the pursuit of cyber-resilience in the banking sector. Fur­
Against this backdrop, the Basel Committee on Banking Super­
thermore, additional insight was gained and findings were fine-
vision (BCBS) recognised the merits of approaching operational
tuned through outreach to a broad set of industry stakeholders
including banks, utility and technology service providers, consul­
tancies and associations involved in domestic and international
See G20, Communique: G20 Finance Ministers and Central Bank
A

Governors Meeting, Baden-Baden, Germany, 17-18 March 2017, www cyber-security matters.
.bundesfinanzministerium.de/Content/EN/Standardartikel/Topics/
For the purpose of this report, the BCBS uses the FSB Lexicon
Featured/G20/g20-communique.pdf?_blob=publicationFile&v=3.
definition of cyber-resilience,7 which defines it as the ability of
2 Many regulated institutions are adopting strategies that will see more
data stored and/or processed outside the perimeters of the regulated an organisation to continue to carry out its mission by anticipat­
institution while at the same time granting service providers (now grow­ ing and adapting to cyber threats and other relevant changes in
ing to what is commonly a multitude of providers) access to their envi­ the environment and by withstanding, containing and rapidly
ronments to perform business and technology processes.
recovering from cyber incidents. Although this paper focuses on
3 See G7, Fundamental elements of cybersecurity for the financial sector,
October 2016.
4 See CPMI-IOSCO: Guidance on cyber-resilience for financial market 6 See NIST, Framework for improving critical infrastructure cybersecurity,
infrastructures, June 2016. 16 April 2018, www.nist.gov/cyberframework/framework, which consists
of standards, guidelines and best practices to manage cyber- security-
5 The European Securities and Markets Authority (ESMA), the European
related risk.
Banking Authority (EBA), and the European Insurance and Occupational
Pensions Authority (EIOPA), collective referred to as the "European 7 See FSB, Cyber Lexicon, 12 June 2018, www.fsb.org/wp-content/
Supervisory Authorities". uploads/P121118-l.pdf.

364 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
cyber-resilience, practices also relevant to the broader opera­ Standards on general risk topics such as business continuity
tional resilience context were considered. A distinction was also planning and outsourcing contribute to the management of a
drawn between cyber-risk management (which deals with vul­ wide range of risks and also have relevance to cyber-risk. Discus­
nerabilities and threats) and IT risk management, the scope of sion at the 2017 Information Technology Supervisors' Group
which is broader than the matter at hand in this report. Where (ITSG) meeting highlighted that many countries are working on
appropriate, deeper dives on practices that reflect new updates to their outsourcing standards.9 The Australian Pruden­
approaches or address widely shared strategic concerns have tial Regulation Authority(APRA) is also considering whether the
been performed ORG members in the form of nine specific term outsourcing remains relevant or whether service p ro vid er
case studies. risk m anagem ent might be more appropriate, recognising that
bank supply chains have become more complex. Section 6 of
The remainder of this report is divided into the following
this report further discusses expectations and practices in rela­
sections:
tion to third-party interconnections.
• Section 2 provides a high-level overview of current
Specific cyber-risk management guidance has emerged in the
approaches taken by jurisdictions to issue cyber-resilience
context of information security. A few jurisdictions have issued
guidance standards.
specific cyber-risk management or information security guidance,
• Section 3 assesses the range of practices regarding gover­
including on the importance of effective cyber-security risk man­
nance arrangements for cyber-resilience.
agement (Hong Kong SAR), on early detection of cyber intru­
• Section 4 focuses on current approaches on cyber-risk man­ sions (Singapore), on the establishment of a cyber-security policy
agement, testing, and incident response and recovery. (Brazil) and on the common procedures and methodologies for
• Section 5 explores the various types of communications and the assessment of ICT risk (European Banking Authority (EBA)).
information-sharing. In jurisdictions where no specific cyber-security regulations exist
• Section 6 analyses expectations and practices related to for the financial sector, supervisors encourage their regulated
interconnections with third-party services provides in the con­ entities to implement international standards and apply prescrip­
text of cyber-resilience. tive guidance, and supervisory practices align with the top-down
initiatives of national cyber-agencies. Most jurisdictions implement
key concepts from international and industry standards such as
24.2 CYBER-RESILIENCE STANDARDS NIST, ISO/IEC and CO BIT.10 Regulators also leverage supervisory
AND GUIDELINES practices from the US (Federal Financial Institution Examining
Council (FFIEC) IT Examination Handbook) and the UK (CBEST).
Most jurisdictions address cyber through the lens of IT and gen­
Some jurisdictions are developing enforceable standards for
eral operational risk. Cyber-resilience expectations, which are
cyber-resilience in the financial sector. This is the theme of this
sometimes embedded within high-level IT risk guidance, cover a
report's first case study (Box 24.1).
wide range of regulatory standards.8 The intent of IT risk guid­
ance is to communicate jurisdictions' expectations and encour­
age good practice. Guidance typically addresses governance,
24.3 CYBER-GOVERNANCE
risk management, information security, IT recovery and manage­
ment of IT outsourcing arrangements. While guidance is pre­ The majority of the regulators have issued either principles-
sented as operational risk or IT risk guidance, it effectively based guidance or prescriptive regulations, with varying levels
provides coverage of cyber-risk management as a subset of of maturity. In general, regulatory standards and supervisory
these practices. practices address enterprise IT risk management but do not
include specific regulations or supervisory practices that cover

8 We note that while the majority of jurisdictions' cyber-resilience expec­

tations are derived from common frameworks, eg NIST, each supervisory
9 The Information Technology Supervisors' Group (ITSG) is an interna­
authority has designed their own assessment tools, eg questionnaires.
tional working group of IT supervisors which meets annually to discuss
As a result, regulated entities are required to provide slightly different
approaches to IT risk (including cyber-risk).
information to each supervisory authority, even where the broad ques­
tions posed are the same. Banks and supervisory authorities may benefit 10 Control Objectives for Information and Related Technologies (COBIT)
from harmonisation and standardisation, not just of supervisory expecta­ is a good practice framework created by international professional
tions, but also of the information requested by supervisors and the tools association ISACA for information technology (IT) management and IT
used to collect it. governance.

Chapter 24 Cyber-Resilience: Range of Practices ■ 365

 BOX 24.1 CASE STUDY 1s RECENT REGULATORY INITIATIVES - THE
AUSTRALIAN, GERMAN AND US MINIMUM REQUIREMENTS
A ustralian Prudential Regulation A utho rity The circular on Minimum Requirements for Risk Manage­
(A PRA ) Prudential Standard CPS 234 ment (MaRisk) provides a comprehensive framework for the
management of all significant risks, thereby concretising the
Inform ation Security
requirements of the German Banking Act. Complementing
This Prudential Standard aims to ensure that an APRA-regu- MaRisk in this regard, the Banking Supervisory Requirements
lated entity takes measures to be resilient against information for IT (BAIT) refines the German Banking Act.
security incidents (including cyber-attacks) by maintaining an
The BAIT covers requirements with respect to:
information security capability commensurate with informa­
tion security vulnerabilities and threats. • IT strategy and IT governance;

A key objective is to minimise the likelihood and impact of • information risk management and information security
information security incidents on the confidentiality, integrity management;
or availability of information assets, including information • user access management;
assets managed by related parties or third parties. The board • IT project management and application development;
of an APRA-regulated entity is ultimately responsible for
• IT operations; and
ensuring that the entity maintains its information security.
The key requirements of this Prudential Standard are that an • outsourcing and other external procurement of IT services.
APRA-regulated entity must:
• clearly define the information security-related roles and US A gencies' N otice of Proposed Rulem aking
responsibilities of the board, senior management, govern­ fo r N ew Cyber-Security Regulations fo r Large
ing bodies and individuals; Financial Institutions
• maintain its information security capability commensu­ Another example is the joint announcement from the US Fed­
rate with the size and extent of threats to its information eral Reserve, the Officer of the Comptroller of the Currency
assets, and so that it enables the continued sound opera­ (O CC) and the Federal Deposit Insurance Corporation (FDIQ,
tion of the entity; which provided a notice of proposed rulemaking for new
• implement controls to protect its information assets cyber-security regulations for large financial institutions. The
com m ensurate with the criticality and sensitivity of intent is to address the type of serious cyber-incident that
those information assets, and undertake system atic te st­ could impact safety and soundness. As announced, require­
ing and assurance regarding the effectiveness of those ments will relate to cyber-risk governance, risk management,
controls; and internal dependency management, external dependency
• notify APRA of material information security incidents. management, incident response, assurance management of
third parties and audit.

Supervisory Requirem ents fo r IT in Financial The State of New York Department of Financial Services has
also released cyber-security regulations that require regulated
Institutions (BaFin Circular 10/2017, BAIT) intuitions in New York to have a cyber-security programme
The German Banking Act requires financial institutions to designed to protect consumers' private data; a written policy
demonstrate that its risk management comprises, among or policies that are approved by the board or a senior officer;
other things, adequate technical and organisational resources a Chief Information Security Officer to help protect data and
and adequate contingency planning, especially for IT systems; and controls and plans in place to help ensure the
systems. safety and soundness of the financial services industry.

cyber-risk management of critical business functions, intercon­ Cyber-Security Strategy Is Expected But
nectedness or third-party risk management. Against this back­
Not Required
drop, supervisory expectations and practices were identified
and analysed in the following areas relevant to governance: Although most regulators do not require regulated entities to
develop a cyber-security strategy, all expect regulated institu­
• Cyber-security strategy
tions to have a board-approved information security strategy,
• Management roles and responsibilities policy and procedures under the broad remit of effective over­
• Cyber-risk awareness culture sight of technology.
• Architecture and standards Many jurisdictions (eg Australia, Brazil and jurisdictions across
• Cyber-security workforce Europe) expect that cyber-risk should be covered by the

366 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
organisation-wide risk management framework and/or informa­ The majority of such guidance prioritises the roles and respon­
tion security framework which is monitored and reviewed by sibilities of the BoD and senior management, while others have
senior executives. prioritised them even more in overseeing overall business tech­
nology risks. Other jurisdictions approach cyber-governance as a
Consistent with the previous observation regarding regulatory
risk that regulated entities are expected to address within their
expectations, most supervisors review regulated entities' infor­
existing risk management frameworks.
mation security strategies, but very few require or evaluate those
entities' standalone cyber-security strategies. Examiners typically Almost all the jurisdictions emphasise the importance of man­
review an institution's information security strategy, information agement roles and responsibilities for cyber-governance and
security plans, and cyber-security implementation, including key controls. In the US, EU and Japan, high-level guidelines encour­
cyber-security initiatives and timelines. They may also review its age global systemically important banks (G-SIBs) and domes­
practices for communicating with relevant stakeholders. tic systemically important banks (D-SIBs) to implement well
defined, risk-sensitive management frameworks under initiatives
A variety of approaches can also be observed within regions:
taken by theBoD. In addition, the EBA implements granular and
while the FFIEC IT Examination Handbook in the US does not
prescriptive requirements, ensuring consistent cyber-security
specifically address the development of a cyber-security strat­
regulation and supervision across the European banking sector.
egy, Canada's self-assessment guidance attempts to determine
Similarly, emerging market economies implement more granular
whether a regulated financial institution has established a cyber­
and prescriptive cyber-security requirements.
security strategy aligned with the institution's business strategy
and implementation plan. Mexico does not have supervisory
practices focused on cyber-security strategy but has issued regu­
Variety of Supervisory Approaches Regarding the
lations that direct banks to develop IT security strategies.
Second and Third Lines of Defence (3LD)
The majority of regulators have adopted the 3LD risk manage­
Jurisdictions enforce cyber-security strategy requirements using
ment model to assess cyber-security risk and controls. However,
three types of non-mutually exclusive regulatory approaches:
most regulators do not require the implementation of 3LD at
1. The regulator/authority implements cyber-security strategy regulated entities and do not prescribe precisely how responsi­
requirements, either sector-specific or across multiple indus­ bilities should be distributed across the lines, as the expectation
tries, with which financial institutions have to comply. This is rather for banks themselves to clearly define responsibilities
is a common approach in emerging market economies with and leave no gaps between the lines. As a result, supervisory
relative homogeneity in their banking systems. practices for assessing the degree of 3LD implementation vary
2. The financial institutions establish their own cyber-security widely, and there appears to be a greater supervisory focus on
strategies in compliance with principles-based risk manage­ the first and second lines of defence than on the third line across
ment practices. Regulators review these strategies as part jurisdictions, which could hamper the effectiveness of the 3LD
of their assessment of an institution's overall risk manage­ checks and balances model. In particular, only a few jurisdictions
ment practices.11 have formulated specific expectation regarding the independent
reporting line from the chief audit executive to the audit com­
3. A third approach, prevalent in Europe, involves examin­
mittee of the BoD.
ing whether financial entities have an IT strategy and the
accompanying security provisions.

Cyber-Risk Awareness Culture

Management Roles and Responsibilities
An awareness of cyber-risk by staff at individual banks and a
Recognition of the Importance of the Board of common risk culture across the banking industry are prerequi­
Directors and Senior Management sites for maintaining cyber-resilience within the sector. Regula­
Some jurisdictions have issued specific regulatory guidance and tors in most jurisdictions have published guidance emphasising
requirements addressing cyber-governance roles and responsi­ the importance of risk awareness and risk culture for staff
bilities of the board of directors (BoD) and senior management. and management at all levels, including BoDs and third-party
employees. Regulatory requirements include increasing cyber­
security awareness and cyber-related staffing at regulated
11 The Saudi Arabian Monetary Authority (SAMA) applied the first two of entities. In some jurisdictions, regulators require cyber-security
these approaches by compelling financial institutions to formulate their
own cyber-security strategies while it developed supervisory practices awareness training during each phase of the employment pro­
for implementing cyber-security strategy. cess, from recruitment to termination.

Chapter 24 Cyber-Resilience: Range of Practices ■ 367

 BOX 24.2 CASE STUDY 2: ROLES AND RESPONSIBILITIES OF CHIEF
INFORMATION SECURITY OFFICERS (CISOS) IN CYBER-GOVERNANCE
A widespread practice among large and globally active banks Considering the cyber-threat landscape, the Saudi Arabian
is to establish a robust governance structure based on the Monetary Authority (SAMA) issued a principle-based cyber­
3LD model. Typically, in this model, the CISO is the execu­ security framework and mandated financial institution to
tive officer responsible for a bank's cyber-security manage­ comply with various range of control considerations men­
ment. The CISO's role is to serve as a circuit breaker and tioned in different topics of this framework.
to balance the firm's risk appetite with security protection
One such topic addresses responsibilities of the CISO in
considerations long before introducing or expanding digi­
the cyber-security committee, security strategy, security
tal services or products. However, in most cases the CISO
architecture, risk-based cyber-security solutions, operational
reports to the chief risk officer (CRO) or to the chief informa­
security, etc to ensure that cyber-security controls are applied
tion officer (CIO), with no independent reporting line to the
throughout the financial institution. This is reinforced with
C EO or board of directors (BoD). CRO s typically place more
the role of the cyber-security function in financial institutions
emphasis on compliance over risk management. Emerging
where SAM A requires financial institutions to have a cyber­
trends in cyber-governance indicate that the placement of
security function independent from the IT function. This
the CISO under the CRO is not ideal because the two posi­
includes separate budgets and staff evaluations along with
tions have inherently conflicting priorities. When the CISO
the cyber-security function reporting directly to the C EO /
attempts to implement risk-based cyber and IT security con­
managing director or senior management of the control func­
trols that accommodate technological innovation through the
tion of the financial institution.
"plan-do-check-act" (PDCA) cycle, the CRO may prioritise
compliance over the benefits of technological innovation. SAM A also requires financial institutions to perform periodic
This dynamic can impede the CISO from effectively perform­ self-assessments against the cyber-security framework, which
ing his/her job function. In response, some global banks is subject to review (on- and off-site) by SAM A to determine
are restructuring the CISO role by having the CISO report the level of compliance and cyber-security maturity of the
directly to the C EO or BoD. financial institution.

Regulated entities may be required to include non-disclosure for cyber-security architecture. For instance, the US FFIEC IT
clauses within staff agreements. To mitigate insider threats, Examination Handbook specifies that when discussing network
some jurisdictions require new employees to complete a screen­ architecture, supervisors should confirm that the diagrams are
ing and background verification process, while existing employ­ current, securely stored and reflective of a defence-in-depth
ees undergo a mandatory reverification process at regular security architecture. In Saudi Arabia, practices covering cyber­
intervals. In some jurisdictions, regulators assess whether banks security architecture are subject to a periodic self-assessment.
have robust processes and controls in place to ensure their
employees, contractors and third-party vendors understand their
responsibilities, are suitable for their roles and have the requi­
Cyber-Security Workforce
site skills to reduce the risk of theft, fraud or misuse of facilities. The skills and competencies of cyber-workforces, their regula­
The majority of the regulators encourage the development of a tory frameworks and the range of practices differ markedly
common risk culture sufficient to ensure effective cyber-risk man­ across jurisdictions. Some jurisdictions have IT-specific standards
agement. In some jurisdictions, regulators assess each bank's that address the responsibilities of the IT workforce and infor­
cyber-risk appetite, considering such factors as the bank's busi­ mation security functions, with particular attention to cyber­
ness model, core business strategy and key technologies. Some security workforce training and competencies. Their range of
jurisdictions view cyber-security as a critical business function, supervisory practices covers the assessment of team divisions,
since a cyber-attack could lead to the insolvency of individual staff expertise (background and security checks of cyber-security
entities or even to widespread disruption of the entire sector. specialists), the staff training processes and the adequacy of
funding and resources to implement the organisation's cyber­
security framework. Most of the jurisdictions are in the early
Architecture and Standards
stages of implementing supervisory practices to monitor a
For most jurisdictions, general regulatory requirements for bank's cyber-workforce skills and resources. Their regulatory
architecture and standards are not in place, or there is a lack of schemes require regulated entities to manage risks but do not
coverage. Only a small number of countries specifically highlight set specific requirements to address cyber-security workforce
control considerations and substantial supervisory guidance skills and resources.

368 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 24.3 CASE STUDY 3: FRAMEWORKS FOR PROFESSIONAL TRAINING
IN CYBER-SECURITY AND CERTIFICATION PROGRAMMES
The Center for Financial Industry Information Systems Security Testers (CREST), ie the C R EST Certified Threat Intel­
(FISC), a public-private partnership, was founded in Japan ligence Manager (CCTIM) for providers of threat intelligence
in 1984 to promote the cyber-security initiatives of financial services, and the C R EST Certified Simulated Attack Manager
institutions. FISC facilitates the exchange of staff between (CCSAM ) and C R EST Certified Simulated Attack Specialist
financial sector supervisors, banks, and IT security vendors (CCSAS) for providers of penetration testing services.
by partnering with the private sector and supervisors. FISC's
efforts have resulted in the development of FISC Guidelines Monetary Authority of Singapore (MAS): MAS requires
for cyber-security preparedness in Japan, as well as cyber­ financial institutions to have in place a comprehensive tech­
security education and training programs for its bankers. nology risk and cyber-security training programme for the
Bank examiners at the FSA and BoJ reference FISC Guide­ BoD. Such a programme may include periodic briefings con­
lines to ensure a consistent and integrated supervisory ducted by in-house cyber-security professionals or external
approach. The same structure can be found in the Finan­ specialists. The goal is to help equip the BoD with the requi­
cial Security Institute (FSI) founded in Korea in 2015. This site knowledge to competently exercise its oversight function
illustrates the effectiveness of cross-border public-private and appraise the adequacy and effectiveness of the financial
partnerships when the supervisors leverage the industry for institution's overall cyber-resilience programme.
cyber-security enhancement. At a minimum, FISC's efforts
Hong Kong Monetary Authority (HKMA): The HKMA's Pro­
serve as a model for other jurisdictions transitioning from
fessional Development Program (PDP) is one of the three ele­
prescriptive to more risk-based and incentive-compatible
ments of HKMA's Cybersecurity Fortification Initiative (CFI).
regulatory models.
It seeks to increase the supply of qualified cyber-security
Bank of England (BoE): The BoE has established the C B EST professionals in Hong Kong SAR. The HKM A has worked
accreditation for suppliers who offer threat intelligence and with the Hong Kong Institute of Bankers and the Hong Kong
penetration testing services who wish to be involved in the Applied Science and Technology Research Institute (ASTRI)
C B ES T scheme. This is in addition to the accreditation for to develop a localised certification scheme and training pro­
individuals offered by the Council for Registered Ethical gramme for cyber-security professionals.

The majority of regulators assess the cyber-security workforce appropriate cyber-security workforce management. In other
of the institutions through on-site inspections, where they have jurisdictions, regulatory requirements for cyber-workforce man­
the opportunity to talk with relevant specialists. Self-assessment agement are limited to supervisory expectations, and there may
questionnaires are becoming common practice. Training pro­ be no assessment by supervisors of cyber-security skills and staff
cesses are particularly scrutinised. As staff competence is integral training at regulated entities. Only the Hong Kong, Singapore
to cyber-security, authorities have been known to raise concerns and the UK have issued dedicated frameworks to certify cyber­
about the capability or qualifications of an institution's head workforce skills and competencies.
of IT or information security. Jurisdictions diverge in how they
regulate the roles and responsibilities of the IT and information
security staff. Some jurisdictions, including Argentina, Australia, 24.4 APPROACHES TO RISK
the EU, Japan and Saudi Arabia, issue regulations specifically MANAGEMENT, TESTING AND
addressing IT staff's roles and responsibilities. Sometimes regula­
INCIDENT RESPONSE AND RECOVERY
tions are embedded in a jurisdiction's global governance frame­
work, such as those issued in Switzerland. In regulations issued This section sets out a range of observed practices on cyber-risk
by Mexico, the US, and Saudi Arabia, regulatory requirements
management, and incident response and recovery. It aims to identify
addressing the roles and responsibilities of the IT and informa­ practices in the supervision of banks' cyber-resilience which could
tion security functions are encompassed by requirements for the
inform future work. This section is divided into four sub-sections:
BoD and senior management. In South Africa, such regulations
are included in the national cyber-security strategy. • Methods for supervising cyber-resilience
• Information security controls testing and independent
The range of practices and regulatory expectations for work­
assurance
force competence is wide, and many jurisdictions have not
formulated any. The FISC in Japan and FSI in South Korea are • Response and recovery testing and exercising
both examples where public authorities have set guidelines on • Cyber-security and resilience metrics.

Chapter 24 Cyber-Resilience: Range of Practices ■ 369

Methods for Supervising Cyber-Resilience Jurisdictions Increasingly Engage With Industry
to Address Cyber-Resilience
Risk Specialists Assess Information Security
Management and Controls Industry engagement is used to either influence industry behav­
iour, or to seek feedback and views to inform regulatory work.
Jurisdictions apply different approaches to supervise regulated
For instance, the French Autorite de Controle Prudentiel et de
institutions' cyber-resilience. Most focus on key risks such as
Resolution (ACPR) and the UK Prudential Regulation Authority
cyber in the context of the scale, complexity, business model
(PRA) both released discussion papers, on IT risk and opera­
and previous findings, often assigning institutions to categories
tional resilience respectively, in 2018.13 Common methods of
to aid decisions about which institutions will be in scope for vari­
engagement also include speaking at conferences and other
ous supervisory initiatives. Guided by existing international and
communications to reach a range of regulated entities and
national legislation, a programme of supervision is then agreed
industry participants.14
spanning financial and operational resilience matters.
Some jurisdictions include third-party service providers in this
Half of the jurisdictions in the EU have internal guidance
engagement. In the EU, both the European Commission EU
addressing the circumstances when the competent authority
FinTech Lab and the EBA FinTech Knowledge Hub have organ­
should conduct a cyber-security review. These include institu­
ised events with regulators, supervisors, industry and third-party
tions' own risk assessments, findings from on-site inspections or
service providers. Communicating key messages through these
questionnaires, and incidents (eg cyber incident trend analysis).
channels can be faster and more responsive.
Risk specialists typically draw on documentary evidence includ­
ing survey responses, physical inspections, incident reports,
and in-person meetings to assess the adequacy of controls in
Information Security Controls Testing
place. Many supervisory expectations are aligned with industry and Independent Assurance
standards (eg COBIT, NIST) but approach, depth and breadth of Mapping and Classifying Business Services Should
supervisory assessments vary between jurisdictions. Inform Testing and Assurance
Most jurisdictions undertake off- and on-site reviews and inspec­ Most jurisdictions (eg Australia, the EU, Hong Kong, Singapore
tions of regulated institutions' information security controls to and the US) recognise the importance of mapping and classify­
assess compliance with regulatory standards and alignment with ing business services and supporting assets and services as a
good practice.12 Reviews are completed either as part of gen­ basis for building resilience. A clear understanding of business
eral technology assessments or risk management assessments services and supporting assets (and their criticality and sensitiv­
more broadly. They tend to focus on governance and strategy, ity) can be used to design testing and assurance of end-to-end
management and frameworks, controls, third-party arrange­ business services. This is typically completed as part of business
ments, training, monitoring and detection, response and recov­ impact analysis, recovery and resolution planning, reviewing
ery, and information-sharing and communication. dependency of critical services on external third parties, and
The number, type, and nature of regulated institutions vary by scoping for assessments.
jurisdiction, as do the size of the specialist risk teams of the A number of jurisdictions assess institutions' monitoring and
regulator. Some jurisdictions (eg Australia, Brazil and Singapore) surveillance of emerging threats, including real-time detec­
have developed approaches to equip front-line supervisors with tion capability, ability to detect adversaries before they move
knowledge and tools to assess (triage) IT risk issues. Techniques between systems and relevant continuity and control policies.
used include guidelines on how to identify and evaluate IT Some jurisdictions perform thematic reviews (eg Sweden com­
risk, questionnaires, risk assessments and tools to quantify risk pleted a review of institutions' access controls and management
assessments. Additionally, a number of jurisdictions (eg Australia
and the UK) have powers to appoint an auditor or other third
party to provide a report to the regulator on a particular aspect
13 See ACPR, "IT Risk", Discussion Paper, March 2018, www.acpr
of the regulated institutions' risk management, including cyber.
.banque-france.fr/sites/default/files/medias/documents/it_risk.pdf; and
Bank of England and Financial Conduct Authority, "Building the UK
financial sector's operational resilience", Discussion Paper, July 2018,
www.bankofengland.co.uk/-/media/boe/files/prudential-regulation/
12 On-site reviews usually consist of one or more meetings with regu­
discussion-paper/2018/dpl I8.pdf.
lated institutions at their premises. Off-site reviews usually consist of
desk-based assessment of documentation or a meeting at the office of 14 Publications used include white papers, information papers, annual
the regulator. reports and in some cases letters to industry.

370 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
of user access rights), while some members use existing inter­ Taxonomy of Cyber-Risk Controls
national standards, applying them to other types of institution
While putting cyber-risk controls in place is only one aspect
(eg South Africa applies the CPM I-IO SCO guidance on cyber­
of building cyber-resilience, many jurisdictions find review of
resilience for FMIs to banks).
controls a ready way to engage with regulated institutions.
Independent assurance also provides management and regula­ Some jurisdictions use taxonomies of controls to understand
tors with an evaluation of whether appropriate controls have whether there are any gaps in the coverage of their supervisory
been implemented effectively. Jurisdictions commonly also approach. Currently the taxonomies are jurisdiction-specific
leverage the management information outputs of these activi­ and do not rely on harmonised concepts and definitions. If an
ties, providing the regulator with another source of information authority is unable to assess a particular type of control, for
for their own assessments. example because it has no supervisory approach, assessment
method or the required skillset to assess the control, then that is
Penetration Testing identified as a gap. An example taxonomy of cyber or informa­

Cyber-security controls are implemented through risk-based tion security controls is included in Annex A.

decisions against a regulated institution's risk appetite. Regu­

lated institutions typically test information security controls
applied to hardware, software and data to prevent, detect, Response and Recovery Testing
respond and recover from cyber-incidents. and Exercising
Supervisors review and challenge regulated institutions' Evaluation of Service Continuity, Response and
approach to testing controls and the remediation of issues iden­ Recovery Plans and Continuous Learning
tified. This can include reviewing survey responses, threat and
Evaluation of service continuity plans focuses on reviewing
vulnerability assessments, risk assessments, audit reports and
alignment with institutions' risk management frameworks, the
control testing reports (eg penetration testing, health checks).
business continuity management strategies chosen, IT disaster
Five EU jurisdictions have developed programmes of regulator- recovery arrangements and data centre strategies.
led penetration tests and three (the EC B, the Netherlands
The majority of regulators require entities to establish a fram e­
and the UK) have provided guidance for regulated institu­
work or policy for prevention, detection, response and recovery
tions on howto test. Tests are typically voluntary, funded by
activities, including incident reporting. Specific requirements
the regulated institution and targeted at larger, more systemic
vary across supervisory authorities, and most are not specific
institutions. In particular, threat-led red team penetration tests
to cyber-risk. Indeed, few regulators have issued cyber-specific
delivered by third-party threat intelligence and penetration tes­
business continuity or disaster recovery regulatory requirements
ters are becoming more widespread. The majority of directed
for the sector. A few jurisdictions, like China and India, have
penetration tests focus on regulated institutions' protective
prescribed cyber-incident response framework to be a key com­
and detective cyber-resilience capabilities, while a few also test
ponent of cyber-governance. The US also has supervisory guid­
response and recovery capabilities.
ance regarding incident management, covering identification
In May 2018, the ECB published the European Framework for of indicator of compromise, analysis and classification of events
Threat Intelligence-based Ethical Red Teaming (TIBER-EU ),15 and escalation and reporting of incidents. Some authorities,
which is the first Europe-wide framework for controlled and such as the Japanese Financial Services Agency (JFSA) and Bank
bespoke tests against cyber-attacks in the financial market. The of Japan, also focus on potential threats and information-sharing
framework facilitates testing for cross-border entities under the to minimise delays in reporting cyber-incidents.
oversight of several authorities. It is up to the relevant authori­
Evaluation of regulated institutions' incident response and
ties and the entities themselves to determine if and when TIBER-
recovery plans focuses on how plans are triggered, institutions'
EU based tests are performed. Tests will be tailor-made and will
ability to implement plans, preservation of data and specific
not result in a pass or fail - rather they will provide the tested
actions for "critical" technology. In Canada, the assessment of a
entity with insight into its strengths and weaknesses, and enable
bank's internal and external communication plans and protocols
it to learn and evolve to improve cyber-maturity.
seeks to determine if all relevant stakeholders are included, to
avoid contagion.
15 ECB, "ECB publishes European framework for testing financial sector
resilience to cyber-attacks", press release, 2 May 2018, www.ecb Several jurisdictions (eg Australia, Belgium, Hong Kong, Japan and
.europa.eu/press/pr/date/2018/html/ecb. prl80502.en.html. the US) complete a supervisory review of post-incident learning.

Chapter 24 Cyber-Resilience: Range of Practices ■ 371

 BOX 24.4 CASE STUDY 4: "EXERCISE RESILIENT SHIELD"
One exam ple of an international public-private exercise • furthering mutual understanding of each country's cyber­
was UK/US "Exe rcise " Resilient Shield in 2015 - a joint security information-sharing processes and incident response
exercise with leading global financial firms to enhance coordination structures, including scenarios that may call for
cooperation and ability to respond effectively to a cyber­ a coordinated response and public communications; and
incident in the finance sector. The exercise was not a test • exchanging best practices domestically and between
of individual financial firms or financial system s, but was the US and UK on a government-to-government and
designed to improve understanding across governments government-to-financial sector basis.
and industry of information-sharing, incident response han­
dling and public communications. The exercise did not:

Participants included UK and US supervisory authorities, • amount to a "cyber war game" or include live play;
government departments and cyber-agencies. The exercise • test the actions of law enforcement or the security and
examined how the UK and US could enhance cyber-security intelligence agencies;
cooperation by: • seek to involve the entire range of the UK and US finance
• enhancing processes and mechanisms for maintaining sectors; or
shared awareness of cyber-security threats between US • seek to test individual firms or financial systems, but
and UK governments and the private sector; instead rehearse communication and coordination links.

