FRM Fin an cial R isk M anager

<S>GARP

2020

EXAM PART II
Operational Risk and Resiliency

Pearson
Book: G A R P _O R R 000200010272205729
Project M anager: EEB
Rights Ed: KW
Copyright © 2019, 2018, 2017, 2016, 2015, 2014, 2013, 2012, 2011 by Pearson Education, Inc.
All rights reserved.
Pearson Custom Edition.
This copyright covers material written expressly for this volum e by the editor/s as well as the com pilation itself. It does not cover the individual
selections herein that first appeared elsew here. Permission to reprint these has been obtained by Pearson Education, Inc. for this edition only. Further
reproduction by any means, electronic or m echanical, including photocopying and recording, or by any information storage or retrieval system , must
be arranged with the individual copyright holders noted.
Grateful acknowledgment is made to the following sources for
permission to reprint material copyrighted or controlled by them:
"Principles for the Sound M anagem ent of O perational Risk," by Basel
Com m ittee on Banking Supervision, Ju n e 2011, by permission of the Bank
for International Settlem ents. Information retrieved from the Bank for
International Settlem ents is freely available at their w ebsite: w w w .bis.org.
"En terp rise Risk M anagem ent: Theory and Practice," by Brian W. Nocco
and Rene M. Stulz, reprinted from Journ al o f A p p lie d C o rp o ra te Finance,
vol. 18, no. 4, Fall 2006, by permission of John W iley & Sons, Inc.
"W hat is ER M ?," by Jam es Lam, reprinted from En terp rise Risk
M anagem ent: From Incentives to C ontrols, Second Edition (2014), by
permission of John W iley & Sons, Inc.
"Im plem enting Robust Risk A p p etite Fram ew orks to Strengthen Financial
Institutions," Ju n e 2011, by permission of the Institute of International
Finance.
"Banking Conduct and Culture: A Perm anent M indset C h an g e," by
the G 30 W orking G roup, 2018, by permission of the Group of 30
Consultative Group on International Econom ic and M onetary Affairs, Inc.
"Risk C ulture," by Alessandro Carretta and Paola Schwizer, reprinted
from Risk Culture in Banking by Alessandro Carretta, Franco Fiordelisi
and Paola Schw izer (2017), by permission of Palgrave Macmillan.
"O p R isk Data and G o vern an ce," by Marcelo G Cruz, Gareth W Peters
and Pavel V Shevchenko, reprinted from Fundam ental A sp e c ts o f
O perational Risk and Insurance A nalytics: A H andbook o f O perational
Risk (2015), by permission of John W iley & Sons, Inc.
"Adoption of Supervisory G uidance on Model Risk M anagem ent,"
reprinted from Financial Institution Letter FIL-22-2017, Ju n e 2017,
published by the Federal D eposit Insurance Corporation.
"Inform ation Risk and Data Q uality M anagem ent," by David Loshin,
reprinted from Risk M an agem en t in Finance: Six Sigm a and O th er
N ext-G eneration Techniques, edited by Anthony Tarantino and Deborah
Cernauskas (2009), by permission of John W iley & Sons, Inc.
"Validating Rating M odels," by G iacom o De Laurentis, Renato Maino,
and Luca M olteni, reprinted from D evelop in g, Validating and Using
Internal Ratings (2010), by permission of John W iley & Sons, Inc.
"Assessing the Q uality of Risk M easures," by Allan M Malz, reprinted
from Financial Risk M an agem en t: M o d e ls, H istory, and Institutions (2011),
by permission of John W iley & Sons, Inc.
"Risk Capital Attribution and Risk-Adjusted Perform ance M easurem ent,"
by Michel Crouhy, Dan Galai and Robert Mark, reprinted from The
Essentials o f Risk M anagem ent, 2nd Edition (2014), by permission of the
M cGraw-Hill Com panies, Inc.
"Range of Practices and Issues in Econom ic Capital Fram ew orks," by
Basel Com m ittee on Banking Supervision, March 2009, by permission of
the Basel Com m ittee on Banking Supervision.
"C apital Planning at Large Bank Holding Com panies: Supervisory
Expectations and Range of Current Practice," August 2013, by
permission of the Board of Governors of the Federal Reserve System .
Pearson
"Stress Testing Banks," by Til Schuermann, reprinted from the International
Journal o f Forecasting 30, no. 3, (2014) pp. 717-728, by permission of
Elsevier BV.
"G uidance on Managing Outsourcing Risk," Supervisory Letter SR 13-19/
C A 1 3-21, D ecem ber 2013, by permission of the Board of Governors of
the Federal Reserve System .
"M anagem ent of Risks Associated with M oney Laundering and Financing
of Terrorism ," by Mark C arey, February 2019, the G A R P Risk Institute.
"Regulation of the O T C D erivatives M arket," by John C Hull, reprinted
from Risk M an agem en t and Financial Institutions, 5th edition (2018), by
permission of John W iley & Sons, Inc.
"C apital Regulation Before the Global Financial C risis," by Mark Carey,
April 2019, the G A R P Risk Institute.
"Solvency, Liquidity and O ther Regulation A fter the Global Financial
C risis," by Mark C arey, April 2019, the G A R P Risk Institute.
"High-Level Sum m ary of Basel III Reform s," by Basel Com m ittee on
Banking Supervision, D ecem ber 2017, by permission of the Bank for
International Settlem ents. Information retrieved from the Bank for
International Settlem ents is freely available at their w ebsite: w w w .b is.o rg .
"Basel III: Finalising Post-Crisis Reform s," by Basel Com m ittee on
Banking Supervision, D ecem ber 2017, by permission of the Bank for
International Settlem ents. Information retrieved from the Bank for
International Settlem ents is freely available at their w ebsite: w w w .b is.o rg .
"The Cyber-Resilient O rganization," by A ndrew Coburn, Eireann Leverett,
and Gordon W oo, reprinted from Solving C yb er Risk: Protecting Your
Com pany and S o cie ty (2019), by permission of John W iley & Sons, Inc.
"Cyber-Resilience: Range of Practices," by Basel Com m ittee on Banking
Supervision, D ecem ber 2018, by permission of the Bank for International
Settlem ents. Information retrieved from the Bank for International
Settlem ents is freely available at their w ebsite: w w w .b is.o rg .
"Building the U K Financial Sector's O perational Resilience," by the Bank
of England and the Financial Conduct Authority, Ju ly 2018, reprinted by
perm ission.
"Striving for O perational Resilience: The Q uestions Boards and Senior
M anagem ent Should A sk ," by Rico Brandenburg, Tom Ivell, Evan Sekeris,
M atthew G rub er and Paul Lewis, 2019, by permission of O liver W ym an.
Learning O bjectives provided by the Global Association of Risk
Professionals.
All tradem arks, service marks, registered tradem arks, and registered
service marks are the property of their respective owners and are used
herein for identification purposes only.
Pearson Education, Inc., 330 Hudson Street, New York, New York 10013
A Pearson Education Com pany
w w w .pearsoned.com
Printed in the United States of Am erica
ScoutAutomatedPrintCode
000200010272205729
EEB /K W
ISBN 10: 0135966000
ISBN 13: 9780135966006
Contents

1.7 Business Resiliency

Chapter 1 Principles for the and Continuity 12
Sound Management 1.8 Role of Disclosure 12
of Operational Risk 1

1.1 Preface 2
Chapter 2 Enterprise Risk
1.2 Role of Supervisors 2
Management:
1.3 Principles for the Management Theory and
of Operational Risk 3
Fundamental Principles of Operational
Practice 13
Risk Management 4
Governance 5
2.1 How Does ERM Create
Risk Management Environment 5
Shareholder Value? 14
Role of Disclosure 5
The Macro Benefits of Risk Management 14
1.4 Fundamental Principles of The Micro Benefits of ERM 15
Operational Risk Management 5
2.2 Determining the Right
1.5 Governance 6 Amount of Risk 16
The Board of Directors 6
2.3 Implementing ERM 20
Senior Management 7
Inventory of Risks 20
1.6 Risk Management Environment 8 Economic Value versus Accounting
Identification and Assessment 8 Performance 21
Monitoring and Reporting 9 Aggregating Risks 22
Control and Mitigation 10 Measuring Risks 24
 Regulatory versusEconomic Capital 24 Section 2 - Key Outstanding
Using Economic Capital to Challenges in Implementing
Make Decisions 25 Risk Appetite Frameworks 41
The Governance of ERM 26
Section 3 - Emerging Sound
Conclusion 26 Practices in Overcoming
the Challenges 43
3.1 Risk Appetite and Risk Culture 44
Chapter 3 What Is ERM? 27 3.2 "Driving Down" the Risk Appetite
into the Businesses 45
3.3 Capturing Different Risk Types 47
3.1 ERM Definitions 28 3.4 The Benefits of Risk Appetite
as a Dynamic Tool 48
3.2 The Benefits of ERM 29 3.5 The Link with the Strategy
Organizational Effectiveness 29 and Business Planning Process 49
Risk Reporting 29 3.6 The Role of Stress Testing
Business Performance 30 within an RAF 52

3.3 The Chief Risk Officer 31 Section 4 - Recommendations

for Firms 55
3.4 Components of ERM 33
Recommendations for Board Directors 55
Corporate Governance 33
Recommendations for Senior
Line Management 33 Management 57
Portfolio Management 34 Recommendations for Risk Management 58
Risk Transfer 34
Annex I: Case Studies 59
Risk Analytics 34
Developing a Risk Appetite Framework
Data and Technology Resources 35 at RBC May 2011 59
Stakeholder Management 35 Risk Appetite within National Australia
Bank: An Ongoing Journey 62
Scotiabank-A Canadian Experience
in Setting Risk Appetite May 2011 68
Chapter 4 Implementing
Risk Appetite Framework Development
Robust Risk at the Commonwealth Bank of Australia 71
Appetite
Frameworks to
Strengthen
Financial Chapter 5 Banking Conduct
Institutions 37 and Culture 77

Introduction 38 Introduction 78
Section 1 - Principal Findings Section 1. Assessment
from the Investigation 39 of Industry Progress 86

iv ■ Contents
 Mindset of Culture 88 External Frauds 120
Senior Accountability and Governance 89 Internal Fraud 120
Performance Management Employment Practices and Workplace
and Incentives 91 Safety 120
Staff Development and Promotions 92 Damage to Physical Assets 121
An Effective Three Lines of Defense 94 7.3 The Elements of the OpRisk
Regulators, Supervisors, Enforcement Framework 121
Authorities, and Industry Standards 95
Internal Loss Data 121
Section 2. Lessons Learned 98 Setting a Collection Threshold
and Possible Impacts 121
Completeness of Database
(Under-Reporting Events) 122
Chapter 6 Risk Culture 105 Recoveries and Near Misses 122
Time Period for Resolution
of Operational Losses 123
6.1 Introduction 106
1

Adding Costs to Losses 123

6.2 What Corporate Culture Provisioning Treatment of Expected
Is and Why It Matters? 106 Operational Losses 123

6.3 Risk Culture: Scope 7.4 Business Environment

and Definition 108 and Internal Control Environment
Factors (BEICFs) 123
6.4 Risk Culture: Drivers
Risk Control Self-Assessment (RCSA) 124
and Effects 109
Key Risk Indicators 125
6.5 Change and Challenge:
J

7.5 External Databases 126

Deploying an Effective
Risk Culture 110 7.6 Scenario Analysis 127
Conclusions 113 7.7 Oprisk Profile in Different
Financial Sectors 129
Bibliography 113
Trading and Sales 129
Corporate Finance 129
Retail Banking 129
Chapter 1 OpRisk Data Insurance 130
and Governance 115 Asset Management 131
Retail Brokerage 132
7.8 Risk Organization
7.1 Introduction 116
and Governance 133
7.2 OpRisk Taxonomy 116 Organization of Risk Departments 133
Execution, Delivery, and Process Structuring a Firm Wide Policy:
Management 117 Example of an OpRisk Policy 134
Clients, Products, and Business Practices 118 Governance 134
Business Disruption and System Failures 119

Contents ■ v
Chapter 8 Supervisory Chapter 9 Information Risk
Guidance on and Data Quality
Model Risk Management 151
Management 137
9.1 Organizational Risk, Business
8.1 Introduction 138 Impacts, and Data Quality 152
Business Impacts of Poor Data Quality 152
8.2 Purpose and Scope 138
Information Flaws 153
8.3 Overview of Model Risk
9.2 Examples 153
Management 138
Employee Fraud and Abuse 153
8.4 Model Development, Underbilling and Revenue Assurance 153
Implementation, and Use 140 Credit Risk 153
Model Development and Insurance Exposure 154
Implementation 140
Development Risk 154
Model Use 141
Compliance Risk 154
8.5 Model Validation 142
9.3 Data Quality Expectations 154
Key Elements of Comprehensive
Validation 143 Accuracy 154
Validation of Vendor and Other Completeness 154
Third-Party Products 146 Consistency 154
Reasonableness 155
8.6 Governance, Policies,
Currency 155
and Controls 146
Uniqueness 155
Board of Directors and Senior
Management 147 Other Dimensions of Data Quality 155
Policies and Procedures 147 9.4 Mapping Business Policies
Roles and Responsibilities 147 to Data Rules 155
Internal Audit 148
9.5 Data Quality Inspection,
External Resources 148 Control, and Oversight:
Model Inventory 149 Operational Data Governance 155
Documentation 149
9.6 Managing Information
Conclusion 149 Risk Via a Data Quality Scorecard 156
Data Quality Issues View 156
Business Process View 157
Business Impact View 157
Managing Scorecard Views 157
Summary 157

vi ■ Contents
 12.3 RAROC: Risk-Adjusted Return
Chapter 10 Validating on Capital 184
Rating Models 159
1

12.4 RAROC for Capital Budgeting 185

12.5 RAROC for Performance
10.1 Validation Profiles 160 Measurement 186
RAROC Horizon 186
10.2 Roles of Internal Validation
Units 161 Default Probabilities: Point-in-Time
(PIT) vs. Through-the-Cycle (TTC) 188
10.3 Qualitative and Confidence Level 188
Quantitative Validation 162 Hurdle Rate and Capital Budgeting
Qualitative Validation 162 Decision Rule 188
Quantitative Validation 166 Diversification and Risk Capital 189
12.6 RAROC in Practice 190
Conclusion 192
Chapter 1 Assessing the
Quality of Risk
Measures 173 Chapter 13 Range of
Practices and
11.1 Model Risk 174 Issues in
Valuation Risk 174 Economic
Variability of VaR Estimates 175 Capital
Mapping Issues 176 Frameworks 193
Case Study: The 2005 Credit
Correlation Episode 176
Case Study: Subprime Default Models 180 13.1 Executive Summary 194
Use of Economic Capital and
Governance 194
Chapter 12 Risk Capital Risk Measures 194
Risk Aggregation 195
Attribution and
Validation 195
Risk-Adjusted Dependency Modelling in Credit Risk 195
Performance Counterparty Credit Risk 196
Measurement 181 Interest Rate Risk in the Banking Book 196
Summary 196

12.1 What Purpose Does Risk 13.2 Recommendations 196

Capital Serve? 182 13.3 Introduction 198
12.2 Emerging Uses of Risk 13.4 Use of Economic Capital
Capital Numbers 182 Measures and Governance 199

Contents ■ vii
 Business-Level Use 199 13.10 Annex 3: Interest Rate
Enterprise-Wide or Group-Level Use 200 Risk in the Banking Book 227
Governance 202 Sources of Interest Rate Risk 227
Supervisory Concerns Relating to Use Interest Rate Measurement
of Economic Capital and Governance 203 Techniques and Indicators 228
13.5 Risk Measures 205 Modelling Issues 229
Desirable Characteristics of Risk Main Challenges for the
Measures 205 Measurement of Interest Rate
Risk in the Banking Book 229
Types of Risk Measures 206
Calculation of Risk Measures 207 References 233
Supervisory Concerns Relating
to Risk Measures 208
13.6 Risk Aggregation 208
Aggregation Framework 208
Chapter 14 Capital Planning
Aggregation Methodologies 209 at Large Bank
Range of Practices in the Choice of Holding
Aggregation Methodology 212 Companies 235
Supervisory Concerns Relating
to Risk Aggregation 213
13.7 Validation of Internal 14.1 Introduction 236
Economic Capital Models 214 14.2 Foundational Risk
What Validation Processes Management 238
Are in Use? 215 Risk Identification 238
What Aspects of Models Does
Validation Cover? 218 14.3 Internal Controls 239
Supervisory Concerns Relating Scope of Internal Controls 239
to Validation 218 Internal Audit 239
13.8 Annex 1: Dependency Independent Model Review and
Validation 240
Modelling in Credit Risk Models 218
Policies and Procedures 240
Types of Models 219
Ensuring Integrity of Results 241
Supervisory Concerns Relating to
Currently Used Credit Portfolio Documentation 241
Models 221 14.4 Governance 241
13.9 Annex 2: Counterparty Board of Directors 241
Credit Risk 223 Board Reporting 242
Counterparty Credit Risk Challenges 223 Senior Management 242
Range of Practices 225 Documenting Decisions 243

viii ■ Contents
 14.5 Capital Policy 243 Modeling Losses 273
Capital Goals and Targets 244 Modeling Revenues 274
Capital Contingency Plan 244 Modeling the Balance Sheet 275
14.6 BHC Scenario Design 245 15.5 Stress Testing Disclosure 275
Scenario Design and Severity 245 Conclusion 278
Variable Coverage 246
Acknowledgments 278
Clear Narratives 246
References 278
14.7 Estimation Methodologies
for Losses, Revenues, and
Expenses 246
General Expectations 246 Chapter 16 Guidance
Loss-Estimation Methodologies 249 on Managing
PPNR Projection Methodologies 257 Outsourcing
14.8 Assessing Capital Risk 281
Adequacy Impact 261
Balance Sheet and RWAs 261
Allowance for Loan and Lease 16.1 Purpose 282
Losses (ALLL) 262
16.2 Risks from the Use
Aggregation of Projections 262
of Service Providers 282
14.9 Concluding Observations 263
16.3 Board of Directors
and Senior Management
Responsibilities 282
Chapter 15 Stress Testing 16.4 Service Provider Risk
Banks 265 Management Programs 282
A. Risk Assessments 283
B. Due Diligence and Selection
Abstract 266 of Service Providers 283
C. Contract Provisions and
15.1 Introduction 266
Considerations 284
15.2 Stress Testing in the D. Incentive Compensation Review 286
Literature 270 E. Oversight and Monitoring
15.3 Stress Testing Design 271 of Service Providers 286
F. Business Continuity
15.4 Executing the Stress and Contingency Considerations 287
Scenario: Losses and Revenues 272 G. Additional Risk Considerations 287

Contents ■ ix
 18.2 Post-Crisis Regulatory
Chapter 17 Management of Changes 297
Risks Associated Uncleared Trades 297
with Money Determination of Initial Margin: SIMM 298
Laundering and 18.3 Impact of the Changes 299
Financing of Liquidity 299
Terrorism 289 Rehypothecation 300
The Convergence of OTC and
Exchange-Traded Markets 300
17.1 Background 290 18.4 CCPS and Bankruptcy 300
17.2 Application of Standard Summary 301
Practices 290
Further Reading 301
17.3 Risk Assessment 291
17.4 Customer Due Diligence
and Acceptance 291
Chapter 19 Capital
17.5 Transaction and Other Regulation
Monitoring and Reporting 291
Before the
17.6 Correspondent Banking 291 Global
17.7 Wire Transfers 292 Financial
17.8 International Scope 292 Crisis 303
References 292
19.1 The Basel Accord:
Basel I Variant 304
Chapter 18 Regulation The Risk-Based Capital Ratio 305
of the OTC 19.2 The Basel Accord:
Derivatives Basel II Variant 309
Market 293 Capital for Credit Risk 310
Retail Exposures Under IRB 312
Credit Mitigants Other Than Collateral 313
18.1 Clearing in O TC Markets 294 Capital for Operational Risk 313
Margin 294 Solvency II 314
Central Clearing 295 Summary 315
Bilateral Clearing 296
Netting 296 References 315
Events of Default 296

x ■ Contents
Chapter 20 Solvency, Chapter 21 High-Level
Liquidity Summary of
and Other Basel III
Regulation Reforms 327
After the
Global
Standardised Approach for
Financial Crisis 317 Credit Risk 328
Internal Ratings-Based
20.1 The Financial Stability Approaches for Credit Risk 331
Board 318 Removing the Use of the Advanced IRB
Approach for Certain Asset Classes 331
20.2 Basel 2.5 318 332
Specification of Input Floors
Stressed VaR 318
Additional Enhancements 332
Incremental Risk Charge 318
Correlations and the Comprehensive CVA Risk Framework 332
Risk Measure 319 Operational Risk Framework 333
20.3 Basel 3 319 Leverage Ratio Framework 333
The Definition of Capital 320 Buffer for Global Systemically
Leverage Ratio Capital Requirements 321 Important Banks 333
Systemically Important Financial Refinements to the Leverage Ratio
Institutions 321 Exposure Measure 334
Buffers 321 Output Floor 334
Liquidity Requirements 323
Transitional Arrangements 335
Derivatives Counterparty Credit Risk 324
20.4 Resolution Planning and
Preparation 324
CoCos 324
Chapter 22 Basel III: Finalising
Living Wills 325 Post-Crisis
Reforms 337
20.5 Stress Testing and Other
Local Applications of Basel 325
20.6 Other Reforms 326 22.1 Introduction 338
References 326 22.2 The Standardised Approach 338

Contents ■ xi
 The Business Indicator 338
The Business Indicator Component 338 Chapter 23 The Cyber-Resilient
The Internal Loss Multiplier 338 Organization 345
The Standardised Approach
Operational Risk Capital
Requirement 339 23.1 Changing Approaches
22.3 Application of the to Risk Management 346
Standardised Approach within Identify, Protect, Detect, Respond,
Recover 346
a Group 339
Threat Analysis 346
22.4 Minimum Standards for
the Use of Loss Data Under 23.2 Incident Response
the Standardised Approach 339 and Crisis Management 346
Real-Time Crisis Management:
22.5 General Criteria on Loss How Fighter Pilots Do It 346
Data Identification, Collection Rapid Adaptation to Changing
and Treatment 340 Conditions 347
22.6 Specific Criteria on Loss Cyber Risk Awareness in Staff 347
Data Identification, Collection Business Continuity Planning
and Treatment 340 and Staff Engagement 347
Building of the Standardised Approach Gaming and Exercises 348
Loss Data Set 340 Nudging Behavior 348
Gross Loss, Net Loss, and Recovery 23.3 Resilience Engineering 348
Definitions 340
Safety Management 348
22.7 Exclusion of Losses from Hotel Keycard Failure Example 349
the Loss Component 341
23.4 Attributes of a
22.8 Exclusions of Divested Cyber-Resilient Organization 349
Activities from the Business Anticipate, Withstand, Recover,
Indicator 342 and Evolve 349
22.9 Inclusion of Losses and Negative Attributes 350
Bl Items Related to Mergers Six Positive Attributes for Resilience 350
and Acquisitions 342 Cyber Resilence Objectives 350

22.10 Disclosure 342 23.5 Incident Response Planning 351

Forensic Investigation 351
22.11 Annex: Definition of
Initial Breach Diagnosis 352
Business Indicator Components 342

xii ■ Contents
 23.6 Resilient Security Solutions 352 24.4 Approaches to Risk
Resilient Software 352 Management, Testing and
Detection, Containment, and Incident Response and Recovery 367
Control 352 Methods for Supervising Cyber-Resilience 368
Minimize Intrusion Dwell Time 353 Information Security Controls Testing and
Anomaly Detection Algorithms 353 Independent Assurance 368
Penetration Testing 354 Response and Recovery Testing and
The Risk-Return Trade-Off 354 Exercising 369
Cyber-Security and Resilience Metrics 370
23.7 Financial Resilience 355
Financial Consequences of a 24.5 Communication and Sharing
Cyber Attack 355 of Information 371
Financial Risk Assessment 355 Overview of Information-Sharing
Frameworks Across Jurisdictions 371
Reverse Stress Testing 355
Sharing Among Banks 373
Defense in Depth 356
Sharing from Banks to Regulators 373
Enterprise Risk Management 356
Sharing Among Regulators 374
Cyber Value at Risk 356
Sharing from Regulators to Banks 375
Re-Simulations of Historical Events 357
Sharing with Security Agencies 375
Counterfactual Analysis 357
Building Back Better 357 24.6 Interconnections with
Events Drive Change 358 Third Parties 377
Education for Cyber Resilience 358 Governance of Third-Party Connections 377
Improving the Cyber Profession 359 Business Continuity and Availability 379
Information Confidentiality and Integrity 380
Specific Expectations and Practices with
Regard to the Visibility of Third-Party
Chapter 24 Cyber-Resilience: Connections 381
Range of Auditing and Testing 381
Practices 361 Resources and Skills 382

24.1 Introduction 362

Chapter 25 Building the
24.2 Cyber-Resilience Standards UK Financial
and Guidelines 363
Sector's
24.3 Cyber-Governance 363 Operational
Cyber-Security Strategy Is Expected
But Not Required 364
Resilience 383
Management Roles and
Responsibilities 365
25.1 Introduction 384
Cyber-Risk Awareness Culture 365
The Importance of Operational
Architecture and Standards 366
Resilience 384
Cyber-Security Workforce 366

Contents ■ xiii
 Important Concepts in the Supervisory Cloud Services 403
Authorities' Approach to Operational Continuity 403
Resilience 384
Economic Functions 403
Discussion Paper Structure 386
Financial Market Infrastructure (FMI) 403
25.2 Operational Resilience General Data Protection Regulation
of Business Services 387 (GDPR) 403
Focusing on Business Services 387 Impact Tolerances 403
Prioritising by Business Services 387 Impact Tolerance Statement 403
Building Resilient Business Services, Integrity 403
Assuming Disruption Will Occur 388 Operational Resilience 403
25.3 Operational Resilience Operational Risk 403
of Firms and FMIs 389 Risk Appetite 403
Factors Relating to the Supervisory Real Economy 403
Authorities' Objectives 390 Real-Time Gross Settlement
Existing Regulatory Requirements and (RTGS) Service 403
Expectations for Firms and FMIs 392 Senior Manager's and Certification
What This Might Mean for Firms and Regime (SM&CR) and Senior Insurance
FMIs in Practice 395 Managers Regime (SIMR) 403
Supervisory Authorities 404
25.4 Clear Outcomes for
Systems and Processes 404
Operational Resilience 397
Vital Services 404
Current Approaches 398
Potential Benefits of Setting Impact
Tolerances 398
25.5 Supervisory Assessment Chapter 26 Striving for
of Operational Resilience 399
Operational
Sector-Wide Work 399
Reviewing How Impact Tolerances Are
Resilience 405
Set and Used 400
Analysis of Systems, People and Processes
that Support Business Services 400 Executive Summary 406
Gaining Assurance that Firms and 26.1 Why Now?: Need for Operational
FMIs Have the Capabilities to Deliver Resilience 406
Operational Resilience 400
Supervisory Tools 401 26.2 Bend, But Don't Break:
Operational Resilience Approach 406
Conclusion 401
26.3 Has the Organization Got It?:
Responses and Next Steps 402
Important Questions to Ask
Feedback and Questions 402 About Operational Resilience 409
Annex 1: Glossary of Terms 402 26.4 Improving Resilience:
Business Services 402 Getting Started 409
Capabilities 402
Bibliography 413
Clearing House Automated Payment
System (CHAPS) 403 Index 417

xiv ■ Contents
Chairman
Dr. Rene Stulz
Everett D. Reese Chair of Banking and M onetary Econom ics,
The Ohio State University

Members
Richard Apostolik Dr. Attilio Meucci, CFA
President and C E O , Global Association of Risk Professionals Founder, ARPM

Michelle McCarthy Beck, SMD Dr. Victor Ng, CFA, MD

C h ief Risk Officer, T IA A Financial Solutions C hief Risk Architect, M arket Risk M anagem ent and Analysis,
Goldm an Sachs
Richard Brandt, MD
O perational Risk M anagem ent, Citigroup Dr. Matthew Pritsker
Senior Financial Econom ist and Policy Advisor / Supervision,
Julian Chen, FRM, SVP
Regulation, and Credit, Federal Reserve Bank of Boston
FRM Program Manager, Global Association of Risk Professionals
Dr. Samantha Roberts, FRM, SVP
Dr. Christopher Donohue, MD
Balance Sheet Analytics & M odeling, PN C Bank
G A R P Benchmarking Initiative, Global Association of Risk
Professionals Dr. Til Schuermann
Partner, O liver Wyman
Donald Edgar, FRM, MD
Risk & Q uantitative Analysis, BlackRock Nick Strange, FCA
Director, Supervisory Risk Specialists, Prudential Regulation
Herve Geny
Authority, Bank of England
Group Head of Internal A udit, London Stock Exchange Group
Dr. Sverrir Porvaldsson, FRM
Keith Isaac, FRM, VP
Senior Q uant, SEB
Capital M arkets Risk M anagem ent, TD Bank Group

William May, SVP

Global Head of Certifications and Educational Program s, Global
Association of Risk Professionals

FRM® Committee ■ xv
 Learning Objectives
A fter com pleting this reading you should be able to:
Describe the three "lines of defense" in the Basel model
for operational risk governance.
Summarize the fundam ental principles of operational risk
m anagem ent as suggested by the Basel Com m ittee.
Explain guidelines for strong governance of operational
risk, and evaluate the role of the board of directors and
senior m anagem ent in implementing an effective opera­
tional risk fram ework.
E x c e rp t is rep rin ted by perm ission from the Basel C om m ittee on Banking Supervision.
Describe tools and processes that can be used to identify
and assess operational risk.
Describe features of an effective control environm ent and
identify specific controls that should be in place to address
operational risk.
Explain the Basel Com m ittee's suggestions for managing
technology risk and outsourcing risk.
1
1.1 PREFA CE
1. In the Soun d Practices for the M anagem ent and Supervision
o f O perational Risk (Sound Practices), published in February
2003, the Basel Com m ittee on Banking Supervision (Com m ittee)
articulated a fram ework of principles for the industry and super­
visors. Subsequently, in the 2006 International C on verg en ce o f
Capital M easurem ent and Capital Standards: A R evised
Fram ew ork— C om prehensive Version (commonly referred to as
"Basel II"), the Com m ittee anticipated that industry sound prac­
tice would continue to evo lve.1 Since then, banks and supervi­
sors have expanded their knowledge and experience in
implementing operational risk m anagem ent fram eworks (Fram e­
work). Loss data collection exercises, quantitative im pact stud­
ies, and range of practice reviews covering governance, data
and modelling issues have also contributed to industry and
supervisory knowledge and the em ergence of sound industry
practice.
2. In response to these changes, the Com m ittee has deter­
mined that the 2003 Sound Practices paper should be updated
to reflect the enhanced sound operational risk m anagem ent
practices now in use by the industry. This docum ent— Principles
for the Sou n d M anagem ent o f O perational Risk and the Role o f
Supervision— incorporates the evolution of sound practice and
details eleven principles of sound operational risk m anagem ent
covering (1) governance, (2) risk m anagem ent environment and
(3) the role of disclosure. By publishing an updated paper, the
Com m ittee enhances the 2003 sound practices fram ework with
specific principles for the m anagem ent of operational risk that
are consistent with sound industry practice. These principles
have been developed through the ongoing exchange of ideas
between supervisors and industry since 2003. Principles for
the Sou n d M anagem ent o f O perational Risk and the Role o f
Supervision replaces the 2003 Sound Practices and becom es the
docum ent that is referenced in paragraph 651 of Basel II.
3. A Fram ew ork for Internal C ontrol System s in Banking O rgan­
isations (Basel Com m ittee, Septem ber 1998) underpins the
Com m ittee's current work in the field of operational risk. The
C ore Principles for Effective Banking Supervision (Basel Com m it­
tee, O ctober 2006) and the C ore Principles M eth o d o lo g y (Com ­
m ittee, O ctober 2006), both for supervisors, and the principles
identified by the Com m ittee in the second pillar (supervisory
review process) of Basel II are also im portant reference tools
1 Basel Com m ittee on Banking Supervision, International C o n verg en ce
o f Capital M easu rem en t and Capital Standards: A R evised Fram ew ork—
C om prehen sive Version, Section V (O perational Risk), paragraph 646,
Basel, Ju n e 2006.
2 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
that banks should consider when designing operational risk poli­
cies, processes and risk m anagem ent system s.
4. Supervisors will continue to encourage banks "to move along
the spectrum of available approaches as they develop more
sophisticated operational risk m easurem ent system s and prac­
tic e s ."23Consequently, while this chapter articulates principles
from emerging sound industry practice, supervisors expect
banks to continuously improve their approaches to operational
risk m anagem ent. In addition, this chapter addresses key ele­
ments of a bank's Fram ework. These elem ents should not be
viewed in isolation but should be integrated com ponents of the
overall fram ework for managing operational risk across the
enterprise.
5. The Com m ittee believes that the principles outlined in this
chapter establish sound practices relevant to all banks. The
Com m ittee intends that when implementing these principles, a
bank will take account of the nature, size, com plexity and risk
profile of its activities.
1.2 ROLE O F SUPERVISORS
6. Supervisors conduct, directly or indirectly, regular indepen­
dent evaluations of a bank's policies, processes and systems
related to operational risk as part of the assessm ent of the
Fram ework. Supervisors ensure that there are appropriate
mechanisms in place which allow them to remain apprised of
developm ents at a bank.
7. Supervisory evaluations of operational risk include all the
areas described in the principles for the m anagem ent of opera­
tional risk. Supervisors also seek to ensure that, where banks are
part of a financial group, there are processes and procedures in
place to ensure that operational risk is managed in an appropri­
ate and integrated manner across the group. In performing this
assessm ent, cooperation and exchange of information with
other supervisors, in accordance with established procedures,
may be necessary. Some supervisors may choose to use exter­
nal auditors in these assessm ent processes.4*
2 B C B S (2006), paragraph 646.
3 Refer to the Com m ittee's papers H igh-level prin ciples fo r the
cro ss-b o rd er im plem entation o f the N ew A cco rd , August 2003, and
Principles fo r hom e-host su p erviso ry cooperation and allocation m echa­
nisms in the co n te x t o f A d v a n ce d M easu rem en t A p p ro a ch e s (A M A ),
N ovem ber 2007.
4 For further discussion, see the Com m ittee's paper The relation­
ship b etw een banking su p erviso rs and bank's external auditors,
January 2002.
8. Deficiencies identified during the supervisory review may be
addressed through a range of actions. Supervisors use the tools
most suited to the particular circum stances of the bank and its
operating environment. In order that supervisors receive cur­
rent information on operational risk, they may wish to establish
reporting mechanisms directly with banks and external auditors
(e.g ., internal bank m anagem ent reports on operational risk
could be made routinely available to supervisors).
9. Supervisors continue to take an active role in encouraging
ongoing internal developm ent efforts by monitoring and evalu­
ating a bank's recent im provem ents and plans for prospective
developm ents. These efforts can then be com pared with those
of other banks to provide the bank with useful feedback on
the status of its own work. Further, to the extent that there are
identified reasons why certain developm ent efforts have proven
ineffective, such information could be provided in general terms
to assist in the planning process.
1.3 PRINCIPLES FOR THE
M AN AGEM EN T O F OPERATIONAL
RISK
10. Operational risk5 is inherent in all banking products, activi­
ties, processes and system s, and the effective m anagem ent of
operational risk has always been a fundam ental elem ent of a
bank's risk m anagem ent program m e. As a result, sound opera­
tional risk m anagem ent is a reflection of the effectiveness of the
board and senior m anagem ent in administering its portfolio of
products, activities, processes, and system s. The Com m ittee,
through the publication of this chapter, desires to promote and
enhance the effectiveness of operational risk m anagem ent
throughout the banking system.
11. Risk management generally encompasses the process of
identifying risks to the bank, measuring exposures to those risks
(where possible), ensuring that an effective capital planning and
monitoring programme is in place, monitoring risk exposures and
corresponding capital needs on an ongoing basis, taking steps to
control or mitigate risk exposures and reporting to senior man­
agem ent and the board on the bank's risk exposures and capital
positions. Internal controls are typically em bedded in a bank's
day-to-day business and are designed to ensure, to the extent
possible, that bank activities are efficient and effective, informa­
tion is reliable, timely and com plete and the bank is compliant
5 O perational risk is defined as the risk of loss resulting from inadequate
or failed internal processes, people and system s or from external
events. This definition includes legal risk, but excludes strategic and
reputational risk.
Chapter 1 Principles for the Sound Management of Operational Risk
with applicable laws and regulation. In practice, the two notions
are in fact closely related and the distinction between both is less
important than achieving the objectives of each.
12. Sound internal governance forms the foundation of an effec­
tive operational risk m anagem ent Fram ework. Although internal
governance issues related to the m anagem ent of operational
risk are not unlike those encountered in the m anagem ent of
credit or m arket risk operational risk m anagem ent challenges
may differ from those in other risk areas.
13. The Com m ittee is seeing sound operational risk governance
practices adopted in an increasing number of banks. Common
industry practice for sound operational risk governance often
relies on three lines of defence— (i) business line managem ent,
(ii) an independent corporate operational risk m anagem ent func­
tion and (iii) an independent review.6 Depending on the bank's
nature, size and com plexity, and the risk profile of a bank's activ­
ities, the degree of form ality of how these three lines of defence
are im plem ented will vary. In all cases, however, a bank's opera­
tional risk governance function should be fully integrated into
the bank's overall risk m anagem ent governance structure.
14. In the industry practice, the first line of defence is busi­
ness line m anagem ent. This means that sound operational risk
governance will recognise that business line m anagem ent is
responsible for identifying and managing the risks inherent in
the products, activities, processes and systems for which it is
accountable.
15. A functionally independent corporate operational risk func­
tion (C O R F)7*is typically the second line of defence, generally
6 A s discussed in the Com m ittee's paper O perational Risk— Sup ervisory
G uidelines fo r the A d v a n ce d M easu rem en t A p p ro a ch es, Ju n e 2011,
independent review includes the following com ponents:
Verification of the Fram ew ork is done on a periodic basis and is typi­
cally conducted by the bank's internal and/or external audit, but may
involve other suitably qualified independent parties from external
sources. Verification activities test the effectiveness of the overall Fram e­
w ork, consistent with policies approved by the board of directors, and
also test validation processes to ensure they are independent and im ple­
m ented in a manner consistent with established bank policies.
Validation ensures that the quantification system s used by the bank
are sufficiently robust and provides assurance of the integrity of inputs,
assum ptions, processes and outputs. Specifically, the independent
validation process should provide enhanced assurance that the risk
m easurem ent m ethodology results in an operational risk capital charge
that credibly reflects the operational risk profile of the bank. In addition
to the quantitative aspects of internal validation, the validation of data
inputs, m ethodology and outputs of operational risk m odels is im portant
to the overall process.
7 In many jurisdictions, the independent corporate operational risk func­
tion is known as the corporate operational risk m anagem ent function.
■ 3
com plem enting the business line's operational risk m anagem ent
activities. The degree of independence of the C O R F will differ
among banks. For small banks, independence may be achieved
through separation of duties and independent review of pro­
cesses and functions. In larger banks, the C O R F will have a
reporting structure independent of the risk generating business
lines and will be responsible for the design, m aintenance and
ongoing developm ent of the operational risk fram ework within
the bank. This function may include the operational risk m ea­
surem ent and reporting processes, risk com m ittees and respon­
sibility for board reporting. A key function of the C O R F is to
challenge the business lines' inputs to, and outputs from, the
bank's risk m anagem ent, risk m easurem ent and reporting sys­
tem s. The C O R F should have a sufficient number of personnel
skilled in the m anagem ent of operational risk to effectively
address its many responsibilities.
16. The third line of defence is an independent review and
challenge of the bank's operational risk m anagem ent controls,
processes and system s. Those performing these reviews must
be com petent and appropriately trained and not involved in the
developm ent, implementation and operation of the Fram ework.
This review may be done by audit or by staff independent of the
process or system under review, but may also involve suitably
qualified external parties.
17. If operational risk governance utilises the three lines of
defence model, the structure and activities of the three lines
often varies, depending on the bank's portfolio of products,
activities, processes and system s; the bank's size; and its risk
m anagem ent approach. A strong risk culture and good com m u­
nication among the three lines of defence are im portant charac­
teristics of good operational risk governance.
18. Internal audit co verag e should be adequate to in d ep en­
dently verify that the Fram ew ork has been im plem ented as
intended and is functioning e ffe c tiv e ly .8 W here audit activities
are outsourced, senior m anagem ent should consider the
effectiveness of the underlying arrangem ents and the su itab il­
ity of relying on an outsourced audit function as the third line
of d efen ce.
19. Internal audit coverage should include opining on the
overall appropriateness and adequacy of the Fram ework and
the associated governance processes across the bank. Internal
audit should not simply be testing for com pliance with board
approved policies and procedures, but should also be evaluat­
ing whether the Fram ework meets organisational needs and
8 The Com m ittee's paper, Internal A u d it in Banks and the Supervisor's
Relationship with A u d ito rs, August 2001, describes the role of internal
and external audit.
4 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
supervisory expectations. For exam ple, while internal audit
should not be setting specific risk appetite or tolerance, it
should review the robustness of the process of how these lim­
its are set and why and how they are adjusted in response to
changing circum stances.
20. Because operational risk m anagem ent is evolving and the
business environm ent is constantly changing, m anagem ent
should ensure that the Fram ework's policies, processes and
system s remain sufficiently robust. Im provem ents in operational
risk m anagem ent will depend on the degree to which opera­
tional risk m anagers' concerns are considered and the w illing­
ness of senior m anagem ent to act prom ptly and appropriately
on their warnings.
Fundamental Principles of Operational
Risk Management
Principle 1: The board of directors should take the lead in
establishing a strong risk m anagem ent culture. The board of
directors and senior m anagem ent9 should establish a corporate
culture that is guided by strong risk m anagem ent and that sup­
ports and provides appropriate standards and incentives for
professional and responsible behaviour. In this regard, it is the
responsibility of the board of directors to ensure that a strong
operational risk m anagem ent culture10 exists throughout the
whole organisation.
Principle 2: Banks should develop, im plem ent and maintain a
Fram ework that is fully integrated into the bank's overall risk
m anagem ent processes. The Fram ework for operational risk
m anagem ent chosen by an individual bank will depend on
a range of factors, including its nature, size, com plexity and
risk profile.
9 This chapter refers to a m anagem ent structure com posed of a board
of directors and senior m anagem ent. The Com m ittee is aware that there
are significant differences in legislative and regulatory fram ew orks across
countries as regards the functions of the board of directors and senior
m anagem ent. In some countries, the board has the main, if not exclu­
sive, function of supervising the executive body (senior m anagem ent,
general m anagem ent) so as to ensure that the latter fulfils its tasks.
For this reason, in som e cases, it is known as a supervisory board. This
means that the board has no executive functions. In other countries, the
board has a broader com petence in that it lays down the general fram e­
work for the m anagem ent of the bank. Owing to these differences, the
term s "board of directors" and "senior m anagem ent" are used in this
chapter not to identify legal constructs but rather to label two decision­
making functions within a bank.
10 Internal operational risk culture is taken to mean the com bined set of
individual and corporate values, attitudes, com petencies and behaviour
that determ ine a firm's com m itm ent to and style of operational risk
m anagem ent.
Governance11
The Board of Directors
Principle 3: The board of directors should establish, approve
and periodically review the Fram ework. The board of directors
should oversee senior m anagem ent to ensure that the policies,
processes and system s are im plem ented effectively at all deci­
sion levels.
Principle 4: The board of directors should approve and review a
risk appetite and tolerance statem ent1
12*for operational risk that
1 Business Resiliency and Continuity
articulates the nature, types, and levels of operational risk that
the bank is willing to assume.
Senior Management
Principle 5: Senior m anagem ent should develop for approval by
the board of directors a clear, effective and robust governance
structure with well defined, transparent and consistent lines of
responsibility. Senior m anagem ent is responsible for consistently
implementing and maintaining throughout the organisation poli­
cies, processes and systems for managing operational risk in all
of the bank's material products, activities, processes and sys­
tem s consistent with the risk appetite and tolerance.
Risk Management Environment
Identification and Assessment
Principle 6: Senior m anagem ent should ensure the identification
and assessm ent of the operational risk inherent in all material
products, activities, processes and system s to make sure the
inherent risks and incentives are well understood.
Principle 7: Senior m anagem ent should ensure that there is an
approval process for all new products, activities, processes and
system s that fully assesses operational risk.
Monitoring and Reporting
Principle 8: Senior m anagem ent should im plem ent a process to
regularly monitor operational risk profiles and material exp o­
sures to losses. Appropriate reporting mechanisms should be in
11 See also the Com m ittee's Principles fo r enhancing co rp o ra te g o ver­
nance, O cto b er 2010.
12 "Risk ap p etite" is a high level determ ination of how much risk a firm is
willing to accept taking into account the risk/return attributes; it is often
taken as a forward looking view of risk acceptance. "Risk to lerance" is
a more specific determ ination of the level of variation a bank is willing
to accept around business objectives that is often considered to be the
amount of risk a bank is prepared to accept. In this docum ent the term s
are used synonym ously.
Chapter 1 Principles for the Sound Management of Operational Risk
place at the board, senior m anagem ent, and business line levels
that support proactive m anagem ent of operational risk.
Control and Mitigation
Principle 9: Banks should have a strong control environ­
ment that utilises policies, processes and system s; appropri­
ate internal controls; and appropriate risk mitigation and/or
transfer strategies.
Principle 10: Banks should have business resiliency and continu­
ity plans in place to ensure an ability to operate on an ongoing
basis and limit losses in the event of severe business disruption.
Role of Disclosure
Principle 11: A bank's public disclosures should allow stakehold­
ers to assess its approach to operational risk m anagem ent.
1.4 FUNDAM ENTAL PRINCIPLES O F
OPERATION AL RISK M AN AGEM EN T
Principle 1: The board of directors should take the lead in
establishing a strong risk management culture. The board
of directors and senior management should establish a cor­
porate culture that is guided by strong risk management
and that supports and provides appropriate standards and
incentives for professional and responsible behaviour. In this
regard, it is the responsibility of the board of directors to
ensure that a strong operational risk management culture
exists throughout the whole organisation.
21. Banks with a strong culture of risk m anagem ent and ethi­
cal business practices are less likely to experience potentially
damaging operational risk events and are better placed to deal
effectively with those events that do occur. The actions of the
board and senior m anagem ent, and policies, processes and
system s provide the foundation for a sound risk m anagem ent
culture.
22. The board should establish a code of conduct or an ethics
policy that sets clear expectations for integrity and ethical values
of the highest standard and identify acceptable business prac­
tices and prohibited conflicts. Clear expectations and account­
abilities ensure that bank staff understand their roles and
responsibilities for risk, as well as their authority to act. Strong
and consistent senior m anagem ent support for risk m anage­
ment and ethical behaviour convincingly reinforces codes of
conduct and ethics, com pensation strategies, and training
■ 5
program m es. Com pensation policies should be aligned to the
bank's statem ent of risk appetite and tolerance, long-term stra­
tegic direction, financial goals and overall safety and soundness.
A Q
They should also appropriately balance risk and reward.
23. Senior m anagem ent should ensure that an appropriate level
of operational risk training is available at all levels throughout
the organisation. Training that is provided should reflect the
seniority, role and responsibilities of the individuals for whom it
is intended.
Principle 2: Banks should develop, implement and maintain a
Framework that is fully integrated into the bank's overall risk
management processes. The Framework for operational risk
management chosen by an individual bank will depend on a
range of factors, including its nature, size, complexity and
risk profile.
24. The fundam ental premise of sound risk m anagem ent is that
the board of directors and bank m anagem ent understand the
nature and com plexity of the risks inherent in the portfolio of
bank products, services and activities. This is particularly impor­
tant for operational risk, given that operational risk is inherent in
all business products, activities, processes and system s.
25. A vital means of understanding the nature and com plexity
of operational risk is to have the com ponents of the Fram ework
fully integrated into the overall risk m anagem ent processes of
the bank. The Fram ework should be appropriately integrated
into the risk m anagem ent processes across all levels of the
organisation including those at the group and business line lev­
els, as well as into new business initiatives' products, activities,
processes and system s. In addition, results of the bank's opera­
tional risk assessm ent should be incorporated into the overall
bank business strategy developm ent processes.
26. The Fram ework should be com prehensively and appropri­
ately docum ented in board of directors approved policies and
should include definitions of operational risk and operational
loss. Banks that do not adequately describe and classify opera­
tional risk and loss exposure may significantly reduce the effec­
tiveness of their Fram ework.
27. Fram ework documentation should clearly:
a. identify the governance structures used to manage opera­
tional risk, including reporting lines and accountabilities;
b. describe the risk assessm ent tools and how they are used;
13 See also: the C om m ittee's R e p o rt on the range o f m e th o d o lo g ies for
the risk and perform an ce alignm ent o f rem uneration, May 2011; the
Financial Stability Forum's Principles fo r so u n d com pensation practices,
April 2009; and the Financial Stability Board's FSB principles fo r so u n d
com pensation p ra ctices— im plem entation standards, Septem ber 2009.
6 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
c. describe the bank's accepted operational risk appetite and
tolerance, as well as thresholds or limits for inherent and
residual risk, and approved risk mitigation strategies and
instruments;
d. describe the bank's approach to establishing and moni­
toring thresholds or limits for inherent and residual risk
exposure;
e. establish risk reporting and M anagem ent Information Sys­
tem s (MIS);
f. provide for a common taxonom y of operational risk terms
to ensure consistency of risk identification, exposure rating
and risk m anagem ent objectives14;
g. provide for appropriate independent review and assess­
ment of operational risk; and
h. require the policies to be reviewed w henever a material
change in the operational risk profile of the bank occurs,
and revised as appropriate.
1.5 G O V ER N A N CE
The Board of Directors
Principle 3: The board of directors should establish, approve
and periodically review the Framework. The board of direc­
tors should oversee senior management to ensure that the
policies, processes and systems are implemented effectively
at all decision levels.
28. The board of directors should:
a. establish a m anagem ent culture, and supporting processes,
to understand the nature and scope of the operational
risk inherent in the bank's strategies and activities, and
develop com prehensive, dynamic oversight and control
environments that are fully integrated into or coordinated
with the overall fram ework for managing all risks across
the enterprise;
b. provide senior m anagem ent with clear guidance and direc­
tion regarding the principles underlying the Fram ework
and approve the corresponding policies developed by
senior m anagem ent;
c. regularly review the Fram ework to ensure that the bank has
identified and is managing the operational risk arising from
external market changes and other environmental factors,
14 An inconsistent taxonom y of operational risk term s may increase the
likelihood of failing to identify and categorise risks, or allocate responsi­
bility for the assessm ent, monitoring, control and mitigation of risks.
 as well as those operational risks associated with new prod­
ucts, activities, processes or system s, including changes in
risk profiles and priorities (e.g ., changing business volumes);
d. ensure that the bank's Fram ework is subject to effective
independent review by audit or other appropriately trained
parties; and
e. ensure that as best practice evolves m anagem ent is availing
them selves of these ad vances.15
29. Strong internal controls are a critical aspect of operational
risk m anagem ent, and the board of directors should establish
clear lines of m anagem ent responsibility and accountability for
implementing a strong control environm ent. The control envi­
ronment should provide appropriate independence/separation
of duties between operational risk m anagem ent functions, busi­
ness lines and support functions.
Principle 4: The board of directors should approve and
review a risk appetite and tolerance statement for opera­
tional risk that articulates the nature, types and levels of
operational risk that the bank is willing to assume.
30. W hen approving and reviewing the risk appetite and toler­
ance statem ent, the board of directors should consider all rel­
evant risks, the bank's level of risk aversion, its current financial
condition and the bank's strategic direction. The risk appetite
and tolerance statem ent should encapsulate the various opera­
tional risk appetites within a bank and ensure that they are
consistent. The board of directors should approve appropriate
thresholds or limits for specific operational risks, and an overall
operational risk appetite and tolerance.
31. The board of directors should regularly review the appropri­
ateness of limits and the overall operational risk appetite and
tolerance statem ent. This review should consider changes in the
external environm ent, material increases in business or activity
volum es, the quality of the control environm ent, the effective­
ness of risk m anagem ent or mitigation strategies, loss exp eri­
ence, and the frequency, volume or nature of limit breaches.
The board should monitor m anagem ent adherence to the risk
appetite and tolerance statem ent and provide for tim ely d etec­
tion and remediation of breaches.
Senior Management
Principle 5: Senior management should develop for approval
by the board of directors a clear, effective and robust
15 See the Com m ittee's 2006 International C o n verg en ce o f Capital M ea ­
surem en t and Capital Standards: A R evised Fram ew ork— C o m p reh en ­
sive Version; paragraph 718(xci).
Chapter 1 Principles for the Sound Management of Operational Risk
governance structure with well defined, transparent and
consistent lines of responsibility. Senior management is
responsible for consistently implementing and maintaining
throughout the organisation policies, processes and systems
for managing operational risk in all of the bank's material
products, activities, processes and systems consistent with
the risk appetite and tolerance.
32. Senior m anagem ent is responsible for establishing and
maintaining robust challenge mechanisms and effective issue-
resolution processes. These should include system s to report,
track and, when necessary, escalate issues to ensure resolu­
tion. Banks should be able to dem onstrate that the three
lines of defence approach is operating satisfactorily and to
explain how the board and senior m anagem ent ensure that this
approach is im plem ented and operating in an appropriate and
acceptable manner.
33. Senior m anagem ent should translate the operational
risk m anagem ent Fram ew ork established by the board of
directors into sp ecific policies and procedures th at can be
im plem ented and verified within the different business units.
Senior m anagem ent should clearly assign authority, resp o nsi­
bility and reporting relationships to encourage and maintain
acco untab ility, and to ensure that the necessary resources are
available to m anage operational risk in line within the bank's
risk ap p etite and to leran ce statem ent. M oreover, senior
m anagem ent should ensure that the m anagem ent oversight
process is ap p ro p riate for the risks inherent in a business
unit's activity.
34. Senior m anagem ent should ensure that staff responsible for
managing operational risk coordinate and com m unicate effec­
tively with staff responsible for managing credit, m arket, and
other risks, as well as with those in the bank who are responsible
for the procurem ent of external services such as insurance risk
transfer and outsourcing arrangem ents. Failure to do so could
result in significant gaps or overlaps in a bank's overall risk man­
agem ent program m e.
35. The managers of the C O R F should be of sufficient stature
within the bank to perform their duties effectively, ideally evi­
denced by title com m ensurate with other risk m anagem ent
functions such as credit, market and liquidity risk.
36. Senior m anagem ent should ensure that bank activities
are conducted by staff with the necessary exp erien ce, tech n i­
cal capabilities and access to resources. Staff responsible for
m onitoring and enforcing com pliance with the institution's
risk policy should have authority independent from the units
they oversee.
37. A bank's governance structure should be com m ensurate
with the nature, size, com plexity and risk profile of its activities.
■ 7
When designing the operational risk governance structure, a
bank should take the following into consideration:
a. Com m ittee structure— Sound industry practice for larger
and more com plex organisations with a central group func­
tion and separate business units is to utilise a board-created
enterprise level risk com m ittee for overseeing all risks,
to which a m anagem ent level operational risk com m ittee
reports. Depending on the nature, size and com plexity of
the bank, the enterprise level risk com m ittee may receive
input from operational risk com m ittees by country, business
or functional area. Sm aller and less com plex organisations
may utilise a flatter organisational structure that oversees
operational risk directly within the board's risk m anagem ent
com m ittee;
b. Com m ittee com position— Sound industry practice is for
operational risk com m ittees (or the risk com m ittee in
sm aller banks) to include a combination of members with
expertise in business activities and financial, as well as inde­
pendent risk m anagem ent. Com m ittee mem bership can
also include independent non-executive board m em bers,
which is a requirem ent in some jurisdictions; and
c. Com m ittee operation— Com m ittee m eetings should
be held at appropriate frequencies with adequate time
and resources to perm it productive discussion and
decision-m aking. Records of com m ittee operations
should be adequate to perm it review and evaluation of
com m ittee effectiveness.
1.6 RISK M AN AGEM EN T
ENVIRON M EN T
Identification and Assessment
Principle 6: Senior management should ensure the identifica­
tion and assessment of the operational risk inherent in all
material products, activities, processes and systems to make
sure the inherent risks and incentives are well understood.
38. Risk identification and assessm ent are fundamental charac­
teristics of an effective operational risk m anagem ent system.
A /
Effective risk identification considers both internal factors
external facto rs.1
17 Sound risk assessm ent allows the bank to
6 reveal individual risks, risk interdependencies, and areas of
16 For exam ple, the bank's structure, the nature of the bank's activities,
the quality of the bank's human resources, organisational changes and
em ployee turnover.
17 For exam ple, changes in the broader environm ent and the industry
and advances in technology.
8 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
better understand its risk profile and allocate risk m anagem ent
resources and strategies most effectively.
39. Exam ples of tools that may be used for identifying and
assessing operational risk include:
a. Audit Findings: W hile audit findings primarily focus on con­
trol weaknesses and vulnerabilities, they can also provide
insight into inherent risk due to internal or external factors.
b. Internal Loss Data Collection and Analysis: Internal opera­
tional loss data provides meaningful information for assess­
ing a bank's exposure to operational risk and the
effectiveness of internal controls. Analysis of loss events can
provide insight into the causes of large losses and informa­
tion on whether control failures are isolated or system atic.18
Banks may also find it useful to capture and monitor opera­
tional risk contributions to credit and market risk related
losses in order to obtain a more com plete view of their
operational risk exposure;
c. External Data Collection and Analysis: External data ele­
ments consist of gross operational loss amounts, dates,
recoveries, and relevant causal information for operational
loss events occurring at organisations other than the bank.
External loss data can be com pared with internal loss data,
or used to explore possible weaknesses in the control envi­
ronment or consider previously unidentified risk exposures;
d. Risk Assessm ents: In a risk assessm ent, often referred to
as a Risk Self Assessm ent (RSA), a bank assesses the pro­
cesses underlying its operations against a library of poten­
tial threats and vulnerabilities and considers their potential
impact. A similar approach, Risk Control Self Assessm ents
(RCSA), typically evaluates inherent risk (the risk before con­
trols are considered), the effectiveness of the control envi­
ronment, and residual risk (the risk exposure after controls
are considered). Scorecards build on RCSAs by weighting
residual risks to provide a means of translating the RCSA
output into metrics that give a relative ranking of the con­
trol environment;
e. Business Process M apping: Business process mappings
identify the key steps in business processes, activities and
organisational functions. They also identify the key risk
points in the overall business process. Process maps can
and
control or risk m anagem ent weakness. They also can help
prioritise subsequent m anagem ent action;
18 M apping internal loss data, particularly in larger banks, to the Level 1
business lines and loss event types defined in A nnexes 8 and 9 of the
2006 Basel II docum ent can facilitate com parison with external loss data.
 f. Risk and Perform ance Indicators: Risk and perform ance indi­
cators are risk metrics and/or statistics that provide insight
into a bank's risk exposure. Risk indicators, often referred to
as Key Risk Indicators (KRIs), are used to monitor the main
drivers of exposure associated with key risks. Perform ance
indicators, often referred to as Key Perform ance Indicators
(KPIs), provide insight into the status of operational pro­
cesses, which may in turn provide insight into operational
w eaknesses, failures, and potential loss. Risk and perfor­
mance indicators are often paired with escalation triggers
to warn when risk levels approach or exceed thresholds or
limits and prompt mitigation plans;
g. Scenario Analysis: Scenario analysis is a process of obtaining
expert opinion of business line and risk managers to identify
potential operational risk events and assess their potential
outcom e. Scenario analysis is an effective tool to consider
potential sources of significant operational risk and the
need for additional risk m anagem ent controls or mitigation
solutions. Given the subjectivity of the scenario process,
a robust governance fram ework is essential to ensure the
integrity and consistency of the process;
h. M easurem ent: Larger banks may find it useful to quantify
their exposure to operational risk by using the output of the
risk assessm ent tools as inputs into a model that estim ates
operational risk exposure. The results of the model can be
used in an econom ic capital process and can be allocated
to business lines to link risk and return; and
i. Com parative Analysis: Com parative analysis consists of
comparing the results of the various assessm ent tools to
provide a more com prehensive view of the bank's opera­
tional risk profile. For exam ple, comparison of the fre­
quency and severity of internal data with RCSAs can help
the bank determ ine whether self assessm ent processes are
functioning effectively. Scenario data can be com pared to
internal and external data to gain a better understanding of
the severity of the bank's exposure to potential risk events.
40. The bank should ensure that the internal pricing and per­
form ance m easurem ent mechanisms appropriately take into
account operational risk. W here operational risk is not consid­
ered, risk-taking incentives might not be appropriately aligned
with the risk appetite and tolerance.
Principle 7: Senior management should ensure that there
is an approval process for all new products, activities, pro­
cesses and systems that fully assesses operational risk.
41. In general, a bank's operational risk exposure is increased
when a bank engages in new activities or develops new prod­
ucts; enters unfamiliar m arkets; implements new business pro­
cesses or technology system s; and/or engages in businesses
Chapter 1 Principles for the Sound Management of Operational Risk
that are geographically distant from the head office. Moreover,
the level of risk may escalate when new products activities, pro­
cesses, or system s transition from an introductory level to a level
that represents material sources of revenue or business-critical
operations. A bank should ensure that its risk m anagem ent con­
trol infrastructure is appropriate at inception and that it keeps
pace with the rate of growth of, or changes to, products activi­
ties, processes and system s.
42. A bank should have policies and procedures that address
the process for review and approval of new products, activi­
ties, processes and system s. The review and approval process
should consider:
a. inherent risks in the new product, service, or activity;
b. changes to the bank's operational risk profile and appetite
and tolerance, including the risk of existing products or
activities;
c. the necessary controls, risk m anagem ent processes, and risk
mitigation strategies;
d. the residual risk;
e. changes to relevant risk thresholds or limits; and
f. the procedures and metrics to measure, monitor, and man­
age the risk of the new product or activity.
The approval process should also include ensuring that appro­
priate investm ent has been made for human resources and
technology infrastructure before new products are introduced.
The implementation of new products, activities, processes and
system s should be monitored in order to identify any material
differences to the expected operational risk profile, and to man­
age any unexpected risks.
Monitoring and Reporting
Principle 8: Senior management should implement a process
to regularly monitor operational risk profiles and material
exposures to losses. Appropriate reporting mechanisms
should be in place at the board, senior management, and
business line levels that support proactive management of
operational risk.
43. Banks are encouraged to continuously improve the quality of
operational risk reporting. A bank should ensure that its reports
are com prehensive, accurate, consistent and actionable across
business lines and products. Reports should be m anageable
in scope and volum e; effective decision making is im peded by
both excessive amounts and paucity of data.
44. Reporting should be tim ely and a bank should be able to
produce reports in both normal and stressed market conditions.
■ 9
The frequency of reporting should reflect the risks involved and
the pace and nature of changes in the operating environment.
The results of monitoring activities should be included in regular
m anagem ent and board reports, as should assessm ents of the
Fram ework perform ed by the internal audit and/or risk m anage­
ment functions. Reports generated by (and/or for) supervisory
authorities should also be reported internally to senior m anage­
ment and the board, where appropriate.
45. Operational risk reports may contain internal financial, opera­
tional, and compliance indicators, as well as external market or
environmental information about events and conditions that are rel­
evant to decision making. Operational risk reports should include:
a. breaches of the bank's risk appetite and tolerance state­
ment, as well as thresholds or limits;
b. details of recent significant internal operational risk events
and losses; and
c. relevant external events and any potential impact on the
bank and operational risk capital.
46. Data capture and risk reporting processes should be ana­
lysed periodically with a view to continuously enhancing risk
m anagem ent perform ance as well as advancing risk m anage­
ment policies, procedures and practices.
Control and Mitigation
Principle 9: Banks should have a strong control environment
that utilises policies, processes and systems; appropriate
internal controls; and appropriate risk mitigation and/or
transfer strategies.
47. Internal controls should be designed to provide reasonable
assurance that a bank will have efficient and effective opera­
tions; safeguard its assets; produce reliable financial reports; and
comply with applicable laws and regulations. A sound internal
control programme consists of five com ponents that are integral
to the risk m anagem ent process: control environm ent, risk
assessm ent, control activities, information and com munication,
and monitoring activities.19
48. Control processes and procedures should include a system
for ensuring com pliance with policies. Exam ples of principle ele­
ments of a policy com pliance assessm ent include:
a. top-level reviews of progress towards stated objectives;
b. verifying com pliance with m anagem ent controls;
19 The Com m ittee's paper Fram ew ork fo r Internal C ontrol System s in
Banking O rganisations, Septem ber 1998, discusses internal controls in
greater detail.
10 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
c. review of the treatm ent and resolution of instances of
non-compliance;
d. evaluation of the required approvals and authorisations to
ensure accountability to an appropriate level of m anage­
ment; and
e. tracking reports for approved exceptions to thresholds or
limits, m anagem ent overrides and other deviations from
policy.
49. An effective control environm ent also requires appropriate
segregation of duties. Assignm ents that establish conflicting
duties for individuals or a team without dual controls or other
counterm easures may enable concealm ent of losses, errors or
other inappropriate actions. Therefore, areas of potential con­
flicts of interest should be identified, minimised, and be subject
to careful independent monitoring and review.
50. In addition to segregation of duties and dual control, banks
should ensure that other traditional internal controls are in place
as appropriate to address operational risk. Exam ples of these
controls include:
a. clearly established authorities and/or processes for
approval;
b. close monitoring of adherence to assigned risk thresholds
or limits;
c. safeguards for access to, and use of, bank assets and records;
d. appropriate staffing level and training to maintain expertise;
e. ongoing processes to identify business lines or products
where returns appear to be out of line with reasonable
expectations;20
f. regular verification and reconciliation of transactions and
accounts; and
g. a vacation policy that provides for officers and em ployees
being absent from their duties for a period of not less than
two consecutive weeks.
51. Effective use and sound implementation of technology
can contribute to the control environm ent. For exam ple, auto­
mated processes are less prone to error than manual processes.
However, autom ated processes introduce risks that must be
addressed through sound technology governance and infra­
structure risk m anagem ent programmes.
52. The use of technology related products, activities, processes
and delivery channels exposes a bank to strategic, operational,
20 For exam ple, where a supposedly low risk, low margin trading activity
generates high returns that could call into question w hether such returns
have been achieved as a result of an internal control breach.
and reputational risks and the possibility of material financial
loss. Consequently, a bank should have an integrated approach
to identifying, measuring, monitoring and managing technology
risks. Sound technology risk m anagem ent uses the same pre­
cepts as operational risk m anagem ent and includes:
a. governance and oversight controls that ensure technology,
including outsourcing arrangem ents, is aligned with and
supportive of the bank's business objectives;
b. policies and procedures that facilitate identification and
assessm ent of risk;
c. establishm ent of a risk appetite and tolerance statem ent
as well as perform ance expectations to assist in controlling
and managing risk;
d. im plem entation of an effective control environm ent and the
use of risk transfer strategies that mitigate risk; and
e. monitoring processes that test for com pliance with policy
thresholds or limits.
53. M anagem ent should ensure the bank has a sound technol-
ogy infrastructure that meets current and long-term business
requirements by providing sufficient capacity for normal activity
levels as well as peaks during periods of market stress; ensuring
data and system integrity, security, and availability; and support­
ing integrated and com prehensive risk m anagem ent. Mergers
and acquisitions resulting in fragm ented and disconnected infra­
structure, cost-cutting measures or inadequate investm ent can
undermine a bank's ability to aggregate and analyse information
across risk dimensions or the consolidated enterprise, manage
and report risk on a business line or legal entity basis, or oversee
and manage risk in periods of high growth. M anagem ent should
make appropriate capital investm ent or otherwise provide for a
robust infrastructure at all tim es, particularly before mergers are
consum m ated, high growth strategies are initiated, or new
products are introduced.
54. O utsourcing2
23 is the use of a third party— either an affiliate
2
1 be considered.24
within a corporate group or an unaffiliated external entity— to
perform activities on behalf of the bank. Outsourcing can
involve transaction processing or business processes. W hile out­
sourcing can help manage costs, provide expertise, expand
21 Refer also to the Com m ittee's Ju ly 1989 paper Risks in C o m p u ter and
Telecom m unication System , and its May 2001 paper Risk M anagem ent
Principles fo r Electro n ic Banking.
22 Technology infrastructure refers to the underlying physical and logi­
cal design of information technology and communication system s, the
individual hardware and software com ponents, data, and the operating
environm ents.
23 Refer also to the Jo in t Forum's February 2005 paper O utsourcing in
Financial Services.
Chapter 1 Principles for the Sound Management of Operational Risk
product offerings, and improve services, it also introduces risks
that m anagem ent should address. The board and senior man­
agem ent are responsible for understanding the operational risks
associated with outsourcing arrangem ents and ensuring that
effective risk m anagem ent policies and practices are in place to
manage the risk in outsourcing activities. Outsourcing policies
and risk m anagem ent activities should encom pass:
a. procedures for determ ining whether and how activities can
be outsourced;
b. processes for conducting due diligence in the selection of
potential service providers;
c. sound structuring of the outsourcing arrangem ent, includ­
ing ownership and confidentiality of data, as well as term i­
nation rights;
d. programmes for managing and monitoring the risks associ­
ated with the outsourcing arrangem ent, including the finan­
cial condition of the service provider;
e. establishm ent of an effective control environment at the
bank and the service provider;
f. developm ent of viable contingency plans; and
g. execution of com prehensive contracts and/or service
level agreem ents with a clear allocation of responsibilities
between the outsourcing provider and the bank.
55. In those circum stances where internal controls do not ad e­
quately address risk and exiting the risk is not a reasonable
option, m anagem ent can com plem ent controls by seeking to
transfer the risk to another party such as through insurance. The
board of directors should determ ine the maximum loss exposure
the bank is willing and has the financial capacity to assum e, and
should perform an annual review of the bank's risk and insurance
m anagem ent program m e. W hile the specific insurance or risk
transfer needs of a bank should be determ ined on an individual
basis, many jurisdictions have regulatory requirem ents that must
56. Because risk transfer is an im perfect substitute for sound
controls and risk m anagem ent program m es, banks should view
risk transfer tools as com plem entary to, rather than a replace­
ment for, thorough internal operational risk control. Having
mechanisms in place to quickly identify, recognise and rectify
distinct operational risk errors can greatly reduce exposures.
Careful consideration also needs to be given to the extent to
which risk mitigation tools such as insurance truly reduce risk,
transfer the risk to another business sector or area, or create a
new risk (e.g ., counterparty risk).
24 See also the Com m ittee's paper, R eco gn isin g the risk-m itigating
im pact o f insurance in operational risk m odelling, O cto b er 2010.
■ 11
1.7 BUSINESS RESILIEN CY
AND CONTINUITY
Principle 10: Banks should have business resiliency and con­
tinuity plans in place to ensure an ability to operate on an
ongoing basis and limit losses in the event of severe business
disruption.25
57. Banks are exposed to disruptive events, some of which may
be severe and result in an inability to fulfil some or all of their
business obligations. Incidents that damage or render inaccessible
the bank's facilities, telecommunication or information technology
infrastructures, or a pandemic event that affects human resources,
can result in significant financial losses to the bank, as well as
broader disruptions to the financial system. To provide resiliency
against this risk, a bank should establish business continuity plans
commensurate with the nature, size and complexity of their
operations. Such plans should take into account different types of
likely or plausible scenarios to which the bank may be vulnerable.
58. Continuity m anagem ent should incorporate business impact
analysis, recovery strategies, testing, training and awareness
program m es, and communication and crisis m anagem ent pro­
gramm es. A bank should identify critical business operations,262
*
7
key internal and external dependencies, and appropriate resil­
ience levels. Plausible disruptive scenarios should be assessed
for their financial, operational and reputational im pact, and the
resulting risk assessm ent should be the foundation for recovery
priorities and objectives. Continuity plans should establish con­
tingency strategies, recovery and resumption procedures, and
communication plans for informing m anagem ent, em ployees,
regulatory authorities, customer, suppliers, and— where
appropriate— civil authorities.
59. A bank should periodically review its continuity plans to
ensure contingency strategies remain consistent with current
operations, risks and threats, resiliency requirem ents, and
recovery priorities. Training and awareness program m es should
25 The Com m ittee's paper, High-level principles for business continuity,
August 2006, discusses sound continuity principles in greater detail.
26 A bank's business operations include the facilities, people and pro­
cesses for delivering products and services or perform ing core activities,
as well as technology system s and data.
27 External dependencies include utilities, vendors and third-party ser­
vice providers.
12 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
be im plem ented to ensure that staff can effectively execute
contingency plans. Plans should be tested periodically to ensure
that recovery and resumption objectives and tim efram es can
be met. W here possible, a bank should participate in disaster
recovery and business continuity testing with key service
providers. Results of formal testing activity should be reported
to m anagem ent and the board.
1.8 ROLE O F DISCLOSURE
Principle 11: A bank's public disclosures should allow
stakeholders to assess its approach to operational risk
management.
60. A bank's public disclosure of relevant operational risk man­
agem ent information can lead to transparency and the develop­
ment of better industry practice through market discipline. The
amount and type of disclosure should be com m ensurate with
the size, risk profile and com plexity of a bank's operations, and
evolving industry practice.
61. A bank should disclose its operational risk m anagem ent
fram ework in a manner that will allow stakeholders to determ ine
whether the bank identifies, assesses, monitors and controls/
m itigates operational risk effectively.
62. A bank's disclosures should be consistent with how senior
m anagem ent and the board of directors assess and manage the
operational risk of the bank.
63. A bank should have a formal disclosure policy approved by
the board of directors that addresses the bank's approach for
determ ining what operational risk disclosures it will make and
the internal controls over the disclosure process. In addition,
banks should im plem ent a process for assessing the appropri­
ateness of their disclosures, including the verification and fre­
quency of them .29
28 Basel Com m ittee on Banking Supervision, International C o n verg en ce
o f Capital M easu rem en t and Capital Stan dards: A R evised Fram ew ork—
C om p reh en sive Version, Section V (O perational Risk), Basel, Ju n e 2006,
paragraph 810.
29 Basel Com m ittee on Banking Supervision, International C o n verg en ce
o f Capital M easu rem ent and Capital Stan dards: A R evised Fram ew ork—
C om p reh en sive Version, Section V (O perational Risk), Basel, Ju n e 2006,
paragraph 821.
 Learning Objectives
A fter com pleting this reading you should be able to:

Define enterprise risk m anagem ent (ERM) and explain Describe the role of and issues with correlation in risk
how implementing ERM practices and policies can create aggregation, and describe typical properties of a firm's
shareholder value, both at the macro and the micro level. market risk, credit risk, and operational risk distributions.

