2001

Choose your weapons...Moving forward on operational risk in the light of the new Basel Accord

By James Ward

FX & MM Magazine,  01 October 2001

The recent, revised consultation paper on the Basel Committee's proposals for operational risk capital requirements provides banks with an opportunity to significantly reduce their capital requirements via a (relatively modest) investment in operational risk measurement techniques. However, it also provides them with a dilemma: to achieve this reduction, they must select an 'advanced measurement approach' (AMA) from one of three broad types: the internal measurement approach, loss distribution approach, and the scorecard approach. The question that banks must therefore ask is: which of these will provide the greatest benefits, at lowest cost?

At PA Consulting, we believe that the scorecard approach will, for nearly all banks, prove to be the best choice to take in developing an operational risk model. The three primary advantages of this method are that it provides a more complete (and so more accurate) measure of operational risk, stronger incentives and better tools for managers to reduce risks, and a more practical and flexible implementation path. Furthermore, in our experience, banks that have implemented scorecard approaches have seen substantial benefits, including stronger risk cultures and increased shareholder returns.

An opportunity for significant capital reductions

Late in September 2001, the Basel Committee issued a revised consultation paper 1 on its proposals for operational risk capital requirements, to be introduced as part of the revised Accord in 2005. This paper proposes three possible approaches to the calculation of operational risk capital:

• The Basic Approach, using a fixed percentage ('alpha') of gross revenue, with alpha expected to be in the range of 17-20%

• The Standardised Approach, similar to the Basic Approach but with different percentages ('betas') for different types of business - such as retail banking, asset management, etc

• The Advanced Measurement Approach, in which a bank will be permitted to use its own internal model to calculate required capital.

According to the latest consultation paper, both the Basic and Standardised Approaches will be calibrated so that operational risk capital forms (on average) around 12% of a bank's total regulatory capital requirement. In the Advanced Measurement Approach (or AMA), the bank's own model will set the result, but with a 'floor' (minimum) at 75% of the value calculated by the Standardised Approach. This floor may be reduced over time, and perhaps even eliminated, as the regulators develop greater trust in the models that banks have developed. Even with the floor, however, a significant benefit is available - on average up to 3% of regulatory capital.

For even a medium-sized bank (say one in the global top 300, with $1bn or more of Tier 1 capital), this would imply a capital reduction on the order of tens of millions of dollars, with a corresponding economic profit of several millions of dollars each year. Even the most advanced operational risk model is unlikely to cost that much to implement, and although the costs will be incurred in the short-term,they are largely one-off, whereas the benefits can accrue every year from 2005 onwards. This analysis does not even begin to count the benefits from improved risk management and reduced losses that can arise from implementation of an advanced operational risk model.

It seems, therefore, that for most medium and large banks, there will be a very strong business case for using the Advanced Measurement Approach.

A choice of models

This leaves the bank with a dilemma: what kind of operational risk model should they implement to qualify for AMA treatment? In principle, any approach that satisfies the regulators' criteria for rigor and robustness will qualify; however, the consultation paper identified three families of models into which all currently-known advanced models fall, and which therefore form the practical range of options for banks wishing to select an AMA:

• The Internal Modelling Approach (IMA), in which the expected losses in each business line are calculated by examining the average of past losses experienced, and then multiplied up by a standard 'gamma'factor to derive a figure for 'unexpected' or 'worst-case'losses, which gives the capital requirement

• The Loss Distribution Approach (LDA) which, as its name suggests, attempts to fit a statistical distribution to the history of losses, and derives the capital requirement from a confidence level on this distribution, in a manner similar to the Value-at- Risk (VaR) models used by many banks to calculate market and credit risks

• The Scorecard Approach, which starts with a capital amount that is derived by an analysis of historical loss data similar to an IMA or LDA, but with its evolution over time guided not purely by changes in the pattern of past losses, but also by quantitative indicators of future risks (for example, staff turnover and systems crash frequency), and by qualitative assessments of the bank's control environment.

Each bank must therefore determine which of these approaches will deliver the greatest benefits, at least cost - a question that the remainder of this paper is devoted to answering.

A clear winner

In PA's view, based on experience of working on operational risk issues with many different banks around the world, the scorecard approach is by far the most attractive approach. In particular, it has the following clear advantages:

• It provides a more complete and accurate measure of operational risks, by incorporating forward-looking risk indicators and qualitative assessments of the control environment as well as loss data

• It gives managers much stronger incentives to reduce risks, and much better tools to help them identify how to do so

• It is much easier to implement for most banks (that lack a complete history of internally-collected loss data), and also easier to adapt as the requirements of the bank, and the regulators, evolve over time.

These advantages are explained further in the tables and text that follows, before examining some anecdotal evidence of the operational and strategic benefits that are gained by banks implementing the scorecard approach.

A more complete and accurate measure of risks

The first requirement of an operational risk model is that it should provide a reasonably accurate measure of risk. By this, we mean that, given the information available at the time, it should give the best possible estimate of future losses (or, more precisely, the range or volatility of those losses).