This is conducted through the discussion of regulated institutions' Cyber-Security and Resilience Metrics
response and the root cause analysis, but no further standard
practice could be observed. Cyber-Security and Resilience Metrics are Not
Yet Mature
Joint Public-Private Exercising Some jurisdictions have methodologies to assess or benchmark
Distinct from testing, most supervisors and banks use exercises regulated institutions' cyber-security and resilience. Those juris­
to train and practice how they would respond to an incident. dictions that have developed ways to assess cyber-security and
Cross-border international exercises have made this more visi­ resilience have focused on reported incidents, surveys, penetra­
ble. Examples include the UK/US exercise Resilient Shield tion tests and on-site inspections. None of these methodologies
(Box 24.4) and the TITUS exercise in 2015,16 as well as the G7 produce quantitative m etrics or risk indicators comparable to
exercise under planning in 2018. those available for financial risks and resilience, eg standardised
quantitative metrics where established data are available.
In the UK, the Sector Exercising Group (SEG), which is a sub­
Instead, indicators provide information on regulated institutions'
group of the Cross Market Operational Resilience Group
approach to building and ensuring cyber-security and resilience
(CM O RG), manages the sector's annual exercise regime, which
more broadly. Supervisory authorities also rely on entities' own
incorporates cyber-specific scenarios.17 In Japan, the JF S A has
management information, although this differs across entities
conducted tabletop exercises to improve cyber-security, and in
and is not yet mature.
particular communication and coordination of response mecha­
nisms. Over 100 regulated institutions including banks, credit Emerging Forward-Looking Indicators of Resilience
unions, insurance companies and securities companies partici­
pated in the 2017 exercise, which covered two cyber-scenarios. It is common for jurisdictions (and often regulated institutions

A summary of results was then published to enable others to themselves) to focus on backward-looking indicators of the

draw lessons from the exercise. performance of the technology function. These indicators are
presented to Board members and executives as part of manage­
ment information that regulators may review (examples can be
16 TITUS was a crisis communication exercise for euro area financial mar­ found in Annex B).
ket infrastructures held in November 2015.
Backward-looking indicators comment on past performance as
17 CMORG is a UK industry forum which is co-chaired by the Bank of
England and UK Finance and attended by senior representatives from an indicator of future performance, which is reasonable when
regulated institutions. institutions' operations and risk environment are relatively stable

372 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
over time and more or less independent from outside influ­ A number of jurisdictions (eg Australia, Canada, the ECB-SSM ,
ences. However, cyber-risk frustrates this because adversaries Hong Kong, Singapore, the UK and the US) analyse survey
are dynamic, themselves adapting to institutions' responses and responses to assess regulated institutions' capabilities and
protective measures, sometimes changing their tactics and strat­ inform prioritisation of follow-up work. The outcomes of this
egies even in the space of a single cyber-incident. Distributed work tend to be institution-specific findings and remediation or
denial of service (DDOS) incidents are a good example, where action plans which can be monitored over time, and/or thematic
the volume and scale of disrupted internet traffic generated reports. As such, they provide indicators and trends if per­
has increased significantly in the last two years and adversaries formed on a regular basis. Results from the Australian surveys
adapt their techniques in response to an institution's defences. are subsequently published to influence industry behaviour. In
While backward-looking metrics continue to be important, the UK, thematic findings are often shared with participating
jurisdictions are increasingly recognising the need for forward- firms for the same purpose.
looking indicators as direct and indirect metrics of resilience,
indicating whether a regulated institution is likely to be more or
less resilient in the event of a risk crystallising. 24.5 COMMUNICATION AND
Regulated institutions are also seeking to improve metrics for SHARING OF INFORMATION
resilience more broadly. Annex C contains cyber-centric metrics
collated by a sample set of regulated institutions for decision­ Most Basel Committee jurisdictions have put in place cyber-secu­
rity information-sharing mechanisms, be they mandatory or vol­
making bodies (boards and board sub-committees). It is notable
untary, to facilitate sharing of cyber-security information among
that the data provided typically allow for trend information so
that the reviewer can assess if the situation is getting better banks, regulators and security agencies. These communications

or worse. Some metrics track compliance with internal policies are established for multiple purposes, including helping relevant

while others measure inherent risk. Patch ageing in particular is parties defend themselves against emerging cyber-threats.

a widespread and comparable metric. This section sets out a range of observed cyber-security

This list of cyber-metrics collated by regulated entities can be information-sharing practices among banks and regulators. For

reviewed by regulators to gain insight into what may be col­ the purpose of this report, they are divided into five categories

lected across the regulated population to gain an enhanced set according to the parties involved in the sharing. Figure 24.1

of cyber-metrics for measuring the state of cyber-resilience more illustrates the interlinkages of the five types of practices.

broadly. Collectively, these indicators can inform on the broad

adequacy of an institution's cyber- and operational resilience Overview of Information-Sharing
levels for its business needs and risk appetite. However, no sin­
Frameworks Across Jurisdictions
gle item taken in isolation is seen as a sufficient metric, and no
standard set of indicators has been identified so far to provide a Among the five types of cyber-security information-sharing prac­
meaningful benchmark. tices, sharing among banks; sharing from banks to regulators and

(1) the numbered circles next to the arrows indicate the "types" of info sharing as described in section 5.1 and Figure 24.2.

Source: Basel Committe on Banking Supervision.

Chapter 24 Cyber-Resilience: Range of Practices ■ 373

 0% 20% 40% 60% 80% 100%

Type 1 - among banks 75% 25%

Type 2 - bank to regulator 75% 25%

Type 3 - among regulators 29% 71%

Type 4 - regulator to banks 32% 68%

Type 5 - with security agencies 68% 32%

□ With information-sharing arrangement (either mandatory or voluntary, or both)

□ Without information-sharing arrangement

Fiaure 24.2 P e rce n ta g e of ju risd ictio n s w ith/w ith o u t inform ation-sharing a rra n g e m e n t.

Source: Basel Committee on Banking Supervision.

sharing with security agencies are the most commonly observed. potentially due to the allocation of responsibilities for cyber­
Sharing among regulators is the least observed type. This is partly security information processing among regulators and security
due to the less systematic nature of information-sharing arrange­ agencies within a jurisdiction.
ments between regulators, where it can happen on an ad hoc basis
For some of the jurisdictions, both mandatory and voluntary
at a bilateral level or within supervisory colleges, under specific
information-sharing arrangements are noted for the same type
circumstance. Figure 24.2 illustrates the adoption rate of different
of information-sharing arrangement. This is because voluntary/
types of cyber-security information-sharing, both mandatory and
mandatory sharing is sometimes applicable when different types
voluntary, by the jurisdictions covered by this report.
of information are being shared, or when information is shared
Different kinds of cyber-security information are shared by with different parties. For example, there is a mandatory require­
banks and regulators, including cyber-threat information, ment in Singapore for financial institutions to report relevant cyber­
information related to cyber-security incidents, regulatory and security incidents to MAS, while cyber-threat information exchange
supervisory responses in case of cyber-security incidents and/ between MAS and the Cyber Security Agency (CSA) is voluntary.
or identifications of cyber-threat, and best practices related
Other types of information-sharing arrangements are observed,
to cyber-security risk management. Depending on the type
which include public announcement/disclosure of information
of arrangement, the kind of information shared varies. For
about cyber-security incidents and cross-sector information­
instance, information related to cyber-security incidents is more
sharing with public and private institutions. In particular, the range
widely observed in sharing from banks to regulators and with
of stakeholders involved in cyber-attacks typically includes non­
security agencies, whereas cyber-threat information/intelligence
bank critical infrastructure operators, third-party service providers
is the most common kind of information shared among banks.
and customers who could contribute to sharing information with
Various jurisdictions have put in place certain cyber-security security agencies for further distribution to other sectors, or be
information-sharing arrangements to facilitate more effective part of other setups such as a joint-industry groups.18
sharing of cyber-security information by banks and regulators.
The remainder of this section summarises common practices
Full adoption of all types of information-sharing arrangements
adopted by various jurisdictions, describes more specific prac­
within a jurisdiction is still exceptional.
tices adopted by individual jurisdictions and summarises key
That said, it was also noted that for jurisdictions with observed gaps observed.
practices of information-sharing among banks, there are less
observed practices of information-sharing from regulators
18 This "other" type of information is shown in Figure 24.3. One
to banks. This is probably attributable to the lesser need for example is the EBA guidelines on ICT Risk Assessment under the
sharing by regulators to banks if an effective peer sharing Supervisory Review and Evaluation process (SREP) (EBA/GL/2017/05)
mechanism among banks already exists. Similarly, jurisdictions and recommendations on outsourcing to cloud service providers (EBA/
REC/2017/03), which assumed good information-sharing of IT risks
with observed practices of information-sharing from banks to between banks and supervisors, although there was no specific require­
regulators display lower rates of sharing with security agencies, ment for banks to report security incidents to their supervisors.

374 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 No of practices observed
0% 10% 20% 30% 40% 50% 60%

Cyber-threat information /
18 2 2 2 2 3
CD intelligence
E
o
Cyber-security incidents 20 5 J 4 18 6

Cyber-security regulatory
u 1| 4
Q) responses
if)

Q)
JD
Good practices 2 2
U
M—
o
“U
Other |p l
J
Type 1 - Sharing among banks □ Type 2 - Sharing from bank lo regulator □ Type 3 - Sharing among regulators
□ Type 4 - Sharing from regulator □ Type 5 - Sharing with security agencies □ Others
to banks

Fiqure 24.3 K inds of inform ation shared

Source: Basel Committee on Banking Supervision.

Sharing Among Banks interpersonal level with a closer group and then be exchanged
at the company level with a broader group of banks helps build
Banks share information (eg knowledge of a cyber-security trust into the system.
threat) with peer banks through established channels, mainly
to allow peer banks to take more tim ely action in response Sharing from Banks to Regulators
to similar threats. Although there is no common standard
for automated information-sharing, regulators in most jurisdic­ The sharing of cyber-security information from a bank to its
tions are not directly involved in bank-to-bank inform ation­ regulator(s)/supervisor(s) is generally limited to cyber-incidents
sharing but do play a role in facilitating the establishm ent of based on regulatory reporting requirements. Such requirements
voluntary sharing mechanisms for cyber-vulnerability, threat are mainly established to (i) enable systemic risk monitoring
and incident information, and in some cases indicators of of the financial industry by regulator(s); (ii) enhance regulatory
com prom ise. requirements or issue recommendations by regulator(s) to adjust
policies and strategies based on information collected; (iii) allow
Some jurisdictions have established public sector platforms to
appropriate oversight of incident resolution by regulator(s); and
accomplish information-sharing initiatives while others have
(iv) facilitate further sharing of information with industry and
encouraged private sector development of information-sharing
regulators to develop a cyber-risk response framework.
organisations. Three jurisdictions (Brazil, Japan and Saudi A ra­
bia) have mandated cyber-security information-sharing among Reporting requirements are established by different authori­
banks through regulations or statutes. ties for specific purposes depending on their mandate (eg
supervisory and regulatory functions, consumer protection and
Outside the information-sharing and analysis centre construct,
further distribution of information to national cyber-security
some jurisdictions have established public/private forums or
agencies for systemic operators). Incident reporting by banks
government-led centres for information-sharing. In some juris­
to regulator(s) is a mandatory requirement in many jurisdictions,
dictions, local regulations on data protection are perceived to
with different scopes of requirements and ranges of applica­
be an obstacle to cyber-security information-sharing among
tion. For jurisdictions already enforcing the requirement in the
banks and may warrant a specific dialogue between banks and
past, the reporting obligation has a broader operational incident
their local or regional regulators.
scope, including cyber-incidents. The perimeter can include all
Sharing of information and collaboration among banks depend supervised institutions but is more often limited to systemically
on the financial industry's culture and level of trust among par­ important institutions. Nearly all institutions regulated in the EU
ticipants. Experience shows that a two-level information-sharing are required to report cyber-security incidents to the competent
structure through which information would be first shared on the authorities. The requirements stem from supervisory frameworks

Chapter 24 Cyber-Resilience: Range of Practices ■ 375

 BOX 24.5 CASE STUDY 5: FS-ISAC - KEY FEATURES AND BENEFITS
The Financial Services Information-sharing and Analysis classified by type and severity. The information is then
Center (FS-ISAC) is a non-profit entity established in 1999 to sent out by CINS and reaches members instantly. FS-ISAC
collect and provide financial services sector member organ­ also conducts crisis calls if necessary, and has a team
isations with information on potential vulnerabilities as well as working 24/7 to analyse any incoming data and dissemi­
timely, accurate and actionable warnings of physical, opera­ nate information.
tional and cyber-threats or attacks on the national financial • Anonymised data: Information received and disseminated
services infrastructure. Its members include banks, credit through the FS-ISAC is considered confidential and stored in
unions, insurance companies, investment companies, financial a standalone, secure portfolio so that no threat or informa­
services regulators and law enforcement entities. tion can be traced back to its source by any members and all
information is anonymously shared. This makes the FS-ISAC
In addition to the core information-sharing platform, the FS-
a safe place for its members and encourages sharing.
ISAC hosts conferences and educational seminars, conducts
sector and cross-sector contingency planning exercises, and • Member-driven: The members of the FS-ISAC run the
is an internationally recognised source for threat intelligence organisation, tailoring it specifically for the needs of the
information. Core elements of the FS-ISAC include: financial industry.
• Recognised by US Financial Services Regulators: the
• Rapid response: the FS-ISAC analyses and disperses Federal Financial Institutions Examination Council, a
information and threat intelligence information among its group consisting of federal and state US financial services
members through their proprietary real-time Critical Infra­ regulators, has recognised the FS-ISAC as a key threat
structure Notification System (CINS). intelligence source and recommends financial institutions
• Information analysis and sharing: the FS-ISAC receives participate in its process to identify, respond to and miti­
information from many sources that is verified and gate cyber-security threats and vulnerabilities.

(such as the Single Supervisory Mechanism (SSM) cyber-incident authorities, as these banks are likely to be obliged to fill in vari­
reporting framework), EU directives (PSD2, NIS) and local law. ous templates with different taxonomy, reporting time frame
Some requirements also include the obligation to submit a root and threshold. This may increase their regulatory burden, con­
cause analysis for the incident, or a full post-mortem or lessons suming significant resources to ensure compliance. It may be
learnt after the incident. possible for an authority with multiple functions to receive from
a bank multiple reports with distinct formats for multiple times.
Different scopes and perimeters may depend on the type of
authority (eg supervisors, regulators, national security) and their All incident reporting processes have a single direction flow, by
mandate (ie national cyber-security agencies, consumer protec­ a bank to an authority, although an informal flow back can be
tion, banking supervision, etc), sector(s) involved (eg multisector used for alerting firms in case of an incoming threat. By normal­
or specific: banks, significant banks, systemic operators, pay­ ising the prompt exchange of information between banks and
ment) and geographical range (eg national, multiregional). While supervisors, reciprocal flow mechanisms can help remove the
many of the supervisors focus only on reporting and tracking possible stigma associated with incident reporting by banks,
incidents that have already taken place, some require proac­ thereby fostering effective and timely incident reporting.
tive monitoring and tracking of potential cyber-threats because
concerns about reputational risk may lead to a delay in incident Sharing Among Regulators
reporting by the regulated entity.
Regulators share information with fellow regulators, be they
Based on these considerations, different reporting frameworks
domestic or cross-border, as appropriate according to estab­
are also observed. These range from formal communications to
lished mandatory or voluntary information-sharing arrange­
informal communications (eg free-text updates via email or ver­
ments. Cyber-security information shared among regulators
bal updates over the phone).
may include regulatory actions, responses and measures. Con­
Differences are noted in: (i) taxonomy for reporting; (ii) reporting sidering different types of cyber-security information-sharing,
time frame (immediately, after two hours, after four hours and information-sharing among regulators is the least observed
after 72 hours are examples of practices observed); (iii) tem ­ practice across jurisdictions, although it is expected that many
plates; and (iv) threshold to trigger an incident reporting. These informal and ad hoc communication channels exist, such
differences highlight the fragmentation issue facing the banks as through supervisory colleges and memoranda of under­
operating in multiple jurisdictions or supervised by different standing. Cyber-fraud is becoming more sophisticated and

376 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 24.6 CASE STUDY 6: BILATERAL CYBER-SECURITY INFORMATION-SHARING
BETWEEN THE HONG KONG MONETARY AUTHORITY (HKMA) AND THE
MONETARY AUTHORITY OF SINGAPORE (MAS)
Given the importance of facilitating more cross-border cyber­ 24 hours. Incomplete information about cyber-security
security information-sharing, the HKMA and MAS established incidents can be shared so long as a reasonable degree of
a bilateral cyber-security information-sharing framework in validity has been ascertained.
the first quarter of 2018. • E ffe c tiv e : To ensure the efficacy of the fram ework, shar­
As part of the framework, the HKMA and MAS have agreed ing of cyber-security information should not be limited
upon four important guiding principles and key design fea­ to information related to those financial institutions
tures of the governance arrangement, the scope of informa­ with an operation in both jurisdictions (ie unlike typical
tion-sharing, a traffic light protocol, standard taxonomy and supervisory college or memoranda of understanding,
dedicated communication channels. "supervisory locus" is not required to be established).
A taxonom y was also established with reference to
• Voluntary: Given that some cyber-security information may the Structured Threat Information expression (STIX)
be highly sensitive, the sharing of information under the fram ework.
framework should be voluntary, without creating any legal
obligations for the participating authorities. • C onfidential: The confidentiality of any information shared
between the authorities should be properly protected.
• Tim ely: The HKMA and MAS recognise that timely sharing The framework will focus on the sharing of general infor­
of cyber-security information is of paramount importance mation such as the modus operandi of the attacks. The
to building an effective framework. The authorities have authorities also adopted a Traffic Light Protocol (TLP) for
therefore agreed that information about cyber-security subsequent sharing of information.
incidents should be shared as soon as possible to the
extent permitted by law. If a cyber-security incident is The HKMA and MAS have been exchanging information
assessed to have the potential to spread to other jurisdic­ regarding real-life cyber-threats and cyber- security-related
tions, the related information should be shared within regulatory responses and measures since April 2018.

cross-jurisdiction, and sharing of cyber-security information forums), meetings and informal communications to disseminate
among regulators could assist in maintaining awareness of the information to the banks.
cyber-threat situation for timely guidance to be provided to
In cases where non-public information is obtained by regula­
banks to protect financial systems against cyber-frauds.
tors, the information is shared with selected parties via informal
meetings or other informal communication vehicles, so as to
Sharing from Regulators to Banks preserve anonymity and confidentiality of the institution(s)/
bank(s) impacted by a cyber-attack, and maintain banks' confi­
Information-sharing from regulators to banks occurs through dence and trust in the regulators generally.
established channels, based on the information the regulator
Mandatory requirements for regulators to share information
receives both from banks and other sources. Various jurisdictions
with banks have only been established for a few jurisdictions (eg
(eg Australia, China, Korea, Saudi Arabia, Singapore, Turkey and
China). A few other jurisdictions have put in place practices for
the US) have established clear guidance in the form of standards
voluntary sharing (eg Singapore, the UK). However, many juris­
and practices to enable cyber-security information-sharing by
dictions have not put in place any standard practices for regula­
regulators to banks. In these jurisdictions, information flows
tors in the sharing of information with banks, nor established any
from the bank to the regulator, and the regulator assesses the
process or time frame to enable timely, risk-based information­
risk to the financial industry and shares the information with the
sharing. Classification of information could ensure that the
industry, as appropriate, based on the risk assessment. In cases
appropriate audience could receive the appropriate information
where the information is sensitive (eg contains customer-specific
and help to build trust between regulators and banks.
or bank-specific information), the regulator anonymises or sum­
marises it to allow sharing.

Regulators with a regulator to bank sharing mechanism more

Sharing with Security Agencies
readily share publicly available information such as cyber-secu­ This section examines sharing of information by banks or regu­
rity risk management best practices. They use informal channels lators with the security agencies operating in their respective
such as industry sharing platforms (eg participation in industry jurisdictions.

Chapter 24 Cyber-Resilience: Range of Practices ■ 377

 BOX 24.7 CASE STUDY 7: COMPUTER SECURITY INCIDENT RESPONSE TEAMS
(CSIRTs) IN THE EU
The Network and Information Security (NIS) Directive is a the member states, with its secretariat provided by the
component of EU legislation with the specific objective to European Network and Information Security Agency) with
improve cyber-security throughout the EU. The requirements the following competencies:
came into full effect on 10 May 2018. The NIS Directive
• Exchange information on services, operations and coop­
defines different obligations across the EU, one of which con­
eration capabilities
cerns the establishment of one or more Computer Security
Incident Response Teams (CSIRTs) at national level for com­ • Exchange and discussing information related to incidents
prehensive incident management nationwide. Incident and associated risks (on request, on a voluntary basis)
reporting notification to national CSIRTs (directly or through a • Identify a coordinated response to an incident (on request)
competent authority) is mandatory for entities identified as • Providing member states support in addressing cross-
Operators of Essential Services (OES) and Digital Service Pro­ border incidents (on a voluntary basis)
viders (DSP) (some banks have been included in the first cate­
• Issue guidelines concerning operational cooperation
gory). In some countries, competent authorities for banks
that have been identified as O E S 19 are the supervisory • Discuss, explore and identify further forms of operational
authorities, while in others it can be the Ministry of Finance cooperation (risks and incidents, early warnings, mutual
or a specific government authority. The NIS Directive also assistance, coordination)
established the requirements to have a CSIRTs European net­ • Discuss the capabilities and preparedness of certain
work (ie a dedicated network for all national CSIRTs, run by CSIRTs (on request from that CSIRT)

Given that cyber-security incidents encountered by banks or Cyber-security and Communications Integration Center and
regulators could potentially be experienced by entities in other the US CERT. In Luxembourg, the Computer Incident Response
sectors, effective communication of relevant cyber-security inci­ Center (CIRCL) has established a Malware Information-sharing
dents with security agencies could facilitate broader awareness Platform (MISP) to gather, review, report and respond to com­
of cyber-threats in a timely manner, and enhance defensive mea­ puter security threats and incidents. The MISP allows organisa­
sures against adversaries. tions to share information about malware and their indicators.
The aim of this trusted platform is to help improve the counter­
For jurisdictions with operations of Computer Emergency Readi­
measures used against targeted attacks and set up preventive
ness Team (CERT) or similar security agencies, these agencies
actions and detection.
may act as focal points for cyber-security incident notification.
Banks or regulators share cyber-security information with these For jurisdictions with mandatory requirements for cyber-security
agencies for broader circulation of information and collaboration incident information-sharing with national security agencies
with other sectors within the country (eg public sector, civilian (Canada, France, Singapore and Spain), the sharing arrange­
sector, computer community). ments are bilateral in general. Instead of requiring banks or reg­
ulators to share all cyber-security incidents, these jurisdictions
Jurisdictions have generally set out standards and practices
require cyber-security incidents affecting key operators of critical
for critical infrastructure entities and regulators to share cyber­
infrastructure to be reported.
security information with national security agencies. While
most jurisdictions adopt a voluntary approach, a few jurisdic­ Some jurisdictions have established procedures for relevant
tions mandate formal sharing requirements. Some jurisdictions information to be exchanged voluntarily and bring together
(eg Luxembourg, the US) have established sharing platforms relevant parties for coordination of responses to incidents. In
to facilitate multilateral sharing of cyber-security incident or the UK, the Authorities Response Fram ework can be invoked
cyber-threat information. In the US, an online portal is available by financial authorities to bring together the Financial Con­
for cyber-security information to be submitted to the National duct Authority (FCA ), the Bank of England, the Treasury,
the National Crime Agency and the National Cyber-security
Centre to coordinate their response to a cyber-security
19 As required by the NIS Directive, identification of OES should have incident. Meetings and formal communications can be trig ­
been completed by October 2018. gered as appropriate.

378 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
24.6 INTERCONNECTIONS WITH and signing contracts (eg involvement of a cyber- security func­
tion), with specifications on the result (ie an official, written and
THIRD PARTIES detailed contract) and the applicability of the framework (typi­
cally also for intragroup outsourcing).
All jurisdictions recognise the challenge of gaining assurance
of an entity's cyber-resilience, a challenge both for regulators The regulatory expectations on risk assessments and contracts
with regard to financial institutions, and for financial institutions tend to specify in a rather comprehensive way which risks (and
with regard to their third-party service providers. Extensive mitigating measures) to cover, albeit mostly in general terms.
use of third-party services increases the challenge for jurisdic­ Next to a description of the nature of the service, the
tions and regulated institutions them selves to have full sight of expected results of the outsourcing, and the roles and respon­
the controls in place, and the level of risk. For the purpose of sibilities of the service provider and the financial institution,
identifying the range of practices in relation to cyber-resilience, risk assessments and contracts are expected to include analysis
"third parties" is understood in a broad sense, including: (i) all and clauses on strategic risk, compliance risk, security risk (typ­
forms of outsourcing (including cloud computing services); ical areas of attention are security monitoring, patch m anage­
(ii) standardised and non-standardised services and products ment, authentication solutions, authorisation management and
that are typically not considered outsourcing (power supply, data loss/breach procedures), business continuity risk, vendor
telecommunication lines, commercial hardware and software, lock-in risk (the general ability of an institution to withdraw
etc); and (iii) interconnected counterparties such as other insti­ from the service provider and to absorb the outsourced activ­
tutions (financial or not) and FMIs (eg payment and settlem ent ity or transfer it to another service provider), counterparty risk
systems, trading platforms, central securities depositories and (the visibility into the service provider's organisation), country
central counterparties). risk, contractual risk, access risk (meaning that financial institu­
tions and/or supervisors cannot audit the third-party connec­
Cyber-resilience practices in relation to third parties are analysed
tion due to inadequate contractual agreements) and
across the following areas:
concentration risk.20
• Governance of third-party interconnections
Along with the outsourcing and contractual frameworks, regula­
• Business continuity and availability
tors typically expect that information, cyber-security and/or con­
• Information confidentiality and integrity tinuity frameworks address some crucial aspects of third-party
• Specific expectations and practices regarding visibility of arrangements to ensure the availability of critical systems and
third-party interconnections the security of sensitive data that are accessible to, or held by,
third-party service providers. These aspects include the identifi­
• Auditing and testing
cation and prioritisation of interconnections, as well as the clas­
• Resources and skills
sification and response to incidents with third parties according
to service agreements and the communication of these policies
Governance of Third-Party Connections to relevant external parties.

Widespread Expectations and Practices As regards supervisory practices, the following activities appear
to be widespread:
Regulations across different jurisdictions require that insti­
tutions develop a management- and/or board-approved • Intrusive on-site inspections with respect to cyber-risk in rela­
outsourcing (or organisational) framework that defines the tion to outsourcing. During such inspections, the outsourcing
applicable roles and responsibilities, the outsourceable activi­ framework, the applicable processes and the completeness
ties and concrete conditions for outsourcing, the specific risks and adequacy of specific risk assessments and contracts will
that need to be analysed (either prior to selection of a provider typically be reviewed.
or when substantially amending/renewing an agreement) and
recurrent obligations (such as monitoring procedures or regular
risk assessments). 20 "Concentration risk" in this context does not refer to the potential
systemic risk to the industry as a whole, but rather to the potential lack
Regulators typically also require that institutions implement of control of an individual firm over one single provider as multiple
activities are outsourced to the same service provider. These different
a contractual framework, defining generic rights, obligations,
aspects of concentration risk are explained in Joint Forum, Outsourcing
roles and responsibilities of the institution and the service pro­ in financial services, February 2005; and Committee of European Bank­
vider, specifying the responsibility for reviewing, approving ing Supervisors, Guidelines on outsourcing, December 2006.

Chapter 24 Cyber-Resilience: Range of Practices ■ 379

• As part of their off-site supervision practices, most jurisdic­ by the institution for the purpose of identifying and authenticat­
tions receive periodic statements or reports that assess the ing the client and validating the transactions).
outsourcing policies and risks at the financial institution.
In Luxembourg, authorities have put in place a specific regula­
These reports will typically contain statements on the exis­
tion for companies that supply specialised services to financial
tence and adequacy of outsourcing policies, processes, risk
institutions. For these "financial sector professionals", the same
assessments and contracts.
regulation for authorisation and ongoing supervision applies as
Expectations on the Scope of the Ecosystem and for the financial institutions themselves (Box 24.8).
Management of Third Parties Consistent with the expanding scope of supervisory scrutiny
Some international standards explicitly recognise that institu­ or regulated entities, in Europe legal mandates that regulate
tions may critically depend on third-party interconnections, interaction between institutions, supervisors and third-party pro­
other than those that are typically considered outsourcing. The viders are provided by the Mifid II Directive, and 12 competent
CPM I-IO SCO guidance on cyber-resilience for FMIs discusses authorities can directly review third parties involved in IT ser­
the identification of cyber-risks and the coordination of resil­ vices. In addition, specific expectations for control and location
ience efforts from the perspective of the ecosystem of an FMI. of data are starting to emerge in the form of requirements that
The ISO 27031 standard specifies requirements for hardware, the location of at least one data centre for cloud computing ser­
software, telecoms, applications, third-party hosting services, vices provided in the country or region (eg in the EU) be identi­
utilities and environmental issues, such as air conditioning, envi­ fied, or data ownership, control (Australia) and location (Brazil
ronmental monitoring and fire suppression. and France) be identified and monitored as part of the outsourc­
ing agreement. Some jurisdictions (Germany, Singapore and
Some jurisdictions require that financial institutions enter into
Switzerland) further require a contractual clause that reserves
a prior agreement with their clients when they offer financial
the right for institutions to intervene at, or give directives to, the
services via the internet that involve the consultation and man­
service provider.
agement of personalised data or carrying out transactions (eg
precise description and demarcation of the responsibilities of Beyond the assurances required prior to engaging with third
each party in using the technologies provided or recommended parties, most jurisdictions also require either prior notification

BOX 24.8 CASE STUDY 8: REGULATED/CERTIFIED THIRD PARTIES IN

LUXEMBOURG
The Luxembourg government has put in place a specific based on a cloud computing infrastructure. If these criteria are
regulation for companies that supply specialised services to met, the specific obligations of CSSF circular 17/654 on cloud
financial institutions. For these "financial sector profession­ computing apply. An institution can outsource directly to a
als" (PSFs), the same regulation for authorisation and ongoing CSP or indirectly through a support PSF or a non-regulated
supervision by the Commission de Surveillance du Secteur entity (which will outsource to CSP in a chain). The signatory
Financier (CSSF) applies as for the financial institutions them­ of the contract with the CSP can be either the financial
selves. PSFs that exclusively offer operational services are institution or the operator of the resources provisioned by the
called support PSFs. By regulating and supervising technical, CSP, who can be the support PSF or the non-regulated entity
administrative and communications-related activities, the outside of Luxembourg. Several provisions on the governance
Luxembourg government seeks to facilitate the outsourcing of cloud services apply, including the appointment of a cloud
of core activities by ensuring a high quality of service and pro­ officer for the cloud resources operating entity (which can be
fessional confidentiality. If a financial institution is outsourcing the institution itself or a third party).
to a PSF, the ultimate responsibility remains with the institu­
Depending on the materiality of the activity supported by
tion, in accordance with the Committee of European Banking
the cloud infrastructure, the institution needs prior approval
Supervisors (CEBS) guidelines on outsourcing. However, in
from the CSSF. If the outsourced activities are not mate­
some cases it is observed that an institution is more enticed
rial or if the cloud service contract is signed with a support
to neglect its monitoring and audit obligations, as it might
PSF, notification to the C SSF is sufficient. The C SSF circular
consider them to be performed by the supervisor.
17/654 will be amended by abolishing the notification of
Cloud service providers (CSPs) are not subject to this regu­ non-material outsourcing and asking all financial institutions
lation. The Luxembourg regulator (CSSF) defined specific to set up a register containing all outsourcing in the cloud
criteria for outsourcing that will be considered IT outsourcing regardless of materiality.