Explain how a company can determ ine its optimal amount Distinguish between regulatory and econom ic capital, and
of risk through the use of credit rating targets. explain the use of econom ic capital in the corporate deci­
sion making process.
Describe the developm ent and implementation of an ERM
system , as well as challenges to the implementation of an
ERM system.

E x c e rp t is from Journal of Applied Corporate Finance 18, No. 4 (2006), b y Brian W. N occo and Rene M. S tu lz *

* W e are grateful for com m ents from Don Chew , Michael Hofmann, Jo anne Lamm-Tennant, Tom O 'B rien , Jero m e Taillard, and W illiam W ilt.

13
The past two decades have seen a dram atic change in the role
of risk m anagem ent in corporations. Twenty years ago, the job
of the corporate risk m anager— typically, a low-level position in
the corporate treasury— involved mainly the purchase of insur­
ance. A t the same tim e, treasurers were responsible for the
hedging of interest rate and foreign exchange exposures. O ver
the last ten years, however, corporate risk m anagem ent has
expanded well beyond insurance and the hedging of financial
exposures to include a variety of other kinds of risk— notably
operational risk, reputational risk, and, most recently, strategic
risk. What's more, at a large and growing number of com panies,
the risk m anagem ent function is directed by a senior executive
with the title of chief risk officer (CRO) and overseen by a board
of directors charged with monitoring risk measures and setting
limits for these measures.
A corporation can manage risks in one of two fundam entally
different ways: (1) one risk at a tim e, on a largely com part­
mentalized and decentralized basis; or (2) all risks viewed
together within a coordinated and strategic fram ework. The
latter approach is often called "enterprise risk m anagem ent,"
or "E R M " for short. In this article, we suggest that com panies
that succeed in creating an effective ERM have a long-run com­
petitive advantage over those that manage and monitor risks
individually. O ur argument in brief is that, by measuring and
managing its risks consistently and system atically, and by giving
its business managers the information and incentives to optimize
the trade-off between risk and return, a com pany strengthens its
ability to carry out its strategic plan.
In the pages that follow, we start by explaining how ERM can
give com panies a com petitive advantage and add value for
shareholders. N ext we describe the process and challenges
involved in implementing ERM . We begin by discussing how a
company should assess its risk "ap p e tite," an assessm ent that
should guide management's decision about how much and
which risks to retain and which to lay off. Then we show how
com panies should measure their risks. Third, we discuss various
means of laying off "non-core" risks, which, as we argue below,
increases the firm's capacity for bearing those "co re" risks the
firm chooses to retain. Though ERM is conceptually straightfor­
ward, its implementation is not. And in the last— and longest—
section of the chapter, we provide an extensive guide to the
major difficulties that arise in practice when implementing ERM .
2.1 HOW DO ES ERM CREATE
SH AREH O LDER V A LU E?
ERM creates value through its effects on com panies at both a
"m acro" or company-wide level and a "m icro" or business-unit
14 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
level. A t the macro level, ERM creates value by enabling senior
m anagem ent to quantify and manage the risk-return trade-off
that faces the entire firm. By adopting this perspective, ERM
helps the firm maintain access to the capital markets and other
resources necessary to im plem ent its strategy and business plan.
A t the micro level, ERM becom es a way of life for managers and
em ployees at all levels of the company. Though the academ ic
literature has concentrated mainly on the macro-level benefits of
ERM , the micro-level benefits are extrem ely im portant in prac­
tice. As we argue below, a well-designed ERM system ensures
that all material risks are "o w n ed ," and risk-return trade-offs
carefully evaluated, by operating managers and em ployees
throughout the firm.
The Macro Benefits of Risk Management
Students in the first finance course of an M BA program often
come away with the "p erfect m arkets" view that since share­
holders can diversify their own portfolios, the value of a firm
does not depend on its "to tal" risk. In this view, a company's
cost of capital, which is a critical determ inant of its P/E ratio,
depends mainly on the "system atic" or "nondiversifiable
com ponent of that risk (as typically measured by a company's
"b e ta"). And this in turn implies that efforts to manage total risk
are a waste of corporate resources.
But in the real world, where investors' information is far from
com plete and financial troubles can disrupt a company's opera­
tions, a bad outcom e resulting from a "diversifiable" risk— say,
an unexpected spike in a currency or com m odity price— can
have costs that go well beyond the im m ediate hit to cash flow
and earnings. In the language of econom ists, such risks can have
large "deadw eight" co sts.1
To illustrate, if a company expects operating cash flow of $200
million for the year and instead reports a loss of $50 million, a
cash shortfall of this size can be far more costly to the firm than
just the missing $250 million. First of all, to the extent it affects
the market's expectation of future cash flows and earnings, such
a shortfall will generally be associated with a reduction in firm
value of much more than $250 million— a reduction that reflects
the market's expectation of lower growth. And even if operating
cash flow rebounds quickly, there could be other, longer-lasting
effects. For exam ple, assume the company has a number of
strategic investm ent opportunities that require im m ediate fund­
ing. Unless the firm has considerable excess cash or unused 1
1 There is a large academ ic literature that investigates how firm value
depends on total risk. For a review of that literature, see Rene Stulz, Risk
M an ag em en t and D erivatives, Southwestern Publishing, 2002.
debt capacity, it may be faced with the tough choice of cutting
back on planned investments or raising equity in difficult cir­
cum stances and on expensive term s. If the cost of issuing equity
is high enough, m anagem ent may have little choice but to cut
investm ent. And unlike the adjustm ent of market expectations
in response to what proves to be a tem porary cash shortfall, the
loss in value from the firm having to pass up positive-NPV proj­
ects represents a perm anent reduction in value.
For most com panies, guarding against this corporate "underin­
vestm ent problem " is likely to be the most im portant reason to
manage risk. By hedging or otherwise managing risk, a firm can
limit (to an agreed-upon level) the probability that a large cash
shortfall will lead to valuedestroying cutbacks in investment.
And it is in this sense that the main function of corporate risk
m anagem ent can be seen as protecting a company's ability to
carry out its business plan.
But which risks should a company lay off and which should it
retain? Corporate exposures to changes in currencies, interest
rates, and com m odity prices can often be hedged fairly inex­
pensively using derivatives such as forwards, futures, swaps,
and options. For instance, a foreign exchange hedging program
using forward contracts typically has very low transaction costs;
and when the transfer of risk is inexpensive, there is a strong
case for laying off econom ic risks that could otherwise under­
mine a company's ability to execute its strategic plan.
On the other hand, com panies in the course of their normal
activities take many strategic or business risks that they can­
not profitably lay off in capital markets or other developed risk
transfer markets. For instance, a company with a promising
plan to expand its business typically cannot find an econom ic
hedge— if indeed there is any hedge at all— for the business
risks associated with pursuing such growth. The company's
m anagem ent presumably understands the risks of such expan­
sion better than any insurance or derivatives provider— if they
don't, the company probably shouldn't be undertaking the
project. If the company were to seek a counterparty to bear
such business risks, the costs of transferring such risks would
likely be prohibitively high, since they would have to be high
enough to com pensate the counterparty for transacting with
a better informed party and for constructing models to evalu­
ate the risks they're being asked to hedge. For this reason, we
should not be surprised that insurance com panies do not offer
insurance contracts that provide com plete coverage for earn­
ings shortfalls or that there is no market for derivatives for which
the underlying is a company's earnings. The insured com panies
would be in a position not only to know more than the insurers
about the distribution of their future earnings, but to manipulate
that distribution to increase the payoffs from such insurance
policies. A firm that entered into a derivatives contract with its
Chapter 2 Enterprise Risk Management: Theory and Practice
earnings as the underlying would have a similar advantage over
a derivatives dealer.
More generally, in making decisions whether to retain or trans­
fer risks, com panies should be guided by the principle of com ­
parative advantage in risk-bearing.2 A company that has no
special ability to forecast m arket variables has no com parative
advantage in bearing the risk associated with those variables. In
contrast, the same company should have a com parative advan­
tage in bearing information-intensive, firm -specific business risks
because it knows more about these risks than anybody else. For
exam ple, at Nationwide Insurance, exposures to changes in
interest rates and equity markets are managed in strict ranges,
with excess exposures reduced through asset repositioning or
hedging. A t the same tim e, Nationwide retains the vast majority
of its insurance risks, a decision that reflects the firm's advantage
relative to any potential risk transfer counterparty in term s of
experience with and knowledge of such risks.
One im portant benefit of thinking in term s of com parative
advantage is to reinforce the message that com panies are in
business to take stra teg ic and business risks. The recognition
that there are no economical ways of transferring risks that are
unique to a company's business operations can serve to under­
score the potential value of reducing the firm's exposure to
other, "non-core" risks.3 O nce m anagem ent has decided that
the firm has a com parative advantage in taking certain business
risks, it should use risk m anagem ent to help the firm make the
most of this advantage. Which brings us to a paradox of risk
m anagem ent: By reducing non-core exposures, ERM effectively
enables com panies to take more strategic business risk— and
greater advantage of the opportunities in their core business.
The Micro Benefits of ERM
As discussed above, an increase in total risk can end up reduc­
ing value by causing com panies to pass up valuable projects or
otherwise disrupting the normal operations of the firm. These
costs associated with total risk should be accounted for when
assessing the risk-return trade-off in all major new investm ents.
If the company takes on a project that increases the firm's total
risk, the project should be sufficiently profitable to provide an
adequate return on capital after com pensating for the costs
associated with the increase in risk. This risk-return trade-off
For an extended treatm ent of this concept, see Rene Stulz, "Rethink­
ing Risk M anagem ent," Jo u rn a l o f A p p lie d C o rp o ra te Finance, Vol. 9
No. 3, Fall 1996.
3 For a discussion of core and non-core risks, see Robert M erton,
"You Have More Capital Than You Think," Harvard Business R eview
(Novem ber, 2005).
■ 15
must be evaluated for all corporate decisions that are expected
to have a material impact on total risk.
Thus, a major challenge for a company implementing ERM is
to ensure that decision-making not just by senior m anagem ent,
but by business managers throughout the firm, takes proper
account of the risk-return trade-off. To make this happen, the
risk evaluations of new projects must be perform ed, at least
initially, on a decentralized basis by the project planners in the
business units. A com pletely centralized evaluation of the risk-
return trade-off of individual projects would lead to corporate
gridlock. Take the extrem e case of a trader. Centralized evalu­
ation would require the C RO 's approval of each of the trader's
decisions with a potentially material impact on the firm's risk.
But in a decentralized evaluation of the risk-return trade-off,
each unit in the corporation evaluates this trade-off in its deci­
sion making. An im portant part of senior management's and the
CRO 's job is to provide the information and incentives for each
unit to make these trade-offs in ways that serve the interests of
the shareholders.
There are two main com ponents of decentralizing the risk-return
trade-off in a company:
a. First, managers proposing new projects should be required
to evaluate all major risks in the context of the marginal
impact of the projects on the firm's total risk. The com ­
pany's decision-making fram ework should require the busi­
ness managers to evaluate project returns in relation to the
marginal increases in firm-wide risk to achieve the optimal
amount of risk at the corporate level.
b. Second, to help ensure that managers do a good job of
assessing the risk-return trade-off, the periodic perform ance
evaluations of the business units must take account of the
contributions of each of the units to the total risk of the
firm. As we will see later, this can be done by assigning
a level of additional "im puted" capital to the project to
reflect such incremental risk— capital on which the project
m anager will be expected to earn an adequate return. By so
doing, the corporation not only measures its true econom ic
perform ance, but also creates incentives for managers to
manage the risk-return trade-off effectively by refusing to
accept risks that are not econom ically attractive.
With the help of these two mechanisms that are essential to
the m anagem ent of firm-wide risk, a company that implements
ERM can transform its culture. W ithout these means, risk will be
accounted for in an ad hoc, subjective way, or ignored. In the
form er case, promising projects could be rejected when risks
are overstated. In the latter case, system s that ignore risk will
end up encouraging high-risk projects, in many cases without
the returns to justify them . Perhaps even more troubling, one
division could take a project that another would reject based on
a different assessm ent of the project's risk and associated costs.
With the above capital allocation and perform ance evaluation
system mechanisms put in place when ERM is im plem ented,
business managers are forced to consider the impact of all
material risks in their investm ent and operating decisions. In
short, every risk is "o w ned " since it affects som eone's perfor­
mance evaluation.
Spreading risk ownership throughout the company has become
more important as the scope of risk management has expanded
to include operating and reputational risks. Ten or 20 years ago,
when risk management focused mainly on financial risks, compa­
nies could centrally measure and manage their exposures to mar­
ket rates. But operational risks typically cannot be hedged. Some
of these risks can be insured, but companies often choose to
reduce their exposure to such risks by changing procedures and
technologies. The individuals who are closest to these risks are
generally in the best position to assess what steps should be taken
to reduce the firm's exposure to them. So, for exam ple, decisions
to manage operating risks are often entrusted to line managers
whose decisions are based on their knowledge of the business,
and supplemented by technical experts where appropriate.
Nationwide has developed a "factor-based" capital allocation
approach for its m anagem ent accounting and perform ance
evaluation system . Capital factors are assigned to products
based on the perceived risk of such products. For exam ple, the
risk associated with, and capital allocated to, insuring a home in
a hurricane- or earthquake-prone area is greater than that for a
home in a non-catastrophe exposed region.
O ne of the most im portant purposes of such a risk-based capital
allocation system is to provide business managers with more
information about how their own investm ent and operating
decisions are likely to affect both corporate-wide perform ance
and the measures by which their perform ance will be evaluated.
When com bined with a perform ance evaluation system in this
way, a risk-based capital allocation approach effectively forces
the business managers to consider risk in their decision-making.
Nationwide's risk factors are updated annually as part of the
strategic and operational planning process, reflecting changes in
risk and diversification. Decision-making authority is delegated
by means of a risk limit structure that is consistent with Nation­
wide's risk appetite fram ework.
2.2 DETERM INING THE RIGHT
AM OUNT O F RISK *
How should a company determ ine the optimal amount of total
risk to bear? To answer this question, it's im portant to start by

16 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
recognizing that the costs associated with the cash shortfalls we
discussed earlier would not exist if the firm had a larger buffer
stock of equity capital invested in liquid assets. But carrying
excess equity also, of course, has costs. For exam ple, a recent
study concludes that, for some com panies (typically larger,
mature com panies), the last dollar of "excess" cash is valued by
the market at as little as 60 cents.4
By reducing risk, a company can reduce the amount of exp en­
sive equity capital needed to support its operating risks. In this
sense, risk m anagem ent can be viewed as a substitute for equity
capital, and an im portant part of the job of the C R O and top
m anagem ent is to evaluate the trade-off between more active
risk m anagem ent and holding a larger buffer stock of cash
and equity.
As we saw earlier, for com panies without a large buffer of excess
equity, a sharp drop in cash flow and value can lead to financial
distress and a further (permanent) loss of value from underin­
vestm ent. Let's define "financial distress" to be any situation
where a company is likely to feel com pelled to pass up positive
net present value (NPV) activities.
Many com panies identify a level of earnings or cash flow that
they want to maintain under almost all circum stances (i.e.,
with an agreed-upon level of statistical confidence, say 95%,
over a one-year period) and then design their risk m anage­
ment programs to ensure the firm achieves that minimum. For
exam ple, in the case described earlier of the firm with a $250
million shortfall, m anagem ent may want to explore steps that
would ensure that the firm almost never loses more than, say,
$100 million in a year, since that may be the point where man­
agem ent begins to feel pressure to cut projects. But, as the
mention of statistical confidence intervals suggests, a company
cannot— nor should it attem pt to— guarantee that its cash and
earnings will never fall below the level it's aiming to protect. As
long as a com pany operates in a business that promises more
than the risk-free rate, there will be some risk of falling into
financial distress.
W hat m anagem ent can accomplish through an ERM program,
then, is not to minimize or elim inate, but rather to limit, the
probability of distress to a level that m anagem ent and the board
agrees is likely to maximize firm value. Minimizing the prob­
ability of distress, which could be achieved by investing most of
the firm's capital in Treasury bills, is clearly not in the interests of
shareholders. M anagement's job is rather to optim ize the firm's
4 By contrast, for riskier com panies with lots of growth opportunities,
the sam e dollar can be worth as much as $1.50. See Lee Pinkowitz and
Rohan W illiam son, "W hat Is the M arket Value of a Dollar of Cash Hold­
ing s?," G eorgetow n University working paper.
Chapter 2 Enterprise Risk Management: Theory and Practice
risk portfolio by trading off the probability of large shortfalls
and the associated costs with the expected gains from taking or
retaining risks.
Let's refer to this targeted minimal level of resources (which can
be form ulated in term s of cash flow, capital, or market value) as
the company's financial distress "threshold." Many companies
use bond ratings to define this threshold. For exam ple, m anage­
ment may conclude that the firm would have to start giving up
valuable projects if its rating falls to Baa. In that case, it would
adopt a financial and risk m anagem ent policy that aims to limit
to an acceptably low level the probability that the firm's rating
will fall to Baa or lower. Given a firm's current rating— and let's
assume it is A a— it is straightforward to use data supplied by the
rating agencies to estim ate the average probability that the
firm's rating will fall to Baa or lower. A study by Moody's using
data from 1920 to 2005 shows that the probability of a company
with an Aa rating having its rating drop to Baa or lower within a
year's tim e is 1.05% , on averag e.5
W hether such a probability is acceptable is for top m anagem ent
and the board to decide. For a company with many valuable
growth opportunities, even just a 1% chance of having to forgo
such investments may be too risky. By contrast, a basic m anufac­
turing firm with few growth opportunities is likely to be better
off making aggressive use of leverage, maximizing the tax ben­
efits of debt, and returning excess funds to shareholders. For
such a firm, the costs associated with financial trouble would be
relatively low, at least as a percentage of total value.
For financial com panies like Nationwide, however, there is
another im portant consideration when evaluating the costs of
financial distress that is specific to financial institutions: financial
trouble has an adverse impact on liabilities like bank deposits
and insurance contracts that constitute an im portant source of
the value of banks and insurance com panies.6 Because such lia­
bilities are very credit-sensitive, these financial institutions gen­
erally aim to maximize their value by targeting a much lower
probability of distress than the typical industrial firm.
Let's suppose for the moment that a rating is a com pletely reli­
able and sufficient measure of the probability that a company
will default— an assumption we will reexam ine later. And let's
consider a company that would have to start giving up valuable
5 Moody's Default and Recovery Rates of Corporate Bond Issuers,
1920-2005, March 2006. We com pute probabilities that assume that the
rating is not w ithdraw n.
6 See M erton, Robert C ., 1993, "O peration and Regulation in Financial
Interm ediation: A Functional Persp ective," in O peration and Regulation
o f Financial M arkets, edited by P. Englund. Stockholm : The Econom ic
Council.
■ 17
Table 2.1 Transition Matrix from Moody's

Rating To:

Rating From: Aaa Aa A Baa Ba B Caa-C Default

Aaa 91.75% 7.26% 0.79% 0.17% 0.02% 0.00% 0.00% 0.00%

Aa 1.32% 90.71% 6.92% 0.75% 0.19% 0.04% 0.01% 0.06%

A 0.08% 3.02% 90.24% 5.67% 0.76% 0.12% 0.03% 0.08%

Baa 0.05% 0.33% 5.05% 87.50% 5.72% 0.86% 0.18% 0.31%

Ba 0.01% 0.09% 0.59% 6.70% 82.58% 7.83% 0.72% 1.48%

B 0.00% 0.07% 0.20% 0.80% 7.29% 80.62% 6.23% 4.78%

Caa-C 0.00% 0.03% 0.06% 0.23% 1.07% 7.69% 75.24% 15.69%

A verage one-year rating transition m atrix, 1920-2005, conditional upon no rating w ithdraw al.

S o u rce: Moody's Default and Recovery Rates of Corporate Bond Issuers, 1920-2005, March 2006.

projects if its rating fell to Baa or below (that is, Baa would
serve as its financial distress threshold). Assum e also that man­
agem ent and the board have determ ined that, for this kind of
business, the optimal level of risk is one where the probability
of encountering financial distress is 7% over a one-year period.
Such an optimal level of risk would be determ ined by com par­
ing the costs associated with financial distress and the benefits
of having a more levered capital structure and taking on riskier
projects.
To the extent that ratings are reliable proxies for financial health,
com panies can use a rating agency "transition m atrix" to esti­
mate the amount of capital necessary to support a given level of
risk. The transition m atrix shown in Table 2.1 can be used to
identify the frequency with which com panies moved from one
rating to another over a certain period (in this case, 1920 to
2005).7 For any rating at the beginning of the year (listed in the
left-hand column of the table), the column of numbers running
down from the heading "B a a " tells us the probability that a
company will end up with a Baa rating at the end of the year.
Again, let's assume m anagem ent wants the probability of its rat­
ing falling to Baa or lower over the next year to average around
7%. To determ ine the probability of a downgrade to or lower
than Baa for a given initial rating, we add up the probabilities of
ending with a rating equal to or lower than Baa along the row
that corresponds to the initial rating. The row where the prob­
abilities of ending at Baa or lower is closest to 7% is the one
corresponding to an A rating. Consequently, by targeting an A
rating, m anagem ent would achieve the probability of financial
distress that is optimal for the firm.
7 See footnote 2.
In practice, however, the process of determ ining a target rating
can involve more considerations, which makes it more com pli­
cated. For exam ple, Nationwide analyzes and manages both
its probability of default and its probability of dow ngrade, and
it does so in separate but related fram eworks. The company's
optimal probability of default is anchored to its target Aa ratings
and reflects the default history of Aa-rated bonds. By contrast,
the probability of downgrade to Baa or below is assumed to be
affected by, and is accordingly managed by limiting, risk con­
centrations such as those arising from natural catastrophes and
equity markets.
In the exam ple above, the com pany is assumed to maximize
value by targeting a rating of A . As we noted earlier, equity
capital provides a buffer or shock absorber that helps the firm to
avoid default. For a given firm, a different probability of default
corresponds to each level of equity, so that by choosing a given
level of equity, m anagem ent is also effectively choosing a prob­
ability of default that it believes to be optim al.
As can be seen in Table 2.1, an A rating is associated with a
probability of default of 0.08% over a one-year period. Thus,
to achieve an A rating, the company in our exam ple must have
the level of (equity) capital that makes its probability of default
equal to 0.08% . If we make the assumption that the value of a
company's equity falls to a level not materially different from
zero in the event of default, we can use the probability of
default to "back out" the amount of equity the firm needs to
support its current level of risk.
Although the probability of default is in fact a com plicated func­
tion of a number of firm characteristics, not just the amount of
equity, the analytical process that leads from the probability of
default to the required amount of capital is straightforward.

18 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
To see this, suppose that the company
becom es bankrupt if firm value at the
end of the fiscal year falls below a
default threshold level, which is a
function of the composition and
amount of the firm's d e b t.8 Given this
assum ption, the firm needs the
amount of equity capital that will
make the probability of its value fall­
ing below the default threshold level
equal to 0.08% (or alternatively, the
amount that will ensure that its value
will not fall below the default thresh­
old level with a probability of 99.92% ).

A company can also assess its costs

of financial distress by using criteria
other than ratings and ratings thresh­
olds. For instance, in addition to a rat­
ing downgrade, Nationwide Insurance
identifies a number of other scenarios
that it views as imposing large costs
on the company. C h ief among them
Fiqure 2.1 Required equity capital to achieve a target probability of default
are high levels of volatility in earnings
a function of firm volatility or VaR.
and capital that, while not alone suf­
ficient to cause a rating dow ngrade,
could contribute to an increase in overall risk and hence the an amount of equity equal to its firm-wide one-year VaR deter­
required level of capital. For each of these critical variables and mined at a probability level of 0.08% .
scenarios, Nationwide sets target probability levels and accept­
For some com panies, VaR conveys the same information as the
able tolerances that enable the firm to limit its volatility risk
volatility of its stock price or market value, which would allow
within those targeted levels.
the firm using VaR to focus on these more direct measures of
W hen thinking about acceptable levels of volatility, and the volatility of its value.9 But for those com panies for which the dis­
equity capital needed to support them , many financial com ­ tribution of firm value changes is not "norm al" or sym m etric, the
panies use a risk measure called value-at-risk, or VaR for short. analysis of risk provided by VaR can be quite different from the
VaR is the amount of the loss that is expected, with some pre­ information provided by volatility— and in such cases, VaR must
specified probability level, to be reached or exceeded during a be estim ated directly.
defined time period. For instance, if a portfolio of securities has
But whether m anagem ent uses VaR or volatility, given a tar­
a one-year VaR at the 5% probability level of $20 million, there
geted probability of default or financial distress, the company
is a 5% chance the portfolio will have a loss that exceeds $20
faces a trade-off, as illustrated in Figure 2.1, between its level of
million in the next year. VaR can also be com puted for an entire
VaR or volatility and the size of its buffer stock of equity capital.
com pany by assessing the distribution of firm value. When the
As VaR or volatility increase, the firm requires more capital to
determ ination of the buffer stock of equity proceeds along the
achieve the same probability of default. And as can also be seen
lines described so far, the company in our exam ple must have
in the upward shift from line x to line y in Figure 2.1, this trade­
off becom es steeper if m anagem ent chooses to reduce the tar­
geted probability of default.
8 If all debt w ere due at the end of the year, the default threshold level
would be the principal amount of debt outstanding plus interest due.
However, if debt matures later, firm value could fall below the principal
amount of debt outstanding without triggering a default. So, the default
threshold level is lower than the principal amount of debt outstanding 9 In particular, VaR is a multiple of volatility when the variable for which
when the firm has long-term debt. VaR is estim ated has a normal distribution.

Chapter 2 Enterprise Risk Management: Theory and Practice ■ 19

Now suppose that based on its estim ate of volatility, m anage­
ment concludes that the firm needs $5 billion of equity capital
to achieve its target probability of default. As noted earlier, the
company can reduce its required level of equity by using risk
m anagem ent to reduce the probability of default, which would
make sense if that option were deem ed less costly than holding
the $5 billion of equity. In making this trade-off between m anag­
ing risk and holding more equity, the company should aim to
position itself "at the margin" where it is indifferent between
decreasing risk and increasing capital. M anagem ent can satisfy
itself that it has achieved this position if, after having decided
on a certain combination of risk m anagem ent and capital, it
can show that, for exam ple, spending another $10 million to
decrease risk by 1% will save the firm roughly $10 million in
equity capital costs. In this event, it has achieved the optimal
amount of risk.
Using this approach, the company can evaluate the marginal
impact of a project on both its risk of default and its risk of
financial distress. As total risk increases, the firm requires more
capital to support that risk. Moreover, the cost of the additional
capital provides a useful measure of the cost of the project's
contribution to the firm's total risk. The project is worth under­
taking only if its NPV is large enough to cover that additional
cost. Similarly, when evaluating the perform ance of a unit within
the firm, the unit contributes to shareholder wealth only insofar
as its econom ic value added exceeds the cost of its contribu­
tion to the risk of the firm. In this way, then, the capital required
to support the contribution of an activity to the total risk of the
firm becom es itself a measure of risk— a measure that, because
of its sim plicity, can easily be added up across different activities
or risks.
The conceptual fram ework of ERM can thus be summarized as
follows:
1. M anagem ent begins by determ ining the firm's risk appetite,
a key part of which is choosing the probability of financial
distress that is expected to maximize firm value. When
credit ratings are used as the primary indicator of financial
risk, the firm determ ines an optimal or target rating based
on its risk appetite and the cost of reducing its probability
of financial distress.
2. Given the firm's target rating, m anagem ent estim ates the
amount of capital it requires to support the risk of its opera­
tions. In so doing, m anagem ent should consider the prob­
ability of default.
3. M anagem ent determ ines the optimal combination of capi­
tal and risk that is expected to yield its target rating. For
a given amount of capital, m anagem ent can alter its risk
through hedging and project selection. Alternatively, for
20 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
a given amount of total risk, the company can increase its
capital to achieve its target rating. A t the margin, the firm
should be indifferent between changing its capital and
changing its risk.
4. Top m anagem ent decentralizes the risk-capital trade-off
with the help of a capital allocation and perform ance evalu­
ation system that motivates managers throughout the orga­
nization to make investm ent and operating decisions that
optim ize this trade-off.
2.3 IM PLEM ENTING ERM
But if ERM is conceptually straightforward, its im plem entation is
challenging. For a company to succeed in implementing ERM ,
it is critical that people throughout the organization understand
how it can create value. M anagers must understand that it is not
an academ ic exercise but a critical tool for executing the firm's
strategy. Thus ERM must be "sold" to and "bought into" by
all levels of the organization. For the whole organization to get
behind it, considerable thought must be devoted to the design
of managerial perform ance evaluation and incentives. We now
consider the main challenges involved in making ERM work.
Inventory of Risks
The first step in operationalizing ERM is to identify the risks to
which the company is exposed. A common approach is to iden­
tify the types of risks that will be m easured. In the early days of
corporate risk m anagem ent, financial institutions focused mainly
on market and credit risks. Eventually operational risk was
added. As a result, a common practice for banks is to classify all
risks into one of three categories: market, credit, and opera­
tional. But for such an approach to capture all the risks the firm
is exposed to, operational risk has to be a catch-all category
that includes all risks that are not m arket and credit risks.101
Many com panies have gone beyond measuring market, credit,
and operational risks. In recent years, some firms have also
attem pted to measure liquidity, reputational, and strategic
risks. Further, the three-party typology used in banking often
does not correspond well to the risks faced in other industries.
For exam ple, because insurance com panies have risks on their
asset side— that is, the risks associated with their investment
10 For banks, the definition of operational risk that prevails in the Basel
11 accord is much narrower; for instance, it ignores the reputational risks
that are today a major concern of many financial institutions. A s a result,
for banks, there will be a tension betw een the m easurem ent of opera­
tional risk for regulatory purposes and from the perspective of ERM .
portfolio— as well as their liability side, such com panies gener­
ally use a different typology. Nationwide Insurance regularly
measures and monitors its asset, liability, operating, liquidity,
and strategic risks— and it considers reputational risks in the
context of each of these risks and of its overall business. (M arket
and credit risks are both treated as parts of asset risks.)
Having identified all of the company's major risks, m anagem ent
must then find a consistent way to measure the firm's exposure
to these risks— a common approach that can be used to identify
and quantify all the firm's significant exposures. W ithout such a
m ethod, exposure to the same risk could have different effects
on the perform ance evaluation and decision-making of differ­
ent business units and activities. The resulting possibility that
identically risky activities would be allocated different amounts
of capital would almost certainly create tension within the firm.
Furtherm ore, risk would gradually migrate within the organiza­
tion to those parts of the firm where it received the lowest risk
rating and sm allest capital allocation.
For an inventory of risks to be useful, the information pos­
sessed by people within the organization must be collected,
made com parable, and continuously updated. Organizations
that have grown through acquisitions or without centralized IT
departm ents typically face the problem of incom patible com ­
puter system s. Com panies must be able to aggregate common
risks across all of their businesses to analyze and manage those
risks effectively.
Nationwide em ploys both a top-down and a bottom-up pro­
cess of risk identification. From a top-down perspective, the
company's ERM leadership and corporate level risk com m ittee
have identified all risks that are large enough in aggregate to
threaten the firm with financial distress in an adverse environ­
ment. The bottom-up process involves individual business units
and functional areas conducting risk-control self assessments
designed to identify all material local-level risks. The goal is to
identify all im portant risks, quantify them using a consistent
approach, and then aggregate individual risk exposures across
the entire organization to produce a firm-wide risk profile that
takes account of correlations among risk. For exam ple, Nation­
wide analyzes and establishes aggregate limits for the equity
risk stemming from three main sources: (1) the stock holdings
in its property and casualty insurance investm ent portfolio;
(2) the fee levels that are tied to equity values in the variable
annuity and insurance contracts of its life insurance business;
and (3) the asset m anagem ent fees that are tied to equity
values in its investm ent m anagem ent business.
Corporate failures to conduct thorough "inventories" of their
risks on a regular basis have been responsible for a striking num­
ber of major corporate disasters over the last 20 years. Business
Chapter 2 Enterprise Risk Management: Theory and Practice
units often resist such monitoring efforts because they are time-
consuming and distract from other activities. A well-known
exam ple of such resistance that ultimately created massive prob­
lems for the old UBS took place when the firm attem pted to
include its equity derivatives desk into its risk m easurem ent sys­
tem . Because the equity derivatives desk used a different com ­
puter system , such an undertaking would have required major
changes in the way the desk did its business. But since the desk
was highly profitable, it was allowed to stay outside the system.
Eventually, the operation incurred massive losses that funda­
mentally w eakened the bank and led it to seek a m erger.11
Economic Value versus Accounting
Performance
Although credit ratings are a useful device for helping a com ­
pany think about its risk appetite, m anagem ent should also
recognize the limitations of ratings as a guide to a value-m axi­
mizing risk m anagem ent and capital structure policy. Because
of the extent of their reliance on "accounting" ratios as well as
analysts' subjective judgm ent, credit ratings are often not the
most reliable estim ates of a firm's probability of default. For
exam ple, a company might feel confident that the underlying
econom ics of its risk m anagem ent and capital structure give
it a probability of default that warrants an A rating, but find
itself assigned a Baa rating— perhaps because of a mechanical
application of misleading accounting-based criteria— by the
agencies. In such cases, m anagem ent should rely on its own
econom ics-based analysis, while making every effort to share its
thinking with the agencies.
But having said this, if maintaining a certain rating is deem ed to
be critical to the success of the organization, then setting capital
at a level that achieves the probability of default of the targeted
rating may not be enough. M anagem ent may also have to tar­
get some accounting-based ratios that are im portant determ i­
nants of ratings as well.
This question of econom ic or value-based m anagem ent vs.
accounting-based decision-making raises a fundamental ques­
tion of risk m anagem ent: W hat is the shortfall that m anage­
ment should be concerned about? Is it a shortfall in cash flow
or in earnings? Is it a drop in a company's G A A P net worth or a
market-based measure of firm value?
If the company is managing its probability of default, it should
obviously focus on the measure that is most directly linked to
that outcom e. For exam ple, an unexpected drop in this year's
cash flow may not be a problem for a company if its future cash1
11 See Dirk Schutz, La Chute de I'U BS, Bilan, 1998.
■ 21
flows are clearly unaffected. If the firm finds it easy to borrow
against its future cash flows or tangible assets, a shortfall in this
year's cash flow is unlikely to lead the firm to default. But those
com panies that cannot borrow against future cash flows, per­
haps because they are too speculative and have few tangible
assets, may be affected much more adversely. In such cases, the
shortfall in cash flow, by triggering financing constraints, could
push the firm into financial distress. It is these kinds of com pa­
nies that are likely to focus their risk m anagem ent efforts on
measures of cash flow volatility.
But if a com pany is more likely to experience financial distress
because the p re se n t value of future cash flows is low than
because of a drop in cash flow, m anagem ent must model the
risk of changes in firm value, which reflects the present value
of expected future cash flows, rather than the risk of changes
in cash flows. There are a number of topdown approaches that
provide estim ates of total risk based on industry benchm arks
that are cheap and easy to im plem ent. Unfortunately, such
approaches are not useful for managing risk within a com ­
pany because they do not make it possible to relate corporate
actions to firm -wide risk. For instance, m anagem ent could
obtain an estim ate of the volatility of firm value or cash flows by
looking at the distribution of the value or cash flows of com pa­
rable com panies. But such an approach would provide m anage­
ment with little understanding of how specific risk m anagem ent
policies, including changes in capital structure, would affect
this estim ate.
Thus, a m anagem ent intent on implementing ERM must esti­
mate the expected distribution of changes in firm value from
the bottom up. W hen, as is typical, a company's value is best
estim ated as the present value of its expected future cash flows,
m anagem ent should "build" its estim ates of firm value by m od­
eling the distribution of future cash flows. As a fundamental
part of its ERM program, Nationwide has developed stochastic
models that generate multi-year cash flow distributions for its
main businesses.
The Accounting Problem
By focusing on cash flows, then, a company focuses on its eco­
nomic value. But while helping the firm achieve its target prob­
ability of default, such an approach could also result in more
volatile accounting earnings. For exam ple, under the current
accounting treatm ent of derivatives, if a company uses deriva­
tives to hedge an econom ic exposure but fails to qualify for
hedge accounting, the derivatives hedge can reduce the volatil­
ity of firm value while at the same tim e increasing the volatility
of accounting earnings. And thus a com pany that implements
ERM could end up with higher earnings volatility than a com pa­
rable firm that does not.
22 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
W hile com panies should pursue econom ic outcom es whenever
possible, there will clearly be situations where they need to
limit the volatility of reported accounting earnings. Com panies
with debt covenants that specify minimal levels of earnings and
net worth are one exam ple. Another is provided by com panies
that face regulatory requirements to maintain minimal levels
of "statutory" capital, which is typically defined in standard
accounting term s. Yet another are com panies whose ability to
attract custom ers depends in part on credit ratings, which in
turn can be affected by earnings volatility. Nationwide Insur­
ance, for exam ple, operates in many businesses that are highly
sensitive to credit ratings. And to the extent its ratings could be
affected by high (or unexplained) levels of accounting volatility,
management's decision-making must clearly take such volatility
into account. In such cases, the challenge of an ERM system is
to m eet the lenders' and regulators' accounting requirements
while still attem pting to manage risk from the perspective of
econom ic value. Nationwide's approach is to make econom ically
based decisions to maximize value while treating its targeted
"A a " ratings vulnerability as a "constraint." A significant amount
of effort is devoted to minimizing the effect of this constraint
through disclosure and communication with the rating agencies.
Aggregating Risks
A firm that uses the three-part typology of m arket, credit, and
operational risk mentioned earlier generally begins by measur­
ing each of these risks individually. If the firm uses VaR, it will
have three separate VaR m easures, one each for m arket risk, for
credit risk, and for operational risk. These three VaRs are then
used to produce a firm-wide VaR.
As shown in Figure 2.2, these three types of risks have dram ati­
cally different distributions.12 M arket risk behaves very much like
the returns on a portfolio of securities, which have a "norm al" or
sym m etric distribution. In contrast, both credit and operational
risk have asym m etric distributions. With credit risk, either a
creditor pays in full what is owed or it does not. In general, most
creditors pay in full, but some do not— and when a creditor
defaults, the loss can be large. With operational risk, there tends
to be large numbers of small losses, so that small operational
losses are almost predictable. There is also, however, some
chance of large losses, so that the distribution of operational
losses has a "long tail." Statisticians describe distributions as
having "fat tails" when the probability of extrem e losses is
higher than can be described by the normal distribution. W hile
many use the normal distribution to estim ate the VaR of market
12 This is also the case when risks are divided into asset risks, operational
risks, and liability risks.
 Market Risk

Loss

2 4 6 8 10
Loss

Operational Risk

Fiqure 2.2 Typical market, credit, and operational risk distributions.

risk, such an approach is not appropriate for credit and opera­
tional risks because these risks have fat tails.
W hen aggregating the risks, one must also estim ate their cor­
relations. The probability of experiencing sim ultaneously highly
adverse market, credit, and operational outcom es is typically
very low. This means that there is diversification across risk cat­
egories, and that the firm-wide VaR is thus less than the sum
of the market risk, credit risk, and operational risk VaRs. How
much less depends on the correlation between these risks. The
estimation of the correlations between certain types of risks is at
present more art than science. For this reason, many com panies
choose to use averages of correlations used by other firms in
their industry rather than relying on their own estim ates.13 But
13 For data on correlations used in practice for financial institutions, see
Andrew Kuritzkes, Til Schuermann, and Scott M. Weiner, "Risk Measure­
ment, Risk Management and Capital Adequacy in Financial Conglomer­
ates," Brookings-Wharton Papers on Financial Services, 2003, pp. 141-193.
regardless of w hether they use their own or other firms' correla­
tion m easures, com panies should keep in mind the tendency for
correlations to increase in highly stressed environments.
One im portant issue in estimating correlations across types of
risks is the im portance of recognizing that such correlations
depend to some extent on the actions of the com pany. For
exam ple, the total risk of an insurance com pany depends on the
correlation between its asset risk and its liability risk. By chang­
ing its asset allocations, the company can modify the correlation
between its asset risk and its liability risk. As a consequence, an
insurance company's asset portfolio allocations can be an essen­
tial part of its risk m anagem ent effort. For exam ple, Nationwide
Insurance uses a sophisticated asset/liability model to create an
efficient frontier of investm ent portfolios. The actual target port­
folio selected takes into consideration the firm's tolerance for
interest rate, equity market, and other risks as well as the oppor­
tunity for expected econom ic value creation.

Chapter 2 Enterprise Risk Management: Theory and Practice ■ 23

Measuring Risks
Some com panies focus mostly on tail risk— the low-probability,
large-loss outcom es. As a result, when they measure the risk of
changes in the present value of cash flows, they use a measure
like VaR at a probability level that corresponds to a default
threshold. Some of these com panies also com plem ent their VaR
estim ates with stress tests in which they investigate the impact
on firm value of rare events (such as the crisis period of August
and Septem ber 1998 that followed Russia's default on some of
its debt).
Though VaR is widely used, it is im portant to understand its
limitations and to com plem ent its use with other risk measures.
Perhaps the main problem is that while VaR measures the loss
that is expected to be exceeded with a specified probability,
it says nothing about the expected size of the loss in the event
that VaR is exceeded. Some have argued that com panies should
instead focus on the expected loss if VaR is exceeded. But
focusing on this risk measure, which is often called conditional
VaR, instead of focusing on VaR has little econom ic justification
in the context of firm wide risk m anagem ent. Setting the com pa­
ny's capital at a level equal to the conditional VaR would provide
the firm with a lower probability of default than the targeted
level, leading to an excessively conservative capital structure.
But a more important reason for companies to look beyond a
VaR measure estimated at the probability level corresponding
to a default threshold is that ERM adds value by optimizing the
probability and expected costs of financial distress. It is therefore
critical for companies to make sure that the equity capital set
based on a VaR estim ate leads to the targeted optimal probabil­
ity of financial distress. Such an effort requires a broader under­
standing of the distribution of firm value than is provided by a
VaR estim ate for a given probability of default. Further, since dif­
ferent levels of financial distress have different costs, a company
can take these different costs into account and focus on the
probability distribution of different levels of financial distress.
To compound the problem , when a company has a high rating
target, the estimation of VaR becom es more of an art as the esti­
mated VaR corresponds to an extrem ely low probability level.
To see this, consider a company that has determ ined that an A
rating is optim al. Since the probability of default for an A-rated
company is only 0.08% over a one-year period, to estim ate
its optimal amount of capital the firm must therefore estim ate
the loss in value that is exceeded with a probability of 0.08% .
The problem , however, is that few A-rated com panies have any
experience of losses that come anywhere near that level. And
without any historical experience of such losses, it is difficult for
m anagem ent to estim ate the VaR at that probability level and
then evaluate the result.
24 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
For most investm ent grade com panies, then, it is much easier
to evaluate the distribution of changes in firm value over the
range of changes that encom passes not default, but just a rat­
ings dow ngrade. For exam ple, using the Moody's transition
matrix data (Table 2.1), one can say with some confidence that
an A-rated firm has a 5.67% chance on average of being down­
graded to a Baa rating over a one-year period; in other words,
such an event is expected to happen in more than one year out
of 20. (In contrast, default is expected to happen in approxi­
mately one year out of 1,000.) Because of the abundance of
data on downgrades as opposed to defaults for A-rated com pa­
nies, the distribution of changes in firm value that corresponds
to a downgrade to Baa can be estim ated more precisely. O ver
that much narrower range of possible outcom es, the prob­
lems created by "asym m etries" in the distribution of firm value
changes and the so-called "fat tail" problems (where extrem e
negative outcom es are more likely than predicted by common
statistical distributions) are not likely to be as severe. In such
cases, m anagem ent may have greater confidence in its esti­
mates of the distribution of value changes corresponding to a
downgrade rather than a default and will be justified in focusing
on managing the probability of a downgrade.
As discussed previously, it is also im portant to understand and
take account of risk correlations when analyzing and m anag­
ing default and distress probabilities. Nationwide Insurance
incorporates in its econom ic capital model a correlation matrix
that reflects sensitivity-tested stress correlations. It is also now
in the process of exploring event-driven correlation analysis
for scenarios that include terrorist attacks, mega hurricanes,
and pandem ics.
Regulatory versus Economic Capital
The amount of equity capital required for the company to
achieve its optimal rating may bear little relation to the amount
of capital regulators would require it to hold. A firm that
practices ERM may therefore have an amount of capital that
substantially exceeds its regulatory requirements because it
maximizes shareholder wealth by doing so. In this case, the
regulatory requirem ents are not binding and would not affect
the firm's decisions.
The company would be in a more difficult situation if its required
regulatory capital exceeded the amount of capital it should hold
to maximize shareholder wealth. Nationwide Insurance refers to
this excess as "stranded capital." To the extent that econom ic
and regulatory capital are subject to different drivers, the dif­
ference between the two can be arbitraged to some degree to
minimize the level of stranded capital. Nationwide allocates any
residual stranded capital to its businesses and products. If all the
potential com petitors of the firm face the same onerous regula­
tory capital requirem ents, the capital the firm has to hold that
is not justified on econom ic grounds is simply a regulatory tax.
If some potential com petitors could provide the firm's products
without being subjected to the same regulatory capital, these
less regulated com petitors could offer the products at a lower
price and the firm would risk losing business to them . In this
case, the firm would have to factor in the cost of regulatory cap­
ital of its various activities and would want to grow its portfolio
of activities in a way that requires less regulatory capital.
Regulatory capital is generally defined in term s of regulatory
accounting. For purposes of an ERM system , com panies focus
on G A A P and econom ic capital. An exclusive focus on account­
ing capital is mistaken when accounting capital does not accu­
rately reflect the buffer stock of equity available to the firm.
The firm may have valuable assets that, although not marked to
market on its books, could be sold or borrowed against. In such
cases, the firm's book equity capital understates the buffer stock
available to it that could be used to avoid default.
Thus, in assessing the level of a company's buffer of capital, this
suggests that the amount of its G A A P equity capital is only part
of the story. The composition and liquidity of the assets matters
as well. If the firm incurs a large loss and has no liquid assets it
can use to "finance" it, the fact that it has a large buffer stock of
book equity will not be very helpful. For this reason, many com ­
panies now do separate evaluations of their liquidity and the
amount of equity capital they require. A s the practice of ERM
evolves, we would expect such com panies to pay more atten­
tion to the relation between the optimal amount of equity and
the liquidity of their assets.
Using Economic Capital to Make Decisions
As we saw earlier, if com panies could simply stockpile equity
capital at no cost, there would be no deadw eight costs associ­
ated with adverse outcom es. M anagem ent could use its liquid
assets to finance the losses, and the bad outcom e would have
no effect on the firm's investm ent policy. But in the real world,
there are significant costs associated with carrying too much
equity. If the market perceives that a company has more equity
than it needs to support the risk of the business, it will reduce
the firm's value to reflect management's failure to earn the cost
of capital on that excess capital.
W hen a company undertakes a new risky activity, the probability
that it will experience financial distress increases, thus raising
the expected costs of financial distress. O ne way to avoid these
additional costs is by raising enough additional capital so that
taking on the new risky activity has no effect on the probability
of financial distress. Consequently, the most straightforward
Chapter 2 Enterprise Risk Management: Theory and Practice
way to estim ate the cost of the impact of a new risky activity on
the firm's total risk is to evaluate how much incremental capital
would be necessary to ensure that the new risky activity has no
impact on the firm's probability of financial distress.
To illustrate, suppose that before the company takes on the new
activity, the VaR estim ate used to set the firm's capital is $5 bil­
lion. Now, with the new activity, this VaR estim ate increases
to $5.1 billion. Thus, for the firm to have the same probability
of financial distress as it had before it undertook the new risky
activity, it would need to raise capital of $100 million. Moreover,
this capital would have to be invested in such a way that the
investment does not increase the risk of the firm, since otherwise
the VaR of the firm would further increase. If the risky new activ­
ity is expected to last one year, and the cost to the firm of having
this additional $100 million available for one year is estimated to
be $8 million, then the econom ic value added of the new activ­
ity should be reduced by $8 million. If the firm ignores this cost,
it effectively subsidizes the new risky activity. To the extent that
riskier activities have higher expected payoffs before taking into
account their contribution to the firm's probability of financial
distress, a firm that ignores the impact of project risks on firm ­
wide risk ends up favoring riskier projects over less risky ones.
Though the exam ple just discussed is straightforward, the
implementation of this idea in practice faces several difficulties.
A com pany is a collection of risky projects. A t any tim e, a proj­
ect's contribution to the firm's total risk depends on the risk of
the other projects and their correlations. When business units
are asked to make decisions that take into account the contri­
bution of a project to firm-wide risk, they must have enough
information when making the decision to know how to evaluate
that contribution. They cannot be told that the contribution will
depend on everything else that is going to happen within the
firm over the next year, and then have a risk charge assigned to
their unit after the fact.
Many com panies sidestep this issue and ignore correlations alto­
gether when they set capital. In that case, the capital required
to support a project would be set so that the project receives
no benefit from diversification, and the contribution of the
project to firm-wide risk would then be the VaR of the project
itself. To account for diversification benefits under this system ,
the firm would reduce the cost of equity. But when evaluating
the perform ance of a business unit, the VaR of the business
unit would be used to assess the contribution of the unit to
the firm's risk and the units would effectively get no credit for
diversification benefits.
When decentralizing the risk-return trade-off, the company has
to enable the managers of its business units to determ ine the
capital that has to be allocated to a project to keep the risk of
■ 25
the firm constant with the relatively simple information that is
readily available to them . Nationwide's factor-based capital allo­
cation and perform ance evaluation system is an exam ple of such
an approach. The com pany allocates diversification benefits
within major business units, but not across them . This means
that a project whose returns have a low correlation with the
other activities within its unit will receive "cred it" for such diver­
sification benefits in the form of a lower capital allocation for the
unit. But investments of a business unit that have low correla­
tions with activities of other major business units are not cred­
ited with firm-wide diversification benefits. The rationale for this
policy is that it enables Nationwide's top m anagem ent to take
account of the effects of new investments on risk at the corpo­
rate level while at the same tim e holding the business managers
who make those decisions accountable for earning returns con­
sistent with their com petitive operating environment.
The Governance of ERM
How does a com pany know that its ERM is succeeding? W hile
one outcom e of effective ERM should be a better estim ate of
expected value and better understanding of unexpected losses,
ERM does not eliminate risk. Thus, extrem e negative outcomes
are still a possibility, and the effectiveness of ERM cannot be
judged on whether such outcom es m aterialize. The role of ERM
is to limit the probability of such outcom es to an agreed-upon,
value-m axim izing, level. But what if the probability of default
is set at one in 1,000 years? Q uite apart from whether this is
indeed the value-maximizing choice, such a low probability
means that there will be no obvious way to judge whether the
C RO succeeded in managing risk so as to give the firm its target
probability of default.
To evaluate the job of a C R O , the board and the C E O must
attem pt to determ ine how well the company's risk is understood
and m anaged. A company where risk is well understood and
well managed is one that can command the resources required
to invest in the valuable projects available to it because it is
26 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
trusted by investors. In such cases, investors will be able to
distinguish bad outcom es that are the result of bad luck rather
than bad m anagem ent, and that should give them confidence to
keep investing in the firm.
CON CLUSION
In this chapter, we have discussed how enterprise risk m anage­
ment creates value for shareholders and exam ined the practical
issues that arise in the im plem entation of enterprise risk man­
agem ent. Although the key principles that underlie the theory
of ERM are well- established, it should be clear from this article
that additional research is needed to help with the im plem en­
tation of ERM . In particular, while much attention has been
paid to measures of tail risk like VaR, it has becom e clear from
attem pts to im plem ent ERM that a more com plete understand­
ing of the distribution of firm value is required. Though correla­
tions between different types of risks are essential in measuring
firm-wide risk, existing research provides little help in how to
estim ate these correlations. Com panies also find that some of
their most troubling risks— notably, reputational and strategic
risks— are the most difficult to quantify. A t this point, there is
little research that helps practitioners in assessing these risks,
but much to gain from having a better understanding of these
risks even if they cannot be quantified reliably.
In sum, there has been considerable progress in the im plem en­
tation of ERM , with the promise of major benefits for corporate
shareholders. And, as this implementation improves with the
help of academ ic research, these benefits can only be expected
to grow.
Brian Nocco is the C h ief Risk O fficer of N ationwide Insurance.
Rene Stulz is the Reese Chair of Banking and M onetary Econom ics at
O hio State University's Fisher School of Business and a research fellow
at the N BER and at the European Corporate G overnance Institute. He is
also a m em ber of the executive com m ittee of the Global Association of
Risk Professionals (G ARP).
What Is ERM?
Learning Objectives
A fter com pleting this reading you should be able to:

Describe Enterprise Risk M anagem ent (ERM) and compare
and contrast differing definitions of ERM .
Com pare the benefits and costs of ERM and describe the
motivations for a firm to adopt an ERM initiative.
Describe the role and responsibilities of a chief risk officer
(CRO ) and assess how the C RO should interact with other
senior m anagem ent.
Describe the key com ponents of an ERM program.

E x c e rp t is C hapter 4 o f Enterprise Risk M anagem ent: From Incentives to Controls, S e co n d Edition, by Ja m es Lam.

27
Earlier, we reviewed the concepts and processes applicable to
almost all of the risks that a company will face. We also argued
that all risks can be thought of as a bell curve. Certainly, it is a
prerequisite that a com pany develop an effective process for
each of its significant risks. But it is not enough to build a sepa­
rate process for each risk in isolation.
Risks are by their very nature dynamic, fluid, and highly inter­
dependent. As such, they cannot be broken into separate com ­
ponents and managed independently. Enterprises operating in
today's volatile environm ent require a much more integrated
approach to managing their portfolio of risks.
This has not always been recognized. Traditionally, com panies
managed risk in organizational silos. M arket, credit, and opera­
tional risks were treated separately and often dealt with by dif­
ferent individuals or functions within an institution. For exam ple,
credit experts evaluated the risk of default, m ortgage specialists
analyzed prepaym ent risk, traders were responsible for mar­
ket risks, and actuaries handled liability, mortality, and other
insurance-related risks. Corporate functions such as finance and
audit handled other operational risks, and senior line managers
addressed business risks.
However, it has becom e increasingly apparent that such a
fragm ented approach sim ply doesn't work, because risks are
highly interdependent and cannot be segm ented and managed
by entirely independent units. The risks associated with most
businesses are not one-to-one m atches for the primary risks
(m arket, credit, operational, and insurance) implied by most tra­
ditional organizational structures. Attem pting to manage them
as if they are is likely to prove inefficient and potentially danger­
ous. Risks can fall through the cracks, risk inter-dependencies
and portfolio effects may not be captured, and organizational
gaps and redundancies can result in suboptim al perform ance.
For exam ple, imagine that a com pany is about to launch a
new product or business in a foreign country. Such an initiative
would require:
• The business unit to establish the right pricing and market-
entry strategies;
• The treasury function to provide funding and protection
against interest rate and foreign-exchange (FX) risks;
• The Information Technology (IT) and operations function to
support the business; and
• The legal and insurance functions to address regulatory and
liability issues.
It is not difficult to see how an integrated approach could more
effectively manage these risks. An enterprise risk m anagem ent
(ERM) function would be responsible for establishing firm-wide
policies and standards, coordinate risk m anagem ent activities
28 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
across business units and functions, and provide overall risk
monitoring for senior m anagem ent and the board.
Nor is risk monitoring any more efficient under the silo
approach. The problem is that individual risk functions measure
and report their specific risks using different m ethodologies
and form ats. For exam ple, the treasury function might report
on interest rate and FX risk exposures, and use value-at-risk as
its core risk m easurem ent m ethodology. On the other hand,
the credit function would report delinquencies and outstand­
ing credit exposures, and measure such exposures in term s of
outstanding balances, while the audit function would report out­
standing audit items and assign some sort of audit score, and
so on.
Senior m anagem ent and the board get pieces of the puzzle,
but not the whole picture. In many com panies, the risk func­
tions produce literally hundreds of pages of risk reports, month
after month. Yet, oftentim es, they still don't manage to provide
m anagem ent and the board with useful risk information. A good
acid test is to ask if the senior m anagem ent knows the answers
to the following basic questions:
• W hat are the company's top 10 risks?
• Are any of our business objectives at risk?
• Do we have key risk indicators that track our critical risk
exposures against risk tolerance levels?
• W hat were the company's actual losses and incidents, and did
we identify these risks in previous risk assessm ent reports?
• Are we in com pliance with laws, regulations, and corporate
risk policies?
If a company is uncertain about the answers to any of these
questions, then it is likely to benefit from a more integrated
approach to handling all aspects of risk— enterprise risk man­
agem ent (ER M ).1
3.1 ERM DEFINITIONS
Since the practice of ERM is still relatively new, there have yet
to be any widely accepted industry standards with regard to the
definition of ERM . As such, a multitude of different definitions is
available, all of which highlight and prioritize different aspects of
ERM . Consider, for exam ple, a definition provided by the Com ­
mittee of Sponsoring Organizations of the Treadway Com m is­
sion (C O SO ) in 2004:
1 O ther popular term s used to describe enterprise risk m anagem ent
include firm -wide risk m anagem ent, integrated risk m anagem ent, and
holistic risk m anagem ent.
 "ERM is a process, effected by an entity's board of
directors, m anagem ent, and other personnel, applied in
strategy setting and across the enterprise, designed to
identify potential events that may affect the entity, and
manage risk to be within its appetite, to provide rea­
sonable assurance regarding the achievem ent of entity
objectives."
Another definition was established by the International O rgani­
zation of Standardization (ISO 31000):
Risk is the "effect of uncertainty on objectives" and risk
m anagem ent refers to "coordinated activities to direct
and control an organization with regard to risk."
W hile the C O S O and ISO definitions provide useful concepts
(e.g ., linkage to objectives), I think it is im portant that ERM is
defined as a value added function. Therefore, I would suggest
the following definition:
Risk is a variable that can cause deviation from an
expected outcom e. ERM is a com prehensive and inte­
grated fram ework for managing key risks in order to
achieve business objectives, minimize unexpected earn­
ings volatility, and maximize firm value.
The lack of a standard ERM definition can cause confusion for a
com pany looking to set up an ERM fram ework. No ERM defini­
tion is perfect or applicable to every organization. My general
advice is for each organization to adopt an ERM definition and
fram ework that best fit their business scope and com plexity.
3.2 THE BEN EFITS O F ERM
ERM is all about integration, in three ways.
First, enterprise risk m anagem ent requires an integrated risk
organization. This most often means a centralized risk m anage­
ment unit reporting to the C E O and the Board in support of
their corporate- and board-level risk oversight responsibilities.
A growing number of com panies now have a C h ief Risk O fficer
(CRO ) who is responsible for overseeing all aspects of risk within
the organization— we'll consider this developm ent later.
Second, enterprise risk m anagem ent requires the integration
of risk transfer strategies. Under the silo approach, risk transfer
strategies were executed at a transactional or individual risk
level. For exam ple, financial derivatives were used to hedge
market risk and insurance to transfer out operational risk. How­
ever, this approach doesn't incorporate diversification within or
across the risk types in a portfolio, and thus tends to result in
over-hedging and excessive insurance cover. An ERM approach,
by contrast, takes a portfolio view of all types of risk within a
company and rationalizes the use of derivatives, insurance, and
alternative risk transfer products to hedge only the residual risk
deem ed undesirable by m anagem ent.
Third, enterprise risk m anagem ent requires the integration of
risk m anagem ent into the business processes of a company.
Rather than the defensive or control-oriented approaches used
to manage downside risk and earnings volatility, enterprise risk
m anagem ent optim izes business perform ance by supporting
and influencing pricing, resource allocation, and other business
decisions. It is during this stage that risk m anagem ent becomes
an offensive weapon for m anagem ent.
All this integration is not easy. For most companies, the implemen­
tation of ERM implies a multi-year initiative that requires ongoing
senior management sponsorship and sustained investments in
human and technological resources. Ironically, the amount of time
and resources dedicated to risk management is not necessarily
very different for leading and lagging organizations.
The most crucial difference is this: leading organizations make
rational investments in risk m anagem ent and are proactive, opti­
mizing their risk profiles. Lagging organizations, on the other
hand, make disconnected investments and are reactive, fighting
one crisis after another. The investments of the leading com pa­
nies in risk m anagem ent are more than offset by improved effi­
ciency and reduced losses.
Let's discuss the three major benefits to ERM : increased organi­
zational effectiveness, better risk reporting, and improved busi­
ness perform ance.
Organizational Effectiveness
Most com panies already have risk m anagem ent and corporate-
oversight functions, such as finance/insurance, audit and com pli­
ance. In addition, there may be specialist risk units: for exam ple,
investm ent banks usually have market risk m anagem ent units,
while energy com panies have com m odity risk managers.
The appointm ent of a chief risk officer and the establishm ent of
an enterprise risk function provide the top-down coordination
necessary to make these various functions work cohesively and
efficiently. An integrated team can better address not only the
individual risks facing the company, but also the interdependen­
cies between these risks.
Risk Reporting
As previously noted, one of the key requirements of risk man­
agem ent is that it should produce tim ely and relevant risk
reporting for the senior m anagem ent and board of directors.
As we also noted, however, this is frequently not the case. In a
Chapter 3 What Is ERM? ■ 29
silo fram ework, either no one takes responsibility for overall risk
reporting, and/or every risk-related unit supplies inconsistent
and som etim es contradictory reports.
An enterprise risk function can prioritize the level and content
of risk reporting that should go to senior m anagem ent and the
board: an enterprise-wide perspective on aggregate losses, pol­
icy exceptions, risk incidents, key exposures, and early-warning
indicators. This might take the form of a risk dashboard that
includes tim ely and concise information on the company's key
risks. O f course, this goes beyond the senior m anagem ent level;
the objective of ERM reporting is by its nature to increase risk
transparency throughout an organization.
Business Performance
Com panies that adopt an ERM approach have experienced
significant im provem ents in business perform ance. Figure 3.1
provides exam ples of reported benefits of ERM from a cross-
section of com panies. ERM supports key m anagem ent decisions
such as capital allocation, product developm ent and pricing, and
mergers and acquisitions. This leads to improvements such as
reduced losses, lower earnings volatility, increased earnings, and
improved shareholder value.
These im provem ents result from taking a portfolio view of all
risks; managing the linkages between risk, capital, and profit­
ability; and rationalizing the company's risk transfer strategies.
The result is not just outright risk reduction: com panies that
understand the true risk/return econom ics of a business can take
more of the profitable risks that make sense for the company
and less of the ones that don't.
Despite all these benefits, many com panies would balk at
the prospect of a full-blown ERM initiative were it not for the
Benefit Company
M arket value im provem ent Top money center bank
Early warning of risks Large commercial bank
Loss reduction Top asset-m anagem ent
company
Regulatory capital relief Large international commercial
and investm ent bank
Risk transfer rationalization Large property and casualty
insurance company
Insurance premium reduction Large manufacturing company
Fiqure 3.1 ERM benefits.
30 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
existence of heavy internal and external pressures. In the busi­
ness world, managers are often galvanized into action after a
near miss— either a disaster averted within their own organiza­
tion or an actual crisis at a similar organization.
In response, the board and senior m anagem ent are likely to
question the effectiveness of the control environm ent and
the adequacy of risk reporting within their com pany. To put it
another way, they will begin to question how well they really
know the organization's major risk exposures.
Such incidents are also often followed by critical assessments
from auditors and regulators— both groups which are constitu­
tionally concerned with the effectiveness of risk managem ent.
Consequently, regulators focus on all aspects of risk during
exam inations, setting risk-based capital and com pliance require­
ments, and reinforcing key roles for the board and senior man­
agem ent in the risk m anagem ent process.
This introspection often leads to the em ergence of a risk cham ­
pion among the senior executives who will sponsor a major
program to establish an enterprise risk m anagem ent approach.
As noted above, this risk champion is increasingly becoming a
form alized senior m anagem ent position— the chief risk officer,
or C R O .
Aside from this, direct pressure also comes from influential
stakeholders such as shareholders, em ployees, ratings agencies,
and analysts. Not only do such stakeholders exp ect more earn­
ings predictability, m anagem ent have few er excuses today for
not providing it. O ver the past few years, volatility-based m od­
els such as value-at-risk (VaR) and risk-adjusted return on capital
(RARO C) have been applied to measure all types of market risk
within an organization; their use is now spreading to credit risk,
and even to operational risk. The increasing availability and
liquidity of alternative risk transfer products— such as credit
Actual Results
O utperform ed S&P 500 banks by 58% in stock price
perform ance
Assessm ent of top risks identified over 80% of future losses;
global risk limits cut by one-third prior to Russian crisis
30% reduction in the loss ratio enterprise-wide; up to 80%
reduction in losses at specific business units
$1 Billion reduction of regulatory capital requirem ents, or
about 8-10%
$40 million in cost savings, or 13% of annual reinsurance
premium
20-25% reduction in annual insurance premium
derivatives and catastrophe bonds— also means that com panies
are no longer stuck with many of the unpalatable risks they
previously had no choice but to hold. O verall, the availability of
such tools makes it more difficult and less acceptable for com ­
panies to carry on with more primitive and inefficient alterna­
tives. Managing risk is management's job.
3.3 THE CH IEF RISK O FFIC ER
The role of a chief risk officer has received a lot of attention
within the risk m anagem ent community, as well as from the
finance and general m anagem ent audiences. Articles on chief
risk officers and ERM appear frequently in trade publications
such as Risk M agazine and Risk and Insurance, but have also
been covered in general publications such as C F O magazine,
the Wall S tre e t Journal, and even USA Today.
• • •
Today, the role of the CRO has been widely adopted in risk­
intensive businesses such as financial institutions, energy firms,
and non-financial corporations with significant investment activities
and/or foreign operations. Today, I would estimate that as many
as up to 80% of the biggest U.S. financial institutions have CRO s.
The recent financial and econom ic m eltdowns have increased
the demand for com prehensive ERM fram eworks. As an indica­
tion of this increased dem and, executive m anagem ent training
programs in ERM are increasingly offered by leading business
schools. For exam ple, in Novem ber 2010, Harvard Business
School im plem ented a five-day program designed to train
C E O s, C O O s, and C R O s in managing risk as corporate leaders:
there have been two other sessions to date, one in February
o
2012, and one just recently, in February 2013.
Typical reports to the C R O are the heads of credit risk, mar­
ket risk, operational risk, insurance, and portfolio m anage­
ment. O ther functions that the C RO is commonly responsible
for include risk policy, capital m anagem ent, risk analytics and
reporting, and risk m anagem ent within individual business units.
In general, the office of the C RO is directly responsible for:
• Providing the overall leadership, vision, and direction for
enterprise risk m anagem ent;
• Establishing an integrated risk m anagem ent fram ework for all
aspects of risks across the organization;
• Developing risk m anagem ent policies, including the quantifi­
cation of the firm's risk appetite through specific risk limits;
2 W inokur, L.A . "The Rise of the Risk Leader: A Reappraisal," Risk Pro­
fessional, April 2012, 20.
• Implementing a set of risk indicators and reports, including
losses and incidents, key risk exposures, and early warning
indicators;
• Allocating econom ic capital to business activities based on
risk, and optimizing the company's risk portfolio through
business activities and risk transfer strategies;
• Com m unicating the company's risk profile to key stakehold­
ers such as the board of directors, regulators, stock analysts,
rating agencies, and business partners; and
• Developing the analytical, system s, and data m anagem ent
capabilities to support the risk m anagem ent program
Still, given that enterprise risk m anagem ent is still a relatively
new field, many of the kinks have yet to be smoothed out of the
C hief Risk O fficer role. For exam ple, there are still substantial
amounts of ambiguity with regard to where the C R O stands in
the hierarchy between the board of directors and other C-level
positions, such as C E O s, C F O s, and C O O s.
In many instances, the C R O reports to the C FO or C E O — but
this can make firms vulnerable to internal friction when serious
clashes of interest occur between corporate leaders. For exam ­
ple, when Paul Moore, form er head of regulatory risk at H BO S,
claimed that he had been "fired . . . for warning about reckless
lending," the resulting investigations led to the resignation of
H BO S' chief executive, Sir Jam es Crosby, as the deputy chair­
man of the Financial Services A uthority.*•3
One organizational solution is to establish a dotted-line report­
ing relationship between the chief risk officer and the board or
board risk com m ittee. Under extrem e circum stances (e.g ., C E O /
C FO fraud, major reputational or regulatory issues, excessive
risk taking beyond risk appetite tolerances), that dotted line may
convert to a solid line so that the chief risk officer can go directly
to the board without fear for his or her job security or com pen­
sation. Ultim ately, to be effective, risk m anagem ent must have
an independent voice. A direct communication channel to the
board is one way to ensure that this voice is heard.4
For these dotted-line reporting structures between the C RO
and the board (and between the business line risk officers and
the C R O ), it is critical that an organization clearly establish and
docum ent the ground rules. Basic ground rules include risk
escalation and communication protocols, and the role of the
board or C RO in hiring/firing, annual goal setting, and com pen­
sation decisions of risk and com pliance professions who report
to them .
3 Davy, Peter. "Cinderella M om ent," Wall S tre e t Journal, O ctober 5, 2010.
4 Lam, Jam es. "Structuring for A cco untab ility," Risk Progressional, Ju n e
2009, 44.
Chapter 3 What Is ERM? ■ 31
Another board risk oversight option is to alter existing audit
com m ittees to incorporate risk m anagem ent. In a survey of the
S&P 500, "58% of respondents said that their audit com m ittees
were responsible for risk m anagem ent."5 However, this presents
problems of its own; oftentim es, audit com m ittees are already
working at maximum capacity just handling audit m atters, and
are unable to properly oversee ERM as well. Henry Ristuccia, of
Deloitte, affirms that unless the "audit com m ittee [can improve]
its grasp of risk m an ag em en t. . . a separate risk com m ittee
needs to be fo rm e d ."6
The lack of an ERM standard is also a significant barrier to the
positive developm ent of the C R O role. Mona Leung, C FO
of Alliant Credit Union, says that "w e have too many varying
definitions" of enterprise risk m anagem ent, with the result
that ERM means something different to every company, and
is im plem ented in different ways. O f course, firms from differ­
ent industries should (and must) tailor their approaches to risk
m anagem ent in order to m eet the requirements of their specific
business models and regulatory fram eworks, but nonetheless, it
is im portant to have a general ERM standard.
Despite the remaining am bivalences in the structure of the
C RO role, I believe that it has elevated the risk m anagem ent
profession in some im portant ways. First and forem ost, the
appointm ent of executive managers whose primary focus is
risk m anagem ent has improved the visibility and organizational
effectiveness of that function at many com panies. The successes
of these appointm ents have only increased the recognition and
acceptance for the C RO position.
Second, the C R O position provides an attractive career path for
risk professionals who want to take a broader view of risk and
business m anagem ent. In the past, risk professionals could only
aspire to becom e the head of a narrowly focused risk function
such as credit or audit. Nearly 70 percent of the 175 participants
in one online seminar that I gave on Septem ber 13, 2000, said
they aspired to becom e C R O s.
Today, C R O s have begun to move even further up the corpo­
rate ladder by becom ing serious contenders for the positions
of C E O and C F O . For exam ple, M atthew Feldm an, form erly
C R O of the Federal Home Loan Bank of C hicago, was
appointed its C E O and President in May of 2008. Likew ise,
D eutsche Bank C R O Hugo Banziger was a candidate for UBS
C E O . Kevin Buehler, of M cKinsey & C o .'s, affirm s that the
gradual m ovem ent of C R O s from control functions to more
5 Banham , Russ. "D isaster A ve rte d ," C F O M agazine, April 1, 2011, 2.
6 Ibid.
32 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
strategic roles is the prim ary contributing factor to their suc­
cess, and that with the com ing years, this progress is only
likely to a cce le ra te .7
• • •
Some argue that a com pany shouldn't have a C RO because that
job is already fulfilled by the C E O or the C F O . Supporting this
argum ent is the fact that the C E O is always going to be ulti­
mately responsible for the risk (and return) perform ance of the
com pany, and that many risk departm ents are part of the C FO 's
organization. So why create another C-level position of C RO and
detract from the C EO 's or C FO 's responsibilities?
The answer is the same reason that com panies create roles for
other C-level positions, such as chief information officers or
chief marketing officers. These roles are defined because they
represent a core com petency that is critical to the success for
the company— the C E O needs the experience and technical
skills that these seasoned professionals bring. Perhaps not every
company should have a full-time C R O , but the role should be an
explicit one and not simply one implied for the C E O or C F O .
For com panies operating in the financial or energy m arkets, or
other industries where risk m anagem ent represents a core com ­
petency, the C R O position should be considered a serious pos­
sibility. A C RO would also benefit com panies in which the full
breadth of risk m anagem ent experience does not exist within
the senior m anagem ent team , or if the build-up of required risk
m anagem ent infrastructure requires the full-time attention of an
experienced risk professional.
W hat should a company look for in a C R O ? An ideal C RO would
have superb skills in five areas. The first would be the leadership
skills to hire and retain talented risk professionals and establish
the overall vision for ERM . The second would be the evangeli­
cal skills to convert skeptics into believers, particularly when it
com es to overcoming natural resistance from the business units.
Third would be the stewardship to safeguard the company's
financial and reputational assets. Fourth would be to have the
technical skills in strategic, business, credit, market, and opera­
tional risks. And, last but not least, fifth would be to have con­
sulting skills in educating the board and senior m anagem ent,
as well as helping business units im plem ent risk m anagem ent
at the enterprise level. W hile it is unlikely that any single indi­
vidual would possess all of these skills, it is im portant that these
com petencies exist either in the C RO or elsewhere within his or
her organization.
7 W inokur, L. A . "Th e Rise of the Risk Leader: A Reappraisal," Risk
Professional, April 2012, 17.
3.4 CO M PO N EN TS O F ERM
A successful ERM program can be broken down into seven key
com ponents (see Figure 3.2). Each of these com ponents must
be developed and linked to work as an integrated whole. The
seven com ponents include:
1. Corporate governance to ensure that the board of directors
and m anagem ent have established the appropriate organi­
zational processes and corporate controls to measure and
manage risk across the company.
2. Line m anagem ent to integrate risk m anagem ent into the
revenue-generating activities of the com pany (including
business developm ent, product and relationship m anage­
ment, pricing, and so on).
Corporate Governance
Corporate governance ensures that the board of directors and
m anagem ent have established the appropriate organizational
processes and corporate controls to measure and manage risk
across the com pany. The mandate for effective corporate gov­
ernance has been brought to the forefront by regulatory and
industry initiatives around the world. These initiates include the
Treadway Report from the United States, the Turnbull Report
from the UK, and the Dey Report from Canada. All of these
made recom m endations for establishing corporate controls
and emphasized the responsibilities of the board of directors
and senior m anagem ent. Additionally, the Sarbanes-O xley A ct
provides both specific requirem ents and severe penalties for
non-compliance.