We believe strongly that the scorecard approach provides the most accurate measure of risk, because it is the only approach to use the full range of risk data available - as illustrated in the table below.

By contrast, the IMA and LDA both focus narrowly on historical loss data, an approach that has two major failings:

• Firstly, it fails to take account of loss types that have not yet occurred (for example, where were the events of 11 September in the historical data record, prior to their occurrence?)

• Secondly, it fails to adapt to recent changes in the risk environment that have changed the probability or likely impact of events.

The second failing is particularly critical, since the natural reaction of a bank to losses is to tighten up controls to prevent their re-occurrence, and thereby to reduce the level of risk. At the same time, it may have opened up new risk exposures by entering into new products, markets, technologies or ways of working. So the level of risk may be higher or lower, or differently distributed; what is almost certain is that it will not be the same as it was before.

The scorecard approach addresses both of these issues, by focusing not on specific loss events, but on general risk classes and on the risk factors, internal and external to the bank, that drive the probability and impact of these risks. For example, in measuring premises and security risks, the scorecard might examine both the general rate of crime in the population, and the specific control measures taken by the bank to prevent theft of or damage to property. If any of these factors change, the scorecard approach will immediately record a change in risk level, whereas the IMA and LDA would take many years to react to a gradual change in loss experience.

The major criticism levelled at the scorecard approach by its critics is that the choice of risk drivers, and of the weightings given to each in the scorecard, is highly subjective: how do we know what these factors are, and how important each one is? Of course, the only true test of the relationship between risk drivers and loss experience will be in the examination of statistical trends over many years. However, in the short term we do not have the luxury of access to such analysis; instead, all we have is our intuition and common sense, which tells us (for example) that banks with very high staff turnover and inexperienced staff will be, on average, riskier than those with lower turnover and more experienced staff.

The choice we face is either to ignore this intuition, and rely purely on the historical data record (an approach taken by the IMA and LDA), or to incorporate that intuition in a structured way, alongside loss data, in the risk assessment (the scorecard approach). In this respect we are in a similar position to lending officers taking decisions on credit risk some 10-15 years ago: at that stage, there were relatively few statistical models available to analyse individual credits. But experienced bankers could easily identify the factors that influenced credit risks: for example, customers with more money, and with secure sources of income, were more likely to repay loans.

Their response to the lack of precise statistical models was not (in most banks) to lend to all customers willy-nilly, but rather to create 'scorecards'based on the expert judgement of lending officers as to which factors counted most in driving ability to repay. Over time, these scorecards have been refined as the relationship between risk drivers and loss experience have become clearer - although in the case of corporate credit, expert scorecards still predominate over statistically-derived models.

We are in exactly the same situation now for operational risk: it will not be for many years, if ever, that a formal statistical relationship can be established between operational risk drivers and losses, but we can use our intuition now to help us make good decisions in the short term, and refine this based on experience as we go forward. Of the AMA models offered by Basel, only the scorecard takes this pragmatic approach, and so should be preferred.

Stronger incentives and better tools for managers

The second major reason to prefer the scorecard approach relates to its impact on management. The scorecard approach both creates strong incentives for managers to reduce risks, and gives strong hints as to how they can do this - something that neither the IMA or LDA can do.

The difficulty with the IMA and LDA is that, since their capital calculations are based on the pattern of losses over a number of years, it will take many years before a reduction in risk levels is fully reflected in lower capital allocations. (Indeed, if -as is often the case- the calculations are based in part on external benchmarks, the reduction may never be fully reflected).

As a result, managers will have little short-term incentive to make the investments in people, processes and systems that may be required to reduce risks. This will be a particular problem in environments such as FX and money-market trading that have a strong focus on short-term results, and where the manager may well expect to be in a different job by the time the benefits come through.

The scorecard approach, by contrast, provides an immediate linkage between risk-mitigating actions and capital reductions, since the capital is based directly on measures of the risk environment. With this approach, there is no need to wait several years for a payoff if a real change in the risk environment can be effected now.

Managers will therefore have a strong incentive to take actions that will reduce risks, in order to improve their business's reported returns on capital. These incentives will be particularly strong where managers' performance assessments and remuneration are linked to risk-adjusted returns, a linkage that PA research 2 shows leads to significant gains in shareholder returns.

The scorecard approach not only provides incentives for managers to reduce risks, it also tells them how to do it. Just as a life assurance questionnaire implicitly provides us with hints as to how to improve our life expectancy (eg stop smoking, start taking exercise), so too an operational risk scorecard provides strong clues as to the actions that will lead to lower risks - for example, reducing staff turnover, improving systems maintenance, increasing compliance training, and testing business continuity plans more regularly.