380 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BOX 24.9 CASE STUDY 9: CLOUD SERVICE PROVIDERS' REGULATORY CLOUD
SUMMITS
Some cloud service providers organise regulatory cloud sum­ The main part of the summits is usually organised into
mits that provide examples of how a supervisory college sessions provided by the staff of the service provider.
model could work in practice when applied to a global tech­ Typically, one session consists of a panel discussion of
nology provider. regulators (chosen by the cloud service provider) that starts
a dialog with the cloud service provider's staff, after which
These summits are organised with regulators and supervisors
the discussion is opened to all regulators. Discussions are
with the objective of:
typically not recorded, but the cloud service provider's staff
(i) holding cloud-focused discussions on the threats related takes notes.
to cloud, the international regulatory landscape and the
Regulatory summits could also be organised by regulators or
cloud service provider's stance in this regard; and
an independent body to allow examiners to understand the
(ii) providing the regulators with an opportunity to learn products and compliance controls so as to usefully complete
about products, processes and practices and to discuss their expertise and become more effective doing on-site
approaches to supervise and gain assurance that financial examinations.
institutions using these cloud services operate in a safe
and sound manner.21

or prior authorisation of material (cloud) outsourcing activities. authority (as is done in Hong Kong, Singapore and the US) or
To this end, jurisdictions have created questionnaires/templates based on cooperation from service providers. For example,
(sometimes specifically for IT outsourcing or cloud computing). Australia engages with systemically important third-party service
Although these are not harmonised in their coverage and met­ providers which host critical systems for regulated institutions.
rics across jurisdictions, they facilitate the creation and docu­ Periodic engagements are voluntary and focus on service provid­
mentation of risk assessments locally. ers' systemic role as opposed to their relationship with individual
institutions. This allows for a more open discussion of relevant
By focusing on the products and services themselves, new
strategy, governance, customer engagement, controls and capa­
expectations for secure development and procurement also
bilities (including those pertaining to cyber). It also can provide
contribute to making regulations and practices future-proof.
useful insight into the maturity (or lack thereof) of regulated
In particular, specific requirements (eg regarding "internet
institutions oversight practices, informing further supervisory
of things" systems in Japan) are in place for systems to be
activities. They can also be used as a mechanism to influence the
designed, developed and operated under the principle of secu­
provider regarding regulatory expectations and best practice.
rity by design, considering that many individual devices, applica­
tions and systems will be interconnected in the future, providing In the same vein, supervisors can work directly with cloud sup­
new opportunities and possibly introducing new vulnerabilities. pliers both on formal or informal grounds, to include the right
to audit in contracts for the financial industry (as in the Nether­
Observed Supervisory Practices lands) or to take part in regulatory summits organised by major
cloud providers (including for discussions of assurance frame­
Overall, although jurisdictions' mandates to supervise third-party
works; see Box 24.9).
service providers vary, supervisors have been using traditional
supervisory tools in order to ensure that the common expecta­ Against the above findings, a "supervisory college" model to
tions described above are met. Thematic exercises based on supervise and share information about large, internationally
self-assessment questionnaires to assess the cyber-security active service providers (particularly cloud providers) could also
and IT outsourcing risk of banks are a typical example. Third- be a way to address the blind spots resulting from mandate limi­
party providers can also be reviewed during on-site reviews tations and regulatory fragmentation.
and inspections, either on the basis of formal requirements or
Business Continuity and Availability
To safeguard the availability and continuity of critical business
21 In addition to these summits with regulators and supervisors, these
cloud service providers typically also organise comparable summits with activities in case of exceptional events or crises (eg cyber­
their most important financial customers. attacks), regulators typically request that financial institutions

Chapter 24 Cyber-Resilience: Range of Practices ■ 381

analyse these activities,22 to design and implement appropriate These tests are typically complemented by audits and moni­
plans, procedures and technical solutions, and to adequately toring activities (on availability, security incidents, etc) of the
test mitigating measures. The same holds true where critical outsourcing vendors.
business activities depend on interconnections with third par­
In terms of business continuity and availability, commonalities in
ties, with regulations stressing the importance of aligning the
supervisory expectations and practices are observed, which are
business continuity plans of critical suppliers (and their subcon­
mainly focused on the "standalone business continuity" of the
tractors) with the needs and policies of the financial institution in
institutions. Such commonalities could provide an opportunity to
terms of continuity and security.
extend continuity and resilience testing to a more collaborative
It is common practice to request that recovery and resumption and coordinated form that involves larger parts of the ecosys­
objectives be defined for critical business activities from an end- tem of a financial institution.
to-end perspective23 For instance, Italy specifies that among the
risk scenarios for the continuity of systemically important pro­
Information Confidentiality and Integrity
cesses that are documented and constantly updated, institutions
should include catastrophic events that affect essential opera­ Confidentiality and integrity of information for third-party inter­
tors and third-party infrastructures (eg large-scale cyber-attacks). actions are commonly addressed in general data protection
Typical activities and services that are considered by regulators requirements, through explicitly requiring contractual terms to
are cloud outsourcing, settlement processes or internet services include confidentiality agreement and security requirements
offered to customers. for safeguarding the bank's and its customers' information.
In addition, banks are generally required to manage or take
Expectations with regard to plans and procedures typically
appropriate steps to ensure The CPM I-IO SCO guidance on
address tasks and responsibilities in processes for incident
cyber-resilience for financial market infrastructures, for instance,
management and for response and recovery in case of material
specifies that a Financial Market Infrastructure should, design
disruptions, the information and communication needs from and
and test its systems and processes to enable the safe resump­
towards key internal and external stakeholders and the required
tion of critical operations within two hours of a disruption and
resources, including planned redundancy, so as to ensure the
to enable itself to complete settlement by the end of the day
prompt transfer of outsourced activities to a different provider
of the disruption, even in the case of extreme but plausible
in case continuity or quality of the service provision are likely to
scenarios. Some banking supervisors have similar expectations
be affected.
for systemically important functions, that their service providers
Most regulators and international standards expect financial protect their confidential information and that of their clients.
institutions to test protective measures periodically in order to Steps include verifying, assessing and monitoring security prac­
verify their effectiveness and efficiency and make adjustments tices and control processes of the service provider.
where necessary. Advanced regulators require that tests for
A growing number of jurisdictions have cloud-specific
critical activities are based on realistic and probable disrup­
requirem ents, which range from requirem ents that inform a­
tive scenarios, conducted at least on a yearly basis and that
tion transferred to the cloud be subject to a contractual
service providers and significant counterparties are involved
clause and that different cloud-specific issues be considered
through collaborative and coordinated resilience testing.
to ensure data security, to more specific requirem ents on
data location, data segregation, data use lim itations, security
and exit. One exam ple of data access limitation is the prohi­
The analysis step typically involves a business impact assessment (BIA) bition imposed on staff of cloud service providers in Luxem ­
identifying the most critical activities, resources and services, their inter­ bourg to access a bank's data without the explicit agreem ent
nal and external dependencies, their acceptable recovery time frames in
of the bank and without a mechanism available to the bank to
case of disruption, the events/scenarios (either natural or manmade) that
can affect these critical business activities and the potential impacts of a detect and control access.
(major) disruption.
In a number of jurisdictions, regulations explicitly include
23 The CPMI-IOSCO guidance on cyber-resilience for financial market
expectations that outsourcing arrangements comply with legal
infrastructures, for instance, specifies that a Financial Market Infrastruc­
ture should, design and test its systems and processes to enable the and regulatory provisions on protection of personal data, con­
safe resumption of critical operations within two hours of a disruption fidentiality and intellectual property. Evidence of more techni­
and to enable itself to complete settlement by the end of the day of the cal and operational requirements is more scattered and less
disruption, even in the case of extreme but plausible scenarios. Some
banking supervisors have similar expectations for systemically important harmonised, with jurisdictions emphasising different aspects
functions. of information confidentiality and integrity, ranging from

382 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
explicitly requiring encryption solutions for confidential data to suppliers and associated contracts and categorise them into
be under the banks' control, to regulating the transfers of data type, significance and criticality in order to establish a process
abroad and requiring explicit client consent for data handling for their evaluation.
by third parties.
Analysis of supervisory expectations for the visibility of third-
party connections shows that the scope, format and content of
Specific Expectations and Practices with supervisory authorities' information requests about material out­
sourcing vary greatly across jurisdictions.
Regard to the Visibility of Third-Party
Connections
In many jurisdictions the supervisory authority requests to be
Auditing and Testing
informed about the material outsourcing agreements made by Supervisory expectations regarding the audit of third parties
supervised institutions and imposes some conditions on them, (internal and/or external) are aligned in two areas. First, the
including about preserving a minimum level of visibility on the majority of the requirements state the necessity for the super­
outsourced functions by the supervised entity. vised organisations to guarantee the "rights to inspect and

Beyond the prior notifications and authorisation processes, audit" their service providers. Some jurisdictions require that

supervised institutions are commonly expected to maintain an this right be cascaded to the significant subcontractors while

inventory of outsourced functions and to receive regular reports other jurisdictions (France, Switzerland and Singapore) have

from service providers, mainly about measurements of service granted this right directly to supervisory authorities.

level agreements and the appropriate performance of controls. Second, for several jurisdictions the audit opinion on the out­
Some jurisdictions also require sub- outsourcing activities to be sourcing arrangements may be formed based on the report of
visible for the supervised entities so that the associated risks can the service provider's external auditor. Others accept pooled
also be managed. audits, organised by multiple financial institutions,26 or audits

Inventorying expectations can be set in relation to IT assets in performed by the internal audit department of a service pro­

some jurisdictions, such as the identification of both hardware vider, under the condition that the audit department comply

and software elements together with the function they are with certain regulatory conditions. Some jurisdictions specify

related to (even for outsourced functions) in Luxembourg.24 that these independent reports should be based on widely rec­

Other frameworks, such as the US FFIEC IT Examination Hand­ ognised standards or be performed by auditors with adequate

book and the CPM I-IO SCO guidance, focus on the connections skills and knowledge.

and information flows of financial institutions with external Current regulations focus on traditional outsourcing and, in
parties. some cases, cloud computing providers. The scope of the
requirements for "rights to inspect and audit" critical third par­
The current practices inspired by the various expectations set at
national supervisory level and by international guidance play a ties is nonetheless still focused on the strict banking sector.

complementary role. While supervisory authorities' expectations Shared and independent audit reporting on the critical intercon­

define activities that can fit into classical cyber-security fram e­ nections with third parties could therefore facilitate the audit

works (identify, protect, detect, respond and recover), standard approach effectiveness and efficiency.

setting bodies have an organisational process-oriented As regards testing of the security requirements for outsourcing
approach: for instance, ISO IEC 27036-2 addresses configuration and cloud computing providers, although institutions are
management, information management processes and the out­ generally required to monitor their providers' com pliance,
sourcing relation termination processes, and ISACA C O BIT 5 most regulations are not aligned in term s of how compliance
elaborates on the implementation of an information security should be verified or tested. One possible method is the
management system. On the other hand, both ISO and the US application of supervisor-led or bank-led (intelligence-based)
NIST framework25 recommend the identification, documentation red teaming exercises focused on interconnections. In the
and categorisation of suppliers to address information security EU, the scope of the TIBER-EU test appears to include the
issues, while ISACA C O B IT 4.1 and 5 recommend to identify institution's critical functions that are outsourced to third-party
service providers.

24 See CSSF, CSSF Circular 01/27, 23 March 2001.

25 See NIST, Framework, for improving critical infrastructure cybersecu­ 26 As an example, a group of eight European financial institutions per­
rity, version 1.1, draft 2,16 April 2018. formed a joint audit in June 2018 of a common cloud service provider.

Chapter 24 Cyber-Resilience: Range of Practices ■ 383

Resources and Skills institutions are required to provide a monitoring and replacement
plan for employees who are crucial for ensuring the proper func­
The Basel Committee's S o u n d P ractices: Im plications o ffin te c h tioning of the critical activities, services and resources and who are
d evelo p m en ts fo r banks and bank su pervisors, published in difficult to replace due to their specific expertise and limited num­
February 2018, indicate that banks may require specialist com­ ber. Even beyond the supervised institution personnel, institutions
petencies to assess whether their risk functions are capable of should also provide documentation to clients of financial internet
maintaining effective oversight of the emerging risks posed by services on security awareness and responsibilities with regard to
new technologies. their secure use to strengthen those connections.
This topic is usually covered by the broader outsourcing and As with the regulatory expectations, supervisory practices
management processes, with the expectation that the relevant mostly reflect commonalities, as the assessment of human
personnel have the necessary expertise, competencies and qual­ resources and qualifications for managing third-party connec­
ifications to effectively monitor outsourced services or functions tions and relationships is usually done during on-site inspec­
and are able to manage the risks associated with the outsourc­ tions. In those jurisdictions where financial supervisors have the
ing beyond the mere compliance dimension. authority to examine third parties directly, they assess the suffi­
Regulators expect that institutions contract sufficient and quali­ ciency and qualifications of staff at the third parties, and expect
fied personnel to ensure continuity in managing and monitoring the third parties to perform appropriate background checks.
outsourced services or functions, even if key personnel leave the Personnel who are Certified Information Systems Security Pro­
institution or become otherwise unavailable. When institutions do fessionals or an organisation that conforms to the ISO 9001
not have internal resources sufficient in know-how or number, the Quality Management System could provide additional assurance
general expectation is that external experts or technical resources, that personnel have the necessary competencies to manage
such as consultants or specialists, would be proactively identified third-party connections.
to complement or supplement in-house personnel. In Belgium,

384 Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Operational
Resilience: Impact
Tolerance for
Important Business
Services
Learning Objectives
After completing this reading you should be able to:

Describe an impact tolerance; explain best practices and improve their operational resilience and remain within
potential benefits for establishing the impact tolerance for their impact tolerance.
a business service.
Describe the governance of an operational resilience
Provide examples of important business services and policy, including the relationships between operational
explain criteria that firms should use to determine their resilience and a firm's risk appetite, impact tolerance,
important business services. continuity planning, and outsourcing to third-party
providers.
Explain tools and processes, including mapping and
scenario testing, that financial institutions should use to

E x c e rp t is rep rin ted from Operational Resilience: Impact Tolerances for Important Business Services, March 2021, by perm ission o f
the Bank o f England and the Financial C o n d u ct A uthority. This article is a reprodu ction o f a discussion paper, seekin g view s from
sta keh old ers, and d o e s n ot rep re se n t current Bank o f England, Prudential Regulation A u th ority or Financial C o n d u ct A u th ority policy.
25.1 INTRODUCTION approach would make the policy clearer to implement and
enable more consistent supervision. The supervisory authorities
1.1 This paper is issued jointly by the Prudential Regulation agree that a common understanding of the key principles of
Authority (PRA), the Financial Conduct Authority (FCA), and the the policy is important, and each authority has provided more
Bank of England ('the Bank') in its capacity of supervising finan­ explanation and examples of how they expect the policy to be
cial market infrastructures firms (FMIs), collectively 'the supervi­ implemented, where relevant.
sory authorities'. 1.7 However, the supervisory authorities believe that there
1.2 A key priority for the supervisory authorities is to put in are benefits in maintaining an outcomes-based approach. An
place a stronger regulatory framework to promote the opera­ important business service for one firm or FMI may not be
tional resilience of firms and FMIs. To this end, the supervisory appropriate for another. Firms and FMIs may arrive at different
authorities published a joint Discussion Paper on Operational impact tolerances for similar business services due to differences
Resilience in 2018 setting out an approach to operational resil­ in the nature and scale of their client bases. The authorities
ience. Following this, the supervisory authorities published a believe that encouraging boards and senior management to
suite of consultation documents ('the consultations') in make judgements in the selection of their important business
December 2019 to embed this approach into policy.1 services and the setting of impact tolerances will facilitate bet­
ter decision-making as firms and FMIs build their operational
1.3 The proposals were designed to improve the operational
resilience.
resilience of firms and FMIs and protect consumers, the wider
financial sector and UK economy from the impact of operational 1.8 While the final policy is not overly prescriptive in terms of
disruptions. The consultations proposed requirements and defining lists of important business services and setting specific
expectations for firms and FMIs to: impact tolerances, the supervisory authorities expect best prac­
tice will emerge over time, and will take a close interest as it
• identify their important business services by considering how develops. The supervisory authorities encourage firms and FMIs
disruption to the business services they provide can have
to view the policy as a proportionate minimum standard and
impacts beyond their own commercial interests; develop their approach based on this standard. Both firms and
• set a tolerance for disruption for each important business ser­ FMIs and the supervisory authorities will learn as firms and FMIs
vice (an impact tolerance); and put the policy into practice.

• ensure they can continue to deliver their important business 1.9 In this document, the supervisory authorities summarise fur­
services and are able to remain within their impact tolerances ther common responses to the policy proposals and their policy
during severe (or in the case of FMIs, extrem e)1
2 but plausible decisions.
scenarios.
1.10 It should be noted that each supervisory authority received
1.4 The supervisory authorities' approach to operational resil­ other comments which were more exclusively relevant to that
ience is based on the assumption that disruptions will occur, supervisory authority, and these have not been addressed in this
which will prevent firms and FMIs from operating as usual, joint document. Those comments and the particular detail of
and result in them being unable to provide their services for a each supervisory authority's approach are instead covered in the
period. The supervisory authorities consider that many firms and respective supervisory authorities' documents.3
FMIs currently may not sufficiently plan on the basis that disrup­
tions will occur, and therefore would not be able to manage
effectively when they do. The aim of the policy that the super­
visory authorities proposed is to ensure that firms and FMIs do
1 PRA CP29/19 'Operational resilience: Impact tolerances for important
this planning and deliver improvements to their operational
business services', FCA CP19/32: Building operational resilience: impact
resilience to ensure they are able to respond effectively if a dis­ tolerances for important business services and feedback to DP18/04,
ruption does occur. Bank CP 'Operational Resilience: Central counterparties', Bank CP
'Operational Resilience: Central securities depositories', and Bank CP
1.5 The supervisory authorities received an excellent level of 'Operational Resilience: Recognised Payment Systems and Specified
engagement with the consultations. Overall, respondents were Service providers'.
supportive of the approach set out in the proposals. 2 Note: for FMIs the terminology 'extreme but plausible' is used to avoid
confusion with other parts of their supervisory approach.
1.6 A major theme from the feedback was respondents ask­
3 Available at: PRA PS6/21: Operational resilience: Impact tolerances
ing for more detail on how they might apply the proposals for important business services; Bank of England policy on Operational
and clearer definitions. Respondents suggested that such an Resilience of FMIs; FCA PS21/3 'Building operational resilience'.

386 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
25.2 IMPORTANT BUSINESS SERVICES their respective consultations. These definitions were intended
to provide clarity in relation to the terms in line with the respec­

Overview tive authorities' objectives.

2.6 Some respondents commented that the use of different

2.1 The consultations proposed that firms and FMIs would be
wording within the definitions caused some confusion and that
required to identify and prioritise the services that, if disrupted,
greater harmonisation between the supervisory authorities was
would impact the supervisory authorities' objectives and thereby
needed.
the public interest as represented by those objectives. These
were termed important business services. This represented a 2.7 Following the responses, the supervisory authorities have
shift away from thinking about the resilience of individual sys­ made some changes to clarify and better align the definitions
tems and operational resources to considering the continuity of where possible.
the services that firms and FMIs provide to their external end
2.8 Differences in the definitions are driven by a number of rea­
users, customers, or participants.
sons, including differing objectives and legal frameworks, but
the PRA and the FC A consider that the respective outcomes
Internal Services and policies are aligned. For firms regulated by the PRA and the
FCA , the supervisory authorities expect that work done to meet
2.2 A number of respondents asked for clarity as to whether
the requirements of one regulator should be leveraged to meet
internal services were included within the definition of important
those of the other, and would encourage firms to avoid dupli­
business service. Firms suggested that, if disrupted, internal ser­
cative work. An example of where differences remain include
vices such as human resources or payroll might have significant
where the PRA has chosen to use the word 'person' rather than
impact on the ultimate delivery of services to external end users,
'client' in order to align with the language used in the PRA Rule-
customers, or participants.
book; however, the FC A is not subject to this constraint.
2.3 In the final policy, the supervisory authorities have set out
2.9 To provide greater harmonisation between the supervisory
that internal services such as human resources or payroll should
authorities and to ensure third parties are captured in the policy,
not be identified as an important business service. These services
the PRA has added 'services provided by a firm, or by another
constitute enablers of the important business service. The policy
person on behalf of the firm' to their definition of an 'important
is focused on delivery of specific outcomes or services to exter­
business service'.
nal end users. The supervisory authorities are therefore requiring
firms to prioritise work to build the operational resilience of those 2.10 The supervisory authorities have a shared goal of main­
important business services. Firms should identify the most critical taining financial stability, which is reflected in their respective
services and consider what is required for delivery. The supervi­ definitions of 'important business service'. The PRA's and FCA's
sory authorities consider that the most critical parts of the chain objectives are defined in the Financial Services and Markets
should be operationally resilient. If internal services were defined Act 2000 (FSMA). The PRA seeks to promote the safety and
as important business services on a standalone basis, this would soundness of the firms it supervises, and contribute to securing
expand the coverage of the policy, and could reduce focus on an appropriate degree of protection for those who are or may
the most important external services. The supervisory authori­ become insurance policyholders. The PRA also has a secondary
ties believe it appropriate to set minimum expectations on these competition objective.
external services, but firms can expand on this should they so wish.
2.11 The FC A has a strategic objective to ensure relevant mar­
2.4 To provide further clarity for firms and FMIs, in some cases kets work well. To advance its strategic objective, the FCA has
the supervisory authorities have included examples in the policy three operational objectives: to secure an appropriate degree of
documents to illustrate where activities performed by internal protection for consumers, to protect and enhance the integrity
services within a firm would need to be included in the chain of of the UK's wider financial sector, and to promote effective com­
activities for the delivery of their important business services. petition in the interests of consumers. This is reflected in part (1)
of its definition of 'important business service'.

Definitions 2.12 Where definitions for important business services have

been updated, these are detailed in the table below. The areas
Aligning definitions between supervisory authorities which have been amended are underlined. The PRA definitions
2.5 The supervisory authorities set out definitions for terms are in the Operational Resilience Parts of the PRA Rulebook, and
including important business services and impact tolerances in the FCA definitions are in the Glossary of the FCA Handbook.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 387

 Term PRA4 FCA
Important Business a service provided bv a firm, or bv another person means a service provided by a firm, or by another
Service on behalf of the firm, to another person which, if dis- person on behalf of the firm, to one or more clients
rupted, could pose a risk to: of the firm which, if disrupted, could:
(1) (where the firm is an O-SII/where the firm is a rel­ (1) cause intolerable levels of harm to anv one or
evant Solvency II firm) the stability of the UK financial more of the firm's clients; or
system;
(2) pose a risk to the soundness, stabilitv or resil-
(2) the firm's safety and soundness; or ience of the UK financial system or the orderly
operation of the financial markets.
(3) (for Solvency II firms) an appropriate degree of
protection for those who are or may become the firm's
policyholders.

25.3 IMPACT TOLERANCES not mandate that all important business services should have
separate impact tolerances set.

Overview 3.4 The PRA and FCA would like to emphasise that, if appro­
priate, a firm may set its PRA impact tolerance for a given
3.1 The consultations proposed that firms and FMIs would be
important business service at the same point as its FC A impact
expected to set an impact tolerance for each of their important
tolerance or vice versa. The PRA and FC A expect that work
business services. The impact tolerance would measure the
done to meet the requirements of one regulator should be lev­
maximum tolerable level of disruption to an important business
eraged to meet those of the other, and encourage firms to avoid
service.
duplicative work. The PRA and FCA view the design and goals
of their respective policies as the same.
Impact Tolerances for PRA-FCA 3.5 However, each supervisory authority must construct their
Dual-Regulated Firms policy in such a way as to advance their own statutory objec­
tives. For this reason, the policy approaches of the supervisory
3.2 The PRA and FC A issued a joint covering document accom ­
authorities have not changed.
panying their consultation papers. This explained that if the
same business service is defined as an important business 3.6 The PRA and FCA expect firms to understand whether the
service under both PRA and FC A rules, the firm should have scenarios that may cause firms to exceed their respective PRA
separate impact tolerances in consideration of the objectives and FCA impact tolerances would differ (whether or not those
of the two supervisory authorities.5 The PRA and FC A set out impact tolerances are aligned) and to take action to remain
that the separate impact tolerances may be the same or they within impact tolerances.
may differ.
3.7 The PRA and FCA understand that in practice firms
3.3 The PRA and FC A received responses that setting separate may concentrate their efforts in ensuring they can remain within
impact tolerances for dual-regulated firms would be impractical the more stringent tolerance. Therefore, the final policies
and burdensome. Respondents requested more detail on the state that taking action to ensure firms can remain within
expected action firms should take to ensure they can remain the more stringent tolerance will be acceptable if a firm can
within both tolerances. Some requested that the authorities do demonstrate:

(i) how they have considered each of the PRA and FCA's objec­
tives when setting their impact tolerances;

(ii) how their recovery and response arrangements are also

appropriate for the longer impact tolerance (recovery and
4 This table summarises the important business services definitions for response arrangements must be viable for both shorter and
CRR and Solvency II firms set out in the Operational Resilience Parts.
longer time periods); and
5 December 2019: https://www.bankofengland.co.uk/prudential-
regulation/publication/2018/building-the-uk-financial-sectors- (iii) that scenario testing has been performed with the longer
operational-resilience-discussion-paper. impact tolerance in mind as a shorter impact tolerance might

388 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 constrain the universe of severe but plausible events a firm 3.14 The supervisory authorities acknowledge the concerns of
might consider. the respondents. The supervisory authorities consider that the
use of a time-based metric is necessary to ensure that firms plan
around the continuity of important business services, and ensure
Disruption to Multiple Business Services that there are contingency plans in place to limit the extent
3.8 The consultations proposed that firms set an impact toler­ of disruption. This common approach to all impact tolerances
ance for each of their important business services. would also enable a minimum level of consistency - an idea that
was supported by respondents' comments. However, the super­
3.9 The supervisory authorities received responses commenting
visory authorities also understand the importance of considering
that their respective statutory objectives are more likely to be
other metrics depending on the type of the important business
impacted by a disruption to multiple business services rather
service in question.
than by significant disruptions to individual important business
services. 3.15 The supervisory authorities would like to clarify that a time-
based metric can be defined in different ways and, where appro­
3.10 Having considered the responses, the supervisory authori­
priate, must be used in conjunction with other metrics. The
ties are retaining the requirement, as proposed, for impact toler­
impact tolerance should specify that a particular important busi­
ances to be set for individual important business services. Firms
ness service should not be disrupted beyond a certain period
and FMIs should understand the maximum amount of time for
of or point in time. As an example, this could be a number of
which disruption to an important business service can be toler­
hours/days or a point in time, such as the end of the day, in
ated, or a point in time beyond which disruption cannot be tol­
conjunction with, for example, a certain level of customer com­
erated. This will provide clarity for firms and FMIs on how they
plaints or volume of interrupted transactions.
should act to remain within these tolerances.

3.11 However, the supervisory authorities also recognise that

disruptions to multiple important business services could signifi­ Definition of Impact Tolerances Between
cantly compound the impacts of disruptions. Therefore, the pol­ Supervisory Authorities
icy has been amended to include an expectation for firms and
3.16 The supervisory authorities proposed definitions for impact
FMIs to take into account the impact of failure of other related
tolerances in their respective documents. These definitions were
important business services when setting impact tolerances for
intended to provide clarity in relation to the term in line with the
an individual important business service. These may be related
respective supervisory authorities' objectives.
because, for example, they share common resources which sup­
port the delivery of the important business services or where 3.17 A number of respondents commented that the lack of
simultaneous disruption could have compounding impacts on consistency between the definitions caused some confusion and
similar external end users, customers, or participants. The super­ that greater harmonisation between the supervisory authorities
visory authorities expect firms to take a proportionate approach was needed.
in making this assessment, and only to consider extra layers of
3.18 Following these responses, changes have been
complexity where there are significant benefits in terms of build­ made to align the definitions where possible. Some differences
ing operational resilience.
in the wording of the definitions remain to reflect the
differing objectives and legal frameworks of the supervisory
authorities.
Measuring Impact Tolerances
3.19 Where definitions for impact tolerances have been
3.12 When defining impact tolerances for important business
updated, these are outlined in the table below and are reflected
services, the consultations proposed that firms and FMIs would
in the final rules. The FC A has, in line with amendments to the
be required to, at a minimum, specify the length of time for
'important business service' definition, made a correspond­
which a disruption to that important business service or impor­
ing change to its definition of 'impact tolerance' to remove
tant group business service can be tolerated (ie use a 'time-
the reference to 'intolerable' risk. The areas which have been
based' metric for all impact tolerances).
amended have been underlined in the table below. The PRA
3.13 Some respondents raised concerns that requiring a time- definitions are in the Operational Resilience Parts of the PRA
based metric for all impact tolerances could result in firms and Rulebook, and the FC A definitions are in the Glossary of the
FMIs treating impact tolerances as a compliance exercise. FCA Handbook.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 389

 Term PRA FCA
Impact Tolerance The maximum tolerable level of disruption to an means the maximum tolerable level of disruption
important business service or an important group to an important business service, as measured by
business service as measured bv a lenath of time in a lenqth of time in addition to any other relevant
addition to anv other relevant metrics.
------------------------------------y----------------------------------------------------------
metrics, reflecting the point at which any further
disruption to the important business service could
cause intolerable harm to anv one or more of the
firm's clients or pose a risk to the soundness, stabil­
ity, or resilience of the UK financial system or the
orderly operation of the financial markets.