3. Portfolio m anagem ent to aggregate risk exposures, incor­
porate diversification effects, and monitor risk concentra­
tions against established risk limits.
4. Risk transfer to mitigate risk exposures that are deem ed too
high, or are more cost-effective to transfer out to a third
party than to hold in the company's risk portfolio.
5. Risk analytics to provide the risk m easurem ent, analysis, and
reporting tools to quantify the company's risk exposures as
well as track external drivers.
6 . Data and technology resources to support the analytics and
reporting processes.
7. Stakeholder m anagem ent to com m unicate and report the
company's risk information to its key stakeholders.
Let's consider these in turn.
From an ERM perspective, the responsibilities of the board of
directors and senior m anagem ent include:
• Defining the organization's risk appetite in term s of risk poli­
cies, loss tolerance, risk-to-capital leverage, and target debt
rating.
• Ensuring that the organization has the risk management skills
and risk absorption capability to support its business strategy.
• Establishing the organizational structure of the ERM fram e­
work and defining the roles and responsibilities for risk man­
agem ent, including the role of chief risk officer.
• Implementing an integrated risk m easurem ent and m anage­
ment fram ework for strategic, business, operational, financial,
and com pliance risks.
• Establishing risk assessm ent and audit processes, as well
as benchmarking company practices against industry best
practices.

• Shaping the organization's risk culture by setting the tone

from the top not only through words but also through
1. Corporate G overnance
Establish top-down risk management actions, and reinforcing that com m itm ent through incentives.

• Providing appropriate opportunities for organizational learn­

3. Portfolio 4. Risk Transfer ing, including lessons learned from previous problem s, as
2. Line M anagem ent
M anagem ent Transfer out well as ongoing training and developm ent.
Business strategy
Think and act like a concentrated or
alignment
"fund manager" inefficient risks

6. Data and Technology

Line Management
5. Risk Analytics
Resources
Develop advanced Perhaps the most im portant phase in the assessm ent and pricing
Integrated data and
analytical tools of risk is at its inception. Line m anagem ent must align business
system capabilities
strategy with corporate risk policy when pursuing new business
7. Stakeholders M anagem ent and growth opportunities. The risks of business transactions
Improve risk transparency for key stakeholders
should be fully assessed and incorporated into pricing and prof­
Fiqure 3.2 Seven components of ERM. itability targets in the execution of business strategy.

Chapter 3 What Is ERM? ■ 33

Specifically, expected losses and the cost of risk capital should
be included in the pricing of a product or the required return of
an investm ent project. In business developm ent, risk acceptance
criteria should be established to ensure that risk m anagem ent
issues are considered in new product and market opportuni­
ties. Transaction and business review processes should be
developed to ensure the appropriate due diligence. Efficient
and transparent review processes will allow line managers to
develop a better understanding of those risks that they can
accept independently and those that require corporate approval
or m anagem ent.
Portfolio Management
The overall risk portfolio of an organization should not just
happen— that is, it should not just be the cumulative effect of
business transactions conducted entirely independently. Rather,
m anagem ent should act like a fund manager and set portfolio
targets and risk limits to ensure appropriate diversification and
optimal portfolio returns.
The concept of active portfolio m anagem ent can be applied
to all the risks within an organization. D iversification effects
from natural hedges can only be fully captured if an orga­
nization's risks are view ed as a w hole, in a portfolio. More
im portantly, the portfolio m anagem ent function provides
a direct link between risk m anagem ent and shareholder
value m axim ization.
For exam ple, a key barrier for many insurance com panies in
implementing ERM is that each of the financial risks within the
overall business portfolio is managed independently. The actu­
arial function is responsible for estimating liability risks arising
for the company's insurance policies; the investm ent group
invests the company's cash flows in fixed-incom e and equity
investments. The interest rate risk function hedges mismatches
between assets and liabilities. However, an insurance company
which has im plem ented ERM would manage all of its liabil­
ity, investm ent, interest rate, and other risks as an integrated
whole in order to optim ize overall risk/return. The integration
of financial risks is one step in the ERM process, while strategic,
business, and operational risks must also be considered in the
overall ERM fram ework.
Risk Transfer
Portfolio m anagem ent objectives are supported by risk transfer
strategies that lower the cost of transferring out undesirable
risks, and also increase the organization's capacity to originate
34 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
desirable but concentrated risks. To reduce undesirable risks,
m anagem ent should evaluate derivatives, insurance, and hybrid
products on a consistent basis and select the most cost-effective
alternative. For exam ple, corporations such as Honeywell and
Mead have used alternative risk transfer (ART) products that
com bine traditional insurance protection with financial risk pro­
tection. By bundling various risks, risk managers have achieved
estim ated savings of 20 to 30% in the cost of risk transfer.
A com pany can dram atically reduce its hedging and insurance
costs— even without third-party protection— by incorporat­
ing the natural hedges that exist in any risk portfolio. In the
course of doing business, com panies naturally develop risk
concentrations in their areas of specialization. The good news
is that they should be very capable of analyzing, structuring,
and pricing those risks. The bad news is that any risk concentra­
tion can be dangerous. By transferring undesirable risks to the
secondary market— through credit derivatives or securitization,
for exam ple— an organization can increase its risk origination
capacity and revenue without accumulating highly concentrated
risk positions.
Finally, m anagem ent can purchase desirable risks that they
cannot directly originate on a tim ely basis, or swap undesir­
able risk exposures for desirable risk exposures through a
derivative contract.
Risk Analytics
The developm ent of advanced risk analytics has supported
efforts to quantify and manage credit, m arket, and operational
risks on a more consistent basis. The same techniques that allow
for the quantification of risk exposures and risk-adjusted profit­
ability can be used to evaluate risk transfer products such as
derivatives, insurance, and hybrid products. For exam ple, man­
agem ent can increase shareholder value through risk transfer
provided that the cost of risk transfer is lower than the cost of
risk retention for a given risk exposure (e.g ., 12% all-in cost of
risk transfer versus 15% cost of risk capital).
A lternatively, if m anagem ent wants to reduce its risk exposure,
risk analytics can be used to determ ine the most cost-effective
way to accom plish that objective. In addition to risk m itiga­
tion, advanced risk analytics can also be used to significantly
im prove net present value (NPV)- or econom ic value added
(EVA)-based decision tools. The use of scenario analyses and
dynam ic sim ulations, for exam ple, can support strategic plan­
ning by analyzing the probabilities and outcom es of different
business strategies as well as the potential im pact on share­
holder value.
Data and Technology Resources
O ne of the greatest challenges for enterprise risk m anagem ent
is the aggregation of underlying business and market data. Busi­
ness data includes transactional and risk positions captured in
different front- and back-office system s; m arket data includes
prices, volatilities, and correlations. In addition to data aggrega­
tion, standards and processes must be established to improve
the quality of data that is fed into the risk system s.
As far as risk technology goes, there is no single vendor soft­
ware package that provides a total solution for enterprise risk
m anagem ent. Organizations still have to either build, buy, and
customize or outsource the required functionality. Despite the
data and system challenges, com panies should not wait for
a perfect system solution to becom e available before estab­
lishing an enterprise risk m anagem ent program. Rather, they
should make the best use of what is available and at the same
tim e apply rapid prototyping techniques to drive the systems-
developm ent process. Additionally, com panies should consider
tapping into the power of the Internet/lntranet in the design of
an enterprise risk technology platform.
Stakeholder Management
Risk m anagem ent is not just an internal m anagem ent process. It
should also be used to improve risk transparency in a firm's rela­
tionship with key stakeholders. The board of directors, for exam ­
ple, needs periodic reports and updates on the major risks faced
by the organization in order to review and approve risk man­
agem ent policies for controlling those risks. Regulators need to
be assured that sound business practices are in place, and that
business operations are in com pliance with regulatory require­
ments. Equity analysts and rating agencies need risk information
to develop their investm ent and credit opinions.
An im portant objective for m anagem ent in com m unicating
and reporting to these key stakeholders is an assurance that
appropriate risk m anagem ent strategies are in effect. O ther­
w ise, the com pany (and its stock price) will not get full credit,
since interested parties will see the risks but may not see the
controls. The increasing em phasis of analyst presentations
and annual reports on a com pany's risk m anagem ent cap ab ili­
ties is evidence of the im portance now placed on stakeholder
com m unication . . . .
Chapter 3 What Is ERM? ■ 35
 Learning Objectives
A fter com pleting this reading you should be able to:

Describe best practices for the implementation and com­
munication of a risk appetite fram ework (RAF) at a firm.
Explain the relationship between a firm's RAF and its risk
culture, and between the RAF and a firm's strategy and
business planning process.
Assess the role of stress testing within an RAF, and
describe challenges in aggregating firm-wide risk
exposures.
Explain lessons learned in the implementation of a RAF
through the presented case studies.

Explain key challenges to the implementation of an

RAF and describe ways that a firm can overcom e each
challenge.

E x c e rp t is rep rin ted from Implementing Robust Risk A ppetite Fram eworks to Strengthen Financial Institutions, by the Institute o f
International Finance, Ju n e 2011.

37
INTRODUCTION
1. O ne of the key lessons of the financial crisis was that some
firms took more risk in aggregate than they were able to
bear given their capital, liquidity, and risk m anagem ent
capabilities, and some took risks that their m anage­
ment and Boards did not properly understand or control.
Indeed, in its O ctober 2009 report, Risk M anagem ent L e s­
sons from the G lobal Banking Crisis o f 2008, the Senior
Supervisors Group (SSG) highlighted major governance
challenges at the 20 largest banks in the most-affected
jurisdictions, in particular "the unwillingness or inability
of Boards of Directors and senior managers to articulate,
measure and adhere to a level of risk acceptable to the
firm ." The SSG concluded that "a key weakness in gov­
ernance stem med from . . . a disparity between the risks
that their firms took and those that their Boards of D irec­
tors perceived the firms to be taking." Put simply, Boards
did not understand well enough, or properly control in
advance, the risks that their firms were taking. These con­
clusions are not disputed by the Industry.
2. Three years after the crisis, largely as a consequence of
these conclusions, there is now consensus between super­
visors and the Industry that a clearly articulated statem ent
of risk appetite and the use of a well-designed risk ap p e­
tite fram ework to underpin decision-making are essential
to the successful m anagem ent of risk. Taken together,
such a statem ent and fram ework provide clear direction
for the enterprise and ensure alignment of expectations
among the Board, senior m anagem ent, the risk m anage­
ment function, supervisory bodies, and shareholders. In
combination with a strong risk culture, they provide the
cornerstone for building the effective enterprise-wide risk
m anagem ent fram ework that is essential to the long-term
stability of a firm.
3. In 2008 the Institute of International Finance form ed a
high-level Com m ittee on M arket Best Practices (CM BP) to
draw key lessons for the financial services industry from
the global financial crisis that was unfolding at that tim e.
The C M BP issued a report containing a number of key
principles and recom m endations for the Industry, focusing
on areas such as governance, risk m anagem ent, and trans­
parency. The core purpose of these recom m endations was
to promote much more robust risk m anagem ent and gov­
ernance fram eworks in financial institutions.
4. Early in the discussion and analytical process that led to
the final C M BP report, IIF members identified risk appetite
as being of fundamental im portance. The C M BP report
defined risk appetite as "a firm's view on how strategic risk
38 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
taking can help achieve business objectives while respect­
ing constraints to which the organization is subject." A key
finding of the C M BP was that putting in place a robust risk
appetite fram ework constitutes an essential com ponent
of adequate risk m anagem ent. The C M BP elaborated on
a number of aspects regarding risk appetite, including the
high-level governance aspects of defining and im plem ent­
ing a risk appetite fram ework.
5. In 2009 the IIF, recognizing the need to actively promote
the im plem entation of the C M BP recom m endations,
established a Steering Com m ittee on Implementation
(SCI). This com m ittee was charged with steering the EF's
efforts on further analysis of key risk m anagem ent im plica­
tions of the crisis as well as tracking EF m em bers' efforts
in revising their practices and implementing Industry
practices recom m endations. In D ecem ber 2009 the SCI
issued its report, Reform in the Financial Services Industry:
Strengthening Practices for a M ore Stable System , which
assessed the progress made by the Industry in im plem ent­
ing and em bedding revised risk m anagem ent and gover­
nance practices.
6. Am ong other issues, the 2009 SCI report focused once
again on risk appetite, further developing and discussing
the concept and a number of related issues. The report
also provided an augm ented definition of risk appetite
as being "the amount and type of risk that a company is
able and willing to accept in pursuit of its business objec­
tives." The statem ent of risk appetite balances the needs
of all stakeholders by acting both as a governor of risk
and a driver of current and future business activity. It is
expressed in both quantifiable and qualitative term s and
covers all risks." In particular, the 2009 report set out an
analytical fram ework for risk appetite and outlined a num­
ber of key issues in regard to the practical implementation
of the concept by financial firms.
7. Risk appetite has also received a great deal of atten­
tion from the regulatory community. In particular, the
SSG — which has been the public sector group most
deeply involved in the analysis of the risk m anagem ent
implications of the crisis— has focused extensively on risk
appetite issues and related supervisory im plications. Sp e­
cifically, the SSG's 2009 report, Risk M anagem ent Lessons
from the G lobal Banking Crisis o f 2008, identified risk
appetite as a crucial elem ent of robust risk m anagem ent.
The SSG identified a number of deficiencies in the way the
Industry was approaching risk appetite issues, observing,
for exam ple, that much more evidence was needed of
Board involvement in setting and monitoring adherence
to firms' risk appetite, and that the Industry needed to
 continue working to make risk appetite statem ents much
more robust to encom pass a suitably wide range of m ea­
sures and actionable elem ents.
8. In D ecem ber 2010, the SSG issued another report, O b ser­
vations on D evelopm en ts in Risk A p p e tite Fram eworks
and IT Infrastructure, which elaborated on this subject. In
particular, the SSG highlighted the im portance of Board
and senior m anagem ent involvem ent in the articulation
and implementation of the risk appetite fram ework and
em phasized the need to em bed revised practices within
firms so that such practices can be sufficiently resilient in
an increasingly com petitive environment.
9. W hile there is clearly a substantial amount of ongoing
work by both the Industry and the regulatory community
in the area of risk appetite fram eworks, it is widely recog­
nized that additional guidance would be helpful as firms
continue refining their practices and m ethodologies. The
reports by the 11F and the SSG , together with the substan­
tial experience gained by firms in the last several years,
constitute a fertile ground in which to continue developing
guidance as to how m anagem ent and Boards should con­
front and resolve difficult, basic issues linked to the design
and implementation of a risk appetite fram ework.
10. As fi rms, in response to the crisis, continue to make
progress in improving their risk appetite processes, pri­
marily in pursuit of stronger risk m anagem ent but also
to meet evolving supervisory expectations, additional
guidance should draw on lessons from firms' experience
and from the successful practices that are being devel­
oped globally by many in the Industry. This can, in turn,
form the basis for a constructive dialogue with the global
supervisory community.
11. In order to organize the in-depth analysis and discus­
sion of risk appetite issues, assess the Industry's state of
practice on the subject, and learn by leveraging the exp e­
rience and expertise of a broad range of market partici­
pants, the 11F SCI established the Working Group on Risk
A ppetite (W G RA). The W G R A and the present report have
the following key objectives:
• To assess and evaluate current Industry practices in the
area of risk appetite.
• To identify the key stages and the technical and cultural
challenges in the journey toward setting— and moni­
toring adherence to— appropriate boundaries for risk,
within a sound risk appetite fram ework.
• To bring Industry expertise and sound practices to
bear on examining how these challenges have been
addressed, including the analysis of real-life case studies.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
• To develop specific practical recom m endations for
firms to address the challenges of implementing a
robust and meaningful risk appetite fram ework.
12. The W G R A has carried out an Industry survey, group dis­
cussions, interviews, and case studies involving a diverse
sam ple of participants globally. As detailed in A nnex II,
respondents to the survey represented a cross-section of
geography and institutional size, all at various stages of
the implementation journey. The survey was sent to 79
firms; 73 responses were received from 40 firms. Although
the survey responses received were rich and com prehen­
sive, in order to get behind them to understand at a prac­
tical level how challenges were overcom e to enable the
sharing of good practices, multiple them atic conference
calls, as well as bilateral in-depth discussions, were held
with Industry participants in several continents, covering
the key topics and challenges considered in Section 2. The
survey responses, conference calls, extensive bilateral dis­
cussions, and the four case studies supplied have provided
the background for our in-depth analysis of the current
challenges facing the Industry and a practical set of rec­
om mendations to move forward.
13. A nnex I presents four highly detailed case studies which
were generously provided, upon request, by Com m on­
wealth Bank of Australia, National Australia Bank, Royal
Bank of Canada, and Scotiabank. These case studies are
intended to com plem ent the evidence gathered through
the survey and the W G R A discussions and to provide valu­
able insights and "real-life" exam ples of the approaches
that large firms have taken to overcoming the challenges
involved in establishing a risk appetite fram ework (RAF).
The case studies represent an integral part of this report
and are recom m ended reading as they contain a wealth of
detailed information regarding the diversity of approaches
taken, the role of leadership and collaboration, the itera­
tive nature of RAF developm ent and the influence of cul­
ture in the risk appetite process.
SECTION 1 - PRINCIPAL FINDINGS
FROM THE INVESTIGATION
14. This section outlines a number of key findings of our
work on risk appetite, the extent to which the Industry
is em bracing it, and the principal im pedim ents to im ple­
mentation. It outlines a number of practical steps that
firms have taken to overcom e the principal challenges and
which form the basis of emerging Industry sound practices
in this evolving area. In some instances the findings of
■ 39
 this report are not new. The survey highlights, reinforces,
or otherwise clarifies issues that the Industry continues
to struggle with and that at tim es have been com mented
on elsew here. The report does, however, aim to offer
valuable insights on how many of these challenges are
being overcom e.
15. It is clear from the responses to the survey and from the
discussions that followed that developing a risk appetite
fram ework is a journey on which the Industry finds itself
in the early stages. Although the cultural, organizational,
and technical challenges are form idable and the major­
ity of firms are not yet where they either need or want to
be, our investigation has shown that a number of leading
firms in the Industry are making good progress. Evidence
suggests that there has been more progress in designing,
im plem enting, and em bedding risk appetite fram eworks—
at least in participating firms— than has been generally
realized until now.
16. The aggregate risk profiles of large financial institutions
are com plex, multidimensional, and, even where risk IT is
well developed, relatively o p aq ue.1 Consequently, devel­
oping a risk appetite fram ework requires tim e and signifi­
cant intellectual and financial resources. Not surprisingly,
the degree of progress varies across participating banks,
and a substantial gap is likely to remain for some time
between leading-edge practices and what is "typ ical."
O ne very striking feature of the results of this investiga­
tion, however, is the widespread recognition of the intrin­
sic im portance of risk appetite to good risk m anagem ent
and the motivation to get this right.
17. W here progress has been made to date, it has been
driven principally by a recognition by the firms' leadership
of the need to strengthen risk m anagem ent and gover­
nance arrangem ents. It has not typically been solely, or
even primarily, a response to specific regulatory or super­
visory requirem ents.
18. Not only are firms at different stages of developm ent
of their RAFs, they are also adopting a wide range of
approaches, as can be clearly seen from the important
and detailed case studies supplied in A nnex I. This reflects
differing business m odels, structures, and degrees of
com plexity. Thus, an im portant finding of our work is
that one size does not fit all. W hile some convergence of
practices can be expected to em erge over tim e, diversity
of approach is inevitable and should not be discouraged.
1 The identification of sound industry practices for risk IT is the subject
of a parallel IIF report: Risk IT and O p era tio n s: Stren gthening Capabili­
ties, Ju n e 2011.
40 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Supervisors need to be alert to this and avoid insist­
ing on form ulaic solutions that may not be aligned with
business needs.
19. Despite the different stages of developm ent of firms'
RAFs and the multiplicity of approaches being taken, our
investigation has shown that there is some convergence
of thought and experience around the im plem entation,
design, and im pact of an effective risk appetite fram e­
work. These areas of convergence include:
a. Successful im plem entation is highly dependent on
effective interactions among all key stakeholders,
including Board m em bers, senior m anagem ent, the
risk m anagem ent function, and the operating busi­
nesses. In a large m ajority of firm s, defining or setting
the risk appetite is initiated by senior m anagem ent
and, after an effective challenge process, is approved
by the Board. In all cases the "tone from the to p " was
essential to driving the process. It is clear that where
there is visible and continuous support of the risk
appetite concept from the Board and senior m anage­
m ent, the developm ent and im plem entation of the
risk appetite fram ew ork was much more effective in
all respects.
b. The in-depth discussion around the survey results
indicates quite clearly that putting in place an effec­
tive risk appetite framework is inextricably linked
to the risk culture of a firm. To be fully effective, the
risk appetite fram ew ork, together with an ap p recia­
tion of its benefits, needs to be dissem inated through­
out the institution. Done properly, im plem entation
of a risk appetite fram ew ork can act as a powerful
reinforcem ent to a strong risk culture in providing
a coherent rationale and consistent fram ew ork for
understanding risk at all levels. It can never substitute
for proper system s, controls, and limits, but instead
supplem ents and m otivates these and may even
increase com pliance. Firm s with strong risk cultures
that provide staff with guidance for their own behavior
and w hat to look for and challenge in others are much
more effective in the im plem entation process. This is
especially im portant when developing appetite state­
ments around those risks that are less quantifiable
(e .g ., operational risk, risks of legal or regulatory non-
com pliance, and reputational risk). It is also clear that
risks cannot be com pletely avoided, and aspirational
statem ents relating to "zero to leran ce" of certain
types of risk are less useful than detailed guidance to
the businesses about how such risks should be view ed
and m anaged.
c. W hile implementing an RAF is challenging, those
firms that have made progress are clear that they see
tangible benefits resulting from their risk appetite
process. W hile these benefits are not always apparent
at the start, there is a high degree of consensus among
such firms that the RAF is allowing the Board and the
senior m anagem ent to have a more informed discus­
sion of the risks in the business plan and strategy. Firms
reporting the most progress have also established
strong linkages between risk issues and strategy, plan­
ning, and finance— the last two of these being areas
in which risk was often not form ally considered in the
past. These linkages have been put in place at both
the enterprise-wide and business unit (BU) levels. Such
processes may, at least initially, make the resource
planning cycle longer and more com plicated, but this is
a price well worth paying in return for fostering a more
robust risk culture and a stronger awareness through­
out the organization. Firms at a more advanced stage
also highlight the benefits deriving from a stronger
integration of risk considerations into the strategic and
business plans and more effective risk/reward decision­
making across the organization. These benefits can be
clearly seen in the case studies attached in A nnex I.
d. There is a high degree of commonality around the most
relevant inputs driving the shaping of a firm's risk
appetite. Most often used is capital capacity, followed
by budget targets, liquidity, and other market con­
straints and stress test results. Although not captured in
the survey data, several firms em phasized that a firm's
overall strategy and financial objectives should be con­
sidered as a key input.
e. Limits and controls have a central role in any well-run
organization, but an excessively narrow emphasis on
granular limits (or too many of them) can provide false
com fort to m anagem ent and supervisors; lead to a
m echanical, "tick-box" (or com pliance-type) approach;
and detract from or undermine this crucial dialogue. A
strong RAF is much more powerful than limits alone:
staff at all levels with any significant responsibility
should know what they need to do and why, rather
than merely follow instructions. The overwhelm ingly
im portant conclusion from firms' experiences in this
area is that developing an RAF is not about putting in
place "tablets of stone" and creating and im plem ent­
ing a structure of many hundreds of highly granular
limits. It is im portant that stakeholders, including super­
visors, should recognize this when assessing progress in
this area.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
f. The survey shows that a large majority of firms (70%)
are taking a comprehensive view of all risks across
the firm, not merely focusing on those risks that can be
easily m easured, and are using a combination of quan­
titative and qualitative metrics in expressing risk ap p e­
tite. This reinforces the point that risk appetite does
not mean the creation of a com plex, highly granular
set of limits. That said, at this stage in the journey the
most common transmission mechanism for com muni­
cating Board-level risk appetite statem ents throughout
the enterprise is the translation into limits. This in part
reflects the quantifiable nature of some risks and pro­
vides for clear, recognizable boundaries.
g. Stress testing and stress metrics play a role in the
risk appetite fram ework of almost all respondents
(only one firm stated that they are not used). The use
of stress tests varies, with some banks putting them at
the center of the risk appetite setting process, whereas
others use stress tests primarily to "sense-check"
their appetite.
h. A large majority of those responding indicated that
risk appetite is monitored on an ongoing basis at the
group level and that a contingency plan or escalation
procedure is triggered when a risk appetite metric
is exceeded.
20. As noted above, the case studies in A nnex I are an essen­
tial part of this report and clearly illustrate many of the
points listed above.
SECTION 2 - K EY OUTSTANDING
CH A LLEN G ES IN IM PLEM ENTING
RISK APPETITE FRAM EW ORKS
21. Despite the visible progress being made by many in the
Industry in the im plem entation of effective risk appetite
fram eworks, more needs to be done. The survey and
discussion reveal there is a degree of com monality in the
hurdles firms are facing and the need for proven practi­
cal solutions to these issues. Section 3 provides a number
of exam ples of emerging Industry sound practices in
addressing these. This section outlines the largest chal­
lenges that are proving most difficult to overcom e. The
chart below shows the most relevant survey results in
this context.
22. The link with the wider risk culture is of central impor­
tance but is also problematic in some firms. Broad
discussion among firms reinforces the point that without
a strong risk culture success on the risk appetite journey
■ 41
 is extrem ely difficult, if not im possible, while it is easiest
to im plem ent an effective RAF where there is already a
strong culture around risk. However, a number of respon­
dents cited culture and its link to risk appetite as being an
im portant and difficult issue. A strong culture implies that
staff understand what is required of them with respect to
risk and why, and where such a strong risk culture exists it
may be possible for firms to place less reliance on narrow
com pliance with limits and processes. N evertheless, even
the strongest culture needs to be supported with good
system s, controls, and limits. It is also necessary to estab­
lish a strong link between risk appetite and com pensation.
A t the sim plest level this can be an assessm ent of whether
business results and key perform ance indicators (KPIs)
have been achieved by operating within limits and in
accordance with the behaviors and culture described and
em bedded within the risk appetite. W here this is not the
case remuneration incentive awards should be m oderated
or adjusted accordingly.
23. Effectively cascading the risk appetite framework
throughout the firm and embedding and integrating it
into the operational decision-making process is clearly
the largest challenge for almost all firms. W hile most firms
have risk policies and risk measures in the form of limits
that can easily be cascaded through the organization,
other guidance on risk tends to be more general and at a
higher level. The linkage between high-level risk appetite
principles and the risk policies and metrics guiding day-
to-day decision-making needs further developm ent. As
0 5
Effectively cascading the risk appetite statement through the operational levels
of the organization and embedding it into operational decision making processes
How to best express risk appetite for different risk types,
some of which can be quantified in generally accepted ways,
and some of which cannot be easily quantified
Using the risk appetite framework as a dynamic tool for managing risk rather than
another way of setting limits or strengthening compliance
Using the risk appetite framework as a driver of strategy and business decisions
Achieving sufficient clarity around the concept of risk appetite and some of the
terminology used (e.g. difference between risk appetite and risk limits)
How to effectively relate risk appetite to risk culture
How to make best use of stress-testing in the risk appetite process
How to most effectively aggregate risks from different business units and/or
different risk types, for risk appetite purposes
42 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
noted, firms that have been most successful in creating
an RAF to date have recognized that it needs to pervade
the organization in the sense that risk concepts are fully
understood by staff at a range of levels and influence
behavior as a result of being internalized. The benefits of a
risk appetite fram ework are often much more apparent to
Board members and senior m anagem ent than they are to
mid-level staff. This raises questions of how best to train
and educate staff to enable them to perceive the benefits
of the new approach and also touches upon the desired
responsibilities of m anagem ent in such training and the
way in which the new approaches can or should be sup­
plem ented with formal controls and limits.
24. The best way of expressing risk appetite in a way that
covers all relevant risks is also proving a challenge for
firms. This is particularly true in respect to risks that are
less quantifiable and require a more qualitative approach.
O nce the process moves beyond traditional credit
and market risks— where historical data is abundantly
available— to focus on reputational, strategic, and opera­
tional risks, significant challenges remain. However, it is
widely recognized that an RA F cannot be confined to risks
that can be easily m easured. To be meaningful, risk ap p e­
tite needs to take a com prehensive view across a firm,
and risk appetite statem ents need to capture and include
those risks that cannot be easily quantified. The identifi­
cation and effective mitigation of such risks is a difficult
challenge that is not, of course, confined to risk appetite.
W hile some firms are com fortable tracking these risks with
10 15 20 25
10 VJ 6
6 3
5 5 2
7 2 3
I
II
 qualitative indicators, most are making significant efforts
to quantify such risks, through, for exam ple, proxy m ea­
sures and use a combination of qualitative and detailed
quantitative elem ents in their risk appetite statem ents.
25. Some respondents are finding it difficult to shift the
perception that risk appetite is primarily about set­
ting limits. W hile limits and risk policies are important
com ponents of an effective risk appetite fram ework, the
more dynamic nature of risk appetite and its role in man­
aging risk, driving strategy, and optimizing return on a
much broader basis needs to be ingrained throughout
the organization. Ensuring that the RAF is positioned and
perceived internally as a dynamic tool for shaping the risk
profile of the institution, rather than as merely a dressed-
up, "grander" process for setting limits and additional
business constraints is also an im portant challenge. In real­
ity, it is necessary to strike the right balance between a
fram ework on the one hand which is so rigid, constraining
and inflexible over time as to be unable to sensibly and
prudently accom m odate the evolution of the businesses
and group strategy in a tim ely fashion, having due regard
to the risk im plications, and one on the other hand which
is excessively flexible and too easily substantially changed
from one period to the next (perhaps in response to any
number of proposed growth initiatives), and consequently
imposes insufficient discipline on the businesses, lacks
continuity, and is difficult for all em ployees to understand
and em brace. Striking this balance correctly requires care­
ful judgm ent by Boards and senior m anagem ent.
26. Many firms have difficulty forging the necessary links
between risk appetite and the strategic and busi­
ness planning processes, though leading firms have
done this successfully. It is relatively straightforward to
establish an RAF in the sense of the Board setting out
a statem ent of risk preferences that the business then
seeks to translate into a range of limits. There is a growing
recognition, however, that this is a very narrow concept
of risk appetite and that the establishm ent of actionable
guidance at the business unit level is crucial. The tradi­
tional approach of making high-level statem ents and then
seeking to turn these into a plethora of granular and not
well-understood limits has been shown to have serious
limitations, as it tends to result in risk appetite being seen
within the businesses as a remote and som etim es irrele­
vant part of the risk m anagem ent apparatus. A s explained
further below, risk appetite needs to be an integral part of
a business. Its effects need to be pervasive throughout the
organization, and there needs to be a clear link between
the RAF and business decisions.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
27. Stress testing, and how it should be effectively incor­
porated into the risk appetite framework, remains an
area of uncertainty and evolving practice in the Industry.
While it is widely accepted as being a component of an
effective risk appetite framework, there is less consensus
about exactly how stress testing should be incorporated
into a framework. The use of stress tests varies widely,
with some banks putting them at the center of the risk
appetite— setting process, even as others use stress tests
primarily to sense-check their appetite. As a general obser­
vation, the firms that were most affected by the financial
crisis appear to be more advanced in this area, but further
guidance is required for the majority. While an important
focus of an RAF will be the level of risk with which the Board
and senior management are comfortable during "business
as usual" conditions, it is equally important to understand
and consider the implications of extreme but plausible sce­
narios on the risk profile. The technical and methodological
challenges of stress and scenario testing are well known. In
the RAF context, Boards, senior management, and business
units need to ask how the results of stress tests should be
interpreted and what they mean for risk profiles and prefer­
ences. One particularly important question in this context is
the extent to which Board members and risk professionals
are equipped a) to make sense of scenarios that have poten­
tially very substantial impacts but low probability and b) to
push back against the pressures from the business that are
curtailing apparently profitable lines of business.
28. A related issue is how to achieve an appropriate aggre­
gation at the group level of the levels of risks for the
different individual businesses and how to establish rela­
tionships between these. Individual business units need to
have a consistent fram ework for setting their own toler­
ances for risk, and these need to be consistent with the
overall enterprise-wide risk appetite, both individually and
in aggregate. Although progress has been made in this
area by a number of firm s, no single approach is dominant
today. There is currently no uniform process for translating
high-level risk appetite indicators into more specific m ea­
sures, such as risk limits and tolerances, and further work
is needed in the area of risk aggregation.
SECTION 3 - EM ERGIN G SOUND
PRACTICES IN O VERCO M IN G THE
CH A LLEN G ES
29. The objective of this section is to draw on the survey and
the case studies, as well as discussions with firms to iden­
tify ways in which the principal challenges identified in the
■ 43
 previous section might be overcom e. The point needs to be
made at the outset that the Industry is still some distance
from an identifiable body of sound practices in most of
these areas. W hat follows, however, is intended to form the
basis of emerging good practices.
3.1 Risk Appetite and Risk Culture
A crucial challenge is building a strong link and an effective
interaction between culture and the RAF. Risk culture can
be defined as the norms and traditions o f behavior o f indi­
viduals and o f groups within an organization that d eter­
mine the way in which they identify, understand, discuss,
and act on the risks the organization confronts and the
risks it takes.2 It is widely recognized that a strong (or
weak) risk culture manifestly and directly impacts the risk
appetite process.
31. Firms that had made the most progress in establishing a
risk appetite fram ework report that there is a close and
indissoluble link between risk appetite and culture.
Risk appetite is about the organization being clear, and
making clear to others its desired level of risk. This in turn
informs the planning and risk taking decisions of the busi­
ness units. Decision-m akers, while continuing to be bound
by policies and limits, have a clearer understanding of why
the policies and limits are as they are. And to the extent
that they have the discretion and scope to exercise ju d g ­
ment, the risk appetite will provide them with a lodestone
that helps to inform them in doing so.
32. Some firms have found that internal "values" statem ents
can be of some use in reinforcing culture. If these are seen
as self-serving and isolated exam ples of "m anagem ent-
sp eak," such statem ents are likely to be counterpro­
ductive; however, if they are part of a consistent set of
m essages and behaviors that provide staff m em bers with
a guide to their own behavior, they can be the basis on
which staff can feel able to constructively challenge behav­
iors or decisions of others, and they can be of real benefit.
33. The link with culture is therefore potentially self-reinforcing:
firms with a strong risk culture find it relatively more straight­
forward than others to implement a risk appetite framework.
A t the same time, an effective risk appetite framework can
consolidate and reinforce an effective risk culture with indi­
viduals and business heads feeling reinforced about doing
the right thing. National traditions play a part in this. Some
2 A p p en d ix III of the D ecem ber 2009 IIF report, "R efo rm in the Financial
Services Industry: Stren gth en in g Practices fo r a M o re Stab le S y stem ,"
provides a background discussion around the concept, im portance, and
key im pacts of risk culture.
44 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
This self-reinforcing link is explained by one firm in the fo l­
lowing way: "Th e adoption o f a Risk A p p e tite Fram ew ork
d id not en coun ter m ajor resistance from the organization.
This is likely due to (a) the Bank's existing strong risk man­
agem ent culture and (b) the fact that the sp e cific m etrics
in the 'm easures' com pon en t o f the Risk A p p e tite Fram e­
w ork w ere key existing m etrics that already had buy-in
across the organization. In many resp ects, the adoption
o f a form al Risk A p p e tite Fram ew ork co d ified existing risk
culture, principles, o b jectives, and m ea su res."
A n o th er firm highlighted that "the risk a p p etite fram ew ork
plays a crucial role in establishing the d esired risk culture
across the organization. The discussions o f risk a p p etite
across the G roup as well as the sp ecific con ten t o f the
Board-ow ned Risk A p p e tite Statem en t have p ro m o te d a
strong risk culture, which is key to su ccess. Business Units
understand what is ou tside a p p etite and therefore do not
pursue th ese opportunities. The Risk A p p e tite Statem ent
contains a key section outlining the principles o f the risk
culture that the G roup seeks to a ch ieve."
firms from financial centers where there is traditionally a less
direct link between profit/return and remuneration report
that risk appetite may be an easier "sell" to staff and busi­
ness heads.
34. G iven these close links, the practical steps for getting the
culture of risk appetite right are similar to those for g et­
ting overall risk culture right. O verall, firms report that
they know when they are making progress when refer­
ences to risk and risk appetite becom e a normal part of
day-to-day discourse about the business.
Overall Lessons:
• There needs to be a demonstrable commitment to
explaining— through training and day-to-day experience—
the importance the institution attaches to risk appetite.
This needs to have the consistent support of the highest
level of management.
• Many staff for whom the benefits of an effective RAF are
not immediately apparent are unlikely to undergo an instant
conversion. Even after training and assimilation are in place,
it is necessary to operate rigorous controls and limits.
• It is im portant to develop m easurable indicators of
com pliance with risk m anagem ent norms that can form
a robust basis for promotion and remuneration. This
should include not only com pliance with hard limits but
also with clearly stated behavioral expectations. C om pli­
ance with these more qualitative criteria can be more
difficult to assess objectively but is critical in establish­
ing the desired risk culture and is integral to making
risk appetite effective. Rigorous application of such
 guidelines is consistent with cultivating a strong risk cul­
ture, provided it is consistent and relatively transparent.
• Clear communication of risk appetite param eters and
preferences is a prerequisite for developing the appro­
priate culture. Individuals need to feel incentivized to
com ply with these and confident in doing so. There can
be no hidden agendas or revealed preferences on the
part of m anagem ent.
• Consistency of m essages and consistency of senior
behaviors with these m essages, rewards and sanctions
that are dem onstrably consistent with the m essages, and
the absence of barriers to bad news travelling upward
are essential com ponents of a strong culture.
• There is value in measures such as the creation of a
meaningful and non-public statem ent of values codify­
ing this. But culture is determ ined ultimately by what the
leadership does rather than by what it says.
3.2 "Driving Down" the Risk Appetite into
the Businesses
35. Effective internal communication that makes risk appetite
directly relevant to employees in the business units is seen
as a major challenge by all participating banks. A variety of
approaches have been taken, but no clear consensus has yet
emerged about how to do this most effectively. This remains
very much work in progress, even for the leading banks.
A cornerstone in the architecture o f an R A F and a key step in
its internal communication is the articulation of a risk appetite
statement. Som e firm-specific exam ples are provided below :•
• O ne firm explains that its risk a p p etite statem en t is cur­
rently a mix o f quantitative lim its/m etrics and qualitative
guidelin es:
i) Limits and m etrics consistently m onitored include: R O E:
Stress tests: RW A limits; Capital m arket m easures (e.g.
VaR, trading limits): Liquidity ratios: Single-N am e C on­
centration: Industry concentration; and Country en ve ­
lopes. These lim its/m etrics co rresp o n d to the Target
Rating se t fo r the Bank.
ii) Qualitative guidelines mainly stem from a co m p re­
hensive se t o f Risk forum s at the Execu tive M anage­
m ent level (e .g ., Portfolio d ecision s: Risk C om m ittee,
Stra teg ic Risk Forum s on C ountries, Industry/Product/
S ecto rs, as well as on Capital M arket activities. Key
Individual d ecision s: Risk com m ittees on one sp ecific
transaction/counterparty; Excep tio n a l Transaction and
N ew A ctivity Validation C om m ittees. Them atic trans­
versal p o licies: C red it policies).
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
36. Two points, however, em erged very clearly in this regard:
• An effective risk appetite fram ework should be perva­
sive throughout the organization in that all staff with
any significant decision-making authority should under­
stand the institution's stance toward risk and what it
means for them .
• Yet the benefits of an effective risk appetite fram ework,
while very real, are often not apparent to more junior
staff and, indeed, there may be some initial resistance
or skepticism among these groups.
37. For this reason, communication and training are essential
starting points. The C E O needs to be personally involved
in promulgating the message about the risk appetite
fram ework and what it means. There needs to be com ­
plete agreem ent within the Board and management on a
meaningful and com prehensive definition of risk appetite,
and the concepts need to be communicated in a straight­
forward way without jargon. There also needs to be clarity
in communications about where risk appetite fits alongside
risk capacity or tolerance, that is, how much risk it is techni­
cally possible to take, and the current level of risk being
taken. Finally, there needs to be clarity regarding the own­
ership of risk. The risk function should own the overall risk
fram ework and the interface with the Board on risk appe­
tite. However, responsibility for risk within the business
units and for achieving consistency with the enterprise­
wide risk stance rests squarely with business unit heads.
• A n o th er firm has a rather d eta iled statem en t covering
the follow ing qualitative and quantitative elem en ts: 1. To
g en era te sustainable econom ic p ro fit com m ensurate
with the risks taken; capital liquidity & im pairm ents &
e x p e c te d loss; 2. To b e well capitalised on a regulatory
basis and maintain a long-term d e b t rating o f X ; 3. To
maintain a strong Tier 1 ratio co m p rised o f a large core
Tier 1 p ro p o rtio n ; 4. To maintain a w ell-diversified funding
structure; 5. To keep o ff the balance sh e e t vehicles non­
material in size relative to the size o f the balance sh e e t;
6. Risk m anagem ent to ensure im pairm ents and losses
are m anaged within the group's toleran ce; 7. To m anage
all risk ca teg o ries within its a p p e tite ; 8. To harness b e n ­
efits from business diversification to g en era te nonvolatile
and sustainable earnings; 9. To co m p ete in businesses
with international custom ers w here m arket connectivity
is critical, b u sin esses with local custom ers w here w e have
local scale and p ro d u cts w here global scale is critical to
effe ctiven ess; 10. To use robust and appropriate scenario
stress testin g to assess the potential im pact o f the chosen
scenario on the G roup's capital adequacy and stra teg ic
plans.
45
38. Limits are a necessary part of driving risk appetite into
the businesses. Effective limits are an essential part of
any risk fram ework, whether or not the firm em braces a
full RAF. Financial institutions have operated with limits
(e.g ., for lending or market transactions) for many years,
without necessarily effectively controlling aggregate risks
within acceptable levels. The establishm ent of an effective
fram ework goes far beyond the simple setting of limits,
however. There is a strong consensus that it is very impor­
tant for staff who are subject to limits to understand both
the context and rationale for these and their implications
for revenue, custom er service/satisfaction, and aggregate
risks. The objective is to foster an effective, ongoing dia­
logue about the boundaries of acceptable risks and the
implications of these boundaries, including for the optimal
allocation of scarce resources within the firm.
39. In this context, a strong culture of responsibility for, and
open dialogue about, risks in the businesses is seen as fun­
damentally important in effectively embedding risk appetite
in the business lines. Business unit leaders have a strong
leadership role to play in this. Firms that have made the
most progress in implementing risk appetite have put in
place processes designed to ensure the broad congruence
of business and risk decisions and the overall enterprise­
wide risk appetite. In these firms, business heads are
required to have visible ownership of risk in their areas
and to incorporate risk explicitly in their business planning.
Processes then need to be put into place to check the con­
sistency of these— both individually and in aggregate— with
In som e banks the business unit leaders are required to have
prim ary' accountability for preparing and interpreting their
own risk a p p etite statem ents to ensure that they are both
p ro p erly aligned with the group risk a p p etite statem ents
and also w ell-design ed and effective in com m unicating to
the sta ff in their own businesses. Fo r instance, in one firm
the "line o f Business (LO B) m anagem ent is resp on sib le for
execu tin g the stra tegic and financial operating plans o f the
business, optim izing the risk and rew ard o f the business
within limits establish ed by execu tive m anagem ent, and
ensuring internal controls are appropriate. A dditionally, each
LO B d evelo p s a Line o f Business Risk A p p e tite which further
drives the en terprise Risk A p p e tite into the individual Lines
o f Business. Every em p loyee understands that it is his or her
responsibility to im plem ent and adhere to the Risk A p p e tite
while making daily business d e c isio n s."
In addition, other banks seem to rely on an appropriate inter­
action am ong risk culture, awareness, and policies and p ro ce ­
dures. A s explained by one bank participating in our survey:
"The link is b a sed on an awareness o f the qualitative aspects,
o f e x p e cte d norms and behaviors and how decisions impact
46 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the overall risk appetite. Business unit heads are responsible
for formulating these local plans. They also have a respon­
sibility to explain the importance of risk appetite concepts
and boundaries within their business units. Illustrating the
links between specific business initiatives and day-to-day
transactions and the broader risk appetite helps to make
these processes come alive for staff within the businesses.
Some firms have also found value in a "them atic" approach
to risk, placing a specific focus on aspects of risk— such as
reputation risk— for a specific period.
40. Similarly, staff on risk committees or those who are involved
in the approval of transactions can link risk appetite con­
cepts to individual policies and transaction approvals,
thereby raising awareness and understanding of the bound­
aries and importance of risk appetite facilitating dialogue
within the businesses about these boundaries and limits.
41. When this dialogue within and across business units and
with risk and senior management works well, it facilitates
both intelligent challenges to the risk appetite boundaries
and their evolution over time. In this way, the risk appetite
framework is made dynamic and is able to sensibly accom­
modate new business opportunities and changes to the risk/
reward relationships between different parts of the business.
42. The Iink between risk appetite as expressed by the Board
and the behavior of mid-level staff em powered to make
local decision is also facilitated by the integration of the
RAF into the business planning, as further explained in
section 3.5.
the operational groups/enterprise risk appetite. This awareness
is created through learning program s targeted at mid-level
management. M id-level m anagem ent in front-line opera­
tions is g u id ed in part by the sim plified statem ents created
by the enterprise. Both qualitative and quantitative aspects
are reflected through policies and procedures that govern
the activities o f mid-level staff. These policies and procedures
provide m ore detail to the high-level statem ents o f the risk
appetite, including business practices for exam ple, reputa­
tional risk, regulatory and legal requirem ents), risk transparency
requirem ents for exam ple, new products and initiatives) as well
as detailed limit fram eworks (market risk, liquidity and funding,
credit risk) that are se t at various levels o f the organization."
A few banks highlight a link with business planning: "The
integration o f the risk a p p etite statem en t production into the
fram ew ork o f the business planning p ro ce ss gives a linkage
o f the Board's risk a p p etite to the decisions and strategies
m ade b y business at that tim e. This is also e x p re sse d via the
Board's capital plan, w here return requirem ents, capitaliza­
tion targets, and capital allocation resolutions com bine with
business volum e ta rg e ts."
Overall Lessons:
• Comm unication and education on the benefits of a risk
appetite fram ework are essential. M em bers of senior
m anagem ent need to be visibly and consistently associ­
ated with these.
• Limit setting is a key part of risk m anagem ent, whether
or not it is part of a wider risk appetite fram ework. Busi­
ness unit and risk m anagem ent heads should use the risk
appetite fram ework as the context for explaining and
promulgating limits and risk policies.
• Business unit heads must own local business plans, which
in turn must pay proper regard to risk. This, including the
link to the wider risk appetite, should be clearly and con­
sistently communicated to staff.
• Continuous and open dialogue about risks is seen as
fundamentally important in effectively em bedding risk
appetite in the business lines. Business unit leaders have a
strong leadership role to play in this. When this dialogue
about risks— within and across business units and with
risk and senior management— works well, it facilitates
both intelligent challenges to the risk appetite boundaries
and their evolution over time. In this way, the risk appe­
tite framework is made dynamic and is able to sensibly
accom m odate new business opportunities over time.
3.3 Capturing Different Risk Types
43. Incorporating different risk types into the risk appetite
framework and, more specifically, capturing risks that can­
not easily be quantified, is a challenging task. There is wide
agreement that the RAF should capture and include all
material risks, including those that are not easily quanti­
fied, such as operational and reputational risks. However,
although 70 percent of the participating firms stated that
their RAF covers all risks, no real consensus was seen
One institution n o te d that, w herever p o ssib le, estim ates are
m ade o f the potential im pact o f crystallized risks on future
earnings capacity. Exam ples o f this w ould b e the e ffe ct o f
regulatory changes or sanctions on the revenue from individ­
ual business lines. An effo rt is then m ade to com pare these
im pacts with th ose o f o th er risks. However, "this is re c o g ­
nized as being very su b je ctiv e " and o f very lim ited value with
re sp e ct to non-linear tail risks such as litigation or serious
reputational dam age.
A n o th er bank d o es not g o as far in seekin g to quantify
risks but d o es try to estim ate the potential im pact o f risks
on future earnings capacity fo r each risk with the o b je c t o f
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
among the participants about how the risks that cannot be
easily quantified (if at all) should be captured in the RAF.
44. Some firms report that an effective first stage in the iden­
tification of risk appetite has been a free-ranging and
sometimes quite qualitative discussion of risk with the
Board. It is reported that this can be helpful in avoiding
becoming bogged down either in issues of definition or
quantification. The Board's preferences are then subse­
quently turned into a quantified fram ework.
45. In some banks there is a clear link between elem ents of
the RAF and operational risk m anagem ent. To the extent
that operational risk m anagem ent seeks to identify, quan­
tify, and control less intrinsically quantifiable aspects of
risk, the m ethodologies developed can be a useful input
to a broader RAF fram ework. Some firms indicated that
a range of indicators is reported to the Board as part of
regular reporting on com pliance with the risk appetite
fram ework. Many banks involved in the study were seek­
ing proxies to help them to understand the manner in
which risks (both internal and external) are evolving, at
least directionally. In this context, defining risk appetite
was described as "an art around the science." There was
agreem ent that around any set of similar metrics one
needs to overlay a good measure of interpretation.
46. However, some clear examples were given that resulted
in a significant change to the risk appetite for certain busi­
nesses. One high-profile example of this is material changes
to the regulatory landscape (e.g., Lehman minibonds in
Hong Kong). These kinds of changes in the regulatory (and
political) environment fundamentally change the level of risk
associated with certain businesses and, subsequently, the
risk/reward of the business proposition significantly.
47. Comm ittee structures, if thoughtfully designed, can provide
an opportunity to draw on experienced judgm ent and over­
sight in areas in which quantification is inherently weak.
arriving at an overall indication o f how large or small that risk
is in com parison with o th er risks. This is m ore a question o f
m agnitude rather than precision, as the o b jective is to ensure
that it carries enough w eight versus o th er risks.
O ne firm undertakes a regular assessm ent o f the p erceptio n s
o f various stakeholders (clients, shareholders, em ployees,
and regulators) noting a) that these legitim ately differ and b)
that the ob jective should b e "no su rp rise s." This approach is
reinforced through the creation o f a senior Reputation Risk
C om m ittee com prised o f senior m anagem ent (C FO , C RO ,
and heads o f Legal and Com pliance). This com m ittee reviews
highly com plex or structured transactions that may create
(Continued)
47
 particularly high levels o f reputation risk. The basic p u rp o se
is to determ ine w hether this is the type o f business the firm
should b e doing. A n o th er firm uses com m ittee structures to
assess the broader risk im plications o f new p ro d u ct approvals.
A n o th er firm captures a num ber o f m etrics o f varying im por­
tance. Fo r exam ple:
• Com m unications to the central bank/regulator regarding
m oney laundering breaches;
48. The point was also made by many firms that, notwithstand­
ing a professed "zero tolerance" for some categories of
risk (such as reputation risk and the risks of legal or regula­
tory non-compliance) there are, in reality, always tradeoffs,
and zero levels of these risks are not achievable in practice.
The key thing is to recognize these risks and manage them
intelligently.
Overall Lessons:
• To be effective, the risk appetite fram ework needs to
incorporate all material forms of risk, including those that
are not readily quantifiable. Zero tolerance is not a very
meaningful or practical concept— all risks need to be
actively m anaged.
• Firms should make a maximum effort to quantify such
risks, making use of such innovative approaches as esti­
mates of earnings foregone.
• Maximum use should also be made of proxies and other
m etrics, even where these do not perm it the direct quan­
tification of losses. Quantification and the developm ent
of proxies need to draw on operational risk fram eworks.
• Com m ittee structures to address reputational or legal
risks directly, and the risk implications of new products
can, if well operated, bring experienced oversight to
bear effectively.
3.4 The Benefits of Risk Appetite as a
Dynamic Tool
49. The following two challenges are som ewhat linked and
need to be addressed as im portant steps in building an
RAF: positioning and communicating the RAF internally as
a dynamic tool for shaping the risk profile of the institu­
tion, rather than as merely a dressed-up, more elaborate
process for setting limits or a source of additional business
constraints, and communicating its benefits.
48 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• Penalties from supervisors, inclusive o f the results o f inves­
tigations and rem edial actions im posed, even w here there
is no fine;
• N ew p ro d u ct activity and de-listing o f p ro d u cts (gives a
real flavor o f the use te st and how this is affecting "real
life");
• Trading with su sp e c te d insider traders; and
• Com plaints from custom ers.
50. O ur investigation has shown that successfully position­
ing the RA F internally as a dynam ic tool for shaping the
risk profile of an institution depends critically on how
it is em bedded in the businesses and on the quality of
the ongoing, day-to-day dialogue about risk within and
across business units and with risk m anagem ent staff and
senior m anagem ent. As discussed in section 3.2, when
this dialogue works w ell, it facilitates both intelligent
challenges to risk appetite boundaries and their evolu­
tion over tim e. In such circum stances, the risk appetite
fram ew ork is seen and understood to be dynam ic by all
participants.
51. Risk appetite fram eworks and processes of the kind
discussed in this report are relatively new in many orga­
nizations, and take tim e to institutionalize. Participating
banks agree that the benefits are not im m ediately appar­
ent at the outset; in some banks, there is (or was) active
resistance from some business units that needed to be
overcom e.
52. It is obvious that leadership from the top is important, in
term s of stating the reason for creating the risk appetite
fram ework and associated processes and explaining the
benefits to be gained from doing this. Nevertheless, from
the experience of some banks it may be necessary to start
with an elem ent of com pulsion. Participants reported that
they needed to push quite hard initially to get the busi­
nesses to think about risk appetite, although after "learn­
ing by doing" for a while, many reported that they have
seen the benefits.
53. In general, senior executives appreciate the benefits of
risk appetite more readily than those lower down in the
business. The active dialogue linked to specific transac­
tions within the business line was described earlier, and it
is key to educating front-line staff about risk appetite and
the benefits that awareness and understanding of it bring
to the business and the group.