In a sophisticated scorecard implementation, the manager may even be able to perform 'what-if ?' analysis from his or her own desktop, calculating the potential capital reduction arising from a candidate mitigating measure. An immediate business case is thereby provided for actions that might previously have been impossible to obtain budget for, but which (on a risk-adjusted basis) would be highly profitable. Equally, mitigating actions that are not economic, or have reached the point of diminishing returns, can be quickly discarded. The scorecard approach therefore drives managers to take those actions that reduce operational risks most successfully, for the least expended cost - something that neither the IMA or LDA can claim to achieve.

An easier and more flexible implementation path

Having seen that the scorecard approach is both a better measure of risk, and a stronger tool for driving risk-mitigating actions, we may expect to find that it is much more difficult, expensive and time-consuming to implement than either the IMA or LDA. Fortunately, little of this is true: building a scorecard approach is no simple matter, but it is not appreciably more difficult to implement than the other approaches, and it proves to be much more flexible in responding to changes in requirements over time.

The table below highlights the factors that make different AMA models more or less difficult to implement. As we can see, the scorecard approach can often be implemented much more quickly than either of the history-based approaches - within a year or less, compared to the many years that it may take to collect sufficient loss data to feed an IMA or LDA model. Although the scorecard approach does demand large volumes of input data, this is typically data that well-managed banks already collect about their current operations.

Unfortunately, this reduction in time expended does not necessarily mean a commensurate reduction in costs, since waiting around for loss data to arrive is relatively inexpensive. What it does mean is that the benefits will arrive earlier, both in terms of capital reductions and real risk reductions, and so some of the losses may even be prevented before they add to the database.

The costs of implementing the scorecard approach will vary from bank to bank (according to the complexity of the business, and the sophistication of the model chosen), but are likely to be in the range of £0.5-1.0m for a medium-sized bank. As we saw at the start of the paper, these costs are an order of magnitude smaller than the potential benefits in terms of capital reduction, and so should not be a significant deterrent to implementation.

The one factor where the scorecard approach appears to fall down, compared to the alternatives, is in its requirement for human resources. The nature of the approach, using the judgement of experts from within the business to construct the scorecards, and requiring all business units to complete them, inevitably implies the involvement of dozens, perhaps even hundreds, of people from across the bank in the process.

By contrast, the IMA and LDA approaches can be implemented with a much smaller, centralised team, using business line resources only to collect the loss data. The downside of this approach, however, comes in the following column: management buy-in. In our experience, business managers rarely understand or trust the statistical models implicit in IMA and LDA approaches, nor can they see how they can be used to run the business any better.

On the other hand, the scorecard model, with its common-sense approach, recognisable inputs and immediate feedback to mitigating actions, tends to command respect and engagement from management. This is particularly true if their staff have been involved, not just in collecting data to enter into the model, but in designing the way it works. PA research indicates that senior management support is the most critical factor in implementing risk and capital models in the business - without it, the project will surely fail.

As well as being easier to implement in the first instance, the scorecard approach is easier to adapt to changing conditions over time. This is illustrated in the table below, where it is apparent that whatever the new condition - additional data, new risks, new businesses, or even the development of more advanced models - the scorecard model is at least as flexible as the alternatives, and in some cases dramatically more so.

The scorecard model's modular nature therefore offers a much better platform for future development, in response to changes in the bank's own requirements and those of regulators, than the more narrow and inflexible approach represented by the IMA and LDA.

A wide range of practical benefits

The attractions of an accurate risk measure, strong management incentives and a flexible implementation path should be enough to convince even the most ardent lover of loss history of the scorecard model's superiority. However, so far this has only been theoretical argument - what have been the experiences of those banks that have implemented scorecard models?

Inevitably, it is early days yet: like all of the AMA approaches, the scorecard model is relatively recent in its design, and still evolving. However, there are banks for whom the model is already 12-18 months old. From this small sample, we can already see clear signs of a wide range of benefits, including:

• Reduced risks and losses, arising from actions identified by the scorecard process as being profitable on a risk-adjusted basis

• A stronger risk management culture, with understanding and engagement improved at all levels from front-line staff to the Board

• Market perception of improved risk control, leading (together with other factors) to higher stockmarket returns compared to peer banks.

With these benefits on offer, not to mention the capital reductions held out by the new Basel Accord, it is little surprise that an increasing number of banks are implementing, or moving to implement, a score-card- based approach to operational risk management. Indeed, we struggle to understand why, in the current environment, any bank would take a different approach.

References

1 Working Paper on the Regulatory Treatment of Operational Risk, Basel Committee on Banking Supervision, September 2001. Available from http://www.bis.org

2 Risk-based Management in the Banking Sector; PA Global Survey Results 2001. For a copy, please contact us at risk.management@paconsulting.com

The author is a senior consultant in PA’s Risk Management Centre of Excellence, based in London, but working for clients throughout the US, UK, Europe and Asia. James leads PA’s work in operational risk management around the world, including the development of capital allocation models, risk mitigation programmes, and management information reports and systems. He can be contacted at james.ward@paconsulting.com 

  |  Previous  |    |  Next  |