25.4 IMPLEMENTATION TIMELINE 4.4 Senior management are expected to take responsibility for
delivering the policy outcomes. Firms and FMIs are expected to
4.1 The consultations proposed that firms and FMIs would have have a strategy or plan which sets out how they will comply with
12 months from the publication of final policy to implement the the supervisory authorities' requirements and expectations. In
policy. At the time of consultation, the proposed implementa­ order for the strategy to be effective, it should be put into effect
tion date for the proposals was the second half of 2021. The before Thursday 31 March 2022.As part of the strategy or plan,
consultation period was subsequently extended by six months firms and FMIs should prioritise their efforts on mapping and
in response to the Covid-19 pandemic. The consultations also scenario testing so that they will be able to identify vulnerabili­
proposed that firms and FMIs would be required to ensure they ties in sufficient time so that measures can be taken to remedi­
could remain within their impact tolerances in the event of a ate them. Firms and FMIs, particularly larger more complex
severe but plausible disruption to operations. The proposed ones, will need to make choices and prioritise with the ultimate
rules would have required firms and FMIs to meet this latter goal of delivering the outcomes of the policy.
outcome within a reasonable time, but no later than three years 4.5 The speed at which vulnerabilities are remediated should be
after the policy came into force. commensurate with the potential impact that a disruption would
4.2 A number of respondents enquired as to whether there cause, and will be an area of supervisory focus.
would be flexibility within the timelines for implementation.
4.6 After Monday 31 March 2025, maintaining operational
Firms and FMIs queried if mapping and testing should also be
resilience will be a dynamic activity. By this point, firms and
completed in these 12 months, suggesting they are resource
FMIs should have sound, effective, and comprehensive strate­
intensive and may be difficult to implement within such time-
gies, processes, and systems that enable them to address risks
frame. Respondents also requested flexibility around remaining
to their ability to remain within their impact tolerance for each
within impact tolerances, citing that operational resilience is not
important business service in the event of a severe but plausible
an end-state and that remediating operational shortfalls can
disruption (or extreme disruption).
take significantly longer than three years.
4.7 In the early stages of the Covid-19 pandemic, the supervi­
4.3 Firms and FMIs will need to have identified their important
sory authorities decided to postpone the consultation close date
business services and set impact tolerances by Thursday 31
to Thursday 1 October 2020. In light of this, the supervisory
March 2022. In order to achieve this, and to identify any vulner­
authorities have maintained the same timeline (12 months fol­
abilities in their operational resilience, firms and FMIs should
lowed by three years), but the date the timeline starts has been
have mapped their important business services and commenced
pushed back. The policy will take effect on Thursday 31 March
a programme of scenario testing. Firms and FMIs are not
2022 with a fixed three year implementation timeline within
expected to have performed mapping and scenario testing to
which the policy will become fully operational.
the full extent of sophistication within this time. Both mapping
and scenario testing are ongoing processes, and firms and FMIs 4.8 The supervisory authorities have considered the implemen­
are expected to perform them at varying levels of sophistication tation timelines carefully and consider that there is urgency for
over time. The supervisory authorities expect that firms' and firms and FMIs to build and prioritise their operational resilience
FMIs' approach to both mapping and scenario testing should as soon as reasonably practicable. The supervisory authorities
evolve over time. further believe they are being proportionate and flexible in their

390 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
expectation for firms and FMIs to propose to their supervisors reliance placed on sub-outsourcing arrangements, and if these
what a 'reasonable time' is for them to comply with operational arrangements pose a threat to their operational resilience. Firms
resilience requirements. and FMIs should, at a minimum, monitor sub-outsourced pro­
viders involved in the provision of important business services,
including their ability to deliver the firm's important business
25.5 DELIVERING OPERATIONAL services within the firm's impact tolerances.
RESILIENCE
Overview Scenario Testing for PRA-FCA
5.1 The policy requires firms and FMIs to set, and take actions
Dual-Regulated Firms
to meet, standards of operational resilience that incorporate the 5.5 Under the final policy, firms will be required to document a
public interest as represented by supervisory authorities' objec­ self-assessment of their compliance with the policy. Firms are
tives. Firms and FMIs should focus on their important business expected to:
services and ensure they have the ability to remain within impact
• summarise the vulnerabilities they have identified to the
tolerances in severe but plausible (or extreme) scenarios. Firms
delivery of their important business services; and
will be required to map the resources, people, processes, tech­
nology and facilities necessary to deliver important business ser­ • outline the scenario testing performed and the findings from

vices, irrespective of whether or not they use third parties in the the tests.

delivery of these services, and test their ability to remain within 5.6 In addition to the above, the FCA has set an expectation for
their impact tolerances. firms to conduct 'lessons learned' exercises to identify, prioritise
and invest in their ability to respond and recover from disrup­
tions as effectively as possible.
Mapping
5.7 Firms indicated that the introduction of the additional con­
5.2 The consultations proposed that a firm or FMI would be
cept of undertaking a 'lessons learned' exercise during scenario
required to identify and document the necessary people, pro­
testing in the FCA's consultation was not drawn out specifically
cesses, technology and information required to deliver each of
in PRA proposals. The respondents requested that the supervi­
its important business services. In particular, it was proposed
sory authorities use consistent terminology in this regard.
that mapping should enable firms and FMIs to deliver the fol­
lowing outcomes: 5.8 To provide consistency in the terminology used across the
supervisory authorities, the PRA has amended its policy to
(i) identify vulnerabilities in delivery of important business
include an expectation for firms to include 'lessons learned'
services within an impact tolerance; and
within their self-assessment document. Firms should identify any
(ii) test their ability to remain within impact tolerances. lessons learned when undertaking scenario testing or via practi­
cal experience, and include the actions taken to address the
5.3 Some firms and FMIs responded requesting that the super­
risks in their self-assessment document.
visory authorities set out further detail on these expectations
through a proportionate approach. The supervisory authorities
consider that the most proportionate and effective approach is
Severe/Extreme But Plausible Definition
maintaining the outcomes-based approach. Firms and FMIs are
expected to meet these outcomes in ways most appropriate for 5.9 The policy sets out that firms and FMIs should articulate spe­
their circumstances. The supervisory authorities expect firms and cific maximum levels of disruption, including time limits within
FMIs to take ownership of how mapping may fit into their exist­ which they will be able to resume the delivery of important busi­
ing approaches and how they could use it to identify vulnerabili­ ness services following severe but plausible disruptions. Firms and
ties. In supervising the policy, the supervisory authorities expect FMIs are also required to take action to ensure they remain within
firms and FMIs to meet the outcomes of the policy proportion­ impact tolerances in severe/extreme but plausible scenarios. In
ate to their size, scale, and complexity. the case of FMIs, the terminology 'extreme but plausible' is used
to avoid confusion with other parts of their supervisory approach.
5.4 Some firms and FMIs requested clarity on identifying sub­
outsourcing dependencies through mapping. The supervisory 5.10 A number of firms and FMIs asked for clarity regarding the
authorities note that the policy does not prescribe this level 'severe/extreme, but plausible' scenarios, and requested a defi­
of mapping. However, firms and FMIs should understand the nition be set out in the policy.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 391

5.11 To allow flexibility for firms and FMIs in their approach to that supervisory authorities would also expect firms and FMIs to
operational resilience, the final policy expects that firms and update their mapping annually at a minimum, or following sig­
FMIs identify the severe/extreme but plausible scenarios they nificant change if sooner.
use for testing. When setting severe/extreme but plausible sce­
narios, firms and FMIs could consider previous incidents or near
misses within the organisation, across the financial sector and
Self-Assessment Templates and Guidance
in other sectors and jurisdictions. A testing plan should include for PRA-FCA Dual-Regulated Firms
realistic assumptions and evolve as the firm learns from previous 5.17 The consultations proposed an expectation for firms to:
testing.
summarise the vulnerabilities they have identified to the delivery
5.12 The supervisory authorities see this area as one where of their important business services; and outline the scenario
the interest of firms and FMIs and the supervisory authorities testing performed and the findings from the tests. Firms would
should be aligned - if a firm or FMI chooses scenarios that are need to indicate what actions are planned to improve their abil­
insufficiently severe/extrem e, boards and senior management ity to remain within impact tolerances and demonstrate that the
might be taking inappropriate risks with the running of their timing for these is reasonable and in proportion to the systemic
businesses. The nature and severity of scenarios it is appropriate importance of the firm's important business service. The PRA
for firms to use may vary according to their size and com plex­ and FCA define this documentation as self-assessment.
ity. As a result, the policy does not include detailed guidance.
5.18 Respondents requested additional guidance or a template
However, the supervisory authorities anticipate that this will be for the self-assessment process. Firms also requested further
a common area for supervisory discussion, including developing
clarity on the level of detail required for the document.
an understanding of how and why scenarios have been selected.
The supervisory authorities expect best practice to develop over 5.19 The PRA and FC A consider that firms should undertake

time and that both firms and FMIs, and the supervisory authori­ bespoke self-assessments which reflect their individual impor­

ties will learn more over time. tant business services and scenario testing. A self-assessment
should document the necessary information to make decisions
required to meet the outcomes of the policy. The level of detail

Review of Testing should therefore be appropriate for the decisions firms will
make. Setting exact minimum standards would not be propor­
5.13 The consultations proposed that firms and FMIs would be tionate given the differences in the structures of individual firms.
required to carry out regular scenario testing of their ability to
remain within their impact tolerances for each of their important
business services in the event of a severe but plausible disrup­ Outsourcing and the Use of Third Parties
tion of their operations.
5.20 The consultations proposed that firms and FMIs would be
5.14 A number of firms and FMIs requested clarity on the required to map their important business services and test their
extent, level and nature of testing on a regular basis as pro­ ability to remain within impact tolerances for the purposes of
cesses mature over time. Other respondents suggested that building operational resilience. This would be expected regard­
regular testing could be too burdensome and have requested a less of whether the operational resources are being provided
review of the requirement. wholly or in part by a third party. Mapping and testing on third
parties is necessary for the firm or FMI and the supervisor to
5.15 While the supervisory authorities agree that testing should
obtain an accurate understanding of their operational resilience.
not become unduly burdensome, the supervisory authorities con­
sider that the process of reviewing mapping at least annually and 5.21 Some respondents raised concerns relating to third party
testing regularly is required for firms and FMIs to better under­ suppliers which may be reluctant to share information necessary
stand their systems and identify any vulnerabilities that need for mapping and testing, particularly where some firms have low
remediation. Where appropriate, the supervisory authorities have negotiating power in relation to large suppliers.
set out their expectations in their respective policy documents.
5.22 The supervisory authorities expect that the level of assur­
5.16 The final policy expects firms and FMIs to prioritise and ance firms and FMIs receive from third party suppliers relating
narrow their scenarios appropriately to ensure effective testing to important business services should be proportionate to the
that is not unduly burdensome. Firms and FMIs will also need to size and complexity of the firm or FMI and reflect the materiality
test regularly their ability to remain within impact tolerances in and risk of the outsourcing and third party arrangement. Firms
severe/extreme but plausible scenarios. The final policy states that enter into outsourcing or third party arrangements remain

392 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
fully accountable for complying with all their regulatory obliga­ 25.7 CONCLUSION
tions. As part of their assurance, firms or FMIs may ask third par­
ties to provide mapping or scenario testing data but this is not 7.1 The supervisory authorities are grateful for the consultation
required in all cases, particularly if other assurance mechanisms feedback in developing the operational resilience policy. They
are effective and more proportionate. are encouraged by the high level of engagement they have
received from industry and consumers.

25.6 INTERNATIONAL ALIGNMENT 7.2 The supervisory authorities expect firms to begin imple­
menting the policy requirements in line with the timeline as set
6.1 A number of respondents commented on the UK's proposals out in paragraphs 4.3 to 4.8 above. The final policy is now set
differing from international approaches. They also asked for clar­ out in the individual supervisory authorities' policy documents,
ification regarding the differing terminology and the relationship which are detailed below:
to potential international standards, such as those being devel­ • PRA - PS6/21: 'Operational resilience: Impact tolerances for
oped by the Basel Committee on Banking Supervision (BCBS). important business services';
6.2 The supervisory authorities recognise the global and inter­ • FC A - PS21/3 'Building operational resilience'; and
connected nature of firms and FMIs and the importance of • Bank - Bank of England policy on Operational Resilience of
supervisory coordination, and are committed to working closely FMIs.
with other regulators to ensure that supervisory approaches on
7.3 Identifying important business services and setting impact
operational resilience are well coordinated.
tolerances will be the first steps in the new framework for opera­
6.3 In August 2020 the BCBS published its consultation on prin­ tional resilience. The supervisory authorities recognise there
ciples for Operational Resilience.6 The UK's supervisory authori­ will be more to learn as the supervisory authorities and industry
ties have made a significant contribution to drafting these progress on the shared goal of operational resilience.
principles, using insights gained from developing their domestic
7.4 The supervisory authorities have found that collaboration
policy proposals.
with firms, FMIs, security, and other public and private sector
6.4 Comparing their policy with the BCBS consultation, despite organisations provides a constructive approach to promoting
some differences in terminology, the supervisory authorities operational resilience. They intend to continue this strategy,
consider that there is alignment on the core principles: working with other organisations in both authority-led and
industry fora. The supervisory authorities believe that coopera­
• a distinction between operational risk and operational
tion in this area is vital to achieving good operational resilience
resilience;
outcomes.
• operational resilience as an outcome, that firms and FMIs
continually need to work towards;
• the importance of operational resilience for both financial
stability and the safety and soundness of firms and FMIs; APPENDIX 2
• the concept of a risk or impact tolerance to define what
might be acceptable that does not assume zero failure; and
A2.1 INTRODUCTION
• the use of scenario testing to assure resilience.
1.1 This Supervisory Statement (SS) sets out the Prudential
6.5 The UK's supervisory authorities will continue to engage Regulation Authority's (PRA) expectations for the operational
with international policy development processes. It is realistic to resilience of firms' important business services, for which they
assume that there will be local differences in implementation. are required to set impact tolerances. The policy objective is to
And it is reasonable that different jurisdictions will have different improve the resilience to operational disruptions of both firms
views on what they consider critical or important. But as long as and the wider financial sector.
the principles are aligned, the supervisory authorities consider
1.2 The policy addresses risks to operational resilience from the
firms and FMIs and their supervisors should be able to work
interconnectedness of the financial system and the complex and
effectively across borders.
dynamic environment in which firms operate. The PRA consid­
ers that there is a need for a proportionate minimum standard
6 CBS Principles for operational resilience (https://www.bis.org/bcbs/ of operational resilience that incentivises firms to prepare for
publ/d509.pdf). disruptions and to invest where needed. Disruptions can affect

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 393

firms' safety and soundness, undermine policyholder protection, • the Fundamental Rules Part of the PRA Rulebook;9
and, in some cases, affect financial stability. • the Operational Resilience Parts;
1.3 This SS is relevant to all: • the PRA Statement of Policy 'Operational resilience';101and

• UK banks, building societies, and PRA-designated investment • SS2/21 'Outsourcing and third-party risk m anagem ent'.11
firms (hereafter banks); and
• UK Solvency II firms, the Society of Lloyd's, and its managing
agents (hereafter insurers).
A2.2 IMPORTANT BUSINESS SERVICES
1.4 Banks and insurers are collectively referred to as 'firms' in 2.1 A business service is a service that a firm provides. Business
this SS. services deliver a specific outcome or service to an identifiable
1.5 Operational resilience in this SS refers to the ability of firms user external to the firm and should be distinguished from busi­
and the financial sector as a whole to prevent, adapt, respond ness lines, which are a collection of services and activities.
to, recover from, and learn from operational disruptions. 2.2 As set out in the Operational Resilience Parts,12 firms must
The PRA's approach to operational resilience is based on the identify their important business services. The Operational Resil­
assumption that, from time to time, disruptions will occur which ience Parts define important business services as the services
will prevent firms from operating as usual and see them unable a firm provides which, if disrupted, could pose a risk to a firm's
to provide their services for a period. safety and soundness or, if a firm meets the criteria set out in
1.6 A clear focus by boards and senior management on their the Operational Resilience Parts,13 the financial stability of the
firm's operational resilience will become increasingly important UK. The Operational Resilience Parts14*set out that insurers must
as the wider financial sector becomes more dynamic, complex, also identify important business services that may pose a risk to
and reliant on technology and third parties. Moreover, inter­ policyholder protection.
national interconnectedness is increasing, for example as UK 2.3 The PRA expects firms to identify important business ser­
firms may outsource to cloud computing providers operating in vices considering the risk their disruption poses to financial sta­
a number of different countries. While this can improve firms' bility (where applicable), the firm's safety and soundness and, in
resilience, it also gives rise to new risks to operations which the the case of insurers, policyholder protection. A firm's important
PRA expects firms to manage effectively. business services will be a relatively short list of external-facing
1.7 To address the growing risk a lack of operational resilience services for which the firm has chosen to build high levels of
poses, the Operational Resilience Parts of the PRA Rulebook7 operational resilience in anticipation of operational disruption.
require firms to set and meet clear standards for the services 2.4 Firms should also consider the practicalities of how they
they provide and test their ability to meet those standards. identify their important business services. For example, they
Firms are required to review their existing approaches and make should identify important business services so that:
improvements where necessary.
• an impact tolerance can be applied and tested; and
1.8 The policy supports the PRA in embedding operational
• boards and senior management can make prioritisation and
resilience into its prudential framework. The policy provides an
investment decisions.
objective basis for the PRA to assess firms' operational resilience
and for the PRA's supervisors to have an informed dialogue with
the firms they supervise and drive them to implement change
where necessary. 9 Fundamental Rules 2, 3, 5, and 6 are particularly relevant.

1.9 This SS complements, and should be read in conjunction 10 March 2021: https://www.bankofengland.co.uk/prudential-regulation/
publication/2021/march/operational-resilience-sop.
with:
11 March 2021: https://www.bankofengland.co.uk/
• 'The PRA's approach to banking supervision' or 'The PRA's prudential-regulation/publication/2021/march/
approach to insurance supervision';8 outsourcing-and-third-party-risk-management-ss.
12 Operational Resilience - CRR Firms 2.1, Operational Resilience - Sol­
vency II Firms 2.1.
7 Operational Resilience - CRR Firms; Operational Resilience - Solvency
II Firms; and Rule 22 in the Group Supervision Part of the PRA Rulebook. 13 Operational Resilience - CRR Firms 2.3, Operational Resilience - Sol­
vency II Firms 2.3.
8 Available at: https://www.bankofengland.co.uk/prudential-
regulation/publication/pras-approach-to-supervision-of-the- 14 The definition of 'important business service' is in the Operational
banking-and-insurance-sectors. Resilience - Solvency II Firms Part.

394 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
2.5 When assessing the risk a business service poses to financial included in the mapping, scenario testing, and any remediation
stability (where applicable), the firm's safety and soundness, or work the PRA requires firms to perform.
policyholder protection, the PRA expects firms to consider the
2.8 Important business services deliver a specific outcome or
following factors:
service to an identifiable user and should be distinguished from
(a) Financial stability - the impact on the wider financial sector business lines, such as mortgages, which are a collection of ser­
and UK economy, including: vices and activities. They will vary from firm to firm. Firms should
consider the chain of activities which make up the important
• the potential to inhibit the functioning of the wider economy,
business service, from taking on an obligation to delivery of the
in particular the economic functions listed in SS19/13 'Resolu­
service, and determine those parts of the chain that are critical
tion planning';15
to delivery of the important business service. The PRA expects
• the potential to cause knock-on effects for counterparties,
that the critical parts of the chain should be operationally resil­
particularly those that provide financial market infrastructure
ient, and that firms should focus their work on the resources
or critical national infrastructure; and
necessary to deliver them. Below is an example of where activi­
• whether the service is covered by an impact tolerance set by ties performed by internal services within a firm would need
the Bank's Financial Policy Committee. to be included in the chain of activities (note, in the example
(b) The firm's safety and soundness - the impact on the firm below, the risk management function itself is not required to be
itself, including the: operationally resilient in the terms of this policy):

• impact on the firm's profit and loss; • Trade execution: Where trade execution requires clearance

• potential to cause reputational damage; and from the risk management function, the clearance process
would be included in the chain of activities that form part of
• the potential to cause legal or regulatory censure.
the important business service, and the operational resources
(c) In the case of insurers, an appropriate degree of policyholder needed to provide that clearance would need to be opera­
protection - the impact on policyholders affected by a disrup­ tionally resilient. In this example, the important business ser­
tion to the service, including consideration of: vice (trade execution) could not be delivered if the clearance
• the type of product, type of policyholder, and their current or process was operationally disrupted.
future interests; 2.9 When assessing if boards and senior management can make
• the significance to the policyholder of the risk insured; prioritisation and investment decisions for an important business
service, firms are expected to consider whether the number of
• the availability of substitute products that would offer a poli­
important business services is proportionate to their business. It
cyholder a similar level of protection; and
is likely that larger firms will identify a larger number of impor­
• the potential for significant adverse effects on policyholders
tant business services than smaller firms.
if cover were to be withdrawn or policies not honoured.
2.10 The PRA expects firms to review their important business
2.6 When assessing if an impact tolerance can be applied to an
services annually at a minimum, or sooner if a significant change
important business service, firms are expected to consider if the
occurs, and to determine whether any changes are required to
users of the service are identifiable. This means that the impacts
their list of important business services.
of disruption should be clear. The users of the service may
include retail customers, business customers, other legal enti­
ties, trustees, market participants, the supervisory authorities, or
other members of a regulated entity's group.
A2.3 IMPACT TOLERANCES
2.7 The focus on the implications of operational disruption for Setting an Impact Tolerance
firms' safety and soundness, financial stability, and policyholder
protection means that firms should not identify internal services 3.1 The Operational Resilience Parts16 require firms to set an

alone (for example those provided by human resources or pay­ impact tolerance for each of their important business services.

roll) as important business services. Such internal services, if nec­ The Operational Resilience Parts define an impact tolerance

essary for the delivery of important business services, would be as the maximum tolerable level of disruption to an important

15 June 2018: https://www.bankofengland.co.uk/prudential-regulation/ 16 Operational Resilience - CRR Firms 2.2, Operational Resilience -
publication/2013/resolution-planning-ss. Solvency II Firms 2.2.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 395

business service as measured by a length of time in addition to 3.7 Firms may choose to set their impact tolerances by assum­
any other relevant metrics. ing an important business service is unavailable for a specified
period of time and judging the potential impact this would
3.2 The Operational Resilience Parts17 require firms to set their
have. If this disruption would not pose a risk to the firm's safety
impact tolerances at the point at which any further disruption
and soundness, (in the case of insurers) policyholder protection,
to the important business service would pose a risk to the firm's
and (if applicable) the financial stability of the UK, the firm could
safety and soundness, and in the case of insurers, policyholder
consider the impact of a longer disruption. If, for example, the
protection, and, if a firm meets the criteria as set out in the
firm judges that after an important business service has been
Operational Resilience Parts,18 the financial stability of the UK.
unavailable for five days, there would be a risk to the financial
3.3 When setting an impact tolerance for an individual important stability of the UK, this would be the point within which the firm
business service, the PRA expects firms to take into account the would set its impact tolerance.
impact of failure of other related important business services.
3.8 When judging the point at which safety and soundness, (in
These may be related because, for example, they share com­
the case of insurers) policyholder protection, or (if applicable)
mon resources which support the delivery of the important
the financial stability of the UK is at risk, firms should consider
business services or where simultaneous disruption could have
identifying quantitative and qualitative indicators. In identifying
compounding impacts on similar external end users. The PRA
indicators, firms should consider the factors identified in para­
expects firms to take a proportionate approach in making this
graph 2.5 of this SS.
assessment, and only to consider extra layers of complexity
where there are significant benefits in terms of building opera­ 3.9 Impact tolerances are defined as the maximum tolerable
tional resilience. amount of disruption and should apply at peak times as well as
in normal circumstances. As such, when setting impact toler­
3.4 Impact tolerances provide a standard which boards and
ances, firms may wish to consider different times of the day,
senior management should use for prioritising investment and
different points in the year, or broader factors which may lead
making recovery and response arrangements (see Chapters 4 to
to activity within the important business service significantly
6 of this SS). They may be helpful in informing decision-making
increasing.
during operational disruptions, when they would be considered
alongside other information relevant to managing an incident
effectively. Impact Tolerance Metrics
3.5 The PRA expects impact tolerances to be set on the assump­
3.10 Firms should state their impact tolerances using clear
tion that a disruption will occur. Firms should not consider the
metrics. Firms should set at least one impact tolerance for each
cause or probability of disruption when setting their impact
important business service they have identified.
tolerances.
3.11 The PRA requires21 firms to use a time-based metric for all
3.6 An impact tolerance m ust,19 in all cases, include a time-
impact tolerances, but, where appropriate, firms should use a
based metric to measure the tolerable level of disruption to an
time-based metric in conjunction with other metrics. For exam­
important business service. Firms are also required to consider20
ple, a firm could set its impact tolerance at a certain volume
whether time-based impact tolerances should be used in con­
of interrupted transactions due to the disruption of the firm's
junction with additional metrics, such as the volume or value of
important business service, in conjunction with the disruption
transactions that the firm can tolerate being interrupted for that
continuing after a certain number of hours.
period of disruption. See paragraphs 3.10 to 3.16 for more on
impact tolerance metrics. 3.12 A time-based metric for an impact tolerance should specify
that a particular important business service should not be dis­
rupted beyond a certain period of or point in time, for example
after 24 hours or at the end of the day. An impact tolerance that
17 Operational Resilience - CRR Firms 2.3, Operational Resilience - combines time with a volume and/or value metric might state
Solvency II Firms 2.3.
that the firm will not tolerate the business service delivering less
1O
Operational Resilience - CRR Firms 2.3, Operational Resilience - than a certain percentage of normal operating capacity for a
Solvency II Firms 2.3.
specified period of time.
19 Operational Resilience - CRR Firms 2.4, Operational Resilience -
Solvency II Firms 2.4.
20 Operational Resilience - CRR Firms 2.4, Operational Resilience - 21 Operational Resilience - CRR Firms 2.4, Operational Resilience -
Solvency II Firms 2.4. Solvency II Firms 2.4.

396 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
3.13 Impact tolerances should not consider the frequency at borders as good reasons for a firm not to be able to act to
which operational disruptions are likely to occur. Rather, they ensure they can remain within an impact tolerance - these fac­
should be focused on setting the limit of the impact the firm can tors are themselves vulnerabilities that the PRA expects firms to
tolerate from a single disruption. address. However, incidents such as rapid technological change
may be a reason for a firm to not be able to remain within an
3.14 Setting an impact tolerance enables firms to assess the
impact tolerance, as it may take time to improve resilience
status of, and set resilience requirements for, the necessary
under those conditions.
people, processes, technology, facilities, and information (the
'resources') that contribute to the delivery of important business 4.3 The PRA expects firms to develop and implement effec­
service. These requirements might include capacity specifica­ tive remediation plans for the important business services that
tions, recovery time objectives, and recovery point objectives. would not be able to remain within their impact tolerance. Firms
These requirements should be set to enable the firm to deliver should take prompt action where they cannot remain within the
the important business service within its impact tolerance. impact tolerance, so these plans should include appropriate tim­
ing for the necessary improvements.
3.15 There may be circumstances when a firm continuing to
deliver a service through disruption may have a more adverse 4.4 In developing these plans to improve resilience and prioritis­
impact than suspending it. An example of this is where the firm ing their work, firms should also consider the:
cannot sufficiently assure the integrity of data underpinning an
• nature and scale of the risk that disruption to the important
important business service.
business service could have on financial stability (if appli­
3.16 The PRA's Fundamental Rules22 will remain relevant to cable), safety and soundness, and (in the case of insurers) the
decision making during operational disruptions, including deci­ appropriate degree of policyholder protection. Firms should
sions about when an important business service is suspended or prioritise those that pose the greatest risk.
restored. When setting impact tolerances, the PRA expects firms • time-criticality of the important business service, which is
to consider the circumstances that might be prevailing at the high when the impact tolerance is set for a short amount of
time of the disruption to help them make informed recovery and time. The PRA expects firms to have undertaken planning
response decisions and when they may decide not to resume and set up recovery and response arrangements in advance
the functioning of their important business services within the to be able to respond quickly to disruptions when they occur.
specified time. The PRA expects firms should not be forced into
• scale of improvement necessary to remain within the impact
inappropriate actions because of their impact tolerances in the
tolerance. An important business service that is far from
event of a disruption.
remaining within the impact tolerance may need to be priori­
tised over a business service that could nearly remain within

A2.4 ACTIONS TO REMAIN WITHIN its impact tolerance in a severe but plausible disruption.

IMPACT TOLERANCE 4.5 The PRA expects firms to be able to remain within impact
tolerances for important business services, irrespective of
4.1 The Operational Resilience Parts23*require firms to ensure whether or not they use third parties in the delivery of these ser­
they are able to deliver their important business services within vices. This means that firms should effectively manage their use
impact tolerances in severe but plausible scenarios. Mapping of third parties to ensure they can meet the required standard of
and testing the delivery of important business services will operational resilience.
equip firms to establish whether and how they can remain within
4.6 Although firms may assume that an arrangement is inher­
impact tolerances.
ently less risky where the service provider is part of its own
4.2 The PRA expects firms to take action where they identify a group, this is often not the case. The PRA expects firms to
limitation in their ability to deliver important business services manage risk and make appropriate arrangements to be able to
within impact tolerances. The PRA is unlikely to consider com­ remain within impact tolerance, whether using third parties that
plicated business models or the provision of services across are other entities within their group or external providers.

4.7 The PRA expects firms to develop communication strate­

gies for both internal and external stakeholders as part of their
22 Fundamental Rules 2, 3, 5, and 6 are particularly relevant for this
example. planning for responding to operational disruptions. These com­
23 Operational Resilience - CRR Firms 2.5, Operational Resilience - munication plans should be developed with a view to reduc­
Solvency II Firms 2.5. ing harm to counterparties and other market participants and

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 397

supporting confidence in both the firm and financial sector. The hours of disruption, this creates a reputational risk which
PRA expects firms' plans to include the escalation paths they threatens their safety and soundness. The firm identifies vul­
would use to manage communications during an incident and to nerabilities in its safeguarding systems and thus increases its
identify the appropriate decision makers. For example, the plan investment to improve the robustness of its systems to allow
should address how to contact key individuals, operational staff it to remain within the shorter impact tolerance, which also
suppliers, and the appropriate regulators. serves to meet the longer impact tolerance.

4.8 The PRA requires24 firms to consider PRA objectives when

setting impact tolerances. It is also aware that dual-regulated Policy Implementation
firms must identify a separate impact tolerance for their impor­
4.12 The Operational Resilience Parts are effective from
tant business services, where the delivery of the important
Thursday 31 March 2022. By this point, firms must have identi­
business service is also relevant to the FCA's objectives. Where
fied their important business services and set impact tolerances.
appropriate, a firm may set its PRA impact tolerance for a given
In order to achieve this, and to identify any vulnerabilities in
important business service at the same point as its FC A impact
their operational resilience, firms should have mapped their
tolerance. The PRA expects that work done to meet the require­
important business services and commenced a programme of
ments of one regulator should be leveraged to meet those of
scenario testing.
the other, and would encourage firms to avoid duplicative work.
4.13 Firms are not expected to have performed mapping and
4.9 The PRA expects dual-regulated firms to understand
scenario testing to the full extent of sophistication by Thursday
whether the scenarios that may cause firms to exceed their
31 March 2022. Both mapping and scenario testing are ongoing
respective PRA and FCA impact tolerances would differ
processes, and firms are expected to perform them at varying
(whether or not those impact tolerances are aligned), and to
levels of sophistication over time. The PRA expects that firms'
take action to remain within their PRA impact tolerances as
approaches to both mapping and scenario testing should evolve
appropriate.
over time.
4.10 The PRA understands that in practice firms may concen­
4.14 Senior management are expected to take responsibility
trate their efforts on ensuring they can remain within the more
for delivering the policy outcomes. Firms are expected to have
stringent tolerance. Where the PRA and FC A impact tolerances
a prioritised plan which sets out how they will comply with the
differ for a dual-regulated firm, taking action to ensure firms can
requirement to be able to remain within their impact tolerances
remain within the more stringent tolerance will be acceptable if
within a reasonable time, and no later than Monday 31 March
a firm can demonstrate:
2025.25 For a firm's plan to be effective, firms must have started
• how they have considered the PRA's objectives when setting putting the plan into effect by Thursday 31 March 2022. As part
their impact tolerances; of this planning, firms should prioritise their regular mapping
• how their response and recovery arrangements ensure firms and scenario testing so that they will be able to identify vul­
are able to remain within the PRA impact tolerance; and nerabilities in sufficient time so that measures can be taken to
• that scenario testing has been performed with the PRA remediate them. Firms, particularly larger, more complex ones,
impact tolerance in mind. will need to make choices and prioritise with the ultimate goal
of delivering the outcomes of the policy.
4.11 Below is an example illustrating how firms could effectively
concentrate their efforts on ensuring they can remain within the 4.15 The speed at which vulnerabilities are remediated should
more stringent impact tolerance for a given important business be commensurate with the potential impact that a disruption
service: would cause, and will be an area of supervisory focus.

• Where a firm providing custodian services to small and 4.16 After Monday 31 March 2025, maintaining operational
medium-sized asset managers and investment firms identifies resilience will be a dynamic activity. By this point, firms should
the safekeeping of securities for customers as an important have sound, effective and comprehensive strategies, processes,
business service, it may judge that: (a) after six hours of dis­ and systems that enable them to address risks to their ability to
ruption, this impacts customers' abilities to settle transactions remain within their impact tolerance for each important business
and thus poses a risk of consumer harm; and (b) after eight service in the event of a severe but plausible disruption.

24 Operational Resilience - CRR Firms 2.3, Operational Resilience - 25 Operational Resilience - CRR Firms 2.5, 2.6, Operational Resilience -
Solvency II Firms 2.3. Solvency II Firms 2.5, 2.6.

398 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A2.5 MAPPING sets out that firms should ensure that the service provider has
the ability and capacity on an ongoing basis to appropriately
5.1 The Operational Resilience Parts26 require firms to identify oversee any material sub-outsourcing in line with the firm's rel­
and document the necessary people, processes, technology, evant policy or policies.
facilities, and information (the 'resources') required to deliver 5.7 As set out in SS2/21, 'firms that enter into outsourcing
each of their important business services. This identification pro­ arrangements remain fully accountable for complying with all
cess is referred to as 'mapping'. their regulatory obligations'. This is a key principle underlying all
5.2 Adequate mapping should enable firms to meet the follow­ requirements and expectations regarding outsourcing and other
ing outcomes: third party arrangements. Therefore, a firm will remain responsi­
ble if a third party provider on whom it relies, whether wholly or
(a) The identification of vulnerabilities. Mapping an important
in part, to provide an important business service, fails to remain
business service should allow a firm to identify the resources
within impact tolerances or causes the firm to do so. SS2/21 sets
that are critical to delivering an important business service,
out detailed expectations on how firms should obtain assurance
ascertain whether they are fit for purpose, and consider what
from third parties throughout the lifecycle of an outsourcing
would happen if resources were to become unavailable.
or, where relevant, other third party arrangement. The level of
(b) Test ability to remain within impact tolerances. Mapping assurance that the PRA expects should be proportionate to the
should facilitate the testing of a firm's ability to deliver impor­ size and complexity of the firm and reflect the materiality and
tant business services within impact tolerances. To design and risk of the outsourcing and third party arrangement. As part of
understand the full implications of scenarios, a map of the rel­ this assurance, firms may ask third parties to provide mapping,
evant business service is necessary. Further information on the but this is not required in all cases, particularly if other assurance
approach to testing is outlined in Chapter 6. mechanisms are effective and more proportionate.

5.3 To meet the requirements in the Operational Resilience 5.8 Mapping information should be accessible and usable for
Parts27, the PRA expects firms to take action where a vulner­ the firm. Firms should document their mapping in a way that
ability is identified, or testing highlights a limitation to remaining is proportionate to their size, scale, and complexity. Firms are
within impact tolerances. expected to develop their own methodology and assumptions
for mapping to best fit their business.
5.4 The PRA expects firms to map their important business
services to the level of detail necessary to use the mapping to 5.9 The PRA expects firms to update their mapping annually at a
identify vulnerabilities and test ability to remain within impact minimum, or following significant change if sooner.
tolerances.