O ne participating bank ran a series o f w orkshops for line
sta ff in se le c te d business units, titled "H o w risk appetite
affects y o u ." These p ro v e d useful in raising awareness o f
the key risk a p p etite co n cep ts and received positive fe e d ­
back from participating staff, who generally saw why this
was im portant from an organizational p ersp e ctive .
Similarly, another bank holds risk a p p etite w orkshops with
each o f its m ajor busin esses to identify concerns such as
im plem entation and/or resource issues. These w orkshops
aim not only at "driving d o w n " the R A F into the busi­
n esses but also at enabling the busin esses to understand
the full b en efits available from a co m p lete risk a p p etite
fram ework, such as an assessm en t o f limits and financial
volatility, that is, the volatility o f a business's plan, where
to focus resources and capital, alignm ent to oth er p ro ­
ce sse s through stress testing, and gauging the potential o f
the business goin g forward.
54. In general, participants agreed that there is a balance to
be found between coercion ("this is the policy/limit, keep
to it") and understanding ("here is the broader risk con­
text and rationale to help guide what you do").
55. As noted previously, business unit leaders must have the
principal responsibility for bringing risk appetite into their
business units and incorporating it into the regular fab­
ric of their businesses. Similarly, they have the principal
responsibility for articulating the benefits of risk appetite
in their businesses— and so they need to be convinced of
the benefits them selves. Some participants reported that
initial resistance in particular business units can be effec­
tively overcom e in many instances by the C E O , C R O , and
other senior leaders actively explaining and reinforcing the
need for business unit staff to em brace risk appetite and
have it becom e part of the fabric of the organization.
56. It is im portant to note that if specific business units can't
get the needed quantitative information to see how they
are tracking against key risk appetite metrics, then risk
appetite concepts have less traction and less "b ite" in
those business units; in these circum stances the benefits
of the fram ework and processes are less clear to front-line
staff. For this reason, firms should be acutely aware of the
m easurem ent limitations at each stage of their risk ap p e­
tite fram ework evolution.
57. In making the benefits more visible in the businesses, it
is im portant to em phasize the return dimension of risk
appetite and the opportunity for risk/reward optimization
and to position risk appetite as a foundation for active
dialogue within and about the business, as previously
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
described. The key is to be "real" with the business— it is
im portant to make the risk appetite measures and metrics
clear and real in the individual business units to facilitate
effective challenge and discussion. If this is achieved,
it is the experience of the leading participants that the
benefits will becom e progressively clearer to all stakehold­
ers as time passes; this is also strongly reflected in the
case studies.
Overall Lessons:
• Leadership from the top is crucial, in term s of stating the
reason for creating the RAF and explaining its benefits.
N evertheless, it may be necessary to start with an ele­
ment of compulsion.
• The active dialogue within and across business units and
with risk m anagem ent staff and senior m anagem ent is
essential to communicate the benefits that the im plem en­
tation of an RAF brings to the firm. Such dialogue should
also be linked to specific transactions within the business
line in order to effectively involve front-line staff.
• Education is a key elem ent in raising awareness about
the full benefits originating from a com plete risk appe­
tite fram ework.
• Business unit leaders must have the principal responsibil­
ity not only for bringing and incorporating risk appetite
into their business but also for articulating the benefits of
risk appetite in their businesses.
3.5 The Link with the Strategy and
Business Planning Process
58. The establishm ent of an effective link between the risk
appetite fram ework and the strategy and business plan­
ning processes is fundam ental.
59. A key finding of this study is that such a link has been
effectively established at a number of leading institu­
tions in recent years. This has been achieved in several
different ways, as the National Australia Bank (NAB) and
Com m onwealth Bank of Australia (CBA) case studies
illustrate. There is strong agreem ent, however, that the
relationship needs to be iterative and based on extensive
internal dialogue.
60. The fi rms that have made the most progress in this typi­
cally followed a process that involved some variation of
the following:
• The Board set key, top-level principles and risk param ­
eters for the overall risk appetite at the group level.
■ 49
 • This may take the form of a fully articulated risk appe­
tite statem ent or, som etim es, an initial, high-level sig­
naling of key risk param eters to business divisions.
• Use of these guidelines by the business units in draft­
ing their own, divisional business and budget plans. In
some cases this involves the creation of local risk ap p e­
tite statem ents. In others it involves the articulation of
a risk "posture" that indicates w hether risk is expected
to increase, decrease, or remain constant in the busi­
ness unit.
• Ensuring that, w hatever the form of the local plan, it
em beds and is fully consistent with the high-level risk
appetite statem ent or principles.
• Individual and aggregated assessm ent at the group
level of proposed business and budget plans and com ­
parison with the group risk appetite.
• Revision and am endm ent as appropriate of divisional
level plans and budgets— or, in some cases, group risk
appetite.
61. In some cases the formal planning process, rather than
being wholly "top dow n," incorporates a significant
am ount of "bottom up" planning at an early stage,
starting at the divisional level. But in either case,
iteration— starting with a concept of risk appetite — ►
business planning — ►aggregation — ►checking back with
the risk appetite fram ework and adjusting as necessary—
was observed to be the key and an im portant method to
creating essential alignm ent between the divisional and
business unit plans and the group risk appetite statem ent.
This process also builds common awareness of the inter­
action and tradeoffs between key risk appetite constraints
and revenue opportunities. Some firms have found the
use of standardized form ats for setting out strategic plans
incorporating m andatory sections on risk profile and risk
appetite to be useful mechanisms for ensuring that these
issues have the appropriate prominence in the planning
process.
62. In general, the process begins with high-level signaling of
risk or key risk param eters. For instance, N A B, as further
explained in the case study in A nnex I, starts its process
by discussing and agreeing the high-level risk posture
of each major business and the group. A nother institu­
tion noted that prior to the strategy planning risk man­
agem ent and/or finance provide indications of current
sensitivities (e.g ., leverage, liquidity, capital objectives
or constraints, etc.), so that the initial business planning
process is done on a more informed basis. There is no
uniform approach for translating high-level risk appetite
decisions into w orkable param eters for business units.
50 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
In some cases an initial effort is made at translating the
high-level statem ent into m etrics such as RoE, RW A, and/
or net funding needs, which are then fed into the busi­
nesses. In general, however, it is recognized that the
process needs to involve a com bination of breaking down
the high-level aspirations into m easurable dim ensions
and business units form ulating their bottom-up plans in
a consistent form , allowing the appropriate consistency
checks to take place.
63. The fi nal stage in the iterative process may involve chang­
ing either aspects of the business plans or of the overall
risk appetite— but if the latter, this is done on a properly
informed basis in order to create the needed alignm ent
between the two that has often been missing in many
institutions in the past. The fact that such decisions are
made on a properly measured and informed basis, and
within a formal and robust governance fram ework, is the
key to ensuring that the risk appetite fram ework strikes
the right balance between being unduly rigid— and there­
fore unable to effectively and prudently accom m odate
business and strategy evolution— and excessively flexible,
in which case it would fail to create the necessary disci­
pline on the business.
One bank p ro vid ed an exam ple o f when the explicit con­
sideration o f risk a p petite in the planning p ro cess led to
an increase in a business line/asset class rather than the
im position o f a reduction. The group had a g reed to a firm­
w ide risk appetite for a certain asset class, and one busi­
ness unit w anted to increase exposure. This led to a risk vs.
return discussion, which led to a shift within the asset class
o f increased allocation to the requesting business unit, but
without an increase in firm-wide risk appetite for that asset
class. It was rep o rted that "n ot everyone liked the answer,
but they appreciated the openness o f the discu ssion ."
64. The value of a stronger link between risk appetite and
business-level planning was summed up by C B A , "B u ild ­
ing of the consideration of risk appetite into the group's
strategic planning process has been a significant step
forward and has given both m anagem ent and Board trans­
parency either to amend the strategy to align with the
existing appetite or the appetite to allow for the proposed
strategy over decisions."
65. The following have been key factors in building and rein­
forcing the necessary links with the business units:
• The creation of a strong partnership between the
group risk m anagem ent, strategy, and finance func­
tions, notwithstanding some initial resistance to this
in a few institutions, because of some concerns about
 potentially com plicating the planning/budget process.
There was general recognition and acceptance that
form ally including the risk m anagem ent function in the
planning process may make the process longer and
more com plicated, but this was seen by those banks
that have taken this step as well worth it for the result­
ing alignm ent of risk appetite and plans. As the plan­
ning process is repeated, participants learn by doing
and a new process with new expectations becom es
established that becom es more efficient over tim e.
However, as observed by NAB in its case study, the
language of risk used by risk m anagem ent staff can
often be opaque and not closely associated with the
language used by those staff who develop strategy
and business plans. Therefore, it is im portant for risk
m anagem ent staff to find ways to com m unicate and
engage effectively in the planning process.
• Use of the concept of "risk posture"— a qualitative
expression of whether the business unit intends to take
more, less, or approxim ately the same amount of risk
over the next planning period— at both the divisional
and group levels is an effective approach in moving the
discussion forward and supplem ents the use of quan­
titative m etrics. Risk posture is an intuitive, accessible,
W hat follow s is a notew orthy exam ple o f how a resp o n d en t
firm is achieving the link b etw een its R A F and stra teg y and
planning:
Links b etw een Risk A p p e tite and Stra teg ic Planning:
• Line o f Business Risk m anagem ent is involved from the
beginning o f the stra teg ic planning cycle to evaluate and
assess how grow th or revenue targets fit with the C om ­
pany's Risk A p p e tite ;
• The Plan is d e v e lo p e d to assure G overnance and Control
functions are appropriately aligned and sta ffed around
new grow th;
• A ll plans fo r grow th are alig n ed around the Risk
A p p e tite ;
• The C h ief Risk O fficer ensures alignm ent o f the Strategic
Plan to the Risk A p p e tite . Risk m anagem ent has o p p o rtu ­
nities throughout the p ro cess to challenge any elem ents
o f the plan.
Links b etw een Risk A p p e tite and Capital Planning:
• The capital fram ew ork assesses capital adequacy in rela­
tion to risk and p ro vid es a com m on currency for m easur­
ing business unit perform an ce;
• The capital m anagem ent p ro ce ss considers credit, mar­
ket, operational, interest rate, liquidity, country, com pli­
ance and stra teg ic risks in the Internal Capital A d e q u a cy
A ssessm e n t P rocess;
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
and widely understood concept that avoids technical
language and enables extensive participation by a wide
group of participants in the dialogue and discussion
about risk appetite. The iterative process described
above needs to include an explicit discussion of the
risk/reward tradeoffs. The relevant questions are: W hat
are we trying to do? and W hat are the tradeoffs? One
firm reported: "This [risk appetite] approach allows an
intelligent discussion of 'who we are' and the optimal
business mix and balance based on risk and return."
Another said: "getting the Head of Strategy to recog­
nize and incorporate Risk M anagem ent personnel into
planning decisions was big win for us."
• Periodic reviews between risk m anagem ent, finance,
and each business division to discuss what is new or
growing rapidly, what is changing, what's driving those
changes, and what are the emerging risk/capital/liquid-
ity capacity issues, are a good tool for keeping the
required linkage strong. These reviews also support the
process for the next planning cycle.
• Some firms require that each business head be able to
explain how risk appetite has been taken into account in
local strategy documents and how key elements of the
business unit strategy are consistent with risk appetite.
• C ustom er and p ro d u ct profitability are m easured via C us­
tom er Level Profitability R eporting (CLPR), which in co rp o ­
rates econom ic capital;
• Capital is re p re se n te d in the Risk A p p e tite sta tem en t and
m easured and m onitored as such.
Links b etw een Risk A p p e tite and Liquidity Planning:
• Together with the C h ief Financial O fficer G roup, Risk M an­
agem ent is involved in settin g and m onitoring liquidity risk
limits, guidelines and early warning indicators;
• Risk M anagem ent controls include the analysis o f co n ­
tractual obligations and utilization o f stress m odeling to
ensure that excess liquidity is sized appropriately and
aligned with the liquidity risk tolerance o f the en terprise;
• Risk M anagem ent incorporates liquidity risk analysis into
new p ro d u ct, business and investm ent decisions where
applicable, and works with Lines o f Business that have
material contingent funding exp o su res and/or require
material levels o f unsecured funding;
• Liquidity Risk is re p re se n te d in the Risk A p p e tite sta te­
m ent and m easured and m onitored as such.
Links b etw een Risk A p p e tite and Perform ance M anagem ent:
• Perform ance m anagem ent is tied to adherence to the Risk
A p p e tite in all areas o f the enterprise, including Risk, Lines
o f Business and En terprise C ontrol Functions.
51
Overall Lessons: 69.
• There needs to be an iterative relationship between set­
ting risk appetite and planning at both the group and
the business unit levels.
• This involves a partnership between a group's risk man­
agem ent, strategy, and finance and the business units,
with explicit consideration of risk in business planning.
• Risk posture— a qualitative expression of whether a busi­
ness unit intends to take more, less, or approxim ately
the same amount of risk over the next planning period—
can be a useful starting point for this discussion.
70.
• The annual planning process should be supplem ented
with quarterly reviews by risk m anagem ent, finance, and
the businesses to assess how the risk profile and the
risk/return tradeoffs are changing. These reviews should
place a special focus on business activities or risk con­
centrations that are new or growing rapidly and what is
changing and what's driving those changes, as well as
71.
any emerging risk/capital/liquidity capacity issues.
3.6 The Role of Stress Testing within
an RAF
66 . An im portant issue on which the investigation has been
focused is the potential role of stress and scenario test­
ing within a risk appetite fram ework. Linked to this is the
question of how appropriate levels of risk can be deter­
mined for individual businesses and in aggregate for the
group in total and the relationship between these.
67. Consciously constraining aggregate risks in advance so
as to ensure a firm's survival under severe stress scenarios
72.
is part of the raison d 'etre and at the heart of setting risk
appetite appropriately. It is essential for senior m anage­
ment and the Board to carefully analyze and understand
the likely distribution of potential outcom es that would
be experienced over time under a variety of severe, but
plausible econom ic and m arket scenarios and to deter­
mine what level of loss would be tolerated under each of
these scenarios.
68 . These assessments are crucial but very com plex and dif­
ficult, involving both significant technical challenges and
the exercise of a substantial amount of judgm ent. They
cannot be reduced to a series of sim ple, form ulaic steps.
This is because, as the financial crisis has shown, for large
financial groups the aggregate, integrated risk profile of a
firm and the way this evolves is opaque, to insiders as well
as to outsiders, and difficult for senior m anagem ent, direc­
tors, and supervisors to properly understand.
52 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
In this context, leading banks in a number of jurisdic­
tions are increasingly using a variety of stress testing
processes, which typically feature a combination of mac­
roeconomic scenarios and changes in m arket variables,
to understand financial outcom es for the group, including
potential credit and market losses and the likely reduction
or loss of business revenues under severe econom ic and
market scenarios. Conducting such stress tests for all enti­
ties across a group requires overcoming a number of very
substantial technical challenges and the significant exer­
cise of m anagem ent judgm ent.
In general, banks in national jurisdictions that were hit
hardest by the financial crisis appear to have made more
progress on developing com prehensive, firm-wide stress
testing capabilities, perhaps in response to Industry-wide
stress testing requirem ents of national regulators. They
are therefore more likely to use these capabilities in a
more central way in their process for setting risk appetite.
An im portant challenge facing m anagem ent in the deter­
mination of risk appetite is how much relative weight
should be given to:
• The predicted level or range of aggregate losses that
could be sustained over a defined tim e period under
relatively likely, less severe adverse econom ic and
market conditions (e.g ., a "one-in-ten year" econom ic
downturn scenario), as against
• The much higher predicted level or range of aggre­
gate losses that could be sustained over a defined
tim e period under a variety of relatively unlikely, m ore
severe— but nonetheless plausible— stress scenarios
(including severe liquidity stress scenarios).
The key areas in which m anagem ent needs to exercise
judgm ent are therefore:
• The severity of the stresses/scenarios to be applied.
As noted, it is necessary to strike a balance in estab­
lishing scenarios that are appropriately severe while
being not so implausible as to make it impossible to act
upon them.
• The implications of the stress and scenario outcomes
for losses and how these com pare to what are judged
to be acceptable loss levels within the existing risk
appetite. It is also necessary to ensure that the im plica­
tions for capital levels are rigorously assessed.
• The implications of the foregoing for risk appetite
and strategy. Boards and m anagem ent need to be
equipped to assimilate and act upon the outcom es of
stress tests, even where they em body relatively low
probability events.
73. It would appear that in many banks these judgm ents have
been made som ewhat implicitly to date, given the con­
siderable technical challenges involved. These are very
subjective but im portant questions, and a divergence of
views regarding their treatm ent was seen among the par­
ticipating banks. Indeed, participants reported that it is
common to see a divergence of views on these questions
even within the m anagem ent team s of individual banks.
74. It is nevertheless im portant to distinguish between the
relatively technical challenges of ensuring that scenarios
are chosen carefully and their implications properly
worked through and the strategic challenge of ensuring
that the outcom es of stress and scenario tests are acted
upon. Boards and m anagem ent often report difficulty in
assimilating the implications of relatively low probability
events and pushing through the necessary adjustments to
business models and strategies. Some report that this will
becom e even more of a challenge as com petitive pres­
sures reassert them selves as memories of the crisis fade.
75. It is possible to make a tentative observation that some
of the banks that were hit hardest in the financial crisis are
currently taking a more conservative approach than others
that were im pacted less severely. The form er are placing
more w eight in setting their overall risk appetite upon the
One leading firm has d e v e lo p e d a co m p reh en sive, firm ­
w ide stress-testin g capability and uses this in a way that is
central to the p ro c e ss o f settin g its risk a p p e tite . The bank
had originally built its firm -w ide risk a p p e tite fram ew ork
around a s e t o f statistical loss m easures, which it co m p a red
with earnings and capital m etrics. U nderpinning the fram e­
w ork w ere statistical m od els fo r individual b u sin esses and
p o rtfo lio s, co m p le m e n te d b y stress m o d els ta rg e te d tow ard
the idiosyn cratic vulnerabilities o f th o se p o rtfo lio s (not
gen erally com binable du e to in co n sisten t scenario assum p­
tions). Lim its on a com bination o f th ese stress and sta tisti­
cal m o d el results w ere u se d as o p era tin g con trols on the
b u sin esses. W hile severa l units within the bank had g a in ed
substantial e x p e rie n ce in the g en eration o f m acro and mar­
ket scen arios and the evaluation o f their im pacts on their
re sp e ctiv e b u sin esses, th e se had not b ee n in teg ra ted to
d e v e lo p firm -w ide scenarios.
During the financial crisis, the firm reco g n ized the n ee d
to adapt its risk a p p etite fram ew ork to incorporate stress
scenarios alongside its statistical m odels and to particularly
em phasize protection o f its Tier 1 capital as a risk a p p etite
o b jective. The p e rio d follow ing the Lehman collapse se rv e d
as a catalyst and m odel exam ple for the d evelo p m en t o f
firm -wide scenarios, since it im pacted many o f the bank's
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
likely losses that would be experienced under more severe
stress scenarios and treating the results of these stress
scenarios as more binding in the risk appetite process.
76. Some banks participating in our investigation, including
some banks in jurisdictions that were less affected by the
financial crisis, have not yet built a com prehensive, group­
wide stress testing capability or have not yet fully incor­
porated stress testing into their process for setting risk
appetite. For these banks, selected stress tests have been
used to date primarily as a basis for checking and chal­
lenging the reasonableness of quantitative risk appetite
param eters and boundaries that have been set via other,
more subjective means. Some banks in this category have
placed higher emphasis to date on ensuring a strong risk
culture and effective dialogue about risks at all levels, and
they caution that placing heavy emphasis on stress test­
ing in the risk appetite— setting process may risk placing
too much focus on "known unknowns." Consequently, it
is clear from our investigation that the further develop­
ment of stress testing capabilities and the evolution of
the way in which stress testing outcom es are incorporated
into the process and context for setting risk appetite is an
area that many firms are continuing to develop, as can be
clearly seen in some of the case studies.
business lines and establish ed an unam biguous level o f sever­
ity. Subsequ ently, scenarios covering o th er potential firm ­
w ide vulnerabilities have been im plem ented.
D evelop m en t o f scenarios typically begins with the identifica­
tion and prioritization o f an area o f concern, i.e., a potential
econ om ic or m arket crisis, through dialogue am ong risk
m anagers, econom ists, and line m anagem ent. Scenarios are
calibrated on a "h ow bad could it plausibly g e t" basis. B ased
on a broad outline o f the prim ary scenario drivers, the firm
d evelo p a d etailed scenario specification describing the evo ­
lution o ver 1-2 years o f a few dozen broad macro and m arket
variables such as G D P grow th in m ajor m arkets, interest and
FX rates, equity m arkets, cred it spreads, inflation, and hous­
ing prices. Both short-term and long-term behavior m ust b e
m o d ele d to evaluate im pact on po rtfo lio s at o p p o site ends
o f the liquidity spectrum , i.e., m arket vs. cred it risks. H istory
and sta keh o ld er input inform the setting o f th ese param ­
eters, which are u p d a ted periodically (at least once a year)
to ensure that scenario assum ptions remain econom ically
m eaningful.
In tandem with this, analysis— often making use o f historical
data at a granular level— is p erfo rm e d to identify' the key
sensitivities o f business/portfolio incom e with the scenario
inputs; w here necessary (i.e., for trading portfolios), the
(Continued)
53
 scenario specification is e x te n d e d to substantially greater
detail. In som e cases, w here data analysis d o e s not lead to
sufficient explanatory pow er, ju d g m e n t as to scenario im pacts
or p ro xy m etrics is applied. The possibility that causal rela­
tionships are m istakenly iden tified through analysis o f lim ited
data is also con sid ered . Typically, effects on m arket and credit
risk po rtfo lios and incom e o f a sset gathering businesses are
p o ssib le to m odel m ore robustly, while volum e-based busi­
nesses and operational risks require m ore ju d g m en t.
Scenario im pact on P&L, capital, and RW As are evaluated
both in absolute term s and with re sp e ct to typical m etrics
(i.e.. Tier 1 ratio). The w orst-case scenario o f the available se t
is chosen (along with the com plem entary firm-wide statistical
m odel results) for com parison against risk a p p etite ob jectives.
O f these, perhaps the g re a test focus is on maintaining a mini­
mum Tier 1 ratio at all tim es, evaluated for each quarter o f
Challenges Associated with Firm-wide Risk
Aggregation:
77. O ne of the significant challenges that firms will eventually
face as they proceed along the risk appetite journey is
the issue of risk appetite aggregation— that being, once
individual businesses have set their own risk appetite
boundaries, how does an organization decide whether, in
aggregate, these boundaries fit within the firm's overall
risk appetite? Or, conversely, if key quantitative aspects of
the group's overall risk appetite have been determ ined,
how can the risk appetite of individual businesses be set
in such a way as to ensure alignm ent with the overall risk
appetite in aggregate? Given that this discussion includes
all risks, some of which are not easily quantified, a great
deal of m anagem ent judgm ent is required to effectively
manage this issue, which is obviously very closely related
to the issue of risk aggregation.
78. The technical challenges involved in risk aggregation are
numerous and com plex. In practice, most banks use a
variety of regulatory and econom ic capital measures for
risk aggregation purposes. However, these measures suf­
fer from a number of im portant weaknesses when used for
this purpose. These include:
• The inability of capital measures to capture and reflect
non quantifiable risks.
• The challenges of determ ining the appropriate treat­
ment of risk concentrations and diversification within
and between risk types.
• The difficulty of directly linking capital measures to sp e­
cific m acroeconom ic stress scenarios.
54 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the scenario. A dditionally, the sufficiency o f earnings to co ver
potential losses (and the timing o f those losses) is considered.
Conform ance to risk a p p etite is te ste d and re p o rte d to senior
m anagem ent m onthly in the form o f a dashboard and com ­
mentary, including d etailed review o f portfolio and business
losses/perform ance under the binding scenario. During the
annual planning p ro cess, the entire risk a p p etite fram ework
is review ed up to Board level and business plans are evalu­
a ted through the lens o f the fram ework and its m etrics. Firm ­
w ide stress scenarios are co n sid ered a particularly valuable
com pon en t o f the fram ework, because o f the relative ease
o f describing (and debating) the causal chain b y which losses
arise and can b e identified with businesses, portfolios, and
risk drivers. C onsequently, it is co n sid ered that scenario-
b a sed m etrics offer advantages o f transparency and avoid­
ance o f (som e) blind sp o ts relative to statistical m easures.
• The inability of capital measures to capture the liquidity
dimensions of risk, which are so crucial for understand­
ing potential losses in severe scenarios.
• More fundam entally, the non intuitive nature of capi­
tal m easures. Experience has shown that it is difficult
to get senior managers and directors to engage in a
meaningful way with statistical variables and capital
measures (e.g ., Value at Risk at 99% or 99.95% confi­
dence levels) and use them with confidence in the risk
appetite process. The experience of a number of firms
has been that it can be easier to get active engage­
ment from senior m anagem ent and directors around
specific m acroeconom ic scenario assumptions.
For these reasons, although certain capital measures (e.g.,
Tier 1 capital adequacy) are the subject of prominent focus
in the overall risk appetite process, it is difficult to robustly
determine an acceptable level of aggregate risks using
capital measures alone. This is one reason why, in addition
to capital and liquidity measures, leading banks in certain
jurisdictions are increasingly using a variety of stress testing
processes, as discussed in detail above.
79. W hile Industry practice is clearly still developing in this
area of risk appetite aggregation, our investigation has
shown that there are certain practices that have proven
effective to date. These include:
• All risks should be included in the aggregation process,
not just those that are quantifiable, such as market,
credit, and liquidity.
• For risks that are quantifiable, comparison of the
enterprise-level limit fram ework to the aggregation
 of business unit limits— including single name, Industry
concentration limits or econom ic and regulatory capi­
tal allocation— is an effective and practical measure
of alignment.
• Attention to the diversity, quality, and stability of earn­
ings across the enterprise is essential;
• Aggregation should identify areas of excessive risk
concentration. In this regard it is also im portant that
when aggregating risk, over-reliance not be placed
on a potential diversification benefit. Recent history
has proved that in tim es of crisis, diversification of risk
often fails in practice.
• For all risks, the aggregate view of risk posture (as
outlined in this paper) is helpful in determ ining how
an organization is approaching risk overall. If, for
exam ple, the individual business units are each willing
to take on more risk in the coming year, comparison
of risk posture at the platform level is a simple cross­
check to determ ine if senior m anagem ent has that
same awareness.
• Aggregation of risk appetite should be done on both a
"normal course" and stressed basis.
80. Aggregation of all risks for the purpose of determ ining fit
within the overall risk appetite of the organization is an
ongoing challenge. As an industry, some progress is being
made but as with many other aspects of this paper, this
will take tim e and a great deal of m anagem ent judgm ent
to develop.
Overall Lessons:
• A com prehensive, enterprise-wide stress testing
mechanism is a key part of a fully effective risk appetite
fram ework.
• M anagem ent needs to develop clear and consistent
criteria for deciding on the severity/plausibility of the
stress and scenario tests chosen. Firms should generally
err on the side of choosing more, rather than less-severe
scenarios, though this needs to be balanced against the
need for the results to be operationally useful.
• O nce the primary scenarios have been chosen, economic
and markets expertise, together with informed judg­
ment, are needed to assess the array of secondary impli­
cations for the firm as a whole.
• Results of stress tests need to be linked to key objective
variables such as P&L, RW As, and Tier 1 capital and illus­
trate explicitly how outcom es for these would comply
with risk appetite boundaries through tim e.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
• M anagem ent and Boards need to feel confident in
assessing the results of the chosen stress and scenario
tests. It is often more meaningful to present outcomes
in concrete term s ("This is what the following scenario
would imply for Tier 1 capital . . .") than in more abstract
term s ("There is a 1 percent probability of a loss of
$X m illion.")
• Boards need to ensure that there is a robust m echa­
nism for holding the line on risk appetite in light of
stress results when faced with inevitable resistance
from the business. If the decision is to take no action in
response to a stressed scenario, the Board and m anage­
ment should be able to explain fully why this decision
is defensible.
• The com pliance of stressed outcom es with the bound­
aries contained within the RAF should be monitored
frequently, and the risk appetite and stress testing
fram eworks them selves should be reviewed at least
annually with the Board.
S E C T IO N 4 - R E C O M M E N D A T IO N S
F O R FIRM S
81. This section draws together a number of the main findings
of this report for Board directors, senior m anagem ent, and
risk managers in firms.
Recommendations for Board Directors
82. O ne of the main m essages from this report is th at a
well-functioning risk appetite fram ework is one that
is pervasive throughout the organization. A ttem p ts
to introduce risk ap p e tite as a rem ote and d isem b o d ­
ied asp ect of risk m anagem ent have ten d ed to fail.
The process has been much more successful w here it
has been recognized that risk ap p e tite needs to be
intim ately bound up with co rp o rate culture, co rp o rate
g o vern an ce, and strateg y and planning as w ell as risk.
Boards have an integral part to play in the definition
and m onitoring of risk ap p e tite and the interchange
with m anagem ent, risk m anagem ent, and the business
is crucial in this. Th e follow ing are the main im p lica­
tions of our investigation for Board m em bers. Th ey are
p articularly relevant for m em bers of Board Risk M an­
agem ent C o m m ittees.
83. Board members need to be properly equipped to
engage fully with risk and risk appetite. They need
■ 55
 to understand generic risk concepts and the relevance
of these to the business. They also need to have access
to the information and expertise necessary to enable
them to develop a good understanding of the risk pro­
file of the firm. They should insist that the material pro­
vided to them strikes the right balance between providing
a com prehensive macro perspective and illustrating the
required level of detail.
84. Board members should be proactive in insisting on proper
support from management and risk management pro­
fessionals, in term s of education on risk concepts and
approaches, technical briefings, and updates on the risk
implications of products and activities.
85. The Board needs to establish the fram ework for risk, typi­
cally through the articulation of a clear and meaningful
risk appetite statement. This is likely to include a num­
ber of key metrics as well as clear qualitative guidance
in respect to less quantifiable risks. One test of whether
the statem ent is meaningful might be whether and how
it would change in response to a decision by the Board
that 10 percent more (or less) risk would be acceptable.
Another test would be whether the statem ent would
provide the basis for an effective challenge to plans on
the part of one or more business units to move to a mark­
edly more expansionary mode, with attendant implications
for risk.
86. Board members need to ensure that risk appetite is
used in a dynamic and iterative way. A key conclusion of
this report is that an effective RAF extends far beyond a
mechanism that simply creates limits. Instead, it involves a
dynamic or iterative process in which:
• The Board provides a clear statem ent or set of signals
regarding its preferred risk/return trade off.
• This informs an enterprise-wide process in which, on
the basis of extensive dialogue, business units deter­
mine their business models and strategies and the risk
implications of these.
• The Board then considers whether the individual and
aggregate risk stances and positions of the business
units are consistent with the firm's risk appetite.
• If these are not consistent, a conscious and informed
decision is made to change one or more of the busi­
ness unit profiles or the overall risk appetite.
In some cases, the process is more "bottom up" with the
initiative for setting risk taken more at business unit level.
In such cases, the role of the Board in establishing the
param eters for risk and actively assessing it at both busi­
ness unit and aggregate levels is especially important.
56 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
87. O perating a risk appetite fram ework in the dynamic and
iterative way advocated in this report makes it particularly
im portant that all participants, including Board m em bers,
risk m anagem ent staff, senior m anagem ent, and busi­
ness heads, are clear about their respective functions and
responsibilities. Setting out the initial risk appetite state­
ment or signaling a set of risk preferences is just the start
of a process of ongoing discussion and testing. Board
members need to challenge senior m anagem ent to ensure
that the necessary processes and structures to facilitate
this are put into place and remain effective.
88 . Such an iterative approach results in Board members hav­
ing other significant challenge functions. This challenge
is essential to ensuring that the risk appetite fram ework
is neither stultifyingly rigid nor excessively flexible. These
challenge functions include, but are not confined, to:
• Making certain that mechanisms are in place to ensure
that new business initiatives, transactions, or products
are consistent with the enterprise-wide risk appetite,
and that the risk implications of these are fully under­
stood before the activity proceeds.
• Ensuring that mechanisms are in place to monitor and
manage risks that are not readily quantifiable— such as
reputation and legal risks— and that their level is consis­
tent with overall risk appetite.
• Ensuring that stress testing is undertaken in a rigorous
and com prehensive way and that the Board is able to
assess the results in the context of the risk appetite
fram ework (more on this below).
89. In general, as this report emphasizes, an effective RAF
is indissolubly linked to the culture of an institution.
There are no simple measures of risk culture, and it is a
key responsibility of Boards to understand and shape this
culture. Experience has shown that it can be exceptionally
difficult for Boards and supervisors to detect weaknesses
in risk culture in an otherwise performing firm; in particular,
the absence of obvious contra-indicators cannot be taken
as positive evidence of a strong culture. Understanding and
shaping the firm's risk culture involves setting broad direc­
tion and continual challenging of senior management to
demonstrate how their actions and communications are con­
sistent with this and how rewards and penalties are visibly
and predictably aligned with the firm's avowed risk culture.
Senior management should be expected to account for
their behaviors, and Board members may find it helpful to
find opportunities to interact directly with staff at all levels in
an attempt to gauge the extent to which they are aware of
and responsive to a positive risk culture, and to assess, for
example, the extent to which "bad news travels upwards".
90. Even the strongest risk culture needs to be supported by
effective systems and controls. Board m em bers need to
satisfy them selves that the firm has a clear and consistent
set of controls and limits that support the objectives of
the risk appetite statem ent and the observance of the
boundaries of acceptable risk em bodied within the risk
appetite fram ework. Board members should challenge
m anagem ent on the way in which these system s are used
to encourage com pliance and penalize noncompliance.
This may, for exam ple, involve the setting of objective
and quantifiable behavioral norms or objectives that can
be used in determ ining remuneration or promotion or,
conversely, as the basis for disciplinary action when neces­
sary. The Board may seek input from the C RO in regards
to any risk cultural or behavioral issues that the Board
should consider in making incentive paym ent decisions
for executives.
91. Boards have a key role to play in the evaluation of
stress and scenario test results. M embers need to satisfy
them selves that the stress tests are conducted rigorously,
that the stresses and scenarios strike the right balance
between severity and realism, and that the implications
have been properly evaluated across all businesses in
the group. Boards have a fundamental role in deciding
w hether risk appetite needs to be revisited or adjusted in
light of the results. Board members also need to ask them ­
selves searching questions about their ability to assimilate
and respond to low-probability but high-impact scenarios.
Many Board members find this very challenging. Boards
need to be aware of their limitations in this regard and
consider carefully whether these are acting as a brake on
effective decision-making.
92. Finally, Boards should subject their own operations
and processes to constant review. Every effort should
be made to identify, on a continuous basis, areas in which
Board procedures have worked well and not so well and
to learn from m istakes. There should be an annual review
of how the Board interacts with the m anagem ent and
business heads. O verall, the Board should have a formal
process at least annually for considering whether and
how it has made a real difference to risk m anagem ent in
the organization.
Recommendations for Senior
Management
93. Implementation of an effective risk appetite framework
is highly dependent on visible support from senior
management, including a bank's Executive Com m ittee
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
and business leaders. This includes recognition and
acknowledgm ent that a clear statem ent of risk appetite
helps drive risk and governance discussions, is integral
to the strategic and business planning discussions, and
provides assurance to regulators and rating agencies that
the institution has clear param eters for how much risk it
will take on. The following are the main implications of our
investigation for senior m anagem ent:
94. To be effective it is essential that senior manage­
ment set the tone and lead the discussion regarding
risk appetite. Senior m anagem ent must be seen as
taking a leadership role in articulating the importance
and benefit of risk appetite throughout an organiza­
tion. This is an ongoing responsibility and must be
continually em phasized.
95. Recognition that risk appetite and risk culture are inex­
tricably linked is important, given that culture derives
from leadership and determ ines inter alia, how middle-
level managers assimilate and em bed risk appetite.
96. Creation of an enterprise-wide RAF is an iterative
process involving the Board, senior m anagem ent, and
risk m anagem ent staff. A t the heart of the process is an
ongoing dialogue, and senior m anagem ent should expect
to be challenged by the Board as to what is being recom ­
m ended, including risk/return tradeoffs and regular close
scrutiny and discussion of all aspects of the firm's risk pro­
file under stressed conditions.
97. It is an absolute requirement that the business (and not
risk management) take ownership and drive the devel­
opment of line-of-business risk appetite and profile. It
must be recognized that risk appetite does not belong
to the risk m anagem ent staff and is not simply another
way to set limits and constrain business. Business unit risk
appetite fram eworks are the main vehicle for providing
guidance and clarity regarding which activities and risks
businesses can consider and what would be outside of
agreed upon appetite.
98. It is im portant to recognize that while it is helpful to have
an articulation of risk appetite that can be used by the
Board and all levels of m anagem ent, there is no clear
need to have the enterprise-level RA F as a docum ent
that middle m anagem ent across the enterprise must use.
The critical com ponent is to have a risk appetite fram e­
work that helps drive a clear and com prehensive limit
structure for the various businesses as well as activities
and limits that determ ine the ability of middle m anage­
ment to pursue and grow specific lines of activity that
link back to the enterprise risk appetite fram ework. Line-
of-business risk appetite frameworks should not be
■ 57
 developed as simple subsets (or even simple "clones")
of the enterprise framework. W hile there are linkages to
the enterprise fram ework, the most useful aspects of the
business-level fram eworks are often quite specific to the
line of business, reflecting the diversity of a firm's activi­
ties, geographic scope, or regulatory regimes in which
it operates.
99. Senior management needs to ensure that the risk appe­
tite framework includes full consideration of and appro­
priately reflects business strategy. It is important that the
Board and the market understand that the senior manage­
ment takes risks in areas that are central to its key strategies
and businesses and that losses in those areas, while not
positive, are expected and understood as a likely outcome
in both normal business conditions and under a difficult
market/stress scenarios. Smaller and more peripheral
businesses by contrast should not be a source of significant
losses.
100. It is im portant that senior m anagem ent understands and
accepts how the RAF will apply to its activities and impact
any initiatives, growth plans, or acquisitions that may be
under consideration. The strategic planning process
must include discussions relating to risk appetite and
profile. W hile risk appetite needs to becom e a fundam en­
tal driver of strategy and of front-line business decisions, it
should be accepted that it will take time and effort to get
this to a point at which business unit leaders and risk man­
agers are com fortable with the process.
101. Business leaders must ensure that risk metrics ade­
quately capture and reflect all material risks of their
business. These metrics should be meaningful and pertain
to their key business and risk drivers. Similarly, the busi­
nesses are responsible for putting appropriate controls in
place to effectively manage their risks, so as to ensure that
they do not exceed their defined risk appetite.
Recommendations for Risk Management
102. Developm ent and m aintenance of an effective risk ap p e­
tite fram ework is a shared responsibility, with risk man­
agement staff playing an essential role in the process. It
is not uncommon for risk m anagem ent to take the lead in
building m anagem ent support and engaging the Board as
the fram ework is developed. Similarly, the ongoing main­
tenance of a robust fram ework is heavily dependent on
risk m anagem ent to provide good-quality reporting of risk
metrics to support the fram ework and its application. The
following are the main implications of our investigation for
risk m anagem ent staff:
58 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
103. Risk m anagem ent needs to be actively involved at
multiple levels in the developm ent of the risk appetite
fram ework. It is incumbent upon risk management to
provide clarity of concept and definition and support
in understanding the implications of the risk appetite
statem ents and metrics as they develop. A lack of clar­
ity in definition often leads to confusing and ineffective
discussion that can frustrate the participants and extend
the process unnecessarily. In this regard, it is important
that risk m anagem ent provide the necessary coaching and
training to facilitate the understanding of risk appetite on
an enterprise-wide basis.
104. An effective RAF covers all risks, and it is im portant that
risk m anagem ent work with all stakeholders in developing
the right balance of appropriate quantitative and quali­
tative metrics. Recognizing that the appetite for some
risks is more easily quantified than others, it is important
that risk m anagem ent lead the discussion and develop­
ment of desired behavior and tolerances for less quantifi­
able risks such as reputation risk.
105. Risk appetite is an iterative process that requires perse­
verance. To that end, the challenges faced early in the
process are different from those experienced later. A t
all stages, it is im portant for risk m anagem ent to ensure
full engagement by all key stakeholders, including the
Board, senior m anagem ent, and risk practitioners.
106. A t the same tim e, risk management must allow the busi­
nesses to take charge of the process of developing line-
of-business-level risk appetite statements. This means
the business unit leaders them selves, not the em bedded
risk m anagem ent staff within the business units.
107. Risk m anagem ent needs to provide the appropriate
infrastructure and controls to support the ongoing
maintenance of the RAF. This includes com prehensive
and tim ely reporting to senior m anagem ent and the
Board to provide clear reference to the current risk profile
and to make the fram ework itself both real and relevant.
Ongoing reporting of the firm's risk profile relative to the
agreed upon risk appetite— and how this is changing—
and repeated/iterative discussions of the evolving fram e­
work itself, will help to build both "pattern recognition"
and acceptance of the fram ework as a useful tool.
108. Risk appetite needs to be viewed in the context of both
normal and stress conditions. Risk m anagem ent needs
to be capable of providing both of these perspectives and
facilitating the appropriate discussion at the Board level
with regard to the potential impact on business strategy
and planning.
109. It is critical that risk management engage with the busi­
nesses in the strategy and planning process to ensure
proper alignm ent between the enterprise-level state­
ment of risk appetite and those statem ents created at the
business-specific level.
110. Risk m anagem ent should be the catalyst and conduit
for effective discussion of risk appetite between the
Board and the businesses by translating what may be at
tim es high-level statem ents of risk preference into effec­
tive risk measures and limits appropriately tailored to
each business.
111. Risk m anagem ent must ensure that the RAF is supported
by a suite of risk policies that reinforce and reflect the
risk appetite as articulated. This includes a clear under­
standing of the process for dealing with and reporting
transactions that may be approved outside of policy
boundaries as well as excesses to approved risk appetite.
112. Education and communication are areas in which it is vital
for risk m anagem ent to participate on an ongoing basis. It
is necessary to effectively com m unicate the key elem ents
of the design, im plem entation, and m aintenance of the
risk appetite fram ework to all stakeholders internally and
externally. It also is im portant that the Board be able to
address questions raised by shareholders and regulators
alike as to the appropriateness of the nature and quan­
tum of the risks being assum ed, both individually and in
aggregate, and how senior m anagem ent is challenged in
this regard.
A N N EX I: CA SE STUDIES
Developing a Risk Appetite Framework
at RBC May 2011
A boutRBC
Royal Bank of Canada (RY on T S X and N YSE) and its subsidiaries
operate under the master brand name RBC. We are Canada's
largest bank as measured by assets and market capitalization,
and among the largest banks in the world, based on market
capitalization. We are one of North Am erica's leading diversi­
fied financial services com panies, and provide personal and
commercial banking, wealth m anagem ent services, insurance,
corporate and investm ent banking and transaction processing
services on a global basis. We em ploy approxim ately 79,000 full-
and part-time em ployees who serve close to 18 million personal,
business, public sector and institutional clients through offices in
Canada, the U.S. and 50 other countries. For more information,
please visit rbc.com .
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
Initial Planning and Development of RBC's Risk
Appetite Framework
Work to form alize RBC's enterprise risk appetite began in 2006,
as part of the annual process to benchm ark and refresh credit
risk and market risk limits. An initial presentation on risk appe­
tite was made to the Risk Com m ittee of our Board of Directors
to gain feedback on the approach to articulating RBC's risk
appetite, and confirm areas of priority.
Initial statem ents of RBC's risk appetite were derived from
a review of decisions made by senior m anagem ent and the
Board that yielded explicit statem ents about what risks were
acceptable, and what risks we wanted to avoid. We identified
to the Board areas we intended to enhance, as well as a plan to
develop a com prehensive Risk A ppetite Fram ework. The global
financial crisis of 2008 then triggered further prioritization of risk
appetite for financial services institutions.
The Chief Risk O fficer and Group Risk M anagem ent (risk man­
agem ent corporate function) acted as a catalyst to define and
communicate the value of risk appetite. O ur Board of Directors
was engaged primarily through the Board Risk Com m ittee, and
this com m ittee provides feedback and challenges the risk/return
tradeoffs implicit within risk appetite. It was understood that our
Risk A ppetite Fram ework would be expanded and refined over
tim e, and that we were learning as we progressed through the
developm ent process.
RBC's Risk A ppetite Fram ework was created through an itera­
tive process. We faced an early challenge to reach consensus on
a single m anagem ent view of self-imposed constraints or other
specific param eters to put forward to the Board for feedback
and approval. We gradually gained senior m anagem ent buy-
in, yet had to remain focused on building senior m anagem ent
understanding and acceptance of how the Risk A ppetite Fram e­
work would apply to the key activities and decisions they faced
within their business segm ents.
Buy-in to the Risk A ppetite Fram ework also had to be built
within our Group Risk M anagem ent function. We needed to cre­
ate a forum for the various specialist groups within Risk to shape
the fram ework, and we now rely on these team s to com muni­
cate and reinforce the fram ework.
Central to our fram ework is the consideration of business strat­
egy, and the concept that not all losses are created equally. This
pertains to our ongoing intention to take risks in areas that are
central to our key strategies and businesses, and that losses in
those areas, while not a positive, are expected and understood
as a likely outcom e in difficult market and stress scenarios.
Sm aller and more peripheral businesses by contrast should not
be a source of significant losses.
■ 59
Risk Appetite Framework
Risk appetite is now a fundam ental part of RBC's Enterprise Risk
M anagem ent Fram ework, which is our enterprise-wide program
for identifying, m easuring, controlling and reporting of the
significant risks faced by the organization. Integral to our Enter­
• Establish and regularly confirm our risk appetite, defined
by drivers and self-imposed constraints through which
we have chosen to limit or otherwise influence the
amount of risk undertaken
• Translate our risk appetite into risk limits and tolerances

prise Risk M anagem ent Fram ework is our strong risk culture, that guide businesses in their risk taking activities

which is both a prerequisite to and reinforced by risk appetite.
Used effectively, risk appetite aligns business strategy, people,
processes and infrastructure.
We define risk appetite as the amount and type of risk we are
willing to accept in the pursuit of our business objectives. RBC's
Risk A ppetite Fram ework provides a structured approach to:
• Regularly m easure and evaluate our risk profile against
risk limits and to leran ces, ensuring appropriate action
is taken in advance of risk profile surpassing risk
appetite
RBC's Risk A ppetite Fram ework is com posed of four major
com ponents:

• Define our risk capacity by identifying regulatory con­

straints that restrict our ability to accept risk

The largest circle represents the regulatory constraints RBC faces. RBC's regulatory
constraints are classified as:
1) Financial - Tend to be quantitative in nature and therefore easier to interpret.
Capital ratios and liquidity metrics are examples of financial regulatory
constraints.
2) Other - Tend to be predominately qualitative in nature and therefore require
judgment in interpreting requirements and assessing compliance. Examples
include maintaining compliance with legislative and regulatory requirements,
and adhering to privacy and information security regulations.
Financial

The darker center circle represents RBC's risk appetite as defined by

1) Drivers - These are business objectives that imply risks RBC must accept to
generate the desired financial return. Examples include revenue growth and
earnings per share.
2) Self-imposed constraints - Quantitative and qualitative statements that
Regulatory Reputational restrict the amount of risk RBC is willing to accept. Examples follow
on the next page.

Financial
The center circle refers to our risk limits and tolerances that we translate from
risk appetite:
1) Risk limits are quantifiable levels of maximum exposure RBC will accept. They
are established only for risks that are financial and measurable, such as
credit risk and market risk.
2) Risk tolerances are qualitative statements about RBC's willingness to accept
risks that are not necessarily quantifiable and for those risks where RBC does
Regulatory Reputational
not have direct control over the risk we accept (such as legal risk and
reputational risk).
We communicate risk limits and tolerances through policies, operating procedures and
Financial
limit structures.

The striped oval represents the organization's risk profile at a given point in time.

Regulatory
Reputational

60 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A key elem ent of RBC's Risk A ppetite Fram ework is self-
imposed constraints and drivers in which we have chosen to
limit or otherwise influence the amount of risk undertaken. We
have seven key categories of self-imposed constraints:
• Maintain a "A A " rating or better
• Ensure capital adequacy by maintaining capital ratios in
excess of rating agency and regulatory thresholds
• Maintain low exposure to "stress events"
• Maintain stability of earnings
• Ensure sound m anagem ent of liquidity and funding risk
• Maintain a generally acceptable regulatory risk and com ­
pliance control environment
• Maintain a risk profile that is no riskier than that of our
average peer
For each category of self-imposed constraints we then have
a set of quantitative and qualitative key m easures. O ur self-
imposed constraints and key measures are regularly reviewed
and updated, and approved by the Risk Com m ittee of our
Board of Directors.
Application of RBC's Risk Appetite Framework
Beginning in 2008, two pilots were conducted to determ ine
if the Risk A p p etite Fram ew ork used to determ ine enterprise
level self-im posed constraints could be applied at the busi­
ness segm ent level. The heads of risk with direct responsi­
bility for business segm ent risk m anagem ent facilitated the
interpretation of the enterprise fram ew ork to each business
segm ent context. This led to the developm ent of business
level constraints that aligned to the seven key categories of
enterprise self-im posed constraints. Businesses also chose to
incorporate several key specific constraints to businesses which
they m anage.
We have made significant progress building out com prehensive
statem ents of risk appetite for each business segm ent. Risk
appetite and risk profile were applied in this year's business seg­
ment strategy developm ent process more explicitly than in pre­
vious years. Activities continue to enhance business segm ent/
unit risk appetite, and com m unicate risk appetite concepts to
broad em ployee audiences.
We observe an increasing number of discussions and propos­
als fram ed within the context of risk appetite. We see our
organizational capability improving to ensure that risk appetite
considerations are well incorporated into growth initiatives and
business planning overall. Group Risk M anagem ent will continue
to facilitate and oversee enhancem ents to business segm ent risk
appetite and related reporting.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
Reporting
Risk profile relative to risk appetite is reported quarterly to
senior m anagem ent and the Board of Directors. An Annual
Enterprise Risk Presentation is also made to the full Board of
Directors. We have found that a com prehensive and balanced
set of our most meaningful m etrics, connected with external
developm ents, has yielded effective discussion and decision
making. Reporting has been a key com ponent in building under­
standing of the fram ework and its application.
Success Factors
An im portant success factor has been strong support of our
Board of Directors, C hief Executive Officer, and senior m anage­
ment. Our emphasis on risk appetite as an enterprise priority
has been fram ed and accepted as a critical elem ent to advance
our strong risk culture.
Repeated iterations with stakeholders were helpful in gradually
building pattern recognition, senior m anagem ent buy-in, Board
of Directors' support, and confirmation of the central com po­
nents of our Risk A ppetite Fram ework.
Risk appetite developm ent has been led by our C R O , with
ongoing facilitation by senior executives in Group Risk M anage­
ment and engagem ent with business segm ents. We began to
build business segm ent ownership of business segm ent— level
risk appetite by integrating risk appetite with business strategy.
A flexible approach was required because one method would
not fit for all businesses and stakeholders.
O ur risk fram eworks contain straightforward term inology and
can be generally understood by all stakeholders. We avoid
overly technical and com plex discussions about risk with our
Board and senior m anagem ent, and focus discussion within
the context of real and current issues for our institution. In this
vein, our business segm ent statem ents of risk appetite are quite
focused and business driver specific, for exam ple, concentration
risk for certain sectors, acceptable earnings volatility and levels
of capital at risk.
Challenges
It was initially challenging to achieve clarity on what risk appetite
means and how it is used to drive m anagem ent decisions. Board
and senior m anagem ent decisions implied a high level risk
appetite; however, it was initially challenging to gain consensus
and concisely articulate risk appetite for the enterprise. Itera­
tive discussions on the fram ework and ongoing reporting of risk
profile helped improve our definition of risk appetite, and build
understanding and acceptance with senior m anagem ent and
the Board.
■ 61
It also took tim e to gain traction building business segm ent
articulations of risk appetite because it was not possible for
business segm ent fram eworks to be developed as simple
subsets of the enterprise fram ework. W hile there are distinct
linkages to the enterprise fram ework, some of the most useful
aspects of the business level fram eworks are often quite specific
to the business segm ent or business line.
We also needed to demonstrate the value of a risk appetite
framework in some instances, before the businesses (and not
Group Risk Management) would take ownership and drive the
developm ent of business segm ent risk appetite. There were some
early concerns that risk appetite and risk profile reporting was
one more mechanism to impose limits or constrain growth plans.
Lesson Learned and Key Benefits Achieved
By articulating risk appetite at both an enterprise and busi­
ness segm ent level, we have an effective combination of top-
down constraints and business specific risk drivers. The linkage
between the enterprise level constraints and the actions of busi­
nesses to grow or change risk profile is now fairly clear. O w ner­
ship of issues is also now clearer.
Risk appetite and risk profile are effective communication tools.
Increased transparency and reporting on these matters has facil­
itated internal alignm ent among business and functional lead­
ers, and supports effective decision making. O ur enterprise risk
profile provides a consolidated view of risk concentrations and
deficits to ensure alignm ent between actual risk exposure and
target risk exposure. O ur Risk A ppetite Fram ework and risk pro­
file have also been very helpful in conversations with our Board,
regulators and rating agencies.
Risk appetite is increasingly integrated into our business strate­
gies and planning processes, so that strategies are developed
and approved in the context of risk appetite. We are em bed­
ding into our annual strategic planning process analysis of how
growth objectives, degree of planned change and "risk posture"
may im pact business segm ent risk profile and risk appetite. In
addition, our annual process where the Board approves del­
egation of authorities to m anagem ent and the associated limit
structures is now put forward with direct linkage to risk appetite.
Moving Forward
Our enterprise Risk A ppetite Fram ework is updated at least
annually, focused on continued developm ent of self-imposed
constraints. For exam ple, we are enhancing constraints pertain­
ing to low exposure to stress events, operational risk and quali­
tative measures for non-financial risks. O ther areas of focus are
to create more forward looking metrics, and achieve the right
blend of qualitative and quantitative key measures.
62 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
As m entioned, we will continue to enhance articulations of risk
appetite for our business segm ents and key lines of business.
Com pensation risk m anagem ent is another practice that we are
integrating into our risk fram eworks.
It is also our objective to cascade risk appetite concepts to
broader em ployee audiences, to create a general understanding
of risk appetite and instill ownership of risk. Consistent with our
industry peers, we have made significant progress in the area of
risk appetite, and there remains work to be done to achieve full
business engagem ent and integration into all relevant m anage­
ment processes.
Risk Appetite within National Australia
Bank: an Ongoing Journey
Overview-Where We are on the Journey
The setting of risk appetite within National Australia Bank
currently manifests itself in two key ways. Firstly, the framework
by which we determine our risk posture is strongly aligned to,
and informs, the planning process. Secondly, the statement of
risk appetite (the Risk Appetite Statement (RAS)) and its three
elements ("posture," "budget" and "settings," described
below) sets out our capacity for taking on risk and the settings
associated therewith.
O ur current capability, in term s of risk appetite, reflects an
ongoing journey over a number of years and will continue to
evolve as our thinking develops. As with most large organisa­
tions, the pace of change is a function of the ability of the
organisation to absorb that change. As such, our strategy for
improving the risk appetite has been m easured, rather than
dram atic, so as to ensure understanding, acceptance and use
as we progress. This has allowed us to approach the task with
a longer term vision, introduce change progressively, reflect on
the responses and then refine our thinking.
The risk appetite fram ework (RAF) is grounded in:
• strong engagem ent between key stakeholders, including
Board and Executive, in setting the planning envelope
for the business; and
• an interactive process over the planning period that sees
agreem ent on the risk reward tradeoffs that are required
for the plan.
The fram ework results in a statem ent on risk appetite, the RAS,
which encom passes:
• a "risk posture" that seeks to qualitatively describe our
capacity and willingness to take risk at any point con­
sidering the internal and external circum stances and a
forward view;
 • a "risk budget" expressed as an econom ic capital limit
within which the Group must operate; and
• "risk settings" that express key operational limits.
Through a combination of a fram ework strongly integrated into
the plan, and the production of a RAS as the em bodim ent of
risk appetite, we seek to effectively com m unicate this appetite
throughout the organisation.
Modest Beginnings
The developm ent of our RAS and associated fram ework has
been, and continues to be, iterative. As described below we are
currently up to the 3rd generation RAS. Our current capability
owes much to the learnings, insights and persistence of those
tasked with earlier efforts.
We have been preparing RASs for a number of years and well
before it was becoming an explicit regulatory expectation. The
RAS was created under the leadership of the Board Risk C o m ­
mittee and the sponsorship of the C FO and C R O . W hilst rigor­
ous and well-grounded in principles of corporate finance, the
em phasis was on quantitative risk and capital metrics and not
enough on qualitative discussion or actual risk settings, limits
and policies. For this reason the RAS remained a centrally man­
aged docum ent with little visibility or traction beyond the Board
and Group Executive.
O ur "second-generation" RASs set out to respond to these
identified gaps by incorporating clear, explicit and detailed
risk settings, limits and triggers. The drawback of these RASs
was that whilst there was a lot of detail around risk settings,
it becam e inaccessible to readers given its com plexity. More
im portant, the Board and the executive felt that the detail
made it hard to "see the wood for the trees" and were of the
view that links between the RAS and overall business strategy
were unclear.
This issue of the lack of strategic relevance for the RAS was
com pounded by the absence of a fully integrated role for the
Risk function itself within the planning process. W hilst Risk had
a clear role in matters such as the validation of forecasts on loan
loss provisioning or expectations about the m ovem ent in asset
quality, it had a minimal part in framing the initial risk envelope
in which the business strategies and financial plans were to fit.
W hy was this the case? A part from the well-accepted view that
Finance "ran the planning process," Risk lacked both a platform
to effectively com m unicate its views and a fram ework to mean­
ingfully participate in the planning process. In particular, Risk
was not successful in identifying a language that readily con­
veyed its position and views. Unlike Finance, whose language is
encapsulated in metrics that are well understood, the language
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
of risk is som ewhat opaque and not broadly identified with by
those tasked to develop and execute strategy and plan— that
is, the businesses. Finding ways for Risk to communicate and
engage in planning was thus critical to the developm ent of
risk appetite.
On top of all this, responsibility for preparing the RAS frequently
changed hands between team s in either Risk or Finance, which
made it difficult to establish a long-term vision or change
agenda for risk appetite.
Our First Steps-Dedicated Resources and
Defining "Risk Posture" Qualitatively
By 2009, we found ourselves at a crossroads. Thinking around
risk appetite was relatively basic and the RAS was seen by many
as having limited relevance or influence.
Despite our best efforts it focused primarily on econom ic capital
(a measure not widely understood in the business), was pre­
pared after the annual planning and strategy process was com­
plete (hence merely reflecting what was to be done) and was
widely seen as uninformative in term s of strategic and business
decisioning (and hence of little strategic use).
The Group C R O and the Board Risk Com m ittee continued
to push for further im provem ents in the thinking behind, and
delivery of, the RAS, highlighting areas that could be improved
to assist the Group in its understanding and application around
risk appetite. A t this stage, responsibility for the RAS changed
hands yet again, and was given to a designated owner within
Risk. We created a new position— Head of Risk A ppetite, who
reported through the General M anager C redit Strategy to the
Group C hief Credit Officer. A dedicated risk appetite function
was an im portant step in the journey, taken to lift the relevance
and influence of risk appetite concepts and m ethodology in the
Group. For the first tim e, it had an owner whose principal role
was to not only prepare the RAS but to develop our thinking
around how best to em bed risk appetite into the business.
Given this structural change, the risk appetite team em barked
on developing the "third-generation" RAS by starting with a
clean slate and spending tim e thinking more explicitly about
what we were looking to achieve.
The challenge was to give life and meaning to risk appetite so
that there was one agreed [upon] view that was used and under­
stood throughout the Group.
The major breakthrough was the decision to describe the "risk
posture" for the Group, and separately each business unit, in
term s of three broad settings linked to directional benchm arks.
These settings were qualitative, and conveyed how the Group
would position itself over the plan period, having regard to the
■ 63
internal and external environm ent. It effectively sought to pro­
vide direction on whether we were prepared to take more or
less risk. By describing this posture, both in language and visual
form, we provided an anchor point from which to develop the
Risk engagem ent with the business units about the respective
risk appetite.
A fter defining this "risk posture," it becam e easier to debate
where we should be, or wanted to be, in term s of a risk stance.
This debate could be had at both the Group level and at each
business unit recognising differing market positions, strategic
capability and priority and external conditions which vary mark­
edly across our Group. It provided a fram ework for the Execu­
tive to do this in a manner that was more readily understood
without reversion to the traditional language of risk (limits,
metrics, etc.). As such, it elevated the richness of the discussion
and gave new impetus to the role and purpose of risk appetite.
By forcing this discussion around the appropriate posture, given
both the subsisting circum stances and our capabilities and con­
straints, the linkage to the plan was more easily understood. It
also ensured that once a particular posture was agreed upon,
risk appetite and settings could be more explicitly linked to
the strategy.
For 2009 the initiative around risk posture was "after the event"
as the plans were by then already substantially com pleted. Since
then, we have sought to set the risk posture (and associated
guidelines) ahead of the planning process so as to provide the
businesses with appropriate direction.
Importantly, we seek to describe the risk posture for each line of
business and bring these together to reflect the overall Group
position. Debate around posture occurs both when we start
Conservative Neutral Expansionary
Business Unit 1
H i U n it 2
j are shown below in Exhibit 4.1.
Ke
Group:
64 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
planning (to signal direction) and when planning is finalised (to
assess whether plans reflect the agreed upon posture). This
debate occurs between all stakeholders, including the Board,
and can best be described as interactive and iterative. There
are a number of stage gates during the planning process where
we revisit the posture assumptions and positioning. More for­
mally, we submit three RASs a year to the Board, each showing
changes in the posture relative to prior periods (for both the
businesses and the Group).
As we evolve our thinking on posture, we see opportunity to
further enhance and enrich the discussion. To this end we are
trialling whether the description of a risk posture statem ent
for key risks (e.g ., credit, operational, m arket, reputation, etc.)
and for major business activities would enhance m essaging. A
direct benefit in developing this thinking is that it forces broader
engagem ent with all stakeholders and raises awareness around
risk appetite.
Along the Path-Completing the Picture
W hilst describing a risk posture was a catalyst for increased
debate at Executive and Board level, and one that has seen the
quality of discussion around risk appetite increase throughout
the Group, other developm ents have also been important.
A key developm ent has been increased engagem ent by Risk
with the Strategy and Finance team s in the developm ent of the
strategic, financial and risk param eters established for the plan­
ning process. This has allowed us to more effectively integrate
risk appetite into the planning process, as businesses see the
three key Group functional stakeholders (in risk, finance and
strategy) more closely aligned and linked in their messaging
around the drivers of financial outcom es. From a Board per­
spective, increased engagem ent between the Group func­
tions has provided com fort that the strategies and business
plans more effectively reflect a risk lens.
This has also allowed for more effective review and challenge
throughout the planning process (over some 6-8 months) in
order that plan outcomes reflect not only the financial exp ec­
tations but also the risk appetite. W here they are outside this,
adjustm ents to either the plan or the risk appetite are made.
This integration and the role of the RA F in the planning cycle
As discussed above, the concept of a risk posture has
allowed Risk to more effectively com m unicate with strategy
and finance. We have also developed the concept of "key risk
them es" within the RAS, which are the most im portant risks
(or "categories" of risk) facing the Group at any tim e. They
Past postures com plem ent thinking around Group strategies, form a basis
Current posture
for identifying the most relevant points of vulnerability in the

Rik Appetite, Fisnaneial Plan
and Strategy are integrally
connected
All three communicate risk /
reward 'trade-off^ to be
made, though with different
language
Exhibit 4.1 Risk appetite in the planning cycle.
plan and provide a fram ework for thinking about risk mitigation.
In addition, because they are described in common language
rather than technical term s, they provide a more broadly under­
stood link for those outside the Risk community.
Having established the role of "risk posture" (a qualitative risk
setting description) in risk appetite we have also sought to
enhance our thinking around the more quantitative aspects of
the RAS, in particular:
• setting a "risk budget" in term s of econom ic capital; and
• describing operational "risk settings" to further enhance
the communication with bankers.
The "risk budget" is described in econom ic capital term s and
sets our maximum risk taking capacity. Reflecting the posture,
it establishes a limit in advance on the use of our available risk
capital to support business activity. Allocated to the businesses
by risk class (e.g ., credit, m arket, operational risk, etc.), it pro­
vides a quantitative boundary for planned activity. Actual use
of econom ic capital is then measured against these limits. This
approach has served as a trigger to review increased business
activity in certain areas where econom ic capital limits were likely
to be insufficient to support the proposed activity.
In the past, econom ic capital would not have acted as such a
constraint as it had always been an outcom e of the plans (i.e.,
the agreed upon plan used "this" amount of econom ic capital)
and as such was not seen as a limit on activity or as a trigger
point for a decision.
Having set a "risk posture" (qualitative) and a "risk budget"
(quantitative), we then establish "risk settings" to further pro­
vide guidance as to the risk tolerances within which the Group
should operate. These risk settings are represented by limits,
policies and procedures and other setting statem ents and are
more operational in nature. They are at different levels of granu­
larity depending on the messaging required.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
This approach to the RAF is shown below.
W hilst the fram ework for the RAS and risk appetite was evolv­
ing, we were conscious that communication through to bankers
remained a challenge. The language of the RAS is targeted at
the Board, Executive and Senior M anagem ent. Beyond this,
the language is less appropriate for day-to-day activity. N ot­
withstanding, it is clear that effective communication to bank­
ers needs to occur in some form if the RAS is to fulfil its role of
"Board to Banker" understanding of risk appetite.
To this end we have sought to engage businesses in preparing
their own "risk-setting statem ents" (RSSs) that can be more
granular and effective in communicating m essages to all levels
of the business. W hilst these clearly need to align to the RAS,
they provide more latitude to effectively com m unicate to a
broader audience. Although some progress has been m ade, this
remains a work in progress.
Lessons Learned-Successes and Challenges Along
the Way
The developm ents described above have been interactive
with enhancem ents to both the RAS and the fram ew ork
occurring as w e progressed. In the course of our journey,
the absence of an "o ff the shelf" solution has m eant we
have spent significant tim e discussing w hat w orks and w hat
do esn't. O ur approach has alw ays been to dem onstrate
ongoing steady im provem ent rather than com ing up with the
"co m p lete so lu tio n ." G iven the uniqueness of the issue, the
m ultifaceted nature of the challenge and the relative interest
and needs of stakeho ld ers, w e have concluded that this is not
achievab le. Rather, ongoing develop m ent and refinem ent will
lead to b etter outcom es.
Against this backdrop, there are lessons we have learnt along
the way that have shaped, and continue to shape, our thinking.
The things that have led to significant im provem ent for us
include:
• fostering leadership of the debate on risk appetite from
the C E O , the C RO and the Board Risk Com m ittee;
• fostering a receptive internal environment. The organisa­
tion has worked hard on its culture over time and has a
strong em phasis on team work, collaboration and enter­
prise thinking. This, alongside the wake-up call issued to
all parties associated with the financial services sector
(arising from the global financial crisis and its aftermath),
has enabled more sophisticated and planned discus­
sions and analysis on the forward outlook for risk and the
environm ent and our response through posture, appetite
and strategy;
■ 65
 Risk se ttin g s

Existing Customer Controls

Outlook
franchise needs
• Models • Hurdles
• Trading (e.g. x-sell,
limits return, LVR,
etc.)
Potential • Op. loss
tolerance • Policies
rewards
• Audits

Limits
Confidence in • Industry • Equity
capabilities • Country • Product
• Market • Liquidity
• IRRBB • etc.
Expectations
for return
Processes / procedures
• Making • Customer
decisions onboarding
• Product • Training
exposure
Regulatory Legacy monitoring
Risk-taking
capacity constraints assets /
Messaging
liabilities

Not all risk settings are in the RAS-but all are consistent with it
Exhibit 4.2 From risk posture to risk budget and actual risk settings.

• identifying a single, dedicated team with accountability
for the RAS and the broader fram ework has allowed us
to attain consistency in approach and provide the im pe­
tus for innovation;
• separating discussion of risk appetite into three parts,
each of which are linked but serve a different purpose:
risk posture, risk budget and risk settings;
• integrating the risk appetite and RAS with the strategic
and financial planning process;
• increasing the dialogue with the business units around
their view of risk posture;
• delivering three RASs to the Board with the cycle and
content linked to the planning process. This has allowed
for more regular Board discussion on risk appetite and
has reinforced the link between risk appetite and the
business strategies and plans. The Board now sees more
careful consideration of the implications of proposed
actions and activities on the Group risk profile and its
relation to the Group Risk A ppetite and evidence of risk
appetite thinking in its discussions with m anagem ent;
• supplem enting the RAS and associated discussion with
risk workshops and targeted risk papers for the Board,
has assisted the Board in linking risk appetite to the busi­
ness activities and the portfolios;
• engaging with our Regulator;
• identifying key stakeholders in the business to champion
risk appetite discussion; and
• maintaining the ongoing com mitment of key stakehold­
ers such as the Board and senior executive.
Most important, we can already say that in the past few years
the outcome of a number of material strategic decisions taken
by the Group were significantly influenced by the fram ework
described above.
As there are diverse views around the approach to risk appetite
(and the RAS) our journey has not been without challenges.
Some of the more significant challenges have been:
• balancing the desire for quantitative or prescriptive crite­
ria to define risk posture with the flexibility and generality
that qualitative, "principles-based" definitions provide.
We have responded by developing a number of quantita­
tive metrics which are "indicative" of risk posture whilst
avoiding the trap of attempting to define it formulaically.
• choosing the appropriate m etric for each application.
For exam ple, econom ic capital is the m etric for risk
"budgeting" across the Group, but other metrics are
more useful for other applications, such as exposure lim­
its, trading desk limits, industry or country credit exp o­
sure limits, etc. Our response has been not to promote a
single all-encompassing risk metric but rather to identify
the most appropriate risk metrics for each purpose.

66 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • whilst used as the measure of risk budget, the use of
econom ic capital still remains a challenge. We continue
to use it given its historic link to past RASs, IC A A P and
the fact that most measured risks can be quantified in
econom ic capital term s (albeit there is always debate
as to the voracity of the number). Notwithstanding this,
most stakeholders still have little engagem ent with eco­
nomic capital as a meaningful m etric to measure risk
perform ance against. The proper place and purpose of
econom ic capital as a useful tool in the RAF continues to
be a focus.
• never allowing the sole use of "risk adjusted" metrics
(like econom ic capital, RWAs and VaR) to lead us to lose
sight of the underlying nominal exposure behind each
risk. Banks lose dollars, not econom ic capital— and the
same can be said of shareholder dividend paym ents— so
we always seek to ensure visibility of unadjusted exp o ­
sures when discussing any risk.
• integrating meaningful stress testing into the risk ap p e­
tite and planning fram ework, including setting limits
more system atically and drawing insights from the
results, which is a task that is still a work in progress; and
• balancing coverage of credit risk (our largest single
risk type), with other material risks (such as operational
or reputation risk), which are less easily quantified or
described. As with stress testing, this is still a work
in progress.
Where We Co from Here-Further Increasing the
Value of the Risk Appetite Framework
The journey never ends. W hilst we have made progress, we
are of the view that further enhancem ents can be, and will
be, made to our RAF to increase its effectiveness within the
Group. In recent discussions with stakeholders, including
Board m em bers, a range of issues have been identified that
would further enhance the impact of the RAS and associated
fram ework including:
• further progressing the discussion around stress testing,
scenarios and responses and incorporating this more
robustly into the planning process;
• continuing to com plem ent the use of econom ic capital
with consideration of other key measures such as regula­
tory capital and sim ple, unadjusted exposure;
• enhancing how the risk appetite shapes portfolios from
a top-down perspective, with analysis on why such deci­
sions would be taken— e .g ., matching external risks with
portfolio shape and defining "where we want to be"
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
from a risk portfolio perspective, not just our limits, bud­
get and tolerances;
• further linking the "return-on-risk" (as opposed to return­
on-capital) with the risk appetite;
• using the RAS to further enhance transparency around
trade-offs in respect to choices between strategic priori­
ties, investments and risk levels we are prepared to accept;
• continuing to develop the fram ework for defining "risk­
setting statem ents" (RSSs) within the businesses; and
• explicitly linking changes in external environm ent to
changes in risk appetite.
Conclusion-Reflecting on the Journey
The key for National Australia Bank in advancing the RAF has
been:
• identifying dedicated resources for accountability;
• developing a standardised risk language around posture,
appetite, settings;
• aligning Risk with Strategy and Finance;
• fully engaging Risk as key participant in the planning
process;
• continuing to develop thinking around the RAF by
engaging with the key stakeholders; and
• seeking ways to broaden the view and understand­
ing of risk appetite so others feel more engaged in its
developm ent.
The benefits from the advancem ent of our RAF and the align­
ment on issues of strategy, finance and risk have elevated the
quality of debate around risk profile and the linkages with the
current and targeted risk profile. O ur approach has been to
develop our risk appetite fram ework in a manner which meets
our organisational needs, reflecting our experiences and our
level of maturity. We have taken an evolutionary approach to
ensure we bring the organisation along at a pace that will more
deeply em bed the RAF into our organisational culture and
processes. We know that if we pushed the pace of change too
rapidly, and without the appropriate engagem ent and consulta­
tion with the business units, our efforts would not be as suc­
cessful. We know this because we hear and observe many more
discussions and debates around risk appetite today than in the
past. O ur internal culture has aided the developm ent of the Risk
A ppetite fram ework and at the same tim e, the Risk Appetite
fram ework assists in continuing to define, describe and shape
our risk culture. The challenge is to remain vigilant to ensure that
we continue to learn and adapt our thinking reflecting where we
are at and where we want to be. We cannot be com placent.
■ 67
Scotiabank-A Canadian Experience in
Setting Risk Appetite May 2011
The year 2008 marked a strategic inflection point for the
world's view on "risk ." The financial crisis com pelled the
Risk M anagem ent discipline in global financial institutions to
re-assess every method and assumption em bedded in their
processes. Three years later, we can all reflect on how financial
institutions have evolved their risk fram ew orks, including, to
various degrees, a deliberate, robust and clear expression of
"risk ap p etite."
This case study captures the challenges and lessons in the
design and im plem entation of a Risk A ppetite Fram ework at
Scotiabank (the Bank). Today Scotiabank considers im plem enta­
tion of their Risk A ppetite Fram ework to have been successful.
For perspective, however, Scotiabank was not starting at the
beginning. It already had a risk appetite position em bedded in
its strong risk culture that had served it well through the finan­
cial crisis. N onetheless, Scotiabank recognized the potential
value of a more clearly defined, com prehensive Risk A ppetite
Fram ework based on governing financial objectives, risk prin­
ciples and risk appetite m easures. Scotiabank integrated these
key dimensions into an enterprise-wide fram ew ork, strength­
ening its overall approach to governing risk-taking activities.
The Risk A p p etite Fram ework was approved by the Bank's
Board of Directors in early 2010. The journey of evolving that
Fram ework continues.
Enterprise Risk
In 2006 the Bank created an Enterprise Risk function with a man­
date of linking capital capacity, revenue and risk-taking across
the various risk types (e.g ., credit, market, liquidity, operational
risk, etc.). The first priority of the new team was the develop­
ment of appropriate and actionable risk metrics. From there, a
com prehensive information package was developed for regular
reporting to senior m anagem ent and the Board on all risks span­
ning the entire Bank against key Board-approved risk limits,
globally, creating a clear picture of the Bank's risk exposures.
Additional priorities included further developm ent of the Bank's
credit risk strategy. With these developm ents, the Board was
more informed and could becom e more engaged. Together,
these risk limits, and various risk reporting aspects, helped
senior m anagem ent articulate to the Board the amount of risk
being taken at the institution.
By 2008 it was evident that a broader strategy was required.
Risk M anagem ent at the Bank was still, to a large extent, siloed
by risk type. The inter-connectedness of risks was only begin­
ning to be aggregated. And various dimensions of financial
perform ance and strength were not consistently being viewed
68 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
through a risk lens. Risk managers across the industry began giv­
ing more consideration to defining risk appetite as a guide for
decision-m aking— to fram e how much risk their firms were w ill­
ing to take on in the context of executing their business strate­
gies and in the drive for value.
A t the tim e, Scotiabank p articipated in a Canadian bench­
m arking survey, conducted by D elo itte, as one input to
defining appropriate p ractices. The study confirm ed that risk
ap p etite was an active area of focus for the banks and that
form alization would take the form of a Board-approved fram e­
w ork with ties to capital m anagem ent and other m anagem ent
activities.
There is general industry consensus on the meaning of "risk
appetite" and the im portance of distinguishing it from risk
capacity. The broadly held view is that risk appetite is an expres­
sion of the desire to take risk and, implicitly, a statem ent of
how returns will be earned against that risk. It is, in effect, a
key part of the contract between senior m anagem ent and the
Board . . . and the shareholders they represent. Risk appetite is
clearly distinct from risk capacity, which is the ability of the firm
to withstand risk events. However, that seem s to be where the
industry consensus ends. To date there is no common approach
beyond definitions and key elem ents of a fram ework at the cor­
porate level.
Setting Context
The Bank's most senior executives were actively engaged in
industry discussions relating to risk, implications of the global
crisis and the subsequent way forward for the industiy. Senior
executives becam e involved in 11F benchmarking efforts, sup­
ported by a broad cross-section of m anagem ent.
The Enterprise Risk m andate was expanding in several ways. In
addition to becoming central support for the EF benchmarking
analysis, the team began integrating risk measures from across
the firm. They started to serve as a clearinghouse for all types
of risk information, and as a risk communications channel for
senior m anagem ent and the Board. W ithout a more defined Risk
A ppetite Fram ework, however, the risk reporting lacked context.
So the team conducted an internal assessm ent of what was in
place and confirmed the following:
• The Bank already had an implicit risk appetite em bedded
in its strong risk m anagem ent culture. A t Scotiabank, the
risk culture is anchored in a long history of who we are as
a lender, from our early days of financing North A m eri­
can Eastern Seaboard trade to the launch of our first per­
sonal loans in 1958, and continuing today with market
leading financing programs around the world. O ur deep
experience in lending has em bedded a focus on capital
 preservation that spans the full spectrum of risk . . . mak­
ing risk m anagem ent a strategic priority shared by all
em ployees. Today, a key aspect of this culture is to be
well-diversified across business lines, countries, products
and industries. Another key elem ent of the culture is
the relatively long tenure of em ployees. For exam ple, of
Canadian-based managers— people in decision-making
roles— over one-third have been with the Bank more
than 20 years. And the Executive M anagem ent Com m it­
tee's tenure is even longer. Based on that deep exp eri­
ence, senior m anagem ent has a strong sense for what
would be "offside" relative to the cultural norms estab­
lished over alm ost one hundred and eighty years;
• Existing limit structures w ere, in effect, a network of
contracts already in place between Risk M anagem ent,
the Business Lines and the Board on what risks could be
taken, or not; and
• Business lines clearly owned risk, complemented by highly
centralized decision-making on risk policy setting and sig­
nificant transactions through executive committees.
However,
• The existing limit structure was com plex and not co d i­
fied in any w ay that made it straightforw ard to com ­
bine and report the total risk taking activities to the
Board; and
• There was no explicit statem ent of the objectives
and principles that governed the Bank's decisions for
risk-taking.
Most experts on "risk appetite" acknowledge that the develop­
ment of a fram ework should engage senior m anagem ent in the
Risk M anagem ent function and in the Business Lines, as well as
the Board. However, the biggest obstacle to developing the
fram ework and implementing it can be the lack of consensus on
what risks are appropriate for the firm and the extent of controls
needed to mitigate the risks. So, when there is broad apprecia­
tion of an established risk culture along with specific risk-based
contracts already in place between the stakeholders, the task
of designing and implementing a risk appetite fram ework is
already well advanced.
Diving In
The first iteration of the Risk A ppetite Fram ework involved
selection of existing quantitative metrics (covering Board-
approved risk limits, perform ance targets and capital targets) as
key indicators of the Bank's risk appetite and actual risk profile.
The indicators were consolidated and incorporated into the
Capital M anagem ent Policy. By the end of 2008, however, it was
evident that a more com plete policy was needed.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
Developm ent of the next iteration of the Fram ework focused on
a few key areas:
• The context of the Bank's governing financial objectives
and strategic principles;
• Articulation of Risk M anagem ent principles (qualitative
attributes) that would guide the Bank's overall approach
in risk-based activities;
• Bringing into focus a limited number of risk measures
that were considered essential objective expressions of
the Bank's risk profile, along with corresponding target
ranges; and
• Establishm ent of monitoring and reporting structures.
Developm ent of the Risk A ppetite Fram ework was driven by
Risk M anagem ent in collaboration with a broad range of stake­
holders. Finance was a pivotal partner in the work as they had
overall m anagem ent of the Bank's Balanced Scorecard (more
recently moved to the Strategic Planning O ffice). As well,
Global Human Resources ensured that em ployee incentives are
linked to perform ance, and that risk perform ance is taken into
consideration. Engagem ent of senior m anagem ent in the Busi­
ness Lines was a key part of the review and approval process.
The Bank's A sset & Liability Com m ittee served as the forum
for review prior to presentation to the Executive M anagem ent
Com m ittee, and ultimately the Board.
The approach could be relatively expedient based on a few
factors:
• The well-established risk culture;
• The independence of the Risk M anagem ent oversight
function; and
• The specific limits to be brought into the Fram ework
could be largely to be drawn from the network of exist­
ing controls.
The Framework that emerged from the discussions had two sides: a
qualitative, principles-based component, and specific risk measures
in key risk disciplines. More specifically, the structure was under­
pinned by sound risk governance, followed by the Risk Appetite
Framework itself. The use of risk management techniques was con­
sidered to be another key component, including the strategies, pol­
icies, limits, processes, measurement and monitoring tools which
Risk Management implements. These risk management techniques
are deployed across the spectrum of risk disciplines covering credit,
market, liquidity, operational and reputational risk. Finally, the
entire structure is underpinned by the Bank's strong risk culture.
Operationalizing the Framework
With the Fram ework generally agreed upon, the risk measures
were operationalized through quarterly monitoring, including
■ 69
com prehensive Board reporting. This practice helped to • avoidance of excessive concentrations, and
consolidate risk reporting and to bring into focus the Bank's • ensuring that risks are clearly understood, m easurable
perform ance on the risk contract between m anagem ent and and m anageable.
the Board.
2 . Strategic Principles provide qualitative benchm arks to
Functionally, the Bank im plem ented the principles com ponent guide the Bank in its pursuit of the Governing Financial
of the Fram ework by referencing the Fram ework in policies such O bjectives, and to gauge broad alignment between new
as the Capital M anagem ent Policy and by communicating the initiatives and the Bank's risk appetite. Strategic principles
risk appetite principles to the Board, Executive, Senior M anage­ include:
ment and shareholders via the "M anagem ent's Discussion &
• placing emphasis on the diversity, quality and stability of
Analysis" section of the Annual Report.
earnings;
Through established policy groups, the Fram ework was cas­ • focusing on core businesses by leveraging com petitive
caded to major international subsidiaries. advantages; and
The Fram ework was initially socialized externally with local regu­ • making disciplined and selective strategic investments.
lators and at a "C olleg e of Supervisors" and was included in
3 . Governing Financial O bjectives focus on long-term share­
presentations with rating agencies. holder value. These objectives include sustainable earnings
By 2010, form alized processes were being put into place for growth, m aintenance of adequate capital in relation to the
ongoing internal discussion. Annually, the Fram ework is now Bank's risk profile and availability of financial resources to
shared with the senior team responsible for Bank-wide strategic meet financial obligations on a tim ely basis at reasonable
planning developm ent— the Strategy Working Group— which is prices.
made up of Senior Vice Presidents and C FO s for the Business 4 . Risk A ppetite Measures provide objective metrics that
Lines and Corporate Functions. As well, the Fram ework has gauge risk and articulate the Bank's risk appetite. They
becom e a lens for reviewing the strategic plans of each Business
Line in the Executive M anagem ent Com m ittee's annual strategic
planning process.
/ Risk \
/ Governance \
Evidence of Change / Risk Appetite \
The value of formalizing the Risk A ppetite Fram ework is best / Governing Financial \
/ Objectives \
illustrated by the change in Scotiabank's Annual Report to / Strategic Principles \
shareholders. Prior to 2008, there had been no discussion of risk / Risk Management Principles \
appetite. By 2010, the Annual Report contained several pages / Risk Appetite Measures \
directly connected to the new Risk A ppetite Fram ework, cap­ / Risk Management Techniques \
tured here: / Strategies Policies Ft Limits \
/ Guidelines Processes Ft Standards \
In discussing Scotiabank's overarching Risk M anagem ent Fram e­ / Measuring Monitoring Ft Reporting
work, the Bank is now more able to enunciate the relationship of
/ Risks
risk governance, risk appetite and risk m anagem ent techniques Credit Market Liquidity Operational Reputational Environmental
and the foundation of these in the Bank's strong risk m anage­
ment culture. Strong Risk Culture

2010 Annual Report Risk Management ^ A . p, . .

_ . . , Strategic Principles
Principles
The Report notes that the Risk A ppetite Fram ework consists of
four com ponents and elaborates on each:

1. Risk M anagem ent Principles provide the qualitative founda­

tion of the Risk A ppetite Fram ework. These include:
i Risk Appetite
Framework
|
¥

• promotion of a robust risk culture,

• accountability for risk by the Business Lines, Governing Financial Risk Appetite
Objectives Measures
• independent central risk oversight,

70 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 provide a link between actual risk-taking activities and the
risk m anagem ent principles, strategic principles and gov­
erning financial objectives. These measures include capita
and earnings ratios, market and liquidity risk limits and
credit and operational risk targets.
Strategies, Policies Guidelines, Processes
a Limits a Standards
Risk Management
Techniques
Measurement,
Monitoring
Et Reporting
• Risk m anagem ent techniques are regularly reviewed and
updated to ensure consistency w ith risk-takin g a ctivitie s, and
relevance to the business and fin an cial strategies o f the Bank
Key Benefits, Challenges and Future
Considerations
The Fram ework is envisioned as a living docum ent that will
undergo periodic review and update. The Bank considers it to
be an evolving guideline that will continue to be dissem inated
internally and which will find expression in additional policies,
strategies and risk m anagem ent practices in the future.
The biggest benefits of defining the Risk A ppetite Fram ework
for Scotiabank have been that it provides greater transpar­
ency of the key objectives, principles and m easures defining
the Bank's appetite for risk in the pursuit of value, and it has
enabled greater awareness and more effective communication
with internal risk decision-m akers and external stakeholders.
This "case" captures how the developm ent of a strong and
functioning Risk A ppetite Fram ework can be accom plished in
the setting of a strong, existing risk culture where there is a
deep network of established controls, limits and risk oversight
structure. The developm ent of the Fram ework was the straight­
forward part. Work continues on key challenges around im ple­
mentation and further alignm ent.
The key challenge continues to be a combination of 1) aw are­
ness and application of the Fram ework within the Business
Lines, and 2) finding the right balance between broad principles
and granular guidance for day-to-day decision-making with line
m anagem ent throughout the Bank.
In term s of awareness, the program was launched with "road
show s," but more communication work needs to be done to
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
evolve from reliance on the culture and norms, to em bedding
the Fram ework as the more clearly defined and rigorous context
for decision-making.
As for "the right balance," there still needs to be linkage
between the high-level principles and metrics as expressions
of risk appetite at the top of the Bank and the risk indica­
tors and limits deployed at a business unit level. W hile some
measures of credit and market risk have been allocated to
businesses, others, including most measures for operational
risk are not easily aggregated, nor divided. As such, the Bank
(and the industry) continues to work at an effective way to link
certain "top of the house" measures with business specific risk
perform ance measures.
Additional work also remains to further integrate the Risk A p p e ­
tite Fram ework with other risk policies and the enterprise-wide
stress testing program.
Ultim ately, Scotiabank's test of an effective Risk A ppetite
Fram ework is that it fits the organization; the Board under­
stands it; m anagem ent is having good discussions reflecting
both qualitative and quantitative m easures; decisions are made
and action is taken; and sustainable long-term earnings growth
is achieved.
Risk Appetite Framework Development
at the Commonwealth Bank of Australia
Background
W ithin the Com m onwealth Bank of Australia (CBA ) G roup, risk
appetite had always been part of the risk vocabulary. However,
historically there has been little docum entation of a formal
fram ew ork. During the mid-2000s som e attem pts had been
made to define the fram ework but it was not until the appoint­
ment of the new Group C h ief Risk O fficer in 2008 and the
actions of an energetic Board Risk Com m ittee chairman that
the need for a form al, Board-owned risk appetite foundation
gathered real traction. Consequently, a project to develop a
risk appetite fram ew ork was launched at the start of 2009 and
this case study covers the various stages of its developm ent
to date.
What Do We Mean by Risk Appetite ?
The first challenge was to understand what was meant by risk
appetite. Internal discussions revealed many different interpreta­
tions of what was meant by risk appetite. Furtherm ore, publicly
available disclosures from banks and financial institutions around
the world also appeared to use the term in different ways.
Annual Reports often referred to "acting in accordance with risk
ap p etite," but nowhere was the risk appetite defined.
■ 71
We felt that part of the reason for the lack of traction in previous
attem pts to establish a risk appetite fram ework was the lack of a
common definition of "in what term s" risk appetite was defined.
A clear conceptual definition was therefore required.
This led us to define risk appetite as: "The types and degree
of risk the Group is willing to accept for its shareholders in its
strategic, tactical and transactional business actions." That is,
appetite was expressed as a boundary on risk taking activities
that defines where we do not want to be, rather than where we
want to be. We liken it to the outer boundary markings on a
sports field-we don't mind where you play as long as you don't
go outside of this boundary.
This contrasts with the amount of risk you are able to take (a
capacity for risk taking), the amount of risk you wish to take (a
target for risk taking) and, of course, the actual risk profile (the
amount of risk you are actually taking). All these alternative
expressions add characterisation to our risk taking capabilities
and exposures.
If the role of risk m anagem ent is thought of in term s of both
protecting the organisation from unwanted outcom es and
advising the organisation on how to optimise its risk/return out­
com es, then risk appetite is supporting the protection role of
risk m anagem ent; the optimisation of risk and return is part of
the advisory role of risk m anagem ent and is addressed by assist­
ing business set their target risk profile.
Monitoring risk levels then becom es one of monitoring the
actual risk profile against target levels that have been set to
optimise risk-adjusted returns within the risk appetite boundary.
This is illustrated in Figure 4.1.
The Group actively uses these types of "sp id er" diagrams in its
business unit and Board dashboards to good effect.
With a clear concept established, we could turn attention to the
term s in which we should express the risk appetite boundary
Spare Risk Dimension 1 Risks actively
Capacity sought
Dimension 5 Dimension 2
BOUNDARY
(APPETITE)
£ define specific limits aligned with the RAS principles and metrics.
Actual Risk / /Target Risk Profile
Profile / ^ (Strategy)
Dimension 4 Dimension 3
®CBA Group
Figure 4.1 The risk appetite concept in CBA.
72 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and, just as important, how we could establish the Board's views
on this.
Board and Management Engagement
The Group's risk appetite needs to be owned by the Board. We
were aware that getting effective engagem ent and ownership
of the Board depended on us taking the Board along the devel­
opm ent road with us rather than either presenting a docum ent
for them to rubber stamp or other actions that lowered Board
m em ber personal investm ent in the outcom e.
O ur approach was to have a series of structured conversations
over a period of months with the Board. The first of these was
conducted as an interactive voting session to gather anonymous
views from all Board m em bers on a number of key questions
regarding outcom es for the Group that they would be least w ill­
ing to accept. This involved selecting various absolute measures
as well as ranking various potential outcom es. W here answers
were not well aligned between Board m em bers a staff-facili­
tated discussion was used to arrive at an acceptable consensus
view. We found that questions requiring ranking of choices
added clarity of insight on Board appetite. A fear by staff that
the Board would collectively adopt a highly conservative risk
outcom e did not happen, but we prepared the Board by talking
about appropriate risk-taking as key to profitable growth.
Arm ed with this base input we were able to translate the Board's
views into what we believed was the risk appetite that they had
expressed. This was written up and presented back to the Board
as a draft Risk Appetite Statement for their further discussion and
refinement over a series of further Board meetings. In the latter
stages nuancing of the words became more and more prevalent,
but by starting the Board engagem ent without a draft document
the initial conversations had concentrated on the concepts rather
than the words.
The same interactive voting session was first trialled with a sub­
set of the Group's m anagem ent Executive Com m ittee. Interest­
ingly, the views of m anagem ent were less well aligned than they
were am ongst the Board members.
'
,
Content of the Group Risk Appetite Statement
A t C B A the risk appetite is defined by a combination of the
Group Risk Appetite Statem ent (RAS) and the supporting Group-
level risk policies, such as the credit concentration policies, which
The RAS covers three im portant areas:
• The conceptual definition of risk appetite for the Group;
• Risk Culture; and
 • The risk-taking boundary— specific boundaries
(expressed in both quantitative and qualitative terms) for
major risk drivers, together with expressions on how par­
ticular risk types are controlled.
Having an appropriate "Risk Culture" is viewed as absolutely key
to effective risk m anagem ent. The RAS sets down a high-level
statem ent of intent with regard to risk, i.e., what we stand for
in risk term s (e.g ., the business, not Risk, m anages and own the
risks), and the expected behaviours of em ployees with regard to
risk. The aim is to ensure that the right people own the risk and
support the desired risk outcom es.
The approach to defining the culture was no different to the
other content in the RAS— we asked the Board questions about
the culture and behaviours they exp ected and then drafted
content that we thought reflected their responses. The result
was a single page containing around 10 cultural and 6 behav­
ioural principles relating to risk, which was edited based on
Board responses to it. Exam ples of the types of topics that we
cover are the need to understand and appropriately price for
risk and a culture where it is safe to call out m is-m anagem ent of
risk by others.
In order to em bed the desired culture there was a need to link it
to the remuneration system and this has been addressed in two
main ways:
The Board asked, as one elem ent of aligning with the regula­
tor's requirem ents, that risk m anagem ent opine on com pliance
with these principles for their consideration in setting executive
incentive awards; and
The Group's internal staff perform ance review system opens
with the requirem ent to consider whether an individual's key
perform ance has been achieved by operating within the culture
and boundaries of the Group's and the relevant business units'
RAS.
The risk-taking boundary includes qualitative expressions of
"risks to which the Group is intolerant" together with more
quantitative limits for key financial outcom es for the Group.
exposures/outcom es that we do not wish to experience but
recognise are not 100% preventable. W here they arise the RAS
commits us to take rapid and com prehensive action to minimise
the chance of reoccurrence.
Having developed the content of the Group RAS with the
Board, an im portant second step was to validate the alignment
of the existing Group-level risk policies, and in particular the
limits contained within those policies, to the RAS. These poli­
cies com plete the definition of the overall risk appetite. The
RAS metrics are now one of the key drivers of the limits that
are included in risk policies, for exam ple, the counterparty,
industry and country limits within the credit concentration policy
fram ework.
Cascading of the Risk Appetite
By necessity, the Group-level risk appetite is high level and
requires translation into more specific and meaningful term s for
a particular business unit.
The approach to this was to make the head of each business
unit— not the C hief Risk O fficers of the business units—
accountable for developing an equivalent RAS for their business
unit. The RAS would need to be both aligned with the Group
risk appetite but also specific to the characteristics of their busi­
nesses. This responsibility was an im portant part of the cultural
change, with the business them selves rather than Risk M anage­
ment being responsible for the risks being taken on and for their
outcom es.
Board members read these docum ents to test their specificity
to the activities of the business unit, and also as a lens through
which to view the strategies presented by businesses.
Bedding in RAS
re q u ire s c a s c a d i n g
Principles Supporting lim its

The "intolerant" concept arose from conversations with the

Board and m anagem ent about incentives and consequences
£
of operating outside of appetite. If we were to say that we had —
Q_
Q)
■

r-h

zero appetite for particular risks (e.g ., fraud) and we aligned

n>
o
n
perform ance assessm ent and incentives to operating within
appetite, then a fraud incident should have remuneration 3
rT
LQ
n>
im plications. This could create the wrong behaviours (either
spending disproportionately on preventing fraud or non­
reporting of fraud incidents) and so, rather than talk about zero
appetite, the concept of intolerance was developed. These are Figure 4.2 Risk appetite components and cascading

Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions ■ 73

Link to Strategy
A major elem ent of the overall risk appetite fram ework is the
interaction between risk appetite and strategy. The formal align­
ment and interaction of these two elem ents had not previously
been built into the operations of the Group.
The first point of connection is that both appetite and strategy
should be aligned with the Group's vision and values. Beyond
that the appetite is setting boundaries on risk taking activities
while strategy is seeking optimal use of the Group's resources
in response to the evolving environments in which we oper­
ate. Each should be challenging the other. Equally, reading one
should give knowledge of the other. These concepts are illus­
trated in Figure 4.3.
The building of the consideration of risk appetite into the
Group's formal strategic planning process has been a significant
step forward. However, it is not just in a formal way that risk
appetite has im pacted decision making across the organisation.
The referencing of decisions as being aligned with or outside
risk appetite is now becoming part of the everyday conversa­
tions around the bank. Even more gratifying is to hear people
often talk of the need to reassess the risk appetite in light of
opportunities that are presented, which creates an evolving and
productive challenge to current RASs— leading to keeping RASs
fresh and appropriate.
Successes to Date
There have been several aspects of the developm ent of risk
appetite that have worked well and translated into meaningful
benefits for the Group:
• Firstly, the approach to engaging with the Board led to a
strong sense of ownership and a depth of understanding
of risk appetite by the Board that would not otherwise
have been achieved.
Bedding RAS in...
Links it to other critical elements in a risk framework
CBA Group Vision and Values
Group Risk Appetite
Statem ent/Policies
Business Unit
Risk Appetite
# Statem ent/Policies
Figure 4.3 The critical link between appetite and
strategy.
74 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• By setting clear Risk Culture expectations in the Group
RAS and putting ownership for developing business unit
RASs on the heads of the business units (rather than the
business unit risk team s), there has been a cultural shift
in the ownership of risk from Risk M anagem ent to the
businesses. Business units now act with clearer responsi­
bility (ownership) for the risk they take on.
• The incorporation of the review of risk appetite as part
of the strategic planning process, and the presentation
of strategic plans, form ally accom panied by recently
agreed upon risk appetite statem ents, to both m anage­
ment and Board has brought risk appetite considerations
form ally into key decision making and strategy setting
discussions.
• The understanding of the interaction of strategy and
risk appetite has changed previously held views that
risk appetite was a barrier to progress, and in particular
that it could not be challenged or changed. A lot of
work has gone into explaining the connection between
strategy and appetite and the im portant way that they
are brought together in strategic planning, to give both
m anagem ent and the Board transparency over decisions
either to amend the strategy to align with the existing
appetite, or the appetite to allow the proposed strategy.
The joint consideration and refinem ent of strategy and
risk appetite is now part of business as usual. (See the
"A ssess & Revise" arrows in Figure 4.3.)
• By establishing clear boundaries, Business units under­
stand what is outside appetite and therefore do not pur­
sue these opportunities, leading to a reduction in both
wasted effort and frustration.
• By bringing the requirem ent to operate into align­
ment with the Group and local risk appetite statem ents
into the perform ance m anagem ent and remuneration
fram ework, risk appetite has achieved a high level of
awareness and influence on behaviours. Key behaviours
are found in the Group RAS, e .g ., responsibility to raise
issues, protection for doing so and "no harm" to people
who raise false-positive issues.
Continuation in the Evolution of Risk Appetite
Although considerable success has been achieved in the risk
appetite journey so far, we are cognisant that there is more
to be done in developing the maturity of risk appetite across
the Group.
• By necessity, the Group RAS is high level and principle
based in nature. The challenge is in cascading this
to lower levels in a way that makes it meaningful in
 day-to-day decision making on the front line. Business
units are developing risk param eters for lower level
portfolios/products that will translate the limits/prin-
ciples established in the Group and business unit RASs
into meaningful limits for staff working in these areas.
This will allow a more granular inclusion of RAS con­
sideration into perform ance assessm ents and incentive
paym ent outcom es.
• There has been som e initial reluctance by som e busi­
ness units to set the hard quantitative boundaries
required to help define risk ap p etite. This may be
partly due to the presence of a form al policy limit se t­
ting fram ew ork, plus a previously held view that once
set, RAS quantitative boundaries would be difficult to
change. (The Board actively assists in this m atter by
engaging on proposed changes out of cycle to the
annual RAS review process.) Further w ork is needed
to include more specific quantitative boundaries for
these businesses.
• Further developm ent is ongoing in adding clarity to busi­
ness unit RASs and strategies so that they becom e more
overtly com plem entary and aligned.
Chapter 4 Implementing Robust Risk Appetite Frameworks to Strengthen Financial Institutions
• The incorporation of stress testing outcomes into the
contextual setting of risk appetite is an area that we con­
tinue to develop.
Summary of Key Lessons Learned
As the risk appetite has been developed a number of lessons
have been learned, the forem ost of which include:
• W ithout sponsorship from the top it is difficult to get
traction in developing a risk appetite fram ework.
• W ithout a clear conceptual definition of risk appetite
there are many confusing and ineffective discussions
about risk m anagem ent and we fail to get business buy-
in to the fram ework.
• The conversations around risk appetite are equally as
im portant and beneficial as the actual Risk A ppetite
Statem ent docum ent produced from them .
• Culture is a fundamental part of risk appetite and to the
success of em bedding risk appetite in the organisation.
Taking the time to craft descriptions of what risk appetite
the Group and business units have for variance in risk
culture breathes life into risk culture.
■ 75
Banking Conduct
and Culture
A Permanent Mindset Change

Learning Objectives
A fter com pleting this reading you should be able to:

Describe challenges faced by banks with respect to
conduct and culture, and explain motivations for banks to
improve their conduct and culture.
Explain methods by which a bank can improve its corporate
culture, and assess progress made by banks in this area.
Summarize expectations by different national regulators
for banks' conduct and culture.
Describe best practices and lessons learned in managing a
bank's corporate culture.

Explain how a bank can structure perform ance incentives

and make staff developm ent decisions to encourage a
strong corporate culture.

E x c e rp t is rep rin ted from Banking Conduct and Culture: A Perm anent M indset Change, by the G 30 W orking G roup, 2018.

77
IN T R O D U C T IO N
This year marks the tenth anniversary of the 2008-09 global
financial crisis, an event that put banking culture and conduct
under the global spotlight. In the previous installment of our
series of reports on this topic, Banking C on d u ct and Culture—A
Call for Sustained and C om prehensive Reform (2015), we put
forth a set of recom m endations for banks, their boards and
BOX 5.1 D EFIN ITIO N O F CULTURE AND CO N D U CT
In our 2015 report,* we defined culture as the mechanism that
delivers the values and behaviors that shape conduct and con­
tributes to creating trust in banks and a positive reputation for
banks among key stakeholders, both internal and external.
We used a fram ew ork that identifies key factors that deter­
mine two broad outcom es for a bank: (a) client and stake­
holder perceptions about the bank's reputation and services,
and w hether the bank builds trust (among stakeholders
including em ployees, society, governm ent, and supervisors);
and (b) financial perform ance, which rewards shareholders.
To achieve these outcom es, the bank starts with its history
(client franchise, brand, technology, and financial resources),
defines a purpose or strategy for the institution, and d evel­
ops a unique culture that is the summation of values and
ethics, desired conduct standards, and implied behaviors.
Figure 5.1 provides a schem atic sum mary of this fram ew ork.
Culture com prises not only conduct and behaviors, but also
the bank's values and ethics. W hile cultural norms and beliefs
cannot easily be m easured, the conduct and behaviors that
the cultural norms encourage or discourage can be. In fact,
conduct can and should be observed, m onitored, m anaged,
and incentivized. It is im portant to rem em ber that while con­
duct and behaviors— that is, what people actually say and
do— are the only visible elem ents of culture, they are directly
INPUTS
C U LTU R E
Conduct & Values &
behaviors ethics
BANK P U R P O S E & ST R A T EG Y
BANK HISTORY
Fiaure 5.1 Elements of a unique bank culture.
78 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
m anagem ent, and supervisors, and promised to provide an
update on the progress major banks have made in implementing
our recom m endations. This report provides that update.
We focus on two fundam ental questions: (1) How much progress
has the banking industry made in culture and conduct (Box 5.1)
since the financial crisis, particularly since our last report?, and
(2) W here do we go from here? That is, in what areas should
banks continue to press on, and what evolving questions should
influenced by the less tangible elem ents, such as the bank's
unspoken rules, ideas, norms, and subconscious beliefs that
lie beneath the surface.
Managing culture thus requires understanding visible con­
duct and behaviors as well as the com plex web of influences
that lie beneath them .
W hile conduct can be evaluated as good or bad, culture
itself cannot be. The culture of each firm is unique to that
organization and it is not empirically right or wrong;
rather, it has to b e rig h t fo r th at organization. In that same
vein, firms that have had conduct issues or scandals do not
necessarily have an overall bad culture but have elem ents of
their culture that are misaligned with the outcomes the firm
is seeking and that are driving undesirable or inappropriate
behaviors. That is why it is so im portant to focus on both the
overall culture and all of the elem ents that com prise culture.
Culture is com plex and is made up of multiple structural
elem ents (such as processes, policies, organization, and
technology) and multiple human elem ents (such as norms,
expectations, beliefs, and values), all of which must be
aligned with one another and with the desired outcomes in
order for the culture to work for the firm.
* Sou rce: Banking C o n d u ct and Culture - A Call fo r Su sta in ed and
C om prehen sive Reform , Group of Thirty, W ashington, D .C ., 2015.
OUTCOM ES
C LIEN T & S T A K EH O LD ER
P E R C E P T IO N S
Reputation Trust
FINANCIAL PER FO R M A N CE
they be mindful of going forward? 85
To address these questions, we inter­ 80
viewed a significant number of C E O s,
75
board m em bers, and senior executives
at major banks across the globe, as well — 70

as a number of supervisory institutions o 65

>
and industry standards bodies. We <D HI] 62
z 60
also drew on other sources including V )

£ 55
insights from O liver W yman's global
practice. 50

45
O v e r th e last d eca d e , bank culture
and con d u ct have re c e iv e d in creased 0
atten tion from bank m anagem ent 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018

and th e ir su p e rv iso rs, clien ts/ — Banks Consumer goods Media Automotive
cu sto m ers, and in vesto rs. Supervisors, Energy Health care Technology
regulators, and governm ents globally Figure 5.2 Edelman Trust Barometer results by industry sector, 2006-2018.
have increased scrutiny of culture and
Sou rce: Edelm an Trust Barom eter Archive.
conduct issues; since the financial crisis,
the banking industry has paid an esti­ Note: Trust level results are distinguished betw een tw o populations: "Inform ed public" (ages 25-64,
collegeeducated, in top 25 percent of household income per age group/country), and "general
mated US$350 billion to US$470 bil­ population" (all population ages 18+). Due to differences in publicly disclosed results by Edelm an,
lion1 in penalties (including fines and years 2006-2011 of this figure show informed public results; years 2012-2015 show a blend of
litigation/settlem ent charges) for informed public and general population results; and years 2016-2018 show general population
results.
conduct-related m atters, evidence that
these so-called soft people issues can significantly impact the • Systematization of the roles of second and third lines of
bottom line. Both institutional clients and retail custom ers are defense in culture and conduct, and a push toward greater
becoming more focused on bank conduct and culture, driven by ownership of these concerns by the first line
highly publicized cases of conduct failures. Senior executives • Changes to business processes, including new prod­
and board members are increasingly expected to dem onstrate uct approval and product governance, revised pric­
that conduct risk is understood and m anaged, and that appro­ ing approaches, improved whistleblowing m echanism s,
priate discipline and culture are being reinforced. and review of questionable m arket practices in trad ­

A s a resu lt, banks have in v e ste d significant e ffo rt in im prov­ ing and hedging, all of which are signs that the conduct

ing th e ir culture and conduct. With increasing appreciation of agenda is beginning to cascade down to the way business

the scope and scale of culture and conduct issues, banks have is done.

instituted many changes focused on improving their culture and
conduct. These efforts span both formal and informal measures
and include:
• Refinem ent and/or re-articulation of bank purpose and val­
ues, with subsequent establishm ent of extensive com m unica­
tion and training programs
• Heightened engagem ent at the board level on conduct and
culture issues
• Modification of compensation and perform ance m anagem ent
schem es to incorporate not just financial results but also
behavioral considerations
D e sp ite th e se e ffo rts to im p ro ve co n d u ct and culture, th e
banking in d u stry still su ffe rs from a n e g a tive rep u ta tio n ,
and tru st still n e e d s repairing. According to the Edelm an
Trust Barom eter, the banking industry historically ranked
among the most highly trusted industries since the end of the
World W ar II; however, trust declined precipitously during the
financial crisis, and today remains low com pared to other indus­
tries and far from recovering to precrisis levels, as shown in
Figure 5.2.
The ongoing stream of conduct scandals, ranging from lapses
in custom er protection to anti-m oney-laundering deficiencies
to m anipulation of m arket benchm ark rates to rogue trad ­
ers, has called attention to the intim ate link betw een conduct

1 Sou rces: Conduct Costs Project, Good Jo b s Project, O liver W yman and reputation and continues to take a toll on the bank­
analysis. ing industry's reputation. The broad spectrum of topics and

Chapter 5 Banking Conduct and Culture ■ 79

geographies of recent scandals (see Figure 5.3) reveals that
conduct is not just an investm ent banking issue but an "all
banks, all g e o g ra p h ie s, all b u sin esses p o ten tia l issu e ," as one
banking official put it. It is relevant to all banks globally and to
all lines of business within banks. (See Box 5.2 for the case of
A ustralia.)
W hile some scandals are institution-specific, the reputational
fallout is often not limited to the offending institution but has
a contagion effect, impacting other players in the industry.
This shows that trust is an industry common good rather than
an institution-specific com petitive advantage. Further, as scan­
dals are often revealed retrospectively rather than in real tim e,

N ote: A M L — anti-money laundering; BBSW = Bank Bill Swap Rate; E T F = exchange-traded fund; EU = European Union; FX = foreign exchange;
IPO = initial public offering; LIBO R — London Inter-bank O ffered Rate; 1M DB

80 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 the reputational overhang can live on long after the m iscon­
duct occurs, som etim es even after the specific issue has been
addressed. All this shows that while trust and reputation are
easy to lose, rebuilding it is much more difficult. Even as banks
continue their efforts to becom e more trustworthy, becoming
trusted again will be a slower process.
are n o t " Banks have a small window to figure out how to man­
age culture and conduct and regain the public's trust. W ithout
earning trust every day, the continued survival of banks is at risk
from displacem ent by new industry entrants, a growing list that
includes fintech start-ups, technology firm s, retailers, and te le­
com com panies.

Banks cannot a ffo rd to b e com placent a b o u t th e ir tru st and In addition to the risk of client attrition, trust and reputational
reputational problem s, especially in light o f em erging com ­ issues may over time also lead to problems in acquiring and
p e titio n from altern a tive p ro vid e rs. As Bill G ates presciently retaining talent. For instance, young m illen n ial continue to be
put it nearly twenty-five years ago, "banking is necessary; banks turned off by banks' reputational problems and are opting instead

ABN AMRO
Mortgage fraud: M ortgage
advisors forged client signatures
in revised docum entation on
m ortgages
I s l pumob notionol bonk
Fraudulent transaction:
Issued fraudulent guarantees
for diamond merchant firms
to withdarw unsecured loans
from overseas branches
IN G & BANK
Money laundering: An investigation opened in 2016
has resulted in a US$900 million fine for failing to
prevent years of money laundering abuse.
A B L V
Violated International sanctions
against North Korea & bribed Latvian
official to prevent tougher A M L rules

WELLS

FARGO
Fraudulent accounts:
O pened millions of
fradulent savings
p
CornnomweaHhRmk
Deutsche Bank
Money laundering: Money laundering: Failied
|CBC Negligence led to more to prevent a US$10 billion
C5 l*>ST\l.S\U\uSliVNK«JFCIU\» 1

& checking accounts Loan fraud: 19 banks granted loans than 50,000 breaches Russian money-laundering
without custom er to criminals who illegally pledged of A M L & counterterriosm schem e, resulting in
consent gold of low purity as collateral laws worth US$ millions US$630 million in fines

i
2015
i 2016
i i

2017
i
2018

i f f 5= ^ t
ID
bsi.
Cotinionwealth Jarik Bank
IALC0NPRIVY!! RANK
Unsuitable financial Aggressive sales Money laundering: C E O
Money laundering: Bankers targets: Increased resigns amid probe into
advice: Encouraged
participated in and coordinated overdraft protection US$200 billion m oney­
more than 3,500
money laundering activities linked amounts & credit card laundering scheme
clients to undertake
to corrupt Malaysian 1M BD fund borrowing limits without perpetrated at its
risky, inappropriate,
investments custom er authorization Estonia branch
WELLS

p
FARGO
Comnonwoatth - AMP .
"Forced" auto insurance sales: Fees for "no service":
Sold auto collateral protection Charged thousands of
insurance to more than 550,000 custom ers for financial
custom ers who did not need advice that was not
coverage delivered

Chapter 5 Banking Conduct and Culture ■ 81

 BOX 5.2 THE AU STRALIAN CRISIS
A s the current situation unfolding in Australia dem onstrates,
the banking industry remains subject to further serious scan­
dals and fallouts.
In D ecem ber 2017, Australian prime minister Malcolm Turn-
bull's governm ent called for the establishm ent of the Royal
Commission into M isconduct in the Banking, Superannua­
tion and Financial Services Industry following revelations of
years of serious m isconduct by Australia's financial institu­
tions. Since the 2015 G30 report, egregious examples
of misconduct have surfaced, affecting one or more of
Australia's "Big Four" banks* These include rate manipula­
tion allegations (2015), unsuitable financial advice impacting
thousands of clients (2015), weak controls to prevent thou­
sands of breaches of anti-money-laundering/counterterrorism
laws (2018), and fees for no service (for exam ple, charging
accounts of dead clients) (2018).
These incidents have led to over US$700 million in penal­
ties and compensation since the 2008 global financial crisis,
removal of senior leadership (at C B A and AM P), and numerous
legal and criminal investigations. An interim report, released
in Septem ber 2018, noted remuneration practices and inade­
quate consequences as having been closely linked to issues of
conduct and culture, with more to come pending the final rec­
ommendations of the Royal Commission. The executive sum­
mary of the Interim Report of the Royal Commission points to
greed as a central issue, resulting in "the pursuit of short-term
profit at the expense of basic standards of honesty" (p. xix).
Separately, the Australian Prudential Regulatory Authority
(APRA) concluded in April 2018 its prudential inquiry into
C B A and released a report that outlines key shortcomings in
governance, accountability, and culture. While the findings are
for other sectors, as seen in the changing career destinations cho­
sen by M BA students post-graduation (Figure 5.4). Despite a
number of high-profile discrimination lawsuits, banks' efforts
focused on improving diversity have been minimally successful, as
diverse talent remains deterred by cultures they view as not
supportive and attentive to their developm ent and well-being.
Further, the shift toward digitization will continue to reveal gaps
in banks' technology capabilities, pressuring banks to compete
for talent that is already in high demand by other industries.
This and similar trends may spark concerns about potential
talent shortages in an industry that is highly dependent on its
human resources as a com petitive differentiator.
Bank culture and con du ct are m ore im portant than ever,
to rep air tru st and reputational issu es and fulfill the role
o f banks in so ciety. Sound culture and conduct are critical for
2 "W hy Diversity Program s Fail," Frank Dobbin and A lexandra Kalev,
Harvard Business R eview 94 (7) (July/August), 2016.
82 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
specific to APRA's review of C B A , the report contains lessons
for the industry as a whole, and in fact, other banks are being
required to conduct a self-assessment against the specific C B A
findings. The key issues outlined in the review include:
• Lack of alignm ent between banking remuneration
practices and fram eworks and indicators of good conduct
• Lack of senior leadership and board oversight on issues of
conduct and culture
• Inadequate oversight and challenge by the Board and its
gatekeeper com m ittees of emerging nonfinancial risks
• Unclear accountabilities, starting with a lack of ownership
of key risks at the Executive Com m ittee level
• Paucity or nonexistence of sufficient internal controls.
As next steps, A P R A has recom m ended that the banks
design and im plem ent stronger remuneration practices that
will align with strong conduct and culture outcom es, and that
banks leverage the Banking Executive Accountability Regime
(BEAR) to detail international best practices on strengthening
conduct and culture.
With the ongoing Royal Commission investigation and
pending recommendations, as well as continued revelations
of retrospective misconduct among Australia's financial institu­
tions, we anticipate that the Australian banking industry is only
beginning its long journey to repair its conduct and culture.
• National Australia Bank (N AB), Com m onwealth Bank of Australia
(C BA ), Australia and New Zealand Banking Group (ANZ), and West-
pac (W BC).
Sou rce: "W hy is Australia investigating its banks?," B B C N ews,
February 12, 2018.
banks to be able to play their role in society, and to the stability
of the broader financial system. Banks are held to a higher stan­
dard than many other service providers given that the services
banks provide are viewed by many as a public good that ben­
efits society— that is, interm ediating between sources and needs
of funds and facilitating transactions throughout the econom y—
and the effects of failure extend beyond just shareholders, with
repercussions for the broader econom y. Further, because bank­
ing products and services can be com plex and difficult to under­
stand, the public expects banks to provide good advice based
on expertise and in the clients' best interest.
And yet, many banks that devote considerable attention to their
business strategies and actions spend insufficient time thinking
about their purpose and the role they play in society. Despite
the trending notion of balancing stakeholder needs and the
argument that, over the long run, putting the custom er first is
the best way to drive sustainable shareholder value, shortterm
trade-offs often confront banking executives, in which doing
 Finance
Consulting
Technology
Investment Banking*
0 5
Percentage of MBA graduates entering each industry
■ 2007 ■ 2013
Fiq u re 5 .4 Career destinations chosen by MBA students.
Sou rces: 2007 and 2013 data: "Business education: Banks? No, thanks!," The Econom ist, O cto b er 11, 2014. 2017 data: average
em ploym ent data from Chicago Booth, W harton, Harvard, London, and IN SEA D .
what is best for custom ers may lead to less im m ediate profit or
more im m ediate cost. In such situations, clarity of purpose is
critical to enable executives to resist the tem ptation of near-
term gains, and to make decisions for the long run. Banks must
understand, reinforce, and internalize their key econom ic and
social purpose and improve their culture and conduct to fulfill
that purpose.
Responsibility for ensuring the organization's ability to bal­
ance purpose and profit ultim ately resides with the board and
the C E O . Under the rubric of culture, as with other aspects
of business perform ance, the board should see it as its key
responsibility to set the right tone and reinforce the desired
culture, and to oversee the bank's efforts to sustain a healthy
culture. In addition to the board, the chief executive should
have a com prehensive aw areness of the overall tone and know
w hat is happening under his or her w atch. An expectation that
senior m anagem ent should invariably be aware of every depar­
ture from desired behaviors w ould, of course, be unrealistic,
inappropriately implying a reversal of the burden of proof. But
it is a specific responsibility of the board and senior m anage­
ment to put in place robust processes to identify and ensure
appropriate escalation of behavioral breaches. Such processes
should be designed to be auditable and the subject of regular
monitoring by internal audit as a key ingredient of the third line
of defense.
Despite significant efforts, many still voice concern about the
industry's ability to make profound and lasting change. In our
interviews, industry leaders voiced several questions and con­
cerns about culture and conduct:
3 Balancing stakeholder needs with putting the custom er first ultimately
im proves com pany success, so no trade-off between custom ers and
shareholders should exist.
* “ In v e stm e n t B a n k in g ” is a s u b s e t
o f th e “ F in a n c e ” c a te g o ry . M B A =
M a s te r o f B u s in e s s A d m in is tra tio n .
■ 2017
• Have things really changed? Skeptics wonder whether true
change is possible in an industry that maintains large poten­
tial upsides to pushing the boundaries, and point to the
exam ple of Wall Street in 2017 recording its highest bonuses
since 2006.4 In addition, despite banks implementing many
process and policy changes to mitigate m isconduct, culture
and conduct have yet to be fully em bedded in many banks in
how they do business, and conduct issues are still observed
in banks worldwide. O thers are concerned about the passage
of time dimming the effect of the lessons learned during the
global financial crisis, and of the possible return to old prac­
tices, especially if interest rates rise, regulation is lessened,
and other business conditions improve. As post-global finan­
cial crisis regulations are potentially rolled back (in some juris­
dictions), firm-level focus on conduct and culture (by the
board and senior leaders) must take on even greater
im portance.
• Potential for culture and conduct fatigue. Especially in
some geographies where there has been a long-standing
focus on conduct and culture problem s, we detected some
desire to move on and get on with business. Banks cannot
think of culture and conduct as separate from business,
or as m erely soft or HR-specific issues. They are business,
that is, how business needs to be done and the means by
which banks can achieve continued success and sustain­
ability. For culture and conduct initiatives to be success­
ful, they need to becom e internalized as a way of doing
business rather than a program that is created and then
ignored. Conduct and culture must be understood by all
em ployees.
4 "N Y S Com ptroller DiN apoli: Wall Street Profits and Bonuses Up
Sharply in 2 0 1 7 ," O ffice of the New York State Com ptroller, March 26,
2018; http://w w w .osc.state.ny.us/press/releases/m arl8/032618.htm .
Chapter 5 Banking Conduct and Culture ■ 83
• Shift in relevant management and leadership capabili­
ties. Many leaders reported that historically, the banking
industry m anaged the business and the people prim arily via
quantitative m etrics (for exam ple, volum es, sales, and prof­
its), which w ere relatively straightforw ard to assess. In the
context of the increased em phasis on culture and conduct,
however, there is greater need for m anagem ent acumen
and skill as banks start to m anage not just the "w h at" but
also the "h o w ," which requires much more judgm ent as
well as proxim ity to and involvem ent in the daily business
operations. A lso, driving sustainable cultural change at large
organizations requires leadership capabilities that may not
have been a focus of developm ent in the past, such as more
focus on soft people m anagem ent skills rather than finan­
cial acum en. Finally, creating an environm ent of psycho­
logical safety where all em ployees feel em pow ered to be
authentic, where diversity can thrive, and where challenging
groupthink is encouraged will require greater m anagem ent
skills.
• Shifting toward a more nuanced and effective style of
management. This is especially difficult in many institutions
given the leadership deficit they are facing. In fact, many
banks historically promoted their best producers/perform-
ers into m anagem ent roles with minimal regard to ability or
interest in managing others (and often without regard to the
individuals' values and ethics, sending a powerful message
in term s of the organization's priorities). And little time was
dedicated to developing m anagem ent skills. A m anagem ent
role was often considered a reward for a job well done rather
than a privilege, obligation, and responsibility to develop
others and ensure the long-term sustainability of the firm.
Banks are now realizing a leadership gap in middle m anage­
ment layers, with a lack of skill and capacity to manage the
"how " of perform ance, and limited ability to influence and
drive team member behaviors. A number of banks that have
historically underinvested in the m anagem ent and leadership
capabilities that they require are now investing in leadership
developm ent to make up for lost tim e.
• Evolving forces on conduct. W hile the definition of good
conduct will stay the sam e, the pressure points will change
as the m arket and business models continue to evolve.
Banks will be tasked with anticipating and addressing addi­
tional scenarios for m isconduct that may em erge, such as
uncertainty in pricing contracts in the context of the London
Inter-bank O ffered Rate (LIBO R) transition; new General
Data Protection Regulation (GDPR) requirements around
data usage, consent, retention, and portability; and risk of
84 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
em bedded bias in autom ated black box system s and artificial
intelligence (Al).
• Rolling bad apples. Individuals with poor conduct records
move from one bank to another. Can issues truly be resolved
and addressed at the industry level if "bad players" can
simply move from one institution to another with impunity?
W hat can the industry do to address this? Are there lessons
from other professional industries (for exam ple, legal, m edi­
cal, engineering) that are applicable? Do laws defending
em ployee rights clash with the industry's ability to protect
itself from toxic em ployees? The industry continues to grap­
ple with these issues within the constraints of privacy and
em ploym ent laws.
• Increasing scope for supervisory gaps and conduct
arbitrage. As the thinking of financial authorities around
the world continues to evolve on conduct and culture, the
divergence in supervisory approaches across jurisdictions
is arousing concerns around conduct arbitrage, that is to
say large firms seeking to benefit from supervisory over­
sight in jurisdictions that may be less focused and dem and­
ing. Further, O pen Banking developm ents have started
to create some blurring of com petitive lines across banks,
technology com panies, retailers, and telecom com panies,
adding to concerns around fair com petition and custom er
protection.
*
This report is structured as follows. Section 1 presents industry
progress on conduct and culture since the financial crisis, and
particularly since our 2015 report; section 2 outlines the lessons
learned; section 3 offers additional, specific recom m endations
reinforcing our 2015 recom m endations; and section 4 explores
outstanding questions and opportunities for continued progress
in the future.
W hile this report focuses on banks as our prim ary audience,
we note that non-bank financial institutions (for exam ple, pri­
vate equity firm s, hedge funds, and insurance com panies) are
also prone to conduct and culture issues that are sim ilar to
those of banks. Certain issues may com e into particularly sharp
focus at these institutions, such as the possibility of outsized
financial rewards prom oting excessive risk-taking behavior. We
hope that, as has been the case with our previous reports on
governance and supervision, the leadership and directors of
non-bank financial institutions will also internalize the lessons
learned and our recom m endations. A s Box 5.3 m akes clear,
conduct and cultural failures are not unique to banks— far
from it.
BO X 5.3 NOT JU ST BANKS
Exam ples of corporate m isconduct are not limited to the
banking industry. O ther industries w orldw ide, including man­
ufacturing, autom otive, and high tech, have exhibited various
forms and levels of m isconduct, especially over the last few
years. As in banking, the root causes of m isconduct stem
from poor corporate cultures, inexperienced or self-absorbed
m anagers, w eak internal controls, and lack of safe escalation
procedures. These have resulted in billions of dollars in fines,
criminal investigations and charges, leadership removal, and
loss of custom ers.
Two industries, in particular, autom otive and high tech, high­
light the sim ilarities in environmental factors also observed in
the banking industry, which led to cultural breakdowns and
eventually to m isconduct issues.
• Automotive: In G erm any, in particular, several major
incidents of m isconduct have em erged from the
intentional manipulation of vehicular software to deceive
em issions tests. In Septem ber 2015, the United States
and G erm any opened investigations into Volkswagen's/
Audi's deliberate rigging of software on 11 million diesel-
powered vehicles w orldw ide between 2009 and 2015,
including 600,000 vehicles in the United States, to falsify
em issions levels to pass U.S. emissions tests. Investigators
further found active approval, engagem ent, and conceal­
ment of this program by the Volkswagen/Audi senior
leadership, including th en -C EO Martin W interkorn.
Consequently, Volkswagen has faced numerous federal
investigations in both the United States and Germ any;
criminal charges or arrests of senior leaders and m anag­
ers, including Volkswagen's and Audi's C E O s; and over
US$30 billion in recalls, legal penalties, and settlem ents
1 1. Lack of diversity: Industry hom ogeneity in backgrounds,
as of m idyear 2018. In addition, Germ an authorities are
investigating sim ilar m isconduct at Daimler, which faces a
potential U S$4.4 billion fine for illegal software in some
M ercedes-Benz m odels.1 2
It is worth noting that the Germ an car executives
concerned received among the highest bonuses in the
country.
• High tech: The high-tech industry has also struggled with
many reputational issues, allegations of m isconduct, and
loss of business due to actions that negatively impact key
stakeholders (that is, custom ers and em ployees). In addi­
tion, the hightech industry overall has been plagued by
extensive accusations of discrimination and mistreatm ent
of fem ale em ployees. The exam ples of cultural failings
1 "Audi C E O Rupert Stadler arrested in G erm an y," CN N Money,
Ju n e 18, 2018.
2' "G erm an y threatens Daim ler with 3.75 billion euro fine over
em issions-Spiegel," Reuters, Ju n e 1, 2018.
are rampant. During the tenure of its form er C E O , Uber's
culture had serious faults and resulted in numerous inci­
dents of m isconduct, including deliberately undermining
its com petitors (for exam ple, booking thousands of fake
Lyft rides, spamming Lyft drivers), underpaying its drivers,
using technology to deceive law enforcem ent, applying
surge prices inappropriately, and stealing trade secrets
from Waymo (the Uber exam ple is also an interesting case
of social media turning on a company for its decisions/
behaviors, and the #D eleteU ber m ovement showed cus­
tom ers voting with their feet).
In D ecem ber 2017, A pple adm itted to slowing the pro­
cessors on its older generation iPhones, presumably to sell
more batteries or new iPhones. Finally, Facebook has
dem onstrated significant negligence in managing the pri­
vacy of millions of its users' data, as revealed in the C am ­
bridge Analytica scandal in early 2018. Personal conduct
of senior executives is also under scrutiny; in a one-month
period in the summer of 2018, three C E O s in the chip
industry resigned or were fired for conduct reasons (the
com panies involved are Texas Instruments, Intel, and
Ram bus).3
Cross-industry lessons
Upon examination of other industries that have suffered
significant and system ic cultural breakdowns similar to
those observed in banking, we identify five characteristics
that these industries have in common and that might
provide insights into characteristics that lead to greater
culture risk.
education, gender, and racial/ethnic composition
remains prevalent and can foster groupthink cultures.
Such environments limit the number of challenges or
alternative opinions required to effectively mitigate poor
business decisions.
2. Presence of dominant companies: A few large, success­
ful players dom inate these industries and may lead to
deprioritizing culture, given that these com panies have
been able to attract custom ers and talent due to their
dominant brands.
3. High dependence on specialized skills: High-quality,
well-educated candidates with specialized knowledge
are critical in these industries. As a result, such individu­
als can often take on an outsized organizational role in
3 "Texas Instruments C E O Resigns A fter C ode of Conduct Viola­
tio n s," Maria Arm ental and Eliot Brown, Wall S tre e t Journal, Ju ly 17,
2018.
(Continued)
Chapter 5 Banking Conduct and Culture ■ 85
 their influence and decision making and make it more
challenging to fire such highly valued individuals even
in the face of egregious behaviors or inappropriate
decisions. Distorted views of individual's contributions
can also lead to the cult of personality in many of these
firms.
4. Misaligned incentives: Perform ance and remuneration
schem es are often aligned with quantitative or financial
targets, which can inadvertently prioritize decisions that
lead to m isconduct. In addition, average annual wages
for positions in these industries tend to be significantly
higher than mean annual national w ages; for exam ple, in
the United States, the mean annual wage for financial
analysts and advisors is 107 percent higher than the U.S.
mean annual wage across all industries, and the mean
S E C T IO N 1. A S S E S S M E N T
O F IN D U ST R Y P R O G R E S S *•
Our 2015 report outlined key recom m endations for improv­
ing conduct and culture, across both the what and the how for
banks to challenge their cultural foundation:
• THE WHAT. Banks should specify their cultural aspirations
through a robust set of principles, and fashion mechanisms
that deliver high standards of values and associated conduct
consistent with the firm's purpose and broader role in society.
• THE HOW. Banks should work to fully em bed the desired cul­
ture through ongoing monitoring and perseverance, drawn
from four key areas: senior accountability and governance,
perform ance m anagem ent and incentives, staff developm ent
and promotion, and an effective three lines of defense.
Our specific recom m endations are summarized in Table 5.1.
This chapter reviews the progress the banking industry has
made on conduct and culture since the financial crisis, particu­
larly since our last report in 2015, with a specific focus on the
recom m endations above. Before we begin, two caveats:
• It is not possible to holistically grade progress at a global
level, given the (sometimes very) significant differences
by geography and by each individual institution; for larger
banks, progress may even differ across businesses, offices,
and team s. For exam ple, banks in markets directly impacted
by the financial crisis (for exam ple, the United States, the UK,
and Europe) experienced an im m ediate spotlight on culture
and conduct and have been on this journey for a decade,
while banks in markets that escaped the financial crisis rela­
tively unscathed (for exam ple, Australia) have only more
recently begun to focus on the issue. In many of the areas
86 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
annual w age for computer- and tech-related jobs is 77
percent higher than the U.S. m ean.4
5. Ineffective leadership and management skills: Board
m em bers, senior leaders, and middle m anagem ent of
fast-growing and highly successful firms may over- esti­
mate their own and their company's capabilities and be
ill-equipped and too inexperienced to recognize poten­
tial risks and com plexities of their operating and revenue
models. Hubris caused by a high degree of success can
also cause individual leaders to believe their capabilities
and decisions are unassailable and they start to believe
their own rhetoric.
4 "N ational O ccupational Em ploym ent and W age Estim ates," U.S.
Bureau of Labor Statistics, W ashington, D .C ., May 2017.
assessed, we observed significant gaps between the leaders
and laggards, with some institutions having made significant
im provem ents while others still operate under the perception
of "it w ould never happen to us."
• W hile progress in term s of inputs/efforts can be easily
observed, whether and how these inputs/ efforts actually
impact outcomes is difficult to prove. Even a reduction in
conduct breaches over tim e cannot be considered a con­
clusive indication of im provem ent, as seen by the number
of conduct scandals that persisted for many years and only
recently have come to light.
Given these considerations, we focus on the efforts and inputs
of banks to improve culture and conduct, and we attem pt to
provide a range of views on progress across the industry.
That the industry mindset on culture has evolved was a point
of unanimous agreem ent across all our interviews. There is
now collective appreciation of the im portance of culture and
conduct, and the need to improve. But tangible industry prog­
ress has been slow, especially as the bar for good conduct
continues to rise and the public continues to expect more from
banks, and as levels of transparency (especially due to social
media) increase. W hile a number of individual firms have made
headway in implementing changes to formal and informal ele­
ments of culture, the industry as a whole continues to struggle
to em bed culture in a more fundamental manner, and to con­
clusively dem onstrate the effects of these changes. Moreover,
there is a growing gap between firms that are applying a holis­
tic, multipronged approach with active board-level engagem ent
and firms that continue to focus more narrowly on m isconduct
m anagem ent and com pliance as the solution to cultural issues.
Two relatively recent incidents in particular have attested to the
seriousness of the continuing cultural and behavioral leadership
Table 5.1 Summary of 2015 Recommendations

Area Recommendations

1 Fundamental shift in a. Banks should look at culture and look to achieve consistent behavior and conduct aligned
the overall mindset on with firm values, as key to strategic success.
culture
b. Banks should reinforce the m essages in their actions and in their internal communications.

c. Banks' behaviors and conduct should be open to constructive internal challenge.

2 Senior accountability d. O versight of em bedded values, conduct, and behaviors should receive regular attention in
and governance boards' agenda setting, given sensitivity to reputational risk.

e. Board charters should include responsibility for oversight of values and conduct.

f. Boards should build a reputation, values, and conduct risk tolerance dashboard to aid in their
evaluation of cultural issues.

g. If the Chair and C E O positions are not split, boards should ensure that the lead independent
director spends adequate tim e in the effective challenge role to the C E O on values and con­
duct issues.

h. The C E O and Executive team should be highly visible in championing the desired values and
conduct, and face material consequences if there are persistent or high-profile breaches.

i. The C E O should ensure that there is a thorough process that reviews the bank's brand and
reputational standing.

j. A sset owners and third-party fund managers should tell boards directly that they consider
effective governance and accountability to be a priority cultural m atter for the firm and
investors.

3 Performance k. Com pensation and promotion processes should ensure reflection of desired behaviors,
management and including consequences for weak m anagem ent oversight or willful blindness.
incentives
l. A com prehensive set of indicators is needed to monitor and assess the adherence of individu­
als and team s to firm values and desired conduct.

m. Individual review and assessm ent of senior executives by the senior leadership and C E O is
required.

4 Staff development and n. Banks should buttress first-line skills and ensure that frontline m anagem ent and leadership are
promotion properly trained in how to conduct judgm ent-based staff evaluation and deal with identified
breaches.

o. Banks should develop programs for staff across all areas of the bank that regularly reinforce
what the desired values and conduct mean in practice.

p. Institutions should form ulate and im plem ent a system-wide values and conduct evaluation
process for internal promotions and external hires.

5 An effective three lines q. Staff and management in the business (first line of defense) should shoulder the largest respon­
of defense sibility forjudging whether behavior is in line with the bank's values and desired conduct.

r. Banks should allocate clear second-line ownership to Com pliance or Risk M anagem ent func­
tions and ensure that the designated function is on the Executive team .

s. Banks should provide assurance to all em ployees that reports of wrongdoing in the workplace
will be taken seriously and confidentially without reprisal. Banks should challenge the conven­
tional wisdom on legal im pedim ents and ensure that robust penalties and appraisal processes
are in place.

(Continued)

Chapter 5 Banking Conduct and Culture ■ 87

Table 5.1 Continued

Area Recommendations

t. Staff rotation between control and business functions may be beneficial and help develop the
desired firm-wide cultural mindset.

u. Banks should ensure that the third line of defense is robust, has operational independence, is
suitably staffed, and has a clear mandate to exam ine adherence to standards.

6 Regulators, supervi­
sors, and enforcement
authorities
v. Regulators should carefully consider the limited effectiveness of promulgating rules related to
values and conduct.
w. Conduct-of-business and prudential supervisors can, however, gauge the effectiveness of
board and m anagem ent processes that generate tangible oversight and change in values and
conduct.

x. Conduct-related assessm ent should be em bedded into the core supervisory work, rather than
developed as an "add-on" task or objective.

y. Industry-led standard-setting initiatives should be encouraged.

and managerial deficit, one regarding Wells Fargo in the United
States and one regarding Com m onwealth Bank of Australia
(CBA ). Wells Fargo, considered an industry leader in cross-sell
metrics and praised for having successfully navigated the finan­
cial crisis, saw a series of high-profile scandals erupt in succes­
sion from late 2016 that revealed serious cultural failings such
as flawed incentives and excessive sales pressures, a pattern of
corner-cutting and unethical behavior, and inaction by senior
leadership. C B A , the largest financial institution in Australia and
a bank respected for its history of financial success and technol­
ogy innovations, also underwent a succession of scandals and
was found in a 2018 prudential inquiry to harbor critical cultural
shortcom ings, including a sense of com placency; utilizing only
a reactionary approach to exposed risks; insularity; and pursuit
of consensus at the expense of constructive challenge and
accountability.
In some ways, these cases shook up the industry in each market
more than other cases because they were so unexpected; these
were institutions with stellar reputations that had weathered the
financial crisis relatively unscathed. They were also considered
solid traditional banking institutions with a community focus.
These scandals proved that conduct issues are not limited to
investment banking and can in fact permeate conventional retail
and wealth management banking activities. As one senior industry
member stated, it is when the institution is successful, growing,
and well-regarded that senior leadership must be most vigilant
against the "tyranny o f su ccess," extreme overperformance vis-a-
vis competitors, and the temptation of willful blindness.
Unfortunately, major conduct failures continue elsewhere, further
underscoring this is not predominantly an Anglo-Saxon matter.
For exam ple, the Danske Bank US$200 billion Estonia-Russia
money-laundering scandal has shown that whistleblowing cannot
be overlooked and should always be carefully and swiftly investi­
gated by senior m anagem ent with the oversight of and reporting
to the board. Likewise, a money laundering scandal at ING led to
a US$900 million fine earlier this year. The Punjab National Bank
US$2 billion fraud has also highlighted conduct and oversight
weaknesses in India's state-owned banks. Finally, the reported
conduct failure at Goldman Sachs related to 1M DB, drives home
that a focus on conduct and behavior is essential to all firms.
Mindset of Culture
Since the financial crisis, culture and conduct concerns have
risen in prominence at many banks, representing a clear shift in
the mindset of culture. Most banks by now have re-articulated
their core values (which are unique to each bank, but commonly
include concepts such as custom er/client centricity, integrity,
and internal collaboration) in a Code of Conduct or similar docu­
ment and have made efforts to repeatedly com m unicate these
throughout their organizations (including implications of per­
sonal and com pany behaviors and expectations related to the
firm's values).
Banks have taken various approaches to com m unicate values
throughout their organizations. One C E O personally reviews
im portant bank-wide communications to increase visibility of
the bank's values and ensure alignm ent with the organization's
culture. O ther banks have set up regular town halls and focus
groups to promote dialogue on values and create venues for
constructive challenge. A number of institutions have devel­
oped interactive training and role-playing to further clarify and
entrench the values and expectations.