5.5 The PRA expects firms to map the resources necessary to

deliver important business services irrespective of whether the
A2.6 SCENARIO TESTING
resources are being provided wholly or in part by a third party,
6.1 The Operational Resilience Parts28 require firms to test regu­
which may be an intragroup or external service provider. Firms
larly their ability to remain within impact tolerances in severe but
should understand how their outsourcing and third party depen­
plausible disruption scenarios. Impact tolerances assume a dis­
dencies support important business services.
ruption has occurred, and so testing the ability to remain within
5.6 Firms should understand the reliance placed on sub-out­ impact tolerances should not focus on preventing incidents
sourcing arrangements and if these arrangements pose a threat from occurring. The PRA expects firms to focus on recovery and
to their operational resilience. Paragraph 9.5 of SS2/21 sets out response arrangements.
that firms should assess whether sub-outsourcing meets mate­
6.2 Firms should identify the severe but plausible scenarios they
riality criteria set out in Chapter 5 of SS2/21, which includes the
use for testing. When setting scenarios, firms could consider
potential impact on the firm's operational resilience and the pro­
previous incidents or near misses within the organisation, across
vision of important business services. Paragraph 9.6 of SS2/21
the financial sector, and in other sectors and jurisdictions. A test­
ing plan should include realistic assumptions and evolve as the
firm learns from previous testing.
Operational Resilience - CRR Firms 4.1, Operational Resilience -
r y /

Solvency II Firms 4.1.

27 Operational Resilience - CRR Firms 2.5, Operational Resilience - Operational Resilience - CRR Firms 5.1, Operational Resilience -
Solvency II Firms 2.5. Solvency II Firms 5.1.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 399

6.3 The Operational Resilience Parts29 require firms to prepare 6.7 Scenario testing should not pose a material risk of creat­
a written self-assessment of compliance with the Operational ing a disruption. Where firms consider that live-systems testing
Resilience Parts. The PRA expects firms to document details of is most appropriate for scenario testing their ability to remain
their scenario testing, including assumptions made in relation within impact tolerances, firms should assess the risk that the
to scenario design and any identified risks to the firm's ability to scenario testing may create a disruption to the delivery of
remain within impact tolerances. important business services. The PRA's Fundamental Rules30*will
remain relevant to decision making for how firms approach their
6.4 Over time, the PRA expects a firm's scenario testing to
scenario testing. Firms should conduct scenario testing with due
become more sophisticated as firms develop operational
skill, care, and diligence, act prudently, have effective risk strate­
resilience for each important business service. Firms would be
gies and risk management, and control their affairs responsibly
expected to test against more severe but plausible scenarios,
and effectively.
proportionate to the firm and the degree of operational resil­
ience each important business service has. 6.8 The entire chain of activities that have been identified as the
important business service should be considered when develop­
6.5 When considering the important business services to priori­
ing testing plans.
tise for testing, firms should consider the relative risk they pose
to financial stability (if applicable), safety and soundness, and 6.9 The severity of scenarios used by firms for their testing could
(in the case of insurers) the appropriate degree of policyholder be varied by increasing the number or type of resources unavail­
protection. able for delivering the important business service, or extending
the period for which a particular resource is unavailable. The
6.6 The PRA expects firms to develop a testing plan that details
mapping work that firms will undertake is likely to be useful
how they will gain assurance that they can remain within impact
in informing them how their scenarios could be made more
tolerances for important business services. The nature and
difficult.
frequency of a firm's testing should be proportionate to the
potential impact that disruption could cause and whether the 6.10 The PRA recognises that it would not be proportionate to
operational resources supporting an important business service require firms to be able to remain within impact tolerances in
have materially changed. When developing a testing plan, firms circumstances which are beyond severe or implausible. There
should consider the following: will be scenarios where firms find they could not deliver a par­
ticular important business service within their impact tolerance.
• the type of scenario testing, which may include paper-based
For example, if essential infrastructure (such as power, transport,
assessments, simulations, or live-systems testing;
or telecommunications) were unavailable, some firms may not
• the frequency of the scenario testing - firms that implement
be able to deliver their important business services within their
changes to their operations more frequently should under­
impact tolerance.
take more frequent scenario testing;
6.11 As impact tolerances are set on the assumption that disrup­
• the number of important business services tested - firms
tions will occur, we do not expect firms to devote too much time
that have identified more important business services should
to considering the relative probability of incidents occurring.
undertake more scenario testing to reflect this; and
• testing the availability and integrity of resources - impact tol­ 6.12 Firms should test a range of scenarios, including those in

erances are concerned with the continued provision of impor­ which they anticipate exceeding their impact tolerance. Under­

tant business services. An important business service that can standing the circumstances where it is impossible to stay within

continue to be provided but has insufficient integrity is not an impact tolerance will provide useful information to firms'

within the impact tolerance. Firms should test their recovery management and to their supervisors. Boards and senior man­

plans for both availability and integrity scenarios, proportion­ agement will need to judge whether failing to remain within the

ate to their size and complexity; and impact tolerance in specific scenarios is acceptable and be able
to explain their reasoning to supervisors.
• how their environment is changing and whether this will give
rise to different vulnerabilities. 6.13 Chapters 5 to 10 of SS2/21 set out detailed expectations
on how firms should perform due diligence and obtain effective

Operational Resilience - CRR Firms 6.1, Operational Resilience - 30 Fundamental Rules 2, 3, 5, and 6 are particularly relevant for this
OQ

Solvency II Firms 6.1. example.

400 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and proportionate assurance from third parties, including Management Responsibilities
through scenario testing. In particular, the PRA expects con­
tractual agreements for material outsourcing arrangements to 7.3 Firms should establish clear accountability and responsibility
include 'requirements for both parties to implement and test for the management of operational resilience, including imple­
business contingency plans. For the firm, these should take mentation of the policy set out here. The PRA expects firms to
account of firms' impact tolerances for important business ser­ structure their oversight of operational resilience in the most
vices. Where appropriate, both parties should commit to take effective way for their business, using existing committees and
reasonable steps to support the testing of such plans'. SS2/21 roles or establishing new ones if necessary.
further notes that firms' business continuity and exit plans for 7.4 Where it exists,33 the Chief Operations Senior Management
material outsourcing arrangements should 'where possible and Function (SMF) 24 should hold overall responsibility for imple­
re le va n t. . . align to, support, or even be a component of firms' menting operational resilience policies and reporting to the
scenario testing for operational resilience. For instance, one of board. Consistent with paragraph 2 .1 1G of SS28/15 'Strength­
the severe but plausible scenarios that firms may select for this ening individual accountability in banking'34 and paragraph
testing could involve a failure or disruption at a third party, or 2.22L of SS35/15 'Strengthening individual accountability in
their supply chain, based on previous incidents or near misses insurance',35 the SM F24 function may be shared or split among
within the organisation, across the financial sector, and in other two or more individuals. This is on the basis that the split accu­
sectors and jurisdictions'. rately reflects the firm's organisational structure and that com­
prehensive responsibility for operations and technology is not
undermined. However, firms that have a single senior individual
A2.7 GOVERNANCE with overall responsibility for internal operations and technology
should only have that individual approved as the SM F24. Where
Board Responsibilities the SMF24 function is split, the PRA does not expect it to be
split among more than three individuals. Further information on
7.1 Boards are specifically required to approve the important
the SMF24 function is contained in the aforementioned Supervi­
business services identified for their firm and the impact toler­
sory Statements.
ances that have been set for each of these. The Operational
Resilience Parts31 require that a firm's board must approve and 7.5 Where a firm does not have a board, senior management
regularly review the firm's important business services, impact should take responsibility for the Operational Resilience Parts.36
tolerances, and written self-assessment (see Chapter 8 of this
SS). In delivering this responsibility, boards must regularly
review assessments of the firm's important business services, A2.8 SELF-ASSESSMENT
impact tolerances, and the scenario analyses of its ability to
remain within the impact tolerance for these important business 8.1 The Operational Resilience Parts37*require firms to docu­
services. ment a self-assessment of their compliance with the Operational
Resilience Part. Firms are also expected to document the meth­
7.2 While individual board members are not required to be
odologies they have used to undertake these activities. Firms'
technical experts on operational resilience, the PRA expects
boards are accountable for and should approve the information
boards to ensure that they have the appropriate management
information. Boards should also collectively possess adequate
knowledge, skills, and experience to provide constructive chal­
33 Rule 3.8 in the Senior Management Functions Part of the PRA Rule-
lenge to senior management and inform decisions that have book (CRR firms), Rule 3.7 in the Insurance - Senior Management Func­
consequences for operational resilience.32 tions Part of the PRA Rulebook (Solvency II firms).
34 December 2020: https://www.bankofengland.co.uk/prudential-
regulation/publication/2015/strengthening-individual-accountability-
in-banking-ss.
35 February 2020: https://www.bankofengland.co.uk/prudential-
regulation/publication/2015/strengthening-individual-accountability-
n in-insurance-ss.
Operational Resilience - CRR Firms 7, Operational Resilience -
a

Solvency II Firms 7. 36 Operational Resilience - CRR Firms 7, Operational Resilience -

Solvency II Firms 7.
32 Rule 5.2 in the General Organisational Requirements Part of the PRA
Rulebook (CRR firms), Rule 2.7 in the Conditions Governing Business 37 Operational Resilience - CRR Firms 6, Operational Resilience -
Part of the PRA Rulebook (Solvency II firms). Solvency II Firms 6.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 401

provided in these documents. The PRA expects boards and • identify the vulnerabilities that threaten their ability to deliver
senior management to seek to build resilience so that they gain a important business services within impact tolerances. Firms
high level of assurance that their firm is able to deliver its impor­ should make every effort to remediate these vulnerabilities,
tant business services within impact tolerances. Firms should detailing the actions taken or planned and justifications for
document this information in the form of a self-assessment. their completion time. The completion time should be appro­
priate to the size and complexity of the firm, and the PRA will
8.2 A self-assessment should directly address the requirements
expect large and complex firms to take prompt action.
set out in the Operational Resilience Parts.38 Broader elements
of firms' operational resilience, for example, operational risk
management and business continuity planning, should only be
A2.9 GROUPS
referenced where they directly pertain to the Operational Resil­
ience Parts.39 Broader elements of firms' resilience should be 9.1 The PRA expects firms to identify a proportionate number
captured in existing firm practices.
of important group business services and respective impact
8.3 When documenting a self-assessment to meet the O pera­ tolerances at the level of the group. Taking a group level view
tional Resilience Parts,40 firms should: of operational resilience ensures the risks to the whole group,
including parts of the group that are not subject to the individ­
• list their important business services and state why each
ual requirements, are taken into account.
of these have been identified, with reference to the PRA's
expectations in Chapter 2 of this SS; 9.2 An important group business service41 is a service provided

• specify the impact tolerances set for these important busi­ by a member of the firm's group to an external end user42 which

ness services and why each impact tolerance has been set, if disrupted, could (via their impact on the group as a whole)

with reference to the expectations in Chapter 3 of this SS; pose a risk to financial stability in the UK, the UK firm's safety
and soundness, or (in the case of PRA-regulated insurers) poli­
• detail their approach to mapping important business ser­
cyholder protection. For example, where there is a UK group
vices. The PRA expects this to include how the firm has
that has a subsidiary, branch, or business unit providing a service
identified the resources that contribute to the delivery of
to customers outside the UK, which could, if disrupted, pose a
important business services and how they have captured the
risk to the safety and soundness of the UK group or UK financial
relationships between these. Firms should also document
stability, the group should identify that service as an important
how they have used mapping to identify vulnerabilities and
group business service and assess whether each important group
to support testing activity;
business service could remain within the impact tolerance in the
• describe their strategy for testing their ability to deliver event of a severe but plausible disruption to its operations.
important business services within impact tolerances through
9.3 Impact tolerances should be set in the same way as they are
severe but plausible scenarios. Firms should also describe the
for an individual firm. Boards and senior management should con­
scenarios used, the types of testing undertaken, and specify
sider the level of disruption that would represent a threat to the
the scenarios under which firms could not remain within their
viability of the group and therefore pose a risk to financial stability
impact tolerances;
in the UK, a firm's safety and soundness, or (in the case of PRA-
• identify any lessons learned when undertaking scenario test­
regulated insurers) there being an appropriate degree of protec­
ing or via practical experience, including the actions taken to
tion for those who are or may become the firm's policyholders.
address the issues encountered or risks highlighted; and
9.4 The Operational Resilience Parts43 require that firms ensure
that the strategies, processes, and systems at the level of their

38 Operational Resilience - CRR Firms 6, Operational Resilience - 41 The definition of important group business services is in the Opera­
Solvency II Firms 6. tional Resilience - CRR Firms Part and Group Supervision Part.
OQ

Operational Resilience - CRR Firms 6, Operational Resilience - 42 The definition of group external end user is in the Operational Resil­
Solvency II Firms 6. ience - CRR Firms Part and Operational Resilience - Solvency II Firms
Part.
40 Operational Resilience - CRR Firms 6, Operational Resilience -
Solvency II Firms 6. 43 Operational Resilience - CRR Firms 8.4, Group Supervision 22.5.

402 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
group enable the firm to assess whether important group busi­ to identify important business services and set impact toler­
ness services are able to remain within their impact tolerances ances for these services. Firms must take action to ensure they
in severe but plausible scenarios. A firm would be expected to are able to deliver their important business services47 within
work with other members of its group to take action, should their impact tolerances.48 Testing against severe but plausible
it be likely that an important group business service could not operational disruption scenarios enables firms to identify vulner­
be delivered within its impact tolerance. Firms are required to abilities and take mitigating action. The PRA's operational resil­
include this analysis in their self-assessments. ience policy requires boards and senior management to drive
improvement where deficiencies are found.

1.5 The context of important business services and impact toler­

APPENDIX 3 ances influences the PRA's approach to other parts of the PRA's
regulatory framework as well. This SoP sets out how the PRA
A3.1 INTRODUCTION implements a consistent and targeted approach across its regu­
latory framework.
1.1 This Statement of Policy (SoP) is relevant to all:
1.6 The SoP clarifies how the PRA's operational resilience policy
• UK banks, building societies, and PRA-designated investment
affects its approach to four key areas of the regulatory fram e­
firms (hereafter banks); and
work in particular (the relationship between these policies is
• UK Solvency II firms, the Society of Lloyd's, and its managing depicted in Figure 25A.1 below):
agents (hereafter insurers).
• governance;
1.2 Banks and insurers are collectively referred to as 'firms'.
• operational risk management;
1.3 The Prudential Regulation Authority (PRA) considers that
• business continuity planning (BCP); and
for firms to be operationally resilient, they should be able to
• the management of outsourced relationships.
prevent disruption occurring to the extent practicable; adapt
systems and processes to continue to provide services and 1.7 There is a valuable set of other relevant existing policies and
functions in the event of an incident; return to normal running guidelines (eg the European Banking Authority's (EBA's) guide­
promptly when a disruption is over; and learn and evolve from lines on information and communication technology (ICT) risks,
both incidents and near misses. Therefore, operational resilience and the EBA's guidelines on ICT and security risk management).49
is an outcome that is supported by several parts of the PRA's The PRA considers all of its policies and relevant international
regulatory fram ework.44 guidelines in the context of its operational resilience policy, not
1.4 The Operational Resilience Parts of the PRA Rulebook45 and just those outlined here. The PRA's operational resilience policy
SS1/21 'Operational resilience: Impact tolerances for impor­ will complement existing policies and is not intended to conflict
tant business services'46 respectively require and expect firms with or amend them.

44 As explained in PRA DP1/18 'Building the UK financial sector's 47 'Important business service' as described in Chapter 2 of SS1/21.
operational resilience', p.8: https://www.bankofengland.co.uk/prudential-
48 'Impact tolerance' as described in Chapter 3 of SS1/21.
regulation/publication/2018/building-the-uk-financial-sectors-operational-
resilience-discussion-paper. 49 Unless otherwise stated, any references to EU or EU derived
legislation refer to the version of that legislation which forms part
45 Operational Resilience - CRR Firms; Operational Resilience - Sol­
of retained EU law. See Appendix 2 of the SoP 'Interpretation of
vency II Firms; and Chapter 22 in the Group Supervision Part of the PRA
EU Guidelines and Recommendations: Bank of England and PRA
Rulebook.
approach after the UK's withdrawal from the EU': https://www.
46 March 2021: https://www.bankofengland.co.uk/prudential-regulation/ bankofengland.co.uk/-/media/boe/files/paper/2019/interpretation-
publication/2021/march/operational-resilience-impact- tolerances-for- of-eu-guidelines-and-recommendations-boe-and-pra-approach-sop-
important business-services-ss. december-2020.pdf.

Chapter 25 Operational Resilience: Impact Tolerance for Important Services ■ 403

 Firm must ensure they
Strategic Identify important are able to remain
Set impact tolerances
Outcomes business services within impact
tolerances

Governance and self-assessment

Supporting Map inputs for Test ability to meet Business Operational risk
Outsourcing
Requirements delivery impact tolerances continuity management

Fiaure 25A.1 Th e relationship b e tw e e n th e PRA's o p eratio n al resilien ce policy w ith o th e r key a re as of th e PRA's
reg u lato ry fram ew o rk.
The framework of: identifying important business services; setting impact tolerances; and taking actions to be able to remain within
impact tolerances set the strategic direction that the PRA expect firms to take. To achieve the strategy, firms must:

• map resources;
• test their ability to remain within impact tolerances;
• implement BCP requirements;
• implement operational risk management requirements; and
• implement outsourcing requirements.
Governance is an inherent part of each of the above elements, and self-assessment looks at how all of these elements combine to
build the resilience of a firm.

A3.2 THE RELATIONSHIP BETWEEN When the PRA considers its expectations for boards in its opera­
tional resilience policy and elsewhere in its regulatory fram e­
OPERATIONAL RESILIENCE AND work, it considers, for example, if boards:
GOVERNANCE
• have appropriate management information available to

2.1 The role of firms' boards and senior management is central to inform decisions which have consequences for operational

the PRA's operational resilience policy. Boards are accountable resilience;

for, and should approve, the identification of their firm's impor­ • have adequate knowledge, skills, and experience in order to
tant business services, impact tolerances, and self-assessment. provide constructive challenge to senior management and
meet their oversight responsibilities in relation to operational
2.2 The ability of firms to deliver their important business ser­
resilience; and
vices within their impact tolerances depends upon appropriate
reporting and accountability to be in place throughout the firm. • articulate and maintain a culture of risk awareness and ethical
Where limitations are identified, leadership from the firms' board behaviour for the entire organisation, which influences the
and senior management is essential to prioritise the investment firm's operational resilience.
and cultural change required to improve operational resilience.

Interaction with Other Management

Interaction with Other Board Responsibilities
Responsibilities
2.4 The Chief Operations Senior Management Function (SMF)
2.3 The PRA considers whether firms are delivering the outcome 24, where it applies, includes responsibility for the firm's opera­
of operational resilience when assessing the adequacy of a tional resilience. The PRA's operational resilience policy provides
firm's arrangements to deliver other expectations of boards. further detail to firms on this responsibility.

404 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A3.3 THE RELATIONSHIP BETWEEN
OPERATIONAL RESILIENCE AND
OPERATIONAL RISK POLICY
3.1 Operational risk management supports both operational
resilience and financial resilience. Firms should have effective
risk management systems in place to manage operational risks
that are integrated into their organisational structures and
decision-making processes.50

3.2 When assessing a firm's operational risk management, the

PRA considers the extent to which firms: have reduced the
likelihood of operational incidents occurring; can limit losses in
the event of severe business disruption; and whether they hold
sufficient capital to mitigate the impact when operational risks
crystallise.

3.3 The additional requirements the PRA's operational resilience LIKELIHOOD

policy places on firms to limit the impact of disruptions when Fiaure 25A.2 Th e relationship b e tw e e n risk a p p e tite
they occur, whatever their cause, develops the PRA's approach and im pact to le ra n ce .
to operational risk in two key ways: Figure 25A.2 shows the relationship between impact and likeli­
hood for a firm's risk appetite and impact tolerance. Both risk
• it increases firms' focus on their ability to respond to and
appetite and impact tolerances help ensure a firm's operational
recover from disruptions, assuming failures will occur; and
resilience.
• it addresses the risk that firms may not necessarily consider
the public interest when making investment decisions to • The thick solid line represents the risk appetite, which
build their operational resilience. The PRA's operational resil­ changes with impact and likelihood. Green, yellow, and red
ience policy requires firms to take action so they are able to illustrate the firm's appetite towards disruption at different
provide their important business services within their impact levels of impact and likelihood (green is within the firm's risk
tolerances through severe but plausible disruptions. appetite, yellow is outside of the firm's risk appetite, and red
is significantly outside of the firm's risk appetite).
• The dashed dark line represents the impact tolerance, which
Risk Appetite and Impact Tolerances
is set at a high level of impact and assumes disruption has
3.4 Impact tolerances differ from risk appetites in that they occurred, so is indifferent to likelihood. The green, yellow,
assume a particular risk has crystallised instead of focusing on and red are not related to the impact tolerance.
the likelihood and impact of operational risks occurring. Firms
that are able to remain within their impact tolerances increase
their capability to survive severe but plausible disruptions, but Financial Resilience
risk appetites are likely to be exceeded in these scenarios (see
3.5 Firms are required to hold capital to ensure they can absorb
Figure 25A.2 below). Impact tolerances are set only in relation
losses resulting from operational risks such as fraud, damage
to impact on financial stability, the firm's safety and soundness
to physical resources, or business disruption and system fail­
and, in the case of insurers, the appropriate degree of policy­
ures.51 However, the PRA's operational resilience policy does
holder protection.
not have an associated capital requirement. As such, it does not

51 CRR Firms - Internal Capital Adequacy Assessment 10.1 (for banks),

for insurers Solvency Capital Requirement - General Provisions 3.3
50 Directive 2013/36/EU (Article 85(1)). Solvency II Directive (Article 44). (for insurers).

Chapter 25 Operational Resilience: Impact Tolerance for Important Business Services ■ 405
affect the PRA's approach to operational risk capital policy or focuses on a firm's ability to deliver its important business ser­
add additional considerations for firms when they make capital vices rather than single points of failure. The PRA considers both
calculations. policies together when supervising firms. For example, when
assessing whether banks are meeting the PRA's expectations in
SS21/15 'Internal governance',55 the PRA considers if banks':
Incident Management
• recovery priorities for their operations56 prioritise the delivery
3.6 In the PRA's general notification rules52 firms are required to of important business services within impact tolerances;
notify the PRA where an incident: could lead to the firm failing
• allocation of resources and communications planning for
to satisfy one or more of the threshold conditions; could have a
business continuity planning focuses on the delivery of
significant adverse impact on the firm's reputation; could impact
important business services; and
the firm's ability to continue to provide adequate services to its
customers; or could result in serious financial consequences to • tests of business continuity plans complement the testing of

the UK's wider financial sector or to other firms. disruption scenarios and relate to impact tolerances.

3.7 The PRA considers whether a firm has met the PRA's noti­
fication requirements alongside the PRA's expectations in its A3.5 THE RELATIONSHIP BETWEEN
operational resilience policy. For example the PRA expects OPERATIONAL RESILIENCE AND
incidents to meet the test for notification if the incident would
disrupt the firm's ability to deliver its important business services
OUTSOURCING
within its impact tolerances. This includes incidents which have
5.1 As set out in the PRA's outsourcing rules,57 firms remain
occurred, may have occurred or may occur in the foreseeable
responsible for their obligations when functions are outsourced
future.
to a third party. In the PRA's operational resilience policy, the
PRA expects firms to be operationally resilient regardless of any

A3.4 THE RELATIONSHIP BETWEEN outsourcing arrangements or use of third parties. Firms should
not allow their ability to deliver their important business services
OPERATIONAL RESILIENCE AND within their impact tolerances to be undermined when they
BUSINESS CONTINUITY PLANNING are delivered wholly or in part by third parties, whether these
(BCP) third parties are other entities within their group or external
providers.
4.1 The PRA requires a bank to 'have in place adequate con­ 5.2 The PRA's policy for modernising the regulatory framework
tingency and business continuity plans aimed at ensuring that on outsourcing and third party risk management (SS2/21 'O ut­
in the case of a severe business disruption the firm is able to sourcing and third party risk management')58 complements the
operate on an ongoing basis and that any losses are lim ited'.53 PRA's operational resilience policy. SS2/21 reflects the increased
Similarly, an insurer is required to 'take reasonable steps to importance to firms of cloud computing and other new technol­
ensure continuity and regularity in the performance of its activi­ ogies. The PRA's approach is to consider SS2/21 and the PRA's
ties, including the development of contingency plans'.54 These operational resilience policy in combination.
requirements and the PRA's operational resilience policy con­
tribute to firms' response and recovery capabilities.

4.2 BCP policies and the PRA's operational resilience policy are
closely linked. However, the PRA's operational resilience policy

55 April 2017: https://www.bankofengland.co.uk/prudential-regulation/

publication/2015/internal-governance-ss.
56 Paragraph 2.1(b), SS21/15.
52 Rule 2.1 in the Notifications Part of the PRA Rulebook.
57 CRR Firms - Outsourcing, Solvency II Firms - Conditions Governing
53 CRR Firms - Internal Capital Adequacy Assessment 10.2. Business 7.
54 Rule 2.6 in the Solvency II Firms - Conditions Governing Business Part 58 March 2021: https://www.bankofengland.co.uk/prudential-regulation/
of the PRA Rulebook. publication/2021/march/outsourcing-and-third-party-risk-_management-ss.

406 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Principles for
Operational
Resilience
Learning Objectives
After completing this reading you should be able to:

Define and describe operational resilience and explain Explain recommended principles that banks should follow
essential elements of operational resilience. to implement an effective operational resilience approach.

E x c e rp t is rep rin ted with perm ission o f the Bank for International Settlem en ts. The full publication is available on the B IS w eb site free
o f charge: w w w .bis.org

407
26.1 INTRODUCTION operational resilience by furthering international engagement
and seeks to promote greater cross-sectoral collaboration over
1. In the years that followed the Great Financial Crisis (GFC) of this body of work.
2007-09, the Basel Committee's reforms of its prudential frame­
work have enhanced the supervision of the global banking sys­
tem and resulted in a number of structural changes to strengthen 26.2 AN EVOLVING OPERATIONAL
banks' financial resilience. While significantly higher levels of cap­ RISK LANDSCAPE
ital and liquidity have improved banks' ability to absorb financial
shocks, the Committee believes that further work is necessary 5. Banks and their customers have benefited from the applica­
to strengthen banks' ability to absorb operational risk-related tion of technology to financial services, although the increased
events, such as pandemics, cyber incidents, technology failures use of technology presents new risks. Until recently, some
and natural disasters, which could cause significant operational of the most predominant operational risks that banks faced
failures or wide-scale disruptions in financial markets. In light of resulted from vulnerabilities related to the rapid adoption of
the critical role that banks play in the operation of the global and increased dependency on technology infrastructure for the
financial infrastructure, increasing their resilience would provide provision of financial services and intermediation, as well as the
additional safeguards to the financial system. sector's growing reliance on technology-based services pro­
vided by third parties. The Covid-19 pandemic has exacerbated
2. Even prior to the Covid-19 pandemic, the Committee con­
these operational risks and increased economic and business
sidered that significant operational disruptions would inevitably
uncertainty. Technology and relationships with third parties have
test improvements to the financial system's resilience made
at the same time supported the continued delivery of products
since the G FC . As the Covid-19 pandemic progressed, the
and services to customers and promoted the ability of banks to
Committee observed banks rapidly adapting their operational
continue operations during the pandemic.
posture in response to new hazards or changes in existing haz­
ards that occurred in different parts of their organisation. Rec­ 6. Pandemic-related disruptions have affected information
ognising that a range of potential hazards cannot be prevented, systems, personnel, facilities and relationships with third-party
the Committee believes that a pragmatic, flexible approach to service providers and customers. In addition, cyber threats (ran-
operational resilience can enhance the ability of banks to with­ somware attacks, phishing, etc) have spiked, and the potential
stand, adapt to and recover from potential hazards and thereby for operational risk events caused by people, failed processes
mitigate potentially severe adverse impacts. and systems has increased as a result of greater reliance on
virtual working arrangements. The Committee's guidance on
3. Through the publication of this document, the Committee
operational resilience will continue to be informed by its moni­
seeks to promote a principles-based approach to improving
toring of the impact of the Covid-19 pandemic and any lessons
operational resilience. The approach builds on updates to the
learned.
Committee's Principles for the Sound Management of O pera­
tional Risk (PSM OR)1 and draws from previously issued principles
on corporate governance for banks, as well as outsourcing-, busi­
26.3 ESSENTIAL ELEMENTS OF
ness continuity- and relevant risk management-related guidance.
OPERATIONAL RESILIENCE
4. Recognising the work undertaken by several jurisdictions and
standard-setting bodies (SSBs) to bolster the operational resil­ 7. Operational resilience is an outcome that benefits from the
ience of the financial sector,1
2 the Committee aims to strengthen effective management of operational risk.3 Activities such as
risk identification and assessment, risk mitigation (including the
1 Revisions to the Principles for the Sound Management of Operational implementation of controls) and the monitoring of risks and
Risk, March 2021, www.bis.org/bcbs/publ/d515.htm.
control effectiveness work together to minimise operational
2 Bank of England and Financial Conduct Authority, Building the UK financial
disruptions and their effects. In addition, management's focus
sector's operational resilience, December 2019; European Banking Author­
ity, EBA guidelines on ICT and security risk management, November 2019; on the bank's ability to respond to and recover from disrup­
European Commission, Legislative proposal for an EU regulatory framework tions, assuming failures will occur, will support operational
on digital operational resilience for the financial sector (DORA), September resilience. An operationally resilient bank is less prone to incur
2020; Monetary Authority of Singapore, Ensuring safe management and
operational resilience of the financial sector, April 2020: International Orga­ untimely lapses in its operations and losses from disruptions,
nization of Securities Commissions (IOSCO), Principles on outsourcing,
May 2020; and Board of Governors of the Federal Reserve System, Federal
Deposit Insurance Corporation and Office of the Comptroller of the Cur­ 3 BCBS, Revisions to the Principles for the Sound Management of Oper­
rency, Sound Practices to Strengthen Operational Resilience, October 2020. ational Risk, March 2021.

408 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
thus lessening incident impact on critical operations and related 26.4 DEFINITION OF OPERATIONAL
services, functions and systems. While it may not be possible to
avoid certain operational risks, such as a pandemic, it is possible
RESILIENCE
to improve the resilience of a bank's operations to such events.
11. The Committee defines operational resilience as the ability
8. In addition, business continuity, outsourcing of services to of a bank to deliver critical operations through disruption. This
third parties and the technology upon which banks rely are ability enables a bank to identify and protect itself from threats
important factors for banks to consider when strengthening and potential failures, respond and adapt to, as well as recover
their operational resilience. Previously issued guidance in these and learn from disruptive events in order to minimise their
areas, whether issued solely by the Com m ittee4 or jointly with impact on the delivery of critical operations through disruption.
other SSBs,5 does not adequately capture all essential elements In considering its operational resilience, a bank should assume
when considered on a standalone basis, but does advance oper­ that disruptions will occur, and take into account its overall risk
ational resilience when considered collectively. appetite7 and tolerance for disruption. In the context of opera­

9. It is essential for banks to ensure that existing risk manage­ tional resilience, the Committee defines tolerance for disruption
as the level of disruption from any type of operational risk a
ment frameworks, business continuity plans and third-party
bank is willing to accept given a range of severe but plausible
dependency management are implemented consistently within
scenarios.
the organisation. Banks should consider whether their opera­
tional resilience approach is appropriately harmonised with 12. The term critical operations is based on the Joint Forum's
the stated actions, organisational mappings, and definitions of 2006 high-level principles for business continuity. It encom­
critical functions and critical shared services contained in their passes critical functions as defined by the FSB8 and is expanded
recovery and resolution plans as specified in the Financial Stabil­ to include activities, processes, services and their relevant sup­
ity Board's (FSB's) Recovery and Resolution Planning framework, porting assets9 the disruption of which would be material to
as appropriate.6 the continued operation of the bank or its role in the financial
system. W hether a particular operation is "critical" depends on
10. The principles for operational resilience set forth in this doc­
the nature of the bank and its role in the financial system. Banks'
ument are largely derived and adapted from existing guidance
tolerance for disruption should be applied at the critical opera­
that has been issued by the Committee or national supervisors
tions level.
over a number of years. The Committee recognises that many
banks have well established risk management processes that are 13. The term respective functions used in this document explicitly
appropriate for their individual risk profile, operational structure, refers to the appropriate function(s) within the bank's three lines
corporate governance and culture, and conform to the specific of defence, as described in the PSM O R.10 These consist of
risk management requirements of their jurisdictions. By building (i) business unit management; (ii) an independent operational risk
upon existing guidance and current practices, the Committee
is issuing a principles-based approach to operational resilience
that will help to ensure proportional implementation across 7 Per the BCBS's 2015 Corporate governance guidelines, which use
banks of various size, complexity and geographical location. the FSB's 2013 Principles for an effective risk appetite framework, "risk
appetite" is defined as: the aggregate level and types of risk a bank is
willing to assume, decided in advance and within its risk capacity, to
achieve its strategic objectives and business plan.
8 FSB, Recovery and resolution planning for systemically important
4 BCBS, Risk management principles for electronic banking, July 2003, financial institutions: guidance on identification of critical functions and
www.bis.org/publ/bcbs98.pdf; and BCBS, Corporate governance prin­ critical shared services, 2013. According to the FSB, critical functions are
ciples for banks, July 2015, www.bis.org/publ/bcbs.pdf. defined as "activities performed for third parties where failure would
lead to the disruption of services that are vital for the functioning of the
5 Joint Forum (BCBS-IOSCO-IAIS), Outsourcing in financial services,
real economy and for financial stability due to the banking group's size
February 2005, www.bis.org/publ/joint12.pdf; and Joint Forum
or market share, external and internal interconnectedness, complexity
(BCBSIOSCO-IAIS), High-level principles for business continuity, August
and cross-border activities. Examples include payments, custody, certain
2006, www.bis.org/publ/joint17.pdf.
lending and deposit-taking activities in the commercial or retail sector,
6 See FSB, Key Attributes of Effective Resolution Regimes for Finan­ clearing and settling, limited segments of wholesale markets, market
cial Institutions, October 2014 (http://www.fsb.org/wp-content/ making in certain securities and highly concentrated specialist lending
uploads/r_141015.pdf); relevant supporting guidance in Identification sectors."
of Critical Functions and Critical Shared Services, July 2013 (http://www.
9 In this context, "supporting assets" are defined as people, technology,
fsb.org/wp-content/uploads/r_130716a.pdf); and Guidance on arrange­
information and facilities necessary for the delivery of critical operations.
ments to support operational continuity in resolution, August 2016
(https://www.fsb.org/wp-content/uploads/Guidance-on-Arrangements- 10 BCBS, Revisions to the Principles for the Sound Management of
to-Support-Operational-Continuity-in-Resolution1 .pdf). Operational Risk, paragraph 6, March 2021.

Chapter 26 Principles for Operational Resilience ■ 409

management function; and (iii) independent assurance. Depend­ In formulating the bank's tolerance for disruption, the board
ing on a bank's nature, such as its size, complexity and risk profile, of directors should consider the bank's operational capabili­
how these three lines of defence are implemented may vary. ties given a broad range of severe but plausible scenarios that
would affect its critical operations. The board of directors should
ensure that the bank's policies effectively address instances
26.5 OPERATIONAL RESILIENCE where the bank's capabilities are insufficient to meet its stated
PRINCIPLES tolerance for disruption.

17. Under the oversight of the board of directors, senior

14. This section presents the Committee's principles for opera­ management should implement the bank's operational resil­
tional resilience which are organised across the following seven ience approach and ensure that financial, technical and other
categories: governance; operational risk management; business resources are appropriately allocated in order to support the
continuity planning and testing; mapping of interconnections bank's overall operational resilience approach.
and interdependencies of critical operations; third-party depen­
dency management; incident management; and resilient infor­ 18. Senior management should provide timely reports on the

mation and communication technology (ICT), including cyber ongoing operational resilience of the bank's business units in sup­

security. The principles are to be applied on a consolidated basis port of the board's oversight, particularly when significant defi­

to banks consistent with the scope of the Basel Framework. ciencies could affect the delivery of the bank's critical operations.

15. These categories are based on the Committee's updated 19. The board of directors should take an active role in estab­

PSM OR, and previously issued principle-based guidance on cor­ lishing a broad understanding of the bank's operational resil­

porate governance, business continuity, outsourcing and other ience approach, through clear communication of its objectives

relevant risk management frameworks. The practices described to all relevant parties, including bank personnel, third parties

below, some of which reflect previously issued guidance, should and intragroup entities.

not be viewed in isolation, but rather as integral parts of a

bank's forward-looking operational resilience approach in line Operational Risk Management
with its operational risk appetite and tolerance for disruption.
Principle 2: Banks should leverage their respective functions
for the management of operational risk to identify external
Governance and internal threats and potential failures in people, processes

Principle 1: Banks should utilise their existing governance and systems on an ongoing basis, promptly assess the vulner­

structure11 to establish, oversee and implement an effec­ abilities of critical operations and manage the resulting risks in

tive operational resilience approach that enables them to accordance with their operational resilience approach.

respond and adapt to, as well as recover and learn from, 20. The bank's operational risk management function should
disruptive events in order to minimise their impact on work alongside other relevant functions to manage and address
delivering critical operations through disruption. any risks that threaten the delivery of critical operations. Banks

16. The board of directors should review and approve the bank's should coordinate their business continuity planning, third-party

operational resilience approach considering the bank's risk dependency management, recovery and resolution planning

appetite and tolerance for disruption to its critical operations. and other relevant risk management frameworks to strengthen
operational resilience across the bank.

11 Consistent with the PSMOR, this document refers to a governance 21. Banks should have sufficient controls and procedures12 to
structure composed of a board of directors and senior management. identify and assess threats and vulnerabilities, and more gener­
The Committee is aware that there are significant differences in legisla­
ally their operational risk, in a timely manner and, to the extent
tive and regulatory frameworks across countries regarding the functions
of the board of directors and senior management. In some countries, possible, prevent them from affecting critical operations deliv­
the board has the main, if not exclusive, function of supervising the ery. The resp ective functions should regularly assess the effec­
executive body (senior management, general management) so as to
tiveness of the implemented controls and procedures. These
ensure that the latter fulfils its tasks. For this reason, in some cases it is
known as a supervisory board. This means that the board has no execu­ assessments should also be conducted in the event of changes
tive functions. In other countries, the board has a broader competence to any underlying components of the critical operations, as well
in that it lays down the general framework for the management of the
bank. Owing to these differences, the terms "board of directors" and
"senior management" are used in this paper not to identify the segre­ 12 These controls and procedures should be consistent with and
gated legal liability in corporate governance practices but rather to label conducted alongside the risk identification process as articulated in
two-tiered decision-making functions within a bank in general. Principle 6 in the proposed revisions to the PSMOR.

410 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
as after incidents in order to take into account lessons learned set out the internal decision-making process and define the trig­
and new threats and vulnerabilities that caused the incident. gers for invoking the bank's business continuity plan.

22. Banks should leverage change management capabilities in 27. Banks' business continuity plans for the delivery of critical
accordance with the change management processes13 under operations and critical third-party services contained in their
the overall management of operational risk as a way to assess recovery and resolution plans should be consistent with their
potential effects on the delivery of critical operations and on operational resilience approaches.
their interconnections and interdependencies.
Mapping Interconnections and
Business Continuity Planning and Testing Interdependencies
Principle 3: Banks should have business continuity plans in Principle 4: Once a bank has identified its critical operations,
place and conduct business continuity exercises under a the bank should map the internal and external interconnections
range of severe but plausible scenarios in order to test their and interdependencies that are necessary for the delivery of
ability to deliver critical operations through disruption.14 critical operations consistent with its approach to operational
resilience.
23. An effective business continuity plan should be forward-
looking when assessing the impact of potential disruptions. Busi­ 28. The respective functions should map (ie identify and document)

ness continuity exercises15 should be conducted and validated the people, technology, processes, information, facilities, and the

for a range of severe but plausible scenarios that incorporate interconnections and interdependencies among them as needed
to deliver the bank's critical operations, including those dependent
disruptive events and incidents.
upon, but not limited to, third parties or intragroup arrangements.
24. An effective business continuity plan should identify criti­
29. Banks may leverage their recovery and resolution plans, as
cal operations, and key internal and external dependencies
appropriate, for definitions of critical operations and should
to assess the risks and potential impact of various disruption
consider whether their operational resilience approaches are
scenarios on critical operations. These plans should incorporate
appropriately harmonised with the organisational mappings of
business impact analyses and recovery strategies as well as test­
critical operations and critical third-party services contained in
ing programmes, training and awareness programmes, and com­
their recovery and resolution plans.
munication and crisis management programmes.
30. The approach and level of granularity of mapping should
25. Business continuity plans should develop, implement and
be sufficient for banks to identify vulnerabilities and to support
maintain a regular business continuity exercise encompassing
testing of their ability to deliver critical operations through dis­
critical operations and their interconnections and interdependen­
ruption, as described in Principle 3, considering the bank's risk
cies, including those through relationships with, but not limited
appetite and tolerance for disruption.
to, third parties and intragroup entities. Among other business
continuity goals, business continuity exercises should support
staff's operational resilience awareness including training of staff, Third-Party Dependency Management
so that they can effectively adapt and respond to incidents.
Principle 5: Banks should manage their dependencies on
26. Business continuity plans should provide detailed guidance relationships, including those of, but not limited to, third
for implementing the bank's disaster recovery framework. These parties or intragroup entities, for the delivery of critical
plans should establish the roles and responsibilities for manag­ operations.16
ing operational disruptions and provide clear guidance regard­ 31. Banks should perform a risk assessment and due diligence
ing the succession of authority in the event of a disruption that before entering into arrangements including those of, but not
impacts key personnel. Additionally, these plans should clearly limited to, third parties or intragroup entities, consistent with
the bank's operational risk management fram ework,17 out-
sourcing/third-party risk management policy and operational
13 See Principle 7 of the PSMOR.
14 Further BCBS guidance on business continuity can be found in docu­
ments published through the Joint Forum (BCBS-IOSCO-IAIS), High- 16 Further BCBS guidance on outsourcing of services can be found in doc­
level principles for business continuity, August 2006, www.bis.org/publ/ uments published through the Joint Forum (BCBS-IOSCO-IAIS), Outsourc­
joint17.pdf. ing in financial services, February 2005, www.bis.org/publ/joint12.pdf.
15 The business continuity planning and testing of critical operations should 17 The management of dependencies articulated in this principle should
be consistent with and conducted alongside the business continuity plan­ be consistent with and conducted alongside the control and risk mitiga­
ning articulated in Principle 11 in the proposed revisions to the PSMOR. tion policies as articulated in paragraph 51 of Principle 9 in the PSMOR.

Chapter 26 Principles for Operational Resilience ■ 411

resilience approach. Prior to the bank entering into such an c. The implementation of communication plans to report inci­
arrangement, the bank should verify whether the third party, dents to both internal and external stakeholders (eg regula­
including, if relevant, the intragroup entity to these arrange­ tory authorities), including performance metrics during, and
ments, has at least equivalent level of operational resilience to analysis of lessons learned after an incident.
safeguard the bank's critical operations in both normal circum­ 35. Incident response and recovery procedures should be peri­
stances and in the event of disruption. odically reviewed, tested and updated. Banks should identify
32. Banks should develop appropriate business continuity and and address the root causes of incidents to prevent or minimise
contingency planning procedures and exit strategies to maintain serial recurrence.
their operational resilience in the event of a failure or disruption 36. Lessons learned from previous incidents including incidents
at a third party impacting the provision of critical operations.
experienced by others, should be duly reflected when updating
Scenarios under the bank's business continuity plans should the incident management programme. A bank's incident man­
assess the substitutability of third parties that provide services agement programme should manage all incidents impacting the
to the bank's critical operations, and other viable alternatives bank, including those attributable to dependencies on, but not
that may facilitate operational resilience in the event of an out­ limited to, third parties and intragroup entities.
age at a third party, such as bringing the service back in-house.

let Including Cyber Security20

Incident Management
Principle 7: Banks should ensure resilient ICT including cyber
Principle 6: Banks should develop and implement response
security that is subject to protection, detection, response
and recovery plans to manage incidents13 that could disrupt and recovery programmes that are regularly tested, incorpo­
the delivery of critical operations in line with the bank's risk rate appropriate situational awareness and convey relevant
appetite and tolerance for disruption. Banks should continu­ timely information for risk management and decision-making
ously improve their incident response and recovery plans by processes to fully support and facilitate the delivery of the
incorporating the lessons learned from previous incidents. bank's critical operations.21
33. Banks should maintain an inventory of incident response 37. Banks should have a documented ICT policy, including cyber
and recovery, internal and third-party resources to support the security, which stipulates governance and oversight require­
bank's response and recovery capabilities.
ments, risk ownership and accountability, ICT security measures
34. The scope of incident management should capture the life (eg access controls, critical information asset protection, iden­
cycle of an incident,19 typically including, but not limited to: tity management), periodic evaluation and monitoring of cyber
security controls, and incident response, as well as business con­
a. the classification of an incident's severity based on pre­
tinuity and disaster recovery plans.
defined criteria (eg expected time to return to business as
usual), enabling proper prioritisation of and assignment of 38. Banks should identify their critical information assets and the
resources to respond to an incident. infrastructure upon which they depend. Banks should also prioritise
their cyber security efforts based on their ICT risk assessment and
b. The incident response and recovery procedures, including
on the significance of the critical information assets to the bank's
their connection to the bank's business continuity, disas­
critical operations, while observing all pertinent legal and regula­
ter recovery and other associated management plans and
tory requirements relating to data protection and confidentiality.
procedures.
Banks should develop plans and implement controls to maintain
the integrity of critical information in the event of a cyber event,
18 Incidents are current or past disruptive events the occurrence of which such as secure storage and offline backup on immutable media of
would have an adverse effect on critical operations of the bank. Incident
data supporting critical operations. Banks should regularly evaluate
management is the process of identifying, analysing, rectifying and
learning from an incident and preventing recurrences or mitigating the the threat profile of their critical information assets, test for vulner­
severity thereof. The goal of incident management is to limit the disrup­ abilities and ensure their resilience to ICT-related risks.
tion and restore critical operations in line with the bank's risk tolerance
for disruption. See the Financial Stability Board's Effective Practices for
Cyber Incident Response and Recovery, October 2020, https://www. 20 Cyber security as defined in the FSB's Cyber Lexicon of November
fsb.org/wp-content/uploads/P191020-1.pdf, as an example of detailed 2018 (www.fsb.org/wp-content/uploads/P121118-1 .pdf).
response and recovery practices.
21 The management of ICT articulated in this principle should be consis­
19 Recognising that the life cycle on an incident could span multiple tent with and conducted alongside the ICT principle as articulated in para­
measures of time that could range from hours to weeks to months. graphs 55-57 of Principle 10 in the proposed revisions to the PSMOR.

412 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Striving for
Operational
Resilience
The Questions Boards
and Senior Management
Should Ask

Learning Objective
After completing this reading you should be able to:

Describe elements of an effective operational resilience

framework and its potential benefits.

E x c e rp t is u sed with perm ission o f O liver Wyman.

EXECUTIVE SUMMARY O perational resilience is the ability o f an organization
to continue to p ro vid e business se rvice s in the face o f
Operational resilience has become a key agenda item for boards adverse operational even ts by anticipating, preven tin g ,

and senior management. Increasing complexity in processes and recoverin g from , and adapting to such events.

IT, dependence on third parties, interconnectedness and data BC and DR have historically emphasized physical events (e.g.,
sharing, and sophistication of malicious actors have made dis­ natural disaster, active shooter), are limited by organizational
ruptions more likely and their impact more severe. High-profile boundaries, and are, by most organizations, primarily viewed as
examples of business and operational disruptions abound, cov­ a "check the box" exercise rather than true risk management.
ering all segments of the financial services industry.
However, several trends in financial services have sharply
Resilience is fundam entally different from traditional business increased the need for more mature operational resilience
continuity (BC) and disaster recovery (DR). These disciplines practices. Exhibit 27.1 below explores the most important
have historically been heavily focused on physical events, trends, which we expect to continue to elevate the topic to
were designed and tested in organizational silos, and are, by discussions at the top table.
most organizations, primarily viewed as a compliance exercise.
These drivers have manifested themselves in high-profile busi­
Operational resilience, instead, focuses on the adaptability to
ness and operational disruptions across the financial services
emerging threats, the dependencies and requirements for pro­
industry, both through internally-driven operational failures and
viding critical business services end-to-end (crossing organiza­
externally-driven malicious acts. These disruptions illustrate
tional silos), and the broader economic as well as firm-specific
some of the shortcomings of traditional BC and DR approaches:
impact of adverse operational events. It requires a mindset
shift in the organization away from resilience as a com pli­ • Firm have more dependencies for service delivery than ever

ance exercise to resilience as a key organizational capability before, but traditional approaches focus on assets in siloes and

that is everyone's responsibility to maintain and continuously ignore potentially critical components of end-to-end service

improve. delivery.
• In a rapidly changing environment, traditional "check the
Financial regulators have started to stipulate expectations
box" and reactive approaches focused solely on recovery
around management of resilience, resilience reporting, and
make firms much slower to adapt.
effective oversight. In response, many firms are embarking or
will need to embark on transformational programs to strengthen • By focusing on a standard set of disruption scenarios, tradi­
their resilience to disruption, incidents, and attacks across all tional approaches provide a false sense of comfort that insti­
operational resilience domains - technology, data, third parties, tutions are prepared for all scenarios.
facilities, operations, and people. In addition, boards and senior Additionally, financial firms recognize the need for greater opera­
management need to provide effective challenge of their orga­ tional excellence (efficiency and effectiveness). Organizations that
nization's resilience ambitions, program, and critical risks that manage to effectively address the combined need for operational
remain to their day-to-day operations. resilience and excellence will be able to unlock significant benefits
Achieving operational resilience is inherently challenging given across the organization (e.g., operational loss, operational cost
the increasing complexity of processes, technology infrastruc­ and complexity reduction, ability to support faster innovation
ture, and organizational silos. However, the business benefits cycles, effective investment into operational capabilities).
go beyond pure risk and compliance, often forming an inherent
part of a firm's value proposition.

This paper explores the key questions that boards and senior 27.2 BEND, BUT DON'T BREAK:
management should ask about their organization's level of OPERATIONAL RESILIENCE
operational resilience. APPROACH
Operational resilience is the ability of an organization to continue to
27.1 WHY NOW?: NEED FOR provide business services in the face of adverse operational events

OPERATIONAL RESILIENCE by anticipating, preventing, recovering from, and adapting to such

events. The fundamental principle is "bend, but don't break."

Continuity of service has always been a priority for financial Even for many advanced institutions, adopting an operational
firms. After all, disruptions can impact revenue, client experi­ resilience approach will imply significant changes from tradi­
ence, and franchise value. tional (more compliance-focused) BC and DR. Whereas these

414 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 DRIVER IM PACT ON EXPO SU RE TO DISRUPTION

Competition and customer demand are driving Increasing complexity of processes and infrastructure
SCALE AND PACE
the need for more disruptive innovations and faster required for product and service delivery, and risk of
OF INNOVATION
innovation cycles imbalance between time to market and security/resilience

Availability of new technology, customer expectations, Traditional (manual) fallback methods no longer viable,
CONTINUED and desires for efficiency are driving increasing levels and more challenging to identify the "weakest link"
DIGITIZATION of automation and faster adoption of digital delivery among connected digital systems
capabilities

Incumbent institutions rely on older technology Challenging to embed risk and resilience requirements
RELIANCE ON LEGACY infrastructure that is less flexible, requires specialized in technology, which increases the exposure
INFRASTRUCTURE knowledge to maintain, and is difficult to integrate to disruptive events
with new technologies and processes

Institutions are increasingly adopting outsourcing More difficult to gain a comprehensive view of the
EXTENSION as a business strategy, expanding their reliance on firm's third-party dependencies and exposure, as well
OF THE SUPPLY CHAIN third parties (and their third parties' third parties) as to assess the risk and resilience posture of all
relevant third parties

Financial institutions are sharing more information More likely to be affected by vulnerabilities
INTERCONNECTEDNESS
and services more broadly (partly through deliberate and disruptions in another part of the ecosystem
AND SHARING
government policy)

CONTINUED RISE IN Cyber attackers are innovating rapidly to identify new More challenging to prevent, detect, respond,
SOPHISTICATION OF means of attack and ways of exploiting firms' and recover from cyber attacks
MALICIOUS ACTORS vulnerabilities

Exhibit 27.1 D rivers of e x p o su re to d isru p tio n.

traditional approaches focus solely on recovery, operational avoiding systemic disruptions, while smaller institutions' objec­
resilience has a broader scope and needs to be integrated into tives will likely focus on maintaining shareholder value.
the risk-mitigation fabric of the organization.
Global institutions will need to pay particularly close attention to
Resilient organizations focus on anticipation, prevention and adap­ regulatory developments, as regulators in different jurisdictions
tation, rather than recovery actions once the "horse has bolted." have not yet aligned on their expectations for firms.
In addition, resilient organizations have creative ways to provide
critical business services in the event of a disruption, beyond simply
getting the technology up and running again (e.g., using branches
RECENT RESILIENCE-RELATED
to service customers at scale when digital channels might be down).
REGULATORY PUBLICATIONS
Exhibit 27.2 shows the key characteristics of an operational
resilience approach compared to most organizations' starting JU LY 2018
point - traditional BC and DR. Bank of England/Prudential Regulation Authority/Financial
Conduct Authority discussion paper, "Building the UK
Financial services regulators have begun to take note and are
financial sector's operational resilience"
beginning to focus on promoting operational resilience, versus
traditional BC and DR. The principles outlined in Exhibit 27.2 are D EC EM B ER 2018
reflected in an increasing body of regulatory consultation and European Central Bank guidance, "Cyber resilience over­
guidance papers. sight expectations for financial market infrastructures"

With the lessons from the financial crisis still fresh, regulators European Banking Authority consultation paper, "G uide­
have overlaid a "system ic" lens, prompting firms to explic­ lines on ICT and security risk management"

itly consider and measure how disruptions would impact the M ARCH 2019
broader market. At the same time, they are emphasizing that
Monetary Authority of Singapore consultation papers, "Pro­
resilience is applicable to all institutions, even if the objectives posed Revisions to Guidelines on Business Continuity Man­
for each institution might differ. For example, Financial Market agement" and "Technology Risk Management Guidelines"
Infrastructure's (FMI) resilience objectives will likely focus on

Chapter 27 Striving for Operational Resilience ■ 415

 CA TEG O RY O PERATIO N AL RESILIEN CE APPROACH TRADITIONAL APPROACH (BC/DR)

• Clearly defined accountability • Role of board and senior management limited

of board and senior management to post-event response

• Resilience incorporated into risk appetite • Resilience not an explicit consideration in risk
statements and metrics across operational appetite statements and metrics
risk types
• "Com pliance-type" update on exercises
• Comprehensive and actionable reporting
to drive continuous improvement

• Critical business services end-to-end • Individual business units or specific

(ignoring organizational silos) technology assets

• Broader economic impact of disruption, • Firm-specific impact of disruption

in addition to firm-specific impact

• Comprehensive view of dependencies of • View of dependencies in most cases limited

critical business service on organizational to the business unit or directly linked
assets (systems, data, third parties, technology assets
facilities, processes, and people)
• Continuity and recovery capabilities bolted
• Resilience considerations embedded on to satisfy requirements
in the upfront design of business services
and organizational assets

• Business disruption scenarios tailored to • Standard business disruption scenarios

each critical service based on an aligned across business units
and forward-looking risk assessment
• Standard tolerances for business disruption
• Tolerances for business disruption (impact (recovery time/point objectives) for all
tolerances) based on bespoke scenarios scenarios

• Single incident response regime (unified • Distinct incident response regimes

incident command) for all incident types for different incident types, which may
negatively impact response times
• Plans and capabilities monitored, tested,
and adapted continuously • Plans and capabilities tested infrequently
(e.g., annually)
• Emphasis on building trust among crisis
management team to enable effective • Little attention paid to dynamics
response of crisis management team

Exhibit 27.2 K e y ch a ra cte ristics of o p eratio n al resilien ce.

416 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
27.3 HAS THE ORGANIZATION GOT senior management, and getting resilience right for one critical
service before expanding the program.
IT?: IMPORTANT QUESTIONS TO ASK
ABOUT OPERATIONAL RESILIENCE Exhibit 27.4 lays out an approach to establishing an effective
operational resilience program that allows the organization to

Achieving operational resilience is inherently challenging and enhance its capabilities without being overwhelmed by the scale

complex: of the effort.

• It requires organizations to understand how all domains (tech­ Organizations that manage to establish effective operational

nology, data, third parties, facilities, operations, and people) resilience programs will be able to realize the benefits of better

impact critical service delivery and to build a consistent set of resilience as well as related business benefits:

resilience capabilities and controls across these domains. • Reduce and optimize their risk exposure, with improved vis­
• It depends on cross-functional, specialized expertise to evalu­ ibility into their risks, better monitoring, a more proactive
ate and measure the resilience of the organization in light of approach to controls, and ability to deliver services even
the specific risks it faces. when things go wrong.

• It relies on extensive coordination, collaboration, and prepara­ • Better focus the organization and drive investment towards
tion to ensure that the organization appropriately considers the most important areas, based on a prioritization of their
resilience in all activities and is ready when the worst happens. critical business services.

Given the complexity of the topic, it is difficult for boards and • Be able to support the innovation agenda of the business

senior management to assess the current level of operational and enable faster innovation cycles without compromising on

resilience and determine whether the organization is making risk management by ensuring the organization is adaptable

resilience investments in the right areas. and considers resilience up front.

• Be more effective and efficient, leveraging a clear under­
W hat questions should boards and senior m anagem ent
standing of critical service delivery to reduce costs
b e asking to provide meaningful challenge and oversight?
(e .g ., optim ize outsourcing relationships), stream line
We believe that boards and senior management should focus on processes (e .g ., introduce tools and autom ation), and
understanding the risk levels of their firms, assessing their firms' enhance efficacy (e .g ., identify and rem ediate steps that
readiness for disruptive scenarios, and gaining comfort that their introduce errors).
firms have a robust approach to resilience. Boards and senior
However, building an effective program is not easy. It will
management should also demand a minimum level of data to
require new skillsets; closer integration and alignment of risk,
support ongoing oversight of risk levels and the progress made
IT, and the business; a cultural shift away from "operational
along the resilience journey.
resilience is IT's responsibility" to "operational resilience is
Exhibit 27.3 contains a list of key questions on resilience that everyone's responsibility;" and fundamental changes to how the
boards and senior management should ask their management organization operates.
teams.
Boards and senior m anagem ent can help their organizations
If the answers to these questions are unsatisfactory, it could signal overcom e these challenges. They can encourage the right
that the organization needs to increase focus on resilience. In this level of investm ent, drive a "tone from the top" to break
case, boards and senior management should request that their siloes and change culture, and set clear expectations for
organizations establish a formal maturity baseline and refocus exist­ progress.
ing initiatives or launch a new program to uplift their resilience.
Ultimately, by asking the right questions and demanding
accountability when the answers are unsatisfactory, boards and
senior management can play a pivotal role in enabling their
27.4 IMPROVING RESILIENCE: organizations to achieve resilience. With the growing com plex­
GETTING STARTED ity in financial services, it is incumbent on every organization
to take resilience seriously, and it is incumbent on boards and
For firms needing to launch or reset their programs, we recom­ senior management to make sure their organization's resilience
mend starting small, providing transparency to the boards and program is on track.

Chapter 27 Striving for Operational Resilience ■ 417

 □ What is our risk appetite for resilience risk?

I I □ What KRIs and KPIs provide us with a comprehensive view of our

maturity and uplift program?

G O V ERN A N C E □ Who is accountable in the 1st and 2 n<^ lines of defense for managing,
monitoring, and reporting on resilience?

□ Does the organization understand the dependencies of critical

business services on organizational assets?
□ What are our most critical assets that impact service delivery?

O RG A N IZA TIO N A L □ How does our approach to resilience change the way we manage
FO CUS operations, technology, and third parties?

□ What is our measure of criticality?

\ □ What are our critical business services and why?
>
V
□ How are we leveraging existing definitions of criticality and critical
business services (e.g., from resolution planning)?
IN TEGRATIO N
□ What is our impact on customers and the financial system?

□ What are the most important resilience risks for the organization?

□ How do we monitor and manage the level of resilience of the

organization?
M EASU REM EN T □ How is risk appetite reflected in our impact tolerances?

□ In which scenarios are we outside of our defined impact tolerances?

------------
□ How do we make sure we are effectively prepared for different
disruption events?

□ How frequently are we testing our response and recovery capabilities

PREPARED N ESS for different disruptive scenarios?

Exhibit 27.3 R esilien ce q u e stio n s fo r b o ard s and sen io r m an ag em en t.

418 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • Assign accountability and develop an operating model for resilience

• Conduct a resilience maturity assessment to establish a baseline

of the organization's capabilities

• Articulate the organization's critical business services

• Define the target resilience maturity ambition for the organization

• Identify an initial set of metrics (including resilience program metrics)

to provide ongoing reporting to the board

• Run a pilot on one critical service to enhance resilience:

- Identify key dependencies and assess risks
- Define impact tolerances and evaluate resilience through scenarios
- Craft an improvement roadmap

• Identify key learnings and program enhancements to facilitate

the rollout of the program more broadly

• Establish the program to drive resilience improvements based on

lessons learned from the pilot and identified areas of enhancement

• Expand the program to enhance capabilities and roll out a resilience

approach across the remaining critical services
Exhibit 27.4 K e y ste p s for estab lish in g an effective o p eratio n al resilien ce program .

Chapter 27 Striving for Operational Resilience ■ 419

Arbib, M. A. (Ed.) (1995), The Handbook of Brain Theory and Neural Basel Committee on Banking Supervision (2000a), Range of Practice in
Networks, The MIT Press. Banks' Internal Ratings Systems, Discussion paper, Basel, Switzerland.
Adelson, M., and Goldberg, M. (2009), On the Use of Models by Basel Committee on Banking Supervision (2000b), Credit Ratings and
Standard & Poor's Ratings Services, www.standardandpoors.com Complementary Sources of Credit Quality Information, Working
(accessed February 2010). Papers 3, Basel, Switzerland.
Akhavein, J., Frame, W. S., and White, L. J. (2001), The Diffusion of Basel Committee on Banking Supervision (2004 and 2006), International
Financial Innovations: An Examination of the Adoption of Small Busi­ Convergence of Capital Measurement and Capital Standards. A
ness Credit Scoring by Large Banking Organization, The Wharton Revised Framework, Basel, Switzerland.
Financial Institution Center, Philadelphia, USA. Basel Committee on Banking Supervision (2005a), Studies on Validation
Albareto, G., Benvenuti, M., Moretti, S. eta/. (2008), L'organizzazione of Internal Rating Systems, Working Papers 14, Basel, Switzerland.
dell'attivita creditizia e I'utilizzo di tecniche di scoring nel sistema Basel Committee on Banking Supervision (2005b), Validation of Low-
bancario italiano: risultati di un'indagine campionaria, Banca d'ltalia, default Portfolios in the Basel IT Framework, Newsletter 6, Basel,
Questioni e Economia e Finanza, 12. Switzerland.
Altman, E. I. (1968), Financial Ratios, Discriminant Analysis and Predic­ Basel Committee on Banking Supervision (2006), The IRB Use Test:
tion of Corporate Bankruptcy, Journal o f Finance, 23 (4). Background and Implementation, Newsletter 9, Basel, Switzerland.
Altman, E. I. (1989), Measuring Corporate Bond Mortality and Perfor­ Basel Committee on Banking Supervision (2008), Range of Practices and
mance, Journal of Finance, XLIV (4). Issues in Economic Capital Modeling, Consultative Document, Basel,
Altman, E. I., and Saunders, A. (1998), Credit risk measurement: Devel­ Switzerland.
opments over the last 20 years, Journal o f Banking and Finance, 21. Basel Committee on Banking Supervision (2009), Strengthening the
Altman, E., Haldeman, R., and Narayanan P. (1977), Zeta Analysis: a New Resilience of the Banking Sector, Consultative Document, Basel,
Model to Identify Bankruptcy Risk of Corporation, Journal of Banking Switzerland.
and Finance, 1. Basilevsky, A. T. (1994), Statistical Factor Analysis and Related Methods:
Altman, E. I., Resti, A., and Sironi A. (2005), Recovery Risk, Riskbooks. Theory and Applications, John Wiley & Sons Ltd.
Bank of Italy (2002), Annual Report 2001, Rome. Beaver, W. (1966), Financial Ratios as Predictor of Failure, Journal of
Bank of Italy (2006), New Regulations for the Prudential Supervision of Accounting Research, 4.
Banks, Circular 263, www.bancaditalia.it (accessed February 2010). Berger, A. N., and Udell, L. F. (2001), Small Business Credit Availability and
Baron, D., and Besanko, D. (2001), Strategy, Organization and Incen­ Relationship Lending: the Importance of Bank Organizational Structure,
tives: Global Corporate Banking at Citibank, Industrial and Corporate US Federal Reserve System Working Papers, Washington, DC, USA.
Change, 10 (1). Berger, A. N., and Udell, L. F. (2006), A more complete conceptual
Basel Committee on Banking Supervision (1999a), Credit Risk Modelling: framework for SME Finance, Journal o f Banking, 30.
Current Practices and Applications, Basel, Switzerland. Berger, A. N., Frame, W. S., and Miller, N. H. (2002), Credit Scoring and
Basel Committee on Banking Supervision (1999b), Principles for the the Availability, Price and Risk of Small Business Credit, US Federal
Management of Credit Risk, Basel, Switzerland. Reserve System Working Papers, Washington, DC, USA.