88 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Despite significant progress in formal intention, fram eworks, and
com m unications, the degree to which these values have been
em bedded in the day-to-day behaviors of em ployees has yet
to be determ ined. W hile "tone from the to p " is appropriately
focused on conduct and culture m atters, it is unclear if this has
flowed throughout the organization and whether em ployees at
all levels, and especially in the front lines, have fully internalized
how this will change how they do business. Much opportunity
also remains in working with middle m anagem ent layers to
ensure that tone from above properly reflects the m essage and
intent from the top, and that em ployees are not in a position
where they feel a conflict between what they hear from senior
leadership and what they are required to do on a day-to-day
basis.
Accurately understanding and measuring changes in culture on
the ground remains challenging (especially in large, multi-geog­
raphy and multi-business-unit banks), and will require banks to
continuously monitor whether the formal shifts in their mindset
of culture have translated to changes in the day-to-day conduct
and behaviors of their em ployees.
Banks need to ensure that the inclusion of behavior and
conduct within their m indset and approach toward business is
perm anent, and to view the process underway as a fundamental
shift in how they do business rather than a program or set of
initiatives. Many leaders interviewed shared the concern that as
the crisis and scandals are put behind us, the lessons might be
forgotten and a return to old practices might occur.
Senior Accountability and Governance
Board Responsibilities and Involvement
With the increased public scrutiny on conduct and culture, and
greater expectation for Boards to be fully informed of and
involved in such issues, ignorance is no longer an acceptable
excuse. In fact, on conduct issues and risk taking, many directors
are asking them selves "how do we really know ?" and are put­
ting in place measures for greater involvement and insights into
the company culture.
The banking industry overall has stepped up board-level involve­
ment on these topics. Prior to the crisis, only one-third of global
system ically im portant financial institutions (SIFIs) had a dedi­
cated board- level financial risk com m ittee,5 and boards rarely
(for exam ple, once a year or som etim es even less frequently)
5 "B S B Blog: Sir David W alker on Banking Conduct and C ulture,"
David Walker, Banking Standards Board, May 24, 2018; https://
www.bankingstandardsboard.org.uk/bsb-blog-sir-david-walker-
on-banking-conduct-and-culture/.
dedicated attention to culture and conduct topics, leading to a
deficit in expectations and guidance for senior executives on
such issues. Today, conduct and culture discussions account for
a meaningful share of board agendas, and as observed by indus­
try participants, the increased board involvem ent represents not
just lip service but tangible im provem ent.
The specific form of implementation varies across banks. Some
boards have co-opted existing, more broadly mandated com ­
mittees (for exam ple, Risk Com m ittees); some banks have newly
established dedicated subcom m ittees on culture and conduct
topics; and still others have opted for multiple overlapping com ­
mittees to exercise joint oversight over these issues.
O ur prior recommendation to split Board Chair and C E O roles
has been executed to varying degrees. Many U.S. banks persist
in a com bined role. Wells Fargo notably shifted to a split model
driven by shareholder pressure in the aftermath of the conduct
failure and scandal, and Citigroup has announced they will
confine to split the Chair and C E O roles. W hile the splitting of
roles does not on its own guarantee elimination of misconduct
(scandals have occurred in banks with split roles), it nonetheless
is good governance practice and facilitates checks and balances
between board and executive leadership.
Board-Level Conduct Management Reporting
Developing m anagem ent and board-level conduct m anagem ent
reporting has been a major area of focus for many banks over
the last few years, in response to regulatory and senior m anage­
ment pressure. Many banks are in the process of creating and
refining their culture (and often also ethics) dashboards, often
leveraging data and information that is already collected across
the organization, and now collating and analyzing these
indicators through a culture lens for the first tim e. There is
general agreem ent on the value and im portance of such
dashboards, though the approaches vary in the type, amount,
and granularity of indicators. Results are often exam ined by a
variety of factors including geography, business unit/function,
tenure, and em ploym ent level, to identify subcultures, discrep­
ancies, and pockets of issues existing today and appearing
over tim e.6
The trend analysis across both leading and lagging indicators
has been used effectively in a number of institutions, but many
organizations still struggle with shortcom ings in their reporting
abilities. The challenges reported by banks include:
• DATA QUALITY AND AVAILABILITY: The required data are
not available and take tim e to build (requiring capability
6 See Section 2 Lessons Learned for additional information on how
banks are approaching culture and conduct m easurem ent and reporting.
Chapter 5 Banking Conduct and Culture ■ 89
 enhancem ent or new roles and responsibilities), and/or
available data are of poor or variable quality. Data must
also enable reporting and metrics at the right level of detail
and granularity to be able to identify localized declines or
w eak areas. M anagem ent must be able to slice and dice
the information in order to spot, highlight, and investigate
specific or localized issues. G reater advances in technology
and Al are starting to enable greater monitoring and analysis
capabilities.
• APPLICABILITY: Defining standardized metrics across busi­
nesses and geographies that are meaningful and can be
aggregated remains a challenge.
• RELEVANCE AND EFFECTIVEN ESS: Existing metrics pro­
vide useful but limited insights in isolation, and relationships
between variables and trends need to be considered. Also,
banks continue to struggle to develop forward-looking
measures and test outcom es, and given the fact that avail­
able metrics are often asym m etrical, they remain focused
on reporting m isconduct rather than conduct more broadly
(including positive measures of conduct).
• USEFULNESS: Conduct and culture reporting in many institu­
tions is a relatively new exercise and will require practice to
get right. Many banks are still struggling with how to best
use the data and metrics to trigger action or achieve goals
of better managing conduct risk. Interpreting the data and
translating it into actionable insights is a work in progress at
many banks we interviewed.
Monitoring and m easurem ent will always be difficult, but this
should not dissuade firms from the exercise, as they can con­
tinue to develop and adjust their tools over tim e.
Modeling Behavior
Banks increasingly recognize the im portance of leading from the
top ("tone from the top") and the need for senior m anagem ent
to consistently set concrete exam ples of desired behavior for
the organization to follow. W hile tone from the top can m aterial­
ize in various ways, a few best practices have em erged in recent
years.
First, leaders can ensure that their communications through­
out the bank are consistent, clear, and relatable, (for exam ple,
clearly explaining key decisions, how they fit with the firm's
overall strategy and culture, and how the decision is relevant
to em ployees). Second, leaders can dem onstrate the desired
behavior by living it on a daily basis and exhibiting it in how they
act within the firm, with em ployees, and with custom ers and
clients. Exam ples matter, and those set by a firm's leadership
are key to em bedding culture. One C E O set a strong tone early
in their tenure by rejecting a business opportunity that was not
90 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
aligned with the company's culture, even though it resulted in a
significant loss of business and profits for the com pany. Third,
leaders can and should model desired behaviors by express­
ing (and, more im portantly, demonstrating) a genuine desire
to receive and respond to feedback. A t one bank, the C E O ,
upon finding that a culture issue raised by an em ployee had not
received attention in a tim ely manner, proffered a personal apol
ogy for the delay.
Finally, bank leadership can tangibly dem onstrate they are in
the same boat with em ployees by taking responsibility for the
consequences of difficult actions or outcom es. For exam ple,
the C E O at one bank took a voluntary 40 percent pay reduction
upon unveiling a plan to cut staff numbers and instituted long­
term incentive plans with com pensation deferred for multiple
years.
Senior leaders sharing their own dilemmas and scenarios of
when they faced difficult and ambiguous decision making also
helps in both defining the expectations and making leaders
more approachable.
Role of Asset Owners and Third-Party Fund
Managers in Influencing the Board and
Management Focus on Culture and Conduct
• A sset owners and shareholders are beginning to increase
pressure on banks with regard to culture and conduct, and in
a number of interviews, C E O s spoke about actively engag­
ing key shareholders in a dialogue about their firm's culture.
Investors, on the other hand, still feel it is difficult to have
a true voice in the process given the diffuse nature of the
investor community; that is, they rarely speak with one voice
(see Box 5.4).
• The Wells Fargo scandals revealed the extent of increasing
investor attention on these topics: not only did they incite
vocal reactions from activist investors, dem anding improved
governance and changes in board m em bership, but the
resulting record US$60 million senior executive claw-backs
were made possible by prior activism in 2013 by New York
City's pension funds to enable claw- backs in the event of
m isconduct.7,87
8
7 "C iti, W ells broaden exec pay claw back policies, M arketW atch,
March 13, 2013; https://w w w .m arketw atch.com /story/
citi-wells-broaden-exec-pay-clawback-policies-2013-03-13.
8 Claw backs (especially ones due to public/investor dem ands) should be
seen by the industry as a last resort m easure. The industry should strive
to achieve effective upfront com pensation assessm ents rather than after-
the-fact rem ediation.
 BOX 5.4 THE IN V ESTO R VIEW
As com panies in the banking industry (and in other industries)
face increasing conduct issues, and have incurred significant
financial costs (fines, lawsuits, lost business), we have seen
investors increasingly paying attention to the softer issues
beyond financial results. A number of bank C E O s reported
to us that they have started engaging directly with large
investors to discuss their culture— and the potential impact
of strategy on culture and conduct. For the first tim e, we
included interviews with large institutional investors in our
report, the key findings of which are described below.
Investors we interviewed care about the culture of their
portfolio com panies from two perspectives: (a) they look for
a board that is independent and strong, while also being
appropriately involved in understanding how the business is
run; and (b) they look for sustainability, which requires both
strong financial results and positive outcom es for all stake­
holders, not just shareholders.
Board culture: The investors we spoke with look at the corpo­
rate culture but also, importantly, at the board culture. W hile
the two are related, they are not the sam e. Assessing the
board culture enables investors to understand the effective­
ness of the board in representing and defending the interests
of shareholders. Elem ents that they look at include:
• Diversity of board members (such as experience, back­
ground, and gender)
• Culture of accountability within the board
• Ability to dissent and have differing views from the
majority
• "Chum m iness" of the board with the C E O .
Investors also assess how well the board understands the cul­
ture of the firm and how the culture drives ability to achieve
desired results. One investor we spoke with said that while
boards have becom e more involved in discussions with man­
agem ent about culture, many directors are still unable to fully
articulate or describe the company culture. From the inves­
tors' viewpoint, there appears to be room for im provem ent
in term s of boards' understanding, involvement in, and influ­
ence on corporate culture.
Culture as a driver of sustainability: W hile investors focus on
returns, there is an increasing recognition that "so ft" fac­
tors such as culture can make or break a company. Financial
Performance Management
and Incentives
Many banks, particularly in the UK and Europe,9 driven by
recent Financial Conduct Authority (FCA) and European Banking
9 In Australia, A PR A released an updated rem uneration fram ew ork and
set of standards; see "Inform ation Paper: Rem uneration practices at
large financial institutions," Australian Prudential Regulation Authority,
returns are necessary but not sufficient; returns can be wiped
out by one event. Culture failures not only lead to hard costs
(fines, lawsuits) and financial losses, but scandals and reputa­
tional issues put m anagem ent in a crisis m ode, which detracts
from their focus on business growth and revenue generation.
A sustainable business model must include a focus both on
financial results and on addressing the interests and w ell­
being of all stakeholders. As one institutional investor stated:
"It is not a choice between profit or purpose— we are long­
term investors for our clients and that requires our portfolio
com panies to pay attention to both profit and purpose."
The challenge, of course, is that even today, the markets
put significant focus on quarterly earnings, which can lead
to business decisions and actions that maximize short-term
financial results over other priorities. One institutional inves­
tor told us that the market needs to start thinking long term
rather than in quarterly results, "but the market is not good at
pricing the value of having sustainable results: there is value
in good culture and good corporate citizenship but we call
these the nonfinancial elem ents because we don't know how
to price sustainability." This investor looks carefully at envi­
ronmental, social, and corporate governance (ESG )* elements
as they believe these provide forward-looking insights. Finan­
cial results report on historical perform ance, but the ESG
elem ents provide predictive insights into an organization's
health, and therefore continued ability to perform.
W hile asset owners have the potential to significantly influ­
ence boards and m anagem ent to focus on culture as a driver
of long-term sustainability; the greatest im pedim ent remains
the diffuse nature of the investor community and of their
interests. Even the largest institutional investors rarely have
significant ownership in any one com pany, and it can be dif­
ficult for them (on their own) to influence board/m anagem ent
agendas. A side from specific scandals that can cause inves­
tors to align their interests, shareholders in any one com ­
pany often have very diverse goals and may seek divergent
outcom es. The asset owners we interviewed spoke about
the need for the investm ent community as a whole to better
align on the im portance of culture and governance as drivers
of sustainable financial results.
Note: The ESG elem ents are the three main areas of focus in
measuring the sustainability and ethical im pact of an investm ent in a
com pany.
Authority (EBA) guidance, have reviewed their remuneration
schem es, and incorporated cultural and behavioral consider­
ations into perform ance scorecards, most notably at senior
m anagem ent levels. Banks are at varying stages of formalizing
these measures, cascading them to middle m anagem ent levels
Sydney, April 2018. Specifics on im plem entation and outcom es are not
yet available.
Chapter 5 Banking Conduct and Culture ■ 91
and below, and ensuring consistent application. W hile some
banks are beginning to report cases of significant compensation
adjustments resulting from the adoption of balanced score-
cards for perform ance m anagem ent, many banks still weigh the
"how " elem ent lower than the "w h at." In practice, it is much
easier to evaluate direct results than behaviors, and difficult to
penalize high perform ers who do not fall in line with cultural
expectations. Nonetheless, boards and m anagem ent must take
this step, and be willing to term inate em ployees for conduct
breaches when necessary.
Recent years have seen cases of conflicted rem uneration
m odels that incentivize overly aggressive sales behaviors that
resulted in harmful outcom es for custom ers. A num ber of indi­
vidual firm s have rem oved sales-focused incentives for frontline
staff, opting instead for alternative m easures such as those
based on team goals and custom er satisfaction outcom es.
O ne bank shifted com pensation away from paying based on
profitability m etrics to paying commission based on a service
provided to the customer. For the com mission to be paid, the
client must be aware of and happy with the service (a third
party is em ployed to collect client satisfaction key perform ance
indicators [KPIs]). A nother bank shifted to a three-pronged
perform ance evaluation for all staff: (a) perform ance in jo b , (b)
effectiveness of behavior, and (c) results on personal stretch
goals.
This transition in compensation structures has not been without
friction, with some banks experiencing initial sales declines, and
others needing to experim ent with alternative perform ance
measures to achieve the right balance between incenting good
conduct and achievem ent of strategic goals. The changes in
incentives will also require efforts in other areas, such as reedu­
cating staff to better assess custom er needs and make suitable
recom m endations, and introducing new service tools and rou­
tines for frontline staff.
A nother challenge of transitioning from purely results-based
com pensation to a balanced-scorecard com pensation structure
is that it requires insight into how em ployees perform their role.
This means that m anagers must have enough tim e and m an­
agem ent acumen to understand what actions and decisions are
required in different circum stances and w hether the em ployee
did in fact exhibit these behaviors. A lso, because com pensation
is such a blunt (and limited) instrum ent for influencing behav­
ior, organizations that value the "ho w " as much as the "w hat"
need to minimize reliance on com pensation as a m anagem ent
tool. Com pensation has a role to play, but more im portant is
the role of leadership. O ne institution we interview ed trains
m anagers to look for real-time coachable moments to drive
em ployee behaviors rather than only ex-post com pensation
m easures.
92 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A num ber of leaders w e in terview ed , w hile agreeing about
the need to change com pensation structures, also pointed
to the lim ited im pact on culture this change will have if done
in isolation. In fa ct, com pensation is often a by-product of its
environm ent rather than a driver. W henever there is m iscon­
duct, there are alm ost alw ays issues with incentive design.
However, one must ask w hether the incentives drove the
undesirable behavior or the incentives are an indication of
the wrong m indset, which is ultim ately responsible for the
behavior.
To be credible, the shift toward a balanced perform ance man­
agem ent culture also requires willingness and courage on the
part of leadership to deal with high perform ers (from a purely
results perspective) who display toxic behaviors. W hen m anage­
ment unevenly upholds standards of behavior, it sends a power­
ful message to all team members of what is im portant in reality
regardless of the stated values.
Banks have also becom e more willing to act on and publicize
breaches of conduct, and some have signaled when conduct
failures have led to term inations, which, when done, sends
a very strong firm -wide m essage. W hereas in the past poor
behavior from a strong producer may have been overlooked,
banks today have much lower tolerance for bad behavior
and have stated that they are even willing to forego revenue
opportunities (for exam ple, w ithdraw from certain deals or
businesses) where necessary in favor of maintaining a strong
culture.
Banks are also beginning to weigh the potential benefits of
using breach of conduct incidents and term inations as teaching
moments, against the potential risks of running afoul of privacy,
confidentiality, and em ploym ent law. Some banks are choosing
to explicitly com m unicate such narratives, while others rely on
informal grapevines and collective consequences (for exam ple,
heavier scrutiny of activities) imposed on team s of the offend­
ing individual or individuals to spread the m essage internally.
A number of senior industry executives pointed to the discon­
nect between regulation and societal expectations on the one
hand, and em ploym ent and privacy laws on the other. D eal­
ing rapidly and forcefully with egregious breaches of conduct
can be difficult, especially in certain jurisdictions with strong
em ployee protection. In the current climate of social justice
cam paigns and activist investors, ethical and legal consider­
ations need to be aligned.
Staff Development and Promotions
Training programs on conduct and culture have expanded
in size and scope at most banks, often focusing on defining
specific expectations around behavior and helping em ployees
understand how abstract values and principles specifically trans­
late into day-to-day responsibilities and expectations. This is a
very im portant elem ent of driving behavior; historically, while
banks had value and mission statem ents, there was very little
guidance for em ployees to translate highlevel statem ents into
"w hat d o es this mean specifically for me in my everyday jo b
to b e able to live up to the exp ectatio n s o f the institution?"
Banks are applying a variety of scenario-based/role-playing/
industrial theater approaches and using a combination of live
and web-based mechanisms to deliver content. As one industry
leader put it, "w e n e e d to map the culture to the p ra ctica l,"
providing actual exam ples of how the culture must be lived.
Another area of training is around the grey zones where ju d g­
ment is required. Banking is a com plex business where rules and
policies are not possible (or even desirable) for every situation.
A principles-based culture requires that em ployees also have the
knowledge, skills, and tools to face the multitude of decisions in
BO X 5.5 USE O F M ACHIN E LEA RN IN G FOR CULTURE AND CO N D U CT
S U R V EILLA N C E BY SU PER V ISO R S
Both banks and supervisors have recently started to look
at the use of advanced technology (that is, Al and machine
learning) to support conduct risk m anagem ent through auto­
mated surveillance techniques.
Culture and conduct surveillance establishes what normal
or expected behavior is for a com pany/function/role, and
then analyzes relevant data to identify behaviors that are
not in line with the norm. This objective of identifying pat­
terns and anomalies in behavior is an ideal application for
machine learning models. For exam ple, clustering algorithms
are effective in identifying patterns, trends, and correlations
in large bodies of data such as account openings and sales
perform ance. In addition, natural language processing tech­
niques can be used to extract sentim ent and meaning from
chat logs and call transcripts to identify em ployee m isbehav­
ior or trends in custom er com plaints.
W hile not without some controversy (related to privacy and
intrusiveness), the technology is advancing rapidly and there
are numerous benefits to automating the monitoring, com ­
parison, and analysis of behavior patterns. Indeed, individual
com panies have experim ented with and are starting to im ple­
ment such capabilities. Supervisory bodies are also exploring
how these capabilities could be used to address their goals
of ensuring safety and soundness.
Assuming supervisors can collect the necessary data at the
appropriate granularity and frequency from institutions, they
could apply machine learning techniques to monitor culture
and conduct at the industry level and across institutions on
an ongoing or near real-time basis. However, even though
such applications are feasible in theory, the practical reality is
much more challenging.
ambiguous and com plex situations where the right answer is not
obvious.
A t the same tim e, some banks have seen that the increased
level of training on all aspects of conduct can have a numbing
effect on staff, where em ployees start to tune out and training
has the opposite effect than intended. It is im portant to have
the right training for the right people at the right tim e and to
target the training and not push everyone through everything.
Conduct screens are also increasingly being applied to prom o­
tion and external hiring decisions. Some banks have stepped up
their hiring practices to better assess new recruits' alignment
with the organization's purpose, values, and expectations
on behavior; exam ples include conduct interview questions,
ethical screening, and various forms of personality assessm ents.
Recent years have also seen active investm ent in surveil­
lance technology at banks (see Box 5.5), typically beginning
The initial practical challenge is the collection of the nec­
essary data in a consistent m anner across institutions.
However, bigger concerns and challenges arise after the
data are co llected . Th ese include establishing baseline
behavior, setting thresholds and trig g ers, drawing m ean­
ingful com parisons given the com plexity of institutions
and differences across institutions, engaging institutions
to investigate potential issues, and the treatm ent of false
positives. The other overarching issue, particularly from the
perspective of supervised institutions, is the potential nega­
tive consequence of big brother influence on em ployees
created by the ongoing m onitoring of em ployee behaviors
and actions.
The potential to use m achine learning by supervisors for
industry-wide culture and conduct surveillance is real,
given that the technology already exists, and the data
already reside within individual institutions. The benefits are
num erous and include rapid identification and rem ediation
of bad behavior and system ic issues; reduction of m anual,
siloed, and costly m onitoring processes at institutions; and
understanding of the cultural health of the industry (sim ilar
to how other industry-wide exercises such as C o m p rehen­
sive Capital Analysis and Review [C C A R ] help supervisors
understand the financial health of the industry). However,
the practical challenges are significant and likely prohibitive
at this point. O vercom ing these challenges would require
a concerted effort and collaboration betw een supervisors
and the industry to ensure that the potential benefits of
this new generation of surveillance m ethods outw eigh the
dow nsides.
Chapter 5 Banking Conduct and Culture ■ 93
with capital markets businesses but increasingly broadening
in scope to other areas. The focus at the cutting edge is on
making better use of available data with advanced analytics,
bringing together disparate analytical outputs (for exam ple,
communications/ trade/voice surveillance, social media scan­
ning), and exploring additional analytics to detect or predict
potential conduct events (for exam ple, reputational/sentim ent
analysis, network analysis, cluster analytics). W hile the technol­
ogy is rapidly evolving to support such capabilities, the ethical
questions around the acceptable degree and level of em ployee
monitoring remain. With increased monitoring capabilities,
banks need to carefully balance the need to manage conduct
with the need to provide em ployees with some level of privacy
and trust.
An Effective Three Lines of Defense
An effective three lines of defense is the area of greatest
challenge and least progress to date. The shift of ownership
of conduct and culture initiatives to the first line (where it
belongs) has been slow. Banks are beginning to improve clarity
of second-line oversight of conduct and culture risk, though
a standard model has yet to em erge; the specific setup varies
by bank size, com plexity, and risk m anagem ent approach.
A t many banks, second line team s are often still responsible
for driving conduct initiatives, focusing on the developm ent
of fram ew orks and standards, piloting, and initial stages of
im plem entation. In term s of the third line of defense, while
some banks have started to establish culture audit practices,
many banks still struggle with the best way to audit what can
feel very intangible. Given this is a relatively new area of focus,
banks are in the process of working through a m aturity curve
to understand the risk and develop a common taxonom y and
fram ew orks.
The biggest gap we observed in the effective im plem entation of
the three lines of defense for conduct risk m anagem ent is that in
many banks it still appears to primarily be a second line focus
area. As with all other risks, to be properly m anaged, it needs to
be owned by the first line and em bedded in all business pro­
cesses. It is especially im portant for the first line to be deeply
aware of and accountable for conduct risk m anagem ent given
that conduct by its nature is how you do business. A conduct
risk lens needs to be explicitly applied to all business activities
including new product approvals, pricing guidelines, customer
com plaint handling, and evaluation of new transaction/business
opportunities. W here it has been a focus by regulators and
banks, some progress has been made. For instance, as the UK
FC A notes in its "5 Conduct Q uestions" April 2018 Industry
Feedback rep o rt,101for the polled com panies,11 nearly all
frontline business areas have taken full ownership for conduct
risk and related change and developm ent programs. There are,
however, firms that were slower to make this shift and continue
to lag behind their peers.
In addition to ensuring that the first line firmly owns conduct and
culture risk m anagem ent, banks have also struggled with the
organizational placem ent of the second line conduct oversight
and control responsibility. Many banks have shifted the respon­
sibility for second line oversight across a number of functions in
order to find the right fit. Common organizational placem ents
are Com pliance, HR, Risk (directly under the C hief Risk Officer),
O perational Risk, and Enterprise Risk M anagem ent. Each of
these has its own set of benefits and challenges:
• Com pliance is probably the most natural fit given that it has
the expertise, experience, and discipline for surveillance and
monitoring of em ployee activity. However, some banks are
starting to worry that it may restrict the view too much with a
focus on laws and regulations. Conduct is about what should
or should not be done, rather than on what can or cannot be
done.
• HR has the benefit of being able to integrate conduct man­
agem ent into the broader talent m anagem ent life cycle from
hiring to term ination. Banks with close HR involvement in
conduct initiatives have benefited from the ability to closely
em bed culture and values into various HR processes, includ­
ing perform ance evaluations, incentives structures, and
external recruiting. The downside is that as HR in some banks
plays a first line role in many of those activities, its second
line abilities may be restricted (in fact, in a number of banks,
HR is considered a first line function). Another potential limi­
tation is that in many institutions, HR does not have the same
organizational power as the Risk function, nor does it have
the proximity to the daily business that Com pliance and Risk
have.
• Placing conduct m anagem ent in the Risk function directly
under the C hief Risk O fficer can be effective, especially in
institutions that have experienced significant conduct issues,
as it elevates the im portance of the function and senior man­
agem ent line of sight. However, as an ongoing business-as-
usual structure, this can lead to a siloed approach to conduct
risk m anagem ent.
• O perational risk m anagem ent is a natural fit for many institu­
tions that have defined conduct risk within the operational
risk taxonom y and structure. Given that operational risk
10 "5 Conduct Q uestions" Industry Feedback for 2017 W holesale
Banking Supervision, Financial Conduct Authority, London, April 2018.
11 Per the report, a sam ple of approxim ately 30 firm s.

94 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 covers people, process, and technology risks, conduct risk
can be viewed as an extension of those risk types. The down­
side is that operational risk is such a broad and still evolving
area of risk m anagem ent that conduct risk may get lost in the
fray and not receive the attention it needs.
• More recently, some banks have moved conduct risk man­
agem ent under enterprise risk. This can make sense for sev­
eral reasons: it is closely linked to reputational risk, it requires
a holistic understanding of risks across the enterprise, and it
entails significant reporting effort for the board and senior
m anagem ent. The downside is that the Enterprise Risk Teams
in many banks may be too small and not have the capacity to
undertake oversight of such a pervasive risk type.
Furthering the dilemma on the organizational placem ent of
second line conduct risk oversight is that many institutions do
not yet have full clarity on whether conduct, culture, and ethics
should be managed as one integrated function, or separately.
W hile the industry has not defined one agreed model for sec­
ond line oversight of conduct and culture, there are two guiding
principles that should be observed:
• W hichever function is selected as the responsible second
line, it needs to be clear. W hile all the groups listed above
likely have a role to play in the oversight and governance of
conduct and culture, there needs to be clarity on roles and
responsibilities; that is, which function is taking the lead and
which functions are tasked with contributing input (and the
type of input) need to be explicitly stated. The risk respon­
sibilities, policies, and appetite statem ents also need to be
aligned.
• W hichever team is given second line oversight and gover­
nance responsibility also needs to be given proper power for
conduct initiatives to have teeth.
Banks are also starting to further their thinking in term s of the
third line's role in the m anagem ent of culture and conduct. A
number of banks have explicitly structured culture audit pro­
cesses, and in some cases, institutions have established audit
team s specifically focused on culture auditing.
W hile second line placem ent is im portant for an effective
conduct risk m anagem ent program, most im portant for the
long-term and perm anent success of culture and conduct
efforts is ownership by the frontline business. Progress has
been slow in em bedding ownership of conduct risk in the first
line, often due to a lack of understanding or experience by
the first line m anagem ent and/or the view of culture and con­
duct as a soft HR issue rather than a business im perative. Due
to lack of first line ownership, some banks have seen first line
responsibilities slip to the second line, which in turn rendered
ineffective the second line's role of independent challenge.
This is often due to the lack of clarity of how this risk should
be defined and m anaged. It cannot be overstated that ulti­
mately, ownership and oversight for conduct and culture risk
m anagem ent needs to be owned by the Board, the C E O , and
the heads of the business units. Defining conduct risk, incorpo­
rating it into the risk appetite statem ent, and developing risk
identification and auditing processes are all still very much a
work in progress. For instance, many institutions are still strug­
gling with the classification of conduct risk: is it its own risk type
or a subset of another risk such as operational risk? As with all
other risk types (credit, m arket, and operational and reputa­
tional risks), the m ethodologies and practices will mature over
tim e. Formal risk m anagem ent routines will need to be agreed
and adopted for the effective functioning of the three lines
of defense.
Regulators, Supervisors, Enforcement
Authorities, and Industry Standards
Regulators and supervisors across the globe have increased
attention to and expectations regarding conduct and culture.
Exam ples include:
• UNITED KINGDOM: The FC A has been a driving force, issu­
ing the Fair and Effective M arkets Review in conjunction with
the Bank of England and Her Majesty's Treasury, and im ple­
menting regulations for benchm ark rates, foreign exchange
(FX) remediation programs, and the Senior Managers and
Certification Regime to increase individual accountability and
governance via banks' senior leadership.
• EUROZONE: European regulators have dialed up scrutiny of
conduct issues, for instance, with the E C B /E B A releasing
conduct-related guidelines on governance arrangem ents and
remuneration policies, and the De N ederlandsche Bank
(DN B, the Dutch central bank) conducting exam inations
focusing on topics such as decision making, leadership, and
com munication. Further, the EC B updated its Manual for
A sset Quality Review in June 2018, incorporating the
implications of International Financial Reporting Standard 9
(IFRS 9) and increasing the im portance of bank business
models focused on investm ent services. Also, as part of its
Internal Capital A dequacy Assessm ent Process, DN B has
stated they will devote particular attention to strategic risks
to banks, including the gradual deterioration of a business
model.1
2
12 IFRS 9 was prom ulgated by the International Accounting Standards
Board and addresses accounting for financial instrum ents. It covers the
classification and m easurem ent of financial instrum ents, im pairm ent of
financial assets, and hedge accounting.
Chapter 5 Banking Conduct and Culture ■ 95
• UNITED STATES: There has been increased focus on culture
and conduct from the Federal Reserve Banks, the O ffice of
the Com ptroller of the Currency (O C C ), the Financial Indus­
try Regulatory Authority (FIN RA ), the Securities and
Exchange Com m ission (S EC ), and the Consum er Financial
Protection Bureau (C FP B ). In particular, the W ells Fargo
sales practices scandal led the O C C to launch a m ultiphase
industry-wide review. In his Ju n e 2018 speech, "N ow is the
Tim e for Banking Culture R e fo rm ,"13 Federal Reserve Bank
of New York president and C E O John W illiam s expressed a
sense of urgency in addressing banking culture, and the
"n e e d to ensure that bank m anagem ent and boards are
exertin g stron g and effe ctive lea d ersh ip with ro b u st
g o vern a n ce. That m eans holding m anagem ent and boards
o f d irecto rs to high standards in term s o f culture and
c o n d u ct. "
• CANADA: The Financial Consum er Agency of Canada
(FC A C ) launched a business practices probe, focusing on
bank em ployees' obligation to obtain custom er consent and
provide proper disclosure about fees and costs when selling
new products, and the O ffice of the Superintendent of Finan­
cial Institutions (OSFI) launched a review of dom estic retail
sales practices. The FC A C s related report,141
5released in
March 2018, noted insufficient controls at Canada's largest
banks to mitigate the risk of mis-selling and breaching market
conduct obligations.
• AUSTRALIA: The Banking Executive Accountability Regime
(BEAR) is seeking to improve standards of behavior and
accountability, and the Banking Royal Commission is cur­
rently investigating incidents of m isconduct. The Interim
Report of the Royal Commission is critical of regulators, and
in its final report, due in February 2019, is likely to recom ­
mend that they be accorded additional powers. In May 2018,
the Australian Prudential Regulation Authority (APRA),
released its review of Com m onwealth Bank of Australia's
fram eworks for governance and accountability,
1 CT
noting
"CPA's con tin ued financial su ccess dulled the sen ses o f the
institution, particularly in relation to the m anagem ent o f
13 Now Is the Tim e for Banking Culture Reform : Rem arks given at
G overnance and Culture Reform C onference, Federal Reserve Bank
of New York, by John C . W illiam s, President and C E O of the Federal
Reserve Bank of New York, Ju n e 2018.
14 "D om estic Bank Retail Sales Practices Review ," Financial Consum er
A gency of Canada, O ttaw a, March 20, 2018.
15 "Prudential Inquiry into the Com m onwealth Bank of Australia (CBA)
Final R ep o rt," Australian Prudential Regulation Authority, Sydney, April
2018.
96 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
nonfinancial risks. " As a result, the A P R A applied a $1 billion
Australian dollar add-on to C BA 's minimum capital
requirem ent.
• HONG KONG: The Securities and Futures Commission's
(SFC's) M anager in Charge regime aims to increase account­
ability of senior m anagem ent and managers of key/control
functions, while the Hong Kong Monetary Authority (HKM A)
recently released a fram ework for fostering sound culture at
banks.
• SINGAPORE: The Monetary Authority of Singapore (MAS)
has drafted proposed guidelines on individual accountability
and conduct via banks' senior leadership.
• CHINA: The China Banking Regulatory Commission (CBRC)
has published Conduct M anagem ent Guidelines for banks,
designed to facilitate reporting of im proper conduct in
banks. The process is designed to establish norms for long­
term monitoring and inspection of bank practices. The
People's Bank of China has also underlined the im portance of
conduct and culture for the leadership of major banks via its
support for the G 30 recom m endations.
Financial authorities recognize that culture and conduct supervi­
sion represents a departure from historical, often quantitatively
based prudential supervision, and are grappling with what that
means in term s of the skills and capabilities of their staff and
their traditional approaches, and their own internal culture and
practices. A consensus view has yet to em erge on whether out­
side organizations that have traditionally focused on quantitative
measures of bank health can, without hands-on experience, truly
assess the culture of the banks they supervise and add value to
a culture review.
In our interviews we heard significant differences of opinion in
term s of the role regulatory agencies can play. On the one hand,
culture is so intimate and unique to the strategy and values of a
specific institution, it is hard to imagine any external party being
able to engage productively in an assessm ent of the culture.
On the other hand, numerous scandals and conduct issues have
shown that insiders can miss signals of cultural deterioration,
and m anagem ent could benefit from external, unbiased inquiry.
Some regulators have taken an optim istic view on this and are
experim enting with alternative approaches. For exam ple, DNB
has hired psychologists to observe and analyze culture at banks,
and the Monetary Authority of Singapore is building up Al and
data analytics capabilities.
An im portant differentiation in determ ining the role supervisors
should adopt in this space is the difference between conduct
and culture. Given that conduct risk m anagem ent is based on
observable behaviors, it may lend itself to a clearer supervisory
 BOX 5.6 HOLDIN G M AN AGERS A C C O U N TA B LE
First introduced in 2016 by the UK Financial Conduct Author­
ity, Accountability Regim es already cover or will cover many
major financial centers and financial business models. These
regimes are a direct response to a call to amend professional
standards and the culture of the banking sector following a
perceived lack of personal responsibility for m anagem ent fail­
ings in the financial crisis.
The UK Senior M anagers and Certification Regime (SM CR),
introduced a statutory duty of responsibility for a defined set
of senior individuals in a firm to dem onstrate that they have
taken reasonable steps to prevent prudential and conduct
failures. The regime has been recognized by many as a key
driver of cultural and behavioral changes in senior managers
in banking. The SM CR was originally established for deposit
takers and later extended to include investm ent firms and
insurers and focused clearer articulation of senior roles,
responsibilities, and accountability, as well as individual con­
sequences extending to legal prosecution and sanction in the
event of breaches by the firm.
Accountability Regim es have since em erged in several other
jurisdictions including Hong Kong Manager-in-Charge (M IC),
effective O ctober 2017; the Australian Prudential Regulation
Authority's BEA R (Banking Executive Accountability Regime)
assessm ent. As Box 5.6 shows, in recent years, supervisory
authorities in a number of countries have recognized this and
reinforced managerial responsibility for conduct and conduct
failures with accountability regimes.
C ulture, on the other hand, is intangible and ubiquitous; as
such, it requires deep understanding of the strategy, operating
m odel, and values of the organization. In other w ords, conduct
can be assessed as right or wrong, whereas culture is not
objectively right or wrong, it can only be assessed in term s of
its alignm ent to the strategy and values of the institution.
In some m arkets, discussions on conduct and culture have
moved beyond individual bank efforts to collaboration across
multiple players in the industry, including tools and practices
that are shared more broadly. Exam ples include:
• The Banking Standards Board in the UK conducts an annual
assessm ent across banks on culture and conduct topics, pro­
viding participating banks with useful benchmarking on how
they are doing relative to peers.
• The Fixed Income, Currencies and Commodities Markets
Standards Board has developed actionable standards on
behavior and statem ents of good practice that have been
well received by industry participants.
effective Ju ly 2018; and most recently the M onetary Author­
ity of Singapore's proposed Individual Accountability and
Conduct Regime and guidance from the US Federal Reserve
Bank.
In designing and implementing these regimes, supervisors
need to have a clear view of the intended outcom es of an
Accountability Regim e, and design a regime that adheres
to those outcom es, taking lessons learned from established
regimes such as the F C A SM CR. Special attention should be
paid upfront to consider potential unintended consequences
and design standards and principles that allow for flexible
application where appropriate.
Firms them selves should avoid a pure com pliance-based
"tick-box" approach when responding to Accountability
Regimes and ideally use such regimes as an opportunity to
drive and build on strengthening leadership behaviors and
overall culture in the organization, ensuring that em ployees
have the resources and support to discharge their duties.
Firms that need to respond to regimes in multiple jurisdic­
tions will need to align on approaches, and navigating the
minefield of unintended behavioral consequences will be key
for both firms and supervisors.
• The Financial Stability Board has since 2015 been
coordinating international efforts around a w ork plan to
reduce m isconduct risk, most recently publishing a to o l­
kit for firm s and supervisors to strengthen governance
fram ew orks. The tools focus on m itigating cultural drivers
of m isconduct, strengthening individual responsibility and
accountability, and addressing the "rolling bad ap p les"
phenom enon.
• The Bankers' Oath in the Netherlands is a legally required
ethics statem ent and code of conduct holding bankers to
standards of good behavior. To date, it has been taken by
87,000 Dutch bank em ployees.16
• The Global Banking Education Standards Board recently
announced standards for ethics education and training for
professional bankers, with plans to develop further standards
in both general banker com petency and on the capabilities
required in credit products.
16 "The Banker's O a th ," Tuchtrecht Banken, Am sterdam ; https://www
.tuchtrechtbanken.nl/en/the-bankers-oath.
Chapter 5 Banking Conduct and Culture ■ 97
S E C T IO N 2. L E S S O N S L E A R N E D
As the banking industry reflects on the last decade, and culture
and conduct efforts gain additional maturity, our research has
revealed eight key lessons.
1 Managing culture is not a one-off event, but a
continuous and ongoing effort that needs to be
constantly reinforced and that must becom e a
perm anent way of doing business.
2 Leadership always m atters; conduct and culture must
be em bedded from the top down throughout the firm,
starting with the board and senior m anagem ent but
also importantly including middle m anagem ent.
3 The scope of conduct m anagem ent is shifting from
m isconduct to conduct risk m anagem ent more
broadly.
4 Managing culture requires a multipronged approach
and the simultaneous alignm ent of multiple cultural
levers.
5 Ten years out from the financial crisis, there is strong
recognition that a more diverse set of views and voices
in senior m anagem ent will lead to better (and more
sustainable) outcom es for all stakeholders.
6 W hile cultural norms and beliefs cannot be explicitly
m easured, the behaviors and outcomes that culture
drives can and should be m easured.
7 Regulation has a limited role in rule setting and man­
dating culture.
8 Restoring trust will benefit the industry as a whole; as
such, industry-wide dialogue and best practices shar­
ing are im portant elem ents in the journey toward a
stronger and healthier banking sector.
A discussion of each of these lessons follows.
LESSON 1. Managing culture is not a one-off event, but a
continuous and ongoing effort that needs to be constantly rein­
forced, and it needs to be perm anent (see Box 5.7). Banks need
to not only find ways to keep culture discussions from becom ­
ing stale or repetitive, but also to ensure that culture efforts are
responsive to potential changes in the desired outcom es them ­
selves as the industry evolves (for exam ple, digitization). This
is particularly im portant as changes to conduct and culture are
further em bedded throughout the organization. It is also impor­
tant to rem em ber that culture is not (and should not be) static;
it will evolve as the business evolves, custom er needs change,
and com petitive forces modify. As such, the firm must constantly
and deliberately adapt culture to align to a changing strategy
and business conditions. Constant nudges and reinforcem ent of
expectations are needed in everyday life as training alone is not
enough to shift behavior.
98 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
LESSON 2. Leadership always m atters. Conduct and culture
must be em bedded from the top down throughout the firm,
from the board to senior m anagem ent and through middle man­
agem ent down to the teller, and through all business units and
geographic locations.
First and forem ost, the board needs to be aware of and involved
in defining and guiding the culture. The board's role is to define
purpose of the organization and ensure that all business levers
are aligned with that purpose. Strategy, com m unications, poli­
cies, processes, and practices must all align with the desired
culture, and the board must oversee that alignment.
Senior leaders need to involve middle m anagem ent to further
articulate and reinforce firm values and intended behaviors in
their respective areas of oversight. The day-to-day realities of
frontline staff are most profoundly impacted by their immediate
manager rather than by the C E O or other senior executives. As
such, leadership modeling must flow all the way through the
organization and cannot only be seen at the senior levels. This is
especially difficult for large, multi-geography and multi-business-
unit banks. A direct m anager that does not model the values
of the firm can easily undermine any exam ple or m essage com ­
municated by the C E O ; as such, many banks are shifting away
from focusing mainly on tone from the top, to tone from above.
W hile the tone and direction of the culture message needs to be
consistent across all leaders, it also needs to be flexible enough
to be aligned with the different styles of each leader.
LESSON 3. The scope of conduct management is shifting from
misconduct to conduct risk management more broadly. Conduct
is not just about purposeful misbehavior driven by an employee's
desire for personal gain or to meet performance targets (for exam ­
ple, rogue traders); rather, it should be considered more broadly.
For example, a bank's decisions— in the form of such things as
business targets, product design, and automated processes— can
sometimes have unintended consequences and harm clients, cus­
tomers, and/or colleagues even in the absence of bad intentions.
In many institutions, conduct has been defined to include intent,
negligence, and failure of judgm ent. The definition is also
broadening to cover all stakeholders, having shifted from only
market and custom er im pact to also include harm to colleagues.
In this context, rather than just focusing on how to reduce bad
conduct, it may be useful to consider the mirror image ques­
tion of how to promote good conduct that aligns and furthers
the organization's purpose and values. It is also im portant to
consider the full potential consequences and implications of all
business decisions.
LESSON 4. Managing culture requires a multipronged approach
and the simultaneous alignment of multiple cultural levers. C ul­
ture is not empirically good or bad, but it must be right for the
 BOX 5.7 LESSO N S FROM O TH ER IN DUSTRIES
Banks can learn from other high-risk, asset-intensive indus­
tries that have worked for years to em bed responsibility for
managing behaviors throughout the organization. Exam ples
include the following.
Oil and gas: Com panies have established specific guidance
on behavior (for exam ple, Shell's "Life-Saving Rules") that sets
clear expectations on acceptable vs. unacceptable behavior.
Also, firms use a buddy system to encourage employees,
upon observing non-compliant behavior by peers, to intervene
with each other without the need to escalate the issue up
the management chain. This helps create an environment of
trust and psychological safety where employees look after the
well-being of the firm and of each other. Banks could consider
applying similar approaches to clarify behavioral expectations
and foster a speaking-up culture. A speaking-up culture could
also mean speaking out to a colleague through mentoring and
coaching rather than only via escalation measures.
Medical devices: "Hazard analysis" (also known as risk analy­
sis) is a mandatory step in the design of medical devices, to
consider the possible consequences of inadvertent misuse by
organization based on its values, strategy, and business model.
And the various levers of culture must be aligned with the desired
outcomes. Cultural levers include structural elements such as
policies, organization, processes, and technology, as well as intan­
gibles such as tone from the top, beliefs, and perceptions.
Em bedding culture is not about changing specific cultural levers
in isolation, but about achieving alignm ent throughout, that is,
a clearly stated (and believed) purpose that flows into strategy,
policies, behaviors, governance m odels, processes, perform ance
m easurem ent, and incentive schem es. Tone from the top and
leading by exam ple are necessary for initiatives to have credibil­
ity, but they are not sufficient. Processes and structural elem ents
are also critical for enabling messaging to cascade uniformly
and effectively throughout the organization, especially for larger
banks. Small changes in everyday decisions ultimately add up to
big changes over tim e. Implications of this lesson include:
• Along the lines of "every organization is perfectly designed
to get the results it g ets," a bank's various culture elem ents
are a reflection of its true (which may differ from its stated)
values and priorities. Banks should think carefully about how
each culture elem ent came to be designed/im plem ented/
perceived in its current form , and make necessary adjust­
ments to ensure that it is aligned with the organization's
desired values and priorities.
• Beyond articulating purpose and values, banks need to pro­
vide practical, actionable guidance to help staff make deci­
sions. This means clear communication of expectations, and
the customer, and to mitigate those hazards so that the cus­
tom er is not harmed. Such analyses, applied to banking and
other financial products, could help banks think more rigor­
ously about product features, even those commonly taken for
granted, and build in appropriate safeguards against poten­
tial custom er misuse.
Pharmaceuticals: Healthcare professionals abide by a phi­
losophy of "right patient, right m edication, right tim e"* to
ensure patient safety and reduce errors in drug adm inistra­
tion.** A banking analog (for exam ple, articulated as "right
customer, right product, right need") of this philosophy could
help guide retail sales staff in recommending appropriate
products for custom ers, reduce mis-selling incidents, and ulti­
mately improve custom er satisfaction and outcom es.
* Some versions also specify, for exam ple, right dose, right route,
right reason, right docum entation, and right response.
** W hile considered a useful rule of thum b, this is not a foolproof
guideline; see "Th e Five Rights: A Destination without a M ap," by
M atthew Grissinger, P& T 35 (10) (O ctober): 542, 2010; https:\\w w w
.ncbi.nlm .nih.gov/pm c/articles/ PM C2957754.
concrete, relatable exam ples around behavior in real-life situ­
ations that em ployees may face. W hile values and principles
provide direction, on their own they are often too abstract
to be directly useful in gray-zone situations. This can be best
achieved through tailored trainings across levels and more
open communication from senior leadership.
LESSON 5. Ten years out from the financial crisis, there is strong
recognition that a more diverse set of views and voices in senior
m anagem ent will lead to better (and more sustainable) out­
comes for all stakeholders. Many of the industry leaders inter­
viewed pointed to group-think as a contributing cause of the
behaviors leading to the financial crisis and many of the scandals
that have occurred since.
Diversity in thinking, problem solving, and leadership styles
will help organizations achieve better results through greater
questioning, challenging, creativity, and innovation. Diverse
leadership team s can also help em ployees (especially diverse
em ployees) feel safer in raising concerns and escalating issues.
Many leaders stated that their institutions have recently placed
greater focus and im portance on hiring, retaining, and em pow­
ering diverse em ployees. These leaders recognize that suc­
cessful, innovative, and learning organizations are ones that are
diverse— at all levels of the organization. As one senior industry
leader stated, "everything changes for the b e tte r when you
have critical mass o f wom en in the C-Suite and the B oardroom ."
But results on this front are slow, and achieving truly diverse
team s (especially at the senior levels) will require intentional
Chapter 5 Banking Conduct and Culture ■ 99
and ongoing effort. A 2016 study by O liver Wyman showed that them . W hile measuring culture is a challenging task, it is also
while slight im provem ent is being made in term s of fem ale rep­ a necessity. Leadership's ability to confidently and objectively
resentation in the C-Suite and the board, the numbers are very state that the conduct of individuals across the organization
low and only marginally improving (see Figure 5.5). is in line with their strategy, core principles, and desired goals
requires a set of indicators that can support their statem ents. To
Recent analysis of the financial sector by M ercer shows that
maintain a healthy culture and detect conduct issues before they
women are significantly better represented at the support staff
becom e a significant problem , m anagem ent needs to be able
level than at the senior m anager or executive level. In addition,
to observe and track behavior through meaningful and objec­
the proportion of women decreases at each level as we move
tive m etrics. This is especially true for larger organizations that
up the hierarchy; they are hired at a lower rate than men at all
span numerous geographies and business lines, and can host a
levels except for senior m anager; they are less likely than men to
myriad of subcultures that differ significantly. In addition, banks
be promoted to the next level across all levels of the organiza­
need to measure and report on culture and conduct because
tion; and they exit at higher rates than they are being hired at all
only by measuring them will banks be able to shift their focus
levels, and even more so at m anager level and above. This is a
away from purely quantitative financial metrics (for exam ple,
troubling picture. Global firms in other industries do not display
revenues, volum es, profits) to an understanding of how their
such large skews.
actions and decisions align to their values.
In addition, gender disparity in pay is gaining attention as an
Culture also needs to be measured and monitored because it
issue in the banking industry, as recently highlighted in the UK
is not constant; culture can and should evolve over tim e and be
but holding true globally. W hile some of this disparity can be
influenced by a number of factors including company strategy,
attributed to issues with equal pay for equal work, the fact that
hiring, growth, acquisitions, and external drivers such as evolv­
women hold few er senior, highly paid positions than men is typi­
ing custom er needs or technology advancem ents. W ithout
cally a larger source of disparity. Such im balances can create
effective m easurem ent, leadership cannot determ ine whether
culture issues such as bullying, harassm ent, and other behaviors
this evolution is progressing in a desirable direction.
that can negatively impact clients.
Deriving metrics from company values is a multistep process
One Bank Board Chair interviewed rightly stated: "A s human
that requires organizations to look inward and answer some
beings, we are not w ired to se e k out diversity; the natural o rd er
challenging questions starting with values, identifying stakehold­
is to b e drawn to th ose who are like us. A n d for too many years,
ers and outcom es for each, and then articulating desired behav­
cultural fit has been used in hiring and prom otion decisions as a
iors and translating them into observable metrics. Following this,
p ro xy for 'is ju st like m e."'
banks will need to em bark on a data exploration and analysis
LESSON 6. W hile cultural norms and beliefs cannot be explicitly effort to make sure that the data needed for the desired metrics
m easured, the behaviors and outcom es that culture drives can are available or can be readily collected. Several tools, including
and should be m easured. Banks are at various stages of trial and internal surveys, audits, and custom er assessm ents, are particu­
error to determ ine what the right metrics are and how to use larly useful in gathering data for given metrics.

30

25 I
? 20%
20 18%
? -f— 16%^
15 14% 13% 14%
B o a rd

10 ExC o

In te rq u a rtile ra n g e
(25th to 75th
p e rce n tile )
0
2003 2008 2013 2016
F ia u re 5.5 Percentage of board and Executive Committee (ExCo) members in major
financial services organizations who are women.
Sou rce: O liver W ym an analysis of organization disclosures across 381 financial services organizations in 32 countries
("W om en in Financial Services," O liver W ym an, New York, 2016).

100 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
There is no silver bullet for measuring and reporting conduct
and culture, but several key design principles are critical to
building a culture dashboard that provides useful and actionable
insights, as shown in Figure 5.6.
The more mature banks in term s of culture and conduct report­
ing provide the following lessons learned:
• The report should focus on metrics that are meaningful to
the purpose and values of the firm. Also im portant in metric
selection is having both leading and lagging metrics: the
forward-looking metrics are key to identify what might hap­
pen rather than only reporting on what did happen.
• To be truly valuable, the metrics should be seen over time
and analyzed as a trend rather than a single number or
point in tim e. In addition, the analysis should not just look
at individual metrics in isolation but rather assess how the
data interact. Metrics from across strategy, governance, HR,
service, operations, product, sales, and clients should come
together to form the full narrative on culture and conduct.
• The details are critical, and the board and senior m anage­
ment should focus on the anom alies, exceptions, and the tail,
given that in the summary view, the issues can be buried and
lead to a false sense of com placency.
• The report should include com m entary and explanation of
the data, and the reporting operating model should also
include the ability to do further analysis and investigation
where needed. With culture and conduct reporting, the
O Has direct link to firm values 0 Displays trends over time
and risk appetite framework
Value Metric
Company R e v e n u e a n d c o s t a g a in s t ta rg e t
landscape E f fic ie n c y ratio
In v o lu n ta ry tu rn o v e r, b y ty p e (e .g . S a le s
Our People
P r a c t ic e s , F ra u d , e t c .)
S a le s tra in in g c o m p le tio n r a t e s , b y ty p e
Customers C u s t o m e r c o m p la in t s b y ty p e
# o r % o f p r o d u c t s o n ly a p p ro p ria te fo r a
s m a ll s u b s e t o f c u s t o m e r s
Risk Control # o f p r o d u c t s w ith p e rio d ic re v ie w o v e rd u e
% o p e n is s u e s ra is e d b y a u d it
O v e rd u e c u s t o m e r a p p r o p r ia t e n e s s r e v ie w s
N u m b e r o f c o m p lia n c e b r e a c h e s
Q Includes granular O U ses both leading
data and targets and lagging indicators
Conduct metrics
Fig u re 5 .6 Design principles for conduct and culture measurement.
metrics do not identify issues per se; rather, they identify
where to look for potential issues. The metrics don't tell you
what went wrong, they just tell you where to look. In that
same vein, as banks refine their approach to selecting and
calibrating metrics, they often struggle with many false posi­
tives. Getting the right metrics and inferring the right insights
will take time and should be piloted/tested over a period of
tim e.
• The reporting should focus on conduct rather than nar­
rowly on m isconduct. When banks start down the culture
and conduct m easurem ent path, many focus their efforts
on m isconduct— intentional actions that are clear breaches
of policies. However, culture and conduct reporting should
also include outcom es driven by unintentional behaviors and
unintended consequences, such as flawed product design
that does not m eet custom er needs. Furtherm ore, to provide
a truly com prehensive and balanced view of com pany culture
and conduct, the scope of m easurem ent should cover p o si­
tive conduct and associated indicators such as em ployee
volunteer hours, em ployee satisfaction survey results, sustain­
ability efforts, and social im pact investm ents.
• The reporting tool should be flexible and provide multiple
views, levels of granularity, geographic focus, and types of
metrics needed to meet the needs of multiple audiences (for
example, the board, senior management, business heads, and
various second line functions). A number of institutions are start­
ing to develop dynamic web-based reporting views (Figure 5.7).
© Provides granular results
for each indicator a cro ss lines of business
Leading
vs. lagging
L e a d in g
L e a d in g
L e a d in g
L e a d in g
L a g g in g
L a g g in g
L e a d in g
L a g g in g
L a g g in g
L a g g in g
1
Q Provides value-adding
commentary
Dashboard
Chapter 5 Banking Conduct and Culture ■ 101
 Conduct risk dashboard Settings Log Out

Board View Detailed View

Filte rs Region All ▼ Office All ▼ Period 2018 Q1 ▼

Metrics summary Insights am

S ta k e h o ld e r c a te g o ry O v e ra ll s ta tu s C o m m e n ts Feb 12, 2018

Employee turnover
Status: Open
C u s to m e rs a n d
c lie n ts • Spike in LO B 1 employee turnover over the
past two quarters.

Feb 12, 2018

E m p lo y e e s Spike in LOB 1 employee
turnover
Feb 2, 2018
Employee Hotline Volume
C o m m u n itie s Status: Resolved
• 10% increase in Employee Hotline volume
across the enterprise during 2017 Q4
• The increase w as determined to be the result
S h a r e h o ld e r s
of an employee hotline aw areness campaign

S u p e r v is o r s ,
r e g u la to r s , a n d Feb 2, 2018

g o v e rn m e n ts
Customer Complaints
Status: Resolved

Conduct risk dashboard Settings Log Out

Board View Detailed View

F ilte rs Region All Office All Period 2018 Q1

Teammates: Metric overview Insights All

Metric
Overall
status
LOB 1 LOB2 LOB3 Employee turnover F
Em ployee hotline volume and whistleblower case s
Status: Open ▼

Number of misconduct incidents (overall) Spike in US employee turnover over the

Number of em ployees with a misconduct incident in the past 12
past two quarters. The change is currently
under investigation.
—
months

Rate of employee turnover

• The trend is isolated to LOB1 at London
office 1. LO B 2 in the sam e office also
Employees: Trends has a spike, but not a s large.
- Jane Smith, Feb 12, 2018
• Reached out to the LO B 1 HR team in
Employee hotline volume Whistleblower cases that office; waiting for their perspective
Volume pegged to historical average Includes both substantiated and before escalating
unsubstantiated cases - Jane Smith, Feb 14, 2018

Add an update
U
l

Employee Hotline Volume

10 Status: Resolved ▼
• 10% increase in Employee Hotline
volume across the enterprise during
2017 Q4

Fiq u re 5 .7 Sample conduct and culture dashboards: Board view and detailed view.
S o u r c e : O li v e r W y m a n .

L E S S O N 7 . Regul ation has a limited role to play given that response, undermining the clarity of the m essage that culture is
culture cannot be mandated or defined by rules; that is, good a m atter for banks' boards and executives, creating a mindset
culture cannot be regulated into existence. A number of indus­ of outsourcing good judgm ent, and forcing disengagem ent
try leaders raised concerns related to the potential downsides of from activities that may expose banks to future financial pen­
overly prescriptive regulation, such as encouraging a box-ticking alty. Having said that, regulatory agencies are responsible for

102 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BO X 5.8 SKILLS AND CA PA BILITIES R EQ U IR ED O F REGULATO RS
To effectively assess banks and assist them in effecting last­
ing conduct and culture changes, supervisors them selves
will need to evolve in order to be properly equipped with
the right skills and capabilities. As one senior industry leader
stated, "a supervisor w ould not undertake the review o f a
financial m odel w ithout financial m odeling e xp e rtise ; how
can they en g a g e in dialogue and review o f culture w ithout
the skills in behavioral d rive rs?"
Supervisory team s should be com posed of experienced
individuals who understand banks' business models and strat­
egy, and can engage in judgm ent-based, forward-looking
discussions with boards and senior executives about con­
duct m atters. These team s must be adept at leveraging new
types of assessm ent m ethodologies and be able to identify
potential issues and behavioral outliers in a constructive and
safeguarding the safety and soundness of the financial services
industry. As such, these agencies cannot be excluded from the
dialogue and monitoring.
The industry continues to explore effective approaches to regu­
lation and supervision; while there is not yet a consensus view,
agreem ent is beginning to em erge in some areas, including:
• REGULATION: Reg ulation can be an effective tool to focus
banks' attention on specific and tangible areas of persis­
tent conduct failures (for exam ple, conflicts of interest, risk
incentives, and custom er protection), in such cases clearly
outlining basic principles while leaving room for banks to
own and drive the specifics of im plem entation. The approach
of principles-based regulation has recently proven effective
in two areas: increasing accountability of senior leadership
(FCA 's Senior M anagers and Certification Regim e [SM&CR])
and aligning remuneration policies to drive better conduct
(FC A /E B A guidance on remuneration). Regulatory bodies can
also outline requirem ents in term s of claw-back practices,
including defining the appropriate tim e period for deferrals
and clawbacks, which may be too short in some cases today.
The various senior accountability regimes seen in some juris­
dictions are one way regulation has impacted bank culture.
W hile the specifics differ, increasingly supervisors are incor­
porating individual accountability for breaches of conduct
in the mandate of their senior m anagem ent regimes. These
are leading to changes in the roles and responsibilities of
senior leaders and directors, and are also affecting how
banks recruit, appoint, train, and com pensate their most
senior leaders. It is of course also having a direct im pact on
the mindset and actions of these individuals and on how they
well-intentioned manner. Further, supervision of conduct and
culture will involve greater resources and time com mitment
relative to traditional supervisory activities, requiring ongoing
dedication, careful planning, and a deeper understanding of
each bank's business model and strategy.
O ver tim e, some supervisors may find them selves needing
to reassess their internal governance structure, operating
model, and rules of engagem ent. It goes without saying that
there should be no conduct issues among those tasked with
evaluating conduct. Finally, supervisors should consider lever­
aging additional expertise from external experts (for exam ­
ple, behavioral scientists, governance experts) to bolster the
quality of assessm ents and strengthen supervisors' knowl­
edge and capabilities going forward.
carry out their responsibilities on a daily basis (that is, they
are more involved in and aware of the activities and decisions
being carried out in their organizations). See Box 5.8 for a
discussion of the skills and capabilities required of regulators.
• SUPERVISION: Supervision has an im portant role in engag­
ing in a dialogue with the industry and holding up a mirror
to the institution. Supervisors can ask questions of the board
and m anagem ent to ensure an appropriate focus on culture
and conduct topics, and can also share industry best prac­
tices and learnings. It is im portant that supervisors share
culture insights that they have gleaned from their work across
multiple institutions and in their dialogue with regulatory
bodies from around the world.
Supervisors can also help in anticipating future sources of
potential m isconduct given their broader industry-wide view.
Trust, transparency, and open dialogue between banks and
supervisors will be critical to allow for this, and to enable
early intervention to prevent serious issues before they
m aterialize.
• SYSTEMIC ISSUES: System ic issues such as the "rolling bad
apples" problem cannot be addressed by individual bank
efforts and require collective response across the industry
and regulatory/supervisory b o d ies.17
L E S S O N 8. Restoring trust will benefit the industry as a whole;
as such, industry-wide dialogue and best practices sharing are
im portant elem ents in the journey toward a stronger and health­
ier banking sector. The banking industry in major markets should
17 Although this must be done within the constraints of local legislation
and em ployee protection laws.
Chapter 5 Banking Conduct and Culture ■ 103
 BOX 5.9 TRAIN IN G FOR LASTING BEH A VIO RA L C H A N G E
Many banks struggle to change their culture because they fail
to address the issue of behavioral change. Training for behav­
ioral change is not a linear process, but an iterative process,
with potential loopbacks to allow adjustm ents and learning.
People change their behavior gradually and on an individual
basis, as behavior is em bodied in the person. That is, in the
moment of action, an em ployee doesn't always think about
his or her behavior, but rather simply behaves according
to subconscious patterns. Changing these behaviors is not
possible in a one-off training or coaching session, but rather
requires repeated rewiring of new patterns and suppressing
old ones over a series of reinforcing experiences, often an
awkward and difficult process, until the new patterns move
out of the conscious mind into the subconscious and becom e
behaviors.
Neuroscience research suggests that driving behavioral
change relies on cycles that ensure new behaviors stick,
starting with a diagnostic to develop a plan of action, then
engineering a shock to raise awareness of target behaviors
seriously consider mechanisms of collaboration (for exam ple,
through industry standards organizations) to develop cross­
industry com parisons regarding their progress on culture and
conduct. Even though culture is unique to each institution, col­
laboration and com parisons can benefit the industry by provid­
ing banks with a view, considered by some to be more honest
than that collected in-house, into their own culture relative to
those of peers. Further, such benchmarking results can provide
banks with an objective basis for introspection and construc­
tive challenge, guarding against overconfidence in their own
approaches.
The Banking Standards Board (BSB) in the UK provides a good
exam ple of this industry-wide collaboration. Established in 2015,
the BSB is a private, nonregulatory, m em bership-based orga­
nization open to any bank in the UK. The BSB has provided UK
banks with an open forum to share and aggregate best practices
on conduct and culture. One of the cornerstone pieces of work
achieved and published annually is the BSB Annual Review,
which assess current and year- over-year changes in behavior,
com petence, and culture in UK banking, and identifies key best
practices from m em ber banks. Though only its second report,
the 2017 Annual Review received over 36,000 responses of
input across 25 UK banks, which highlights the keen interest
and active participation on the part of UK banks in critically
104 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and actions, followed by nudges (ideally every eight or so
days), seeking to affect the subconsciousness associated with
the change, and finally closing out to reinforce behavioral
change.
W hile there is no one-size-fits-all process of behavioral
change, there are typically five stages: awareness (becoming
aware of the new behaviors and need to change), nudging
(starting to experience the impact of the new behaviors),
reinforcing (frequent repetition of new behavior delivers
consistent feedback), sustaining (reinforcing structures help
em bed the change), and, finally, impact (positive results
appear on both a business and personal level).
A well-designed training program com prises not just the
initial training sessions, but also interventions in subsequent
months that help reinforce the behavioral intent. Banks
should look for ways to incorporate such interventions in
order to fully reap the benefits of the investm ent they make
in their training programs.
evaluating their own firm's practices and collaborating with and
supporting other banks in identifying changes in conduct and
culture.
The Fixed Income, Currencies and Com m odities M arket Stan­
dards Board also provides good exam ples of behavioral patterns
evident in m isconduct in its Ju ly 2018, Behavioural C luster Anal-
A Q
ys/s study. 0 The publication provides a practical toolkit to iden­
tify the root causes and relevant behaviors that underlie market
m isconduct. The study has identified 25 patterns, which can be
categorized into seven categories of behavior: Price M anipula­
tion, Circular Trading, Collusion & Information Sharing, Inside
Information, Reference Price Influence, Im proper O rder Han­
dling, and Misleading Custom ers. The study finds that there are
a limited number of patterns that repeat them selves, are juris-
dictionally and geographically neutral, occur across different
asset classes, and adapt to new technologies and market struc­
tures. This study also dem onstrates that conduct issues are a
long-standing and constant struggle that m anagem ent must vig ­
ilantly monitor and m itigate. (See Box 5.9).
18 "Behavioural Cluster Analysis, M isconduct Patterns in Financial Mar­
kets," Fixed Income, Currencies and Com m odities M arkets Standards
Board, London, Ju ly 2018.
Risk Culture
A fter com pleting this reading you should be able to:

Com pare risk culture and corporate culture and explain
how they interact.
Explain factors that influence a firm's corporate culture
and its risk culture.
Describe methods by which corporate culture and risk
culture can be m easured.
• Describe characteristics of a strong risk culture and
challenges to the implementation of an effective risk
culture.
Assess the relationship between risk culture and business
perform ance.

Excerp t is Chapter 2 from Risk Culture in Banking, b y A lessandro Carretta, Franco Fiordelisi and Paola Schwizer.
6.1 IN T R O D U C T IO N
Studies on corporate culture have been carried out for a long
tim e. Corporate culture has been a popular m anagem ent tool
since the early 1980s and, more recently, an intense activity
of research on this subject (arisen from the failure of tradi­
tional cultural models) turned cultural explanations into a more
valuable asset than a simple m atter of "claim ing the residuals"
(Zingales 2015).
In the last decades, the m arket saw a clear evolution of the
role of banks, passed from public institutions to profit-driven
private entities. A new com petitive environm ent, in term s
of actors, rules, geography, and products, produced an
evolution of corporate culture in banking. In this fram ew ork,
risk culture can be seen as a subculture with a central role
in financial institutions. This C hap ter provides an introduc­
tion to the concept of risk culture, focusing on its definition,
im portance, and effects on bank com petition and financial
stability. It includes an in-depth analysis of the relevant litera­
ture and of good/bad practices. This C hap ter is structured as
follow s:
• Definition and m easurem ent of corporate culture and its
impact on corporate behaviors;
• Presentation of the scope and alternative definitions of Risk
culture;
• Analysis of drivers and effects of risk culture on sound and
prudent m anagem ent of financial institutions;
• Discussion on main challenges in deploying an effective risk
culture.
6.2 W H AT C O R P O R A T E C U LT U R E
IS A N D W H Y IT M A T T ER S ?
Literally speaking, there are many thousands of definitions of
corporate culture, all sounding subtly different. Literature often
refers to corporate culture as the missing link to fully under­
stand how organizations act (Kennedy and Deal 1982). Culture
is the result of shared values, basic, underlying assum ptions and
business experiences, behavior and beliefs, as well as strategic
decisions. Culture is much more than a m anagem ent style: it
is a set of experiences, beliefs and behavioral patterns. It is
created, discovered or developed when a group of individuals
learn to deal with problem s of adaptation to the outside world
and internal integration. Individuals develop a system of basic
assum ptions proven to be valid by past experience. M em bers
of the same group assim ilate these assum ptions, which becom e
106 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the organization's specific way to perceive, think, and feel in
relation to problem s (Schein 2010). Organizational culture deals
with different approaches. One takes into account external out­
puts: environm ental, architectural, technological, office layout,
dress code, behavioral standards (visible and audible aspects),
official docum ents (statutes, regulations, and internal com m u­
nication), and sym bols. Such an analysis is the necessary basis
for investigating principles, know ledge, and experiences that
guide attitudes and behavior. These aspects reflect the internal­
ized core values of the organization and justify the behavior of
individuals. In fact, basic assum ptions which underlie actions are
often hidden or even unconscious: beliefs determ ine the way
in which group m em bers perceive, think, feel, and therefore,
act but are difficult to observe from an outside perspective
(Carretta 2001).
Culture is more com plex than other organizational variables: it
can be extrem ely effective and at the same tim e resistant to the
need for change dictated by the environment (Fahlenbrach et al.
2012). Culture is, in fact, "w hat you do and how you do it when
you are not thinking about it". If well governed over tim e, it can
be the glue that holds together a company.
Culture has always been considered a key tool affecting cor­
porate behavior, but authors do not agree on how this occurs.
Some consider culture as a fixed effect on firm perform ance,
while others argue that it is a variable that can be managed over
tim e. Viewing culture as a variable is a quite recent fact, and
several institutions have developed proper m anagem ent tools
and fram eworks to measure and manage it.
The discussion is still going on, but, in principle, a culture suitable
for being applied to a business formula makes a significant con­
tribution to business performance. A suitable culture implies that
people "m ake use" of the same assumptions and adopt behavior
inspired by the company's values; this increases the market value
of the company identity. In business, the importance of main­
taining behavior consistent with corporate culture needs to be
constantly stressed, especially by "lead ers", at all levels of the
organization. The management should always remind the staff of
the underlying cultural contents and their positive impact on indi­
vidual and organization performance, by setting good exam ple
and communication. According to economic literature, culture
is a mechanism in such a way that makes the corporation more
efficient through simplified communication and decision-taking
process. From this perspective, a strong culture has high fixed
costs but reduces its marginal costs (Stulz 2014).
The fact that culture can be structured as artifacts, values, and
assum ptions im plies different levels of analysis and assess­
ment. The purpose of analysis requires a specific level of
assessm ent and the most appropriate m ethodology. However,
researchers should keep in mind that the study of only the vis­
ible m anifestations of culture is likely to describe "how " but
not "w hy" (Carretta 2001). And as noted by Karolyi, there is a
fragility in the measures of the cultural values available to us
(Karolyi 2015).
A number of survey methods and metrics are used, among
others, by firms to investigate the mind-sets underlying culture
(See Box 6.1).
In academ ic literature, there are some relatively well-established
approaches to measuring culture. Q ualitative methods are the
BO X 6.1 M EASURIN G CULTURE AND
CULTURAL PR O G R ESS: RA N G E OF
A P P R O A C H ES USED BY FIRMS
Employee engagement and culture survey
Most firms use annual em ployee engagem ent surveys,
supplem ented by culture and climate surveys or modules
added to the regular engagem ent survey
Customer perceptions and outcomes
According to some firms, the real test of culture consists
in the outcom es it generates. The focus is particularly on
custom er satisfaction scores, while other firms even try to
test outcom es (e.g ., mystery shopping or regular online
panels of customers)
Indicator dashboard
Several firms use a range of indicators, som etim es consoli­
dated into "culture dashboards", including:
• Custom ers: satisfaction scores, complaints
• Em ployees: engagem ent scores, speaking up scores,
turnover, absence rates, grievances, use of w histleblow­
ing lines
• Conduct and risk: conduct breaches, clawbacks, m ate­
rial events, and escalations
Validation
Firms use a range of methods to validate progress or per­
form ance and confirm understanding:
• Consultancy firms' benchmarking exercises
• O ther external benchm arks
• Internal Audit assessm ents
• Triangulation across various data sources, e.g . staff and
custom er surveys
Sou rce: A dapted from Banking Standards Board (2016).
ethnographic analysis and the case study, which allow an in-
depth investigation, but at the same tim e limit the com parability
of results. According to Schneider (2000), direct observation is
the only way to understand culture, since many of its aspects are
silent. In addition, people within an organization are not aware
of how many assumptions affect their behavior and take for
granted that it applies to everyone in the sector. Furtherm ore,
cognitive beliefs of researchers may influence their evaluation
capacity. As a consequence, a problem of objectivity prevents
the possibility for other researchers to replicate the analysis and
confirm its results.
On the other hand, quantitative methods use standardized
approaches of analysis through statistical tools. These methods
do not provide in-depth observations but are more objective
and allow the comparison of different situations.
The goal should be to create a homogenous method within
organizations or groups of interm ediaries, capable of reflecting
the needs of com panies and of the environm ent. This would
result in a com parable approach com pliant with the regulatory
environment. Q uantitative methods have been primarily used
to evaluate culture indirectly, by observing developm ents in risk
governance and the link between risk governance and the com ­
pany's risk- return com binations (Ellul and Yerramilli 2013; Lingel
and Sheedy 2012; A ebi et al. 2012).
A new and dynamic environm ent, in term s of actors, rules, geog­
raphy, and products has produced an evolution of corporate
culture in the banking sector. In the last century the market saw
a clear evolution of the role of banks, passed from public institu­
tions to profit-driven private entities. For some countries, this
shift was very difficult and driven by an incisive, market-oriented
intervention by regulators, especially in Europe, where the final
goal was the creation of a common market. Prudent regulation
has increased the range of banking services offered and, indi­
rectly, com petition. In order to prevent excessive risk-taking, the
Basel Com m ittee has promoted the " self-regulation" of inter­
m ediaries, setting up a system of internal controls and a new
com pliance function. The new culture of supervisors is based
on the collaboration with banks and this relationship may have
positive effects in term s of bank perform ances (Carretta et al.
2015). The financial behavior of fam ilies and firms, traditionally
the main banking clients, has also undergone rapid changes.
Family propensity to save has decreased. Families today tend to
invest more in financial instruments inside or outside their home
countries, while firms are adopting new forms of financing, by
acting directly on the capital markets.
These underlying shifts dem onstrate the im portance of study­
ing the effect of corporate culture on banks' perform ance and
Chapter 6 Risk Culture ■ 107
com petitiveness. The literature on banking culture focuses on
the existence of a specific culture and on how it reacts to the
new paradigm s, showing that culture creates value in firms, and
especially in banks. In an ever-changing market, credit supply
and screening remain the most im portant activities undertaken
by banks and represent a basic know-how. This comes from
experience and the «mutual com mitment based on trust and
respect» (Boot 2000), which are the expression of a specific
bank's culture.
In some cases, culture in the financial institutions has dem on­
strated the ability to integrate com panies' know-how and new
market opportunities. For exam ple, the entry of banks into the
insurance business was difficult, due to limited experience with
sophisticated products. On the other hand, insurers had limited
experience with bank retail client requirements. The problem
was solved through successful strategic alliances in which banks
used their distribution capacity and insurers developed simpler
products. Culture has also driven the creation of new approaches
to answer increasing com petition. A "culture of distribution" has
replaced the pre-existing "culture of production". Due to this
change, m anagem ent has shifted the focus from an efficient ser­
vice developm ent towards an effective selling system. This new
perspective is centered on creating unique and personalized
conditions to attract the highest possible number of clients.
In the new context, culture is a resource rather than a limitation.
If adequately taken into consideration, it can ensure the suc­
cess of com plicated events such as m ergers and acquisitions.
The "one size fits all" solution is not valid anymore, and despite
cultural integration is never easy, effective m anagem ent is the
only chance to make it successful (Carretta et al. 2007). Part of
the literature considers culture as a static elem ent to be devel­
oped only in the long-term, but many authors and practitioners
highlight that culture may be used in order to improve firm
perform ance and stability. Nowadays, it is particularly difficult to
develop and im plem ent a strategy due to the intrinsic variability
of the m arket, with controls becoming increasingly com plicated
due to a w ider range of bank activities and functions. In this con­
text, culture can create shared values to drive individual behav­
ior in pursuing the organizational strategy and assisting the role
of internal controls.
To conclude, a specific corporate culture exists in the bank­
ing sector and literature shows that, in specific contexts, it
can change and help bank stability. Em pirical studies confirm
it (Carretta 2001): positive relations with the environm ent are
linked with an open culture. Banks have overcom e their previous
specialization, developing various new internal com petences:
integration, team work, and interpersonal relations are the base
for a new model of leadership. However, the results also show
that this new culture is not yet widespread.
108 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
6.3 R ISK C U LT U R E : S C O P E
A N D D E F IN IT IO N
The O xford Dictionary defines risk as a situation that involves
exposure to danger. Particularly dangerous exposure is called
bad risk. But banks, as well as any other firm, have the same
opportunities to take risks of an ex ante reward on a stand­
alone basis. This risk is being called "a good risk". One might
be tem pted to conclude that good risk m anagem ent reduces
the exposure to danger. However, this view of risk m anage­
ment ignores the fact that banks cannot succeed without taking
risks that are ex ante profitable. Consequently, taking actions
that reduce risk can be costly for shareholders when lower risk
means avoiding higher risk valuable investments and activities.
Therefore, from the perspective of shareholders, valuable risk
m anagem ent does not reduce risk in general, since reducing risk
would mean not taking on valuable projects. If good risk man­
agem ent does not mean low risk, then what does it mean? How
is it im plem ented? W hat are its limitations? W hat can be done
to make it more effective? (Stulz 2014). These questions can be
answered by looking at the concept of risk culture.
Some authors define risk culture (RC) as an element of corporate
culture; it is what in the culture relates to risk (Power et al. 2013).
It is a product of organizational learning concerning what has or
has not worked in past investments and procedures of a financial
institution (Roeschman 2014). RC could be seen as a subculture
with a central role in financial institutions. In fact, the culture of an
organization is neither unique, nor uniform throughout the com­
pany (Schein 2010). The growing complexity of operations, roles,
and activities performed by firms produces different subcultures at
all levels of the organization; for example, the point of view on the
environment taken by the risk management department can sub­
stantially differ from that taken by the business line. In this case,
RC interacts with dominant corporate culture and subcultures to
ensure a continuous balance between the need for integration
and the opportunity for differentiation of these two perspectives.
This balance is the basis for the adaptation to the environment
and for business changes. Box 6.2 presents a selection of the
existing definitions for RC in financial institutions; the main ones
are by FSB, Institute of International Finance (IIF) and Institute of
Risk Management (IRM). These institutions use concepts that are
widely used in literature to define corporate culture, such as val­
ues, norms, ethics, and traditions. The FSB and IIF definitions are
very similar; in fact, both define RC as norms and behavior related
to how individuals identify, understand, discuss (risk awareness ),
and act (risk-taking and management) concerning the risks. The
IRM definition, on the other hand, refers to values and beliefs, and
is in line with previous literature, which asserts that basic assum p­
tions (beliefs) are at the heart of culture (Schein 1990).