421
Berger A. N., Klapper, L. F.( and Udell, G. F. (2001), The Ability of Banks De Servigny, A., Varetto, F., Salinas, E. et al. (2004), Credit Risk Tracker
to Lend to Informationally Opaque Small Businesses, US Federal Italy, Technical Documentation, www.standardandpoors.com
Reserve System Working Papers, Washington, DC, USA. (accessed February 2010).
Berger, A. N., Miller, N. H., and Petersen, M. A. (2002), Does Function DeYoung, R., Hunter, W. C., and Udell, G. F. (2003), The Past Present and
Follow Organizational Form? Evidence from the Lending Practices of Probable Future for Community Banks, Working Paper 14, Federal
Large and Small Banks, US National Bureau of Economic Research Reserve Bank of Chicago, USA.
Working Papers, 8752, Cambridge, MA, USA. Diamond, D. (1984), Financial Intermediation and Delegated Monitoring,
Blochwitz, S., and Eigermann, J. (2000). Unternehmensbeurteilung The Review o f Economic Studies, 51 (3).
durch Diskriminanzanalyse mit qualitativen Merkmalen, Zeitschrift fur Draghi, M. (2008), A System with More Rules, More Capital, Less Debt
betriebswirtschaftliche Forschung. and More Transparency, Sixth Committee of the Italian Senate, Fact­
Bohn, J. R. (2006), Structural Modeling in Practice, White Paper, finding Inquiry into the International Financial Crisis and Its Effects
Moody's KMV. on the Italian Economy, Rome, http://www.bancaditalia.it (accessed
Boot, A. W. (2000), Relationship Banking: What Do We Know? Journal of February 2010).
Financial Intermediation, 9. Draghi, M. (2009), Address by the Governor of the Bank of Italy, Annual
Boot, A. W., and Thakor, A. V. (2000), Can Relationship Banking Survive Meeting of the Italian Banking Association, 8 July 2009, Rome, http://
Competition? The Journal o f Finance, 55. www.bancaditalia.it (accessed February 2010).
Brunetti, G., Coda, Y., and Favotto, F. (1984), Analisi, previsioni, simu- Dwyer, D. W., Kocagil, A. E., and Stein, R. M. (2004), Moody's KMV
lazioni economico-finanziarie d'impresa, Etas Libri. Riskcalc™ v3.1 Model, Technical Document, http://www.moodyskmv
Brunner, A., Krahnen, J. P., and Weber, M. (2000), Information ,com/research/files/wp/RiskCalc_v3_1 _Model.pdf (accessed February
Production in Credit Relationships: on the Role of Internal Ratings in 2010 ).
Commercial Banking, Working Paper 10, Center for Financial Studies Ely, D. P., and Robinson, K. J. (2001), Consolidation, Technology and
of University of Frankfurt, Germany. the Changing Structure of Banks' Small Business Lending, Federal
Burroni, M., Quagliariello, M., Sabatini, E., and Tola, V. (2009), Dynamic Reserve Bank of Dallas Economic and Financial Review, First Quarter.
Provisioning: Rationale, Functioning, and Prudential Treatment, Engelmann, B., and Rauhmeier, R. (Eds.) (2006), The Basel II Risk Param­
Questioni di Economia e Finanza, 57, Bank of Italy. eters, Springer.
Buzzell, R. D. (2004), The PIMS Program of Strategy Research: A Retro­ Fisher, R. A. (1936), The Use of Multiple Measurements in Taxonomic
spective Appraisal, Journal of Business Research, 57 (5). Problems, Annals of Eugenics, 7.
Buzzell, R. D., and Gale, B. T. (1987), The PIMS principles, The Free Finger, C. (2009a), IRC Comments, RiskMetrics Group, Research Monthly
Press. (February).
Cangemi, B., De Servigny, A., and Friedman, C. (2003), Credit Risk Finger, C. (2009b), VAR is from Mars, Capital is from Venus, Risk-Metrics
Tracker for Private Firms, Technical Document, Standard & Poor's. Group, Research Monthly (April).
Committee of European Banking Supervisors (2005), Guidelines on the Frame, W. S., Srinivasan, A., and Woosley, L. (2001), The Effect of Credit
Implementation, Validation and Assessment of Advanced Measure­ Scoring on Small Business Lending, Journal of Money Credit and
ment (AMA) and Internal Ratings Based (IRB) Approaches. Banking, 33.
Christodoulakis, G., and Satchell, S. (2008), The Analytics of Risk Ganguin, B., and Bilardello, J. (2005), Fundamentals of Corporate Credit
Validation, Elsevier. Analysis, McGraw-Hill.
De Laurentis, G. (1993), II rischio di credito, Egea. Giri, N. C. (2004), Multivariate Statistical Analysis: Revised and
De Laurentis, G. (2001), Rating interni e credit risk management, Expanded, CRC Press.
Bancaria Editrice. Grassini, L. (2007), Corso di Statistica Aziendale, Appunti sull'analisi
De Laurentis, G. (Ed.) (2005), Strategy and Organization of Corporate statistica dei bilanci, http://www.ds.unifi.it/grassini/laura/Pistoia1/
Banking, Springer. indexEAPT2007_08.htm (accessed February 2010).
De Laurentis, G., and Gabbi, G. (2010), The Model Risk in Credit Golder, P. A., and Yeomans, K. A. (1982), The Guttman-Kaiser Criterion as
Risk Management Processes, in Model Risk Evaluation Handbook a Predictor of the Number of Common Factors, The Statistician, 31 (3).
(eds. G. N. Gregoriu, C. Hoppe, and C. S. Wehn), McGraw-Hill. Gupton, G. M., Finger, C. C., and Bhatia, M. (1997), Credit Metrics, Tech­
De Laurentis, G., and Gandolfi, G. (Eds.) (2008), II gestore imprese, nical Document, Working Paper, JP Morgan, http://www.riskmetrics
Bancaria Editrice. .com/publications/techdocs/cmtdovv.html (accessed February 2010).
De Laurentis, G., Saita, F., and Sironi, A. (Eds.) (2004), Rating interni e IASB (2009), Basis for Conclusions on Exposure Draft, Financial Instru­
controllo del rischio di credito, Bancaria Editrice. ments: Amortized Cost and Impairment, 6 November 2009.
De Lerma, M., Gabbi, G., and Matthias, M. (2007), CART Analysis of Ito, K. (1951), On Stochastic Differential Equations, American Mathematical
Qualitative Variables to Improve Credit Rating Processes, http://www Society, 4.
.greta.it/credit/credit2006/poster/7_Gabbi_Matthias_DeLerma.pdf Jackson, P., and Perraudin, W. (1999), Regulatory Implications of Credit
(accessed February 2010). Risk Modelling, Credit Risk Modelling and the Regulatory Implica­
De Servigny, A., and Renault, O. (2004), Measuring and Managing tions Conference (June 1999), Bank of England and Financial Services
Credit Risk, McGraw-Hill. Authority, London.

422 ■ Bibliography
Landau, S.( and Everitt, B. (2004), A handbook of statistical analyses Sharpe, W. (1964), Capital Asset Prices: a Theory of Market Equilibrium
using SPSS-PASW, CRC Press. under Conditions of Risk, Journal o f Finance, 19.
Loehlin, J. C. (2003), Latent Variable Models—An Introduction to Factor, Sobehart, J. R., Keenan, S. C., and Stein, R. M. (2000), Validation
Path, and Structural Equation Analysis, Lawrence Erlbaum Associates. Methodologies for Default Risk Models, Algo Research Quarterly, 4
Lopez, J., and Saidenberg, M. (2000), Evaluating credit risk models, (1/2) (March/June).
Journal of Banking and Finance, 24. Standard & Poor's (1998), Corporate Ratings Criteria, http://www
Lyn, T. (2009), Consumer Credit Models—Pricing, Profit and Portfolios, .standardandpoors.com.
Oxford Scholarship Online. Standard & Poor's (2008), Corporate Ratings Criteria, http://www
Maino, R., and Masera, R. (2003), Medium Sized Firm and Local .standardandpoors.com.
Productive Systems in a Basel 2 Perspective, in Industrial Districts Standard & Poor's (2009), Default, Transition, and Recovery: 2008
and Firms: The Challenge of Globalization, Modena University, Italy, Annual Global Corporate Default Study and Rating Transitions.
Proceedings, http://www.economia.unimore.it/convegni_seminari/ Standard & Poor's (2009a), Annual Global Corporate Default Study and
CG_sept03/papers.html (accessed February 2010). Rating Transitions, http://www.standardandpoors.com.
Maino, R., and Masera, R. (2005), Impresa, finanza, mercato. La gestione Standard & Poor's (2009b), Global Structured Finance Default and
integrata del rischio, EGEA. Transition Study 1978-2008: Credit Quality of Global Structured
Masera, R. (2001) II Rischio e le Banche, Edizioni II Sole 24 Ore, Milano. Securities Fell Sharply in 2008 Amid Capital Market Turmoil, http://
Masera, R. (2005), Rischio, Banche, Imprese, i nuovi standard di Basilea, www.standardandpoors.com.
Edizioni II Sole 24 Ore. Standard & Poor's (2009c), Guide to Credit Rating Essentials, 21 August
Masera, R., and Mazzoni, G. (2006), Una nota sulle attivita di Risk e 2009, http://www.standardandpoors.com.
Capital Management di un intermediario bancario, Ente Luigi Einaudi, Steeb, W. H. (2008), The Nonlinear Workbook: Chaos, Fractals, Neural
Quaderni, 62. Networks, Genetic Algorithms, Gene Expression Programming,
Merton, R., (1974), On the Pricing of Corporate Debt: the Risk Structure Support Vector Machine, Wavelets, Hidden Markov Models, Fuzzy
of Interest Rates, Journal of Finance, 29. Logic with C++, Java and Symbolic C++ Programs: 4th edition, World
Modigliani, F., and Miller, M. H. (1958), The Cost of Capital, Corporation Scientific Publishing.
Finance and the Theory of Investment, American Economic Review, 48. Stevens, J. (2002), Applied Multivariate Statistics for the Social Sciences,
Moody's Investor Services (2000), Benchmarking Quantitative Default Lawrence Erlbaum Associates.
Risk Models: a Validation Methodology (March). Tan; P.-N., Steinbach, M., and Kumar, V. (2006), Introduction to Data
Moody's Investor Service (2007), Bank Loan Recoveries and the Role Mining, Addison-Wesley.
That Covenants Play: What Really Matters? Special Comment (July). Tarashev, N. A. (2005), An Empirical Evaluation of Structural Credit
Moody's Investor Service (2008), Corporate Default and Recovery Rates Risk Models, Working Papers No. 179, BIS Monetary and Economic
1920-2007 (February). Department, Basel, Switzerland.
Nixon, R. (2006), Study Predicts Foreclosure for 1 in 5 Subprime Loans, Thompson, M., and Krull, S. (2009), In the S&P 1500 Investment-Grade
NY Times (20 December 2006). Stocks Offer Higher Returns over the Long Term, Standard and Poor's
OeNB and FMA (2004), Rating Models and Validation, Oesterreichische Market Credit and Risk Strategies (June), http://www.standardandpoors
Nationalbank and Austrian Financial Market Authority. .com.
Petersen, M. A., and Rajan, R. G. (1994), The Benefits of Lending Rela­ Thurstone, L. L. (1947), Multiple Factor Analysis, University of Chicago
tionships: Evidence from Small Business Data, Journal of Finance, 49. Press, Chicago.
Petersen, M. A., and Rajan, R. G. (2002), Does Distance Still Matter? The Treacy, W. F., and Carey, M. S. (1998), Credit Risk Rating at Large U.S.
Information Revolution in Small Business Lending, Journal of Finance, Banks, US Federal Reserve Bulletin (November).
57 (6). Treacy, W. F., and Carey, M. S. (2000), Credit Risk Rating Systems at
Pluto, K., and Tasche, D. (2004), Estimating Probabilities of Default on Large U.S. Banks, Journal of Banking and Finance, 24.
Low Default Portfolios, Deutsche Bundesbank Publication (December). Tukey, J. W. (1977), Exploratory Data Analysis, Addison-Wesley.
Porter, M. (1980), Competitive Strategy, Free Press. Udell, G. F. (1989), Loan Quality Commercial Loan Review and Loan
Porter, M. (1985), Competitive Advantage: Creating and Sustaining Officer Contracting, Journal of Banking and Finance, 13.
Superior Performance, Free Press. Vasicek, O. A. (1984), Credit Valuation, White Paper, Moody's KMV
Rajan, R. G. (1992), Insiders and Outsiders: the Choice Between Rela­ (March).
tionship and Arms Length Debt, Journal of Finance, 47. Wehrspohn, U. (2004), Optimal Simultaneous Validation Tests of Default
Resti, A., and Sironi, A. (2007), Risk Management and Shareholders' Probabilities Dependencies and Credit Risk Models, http://ssrn.com/
Value in Banking, John Wiley & Sons Ltd. abstract=591961 (accessed February 2010).
Saita, F. (2007), Value at risk and bank capital management, Elsevier. Wilcox, J. W. (1971), A Gambler's Ruin Prediction of Business Failure
Schwizer, P. (2005), Organizational Structures, in Strategy and Organiza­ Using Accounting Data, Sloan Management Review, 12 (3).
tion of Corporate Banking (Ed. G. De Laurentis), Springer.

Bibliography ■ 423
A anchoring bias, 130
ancillary processes, 228
Aas, K.f 215
Ang, A., 234
absolute risk measurement, 206
Anti-Kickback Statute, 156
ABX index, 182
anti-money laundering (AML), 154
acceptance, of rating systems, 165-166
supervisory activity, 292
accounting performance vs. economic value, 23-24
anxiety bias, 130
accounting problem, 24
Applied Science and Technology Research Institute (ASTRI), 369
accuracy, data quality, 156
arbitrage, convertible bonds and, 181
accuracy indexes, for validation, 169
asset-liability management (ALM), 264
Acharya, V. V., 275, 279
asset management, OpRisk data, 133-134
acquisition/divestiture analysis, 203
assets under management (AUM), 133
adaptive response, in cyber resilience, 353
Association of Certified Fraud Examiners Report to the Nation
add-on factor, 228
(2006), 155
advanced IRB (A-IRB) approach, 333
asymmetries distribution, 26
advanced measurement approach (AMA), 119, 315, 316, 335
asymptomatic single-risk-factor (ASRF) model, 221, 222
for loss estimation, 255
asymptotic single risk factor model, 312
advanced persistent threat (APT), 355
at the margin, 22
adverse price movements, 121
audit, of third parties, 383
after the fact, 27
Australian crisis, 84
aggregate risk capital, 191
Australian Prudential Regulation Authority (APRA), 84, 98,
aggregating risks, 24-25
365, 366
aggregation. See also risk aggregation
auto lending, 275
challenges, 227
Autorite de Controle Prudentiel et de Resolution (ACPR), 370
of projections, 264-265
availability bias, 129
of risk measure, 210
available capital, 203, 207
AIG, 299
available-for-sale (AFS) securities, 254-255
Allen, L., 275
available stable funding (ASF), 325
Alliant Credit Union, 34
AXA Rosenberg Group LLC, 176
allowance for loan and lease losses (ALLL), 264
American Air Force, 130
American Axle Co., 180 B
amortised cost, 345 back-testing, 147-148, 170-173, 219, 229
analytic monitoring, in cyber resilience, 353 backward-looking indicators, of resilience, 372-373

425
balance sheet, 263-264 innovations of, 311
liability side of, 232 operational risk capital, 315
modeling, 276-277 Pillar 2, 311, 312
Bangia, A., 224, 272 Pillar 3, 311, 312
Bankers Trust, 186 regulation, 124, 162, 166
bank exposures, 314 validation principles, 217
bank holding companies (BHCs), 238-240 Basel II.5, 320-321
documenting decisions, 245 Basel II Accords, 154-155
internal capital planning (See capital planning) Basel III, 321
internal control framework, 241 capital conservation buffer, 323-325
policies and procedures, 242-243 capital, definition of, 322
scenario design, 247-248 CVA risk framework, 325, 334-335
banking book finalising post-crisis reforms, 339-346
formal stress testing, 272 internal ratings-based (IRB) approach, 325-326, 333-334
interest rate risk in, 198, 200, 229-235 leverage ratio, 323, 335-336
optionality in, 231-232 liquidity risks, 325-326
vs. trading book, 235 operational risk framework, 326, 335
banking conduct and culture output floor, 336-337
assessment of industry progress, 88-99 post-crisis reforms, 324
effective three lines of defense, 96-97 standardised approach for credit risk, 325, 330-333
holding managers accountable, 99 transitional arrangements, 337-338
investor view, 93 basic indicator approach (BIA), 315
mindset of, 90-91 basis risk, 178
performance management and incentives, 93-94 Bear Stearns, 268
regulators, supervisors, enforcement authorities, and industry benchmarking, 170-173, 219
standards, 97-99 benchmark models, 147, 254
senior accountability and governance, 91-93 Berkowitz, J., 272
skills and capabilities required of regulators, 105 bias, in scenario analysis, 129
staff development and promotions, 94-96 bid-ask spread, 231
training for lasting behavioral change, 106 bilateral clearing, 296, 298
Banking Executive Accountability Regime (BEAR), 84, 98 bilateral cyber-security information-sharing, 377
Banking Standards Board (BSB), 99, 106, 113 binomial test, 170
Banking Supervisory Requirements for IT (BAIT), 366 BIS, 192, 272
Bank of England, 306, 307, 325, 369, 386 Black, F., 230
bankruptcy, 21, 302-303 Black-Scholes biases/model, 176
Bank Secrecy Act (BSA), 154, 289, 292 board and management engagement, 74
banks' pricing behaviour, 232-233 board of director (BOD), 6-7
banks share information, 375 capital planning and, 243-244
Banziger, Hugo, 34 in cyber-security, 367
Barings Bank, 315 governance, 6-8
Basel Accord, 128, 306 recommendations for, 57-59
Basel Committee, 216 responsibilities regarding service providers, 284
interest rate risk, principles for, 233 risk management, 149
Principle 16, 229 board reporting, 244
validation principles, 217 board responsibilities
Basel Committee on Banking Supervision (BCBS), 140, 162, 212, 306, governance, 401
307, 393 interaction with other, 404
base-level metrics, 158 Board to Banker, 67
Basel I, 306-311 bootstrap procedures, 169
goal of, 307 bottom-up process, 52, 58
risk-based capital ratio, 307-311 Boudoukh, J., 275
Basel II, 196 Brace, A., 230
credit risk capital, 312-314 Breuer, T. M., 212
event type, 119-121 broker-dealers risk, 134

426 ■ Index
Buehler, Kevin, 34 capital conservation buffer (CCB), 323-325
burned-out capital, 187 capital management
business continuity (BC), 412, 414 decisions, 185
operational resilience and, 406, 411 process, 194
planning, 13-14 Capital Management Policy, 71
of service providers, 289 capital planning, 238-239
and testing, 411 assessing capital adequacy impact, 263-265
business cycle, 193 BHC scenario design, 247-248
business disruption and system failures (BDSF), 121-122 capital policy, 245-247
business environment and internal control environment factors (BEICFs), estimation methodologies for losses, revenues, and expenses,
125-128 248-263
key risk indicators (KRIs), 127 foundational risk management, 240-241
risk control self-assessment (RCSA), 126-127 governance, 243-245
business impact assessment (BIA), 382 internal controls, 241-243
business impacts, of data quality, 154-155 Capital Plan Rule, 238, 239, 244, 247
business impact view, 159 capital policy, 245-247
business indicator (Bl), 335, 340, 341 contingency plan, 246-247
business indicator component (BIC), 325, 335, 340, 344-345 goals and targets, 246
business-level use, of economic capital, 201-202 weak, 246
business line management, 136 capital requirements, 98
business performance captive finance, 180
enterprise risk management (ERM), 32-33 capture the flag, 350
business planning process, 51-54 cash flow mappings, 178
business process mappings, 8 cash flows, 24, 178
business process view, 159 catastrophe bonds, 33
business resumption, service provider contracts and, 288 catastrophe exposure, 156
business risk, 211 CDS indexes, 178
business services CDX.NA.IG, 178
definitions, 387-388 Central Bank of Ireland, 269
disruption to multiple, 389 central banks, 306
group, 402-403 central clearing, 296-298
important, 394-395 central counterparty (CCP), 296, 301
internal services, 387 and bankruptcy, 302-303
business unit (BU), 3, 43, 48, 49, 51 defined, 296
in OTC markets, 297
central risk function, 135-136
C challenger models, 242
calibration, quantitative validation, 170 change-control processes, 205
Campa, J. M., 233 charge-off models, 252, 254
Canabarro, E., 275 chief information officer (CIO), 368
capital chief information security officers (CISO), 368
for credit risk, 312-314 chief risk officer (CRO), 16, 28, 33-34, 368
definition of, 322 China Banking Regulatory Commission (CBRC), 98
for market risk, 310-311 chi-square test, 170
for operational risk, 315 Chrysler, 180
Tier 1 and Tier 2, 307 Citigroup, 91
capital adequacy assessment, 198-199, 204, 263-265 classification tests, for validation, 169
capital adequacy process (CAP), 238 clearing houses, 297
principles of, 239 ClearPort, 297, 303
capital asset pricing model (CAPM), 186 clients, products and business practices (CPBP) risk, 120-121
Capital Assistance Program (CAP), 269 CLO, 179
capital budgeting, 194, 203 closeout horizon, 228
decision rule, 190-191 cloud service providers (CSPs), 380
risk-adjusted return on capital (RAROC), 187-188 regulatory cloud summits, 380

Index ■ 427
cloud services, 359 confidentiality
CMBS, 182 of information for third-party interactions, 383-384
CMBX, 182 service provider contracts and, 286-287
CME Group, 297 conservatism, 250
Cochrane, J. H., 234 consistency
Coherent Stress Testing (Rebonato), 273 data quality, 156-157
Cole, Eric Dr., 354 rating systems, 166
collection threshold, 123-124 Consumer Financial Protection Bureau (CFPB), 98, 328
Collins and Aikman, 180 consumer loans, 231
commercial banking, 61 contagion approach, 221
commercial real estate (CRE), 332 context bias, 130
Commission de Surveillance du Secteur Financier (CSSF), 380 contingency considerations, of service providers, 289
committee composition, 8 contingency plan
Committee of European Banking Supervisors (CEBS), 269, capital, 246-247
270, 380 service provider contracts and, 288
Committee on Global Financial Stability (CGFS), 233, 272 contingent convertible bonds (CoCos), 326-327
Committee on Market Best Practices (CMBP), 40 contraction risk, 231
Committee on Payments and Market Infrastructures control and mitigation
(CPMI), 364 risk management environment, 11-12
committee operation, 8 Control Objectives for Information and Related Technologies
committee structure, 8 (COBIT), 365
Common Equity Tier 1 (CET1) capital, 330 convertible bonds, 178
common risk currency, 211 Cooke ratios, 307
Commonwealth Bank of Australia (CBA) Group, 41, 73-77 coordinated defense, in cyber resilience, 353
comparative advantage in risk-bearing, 17 copulas, 197, 213, 214, 222
comparative analysis, 9 core risk level, 189
compensation, service provider contracts and, 286 core risks, 16, 189
completeness corporate culture, 108-110
of databases, 124 corporate exposures, 314
of data quality, 156 corporate finance, 131
of rating systems, 165 corporate governance, enterprise risk management
complex metric, 158 (ERM), 35
compliance risk, 241 corporate operational risk management function (CORF), 3
data quality, 154, 156 corporate risk manager, 16
compliance risks, 284 corporate treasury, 16
comprehensive approach, 312 correspondent banking, 293-294
Comprehensive Capital Analysis and Review (CCAR), 95, 238, costs, service provider contracts and, 286
239, 327 Council for Registered Ethical Security Testers (CREST),
comprehensive risk measure, 321 354, 369
comprehensive validation countercyclical capital buffer (CCyB), 323, 324
evaluation of, 145-146 counterparties
ongoing monitoring, 146-147 credit risk engines, 228
outcomes analysis, 147-148 defaults of, 259
computer emergency readiness team (CERT), 378 high risk, 228
Computer Incident Response Center (CIRCL), 378 margined vs. non-margined, 227
computer security incident response teams (CSIRTs), 378 counterparty credit exposure, 225
concentration risk, 284, 379 measurement, 226
identification, 228 range of practices, 227-229
conduct, defined, 80 counterparty credit risk (CCR), 198, 199, 275
confidence-based impacts, data quality, 154 ancillary processes and, 228
confidence level challenges, 225-227
risk-adjusted return on capital (RAROC), 190 market risk and, 257-258
risk aggregation and, 212 model validation, 229
risk measures and, 209 operational-risk-related challenges, 226-227

428 ■ Index
country risks, 284 cyber-resilience
CPMI-IOSCO guidance, 371,380, 382 adaptation to changing conditions, 349
credit conversion factors, 309 business continuity planning and staff engagement, 349-350
credit equivalent amount, 309, 310 challenge of, 351
credit loan loss-estimation approaches, 252 communication and sharing of information, 373-378
CreditMetrics, 189, 221, 273 defined, 364
credit portfolio management, 201 gamification, 350
credit portfolio models, supervisory concerns relating to, 223-224 incident response planning, 353-354
credit risk, 25 and independent assurance, 370-371
assessment, 155 information security controls testing, 370-371
capital for, 312-314 interconnections with third parties, 379-384
copulas and, 222 negative attributes, 352
counterparty, 198, 199, 225-229 nudging behavior, 350
data quality, 155-156 objectives, 352-353
dependency modelling, 197, 197, 220-224 organization, attributes of, 351-353
interest rate risk and, 234-235 positive attributes, 352
internal ratings-based (IRB) approach for, 333-334 real-time crisis management, 348-349
and market risk, 226 response and recovery testing and exercising, 371-372
price of, 233 risk awareness in staff, 349
retail and wholesale, 251 risk management framework, 348
risk aggregation, 211 safety management, 350-351
standardised approach for, 330-333 security solutions, 354-357
CreditRisk+, 221, 222, 273 standards, 349
credit substitution approach, 315 standards and guidelines, 365, 366
credit support annex (CSA), 227, 298 supervising methods, 370
credit valuation adjustment (CVA), 258, 275, 325, 326, threat detection, 354-355
334-335 training programs, 349
CREST Certified Simulated Attack Manager (CCSAM), 369 cyber-risk controls, taxonomy of, 371
CREST Certified Simulated Attack Specialist (CCSAS), 369 cyber-security, 348, 412
CREST Certified Threat Intelligence Manager (CCTIM), 369 architecture and standards, 368
Critical Infrastructure Notification System (CINS), 376 information-sharing practices, interlinkage of, 373
cross-industry management roles and responsibilities, 367
high dependence on specialized skills, 87-88 and resilience metrics, 372-373
ineffective leadership and management skills, 88 risk awareness culture, 367-368
lack of diversity, 87 strategy, 366-367
misaligned incentives, 88 threat analysis, 348
presence of dominant companies, 87 workforce, 368-369
Cross Market Operational Resilience Group (CMORG), 372 Cyber Security Agency (CSA), 374
Crouhy, Michel, 190 Cybersecurity Fortification Initiative (CFI), HKMA's, 369
crowded trades, 227 Cyber Security Summit, 350
C-suite, 101, 102 cyber threats, 352
culture cyber war game, 372
dashboards, 109
defined, 80 D
of distribution, 110 Dai, Q., 230
of production, 110 damage to physical assets (DPA), 123
cure period, 227 Dang, T. V., 280
currency, data and, 157 Das, S. R., 223
current exposure method, 225, 308 databases
customer and product profitability analysis, 202 completeness of, 124
customer complaints, service provider contracts and, 288 external, 128
customer due diligence (CDD), 293 data collection, 167
customer segmentation, 201, 202 data, for loss estimation, 251
cyber-fraud, 376 data governance (DG), 154

Index ■ 429
data quality, 255-256 shortcomings of, 223-224
accuracy, 156 use of, 224
business impacts of poor, 154-155 derivatives bonds, 33
checks, 218 Derman, E., 230
completeness, 156 Deutsche Bank, 34
compliance risk, 154, 156 development risk, 156
confidence-based impacts, 154 differences of opinion, 98
consistency, 156-157 digital service providers (DSP), 378
control, 157-158 Dimakos, X. K., 215
credit risk, 155-156 direct market access, 134
currency, 157 directors, role of, 114
development risk, 156 disaster recovery (DR), 414
dimensions, 156 disclosure
employee fraud and abuse, 155 economic capital and, 205
financial impacts, 154 role of, 12
information flaws, 155 stress testing, 270, 277-279
inspection, 157-158 discriminatory power, 168, 169
insurance exposure, 156 discussion paper (DP), 386
issues view, 158-159 dispute resolution, service provider contracts and, 287
mapping business policies to data rules, 157 distorted risk measures, 208, 209
other dimensions of, 157 distributed denial of service (DDOS), 373
oversight, 157-158 diversifiable risk, 16
productivity impacts, 154 diversification
reasonableness, 157 assumptions, 206
and revenue assurance, 155 effect, 191-192
risk impacts, 154 inter-risk, 212-213
satisfaction impacts, 154 documentation
scorecard, 158 for capital planning, 243
underbilling, 155 risk management, 151
uniqueness, 157 documenting decisions, BHCs with, 245
validating rating models, 166-168 Dodd-Frank Act, 238, 277
dataset, 164-167 domestically systemically important (D-SIBs), 323, 327
deadweight costs, 16 due diligence, service providers and, 285-286, 293
debt-to-equity ratio, 185 Duffie, D., 223, 298
deception, in cyber resilience, 353 dynamic simulation model, 231
decision-making, 143
authority, 18
economic capital to, 27-28 E
financial aspects of, 140 earnings at risk (EaR), 230, 232
process, 44 economic capital, 184, 185. See also risk capital
decomposition, of risk measure, 210 adequacy assessment, 198-199, 204
default business-level use, 201-202
events of, 298 challenges in, 200
service provider contracts and, 287 change-control processes, 205
default mode model, 222 counterparty credit risk, 198, 199, 225-229
default probabilities, 165 to decision-making, 27-28
default risk charge, 337 defined, 196, 200, 215
Delphi Corp., 180 dependency modelling, credit risk, 197, 199, 220-224
Delphi technique, 130 governance and, 196, 201-207
delta risk, 300 for interest rate risk, 198, 200, 229-235
De Nederlandsche Bank (DNB), 97 internal model validation, 216-220
Department of Defense Guidelines on Data Quality, 155 recommendations, 198-200
dependency modelling risk aggregation, 197, 199, 210-216
in credit risk, 197, 199, 220-224 risk identification, 199