BO X 6.2 RISK CULTURE
D EFIN ITIO N S
Risk culture can be defined as the norms and traditions
of the behavior of individuals and of groups within an
organization that determ ine the way in which they identify,
understand, discuss, and act on the risks the organization
confronts and the risks it takes (Institute o f International
Finance 2009).
«A bank's norms, attitudes, and behavior related to risk
awareness, risk-taking and risk management and controls
that shape decisions on risks. Risk culture influences the
decisions of management and employees during the day-
to-day activities and has an impact on the risks they assume»
(Financial Stability Board 2014; Basel Com m ittee 2015).
«Risk Culture is a term describing the values, beliefs,
knowledge, and understanding about risk shared by a
group of people with a common purpose, in particular, the
em ployees of an organization or of team s or groups within
an organization)) (Institute o f Risk M anagem ent 2012).
«Barclays risk culture is the set of objectives and practices,
shared across the organization, that drive and govern risk
m anagem ent (Barclays P LQ .
Num ber of levers are used to reinforce the risk culture,
including tone from the top, governance and role
definition, capability developm ent, perform ance
m anagem ent and reward)) (Lloyds Banking Group).
«Risk culture is characterized by a holistic and integrated
view of risk, perform ance, and reward, and through full
com pliance with our standards and principles)) (UBS).
«lt can be defined as the system of values and behavior
present throughout an organization that shapes risk deci­
sions. Risk culture influences the decisions of m anagem ent
and em ployees, even if they are not consciously weighing
risks and benefits)). (Farrel and Hoon 2009)
«The behavioral norms of a company's personnel with
regard to the risks presented by strategy execution and
business operations. In other words, it is a key elem ent
of a company's enterprise risk m anagem ent fram ework,
albeit one that exists more in practice than in codification))
(Smith-Bingham 2015).
«Risk culture encom passes the general awareness,
attitudes, and behavior of an organization's em ployees
toward risk and how risk is managed within the
organization. Risk culture is a key indicator of how widely
an organization's risk m anagem ent policies and practices
have been adopted)) (D eloitte Australia 2012).
Concluding, RC is com posed of underlying assumptions and the
way they turn into norms, values, and artifacts. Not all assum p­
tions are relevant, but only those about risk or, more precisely,
those that affect «the way in which they identify, understand,
discuss, and act on the risks» (IRM 2012). So, RC is related to
«risk awareness, risk-taking and risk m anagem ent, and controls
that shape decisions on risks», which act at all levels of the insti­
tution «during the day-to-day activities and have an impact on
the risks they assume)) (FSB 2014).
6 .4 R ISK C U LT U R E : D R IV ER S
AND EFFECTS
First of all, RC depends on national culture and environment.
As far as culture is concerned, some countries are more homo­
geneous than others, even though som etim es, areas having
a similar culture are part of different nations. Despite these
limitations, comparing national cultures is still a meaningful and
revealing venture and has becom e part of the main social sci­
ences. Research by Hofstede has shown that national cultures
differ particularly at the level of habitual, unconscious values
held by the majority of a population. According to Hofstede, the
dimensions of national cultures are rooted in our unconscious
values. Provided that these values are acquired in childhood,
national cultures are rem arkably stable over tim e; changing
national values is a m atter of generations. Instead, practices
change in response to the changing circum stances: symbols,
heroes, and rituals change, but underlying values are largely
untouched. For this reason, differences between countries have
such a rem arkable historical continuity.
Similarly, culture is very much a product of the environment
(Lo 2015). The International M onetary Fund has published
empirical evidence covering about 50,000 firms in 400 sectors
in 51 countries, according to which firms operating in countries
characterized by lower aversion to uncertainty, greater indi­
vidualism and sectors with a strong opacity of information such
as the financial world have a more aggressive risk culture, and
"even in a highly-globalized world with sophisticated m anagers,
culture m atters" (Li et al. 2013). Furtherm ore, these aspects will
be discussed in the following subsections: the im pact of regula­
tion and its underlying culture (Carretta et al. 2015), as well as
supervision pervasiveness of a company's risk culture (Power
et al. 2013). In the financial system , supervisors and supervised
parties can collaborate in order to improve the culture of risk,
fully aware that it is a sensitive area requiring tim e and resources
(Senior Supervisors Group 2009; Group of Thirty 2008).
Culture directly impacts on corporate risk-taking not merely
through indirect channels such as the legal and regulatory
fram eworks (Mihet 2012).
Risk culture also impacts on characteristics and behavior of a
firm and at the same tim e is an expression of them . O ver time
(Fahlenbrach et al. 2012), it can regulate the possibility for
Chapter 6 Risk Culture ■ 109
 BOX 6.3 THE M A CQ U A RIE U N IV ER SITY RISK CULTURE SC A LE
The M acquarie University Risk Culture Scale was used to
assess the culture in 113 business units across three large
banks, two headquartered in Australia and one in North
Am erica.
The main findings were as follows:
• Strong risk culture was generally associated with more
desirable risk- related behavior (e.g ., speaking up) and less
undesirable behavior (e.g ., manipulating controls).
• Personal characteristics were also important. Long-tenured
and less risk tolerant em ployees, and em ployees with a
positive attitude towards risk m anagem ent were more
likely to display desirable risk-related behavior. Those with
high personal risk tolerance were more likely to display
undesirable risk-related behavior.
• Good risk structures (policies, controls, IT systems, training,
and remuneration systems) appeared to support a strong
culture and ultimately a less undesirable risk behavior.
Good risk structures did not by them selves guarantee good
behavior. Early results suggested that structures such as
remuneration were interpreted through the lens of culture.
• Senior staff tended to have a significantly more favorable
perception of culture than junior staff. This highlighted
businesses to adapt to the changing environm ent, but it may
also change if it is no longer able to solve an organization's
problems (Richter 2014). Therefore, it will only affect the role
of risk m anagem ent in the organization; even in case of highly
sophisticated and form alized risk governance, risk culture is still
in charge of deciding which rules and behavior are important
(Roeschmann 2014; Stulz 2014). As a mechanism of control over
behavior, risk culture can impact on results, and if it is strong
and in a stable environm ent, it can becom e more persistent over
time (Sorensen 2014).
The organization is perhaps the "elem entary unit" for the analy­
sis of culture (Carretta 2001) and risk culture, but the individual
is the unit in term s of personal integrity and propensity towards
risk. High levels of perceived integrity are positively correlated
with good incomes, in term s of higher productivity, profitability,
better industrial relations, and a higher level of attractiveness
to prospective job applicants (Guiso et al. 2015), but individual
behavior appears to be influenced by both context and profes­
sional identity which, once more, confirm the key im portance of
the organization (Villeval 2014).
Obviously, risk culture can appear in different forms as sub­
cultures, or even conflicting countercultures, in the following
areas: type of risk (i.e., credit or market), business functions and
families in which it develops, prevailing business m odels, roles in
110 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the im portance of anonymous and independent risk cul­
ture assessm ents where staff felt safe to reveal their true
beliefs.
• There were statistically significant differences between the
risk cultures of the three large banks analyzed.
• The majority of business units assessed (more than 95%
of 113) had an internally consistent perception of culture,
namely, there was a strong or obvious culture in the unit
(i.e., not just the perception of an individual but a qual­
ity of the group). However, it should be noted that there
might have been agreem ent on the fact that culture was
good or poor.
• The most significant variation in risk culture scores
occurred at the business unit level and seem ed to be
driven by the local team environm ent. This was consis­
tent with the hypothesis that culture was a local construct
highly dependent on interactions with close colleagues
and im m ediate managers.
Sou rce: A dapted from Elizabeth Sheedy and Barbara Griffin, Em piri­
cal Analysis of Risk Culture in Financial Institutions: Interim Report,
M acquarie University, N ovem ber (2014).
bank's overall corporate governance (i.e. shareholders, board of
directors, m anagem ent, and auditors).
Subcultures may exist depending on the different contexts within
which parts of an institution operate (See Box 6.3). However,
subcultures should adhere to the high-level values and elements
that support an institution's overall risk culture. A dynamic bal­
ance is required between the value generated by the differences
in risk perception and that generated by a unitary risk approach.
6.5 C H A N G E A N D C H A L L E N G E :
D E P L O Y IN G A N E F F E C T IV E R ISK
C U LT U R E
Risk culture is not a static thing but a formal and informal process
continuously repeating and renewing itself. Risk culture, as well
as corporate culture, evolves over time in relation to the events
that affect an institution's history (such as mergers and acquisi­
tions ) and to the external context within which it operates.
Building a sound risk culture is a collective process, not simply a
m atter of improving technical skills. Risk culture shall be a part
of a business and not simply of the supervision, which is not
necessarily a good proxy. Therefore, it concerns decisions and
actions on a daily basis, such as the way information is shared,

BO X 6.4 "U SIN G " CULTURE
Although its influence on firm behavior has long been
clear, culture has only recently been discovered as a
dependent variable of planning by m anagem ent litera­
ture. In theory, culture suited to the type of enterprise can
make a significant contribution to firm success. This means
that people "m ake use of" culture, that their behavior
is inspired by com pany values, and that they have com ­
municated com pany values to the m arket, emphasizing
the positive aspects of its culture (Hofstede 1983). It is
necessary for the "bosses" at all levels to continuously
em phasize the im portance that behavior adheres to com ­
pany culture, repeat and strengthen its basic contents and
remind people that it has a positive impact on people and
com pany perform ance.
the people being asked, when something went wrong, the
capacity to represent risk inside the organization and the under­
standing and correct use of docum ents. It also includes what
"w o rked " in the past. With the changing of both external and
internal conditions, culture too changes along with a strategic
change (See Box 6.4). O bsolete business culture is an obstacle
to improving perform ance.
The Group of Thirty (2015) states that culture and behavior
in today's financial systems and institutions are inadequate.
An im portant finding is that a suitable culture, with particular
regard to risk, is not a critical success factor but is displayed
only to m eet the expectations of a public, custom ers or norms
at particular tim es. It is not central to governance organs or
senior m anagem ent. It is not sufficiently rewarded in perfor­
mance m anagem ent and does not feature in bank personnel
training. It does not dialogue with three lines of risk defense,
(business, supervision and risk m anagem ent, auditing). In the
United Kingdom , the Banking Standard Board has been set up
by seven big banks in response to the findings of a Parliam en­
tary Com m ission. The Board aims to raise and spread behavioral
standards inside the British financial system , thus contributing to
the continuous im provem ent in bank behavior and cu ltu re s
The main changes since 2008 in the risk culture scenario are
enforcem ent in legislation, growth of the risk function, introduc­
tion of balanced scorecards replacing sales staff perform ance
indicators, shift in focus from com pliance to conduct, and cul­
ture becoming a board issue (Cass Business School 2015).
So how can a renewed culture be fully developed and spread in
a bank today?
Theory and cross-industry experiences clearly dem onstrate
that three mechanisms are critical for achieving the cultural
transform ation of the banking sector. (1) Changing the culture
of a com plex organization like a bank is possible, but difficult
and requires the awareness of the need for change, many
resources, and a long tim e. In fact, relationships between
m anagem ent actions and culture are not necessarily linear, as
there are m ultiple, com plex issues relating to proportionality
and accountability of individuals versus institutions that require
consideration by enforcem ent agencies (Group of Thirty 2015).
A major im provem ent in culture can be secured by focusing on
values and conduct, which are the building blocks of culture.
(2) Change necessitates a system ic approach to all subjects
involved, by taking into account their mutual roles. A sustained
focus on conduct and culture shall be carried out by banks
(board and m anagem ent), and the banking industry. All is
needed to make major im provem ents in culture within the bank­
ing industry and individual institutions (Group of Thirty 2015).
Addressing cultural issues must of necessity be the responsibility
of the board and m anagem ent of firms. Supervisors and regula­
tors cannot determ ine culture, but the form er has an important
monitoring function. (3) In order to be successful, the new cul­
ture has to be profitable and create real value for all subjects,
institutions, and individuals which present forms on their own
motivations explaining their possibly diverging behavior (Lo
2015). The effect of all this should be the creation of a com peti­
tive advantage for firms with better cultures and conducts, with
respect to client reputation and the ability to attract staff and
investors. Banks will only succeed if they accept that culture is
core to their business models and if they decide that fixing cul­
ture is key to their econom ic sustainability (Dickson 2015).
The assessm ent of a bank's risk culture and the perception
of its possible distance from a culture that can be considered
adequate to context, business model, and governm ent require­
ments are matters for the individual bank according to its char­
acteristics. In fact, there is no doubt that risk culture is widely
inadequate today and that there is a need to move from "form
to substance". The attitude "I have complied with the regula­
tions" needs to be replaced by "I have done everything possible
to prevent and resolve problem s". Ju st because it is legal it
does not mean that it is right (See Box 6.5).
A process of cultural change is ambitious as it involves many
players. It is the case that bank shareholders, m anagem ent,
bank staff, parliament, governm ent, legal system , supervision
authorities, media, education system , and custom ers are respon­
sible for the current unsatisfactory situation to various degrees.
W hat matters today is that all these forces are involved in a
common effort to promote a new banking culture shared by
both banking authorities and clientele. And, importantly banks
them selves shall play an active role in this new cultural change.
Risk culture is a sensitive area and cannot be dealt with on the
single dimension of lowering risk propensity by strengthening
Chapter 6 Risk Culture ■ 111
 BOX 6.5 M EA SU RES TO R ED U C E M ISCO N D U CT RISK
Codes and standards of conduct have been in place across
the industry for some tim e. The issue was not the develop­
ment of codes or standards, but their effective im plem en­
tation and enforcem ent across diverse business lines and
jurisdictions. Official sector and private sector representa­
tives noted that the effective implementation of conduct
risk m anagem ent involves fundamental changes in culture
and behavior across the industry, involving firms and market
stakeholders. Such changes take tim e.
Critical im plem entation challenges include:
• Integration in business decision-m aking. The integration of
behavior and ethical considerations in business decisions
(which could involve limiting or withdrawing from certain
transactions or businesses) challenges the "prevailing con­
sensus" on success; other stakeholders, including a firm's
custom ers and shareholders, may need to be involved in
supporting these changes.
• Consistency of m essages and action. The "tone at the
to p " is not always supported by consistent actions that
dem onstrate that conduct and ethical considerations vis­
ibly determ ine hiring, promotions, professional standing,
and success. This requires coordinated engagem ent of all
parts of the organization; ethical and behavior consider­
ations cannot, therefore, be segregated into com pliance
or human resources functions. Ensuring that senior level
em ployees take responsibility for driving forward changes
is im portant to success.
• Cross-border and cross-cultural issues. Supervisors, clients,
and stakeholders have different expectations and perspec­
tives of the role of financial services providers. As such,
approaches to conduct risk m anagem ent, as well as rules
relating to perm issible incentives regarding conduct, differ
across jurisdictions. These differences pose challenges for
global firms seeking to establish consistent expectations
across the institution.
• Com m on taxonom y for conduct risk. The integration
of conduct risk in all aspects of a firm 's business, in a
supervision. The most fundam ental issue in the risk culture
debate is the trade-off between risk-taking and control (Power
et al. 2013).
As reported in the Financial Tim es, the C E O of UBS recently
com m ented that: "M istakes are ok . . . try to eliminate all risk­
taking and threaten to punish all mistakes and the ensuing
culture of fear will limit the pursuit of legitimate business." The
controversy caused by these comments showed that seeking
to com pletely eliminate risk, which after all underpins all finan­
cial interm ediation, is unrealistic. Instilling into the personnel
the fear of making mistakes can only lead to immobility. In the
context of a robust and sound culture of risk, mistakes are a
112 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
m anner that is consistent across the industry, requires
the developm ent of a consistent set of definitions,
m ethods of assessm ent, and m easurem ent of conduct
risk. These risks vary across product lines and may vary
with the organizational structure of businesses within
firm s.
• G rey areas. A ctio ns that are not "ille g a l" but w hich,
under particular circum stances, could be inconsistent
with a firm 's values are som etim es difficult to address
because they are often d ep en d en t on facts and circum ­
stances. Frontline em ployees are often called upon to
exercise their discretion in fulfilling custom er requests;
these decisions are som etim es com plex and can vary
across business lines. Under these circum stances, it is
difficult to make prior determ inations on the best course
of action or to define clear boundaries. Firm s need to
develop fram ew orks to address these questions in a
consistent manner. A visible institutional leadership in
resolving and sanctioning a w eak m anagem ent of con­
duct risk will be im portant. Engaging business lines in
co o p erative approaches to identifying conduct risk such
as "reporting in the public interest" may help overcom e
lim itations of "w histleb lo w in g " approaches, which risk
putting em ployees and the institution on opposite
sides. It was how ever noted that there was a significant
am ount of regulation and case law in existen ce which
should help give firm s clarity on w hat constituted a
breach of regulation or law.
• Role of directors. W hile board oversight of conduct risk
is critical to the strengthening of conduct risk m anage­
m ent, an appropriate balance should be established
betw een the accountability of individual execu tives and
the board, in particular, N ED s. It was acknow ledged that
boards are facing increased pressure and that there may
be a risk that this could potentially create disincentives
for exp erien ced and qualified exp erts to serve on them .
Sou rce: A dapted from Financial Stability Board (2015).
m anagem ent tool and need to be explained in detail for a cor­
rect balance between risk-taking and the maintaining of an
appropriate level of control. "Bad apples" in a bank shall not be
allowed to take the blame for specific behavior which reflects
a weak risk culture. Rather than a lack of personal integrity or a
"natural" tendency towards dishonesty, non-compliant behavior
is, in fact, the outcom e of exogenous environmental and com ­
pany factors which deform the sound conversion of individual
values into behavior and actions, which, in other words, reflect
a firm's unsatisfactory risk culture. An experim ent recently per­
form ed on a sample of bank managers com pared with other
sectors aiming to test their propensity to lie yielded interesting
findings. The propensity to lie is similar in different sectors and
in normal conditions, but rises significantly for managers, whose
work environm ent (in this case the bank) is mentioned (Cohn
et al. 2014).
Risk culture is definitively 100% com patible with risk-taking and
profit-making. A sound risk culture helps ensure that activities
beyond the institution's risk appetite are recognized, assessed,
escalated, and addressed in a tim ely manner (Dickson 2015).
C O N C L U S IO N S
Culture matters. Risk culture is essential for a prudent and sound
bank management, and needs to be central in any evaluation.
Risks are an inherent aspect of bank function and are taken,
transform ed, and managed with com petence and profession­
alism. In this sense, risk culture is central to banks and has an
impact on risk-taking propensity and policies, types of risk assess-
ment/performance ratio and final decisions. The behavior of
banks and their personnel are a direct expression of risk culture.
Banks must develop their risk culture beyond regulatory
guidelines, in order to support their corporate strategy and
strengthen their core skills, and turn risks into opportunities.
They are required to com mit, to more effectively improving their
culture. The banks which are successful at doing this with consis­
tency, awareness, and determ ination in strategic decisions will
raise and consolidate their market reputation.
B IB L IO G R A P H Y
A ebi, A . B., Sabato, G ., Schmid, C . "Risk M anagem ent, C o rp o­
rate, Governance and Bank Perform ance in the Financial C risis".
Journal o f Finance and Banking 36 (2012): 3213-3226.
Basel Com m ittee on Banking Supervision, BSC BS Publications.
C orp ora te G overnance Principles for Banks. G uidelines, 2015.
Banking Standards Board. Annual Review 2015/2016, London,
March 8, 2016.
Boot, A . W. A . "Relationship Banking: W hat Do We Know?"
Journal o f Financial Interm ediation 9 (2000): 7-25.
Carretta, A ., Farina, V., Fiordelisi, F., Schwizer, P., Stentella
Lopes, F. S. "D on't Stand So Close to Me: The Role of Supervi­
sory Style in Banking Stability". Journal o f Finance & Banking
52 (2015): 180-188.
Carretta, A . (ed.). II g o vern o d el cam biam ento culturale in
banco: m odelli di analisi, strum enti operativi, valori individual'!,
Rome, ITA: Bancaria Editrice (2001).
Carretta, A ., Farina, V., Schwizer, P. "Cultural Fit and Post-merger
Integration in Banking M & As". Journal o f Financial Transforma­
tion 33 (2007): 137-155.
Cass Business School. "A Report on the Culture of British Retail
Banking". London, UK: New City Agenda and Cass Business
School, Novem ber 24, 2014.
Cohn, A ., Fehr, E., M arechal, M. A . "Business Culture and
Dishonesty in the Banking Industry". Nature 516 (2014): 86-89.
Deloitte Australia. "Cultivating an Intelligent Risk Culture: A Fresh
Perspective". Sydney, AU : Deloitte Touche Tohmatsu Ltd. (2012).
Dickson, J . "The Relevance of the Supervision of Behavior
and Culture to the SSM ". Am sterdam , N ED : 'Looking
forw ard: Effective Supervision o f Behavior and Culture at
Financial Institutions ' C on feren ce in the Tropenm useum , De
Nederlandsche Bank, Am sterdam , Septem ber 24, 2015.
Ellul, A ., Yerramilli, V. "Stronger Risk Controls, Lower Risk:
Evidence from U.S. Bank Holding C om panies". Journal o f
Finance 68 (2013): 1757-1803.
Fahlenbrach, R., Prilmeier, R., Stulz, R. M. "This Tim e is the
Sam e: Using Bank Perform ance in 1998 to Explain Bank Perfor­
mance During the Recent C risis". Journal o f Finance 67 (2012):
2139-2185.
Farrel, J . M ., Hoon, A . What's Your Com pany Risk C ulture? US:
KPM G US Lip., May, 2009.
Financial Stability Board, FSB. G uidance on Supervisory Interac­
tion with Financial Institutions on Risk Culture. A Fram ew ork
for A ssessin g Risk Culture, FSB Publications, Policy Docum ents,
April 7, 2014.
Financial Stability Board, FSB. M easures to R ed u ce M isco n d u ct
Risk, FSB Publications, Progress Reports, Novem ber 6, 2015.
Group of Thirty. Banking C on du ct and Culture. A Call for Su s­
tained and C om prehensive Reform , W ashington D C , US: Group
of Thirty, Ju ly, 2015.
Guiso, L., Sapienza, P., Zingales, L. "The Value of Corporate
C ulture". E IE F W orking p a p e r 27 (2013).
Hofstede, G . H. "The Cultural Relativity of Organizational Prac­
tices and Th eo ries". Journal o f International Business Studies
14 (1983): 75-89.
Institute of International Finance(IIF). Reform in the Financial
Services Industry: Strengthening Practices for a M ore Stable Sys­
tem , Report of the I IF Steering Com m ittee on Im plem entation,
2009.
Institute of Risk M anagem ent. Risk Culture U nder the
M icro sco p e G uidance for Board, 2012.
Chapter 6 Risk Culture ■ 113
Karolyi, G . A . "The Gravity of Culture for Finance". Journal o f Schein, E. H. Organizational Culture and Leadership, 4th Edition,
C orporate Finance 41 (2015): 610-625. San Francisco, US: Jossey-Bass Inc. (2010).

Kennedy, A . A ., Deal, T. E. C orporate C ultures: The Rites and Schneider, B. The Psychological Life o f Organizations in Hand­
Rituals o f C orporate Life, New York, US: Perseus Books (1982). b o o k o f Organizational Culture and Clim ate, eds. Ashkanasy,
Neal, M ., W ilderom , C eleste, P. M., W ilderom and Peterson,
Li, K., Griffin, D ., Zhao, L. "H ow Does Culture Influence C o rp o­
Mark. F., London, Thousand O aks, New Delhi, UK, US, IND:
rate Risk-taking?" Journal o f C orporate Finance 23 (2013): 1-22.
Sage (2000).
Lingel, A ., Sheedy, E. A . "The Influence of Risk Governance on
Senior Supervisors Group. Risk M anagem ent Lesson s from
Risk O utcom es— International Evid en ce". M acquarie A p p lie d
Financial Crisis 2008, 2009.
Finance C entre Research P aper 37 (2012).
Sheedy, E ., and Griffin, B. Em pirical Analysis o f Risk Culture in
Lo, A . W. "The Gordon Gekko Effect: The Role of Culture in the
Financial Institutions: Interim R ep ort, Sydney, A U : M acquarie
Financial Industry". N B ER W orking Papers 21267 (2015).
University (2014).
Mihet, R. "Effects of Culture on Firm Risk-Taking: A Cross-country
Smith-Bingham, R. Risk Culture: Think o f the C o n seq u en ces,
and Cross-industry Analysis". IM F Working Paper 210 (2012).
New York, US: Risk M anagem ent Insights, Marsh & Me Lennan
Power, M ., Ashby, S., and Palerm o, T. Risk Culture in Financial Com panies, O liver Wyman (2015).
O rganizations: A Research R ep ort, London, UK: London School
Sorensen, J . B. "The Strength of Corporate Culture and the
of Econom ics (2013).
Reliability of Firm Perform ance". Adm inistrative Scien ce
Richter, C. "D evelopm ent of a Risk Culture Intensity Index to Q uarterly 47 (2014): 70-91.
Evaluate the Financial M arket in G erm any". P ro ceedin g s o f
Stulz, R. M. "G overnance, Risk M anagem ent, and Risk-Taking in
FIK U SZ Sym posium for Young R esearcher 14 (2014): 237-248.
Banks". Finance W orking Paper 427 (2014).
Roeschman, A . Z. "Risk Culture: W hat it is and how it Affects an
Villeval, M. C. "Behavioural Econom ics: Professional Identity Can
Insurer's Risk M anagem ent. Risk M anagem ent and Insurance".
Increase D ishonesty". Nature 516 (2014): 48-49.
Risk M anagem ent and Insurance R eview 17 (2014): 227-296.
Zingales, L. "The 'Cultural Revolution' in Finance". Journal o f
Schein, E. H. "Organizational Culture". The Am erican Psychologist
Financial Econom ics 117 (2015): 1-4.
Association 45 (1990): 109-119.

114 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
OpRisk Data and
Governance
Learning Objectives
A fter com pleting this reading you should be able to:

Describe the seven Basel II event risk categories and iden­
tify exam ples of operational risk events in each category.
Summarize the process of collecting and reporting
internal operational loss data, including the selection of
thresholds, the tim efram e for recoveries, and reporting
expected operational losses.
Explain the use of a Risk Control Self Assessm ent (RCSA)
and key risk indicators (KRIs) in identifying, controlling,
and assessing operational risk exposures.
Describe and assess the use of scenario analysis in m anag­
ing operational risk, and identify biases and challenges
that which can arise when using scenario analysis.
Com pare the typical operational risk profiles of firms in
different financial sectors.
Explain the role of operational risk governance and
explain how a firm's organizational structure can impact
risk governance.

E x c e rp t is C hapter 2 o f Fundam ental A spects of O perational Risk and Insurance Analytics: A Handbook of O perational Risk,
b y M arcelo G. Cruz, Gareth W. P eters, and Pavel V. Schevchenko.

115
7.1 IN T R O D U C T IO N
One of the first and most im portant phases in any analytical pro­
cess, and this is certainly no different when developing O pRisk
m odels, is to cast the data into a form am enable to analysis. This
is the very first challenge that an analyst or quant faces when
determ ined to model, measure, and even manage O pRisk. A t
this stage, there is a need to establish how the information avail­
able can be modeled to act as an input in the analytical process
that would allow proper risk assessm ent to be used in risk man­
agem ent and mitigation. In risk m anagem ent, and particularly in
O pRisk, this activity is today quite regulated and the entire data
process, from collection to m aintenance and use, has strict rules,
which in a way reduces the variance in the use of the data across
the industry.
The O pRisk fram ework starts by having solid risk taxonom y so
risks are properly classified. Firms also need to perform a com ­
prehensive risk mapping across their processes to make sure
that no risk is left out of the m easurem ent process. This is a key
process to be accom plished and where a number of firms should
be paying more attention.
In this chapter, we lay the ground for the basic building blocks
of O pRisk m anagem ent. First we describe how risk taxonom y
works, classifying loss events into the major risk categories. Then
we describe the four major data elem ents that should be used
to measure and manage O pRisk: internal loss data, external
loss data, scenario analysis, and business and control environ­
ment factors. When these risk m apping, taxonom y, and data
building blocks are reasonably structured, it becom es important
to configure the organization of the O pRisk departm ent and a
firm's risk governance. Even a very efficient and well-developed
O pRisk fram ework would fail if the proper organization and poli­
cies are not in place.
7.2 O P R IS K T A X O N O M Y
The term "taxonom y" has becom e quite popular in the risk
m anagem ent industry. In most conferences and industrial w ork­
shops, and most certainly among consultants, the term "risk
taxonom y" has becom e a regular mantra. So, what is risk taxon­
omy? Taxonomy is actually a term borrowed from biology. One
of the missions of the biologist is to discover new species on
remote places of the planet and it would make their work easier
if they could classify a new species into a new group based
on some characteristics. So taxonom y means the conception,
naming, and classifying organisms into groups. It is a common
practice in biology to group individuals into species, arranging
species into larger groups, and giving those groups names, thus
116 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
producing a classification. For exam ple, the fact that dolphins
live in the sea and look like a fish does not make them a fish as
many of their characteristics made biologists classify them as
"m am m als". Taxonomy basically encom passes description, iden­
tification, nom enclature, and classification. Therefore, taxonom y
has becom e an interesting and a popular turn in risk m anage­
ment industry as new risks are being encountered at regular
intervals.
Before getting onboard the risk taxonom y bandwagon, a firm
must perform a com prehensive risk mapping exercise. This
means going through, in excruciating details, every major pro­
cess of the firm. For exam ple, let us imagine the equity trading
process. Analyzing this process would mean going through the
risks since the custom er places an order until the transaction
gets fully settled with exchanges of paym ent and securities
delivered. Those will be the basic risks that unlikely would
change, unless there is a change in the process. From this pro­
cess, a risk manager should also be able to point out where
losses are coming from and develop mechanisms to collect
them . The outcom e of this exercise would be the building block
of any risk classification study.
It is interesting to note that even today firms are struggling
with basic risk classification, which is the base of the risk man­
agem ent pyram id, the very first building block of a robust risk
m anagem ent fram ework. Mistakes made in the past years in
classifying a risk will have repercussions in the risk m anagem ent
and on the communication of risks, at a minimum, to outside
parties like regulators, and might com prom ise any good work
done elsewhere in the fram ework. There are roughly three
ways that firms drive this risk taxonom y exercise: cause-driven,
im pact-driven, and event-driven. In many firms, risk taxonom y
is a mixture of these three making it even more difficult to get
it right. Let us discuss these three methods. In the cause-driven
m ethod, the risk classification is based on the reasons that cause
operational losses. This usually follows the old O pRisk definition
(which most firms use in their annual reports) in which O pRisk is
defined as a function of "people, system s, and external events".
Some risk types in this classification would be, for exam ple,
"lack of skills in trade control" or "inappropriate access control
to system s". Although there are some advantages in this type of
classification, as a "root cause" is pretty much em bedded into
the risk classification, challenges arise when multiple causes exist
or the cause is not im m ediately clear. If this cause-driven risk
classification is applied to a process in which operational losses
have high frequency, it would be very difficult for risk m anag­
ers to correctly classify every single loss, and the attrition within
the business and within the departm ent is likely to be high.
Another way to perform this classification exercise is through an
impact-driven method. In this m ethod, the classification is made
according to the financial impact of operational losses. Most
firms that follow this type of classification do not invest heavily
in O pRisk m anagem ent; they just use this type to retrieve data
from their systems. This is quite common in sm aller firms. In this
type of classification, it is quite difficult to manage O pRisk as,
although the exposures are known, it is difficult to understand
what is driving these losses.
The event-driven risk classification is probably the most common
one used by large firms. It classifies risk according to O pRisk
events. This is the classification used by the Basel Com m ittee.
It is interesting to know that during the Basel II discussions,
when this type of risk taxonom y was presented, most of the
industries were reluctant to accept it. A number of firms, even
today, follow their own classification initially and map to the
Basel event-type category later. W hat is interesting in this clas­
sification is that the definition is rather broad which should make
it easier to accept changes in the process. For exam ple, under
"Executio n, Delivery, and Process M anagem ent" (EDPM ), which
is the level-1 event type, there is a category named "Transaction
Capture, Execution, and M aintenance" that can be an umbrella
for a number of event types. For exam ple, if the equity trading
process changes from an old-fashioned phone-based system to
online high-frequency trading, using this classification would be
easy to define the taxonom y of these risks.
Given how new risks emerge in OpRisk, and also the breadth of its
scope, the concept and the ideas behind risk taxonomy in OpRisk
sound quite appealing. However, as this is a building block of the
Table 7.1 Execution, Delivery & Process Management (EDPM) Event-Type Defined as Losses from Failed
Transaction Processing or P rocess M anagem ent, from Relations with Trade C ounterparties and Vendors. Basel II
event type classification as provided in BCBS (2006, pp. 30 5-30 7)
Category (Level 1) Categories (Level 2)
Execution, Delivery & Transaction Capture, Execution
Process M anagem ent and M aintenance
Monitoring and Reporting
Custom er Intake and
Documentation
Custom er/Client Account
M anagem ent
Trade Counterparties
Vendors and Suppliers
OpRisk framework, firms need to be very careful. In the following
sections, all seven Basel II event types required for the advanced
measurement approach (AMA) are defined and discussed in
detail; detailed breakdown into event types at level I, level 2, and
activity groups is provided in BCBS (2006, pp. 305-307).
Execution, Delivery, and Process
Management
EDPM loss event type is one of the most prominent in the
O pRisk profile of firms or business units with heavy transaction
processing and execution businesses. It encom passes losses
from failed transaction processing, as well as problem s with
counterparties and vendors. Table 7.1 describes the Basel event-
type breakdown for this risk.
Losses of this event type are quite frequent as these can be
due to human errors, miscom munications, and so on, which are
very common in an environm ent where banks have to process
millions of transactions per day. A typical exam ple of execution
losses might help to illustrate how frequent these losses can be.
Consider the following deal: A foreign exchange (FX) trader
bought USD 100,000,000 for €90,000,000 (i.e., USD 1 = € 0 .9 0 )
and then sold USD 100,000,000 for €90,050,000 (i.e.,
USD 1 = € 0 .9 0 0 5 ) with a trading initial profit of €50,000. Both
transactions were made almost at the same tim e, and the trader
was obviously very satisfied with a profit of €50,000. In his/her
excitem ent at the successful deal, however, there were some
Activity Examples
M iscommunication; data entry, m aintenance or loading error;
missed deadline or responsibility; model/system m isoperation;
accounting error/entity attribution error; other task m isperform ance;
delivery failure; collateral m anagem ent failure; reference data
maintenance
Failed mandatory reporting obligation; inaccurate external report
(loss incurred)
Client perm issions/disclaim ers missing; legal docum ents missing/
incom plete
Unapproved access given to accounts; incorrect client records
(loss incurred); negligent loss or dam age of client assets
Nonclient counterparty m isperform ance; misc. nonclient
counterparty disputes
Outsourcing; vendor disputes
Chapter 7 OpRisk Data and Governance ■ 117
 EX EC U T IO N , D ELIV ER Y AND P R O C ESS M AN AG EM EN T: M ISUN DERSTAN DIN G
A TRADIN G O R D ER : LA RG E US PRIVATE BAN K, A U G U ST 2012
Despite the fact that there are currently many options to
place orders, where technological devices such as e-mail,
Internet, live chats are available, many purchase orders,
particularly in private banking, are still being placed by old-
fashioned telephone methods. A very common mistake is
the misunderstanding of the order, especially frequent when
the counterparty is a foreign-language speaker and the com ­
munication chain usually goes from client to banker to trader
assistant to trader, and in any one of these links there is
potential for communication breakdowns to happen.
In a busy afternoon at the end of sum mer 2012, a client
asked his private banker to purchase "U SD 100,000 of a
particular share". The private banker passed this order to
the trader, and at the end of the day the trader passed a
bill to the private banker for several million US dollars. The
private banker was absolutely stunned to see that they had
bought a significant portion of this particular company. A s a
consequence of this transaction, the share price of this com ­
pany rose significantly which also generated questions from
authorities that suspected some type of pum p-and-dum p
schem e. Considering it all, the bank decided to keep the
shares and sell it little by little. The operational loss in this
case was reflected in the value lost in returning the stocks to
the m arket after the shares returned to their average price.

snags in the back-office with some confusion on where to remit
the payments of one leg of the deal, and the transaction was
finally settled 3 days later than it should have been.
In FX transactions trading tickets are usually larger to compensate
for the low margins. Similar situations as described earlier may lead
to errors. The counterparties obviously would have demanded a
compensation as the settlement has been delayed for 3 days, and
the bank would also have paid a penalty, in the form of interest
claims of €55,000. Therefore, any error has the potential to be big­
ger than a transaction's eventual economic profit.
The overall scenario is alarming. There was a loss of €5,000 on
the aggregate due to operational errors {€50,000 transaction
profit less €55,000 interest claims due for late payment). This
is the reality a trading environm ent faces on the day-to-day.
The actions of traders are recognized at the closing of the deal,
and errors coming to light at a later time (e.g ., mis-pricing, late
settlem ent) are not linked back to the underlying cause. The
error goes to an "error account" or the like and, in term s of
O pRisk m anagem ent, those who are responsible for the errors
are never identified; even worse is that the real profitability of
individual transactions is rarely understood. The cost side (and
the O pRisks involved) is in general ignored.
Knowing where these errors occur is very im portant for O pRisk
m anagem ent.
Clients, Products, and Business Practices
Loss events under Clients, Products and Business Practices
(CPBP) risk type are usually the largest, particularly in the US.
These events encom pass losses, for exam ple, from disputes with
clients and counterparties, regulatory fines from im proper busi­
ness practices, or wrongful advisory activities. Table 7.2 presents

Table 7.2 CPBP Event-Type Defined as Lo sses A rising from an Unintentional or N eglig en t Failure to M e e t a
Professional O bligation to S p e cific Clients (including fiduciary and suitability requirem ents) o r from the Nature or
Design o f a P ro d u c t Basel II event type classification as provided in BCBS (2006, pp. 305-307)

Category (Level 1) Category (Level 2) Activity Examples

Clients, Products, and Suitability, Disclosure, Fiduciary breaches/guideline violation; suitability/disclosure issues (e.g .,
Business Practices and Fiduciary KYC ); retail custom er disclosure violations; breach of privacy; aggressive
sales; account churning; misuse of confidential information; lender liability

Improper Business or Antitrust; im proper trade/m arket practices; m arket manipulation; insider
M arket Practices trading (on firm's account); unlicensed activity; money laundering

Product Flaws Product defects (e.g ., unauthorised); model errors

Selection, Sponsorship, Failure to investigate client per guidelines; exceeding client exposure
and Exposure limits

Advisory Activities Disputes over perform ance of advisory activities

118 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 REA L O PR ISK EV EN T S: SBC W ARBURG (IN VESTM EN T BANK), O C T O B ER 1996
The Securities and Futures Authority in the UK (the form er
City of London regulator since superseded by the Financial
Services Authority) released partial details in March 1997
of an investigation that had com m enced in O ctober 1996
into rogue trading in a program trade in SB C W arburg. (A
program trade is a transaction where one agent, generally a
fund, chooses another agent, generally a bank or a broker,
to sell part of its shares in the market in a determ ined day
and hour determ ined by market prices.) The program trading
error that made SB C Warburg the subject of the investiga­
tion is thought to have cost it no more than £5 million. Nev­
ertheless, this program trade was one of the largest ever to
be awarded to SB C W arburg, and the SFA investigation has
clearly em barassed it. The investigation relates to a mistake
made during the execution of a £300 million program trade
for an investm ent trust which caused the price of a number
of French stocks to fall sharply. The investigation is being
extended whether this bank made a similar error when selling
Spanish shares as part of the same program deal.
The SFA investigation focused on a 30-min period on O cto ­
ber 30, 1996. A t some time around mid-day. SBC Warburg
traders learnt that the bank had been awarded three con­
tracts by Kleinwort Benson European Privatization Investment
(Kepit) to execute a series of share sales (the so-called pro­
gram trade) on its behalf. Contracts for programme trades
are often awarded just before the deal takes place, and the
Kepit deal was no different. It involved SBC Warburg taking
the £300 million-worth of shares onto its books just minutes
later, at 12:30 pm, and paying Kepit, the mid-market prices
for each share at that tim e. In the remaining minutes before
the Basel event-type breakdown and definition for this risk
type. This is a specific and an im portant risk type for firms with
operations in the US where litigation is very common. As seen
in recent regulatory fines imposed on French banks and other
foreign banks operating in US jurisdiction, this loss type can also
be significant to off-shore entities.
Business Disruption and System Failures
Business Disruption and System Failures (BD SF) event type is
one the most difficult to spot in a large organization. A system
crash, for exam ple, would alm ost certainly bear som e financial
loss for a firm , but these losses must likely would be classified
as ED PM . An exam ple might help to clarify this point. Suppose
that the funding system of a large bank crashes at 9:00 am.
D espite all efforts from IT, the system com es back online only
by 4:00 pm when money m arkets are already closed. W hen
the system returns, the bank learns that it needs to fund an
extra USD 20 billion on that day. As the m arkets are already
the 12:30 pm deadline, SBC W arburg traders sought to sell
some of the same shares they were about to get from Kepit
in order to reduce the risk (this process is known as short sell,
and it is accepted as a normal practice in a program trade, as
long as the price does not fall too much).
Elsewhere at SBC W arburg, a trader was running an arbitrage
position on Kepit, seeking to make money by exploiting
differences between Kepit's own share price and the price
of the shares the bank owned. SFA investigators were told
that in the minutes before the 12:30 pm deadline, the SBC
Warburg trader running the arbitrage position was seen on
the trading floor making gestures with his hands for traders
to get the price of the shares down. N evertheless, a mistake
by one of the SBC W arburg's Paris-based traders attracted
the attention of SFA. Instead of selling as much as he could
before 12:30 pm, SFA investigators have been told that the
trader m isunderstood his instructions and instead attem pted
to sell at the strike tim e. The trader also failed to put a so-
called down limit on his proposed share sales, effectively
turning it into an unlimited sell order.
In the tapes passed to the SFA (all conversations on the trad ­
ing desk are recorded), the London-based trader is heard
talking with a colleague about how the price of the French
shares had fallen much further than they had planned. The
trader com plained that a colleague had just told him, in hind­
sight after the share prices had collapsed, that they should
only have pushed the prices down by 1%. SBC adm itted in
March 1997 that its short selling had contributed to adverse
price movements and dismissed several em ployees involved
in the trade.
closed, they need to make requests to their counterparties to
allow them special conditions; however, the rates in which they
capture these funds are higher than the daily average. This
extra cost, although due to a system failure and, therefore,
should be classified as BDSF, would hardly be captured at all.
Table 7.3 presents the formal Basel definition and breakdown
of this risk type.
Table 7.3 BDSF Event Risk Type Defined as Lo sses
A rising from D isruption o f Business o r System Failures.
Basel II event type classification as provided in BCBS
(2006, pp. 305-307)
Category Category
(Level 1) (Level 2) Activity Examples
Business Systems Hardware; software;
Disruption and telecom m unications; utility
System Failures outage/disruptions
Chapter 7 OpRisk Data and Governance ■ 119
 Table 7.4 External Fraud Event Risk Type Defined
as Lo sses Due to A cts o f a Type In ten d ed to D efraud, REA L O PR ISK EV EN TS: M O D EL
M isappropriate P rop erty, or Circum vent the Law INPUTS FRAUD, NATWEST,
by a Third Party. Basel II event type classification as MARCH 1997
provided in BCBS (2006, pp. 305-307) O ne of the most famous cases in derivatives m ispric­
ing was the one that happened at NarW est in 1997. On
Category Category
February 28, 1997, a few days after the bank released its
(Level 1) (Level 2) Activity Examples annual results, it announced a loss of approxim ately USD
150 million caused by a junior trader who has already left
External fraud Theft and Theft/robbery; forgery;
the bank. The trader was said to be dealing in long-dated
fraud check kiting
O T C interest rate options, used by com panies that borrow
Systems Hacking dam age; theft of at a floating rate and purchase a cap on the interest pay­
security information (w/monetary ments. The major problem in valuing these options is that
loss) they are relatively illiquid. The trader calculated the price
of the options by providing his own estim ates of volatil­
ity, which he apparently overestim ated, creating fictitious
The difficulty to capture this event type is reflected in external profits that built up in the books over tim e.
databases where, aside dam age to physical assets, this risk type The volatility estimates resulted in the options being under-
has least number of events. priced. The trader attracted more clients, booking the
requested premium, thereby increasing the apparent prof­
itability of his desk (and, by extension, his remuneration).
External Frauds The loss was realized when the options were exercised.

External frauds are frauds committed or attempted by third parties

or outsiders against the firm. Examples would be system hacking
and check and credit card frauds. External fraud is very common in
retail businesses where financial firms deal with millions of clients.
Frauds attempted or committed by clients are a daily event in
sectors such as retail banking, retail brokerage, and credit card ser­
vices; see Table 7.4 for Basel II definition and breakdown.
accepted mark-to-market price, are not uncommon. Recently
there were a number of large internal frauds in which billions of
dollars were lost as traders of a particular bank failed to men­
tion their position. These are usually low-frequency/high-severity
events. Table 7.5 presents the formal Basel definition and break­
down of this risk type.

Internal Fraud
Internal frauds are frauds com m itted or attem pted by a firm's
own em ployees. It is one of the less frequent types of O pRisk
loss. Given the sophisticated controls that most institutions have
this would be unlikely. However, events such as traders mismark-
ing positions, particularly in assets that are hard to establish an
Employment Practices and Workplace
Safety
Em ploym ent Practices and W orkplace Safety (EPW S) type of risk
is more prominent in the Am ericas than Europe or Asia as either
the labor laws are old-fashioned and/or there is more a culture

Table 7.5 Internal Fraud Event Risk Type Defined as Lo sses Due to A c ts o f a Type In ten d ed to D efraud,
M isappropriate P ro p erty or Circum vent Regulations, the Law or Com pany Policy, Excluding D iversity/
Discrim ination Even ts, Which Involves at Lea st O ne Internal Party. Basel II event type classification as provided in
BCBS (2006, pp. 305-307)

Category (Level 1) Category (Level 2) Activity Example

Internal fraud Unauthorised/Activity Transactions not reported (intentional); transaction type unauthorised
(w/monetary loss); mismarking of position (intentional)

Theft and fraud Fraud/credit fraud/worthless deposits; theft/extortion/em bezzlem ent/

robbery; m isappropriation of assets, malicious destruction of assets;
forgery; check kiting; sm uggling; account take-over/im personation/etc.;
tax noncompliance/evasion (willful); bribes/kickbacks; insider trading (not
on firm's account)

120 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Table 7.6 EPWS Event Risk Type Defined as Lo sses 7.3 T H E E L E M E N T S O F T H E O P R IS K
A rising from A c ts Inconsistent with Em ploym ent, FRA M EW O RK
Health or S a fety Laws or A g reem en ts, from Paym ent o f
Personal Injury Claims, or from Diversity/Discrim ination The four elem ents that should be used in any O pRisk fram ework
Even ts. Basel II event type classification as provided in are as follows:
BCBS (2006, pp. 30 5-30 7)
• Internal loss data;
Category Category • Business environment and internal control factors;
(Level 1) (Level 2) Activity Examples
• External loss data:
Em ploym ent Em ployee Com pensation, benefit, • Scenario analysis.
Practices and relations termination issues;
W orkplace organised labor activity We provide a description of each of these elem ents in the fol­
Safety lowing text.
Safe General liability (e.g ., slip
environment and fall); em ployee health
and safety rules events; Internal Loss Data
workers compensation
Operational loss means a gross monetary loss (excluding insur­
Diversity and All discrimination types
ance or tax effects) resulting from an operational loss event. An
discrimination
operational loss includes all expenses associated with an opera­
tional loss event except for opportunity costs, forgone revenue,
and costs related to risk m anagem ent and control enhance­
of litigation against the em ployers (Table 7.6). For exam ple,
ments im plem ented to prevent future operational losses.
some large banks in Brazil would count em ploym ent litigation on
the tens of thousand and it is one of the main OpRisks for banks. Having a robust historical internal loss database is the basis of
In some lines of business like investm ent banking em ploym ent any O pRisk fram ework. These losses need to be classified into
issues are also quite important. As these lines of business mostly the Basel categories (and internal if different than the Basel) and
provide advisory to large corporations and the key personnel mapped to a firm's business units. Given their im portance for
is highly com pensated, litigation against some of these key the O pRisk fram ework, the collection and maintenance of these
em ployees and losing them can cost millions of dollars. data are heavily regulated. Basel II regulation says that firms
need to collect at least 5 years of data, (B C B S, 2006), but most
decided not to discard any loss even when these are older than
Damage to Physical Assets this limit. Since losses are difficult to acquire and take years to
Dam age to Physical Assets (DPA) is another O pRisk event type. build up a reliable and informative loss database, consequently
The most common method to assess the exposure to this risk is most firms even pay to supplem ent internal losses (see the
through scenario analysis using insurance in form ation. Very few external loss database). Hence, it is clear that it would not make
firms actively collect losses on this risk type as these are usually sense to discard losses that took place in the firm unless the
either too small or incredibly large. The formal Basel definition business in which this loss took place was sold. There are a num­
and breakdown of this risk type is presented in Table 7.7. ber of issues that can come from internal data modeling that are
worth com ments and are listed below.

Considerable challenges exist in collating a large volume of

Table 7.7 DPA Event Risk Type Defined as Lo sses data, in different form ats and from different geographical loca­
A rising from Loss or Damage to Physical A ssets from tions, into a central repository, and ensuring that these data
Natural D isaster or O th er Even ts. Basel II event type feeds are secure and can be backed up and replicated in case of
classification as provided in BCBS (2006, pp. 30 5-30 7) an accident.

Category Category
(Level 1) (Level 2) Activity Examples
Setting a Collection Threshold and
Possible Impacts
Dam age to Disasters and Natural disaster losses;
physical assets other events human losses from external Most firms set a threshold for loss collection as allowed by Basel.
sources (e.g ., terrorism , However, this decision can have significant impact in establish­
vandalism) ing the risk profile of a business unit. This is usually the case

Chapter 7 OpRisk Data and Governance ■ 121

Table 7.8 The Impact of Threshold Choice: Losses in a Certain Year for the Asset Management Division of a Bank
Loss Brackets (USD) Number of Losses
> 5,000.000 3 23,750,325
1,000,000-5,000.000 7 13,775,000
500,000-1,000,000 10
100,000-500,000 12
50,000-100,000 22
20,000-50,000 71
< 20,000 1520
in businesses that have heavy transaction execution like asset
m anagem ent or equities. See the exam ple in Table 7.8. If the
O pRisk departm ent had chosen USD 100,000 as the threshold,
usually under the argument that only tail events drive O pRisk
capital, that firm would think that its total loss in that year was
USD 49 million. If the threshold choice was USD 20,000, the total
losses would be USD 53 million. However, most losses are due
to compensating retail clients whose orders are usually ranging
from USD 1,000 to USD 50,000. The sum of the losses under
USD 50,000 is about USD 20 million, which is almost equivalent
to the losses above USD 5 million. For this particular firm, setting
the loss collection threshold at USD 100,000 would show total
losses for the year as USD 49 million. However, if this firm had
not set a loss collection threshold they would observe that their
actual losses were USD 71 million, a very different risk profile.
A number of O pRisk managers pick their threshold thinking
only in term s of O pRisk capital. Disregarding these small losses
in many cases can bias the risk profile of a business unit and, of
course, this will also have an im pact on O pRisk capital.
Completeness of Database
(Under-Reporting Events)
In gathering data from disparate sources, we need to avoid an
O pRisk in collecting the O pRisk data. Such risks and subsequent
losses may arise, for exam ple, the em ployee responsible for
reporting losses does not send the loss information to the cen­
tral database, whether accidental or not. The Basel II docum ent
BOBS (2006) refers to this scenario with the possible conse­
quence being that an institution that could not prove that loss
data is flowing with a high degree of reliability to the central
database(s) is likely to be disallowed to em ploy more advanced
techniques for assessing the levels of risk.
The developm ent of filters that capture operational issues
and calculate an eventual operational loss is one of the most
122 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Total (USD) Accumulated Total (USD)
23,750,325
37,525,325
8,250,781 45,776,106
3,562,177 49,338,283
1,723,490 51,061,773
2,159,021 53,220,794
17,500,235 70,721,029
expensive parts of the entire data collection process, but the out­
come can be decisive in making an O pRisk project successful and
increasing confidence in the com pleteness of the loss database.
This OpRisk filter will vary from bank to bank depending on their
systems, but in all cases it works like a conduit between systems,
collecting every cancellation or alteration made to a transaction or
any differences between the attributes of a transaction in one sys­
tem compared to its attributes in another system. The transaction
flow starts at the front-office system that registers the transaction
passing it to the accounting and clearing systems. Any discrep­
ancy, alteration, or cancellation must be extracted by the OpRisk
filter. Also, abnormal inputs (e.g., a lower volatility in a deriva­
tive) can be flagged and investigated. The filter will calculate the
OpRisk loss event and several other impacts in the organization.
Recoveries and Near Misses
The Basel II rules (BC BS, 2006) in general do not allow for the
use of recoveries to be considered for capital calculation pur­
poses. The issue again is that if firms are trying to estimate losses
that can happen once every thousand years, it would not make
sense to start applying mitigating factors to reduce the losses
and eventually reducing also capital. For this reason, gross losses
should be considered for O pRisk calculation purposes.
The only exception is on rapidly recovered loss events but even
this exception is not accepted everywhere. Rapidly recovered
loss events are O pRisk events that lead to losses recognized in
financial statem ents that are recovered over a short period. For
instance, a large internal loss is rapidly recovered when a bank
transfers money to a wrong party but recovers all or part of the
loss soon thereafter. A bank may consider this to be a gross loss
and a recovery. However, when the recovery is made rapidly, the
bank may consider that only the loss net of the rapid recovery
constitutes an actual loss. When the rapid recovery is full, the
event is considered to be a "near m iss".
Time Period for Resolution of Operational
Losses
Some O pRisk events, usually some of the largest, will have a
large tim e gap between the inception of the event and the final
closure, due to the com plexity of these cases. A s an exam ple,
most litigation cases that came up from the financial crisis in
2007/2008 were only settled by 2012/2013. These legal cases
have their own life cycle and start with a discovery phase in
which lawyers and investigators would argue if the other party
has a proper case to actually take the action to court or not. A t
this stage, it is difficult to even come up with an estim ate for
eventual losses. Even when a case is accepted by the judge it
might be several years until lawyers and risk managers are able
to estim ate properly the losses. Firms can set up reserves for
these losses (and these reserves should be included in the loss
database), but they usually do that only for a few weeks before
the case is settled to avoid disclosure issues (i.e., the coun­
terparty eventually knows the amount reserved and uses this
information in their favor). This creates an issue for setting up
O pRisk capital because firms would know that they are going to
undergo a large loss and yet are unable to include it in the data­
base; the inclusion of this settlem ent would cause some volatility
in the capital. The same would happen if a firm set a reserve of,
for exam ple, USD 1 billion for a case, and then a few months
later, if a judge decides to remove the loss in favor of the firm.
For this reason, firms need to have a clear procedure on how to
handle those large, long-duration losses.
Adding Costs to Losses
As said earlier, an operational loss includes all expenses associ­
ated with an operational loss event except for opportunity costs,
forgone revenue, and costs related to risk management and con­
trol enhancements implemented to prevent future operational
losses. Most firms, for exam ple, do not have enough lawyers on
payroll (or expertise) to deal with all the cases, particularly some
of the largest or those that demand some specific expertise and
whose legal fees are quite expensive. There are cases in which the
firm wins in the end, maybe due to some external law firms, but
the cost can reach tens of millions of dollars. In such cases, though
the firm wins a court victory, there will be an operational loss.
Provisioning Treatment of Expected
Operational Losses
Unlike credit risk, the calculated expected credit losses might
be covered by general and/or specific provisions in the bal­
ance sheet. For O pRisk, due to its multidimensional nature, the
treatm ent of expected losses is more com plex and restrictive.
Recently, with the issuing of IAS37 by the International A ccount­
ing Standards Board, W ittsiepe (2008), the rules have becom e
clearer as to what might be subject to provisions (or not). IAS37
establishes three specific applications of these general require­
ments, namely:
• a provision should not be recognized for future operating
losses;
• a provision should be recognized for an onerous contract— a
contract in which the unavoidable costs of meeting its obliga­
tions exceeds the expected econom ic benefits;
• a provision for restructuring costs should be recognized only
when an enterprise has a detailed formal plan for restructur­
ing and has raised a valid expectation in those affected.
These provisions should not include costs, such as retraining
or relocating continuing staff, marketing or investing in new
system s and distribution networks; the restructuring does not
necessarily entail that.
IAS37 requires that provisions should be recognized in the bal­
ance sheet when, and only when, an enterprise has a present
obligation (legal or constructive) as a result of a past event. The
event must be likely to call upon the resources of the institution
to settle the obligation, and, more importantly, it must be pos­
sible to form a reliable estimate of the amount of the obligation.
Provisions should be measured in the balance sheet at the best
estimate of the expenditure required to settle the present obliga­
tion at the balance sheet date. Any future changes, like changes
in the law or technological changes, may be taken into account
where there is sufficient objective evidence that they will occur.
IAS37 also indicates that the amount of the provision should not
be reduced by gains from the expected disposal of assets (even
if the expected disposal is closely linked to the event giving rise
to the provision) nor by expected reimbursements (arising from,
for exam ple, insurance contracts or indemnity clauses). When
and if it is virtually certain that reimbursement will be received
should the enterprise settle the obligation, this reimbursement
should be recognized as a separate asset.
7 .4 B U S IN E S S E N V IR O N M E N T A N D
IN T E R N A L C O N T R O L E N V IR O N M E N T
F A C T O R S (B EIC Fs)
One can see O pRisk as a function of the control environment.
If the control environment is fair and under control, large
operational losses are not likely to take place and O pRisk is con­
sidered to be under control. Therefore, understanding the firm's
business processes, mapping the risks on these processes, and
assessing the control of these processes are the fundamental
Chapter 7 OpRisk Data and Governance ■ 123

Trade
Custody and
Trade capture matching and
control
confirmation
Fiaure 7.1 Equity settlement process
roles of an O pRisk manager. A simple exam ple is the equities
trading process and is shown in Figure 7.1.
Firms need to be able to assess risk on the many steps of the
settlem ent process and report them regularly. There are a
couple of tools that are commonly used by financial firms to per­
form this task: Risk Control Self-Assessm ent and Business and
Control Environm ent programs.
Risk Control Self-Assessment (RCSA)
These are also known as Control Self-Assessm ent (CSA ) in
some firm s, A ccording to this procedure, firm s regularly ask
experts about their view s on the status of each business pro­
cess and subprocess. These reviews are usually done every
12 or 18 months and color rated Red/A m ber/G reen (RAG)
according to the perceived status. Some firm s go beyond
and try to quantify these risks using subjective approaches or
through a scorecard. For many firm s, R C SA is the anchor of the
O pRisk fram ew ork and most O pRisk activities are linked to this
procedure.
In a broad sense, the RC SA program requires the docum enta­
tion and assessm ent of risks em bedded in a firm 's processes.
Levels of risks are derived (usually from a frequency, and
severity basis), and controls associated with these risks are
identified. As risks are usually reported by business units, these
processes are aggregated to a certain business unit and rated/
assessed.
In the R C SA program , m anagers first identify and assess
inherent risks by making no inferences about controls
em bedded in the process: controls are assum ed to be absent.
Under this assum ption, m anagers must carefully identify
how risk m anifests within the activities in the processes.
The following are the usual questions asked by risk m anagers
in this phase:
• Risk scenarios. W here are the potential failure points in
each of these processes?
• Exposure. How big a loss could happen to my operation if
a failure happens?
• Correlation to other risks. Could a failure altogether change
my organization's perform ance, either financially, its reputa­
tion, or affect any other area?
124 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The answers point toward the specific
Clear and Settle inherent risks em bedded within a busi­
trades ness unit's process, which must be
assessed to determ ine the likelihood
the events could occur (frequency) and
severity. The results of this analysis provide a birds' eye view of
the inherent risk of a firm 's business processes. M anagem ent
can then use this assessm ent to prioritize and focus on the
most critical risks that must be proactively m anaged.
O nce these inherent risks are understood, controls will be
added in the RC SA fram ew ork. The effectiveness of these
controls are then assessed to understand how efficient these
are to m itigate risks. A t this stage, the residual risk is also
calculated, which is the risk that is left after inherent risks are
controlled. Put another way, residual risk is the probability of
loss that rem ains to system s that store, process, or transm it
inform ation after security m easures or controls have been
im plem ented.
For a firm that has the RC SA program as the core of
the O pRisk fram ew ork, all other O pRisk initiatives under the
firm 's O pRisk program are usually structured to feed the
R C SA . Risk m etrics such as key risk indicators (KRIs), inter­
nal loss events, and external events would contribute to
the risk identification process ensuring the organization has
considered all readily available data and benchm ark risk
assessm ents.
O nce the universe of controls and m itigation m easures has
been identified, the business unit can partner with various
control functions to conduct the control testing phase of the
R C SA . Control testing is critical to a mutual understanding of
expectations and actions across business units and between
the front and back offices.
O ne significant challenge that arises due to com bining RC SA
data is interpreting w hat the data actually means. For exam ple,
outputs from a R C SA program might lead a risk m anager to
conclude that no im m ediate action is required if the risk e xp o ­
sures are controlled within the tolerances acceptable to the
firm . On the other hand, if the R C SA data indicates that the
control environm ent is weakening and threatening the success
of a particular business goal, a risk m anager m ight decide to
recom m end a corrective action. However, w eighting those risks
across the entire risk universe and naming the most im portant
or "ke y" might not be an easy and objective task.
There are a number of vendors that provide system s that help to
collate these results. The issue with these programs in general is
that they make it harder to integrate with the other data inputs
that are numeric. Even if these RAG assessm ents can be con­
verted to a number or rating, there is always a bias em bedded
that the person who does the assessm ent would have a m otiva­ confirm ations older than 30 days increases to over a certain
tion to improve their ratings so as to reduce their capital. p ercent of the total population, and the num ber of rep u d i­
ated trad es increases, one m ight say th at this process is
Key Risk Indicators facing challenges that need to be ad d ressed .