430 ■ Index
 risk measures, 196-197, 199, 207-210 events of default, 298
senior management involvement, 204 exception VAR, 311
supervisory concerns relating to, 205-207 excess equity, 19
transparency and meaningfulness, 207 exchange-traded market, 296, 302
unit involved, 205 execution, delivery, and process management (EDPM), 119-120
uses, 196, 201-207 "Exercise" Resilient Shield, UK/US, 372
validation, 197, 199 expected losses (EL), 36, 190, 252, 313, 314
economic value added (EVA), 36, 187 expected operational losses, 125
economic value of equity (EVE), 230, 232 expected revenues, 187
economic value vs. accounting performance, 23-24 expected shortfall (ES), risk measures and, 208, 209
employee engagement, 109 exposure at default (EAD)
employee fraud and abuse, 155 loss estimation and, 252
employment practices and workplace safety (EPWS), 122-123 value, 225
Enron, 221 extension risk, 232
enterprise risk, 70 external auditors, 14
enterprise risk management (ERM) external communication, 204
benefits of, 31-33 external databases, 128
business performance, 32-33 external dependencies, 13
chief risk officer, 33-34 external frauds, 122
components of, 34-37 external loss data, 9
corporate governance, 35 external resources, risk management, 150-151
and corporate level risk committee, 23 extreme value theory (EVT)
data and technology resources, 37 defined, 230
definitions, 30-31 drawbacks, 230
determining, 18-24
implementing, 22-28
leadership, 23 F
line management, 35-36 factor-based capital allocation approach, 18
micro benefits of, 17-18 factor loading, 234
organizational effectiveness, 31 failure resolution mechanisms, 298
portfolio management, 36 Fannie Mae, 268
risk analytics, 36 FASB Statements, 262
risk reporting, 31-32 fat tails, 24, 26
shareholder value, 16-18 Federal Deposit Insurance Corporation (FDIQ), 366
stakeholder management, 37 Federal Financial Institution Examining Council (FFIEC), 284,
enterprise-wide levels, 43 287, 365
enterprise-wide use, economic capital and, 202-204 Federal Insurance Office's (FIO), 132
entities, 284 Federal Reserve Bank, 238, 239
Equifax, 352 Federal Reserve Bank of New York, 98
equity capital, 26 Federal Reserve's Capital Plan Rule, 238
equity tranche, 180 feeder models, 242
Ernst & Young, 156 Feldman, Matthew, 34
escrow agreements, 287 Fender, I., 272
estimation methodologies Financial Action Task Force's (FATF), 292
general expectations, 248-251 financial condition, of service providers, 288-289
loss-estimation, 251-259 Financial Conduct Authority (FCA), 93, 386
PPNR projection, 259-263 Financial Consumer Agency of Canada (FCAC), 98
European Banking Authority (EBA), 93, 269, 271, 276, 364, 365 financial crisis
European Framework for Threat Intelligence-based Ethical Red Teaming 2000-2007, 133
(TIBER-EU), 371 2007-2009, 189
European Insurance and Occupational Pensions Authority (EIOPA), 316 financial distress, 19, 20, 26
European Securities and Markets Authority (ESMA), 364 financial impacts, data quality, 154
European Supervisory Authorities, 364 Financial Industry Information Systems (FISC), 369
event management, 8 Financial Industry Regulatory Authority (FINRA), 98

Index ■ 431
financial institutions, 185 futures contracts, 297
contract provisions and considerations, 286-288 futures exchange clearing, 297
defined, 284
failed, 306 G
operations and internal controls, 286
Gambacorta, L., 233
performance and condition, 285-286
gamification, 350
financial market infrastructures (FMIs), 364, 386
gaming, 130
Financial Policy Committee, 328
gap risk, 227
financial regulators, 414
GARCH (General Autoregressive Conditional Heteroscedasticity), 234
financial resilience, 405-406
Gaussian copula, 222, 223
financial sector professionals, 380
Gaussian copula model, one-factor, 312
Financial Security Institute (FSI), 369
General Data Protection Regulation (GDPR), 86
Financial Services and Markets Act 2000 (FSMA), 387
General Motors (GM), 180
Financial Services Information-sharing and Analysis Center (FS-ISAC), 376
General Motors Acceptance Co. (GMAC), 180
Financial Stability Board (FSB), 99, 110, 320
German Banking Act, 366
Financial Stability Oversight Council (FSOC), 328
German steel resilience, 355
financial terrorism, 292. See also money laundering and financial
Gibson, M. S., 272
terrorism (ML/FT) risk management
Global Banking Education Standards Board, 99
FinTech Knowledge Hub, 370
global systemically important banks (G-SIBs), 323, 327, 335-336
FinTech Lab, 370
global systemically important insurers (G-SII), 323
Fiori, R., 234
Goldstein, I., 279
fire sale, 189
Gonzales-Minguez, J. M., 233
firms, debt, 21
good risk, 112
Fisher's r2, 169
Google, 135
Fitch rating, 184
Gordy, M. B., 312, 313
fixed diversification, 213
Gordy model, 321,322
Fixed Income, Currencies and Commodities Market Standards Board,
Gorton, G., 280
99, 106
governance
fixed-rate mortgages, 231
board of directors, 6-7
Flannery, M. J., 268
board responsibilities, 401
flight to quality, 264, 274
capital planning and, 243-245
floating-rate bond, 232
cyber, 365-369
Foglia, A., 272
economic capital and, 196, 201-207
Ford, 180
of ERM, 28
Ford Motor Credit Co. (FMCC), 180
management responsibilities, 401
foreign-based service providers, 288, 289
operational, 3
foreign-exchange (FX) risks, 30
operational resilience, 410
forensic investigation, 353
risk management, 148-151
foundational risk management, 240-241
risk organization and, 136-137
foundation IRB (F-IRB) approach, 333
senior accountability and, 91-93
frailty approach, 223
senior management, 7-8
A Framework for Internal Control Systems in Banking Organisations
Gramm-Leach-Bliley Act of 1999, 155
(Basel Committee), 11
granular credit-risk rating system, 253
frauds
gross income, 315, 316
cyber-fraud, 376
gross loss, 342-343
employee fraud and abuse, 155
group-level use, economic capital and, 202-204
external, 122
Group Risk Appetite Statement (RAS), 74-75
internal, 122
Group Risk Management, 63
Freddie Mac, 268
Friedman, Paul, 176
full modelling/Simulation, 213, 214 H
full-revaluation methods, 259 haircut, for securities financing activities, 229
fully diversified capital, 192 Heath, D., 230
funding liquidity, 280 hedge, 17

432 ■ Index
held-to-maturity (HTM) security, 254-255 information security management, 370
Hickman, A., 273 information-sharing
high-quality liquid assets (HQLA), 325, 326 from banks to regulators, 375-376
historical averages, 257 cross-border cybersecurity, 377
holding managers accountable, 99 frameworks across jurisdictions, 373-374
Holmstrom, B., 280 percentage of jurisdictions, 374
Hong Kong Monetary Authority (HKMA), 98, 369, 377 from regulators to banks, 377
Hopper, G., 275 with security agencies, 377-378
hotel keycard failure, 351 sharing among banks, 375
house price index (HPI), 255, 274, 279 sharing among regulators, 376-377
huddle bias, 130 types of, 375
hurdle rate, 190-191 information technology (IT), 30
hybrid approach, 177 Information Technology Supervisors' Group (ITSG), 365
hybrid capital, 277 initial margin, 296
hypothetical portfolio testing, 218-219 determination of, 300
Institute of International Finance (IIF), 110
Institute of Risk Management (IRM), 110
I insurance, service provider contracts and, 287
IACPM and ISDA study, 220, 222-224 interest rate risk
lannotti, S., 233, 234 assessment of, 230-231
IBM OpVantage, 128 in banking book, 198, 200, 229-235
ICE Clear, 297 credit risk and, 234-235
IFRI and CRO Forum (2007) survey, 203, 205, 207, 209, 214 defined, 229
impact tolerances measurement challenges, 231-235
actions to remain within, 397-398 sources of, 229
disruption to multiple business services, 389 stress testing, 233-234
measuring, 389 internal audit, 3, 219, 241-242, 289
metrics, 396-397 function, 163
policy implementation, 398 risk management, 150
for PRA-FCA dual-regulated firms, 388-389 internal capital adequacy assessment process (ICAAP), 197, 200, 312
risk appetite and, 405-406 internal controls
setting an, 395-396 for capital planning, 241-243
vs. supervisory authorities, 389 service providers and, 289
implementing ERM internal data collection, 255-256
aggregating risks, 24-25 internal dependencies, 13
economic capital to make decisions, 27-28 internal frauds, 122
economic value vs. accounting performance, 23-24 internal loss data, 123, 342
governance of, 28 Internal Loss Multiplier (ILM), 326, 335, 340-341
inventory risks, 22-23 internal models approach, 227
measuring risks, 26 internal ratings-based (IRB), 162
regulatory vs. economic capital, 26-27 approach, 276, 312-313
incentive compensation review, 288 for asset classes, 333
incident management, 406, 412 bank, corporate, and sovereign exposures, 314
incident response planning, in cyber resilience for credit risk, 333-334
forensic investigation, 353 retail exposures, 314-315
initial breach diagnosis, 354 internal rating systems, 164
income simulation models, 232 internal reporting, 203
incremental default risk charge (IDRC), 321 International Accounting Standards Board, 125
incremental risk charge (IRC), 320-321 international alignment, 393
indemnification, service provider contracts and, 287 International Association of Credit Portfolio Managers (IACPM), 220,
inexpert opinion, 130 222-224
information and communication technology (ICT), 12-13, 412 International Association of Insurance Supervisors (IAIS), 306
information flaws, 155 International Financial Reporting Standard 9 (IFRS 9), 97
information security controls, 370-371 International Monetary Fund, 111

Index ■ 433
International Organization of Securities Commissions (IOSCO), long tail distribution, 24
302, 306, 364 look-back option, 189
International Organization of Standardization (ISO 31000), 31 Lopez, J., 314
International Swaps and Derivatives Association (ISDA), 220, 222-224, loss data identification
298, 309 general criteria, 342
inter-risk diversification, 212-213 specific criteria, 342-343
inventory risks, 22-23 loss data set, 342
investor, 93 loss-distribution approach (LDA), 256-257
ISDA master agreement, 298 losses
ISO 22301, 349 exclusion of, 343
ISO 27001, 349 inclusion of, 344
issuer defaults, 259 loss-estimation methodology
available-for-sale (AFS), 254-255
charge-off models, 254
J
correlation with macroeconomic factors, 256
Japanese Financial Services Agency (JFSA), 371
counterparty and issuer defaults, 259
Joint Policy Statement on Interest Rate Risk, 273
credit loan approaches, 252
joint public-private exercising, 372
data and segmentation, 251
Joint Statement on Innovative Efforts to Combat Money Laundering and
expected loss approaches, 252
Terrorist Financing, 292
held-to-maturity (HTM), 254-255
Jorion, R, 275
historical averages, 257
internal data collection and data quality, 255-256
K legal exposures, 257
loss-distribution approach (LDA), 256-257
Karolyi, G. A., 109
Kaspersky Lab, 350 market risk and counterparty credit risk, 257-258

KMV, 189 operational-loss-estimation approaches, 256

Koyluoglu, H. U„ 273 operational risk, 255
Kupiec, P. H., 272 overview, 251
Kuritzkes, A., 268 P/L estimates, 259
rating transition models, 253
regression models, 256
L retail and wholesale credit risk, 251
Large Exposures Framework, 322 revaluation, 259
leadership, 49, 51, 102 risk mitigants, 259
capabilities, 86 roll-rate models, 253-254
legal exposures, 257 scalar adjustments, 254
legal risks, 284, 340 scenario analysis, 257
Lehman, 268 stress scenarios, 258
lending technology, 167 translating scenarios to risk factor shocks, 258-259
Leung, Mona, 34 vintage loss models, 254
leverage ratio loss given default (LGD), 225, 275
Basel III framework, 335-336 credit-risk-related challenges to, 226
capital requirements, 323 loss estimation and, 252
license, service provider contracts and, 287 Luxembourg regulator, 380
limits on liability, service provider contracts and, 287
line management, enterprise risk management (ERM), 35-36
line of business (LOB) management, 48 M
liquidity, 301-302 machine learning, 95
liquidity coverage ratio (LCR), 325-326, 330 Macquarie University Risk Culture Scale, 112
living wills, 326-327 macroeconomic factors
loan-to-value (LTV) ratio, 331 correlation with operational-risk, 256
logistic regression, 165 scenario analysis based on, 234
London Interbank Offered Rate (LIBOR), 297 macro-prudential stress testing, 268, 270, 271

434 ■ Index
Madoff, Bernie, 133 modeling
Malware Information-sharing Platform (MISP), 378 balance sheet, 277
management actions, economic capital and, 206 independent review of, 242
management incentives, 202 losses, 275-276
management information systems (MIS), 6, 240, 243 revenues, 276-277
management oversight, 218 model quality, 141
management responsibilities model replication, 218
governance, 401 model risk management, 141-142
interaction with other, 404 model validation
managing information risk elements of comprehensive validation, 145-148
business impact view, 159 and other third-party products, 148
business process view, 159 vendor validation, 148
data quality issues view, 158-159 modified loss-distribution approach, 256-257
managing scorecard views, 159 Monetary Authority of Singapore (MAS), 98, 369, 374, 377
Manheim index, 275 money laundering and financial terrorism (ML/FT) risk management
mappings application of standard practices, 292
business policies to data rules, 157 correspondent banking, 293-294
cash flow, 178 customer due diligence and acceptance, 293
interconnections and interdependencies, 411 governance, 292
operational resilience, 391, 399 international scope, 294
risk measures, quality of, 178 risk assessment, 293
margin, 296 specific activities, 292
marginal capital, 192 transaction and monitoring, 293
marginal economic capital requirement, 186 wire transfers, 294
margin calls, 302 Monte Carlo Simulation, 198, 228
margined counterparty, 227 Monte Carlo VaR, 178
Mark, C., 313 Moody's, 19, 176, 184
market data, 177, 178 Moody's/KMV (MKMV), 221
market participant identifier (MPID), 134 Morgan, D. P., 280
market participants, 296 Morgan, J. R, 323
market risk, 25, 176 mortgage-backed securities (MBSs), 231
capital for, 310-311 mortgages, 231
counterparty credit risk and, 257-258 mortgage servicing right (MSR) assets, 262
counterparty EAD estimation challenges and, 225-226 Mosser, P. C., 272
credit risk and, 226
defined, 211
risk aggregation, 211 N
Market Risk Amendment, 170, 309, 311 naked access, 134
market variables, 17, 54, 55, 162 NarWest, 122
marking-to-model, 177 Nasdaq 100 Index, 135
mark-to-market National Association of Insurance Commissioners (NAIC), 132, 316
mode, 222, 223 National Australia Bank, 41, 64-69
value, 180 National Institute of Standards and Technology (NIST), 348, 364
matrix reporting, 136 negative convexity, 179
maturity adjustment factor, 314 net income after capital charge (NIACC), 187
McKinsey & Co., 34 net interest income, 261-262, 315
measuring risks, 26 net loss, 342-343
mezzanine tranche, 180 net present value (NPV), 19, 22, 36, 187
migration matrices, for validation, 169 net replacement ratio (NRR), 309, 310
minimum capital requirement (MCR), 317 net stable funding ratio (NSFR), 325-326, 330
Minimum Requirements for Risk Management (MaRisk), 366 netting, 309
Mizuho Securities, 135 over-the-counter (OTC) market and, 298
model errors, 176-177 Network and Information Security (NIS) Directive, 378

Index ■ 435
network intrusion detection system (NIDS), 355 self-assessment templates, 392
net worth, 268 severe/extreme but plausible, 391-392
non-core risks, 17 supervisory authorities', 389-390
nonfinancial risks, 272 testing review, 392
non-interest expense, 263 third-party dependency management, 411-412
non-interest income, 262-263 Operational Resilience Working Group (ORG), 364
non-margined counterparty, 227 operational risk management, 2-4
non-maturity deposits, 232 business continuity planning, 13-14
Nonpublic Personal Information (NPPI), 287 components of, 2
Northern Rock, 325, 326 control and mitigation, 11-12
nudge principle, 350 governance, 6-8
information and communication technology, 12-13
monitoring and reporting, 10-11
O operational resilience, 410-411
observation period, 169 principles for, 6-8
off-balance sheet exposure, 231, 260, 308 risk management environment, 8-10
credit conversion factors for, 309, 333 role of disclosure, 14
Office of Credit Ratings, 328 role of supervisors, 14
Office of the Comptroller of the Currency (OCC), 98 operational risks, 25, 176, 284
Office of the Superintendent of Financial Institutions (OSFI), 98 capital for, 315
Officer of the Comptroller of the Currency (OCC), 366 capital requirement, 335
on-balance sheet exposure, 231, 260 defined, 211,340
one-factor Gaussian copula model, 312 event data, 8
ongoing basis, 43 losses, 342
ongoing consultation, 193 loss-estimation and, 255
ongoing monitoring, 146-147 regression models, 256
operational data governance, 158 operators of essential services (OES), 378
operational-loss-estimation approaches, 256 OpRisk data
operational resilience, 417 adding costs to losses, 125
approach, 414-416 asset management, 133-134
and business continuity planning, 406, 411 business disruption and system failures (BDSF), 121-122
business services, 387-388 business environment and internal control environment factors
cyber security, 412 (BEICFs), 125-128
definition of, 409-410 clients, products and business practices (CPBP) risk, 120-121
delivering, 391-393 completeness of database, 124
essential elements of, 408-409 corporate finance, 131
evolving operational risk, 408 damage to physical assets (DPA), 123
executive summary, 414 elements of, 123-125
financial resilience, 405-406 employment practices and workplace safety (EPWS), 122-123
and governance, 404, 410 execution, delivery, and process management (EDPM), 119-120
ICT, 412 external databases, 128
impact tolerances, 388-390, 405 external frauds, 122
implementation timeline, 390-391 insurance, 132-133
improving, 417-419 internal frauds, 122
incident management, 406, 412 internal loss data, 123
interconnections and interdependencies, 411 policy, 137
mapping, 391, 399, 411 profile, 131-135
need for, 414 provisioning treatment of expected, 125
operational risk management, 410-411 recoveries and near misses, 124
vs. operational risk policy, 405-406 retail banking, 131-132
and outsourcing, 392-393, 406 retail brokerage, 134-135
PRA-FCA dual-regulated firms, 391 risk organization and governance, 135-137
principles for, 410-412 scenario analysis, 129-129
risk appetite, 405 setting collection threshold and possible impacts, 123-124

436 ■ Index
 time period for resolution, 125 observed practices, 260-261
trading and sales, 131 robust projections, 260
Option Adjusted Spread (OAS), 234 PRA-FCA dual-regulated firms
options, scenario analysis based on, 234 impact tolerances for, 388-389
Organisation of Economic Co-operation and Development (OECD), 308 scenario testing for, 391,399-401
organizational culture, 108 self-assessment templates and guidance for, 392
organizational design, 135 preferred risk, 58
organizational effectiveness, enterprise risk management (ERM), 31 prepayment risk options, 231
organized trading facilities (OTFs), 299 pre-SCAP, 270
original equipment manufacturers (OEMs), 180 presentation bias, 129
original exposure method, 308-309 Presidential Policy Directive, 349
other-than-temporary impairment (OTTI), 254, 255 PricewaterhouseCoopers, 155
outsourcing, 12 PricewaterhouseCoopers Survey, 204
operational resilience and, 392-393, 406 pricing transactions, 186
risk management, 283-290 principal components decomposition, 234
oversight process, service providers and, 288-289 privilege restriction, in cyber resilience, 353
over-the-counter (OTC) market probability of default (PD), 20, 190, 225
bilateral clearing, 296, 298 credit-risk-related challenges to, 226
CCPs and bankruptcy, 302-303 loss estimation and, 252
central clearing, 296-298 process verification, 146
clearing in, 296-298 Professional Development Program (PDP), HKMA's, 369
convergence of, 302 profitability analysis, 202
defined, 296 profit and loss attribution, 219
events of default, 298 Prompt Corrective Action (PCA), 323
impact of changes, 301-302 Prudential Regulation Authority (PRA), 370, 386
initial margin, 300-301 Prudential Standard CPS 236, 366
netting, 298 putable bonds, 232
post-crisis regulatory changes, 299-301
role of CCP in, 297 Q
uncleared trades, 299
qualitative processes, for validation, 217-218
over/under confidence bias, 130
qualitative review, 217
ownership, service provider contracts and, 287
quantitative approach, 140
Quantitative Impact Studies (QIS), 311
P quantitative processes
for validation, 218-219
parameter review group, 193
penetration test, 371
performance standards, service provider contracts and, 286 R
phishing attacks, 349 ratings stability, 169
Piazzesi, M., 234 rating systems, 162
Pillar 2, 311, 312 acceptance, 165-166
Pillar 3, 311, 312 completeness, 165
plan-do-check-act (PDCA) cycle, 368 consistency, 166
P/L estimates, 259 design, 164-166
point-in-time (PIT), 190 objectivity, 165
portfolio management, enterprise risk management (ERM), 36 supervisory validation of, 162
position data, 177 rating transition models, 253
post-crisis regulatory changes, 299-301 real economy, 273
post-SCAP, 270 Rebonato, R., 273, 275
potential exposure, 225 recovery, 342-343
PPNR projection methodologies, 259 recovery point objectives (RPO), 13
net interest income, 261-262 recovery time objectives (RTO), 13
non-interest expense, 263 redundancy, in cyber resilience, 353
non-interest income, 262-263 regression models, 256

Index ■ 437
regulation, 105 risk analytics, 36
regulators share information, 376-377 risk appetite framework (RAF)
regulatory capital vs. economic, 26-27 capturing different risk types, 49-50
regulatory cloud summits, 380 case studies, 61-77
regulatory-type approach, 224 for firms, 57-61
rehypothecation, 302 implementation, 43-45
relative risk measurement, 206 practices, 45-57
reputational risks, 241, 284 principal, 41-43
required stable funding (RSF), 325 role of stress testing, 54-57
Research Task Force of the Basel Committee, 212 risk appetites, 4, 35, 40, 70-74, 168, 405
residential mortgage-backed securities (RMBS), 178, 182, 255 benefits of, 43, 50-51
resilience, 349, 414. See also cyber-resilience; operational resilience into businesses, 47-49
backward-looking indicators, 372-373 and capital planning, 53
resilience engineering definition of, 7
hotel keycard failure, 351 dynamic tool, 50-51
safety management, 350-351 evolution of, 76-77
resilience metrics, cyber-security and, 372-373 and impact tolerances, 405-406
resilient organizations, 415 and liquidity planning, 53
resilient software, 354 and performance management, 53
retail banking, 131-132, 233 and risk culture, 46-47
retail exposures, 314-315 and strategic planning, 53
return on assets (ROA), 262 Risk Appetite Statement (RAS), 64
return on capital (ROC), 186 risk assessment, 8
return on capital at risk (ROCAR), 203 risk awareness culture, cyber, 367-368
return-on-risk, 69 risk-based capital allocation, 18
return on risk-adjusted assets (RORAA), 186 risk-based pricing, 201-202
return on risk-adjusted capital (RORAC), 203 risk budget, 65, 67, 68
return trade off, 58 risk capacity, defined, 62
revaluation methodology, 259 risk capital, 184
revenue assurance, 155 active portfolio management for entry/exit decisions, 185
revised IRB framework, 333 diversification and, 191-192
right to audit, service provider contracts and, 286 emerging uses of, 184-186
risk-adjusted performance measurement (RAPM), 184, 186-187 and incentive compensation, 185
risk-adjusted return on capital (RAROC), 32 measurement, 184
for capital budgeting, 187-188 performance measurement, 185
and capital budgeting decision rule, 190-191 pricing transactions, 186
confidence level, 190 risk-adjusted return on capital, 186-194
default probabilities, 190 risk control self-assessment (RCSA), 23, 126-127
economic capital and, 201-202 risk culture (RC), 42, 75
horizon, 188-190 change and challenge, 112-115
hurdle rate, 190-191 culture dashboards, 109
for performance measurement, 188-192 culture survey, 109
point-in-time (PIT) vs. through-the-cycle (TTC), 190 customer perceptions and outcomes, 109
in practice, 192-194 drivers and effects, 111-112
with qualitative factors, 193-194 measuring culture and cultural progress, 109
vs. shareholder value added (SVA), 203 reduce misconduct risk, 114
risk-adjusted return on risk-adjusted assets (RAROA), 203 and risk appetite, 46-47
risk aggregation, 45, 56-57 scope and definition, 110-111
economic capital and, 197, 199 validation, 109
framework, 210-211 risk departments, 135-136
methodology, 211-212 risk diversification effect, 185
range of practices, 212-213 risk factor model, 312
supervisory concerns relating to, 215-216 risk factor shocks, 258-259

438 ■ Index
risk identification risk reporting, 31-32
for bank holding companies (BHCs), 240-241 risk-return trade-off, 17-18
economic capital and, 199 risks
risk management, 22 comprehensive capture of, 206
board of directors, 149 covariance matrix of, 215
documentation, 151 grouping of, 211
external resources, 150-151 risk settings, 65, 67, 68
governance, 148-151 risk setting statements (RSSs), 69
internal audit, 150 risk tolerance, 7
macro benefits of, 16-17 risk types, 189
micro benefits of, 17-18 risk-weighted assets (RWAs), 260, 263-264, 275, 277, 307,
model development and implementation, 142-143 308, 323
model inventory, 151 roll-rate models, 253-254
model use, 143-144 advantages, 253
model validation, 144-148 Rosenberg, J. V., 215
overview of, 140-142 Royal Bank of Canada, 41,61-64
policies and procedures, 149 Rudebusch, G. D., 234
programs for service providers, 284-290 Rutter Associates LLC, 201
purpose and scope, 140
recommendations for, 60-61
roles and responsibilities, 149-150 S
senior management, 149 Sabre SynXis Central Reservations System, 351
Risk Management and Modelling Group (RMMG) (Basel Committee), 200 safety management, 350-351
risk management environment, 8-10 Sapra, H., 279
business continuity planning, 13-14 Sarbanes-Oxley Act, 35, 154, 289
control and mitigation, 11-12 Saunders, A., 275
identification and assessment, 8-10 SBC Warburg, 121
information and communication technology, 12-13 scalar adjustments, 254
monitoring and reporting, 10-11 scenario analysis, 9, 129-131
operational risk management, 5 for bank holding companies (BHCs), 257
risk manager, 177 based on GARCH models, 234
risk measures, 21, 26 based on historical distributions, 234
bank holding companies and, 240 based on macroeconomic factors, 234
calculation of, 209-210 based on options, 234
desirable characteristics, 207-208 based on principal component decomposition of yield
economic capital and, 196-197, 199 curve, 234
supervisory concerns relating to, 210 linking credit and interest rate risk, 234-235
types of, 208, 209 scenario design, bank holding companies (BHCs), 247-248
risk measures, quality of scenarios, 129
Credit Correlation (2005), 178-181 Schuermann, T., 215
mapping issues, 178 scorecard views, 159
model risk, 176-182 Scotiabank, 41, 70-73
subprime default models, 182 Scott, H., 268
valuation risk, 176-177 Sector Exercising Group (SEG), 372
variability of VaR estimates, 177-178 Securities and Exchange Commission (SEC), 98, 328
risk metric, 212 Securities and Futures Authority, 121
RiskMetrics, 272, 273 Securities and Futures Commission's (SFC's), 98
risk mitigants, 259 securitizations, 178
risk organization security master data, 177
firm wide policy, 136 segmentation
governance, 136-137 in cyber resilience, 353
risk departments, 135-136 for loss estimation, 251
risk posture, 52-54, 64-68 self-assessments, 8, 401,402

Index ■ 439
self-regulation, 109 sponsored access arrangements, 134
senior accountability spread duration, 233
applicability, 92 square root of time rule, 189
board-level conduct management reporting, 91-92 stakeholder management, 37
board responsibilities and involvement, 91 stand-alone capital, 192
data quality and availability, 91-92 standard deviation, 208, 209
and governance, 91-93 Standard Initial Margin Model (SIMM), 300-301
modeling behavior, 92 standardised approach
relevance and effectiveness, 92 application of, 341
role of asset owners, 92 Basel II, 312-313
third-party fund managers, 92 Basel III, finalising post-crisis reforms, 324
usefulness, 92 capital for, 315
senior management, 163 for credit risk, 330-333
capital planning and, 244-245 loss data set, 342
commitment, 193 operational risk capital requirement, 341
in cyber-security, 367 use of loss data under, 341-342
economic capital and, 199, 204 standardised credit risk assessment approach (SCRA), 331
governance, 7-8 Standard & Poor's, 184
recommendations for, 59-60 static simulation model, 231
responsibilities regarding service providers, 284 statutory capital, 24
risk management, 149 Steering Committee on Implementation (SCI), 40
Senior Management Function (SMF), 401 stranded capital, 26
Senior Managers and Certification Regime (SM&CR), 97, 99, 105 strategic planning, 203
Senior Supervisors Group (SSG), 40 strategic risks, 241
service-level agreements (SLAs), 158 capital, 187
service providers stressed VaR, 320
board of directors and senior management responsibilities, 284 stress metrics, 43
business continuity of, 289 stress testing, 43-45, 170-173
business model, 285 balance sheet and income statement dynamics, 277
contingency plan of, 288 for bank holding companies (BHCs), 241
defined, 284 and Basel rules, 327
due diligence and selection, 285-286 Bayesian approach, 273
financial condition of, 288-289 counterparty credit risk exposure and, 228
foreign-based, 288, 289 designing the scenarios, 273-274
multinationals valued, 306 disclosure, 269, 270, 277-280
oversight and monitoring of, 288-289 in interest rate modelling, 233-234
risk management programs, 284-290 in literature, 272-273
risks from use of, 284 losses and revenues, 274-277
shareholder value added (SVA) vs. RAROC, 203 macroprudential, 271
Sharpe ratio, 187 role of, 54-57, 206
Sheffield Elicitation Framework (SHELF), 130, 131 scenario-based, 241
simple approach, 312 validation and, 219
simple summation, 213, 214 subcontracting, service provider contracts and, 288
single-factor models, 230 supervision, 105
Single Supervisory Mechanism (SSM), 376 supervisors, 95
Singleton, K. J., 230 role of, 14
software development life cycle (SDLC), 354 supervisory authorities, 372
solvency capital requirement (SCR), 317 vs. impact tolerances, 389
Solvency II, 316-317 objectives, 389
sovereign exposures, 314 Supervisory Capital Assessment Program (SCAP), 238, 268-271
specific risk (SR), 310 supervisory college model, 380
capital for, 311 supervisory validation, 162
spectral risk measures, 208, 209 suspicious activity report (SAR), 289

440 ■ Index
SwapCIear, 297, 303 treasury bond, 297
swap execution facilities (SEFs), 299, 328 Trump Hotels, 351
system development risks, 155 Turnbull, Malcolm, 84
system downtime, 127
systemically important financial institutions (SIFIs), 323 U
systemic issues, 105
UAW, 180
system implementation, 217
UBS, 34
system integration, 146
UK Financial Conduct Authority, 99
system slow time, 127
UK Senior Managers and Certification Regime (SMCR), 99
uncleared trades, 299
T underbilling, revenue assurance and, 155
underinvestment problem, 17
Tarashev, N., 224
under-reporting events, 124
tax benefits of debt, 19
underwriting risk, 317
t-copula, 222
unexpected loss, 313, 314
technology service provider (TSP) risk, 284
unfiltered access, 134
termination, service provider contracts and, 287
unintended consequences, 99
testing, of third parties, 383
uniqueness, data quality and, 157
Thaler, William, 350
unit of account, 211-212
third lines of defence (3LD), in cyber-security, 367
USA PATRIOT Act, 154
third-party dependency management, 411-412
use test, 217
third-party fund managers, 92
third-party products, 148
third-party services, 379 V
auditing and testing, 383 validating rating models
business continuity and availability, 381-382 data quality, 166-168
governance of, 379-381 internal validation, 162
information confidentiality and integrity, 382-383 profiles, 162-163
regulated/certified, 380 qualitative validation, 164-168
resources and skills, 384 quantitative validation, 168-173
supervisory expectations for visibility, 383 regulatory validation, 162
third-party vendors, 163 roles of internal validation units, 163-164
threshold, 19 validation, 3
through-the-cycle (TTC), 190 economic capital and, 197, 199
Thyssenkrup, 355 of inputs and parameters, 218
TIBER-EU (European Framework for Threat Intelligence-based Ethical of internal economic capital models, 216-220
Red Teaming), 371 of models, 242
tick-box, 43 qualitative, 217-218
tick the box compliance, 132 quantitative, 218-219
Tier 1 Capital, 307, 322 supervisory concerns relating to, 220
Tier 2 Capital, 307 valuation risk, 176-177
time horizons, 189, 210, 212, 231 value-at-risk (VaR), 21, 198
timeline, implementation, 390-391 calculation methodology, 184
time period for resolution, 125 as CCR exposure engine, 228
top-down process, 52 for counterparty credit exposure measurement, 225, 226
total capital, 307 risk-adjusted return on capital (RAROC), 32
total loss absorbing capacity (TLAC), 326 risk measures and, 208, 209
total risk, 17-18 stressed, 320
trade control, lack of skills in, 118 variance-covariance matrix, 197, 213-215
trading book vs. banking book, 235 variation margin, 296, 302
transition matrix, 20 vega risk, 300
transparency, 199, 207 vendor validation, 148
Treacy, W. F., 313 verification, 3

Index ■ 441
vetting, 166 wholesale funding, 322
vintage loss models, 254 Wilks', 169
Visteon, 180 Williams, John, 98
volatility, levels of, 21 wire transfers, 294
Volcker Rule, 328 workforces, cyber, 368-369
Working Group on Risk Appetite (WGRA), 41
W wrong-way risk, 226, 228
Wyman, Oliver, 102
Wachovia, 268
Washington Mutual, 268
Weibull distribution, 316 Z
Wells Fargo, 98 zero tolerance, 42
wholesale credit risk, 251 Zhu, H., 224, 298

442 Index