Th ese indicato rs/facto rs are m ostly quantitative and are
used as a proxy for the quality of the control environm ent
of a business. For exam p le, in order to report the quality
of the processing system s of an investm ent bank, we m ight
design facto rs such as "system d o w n tim e" (m easuring the
num ber of m inutes that a system stayed offline), and "sy s­
tem slow tim e " (counting the m inutes that a system was
overload and running slow ). Th ese KRIs can be extrem ely
im portant in O p R isk m easurem ent as they can allow O p R isk
m odels to behave very sim ilarly to those in m arket and
cred it risks.
G oing back to the equity settlem en t exam p le, instead of
using RAG se lf-a sse ssm e n t, a b etter w ay to assess the
quality of these processes is to establish a few KRIs that
provide an accurate picture of the control environm ent as
seen in Figure 7 .2 . As an exam p le, on the trad e confirm ation
stage of the settlem en t p ro cess, if the num ber of unsigned
• Daily trade volume
• Late booking trades
Trade capture
and execution
• Unsigned confirmation > 30 days
• Repudiated trades
Trade • Breaks
matching and
\ confirmation J
Th e process of KRI collection d eserves special attentio n. It is
im portant th at these data are ab so lutely reliab le, in order to
display relationships betw een KRIs and losses. A utom ating
the collection straight from the firm 's operational system s
m ight help to create a more realistic reflection of the true
profile of the infrastructure of a certain business. Th ere are
many stages in establishing these links and of course there
is a cost associated with the im plem entation of the KRI
program , but probably no other typ e of data will be more
pow erful than KRIs for m anaging and m easuring operational
risk. It is much easier to explain O p R isk as a function of the
control environm ent in which a firm exists than to say that
O p R isk capital is m oving up or down because of past losses
or changes in scenarios.
The first stage of the KRI collection process is trying to establish
assumptions on the O pRisk profile of a certain business. For
exam ple, we might assume that execution errors in the equi­
ties division can be explained by the trade volume on the day
the number of securities that failed to be received or delivered,
the head count available on the trading desk and the back
office, and system downtim e (measured by minutes offline).
The decision to be made is: at what organizational level should
this relationship be m easured? Equities division as a whole?
J Should we break down the equities division into cash equities,
listed derivatives and O T C derivatives, or along any other lines?
>v Should we consider breaking it down along regional lines? All
these questions are fundamental for the success of the analysis.
If loss data and KRIs are co llected at cost center level (the
J low est possible level), it becom es possible to perform this
d isag g reg atio n . In g en eral, the low er the level you model the

A
causal relationship , the b etter the chances that you will find
higher level fits to the m odel. Put this another w ay, it is easier
• Breaks
to find strong causal relationships, if you m odel, for exam p le,
• Disputed collateral calls
Custody and the US cash eq uities d ep artm en t than m odeling at the global
control
J eq uities division level, as the low er level would b etter capture
local nuances, id io syncrasies, and trend s.
\\y / N
Th e m odeler m ight also consider using external facto rs such
• Fails as equity indexes and interest rates. It is com m on to find
• Breaks (agent cash, agent stock) strong relationships betw een a stock m arket index and o p era­
C lear and settle
trades
J tional losses, for exam p le, higher vo latility on stock m arkets
is usually associated with high trading volum es, which in turn
is highly associated with execution losses in O p R isk. Table 7.9
presents few exam p les of Business Environm ent and Internal
Fiaure 7.2 Equity settlement process. Control Facto rs (B E IC F s) used in few environm ents.

Chapter 7 OpRisk Data and Governance ■ 125

Table 7.9 Examples of BEICFs Used in Few Environments

Business Environment Factor Description

Systems System downtime Num ber of minutes a system is offline

System slow time Num ber of minutes a system is slow
Software stability
Num ber of code lines changed in a program or software in a certain
period of time

Information Security Malware attacks Num ber of malware attacks

Hacking attem pts Num ber of hacking attem pts

People/Organization Em ployees Num ber of em ployees

Em ployees experience A verage experience of em ployees

Execution/Processing Transactions Num ber of transactions processed

Failed transactions Num ber of transactions that failed to settle
Data quality Ratio of transactions with errors
Breaks Num ber of transactions breaks

7.5 E X T E R N A L D A TA B A SES
According to the Basel Accord, O pRisk m odelers need to cal­
culate regulatory capital at the 99.9% confidence level, which is
equivalent to finding enough capital to protect against losses in
the worst year in a 1,000 year period. O ne way to try to over­
come these challenges is through using other firm s' loss exp eri­
ences. This is common in insurance. For exam ple, suppose that a
US insurer wants to expand to a new state, say New Je rse y. This
insurer does not have experience in New Je rse y; New Jersey
has different characteristics, for exam ple it may have much more
cars per square foot than other states and hence the accident
ratio is known to be higher. How can this insurer price correctly
its premium in New Je rsey? The most used alternative is to start
with a local database of car accidents. This database is available,
with considerable details, for insurance com panies to acquire.
Obviously, this database would never replace the insurer's own
loss experience in their portfolio, but while this loss experience
is not available, the best way to start the business is using this
external database. As the insurer starts building up their own
loss experience, it can start weighting the im portance of the
external database in their premium through credibility theory
methods.
Similarly, banks and other financial firms might struggle to come
up with reasonable measures for some types of risk because
they were never exposed to large losses, but, despite that, they
understand that they are still under the risk that such a loss
would happen eventually. These loss-gathering databases can
be very useful in these cases.
There are basically three ways to get hold of these databases
as seen in Table 7.10. The best choice for a firm would depend
significantly on how their fram ework is structured and how the
m odeler expects to use these losses.

Table 7.10 Methods to Acquire External Data and Details

Type Details Pros Cons

Internally developed Firm gathers these losses from Cheapest way It might not be com prehensive
news feeds and magazines enough and may miss losses in
many industries and jurisdictions

Consortia The most popular is O RX which Loss reporting threshold is No details on the losses. It can
has some of the largest banks in €20,000 only be used for measurement
the industry

Vendors There are a number of vendors More detailed analysis on Loss threshold is usually high
like IBM OpVantage and SAS the loss. It can be used for (USD 1 million). Loss details
m anagem ent or scenarios might not be accurate as these
were taken from newspapers

126 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
7.6 SCENARIO ANALYSIS 161

14-
Another im portant tool in O pRisk m anagem ent and m ea­ 12 -

surem ent is scenario analysis. For a significant number of 10 -

firm s, the scenario analysis program is the pillar of their

8
fram ework. These scenario estim ates are usually gathered
-

6
through expert opinions, where these experts (or a group
-

of experts) com m unicate their estim ates on how losses can 4-

happen on an extrem e situation. These experts are com ­ 2 -

monly guided by information gathered from external data 0 -

or KRIs and internal loss trends, see for instance discussions Structured Survey Individualized O ther
workshops discussions
on scenario analysis for O pRisk in Rippel and Teply (2008).
Alderw eireld et. al. (2006) and Huffman (2002). Figure 7.3 Survey on how US banks run scenarios.

Though there are different approaches to run a scenario

workshop, only three approaches are widely used: struc­ 7 -I

tured workshops, surveys, or individualized discussions. 6 -

A recent survey in 2012 with the largest US financial firms 5-

(the results are not in public domain and reference can­ 4 -
not be provided) shows that information from experts is
3-
obtained mainly through structured workshops (Figure 7.3).
2
A com prehensive guide to performing and establishing
-

1
appropriate statistical structures for surveys in such w ork­
-

shops is provided in detail in O 'Hagan et. al. (2006). 0 -

<10 10-20 21-50 51-100 >100

Scenarios can be a useful tool in case of emerging risks
where a loss experience would not be available. Finan­
cial institutions understanding this challenge are creating
many new scenarios for these emerging risks every year.
Figure 7.4 presents some other results of this survey about the
number of new scenarios developed annually by financial firms
showing that most firms develop between 51 and 100 scenarios
every year.
n order to make the outcom es of the scenario analysis w ork­
shops useful to the O pRisk m easurem ent and qualification
efforts, the opinions need to be converted into numbers. There
Figure 7.4 Number of new scenarios developed
annually by financial firms.
key limitations of this process as these biases are very difficult to
mitigate or avoid. Some of the biases are as follows:
• Presentation Bias. This arises when the order in which the
information is provided can skew or alter the assessm ent from
the experts; see discussion in Hogarth and Einhorn (1992);
• Availability bias. It is related to the over/underestim ation of
loss events due to respondents' exposure or fam iliarity to a

are a few ways to do so, but the most frequent is through gath­ particular experience or risk. For exam ple, if the expert has

ering estim ates on the loss frequencies on predefined severity

brackets. These numbers are then converted to empirical dis­ Table 7.11 Using Scenario Analysis Outcome for
tributions, see exam ple in Table 7.11, that are aggregated with Measurement
internal losses later.
Loss Bracket Relative
A fter convening expert opinion into an empirical distribu­ (in USD thousand) Loss Frequency Frequency
tion, the question is how to incorporate this into the O pRisk
USD 5,000 7 6.9%
fram ework. There are a number of articles on the subject, for
exam ple, see recent publications of Dutta and Babbel (2013), 1,000-5,000 10 9.8
Ergashev (2012), and Shevchenko (2011). 500-1,000 15 14.7

Common Issues and Bias in Scenarios. Because scenarios are 100-500 30 29.4
usually based on expert opinion, they present a number of
50-100 40 39.2
biases, see for exam ple, a demonstration of such features in the
Total 102
experim ents designed by Lin and Bier (2008). This is one of the

Chapter 7 OpRisk Data and Governance ■ 127

 a 30 years career in FX trading and had never experim ented
or seen an individual loss of USD 1 billion or larger, he/she
might be unable to accept the risk that such a loss would
take place;
• Anchoring bias. Anchoring occurs when participants restrict
their estim ates to being within a range of a given value,
which may come from their own experiences, a value they
have seen elsewhere (e.g ., internally, in the media) or a value
provided in the workshop; see discussion in W right and
Anderson (1989);
• "Huddle" bias or anxiety bias. It involves the tendency of
groups to avoid conflicts and differences of opinion, either
because individuals do not want to disrupt the smooth func­
tioning of the group through dissent, or because they are
unwilling to disagree openly with the more senior, expert,
or powerful people in the room; see discussions in O 'Hagan
(2005);
• Gaming. Conflicts of participants' interests with the goals
or consequences of the workshops can cause motivational
biases or gaming. Participants may be unwilling to disclose
information or engage meaningfully in the workshop or may
seek to influence the outcom es;
• Over/under confidence bias. This bias involves over/under-
estimation of risk due to the available experience and/or
literature on the risk being limited;
• Inexpert opinion. In many firms, scenario workshops do not
attract the expert (or the expert is not identified) and a more
junior em ployee or som eone with much less experience ends
up participating in the workshop and providing inaccurate
estim ates;
• Context bias. This bias arises when framing in a certain man­
ner alters the response of experts, that is, color their opinion;
see discussion in Fischhoff et. al. (1978).
A fundam ental problem that scenario analysis programs face is
the disparity of understanding and opinions on losses' sizes and
frequencies. To circum vent some of these problem s, application
of the Delphi technique may be of help. The Delphi technique,
as Linstone and Turoff (1975) defined, . . may b e characterized
as a m eth od for structuring a group com m unication p ro ce ss so
that the p ro ce ss is effective in allowing a group o f individuals, as
a whole, to deal with a com plex p ro b le m ."
The Delphi concept is a spin off from defense research. "Project
D elphi" is the name given to an Am erican Air Force project,
started in the early 1950s, that made use of expert opinion (see
Dalkey and Helmer, 1963). The objective of the original study
was to "obtain the m ost reliable consensus o f opinions within a
group o f e x p e rts" by a series of intensive questionnaires inter­
spersed with controlled opinion feedback.
128 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Delphi has been tested and broadly used in several applications
such as gathering current and historical data not accurately
known or available and exam ining the significance of events.
Usually, one or more of the following properties of the problem
to be solved leads to the need for employing Delphi.
• The problem does not lend itself to precise analytical
techniques but can benefit from subjective judgm ents on a
collective basis;
• The individuals needed to contribute to the examination of
a broad or com plex problem have no history of adequate
communication and may represent diverse backgrounds in
respect of experience or expertise;
• Tim e and cost make frequent group m eetings infeasible; and
• More individuals are needed than can effectively interact in a
face-to-face exchange.
Therefore, for Delphi to work, it is necessary that a group of
experts in each business get together in order to estim ate
O pRisk occurrences at a given confidence level. Consider an
exam ple: a bank in order to assess transaction execution risk in
the fixed income desk decided to get three different perspec­
tives: from the front desk (traders), from the finance group,
and from the operations group. Each one of these areas has
a different perspective on what risks would be and how many
losses would happen. As the estim ates from each of the three
areas were very different, a separate scenario workshop was
perform ed in each departm ent and the participants were elic­
ited to estim ate extrem e losses. A t the end, a final number was
agreed by the three areas and all recognized that trem endous
education took place as traders, for exam ple, did not have the
perspective of losses due to settlem ent failures. Delphi tech­
nique (Dalkey and Helmer, 1963) has a number of stages:
1. In the first step, the subject under discussion should be
explored with as many individuals contributing additional
information;
2. Given the information from step 1, a feedback and a
description of the issues are provided to the group;
3 . (Optional) Bring out the possible differences found in step 2
and evaluate them ; and
4. A final evaluation occurs when all the previously gathered
information has been initially analyzed and the evaluations
have been fed back to the respondents for consideration.
Finally, we would like to mention that ideas from works on
expert elicitation processes were im plem ented in a freely avail­
able toolkit known as the Sheffield Elicitation Fram ework
(SH ELF)1, which is covered under copyright when it comes to
1 S H E LF is available at http://w w w .tonyohagan.co.uk/shelf/
commercial usage; see details on the associated w ebsite. In Table 7.12 Trading and Sales OpRisk Profile
agreem ent with the standard industrial practice of structured
workshops, the SH ELF fram ework is developed to be performed Event Type Frequency (%) Severity (%)
with a group elicitation in mind and com prises a fram ework for Internal Fraud 1.0 11.0
eliciting beliefs of one or more experts as a group.
External Fraud 1.0 0.3

Em ploym ent Practices 3.1 2.3

and W orkplace safety
7 .7 O P R IS K P R O F IL E IN D IF F E R E N T
Clients, Products, and 12.7 29.0
F IN A N C IA L S E C T O R S Business Practices

A fter deciding the form of the operational loss data model and Dam age to Physical 0.4 0.2
Assets
the types of losses that need to be reported, it is useful to split
the financial institution into different business lines, given that Business Disruption 5.0 1.8
the O pRisk profile is generally very diverse across different busi­ and System Failures

nesses within a financial institution. W hile an asset m anagem ent Execution, Delivery & 76.7 55.3
unit is more inclined to have legal/liability problems (although Process M anagement
still having a few transaction processing problem s, in general, Sou rce: Results from the 2008 Loss Data Collection Exercise for O p e ra­
asset managers hold their positions longer than treasury), the tional Risk, see B C B S (2009b).

investm ent bank arm is more inclined to operational errors in

processing transaction. A large investm ent bank might process strategic alternatives. The differences to consulting firms are
over a million transactions a day. due to the fact that corporate finance in banks constantly offers
A typical list of business units includes C orporate Finance, Trad­ financing options, so deals are made. Therefore, it is expected
ing and Sales, Retail Banking, Com m ercial Banking, Payment that most of the losses fall under the umbrella of "litigation" or

and Settlem en t, A g e n cy Services, A sse t M anagem ent, and Retail disputes with clients for arguably poor advice when, for exam ­
Brokerage. These are business units at level 1 as suggested ple, IPOs go wrong; see Table 7.13.

in Basel II. Detailed breakdown into level 2 business units and

activity groups can be found in BCBS (2006, p. 302). Also it can
be appropriate to add an extra business unit, Insurance. Most of
these business units are discussed in the following sections.
Retail Banking
The O pRisk profile of retail banks is not too dissimilar to that of
retail brokerage; see Table 7.14. On the frequency side, most

Trading and Sales

Table 7.13 Corporate Finance OpRisk Profile
It should not come as a surprise that trading and sales OpRisk
profile is dominated by "ED P M " or just "Execu tio n ". This can Event Type Frequency (%) Severity (%)
be clearly seen in Table 7.12, where both frequency and severity Internal Fraud 1.6 0.24
execution losses dominate. The business model in trading is quite
External Fraud 5.4 0.12
simple; traders perform trades on behalf of either their own firms
or clients, and these trades get settled by exchanging the securi­ Em ploym ent Practices 10.1 0.59
and W orkplace safety
ties against some form of payments. However, as the products
are diverse and com plex and settlem ent deadlines and proce­ Clients, Products, and 47.1 93.67
dures vary significantly it is not surprising that executing these Business Practices
transactions is the major O pRisk of this business and, for many Dam age to Physical 1.1 0.004
trading shops, the major overall risk that they are exposed to. Assets

Business Disruption 2.2 0.02

and System Failures
Corporate Finance
Execution, Delivery & 32.5 5.36
This business is where financial firms many tim es behave similar Process M anagement
to consulting firms by providing advice to corporations in pos­ Sou rce: Results from the 2008 Loss Data Collection Exercise for O p e ra­
sible mergers and acquisitions, doing an IPO or even assessing tional Risk, see B C B S (2009b).

Chapter 7 OpRisk Data and Governance ■ 129

Table 7.14 Retail Banking OpRisk Profile
Event Type
Internal Fraud
External Fraud
Em ploym ent Practices
and W orkplace safety
Clients, Products, and
Business Practices
Dam age to Physical
Assets
Business Disruption
and System Failures
at least another two years, then life insurers' financial pain will
be broader and deeper. On the P&C side, the continuing pros­
Frequency (%) Severity (%)
pects for w eak investm ent returns and low interest rates over an
5.4 6.3 extended period compel carriers to improve underwriting mar­
gins, requiring difficult decisions concerning pricing and operat­
40.3 19.4
ing approaches. O rganic growth continues to be a challenge,
17.6 9.8 given the econom ic situation and the com petitive landscape.
Individual insurers confront greater com petition, driven by an
13.1 40.4 abundance of capital, uncertainty around the tim ing, the scope
of regulatory changes, and the continuing volatility caused by
1.4 1.1 weather-related losses, highlighted recently by Hurricane Sandy
in 2012 (in the US, Hurricane Sandy affected 24 states with par­
1.6 1.5 ticularly severe dam age in New Je rse y and New York). Health
insurers in the US, given the advent of the Patient Protection

Execution, Delivery & 20.6 21.4 and Affordable Care A ct (signed into law by US President
Process M anagem ent Barack Obam a on March 23, 2010, and commonly referred to as

Sou rce: Results from the 2008 Loss Data Collection Exercise for O p e ra­
"O b am acare"), are in much better shape than their counterparts
tional Risk, see B C B S (2009b). with a better perspective ahead of them .

Regarding risk regulation in this sector, there are significant

losses are due to external frauds that are daily events for these differences between Europe and the US. In Europe, a process

firms. Execution comes in a far second. However, when looking
at severity, the largest risk exposure is due to litigation once
again.
Insurance
For those not fam iliar with this industry, this sector can be
actually divided into three types given the significant differ­
ences: life insurance, health insurance, and property/casualty
or "P& C " insurance (or general insurance as known in Europe).
To put it very simply, life insurers basically charge a premium
from individuals in exchange to providing a sum of money
when they die. Life insurers also offer retirem ent and income-
protection products. Health insurers provide medical and hos­
pital coverage. P&C insurers offer coverage against dam age to
properties caused by fire, natural disasters, theft, etc. They also
offer protection against liabilities (e.g ., directors being sued and
professional errors). The actuarial calculation used in the P&C
insurance is very similar to the one used in O pRisk capital calcu­
lation. Most operational risk capital techniques are derived from
P&C actuarial techniques, and there are many articles in the
Journal o f O pR isk that were written by P&C actuaries.
Regarding the sector's overall current financial situation, sim i­
lar to most of the financial sectors, the effects of the financial
crisis still lingers. Life insurers started to feel the consequential
effects from the long low-interest rate environm ent, which
affects their profitability and com pany valuations and also, as
consumers struggle, declining sales and revenue. If interest
rates continue to stay low, and it appears likely that they will for
similar to Basel II was developed by insurance regulators, called
Solvency 2. Two key them es have dom inated regulatory dis­
cussions in the past year: supervisory focus on risk and capital
m anagem ent and concerted efforts to move toward a consistent
approach to cross-territory supervision of insurance groups.
These initiatives underscore the im portance of em bedding
strong risk m anagem ent principles throughout an enterprise and
moving beyond just "tick the box" com pliance, similar to what
Basel II has been influencing in the banking industry.
In the US, the regulatory environment also has been changing
as State insurance departm ents and rating agencies, in addition
to National Association of Insurance Com m issioners (N AIC), are
also influencing the direction of solvency regulation. W hile these
varied initiatives place differing degrees of emphasis on capital
requirem ents, reporting standards and risk m easures, a common
them e is their intensified focus on clearly articulating an insurer's
risk profile. To prepare and address the regulatory pressures to
enhance risk m anagem ent, insurers must significantly enhance
their data m anagem ent, reporting and analytical resources, and
their organizations' ability to integrate risk data across disci­
plines. The US insurance industry is also anticipating potential
im pacts of Dodd-Frank legislation, including in the system ically
im portant financial institution (SIFI) designation and the Federal
Insurance Office's (FIO) pending report to Congress on the state
of US insurance regulation, which in practice creates a national
insurance regulator.
Regarding O pRisk more specifically, insurers are still in the early
stages of the developm ent of their O pRisk fram eworks. This
comes somehow as a surprise as insurers suffered several large

130 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
operational losses that were very public and reported in the
media. Some of the exam ples over the last decade2 are the USD
250 million loss that a large US insurer suffered a few years ago
for discrimination (i.e., allegedly pricing their policies differently
according to race); a large European reinsurer lost USD 3.5 billion
for not having final contracts in place on the 9/11 terror attacks
inflicting damages to clients; a large US auto insurer lost USD
1 billion for using low-quality auto parts in vehicle repairs; a large
US life insurer lost USD 2 billion for abusive sales practices and
illegal sales of securities and the list goes on and on.
Insurers face a number of O pRisks; some of these are mis-selling
their products to clients. A number of insurers worldwide got
severe penalties for these sales practices. As with any retail
sector, insurers are exposed to bad faith claims (i.e., frauds by
custom ers)— Hollywood has a number of movies on these inter­
esting stories. More recently, the issue of unclaimed property
has becom e a concern for insurers as public officials are now
focusing much more on the issue than they did in the past.
Given these pressures, insurers have been more diligent to catch
up with banks in developing more robust O pRisk fram eworks.
However, they have a long road ahead of them .
Asset Management
The financial crisis brought to the global asset m anagem ent
industry challenges it has not seen in decades as the industry
was accustom ed to high margins and substantial profits (par­
ticularly in the years 2000-2007 due to the availability of excess
liquidity). As the financial markets climbed regularly over the
last 30 years, occasional dips notwithstanding, asset managers
becam e used to the steady increases in their assets under man­
agem ent (AUM) and easy profits. However, in the wake of the
biggest downturn since the G reat Depression, a slow recovery
has left many firms struggling. Even in 2012, most of the growth
of the asset m anagem ent came from market appreciation and
not due to increase in flow of resources from clients.
This new environm ent changed the asset m anagem ent indus­
try. During the precrisis "golden years" of abundant liquidity,
most asset managers were not overly worried about the costs
incurred in running their operations and did not pay close
attention to the risks involved, since the continuous growth in
personal wealth steadily increased their AU M , covering for these
expenses. Errors and high operating costs were buried under
the increased revenues from a larger asset base and the profits
that came from high returns in the world m arkets. Postcrisis, the
situation has changed dram atically. Large asset managers have
2 To preserve confidentiality, the com pany names are not m entioned.
seen their AUM go down by 30 or 40% , not only because of
the drop in asset prices but also because clients are w ithdraw ­
ing funds, either out of necessity to cover debts, because they
fear that the stock markets will take a long tim e to recover, or
som etim es even out of concern for the financial well-being of
some asset managers. The crisis also showed historic regulatory
failures, like the Bernie Madoff case, in which he created a Ponzi
schem e, that was discovered during the 2008 financial crisis, and
lost USD 6 billion from investors (this case is one of the largest
O pRisk events in history). Many investors close to retirem ent
lost their pensions not only because of the market conditions
but also because of a lack of caution and risk m anagem ent from
pension fund managers.
This long-lasting dire econom ic environment forces asset man­
agers to develop a much more careful discipline around costs,
risk m anagem ent, and productivity. Each of these factors has
received widespread attention in the specialized media.
The industry has reacted quickly to this new reality. For exam ­
ple, a large independent US asset m anager has already put in
place several measures to reduce costs, by sharing services in
its distribution and administration departm ents to reduce costs
across geographical areas. This same firm has also launched an
initiative to reduce its N C E by 20% in 2009, with the develop­
ment of an inter-company com m ittee to determ ine the expenses
that have to be elim inated.
A European-based global firm decided to reduce the number of
products it offered and the developm ent efforts for a few prod­
ucts where it can build competitive advantage on a global scale.
This firm also decided to immediately implement a plan, which
had been on the shelf for many years, to streamline its operational
platforms on a global basis. Currently, each geographical location
(and sometimes within the same country) has its own platform
with different vendors and frameworks to process securities.
A sset managers are susceptible to all forms of risks, namely
m arket, credit, and O pRisks. However, due to the characteristics
of their business (and perhaps helped by a historic disregard
for strong controls), O pRisk is typically the largest risk exposure
an asset m anager has. M arket and credit risk associated losses
would usually have an indirect impact on the asset manager's
revenue, as any loss to the client funds entails lower com m is­
sions. However, these losses are usually borne by the fund's
clients, not the asset m anager as a financial institution. These
market and credit risk losses would im pact the quotas and
NAVs, so the client would take a direct hit; the asset manager
would just have less fee revenue in these cases, an indirect
impact. O pRisk can be manifested in many different ways for
an asset m anager as, for exam ple, in errors in processing trans­
actions or a system failure that can cause severe dam age and
Chapter 7 OpRisk Data and Governance ■ 131
Table 7.15 Asset Management OpRisk Profile on the retail, offering the convenience of trading from home
or work and charging a reasonable fee for trades and usually
Event Type Frequency (%) Severity (%) offering free online research tools and a few other services,

Internal Fraud 1.5 11.1 brick-and-mortar brokers are mostly a division of larger financial
institutions and tend to focus on a wealthier custom er base that
External Fraud 2.7 0.9
would pay for high fees they charge, advice from financial advi­
Em ploym ent Practices 4.3 2.5 sors, etc.
and W orkplace safety
O ver the past decade, the industry had a dram atic transform a­
Clients, Products, and 13.7 30.8
tion with the proliferation of sophisticated, high-speed trading
Business Practices
technology that has changed the way broker-dealers trade for
Dam age to Physical 0.3 0.2 their own accounts and as agent for their custom ers. In addi­
Assets
tion, custom ers of these broker-dealers— particularly leading-
Business Disruption 3.3 1.5 edge institutions— have them selves begun using technological
and System Failures tools to place orders and to trade on markets with little or no
Execution, Delivery & 74.2 52.8 substantive intermediation of their broker-dealers. This, in turn,
Process M anagem ent has given rise to the increased use and reliance on "direct mar­
Sou rce: Results from the 2008 Loss Data Collection Exercise for O p e ra­ ket access" or "sponsored access" arrangem ents. Under these
tional Risk, see B C B S (2009b). arrangem ents, the broker-dealer allows its custom ers— whether
an institution such as a hedge fund, mutual fund, bank or insur­
ance com pany, an individual, or another broker-dealer— to
impact the balance sheet of the asset manager. A sset managers
use the broker-dealer's market participant identifier ("M PID ")
are also regularly sued for poor perform ance by clients. Consis­
or other mechanism for the purposes of electronically access­
tently failing to com ply with local regulations, or with very basic
ing the exchange. With "direct market access", as commonly
business ethics, can generate very large operational losses and
understood, the customer's orders first flow through the
subsequent reputational dam age. A number of exam ples are
broker-dealer's system s and then enters the m arkets, while with
available in the media for large losses in each of these cases
"sponsored access", the customer's orders flow directly into the
(Table 7.15).
markets without passing through the broker-dealer's systems.
Coming to realize the need to focus on O pRisk, asset m anag­ In all cases, irrespectively, whether the broker-dealer is trading
ers have been setting up O pRisk departm ents at a fast speed in for its own account, is trading for custom ers through more tra­
the last few years. The higher focus from regulators on hedge ditionally interm ediated brokerage arrangem ents, or is allowing
funds also made these more sophisticated asset managers to set custom ers direct market access or sponsored access, the broker-
up better O pRisk procedures around their operations. This new dealer with m arket access is legally responsible for all trading
focus on control and risks would actually facilitate a more stable activities that occur under its MPID. In some cases, the broker-
growth, with less bumps, when the econom ic environment even­ dealer providing sponsored access may not utilize any pretrade
tually improves. risk m anagem ent controls (i.e., "unfiltered" or "naked" access),
and thus could be unaware of the trading activity occurring
under its market identifier and has no mechanism to control it.
Retail Brokerage
Nowadays, order placem ent rates can exceed 1000 orders per
For O pRisk practitioners, this sector is possibly one of the most
second with the use of high-speed, automated algorithms. If,
interesting. Although we obviously need to consider that risk
for exam ple, an algorithm such as this malfunctions and places
profiles would vary significantly between institutions given their
repetitive orders with an average size of 300 shares and an
different business strategies, broker-dealers risk profile is usually
average price of USD 20, a two-minute delay in the d etec­
dom inated by O pRisk, which accounts for at least 60-70% of the
tion of the problem could result in the entry of, for exam ple,
total risk capital in these firms. This O pRisk type becom es clear
120,000 orders that values USD 720 million. In sponsored access
when we review the sector.
arrangem ents, as well as other access arrangem ents, appro­
Broker-dealers of these days can be roughly classified into priate pretrade risk controls could prevent this outcome from
online and brick-and-mortar brokers. Although what separa­ occurring by blocking unintended orders from being routed
tion then cannot be precisely defined, the custom er focus of to an exchange. Incidents involving algorithm ic or other trad­
these brokers is different. W hile online brokers tend to com pete ing errors in connection with market access occur with some

132 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
regularity. For exam ple, it was reported that, on Septem ber Table 7.16 Asset Management OpRisk Profile
30, 2008, trading in G oogle becam e extrem ely volatile toward
the end of the day, dropping 93% in value at one point, due to Event Type Frequency (%) Severity (%)
an influx of erroneous orders onto an exchange from a single Internal Fraud 5.8 18.1
market participant. As a result, Nasdaq had to cancel numerous
External Fraud 2.3 1.4
trades, and adjust the closing price for G oogle and the closing
value for the Nasdaq 100 Index. In addition, it was reported Em ploym ent Practices 4.4 6.3
that, in Septem ber 2009, Southwest Securities announced a and W orkplace safety

USD 6.3 million quarterly loss resulting from deficient market Clients, Products, and 66.9 59.5
access controls with respect to one of its correspondent brokers Business Practices
that vastly exceeded its credit limits. Despite receiving intra-day Dam age to Physical 0.1 0.1
alerts from the exchange, Southwest Securities' controls proved Assets
insufficient to allow it to respond in a tim ely manner, and trading Business Disruption 0.5 0.2
by the correspondent continued for the rest of the day, result­ and System Failures
ing in a significant loss. Another exam ple that highlights the
Execution, Delivery & 20.0 14.4
need for appropriate controls in connection with market access Process M anagement
occurred in D ecem ber 2005, when Mizuho Securities, one of
Sou rce: Results from the 2008 Loss Data Collection Exercise for O p e ra­
Japan's largest brokerage firms, sustained a significant loss due tional Risk, see B C B S (2009b).
to an erroneous manual order entry that resulted in a trade that,
under the applicable exchange rules, could not be canceled.
Specifically, it was reported that a trader at Mizuho Securities In this section, we provide an overview of how risk is organized
intended to enter a custom er sale order for one share of a secu­ in financial firms, how policies are structured, and the importance
rity at a price of 610,000 Yen, but the numbers were mistakenly of a solid committee and governance structure. Sound internal
transposed and an order to sell 610,000 shares of the security at governance forms the foundation of an effective O pRisk m anage­
a price of 1 Yen was entered instead. A system -driven, pretrade ment fram ework. Although internal governance issues related
control reasonably designed to reject orders that are not rea­ to the management of operational risk are not unlike those
sonably related to the quoted price of the security would have encountered in the management of credit or market risk, OpRisk
prevented this order from reaching the market. management challenges may differ from those in other risk areas.
As these exam ples show, broker-dealers are intensively exposed
to O pRisk that usually occupies the headlines of most of the
Organization of Risk Departments
newspapers and media. Brokers usually do not hold large pro­
prietary positions and lending, particularly after the 2008 crash, One cannot downplay the role of an organization in any large
has been limited; therefore, most exposure comes from poten­ business. Although many times the focus is on the measurement
tially explosive system issues, execution errors, litigation with models with its complex formulas, most of the times the success of
retail custom ers, fraud com m itted by clients, etc. (Table 7.16) implementing an OpRisk framework lies in having the right organi­
zation. The organizational design would usually hint at the strength
and degree of development of an OpRisk framework at a firm. In

7.8 R IS K O R G A N IZ A T IO N A N D the following text, we show a few organizational designs and the
beliefs that firms need to have to make them work. Usually firms
G O VERN A N CE
start with Design 1 and go to Design 4 presented in Figure 7.5.

Developing a solid risk organization is a key part of the fram e­
work. Understanding the reporting lines and establishing the
position of this organization on the firm would have probably
as much importance as having a good measurement system.
Also having proper organizational involvement in O pRisk issues
where key stakeholders are regularly informed and oversee risk
is fundamental for success. Developing a fram ework in a silo
that no one sees or cares is nor a desirable situation. The OpRisk
manager needs to be integrated to the rest of the organization.
• Design 1— Central Risk Function as Coordinator. In this
organizational design, risk m anagem ent role is more of a
facilitator. Usually in this structure, risk m anagem ent gathers
information and reports to the C E O or the Board. Sometim es
risk m anagem ent would add some layer of analysis, but in
most cases, the Central Risk group would be a small group.
O ne of the issues with this structure is that the regulators dis­
like the idea that risk managers report to revenue generating
businesses;

Chapter 7 OpRisk Data and Governance ■ 133

Design 1 and compensation decisions are still taken by these. In order
for this to be successful, the Business Units should have a
strong risk culture and collaborate very closely with the Central
Risk function. This dotted line structure works well when there
is a culture of Business Unit independence and distrust of the
Central Risk function for some reason or event that happened
in the past;

• Design 3— Solid reporting lines to Central Risk Manage­

ment. This organizational structure is reasonably popular
Design 2 within large firms. Risk M anagers still physically work in the
Business Units but report to the Central Risk function usually
based in the headquarters. The Central Risk function will be
better positioned to prioritize risk m anagem ent efforts across
different initiatives. This solid line reporting will also assist in
the creation of a more homogenous risk culture and consis­
tent approach across the enterprise;

• Design 4— Strong Central Risk Management. Large firms

have adopted this structure lately, either by internal agree­
Design 3 ment or through regulatory pressure. In this structure, the
Corporate C hief Risk O fficer is the key decision maker in risk
m anagem ent and fully responsible for risk across the firm.
Central Risk M anagem ent is responsible to monitor and
manage all the firm's risks and report to senior m anagem ent
and the Board. Such structure makes it much easier for the
regulator to stream line supervision as they can focus to one
particular group instead of being scattered in many business
units and geographical areas.

Design 4
Structuring a Firm Wide Policy: Example
of an OpRisk Policy
Exam ple of a policy is presented in Table 7.17. A policy defines
a firm's operational risk m anagem ent fram ework, which includes
governance structure, roles and responsibilities, and standards
for O pRisk m anagem ent and m easurem ent. It also describes
the O pRisk m anagem ent programs, which are the functional
activities requiring guidelines for consistent firm wide execution
Designs 1-4. (e.g ., loss capture program, risk control self-assessm ent, and
scenario analysis).

In order for this structure to be successful, one should believe

that the Business Units will be responsive to the Central Risk Governance
dem ands even without being part of their reporting line and
Common industry practice for sound O pRisk governance often
the control and incentives that such reporting includes (e.g .,
relies on three lines of defense:
control over com pensation, etc.);
• Business line m anagem ent;
• Design 2— Matrix reporting—the "dotted lines". In this
organizational design, a sort of evolution to the previous • An independent corporate O pRisk m anagem ent function;

design, risk managers have a dotted line to the Central Risk and

function; however, they are appointed by the Business Units • An independent review (usually internal audit).

134 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 7.17 Example of an OpRisk Policy

Content Description

Executive summary Defines the rationale and scope of the policy

Policy statem ents Provide a quick definition of the standards that will be used across the policy

Risk taxonom y Categorize O pRisk in different risk types. It can follow the Basel categories, but if it does not, it
usually provides a mapping of internal categories to the Basel-defined categories

Loss collection Defines what losses or incidents should be reported. Discuss concepts of "near m isses" and
describes recoveries

Risk assessm ent Usually describes other programs used to supplem ent internal loss data collection like scenario
analysis or risk factor analysis

Risk m easurem ent Describes the basic fram ework for measuring O pRisk, which types of data are used, and how
capital is calculated (overall view of the building blocks not a detailed manual)

Validation Describes how the risk assessm ent and m easurem ent are validated, how frequent validation
takes place, and which departm ents are responsible for the validation

Policy assurance and testing Determ ines which departm ent(s) in the firm will be responsible for assurance that the policy is
being followed and the reports that assure this firm-wide com pliance

Governance Describes where this policy is situated, which com m ittee approves it, and how the O pRisk
governance works

References Determ ine on which regulations, external standards, and/or other firm policies this was based
upon

Depending on the bank's nature, size and com plexity, and the
risk profile of a bank's activities, the degree of form ality of how
these three lines of defense are im plem ented will vary. In all
cases, however, a bank's O pRisk governance function should be
fully integrated into the bank's overall risk m anagem ent gover­
nance structure and the regulators closely monitor this.
If OpRisk governance utilizes the three lines of defense model
(i.e., the business is the first line of defense, risk management is
the second line, and internal audit being the third), the structure
and activities of the three lines often vary, depending on the
bank's portfolio of products, activities, processes, and systems;
the bank's size; and its risk management approach. Strong risk cul­
ture and good communications among the three lines of defense
are important characteristics of good OpRisk governance.
The regulators also reinforce the role of the board of direc­
tors. In the US and UK it is common that the regulators meet
separately with financial firms' board of directors regularly to
discuss their expectations regarding risk m anagem ent. The
board of directors should take the lead in establishing a strong
risk m anagem ent culture. The board of directors and senior
m anagem ent should establish a corporate culture that is guided
by strong risk m anagem ent and that supports and provides
appropriate standards and incentives for professional and
responsible behavior. In this regard, it is the responsibility of the
board of directors to ensure that a strong O pRisk m anagem ent
culture exists throughout the whole organization and this will be
closely monitored by regulators.

Chapter 7 OpRisk Data and Governance ■ 135

 Learning Objectives
A fter com pleting this reading you should be able to:

Describe model risk and explain how model risk can arise Explain best practices for the developm ent and
in the implementation of a model. implementation of a model.

Describe elem ents of an effective process to manage Describe elem ents of a strong model validation process
model risk. and challenges to an effective validation process.

E x c e rp t is rep rin ted from Financial Institution L e tte r FIL-22-2017 p u b lish ed b y the Fed eral D ep o sit Insurance C orporation.

137
8.1 IN T R O D U C T IO N
Banks rely heavily on quantitative analysis and models in most
aspects of financial decision m aking.1 They routinely use models
for a broad range of activities, including underwriting credits;
valuing exposures, instruments, and positions; measuring risk;
managing and safeguarding client assets; determining capital
and reserve adequacy; and many other activities. In recent years,
banks have applied models to more com plex products and with
more ambitious scope, such as enterprise-wide risk m easure­
ment, while the markets in which they are used have also
broadened and changed. Changes in regulation have spurred
some of the recent developm ents, particularly the U.S. regula­
tory capital rules for market, credit, and operational risk based
on the fram ework developed by the Basel Com m ittee on Bank­
ing Supervision. Even apart from these regulatory considerations,
however, banks have been increasing the use of data-driven,
quantitative decision-making tools for a number of years.
The expanding use of models in all aspects of banking reflects
the extent to which models can improve business decisions, but
models also come with costs. There is the direct cost of devot­
ing resources to develop and im plem ent models properly. There
are also the potential indirect costs of relying on m odels, such as
the possible adverse consequences (including financial loss) of
decisions based on models that are incorrect or misused. Those
consequences should be addressed by active m anagem ent of
model risk.
This guidance describes the key aspects of effective model
risk m anagem ent. Section II explains the purpose and scope of
the guidance, and Section III gives an overview of model risk
m anagem ent. Section IV discusses robust model developm ent,
implementation, and use. Section V describes the components of
an effective validation framework. Section VI explains the salient
features of sound governance, policies, and controls over model
developm ent, implementation, use, and validation. Section VII
concludes.
8.2 P U R P O S E A N D S C O P E
The purpose of this docum ent is to provide com prehensive
guidance for banks on effective model risk m anagem ent.
Rigorous model validation plays a critical role in model risk
1 Unless otherw ise indicated, banks refers to state non-member banks,
state savings associations, and all other institutions for which the Fe d ­
eral D eposit Insurance Corporation is the primary supervisor. It is not
expected that this guidance will pertain to FDIC-supervised institutions
with under $1 billion in total assets unless the institution's model use is
significant, com plex, or poses elevated risk to the institution.
138 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
m anagem ent; however, sound developm ent, im plem entation,
and use of models are also vital elem ents. Furtherm ore, model
risk m anagem ent encom passes governance and control m echa­
nisms such as board and senior m anagem ent oversight, policies
and procedures, controls and com pliance, and an appropriate
incentive and organizational structure.
Previous guidance and other publications issued by the FD IC on
the use of models address aspects of model risk m anagem ent
for specific types of models or pay particular attention to model
validation.2 Based on supervisory and industry experience over
the past several years, this docum ent expands on existing
guidance— most importantly by broadening the scope to
include all aspects of model risk m anagem ent. Many banks may
already have in place a large portion of these practices, but
banks should ensure that internal policies and procedures are
consistent with the risk m anagem ent principles and supervisory
expectations contained in this guidance. Details may vary from
bank to bank, as practical application of this guidance should be
customized to be com m ensurate with a bank's risk exposures, its
business activities, and the com plexity and extent of its model
use. For exam ple, steps taken to apply this guidance at banks
using relatively few models of only m oderate com plexity might
be significantly less involved than those at a bank where use of
models is more extensive or com plex.
8.3 O V E R V IE W O F M O D E L R ISK
M A N A G EM EN T
For the purposes of this docum ent, the term m odel refers to a
quantitative m ethod, system , or approach that applies statistical,
econom ic, financial, or mathematical theories, techniques, and
assumptions to process input data into quantitative estim ates.
A m odel consists of three com ponents: an information input
com ponent, which delivers assumptions and data to the model;
a processing com ponent, which transform s inputs into estim ates;
and a reporting com ponent, which translates the estim ates into
useful business information. Models meeting this definition
might be used for analyzing business strategies, informing
9
For instance, the FD IC has addressed aspects of model risk m anage­
ment in guidance related to different activities; see Jo in t A gency Policy
Statem ent on Interest Rate Risk (FIL-52-96), F F IE C A dvisory on Interest
Rate Risk M anagem ent (FIL-2-2010), Interagency Advisory on Interest
Rate Risk M anagem ent Frequently Asked Q uestions (FIL-2-2012),
FD IC's C redit Card A ctivities Manual (https://w w w .fdic.gov/regulations/
exam inations/credit_card/), and Supervisory Guidance on Implementing
Dodd-Frank A ct Com pany-Run Stress Tests for Banking Organizations
W ith Total Consolidated Assets of More Than $10 Billion but Less Than
$50 Billion (79 FR 14153). In addition, the advanced-approaches risk-
based capital rules (12 C FR 325, A p p en d ix D) contain explicit validation
requirem ents for subject banking organizations.
business decisions, identifying and measuring risks, valuing
exposures, instruments or positions, conducting stress testing,
assessing adequacy of capital, managing client assets, measuring
com pliance with internal limits, maintaining the formal control
apparatus of the bank, or meeting financial or regulatory report­
ing requirements and issuing public disclosures. The definition of
m odel also covers quantitative approaches whose inputs are
partially or wholly qualitative or based on expert judgm ent,
provided that the output is quantitative in nature.3
M odels are sim plified representations of real-world relationships
among observed characteristics, values, and events. Sim plifi­
cation is inevitable, due to the inherent com plexity of those
relationships, but also intentional, to focus attention on particu­
lar aspects considered to be most im portant for a given model
application. Model quality can be measured in many ways:
precision, accuracy, discrim inatory power, robustness, stability,
and reliability, to name a few. Models are never perfect, and the
appropriate metrics of quality, and the effort that should be put
into improving quality, depend on the situation. For exam ple,
precision and accuracy are relevant for models that forecast
future values, while discrim inatory power applies to models that
rank order risks. In all situations, it is im portant to understand a
model's capabilities and limitations given its sim plifications and
assumptions.
The use of models invariably presents model risk, which is the
potential for adverse consequences from decisions based on
incorrect or misused model outputs and reports. Model risk
can lead to financial loss, poor business and strategic decision
making, or dam age to a bank's reputation. Model risk occurs
primarily for two reasons:
• The model may have fundamental errors and may produce
inaccurate outputs when viewed against the design objective
and intended business uses. The mathematical calculation
and quantification exercise underlying any model generally
involves application of theory, choice of sam ple design and
numerical routines, selection of inputs and estim ation, and
im plem entation in information system s. Errors can occur at
any point from design through im plem entation. In addition,
shortcuts, sim plifications, or approxim ations used to manage
com plicated problem s could com prom ise the integrity and
reliability of outputs from those calculations. Finally, the qual­
ity of model outputs depends on the quality of input data
and assumptions, and errors in inputs or incorrect assum p­
tions will lead to inaccurate outputs.
3 W hile outside the scope of this guidance, more qualitative approaches
used by banking organizations— i.e ., those not defined as models
according to this guidance— should also be subject to a rigorous control
process.
Chapter 8 Supervisory Guidance on Model Risk Management
• The model may be used incorrectly or inappropriately. Even
a fundam entally sound model producing accurate outputs
consistent with the design objective of the model may
exhibit high model risk if it is misapplied or misused. Models
by their nature are sim plifications of reality, and real-world
events may prove those sim plifications inappropriate. This
is even more of a concern if a model is used outside the
environm ent for which it was designed. Banks may do this
intentionally as they apply existing models to new products
or m arkets, or inadvertently as market conditions or customer
behavior changes. Decision makers need to understand the
limitations of a model to avoid using it in ways that are not
consistent with the original intent. Limitations come in part
from weaknesses in the model due to its various shortcom ­
ings, approxim ations, and uncertainties. Limitations are also
a consequence of assumptions underlying a model that may
restrict the scope to a limited set of specific circum stances
and situations.
Model risk should be managed like other types of risk. Banks
should identify the sources of risk and assess the magnitude.
Model risk increases with greater model com plexity, higher
uncertainty about inputs and assumptions, broader use, and
larger potential impact. Banks should consider risk from indi­
vidual models and in the aggregate. A ggregate model risk is
affected by interaction and dependencies among m odels; reli­
ance on common assumptions, data, or m ethodologies; and
any other factors that could adversely affect several models and
their outputs at the same tim e. With an understanding of the
source and magnitude of model risk in place, the next step is to
manage it properly.
A guiding principle for managing model risk is "effective
challenge" of m odels, that is, critical analysis by objective,
inform ed parties who can identify model lim itations and
assum ptions and produce appropriate changes. Effective
challenge depends on a com bination of incentives, com pe­
tence, and influence. Incentives to provide effective challenge
to m odels are stronger when there is greater separation of
that challenge from the model developm ent process and
when challenge is supported by w ell-designed com pensa­
tion practices and corporate culture. C om petence is a key to
effectiveness since technical know ledge and m odeling skills
are necessary to conduct appropriate analysis and critique.
Finally, challenge may fail to be effective without the influence
to ensure that actions are taken to address model issues. Such
influence com es from a com bination of exp licit authority, stat­
ure within the organization, and com m itm ent and support from
higher levels of m anagem ent.
Even with skilled modeling and robust validation, model risk
cannot be elim inated, so other tools should be used to manage
■ 139
model risk effectively. Am ong these are establishing limits on
model use, monitoring model perform ance, adjusting or revising
models over tim e, and supplem enting model results with other
analysis and information. Informed conservatism , in either the
inputs or the design of a model or through explicit adjustments
to outputs, can be an effective tool, though not an excuse to
avoid improving models.
As is generally the case with other risks, m ateriality is an impor­
tant consideration in model risk m anagem ent. If at som e banks
the use of m odels is less pervasive and has less im pact on their
financial condition, then those banks may not need as com ­
plex an approach to model risk m anagem ent in order to m eet
supervisory expectations. However, where m odels and model
output have a material im pact on business decisions, including
decisions related to risk m anagem ent and capital and liquidity
planning, and where model failure would have a particularly
harmful im pact on a bank's financial condition, a bank's model
risk m anagem ent fram ew ork should be more extensive and
rigorous.
Model risk m anagem ent begins with robust model develop­
ment, im plem entation, and use. Another essential elem ent is
a sound model validation process. A third elem ent is gover­
nance, which sets an effective fram ework with defined roles and
responsibilities for clear communication of model limitations and
assumptions, as well as the authority to restrict model usage.
The following sections of this docum ent cover each of these
elem ents.
8.4 M O D E L D E V E L O P M E N T ,
IM P LEM EN T A T IO N , A N D U S E
Model risk m anagem ent should include disciplined and knowl­
edgeable developm ent and im plem entation processes that are
consistent with the situation and goals of the model user and
with bank policy. Model developm ent is not a straightforw ard
or routine technical process. The exp erience and judgm ent of
developers, as much as their technical know ledge, greatly
influence the appropriate selection of inputs and processing
com ponents. The training and exp erience of developers
exercising such judgm ent affects the extent of model risk.
M oreover, the m odeling exercise is often a m ultidisciplinary
activity drawing on econom ics, finance, statistics, m athem atics,
and other field s. M odels are em ployed in real-world m arkets
and events and therefore should be tailored for specific
applications and inform ed by business uses. In addition, a
considerable am ount of subjective judgm ent is exercised at
various stages of model developm ent, im plem entation,
use, and validation. It is im portant for decision makers to
140 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
recognize that this subjectivity elevates the im portance
of sound and com prehensive model risk m anagem ent
p ro cesses.4
Model Development and Implementation
An effective developm ent process begins with a clear statem ent
of purpose to ensure that model developm ent is aligned with
the intended use. The design, theory, and logic underlying the
model should be well docum ented and generally supported
by published research and sound industry practice. The model
m ethodologies and processing com ponents that im plem ent the
theory, including the mathematical specification and the numeri­
cal techniques and approxim ations, should be explained in
detail with particular attention to merits and limitations. D evel­
opers should ensure that the com ponents work as intended,
are appropriate for the intended business purpose, and are
conceptually sound and m athem atically and statistically correct.
Com parison with alternative theories and approaches is a funda­
mental com ponent of a sound modeling process.
The data and other information used to develop a model are
of critical im portance; there should be rigorous assessm ent
of data quality and relevance, and appropriate docum enta­
tion. D evelopers should be able to dem onstrate that such data
and information are suitable for the model and that they are
consistent with the theory behind the approach and with the
chosen m ethodology. If data proxies are used, they should be
carefully identified, justified, and docum ented. If data and infor­
mation are not representative of the bank's portfolio or other
characteristics, or if assumptions are made to adjust the data
and information, these factors should be properly tracked and
analyzed so that users are aware of potential limitations. This is
particularly im portant for external data and information (from a
vendor or outside party), especially as they relate to new prod­
ucts, instruments, or activities.
An integral part of model developm ent is testing, in which
the various com ponents of a model and its overall functioning
are evaluated to determ ine whether the model is perform ­
ing as intended. Model testing includes checking the model's
accuracy, dem onstrating that the model is robust and stable,
assessing potential limitations, and evaluating the model's
behavior over a range of input values. It should also assess the
4 Less com plex banks that rely on vendor m odels may be able to satisfy
the standards in this guidance without an in-house staff of technical,
quantitative model developers. However, even if a bank relies on
vendors for basic model developm ent, the bank should still choose the
particular m odels and variables that are appropriate to its size, scale,
and lines of business and ensure the m odels are appropriate for the
intended use.
im pact of assumptions and identify situations where the model
performs poorly or becom es unreliable. Testing should be
applied to actual circum stances under a variety of market condi­
tions, including scenarios that are outside the range of ordinary
expectations, and should encom pass the variety of products or
applications for which the model is intended. Extrem e values for
inputs should be evaluated to identify any boundaries of model
effectiveness. The im pact of model results on other models
that rely on those results as inputs should also be evaluated.
Included in testing activities should be the purpose, design, and
execution of test plans, summary results with com m entary and
evaluation, and detailed analysis of informative sam ples. Testing
activities should be appropriately docum ented.
The nature of testing and analysis will depend on the type of
model and will be judged by different criteria depending on the
context. For exam ple, the appropriate statistical tests depend
on specific distributional assumptions and the purpose of the
model. Furtherm ore, in many cases statistical tests cannot unam­
biguously reject false hypotheses or accept true ones based on
sam ple information. Different tests have different strengths and
weaknesses under different conditions. Any single test is rarely
sufficient, so banks should apply a variety of tests to develop a
sound model.
Banks should ensure that the developm ent of the more ju d g ­
mental and qualitative aspects of their models is also sound. In
some cases, banks may take statistical output from a model and
modify it with judgm ental or qualitative adjustm ents as part of
model developm ent. W hile such practices may be appropriate,
banks should ensure that any such adjustm ents made as part of
the developm ent process are conducted in an appropriate and
system atic manner, and are well docum ented. M odels typically
are em bedded in larger information system s that manage the
flow of data from various sources into the model and handle the
aggregation and reporting of model outcom es. Model calcula­
tions should be properly coordinated with the capabilities and
requirements of information system s. Sound model risk m anage­
ment depends on substantial investm ent in supporting systems
to ensure data and reporting integrity, together with controls
and testing to ensure proper implementation of m odels, effec­
tive systems integration, and appropriate use.
Model Use
Model use provides additional opportunity to test whether a
model is functioning effectively and to assess its performance
over tim e as conditions and model applications change. It can
serve as a source of productive feedback and insights from a
knowledgeable internal constituency with strong interest in hav­
ing models that function well and reflect econom ic and business
Chapter 8 Supervisory Guidance on Model Risk Management
realities. Model users can provide valuable business insight
during the developm ent process. In addition, business m anag­
ers affected by model outcom es may question the methods or
assumptions underlying the m odels, particularly if the managers
are significantly affected by and do not agree with the outcom e.
Such questioning can be healthy if it is constructive and causes
model developers to explain and justify the assumptions and
design of the models.
However, challenge from model users may be weak if the model
does not m aterially affect their results, if the resulting changes
in models are perceived to have adverse effects on the business
line, or if change in general is regarded as expensive or difficult.
User challenges also tend not to be com prehensive because
they focus on aspects of models that have the most direct
impact on the user's measured business perform ance or com ­
pensation, and thus may ignore other elem ents and applications
of the m odels. Finally, such challenges tend to be asym m etric,
because users are less likely to challenge an outcom e that
results in an advantage for them . Indeed, users may incorrectly
believe that model risk is low simply because outcom es from
model-based decisions appear favorable to the institution. Thus,
the nature and motivation behind model users' input should be
evaluated carefully, and banks should also solicit constructive
suggestions and criticism from sources independent of the line
of business using the model.
Reports used for business decision making play a critical role in
model risk m anagem ent. Such reports should be clear and com ­
prehensible and take into account the fact that decision makers
and m odelers often come from quite different backgrounds and
may interpret the contents in different ways. Reports that pro­
vide a range of estim ates for different input-value scenarios and
assumption values can give decision makers im portant indica­
tions of the model's accuracy, robustness, and stability as well as
information on model limitations.
An understanding of model uncertainty and inaccuracy and a
demonstration that the bank is accounting for them appropri­
ately are im portant outcom es of effective model developm ent,
im plem entation, and use. Because they are by definition imper­
fect representations of reality, all models have some degree of
uncertainty and inaccuracy. These can som etim es be quantified,
for exam ple, by an assessm ent of the potential impact of factors
that are unobservable or not fully incorporated in the model, or
by the confidence interval around a statistical model's point esti­
mate. Indeed, using a range of outputs, rather than a simple
point estim ate, can be a useful way to signal model uncertainty
and avoid spurious precision. A t other tim es, only a qualitative
assessm ent of model uncertainty and inaccuracy is possible. In
either case, it can be prudent for banks to account for model
uncertainty by explicitly adjusting model inputs or calculations
■ 141
to produce more severe or adverse model output in the interest
of conservatism . Accounting for model uncertainty can also
include judgm ental conservative adjustm ents to model output,
placing less em phasis on that model's output, or ensuring that
the model is only used when supplem ented by other models or
approaches.5
W hile conservative use of models is prudent in general, banks
should be careful in applying conservatism broadly or claiming
to make conservative adjustm ents or add-ons to address model
risk, because the impact of such conservatism in com plex mod­
els may not be obvious or intuitive. Model aspects that appear
conservative in one model may not be truly conservative com ­
pared with alternative methods. For exam ple, simply picking
an extrem e point on a given modeled distribution may not be
conservative if the distribution was m isestim ated or m isspecified
in the first place. Furtherm ore, initially conservative assumptions
may not remain conservative over tim e. Therefore, banks should
justify and substantiate claims that model outputs are conserva­
tive with a definition and m easurem ent of that conservatism
that is com m unicated to model users. In some cases, sensitivity
analysis or other types of stress testing can be used to dem on­
strate that a model is indeed conservative. Another way in which
banks may choose to be conservative is to hold an additional
cushion of capital to protect against potential losses associated
with model risk. However, conservatism can becom e an im pedi­
ment to proper model developm ent and application if it is seen
as a solution that dissuades the bank from making the effort to
improve the model; in addition, excessive conservatism can lead
model users to discount the model outputs.
As this section has explained, robust model developm ent,
im plem entation, and use is im portant to model risk m anage­
ment. But it is not enough for model developers and users
to understand and accept the model. Because model risk is
ultimately borne by the bank as a whole, the bank should objec­
tively assess model risk and the associated costs and benefits
using a sound model-validation process.
8.5 M O D E L V A LID A TIO N
Model validation is the set of processes and activities intended
to verify that models are performing as expected, in line with
their design objectives and business uses. Effective validation
helps ensure that models are sound. It also identifies potential
5 To the extent that models are used to generate amounts included in
public financial statem ents, any adjustm ents for model uncertainty are
required by existing law to com ply with generally accepted accounting
principles.
142 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
limitations and assumptions, and assesses their possible impact.
As with other aspects of effective challenge, model validation
should be perform ed by staff with appropriate incentives, com ­
petence, and influence.
All model com ponents, including input, processing, and report­
ing, should be subject to validation; this applies equally to
models developed in-house and to those purchased from or
developed by vendors or consultants. The rigor and sophisti­
cation of validation should be com m ensurate with the bank's
overall use of m odels, the com plexity and m ateriality of its mod­
els, and the size and com plexity of the bank's operations.
Validation involves a degree of independence from model
developm ent and use. Generally, validation should be done by
people who are not responsible for developm ent or use and do
not have a stake in whether a model is determined to be valid.
Independence is not an end in itself but rather helps ensure that
incentives are aligned with the goals of model validation. While
independence may be supported by separation of reporting
lines, it should be judged by actions and outcomes, since there
may be additional ways to ensure objectivity and prevent bias. As
a practical matter, some validation work may be most effectively
done by model developers and users; it is essential, however,
that such validation work be subject to critical review by an inde­
pendent party, who should conduct additional activities to ensure
proper validation. O verall, the quality of the process is judged
by the manner in which models are subject to critical review.
This could be determined by evaluating the extent and clarity of
documentation, the issues identified by objective parties, and the
actions taken by management to address model issues.
In addition to independence, banks can support appropriate
incentives in validation through com pensation practices and
perform ance evaluation standards that are tied directly to the
quality of model validations and the degree of critical, unbiased
review. In addition, corporate culture plays a role if it establishes
support for objective thinking and encourages questioning and
challenging of decisions.
Staff doing validation should have the requisite knowledge,
skills, and expertise. A high level of technical expertise may
be needed because of the com plexity of many m odels, both
in structure and in application. These staff also should have a
significant degree of fam iliarity with the line of business using
the model and the model's intended use. A model's developer
is an im portant source of information but cannot be relied on as
an objective or sole source on which to base an assessm ent of
model quality.
Staff conducting validation work should have explicit authority
to challenge developers and users and to elevate their findings,
including issues and deficiencies. The individual or unit to whom
those staff report should have sufficient influence or stature
within the bank to ensure that any issues and deficiencies are
appropriately addressed in a tim ely and substantive manner.
Such influence can be reflected in reporting lines, title, rank, or
designated responsibilities. Influence may be dem onstrated by a
pattern of actual instances in which m odels, or the use of m od­
els, have been appropriately changed as a result of validation.
The range and rigor of validation activities conducted prior to
first use of a model should be in line with the potential risk pre­
sented by use of the model. If significant deficiencies are noted
as a result of the validation process, use of the model should
not be allowed or should be perm itted only under very tight
constraints until those issues are resolved. If the deficiencies are
too severe to be addressed within the model's fram ework, the
model should be rejected. If it is not feasible to conduct neces­
sary validation activities prior to model use because of data
paucity or other limitations, that fact should be docum ented
and com m unicated in reports to users, senior m anagem ent, and
other relevant parties. In such cases, the uncertainty about the
results that the model produces should be mitigated by other
com pensating controls. This is particularly applicable to new
models and to the use of existing models in new applications.
Validation activities should continue on an ongoing basis after
a model goes into use, to track known model limitations and
to identify any new ones. Validation is an im portant check on
model use during periods of benign econom ic and financial con­
ditions, when estim ates of risk and potential loss can become
overly optim istic, and when the data at hand may not fully
reflect more stressed conditions. Ongoing validation activities
help to ensure that changes in m arkets, products, exposures,
activities, clients, or business practices do not create new model
limitations. For exam ple, if credit risk models do not incorporate
underwriting changes in a tim ely manner, flawed and costly busi­
ness decisions could be made before deterioration in model
perform ance becom es apparent.
Banks should conduct a periodic review— at least annually but
more frequently if warranted— of each model to determ ine
whether it is working as intended and if the existing valida­
tion activities are sufficient. Such a determ ination could simply
affirm previous validation work, suggest updates to previous
validation activities, or call for additional validation activities.
Material changes to models should also be subject to validation.
It is generally good practice for banks to ensure that all models
undergo the full validation process, as described in the following
section, at some fixed interval, including updated docum enta­
tion of all activities.
Effective model validation helps reduce model risk by identify­
ing model errors, corrective actions, and appropriate use. It
also provides an assessm ent of the reliability of a given model,
Chapter 8 Supervisory Guidance on Model Risk Management
based on its underlying assumptions, theory, and m ethods. In
this way, it provides information about the source and extent
of model risk. Validation also can reveal deterioration in model
perform ance over tim e and can set thresholds for acceptable
levels of error, through analysis of the distribution of outcomes
around expected or predicted values. If outcom es fall consis­
tently outside this acceptable range, then the models should be
redeveloped.
Key Elements of Comprehensive
Validation
An effective validation fram ework should include three core
elem ents:
• Evaluation of conceptual soundness, including developm en­
tal evidence
• Ongoing monitoring, including process verification and
benchmarking
• O utcom es analysis, including back-testing
Evaluation of Conceptual Soundness
This elem ent involves assessing the quality of the model design
and construction. It entails review of documentation and empiri­
cal evidence supporting the methods used and variables selected
for the model. Documentation and testing should convey an
understanding of model limitations and assumptions. Validation
should ensure that judgm ent exercised in model design and con­
struction is well informed, carefully considered, and consistent
with published research and with sound industry practice. D evel­
opmental evidence should be reviewed before a model goes into
use and also as part of the ongoing validation process, in particu­
lar whenever there is a material change in the model.
A sound developm ent process will produce docum ented evi­
dence in support of all model choices, including the overall
theoretical construction, key assumptions, data, and specific
mathematical calculations, as mentioned in Section IV. As part
of model validation, those model aspects should be subjected
to critical analysis by both evaluating the quality and extent of
developm ental evidence and conducting additional analysis and
testing as necessary. Com parison to alternative theories and
approaches should be included. Key assumptions and the choice
of variables should be assessed, with analysis of their im pact on
model outputs and particular focus on any potential limitations.
The relevance of the data used to build the model should be
evaluated to ensure that it is reasonably representative of the
bank's portfolio or market conditions, depending on the type of
model. This is an especially im portant exercise when a bank uses
external data or the model is used for new products or activities.
■ 143
W here appropriate to the particular model, banks should
employ sensitivity analysis in model developm ent and validation
to check the impact of small changes in inputs and param ­
eter values on model outputs to make sure they fall within an
expected range. U nexpectedly large changes in outputs in
response to small changes in inputs can indicate an unstable
model. Varying several inputs sim ultaneously as part of sensitiv­
ity analysis can provide evidence of unexpected interactions,
particularly if the interactions are com plex and not intuitively
clear. Banks benefit from conducting model stress testing to
check perform ance over a wide range of inputs and param eter
values, including extrem e values, to verify that the model is
robust. Such testing helps establish the boundaries of model
perform ance by identifying the acceptable range of inputs as
well as conditions under which the model may becom e unstable
or inaccurate.
M anagem ent should have a clear plan for using the results of
sensitivity analysis and other quantitative testing. If testing indi­
cates that the model may be inaccurate or unstable in some
circum stances, m anagem ent should consider modifying certain
model properties, putting less reliance on its outputs, placing
limits on model use, or developing a new approach.
Qualitative information and judgm ent used in model develop­
ment should be evaluated, including the logic, judgm ent, and
types of information used, to establish the conceptual sound­
ness of the model and set appropriate conditions for its use. The
validation process should ensure that qualitative, judgm ental
assessments are conducted in an appropriate and system atic
manner, are well supported, and are docum ented.
Ongoing Monitoring
The second core elem ent of the validation process is ongoing
monitoring. Such monitoring confirms that the model is appro­
priately im plem ented and is being used and is performing as
intended.
Ongoing monitoring is essential to evaluate whether changes
in products, exposures, activities, clients, or market conditions
necessitate adjustm ent, redevelopm ent, or replacem ent of the
model and to verify that any extension of the model beyond its
original scope is valid. Any model limitations identified in the
developm ent stage should be regularly assessed over tim e, as
part of ongoing monitoring. Monitoring begins when a model
is first im plem ented in production system s for actual business
use. This monitoring should continue periodically over tim e, with
a frequency appropriate to the nature of the model, the avail­
ability of new data or modeling approaches, and the magnitude
of the risk involved. Banks should design a program of ongo­
ing testing and evaluation of model perform ance along with
144 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
procedures for responding to any problem s that appear. This
program should include process verification and benchm arking.
Process verification checks that all model com ponents are
functioning as designed. It includes verifying that internal and
external data inputs continue to be accurate, com plete, consis­
tent with model purpose and design, and of the highest quality
available. Com puter code implementing the model should be
subject to rigorous quality and change control procedures to
ensure that the code is correct, that it cannot be altered except
by approved parties, and that all changes are logged and can
be audited. System integration can be a challenge and deserves
special attention because the model processing com ponent
often draws from various sources of data, processes large
amounts of data, and then feeds into multiple data repositories
and reporting system s. User-developed applications, such as
spreadsheets or ad hoc database applications used to generate
quantitative estim ates, are particularly prone to model risk. As
the content or composition of information changes over tim e,
system s may need to be updated to reflect any changes in the
data or its use. Reports derived from model outputs should be
reviewed as part of validation to verify that they are accurate,
com plete, and informative, and that they contain appropriate
indicators of model perform ance and limitations.
Many of the tests em ployed as part of model developm ent
should be included in ongoing monitoring and be conducted
on a regular basis to incorporate additional information as
it becom es available. New empirical evidence or theoreti­
cal research may suggest the need to modify or even replace
original methods. Analysis of the integrity and applicability of
internal and external information sources, including information
provided by third-party vendors, should be perform ed regularly.
Sensitivity analysis and other checks for robustness and stability
should likewise be repeated periodically. They can be as useful
during ongoing monitoring as they are during model development.
If models only work well for certain ranges of input values, market
conditions, or other factors, they should be monitored to identify
situations where these constraints are approached or exceeded.
Ongoing monitoring should include the analysis of overrides
with appropriate docum entation. In the use of virtually any
model, there will be cases where model output is ignored,
altered, or reversed based on the expert judgm ent of model
users. Such overrides are an indication that, in some respect, the
model is not performing as intended or has limitations. Banks
should evaluate the reasons for overrides and track and analyze
override perform ance. If the rate of overrides is high, or if the
override process consistently improves model perform ance,
it is often a sign that the underlying model needs revision or
redevelopm ent.
Benchmarking is the comparison of a given model's inputs and
outputs to estim ates from alternative internal or external data
or m odels. It can be incorporated in model developm ent as
well as in ongoing monitoring. For credit risk models, exam ples
of benchm arks include models from vendor firms or industry
consortia and data from retail credit bureaus. Pricing models
for securities and derivatives often can be com pared with alter­
native models that are more accurate or com prehensive but
also too time consuming to run on a daily basis. W hatever the
source, benchm ark models should be rigorous and benchmark
data should be accurate and com plete to ensure a reasonable
com parison.
Discrepancies between the model output and benchmarks
should trigger investigation into the sources and degree of
the differences, and examination of whether they are within an
expected or appropriate range given the nature of the com ­
parison. The results of that analysis may suggest revisions to the
model. However, differences do not necessarily indicate that the
model is in error. The benchm ark itself is an alternative predic­
tion, and the differences may be due to the different data or
methods used. If the model and the benchmark match well, that
is evidence in favor of the m odel, but it should be interpreted
with caution so the bank does not get a false degree of com fort.
Outcomes Analysis
The third core elem ent of the validation process is outcomes
analysis, a comparison of model outputs to corresponding actual
outcom es. The precise nature of the comparison depends on
the objectives of a model, and might include an assessm ent of
the accuracy of estim ates or forecasts, an evaluation of rank­
ordering ability, or other appropriate tests. In all cases, such
com parisons help to evaluate model perform ance, by establish­
ing expected ranges for those actual outcom es in relation to
the intended objectives and assessing the reasons for observed
variation between the two. If outcom es analysis produces evi­
dence of poor perform ance, the bank should take action to
address those issues. O utcom es analysis typically relies on sta­
tistical tests or other quantitative measures. It can also include
expert judgm ent to check the intuition behind the outcomes
and confirm that the results make sense. When a model itself
relies on expert judgm ent, quantitative outcom es analysis helps
to evaluate the quality of that judgm ent. O utcom es analysis
should be conducted on an ongoing basis to test whether the
model continues to perform in line with design objectives and
business uses.
A variety of quantitative and qualitative testing and analytical
techniques can be used in outcomes analysis. The choice of
technique should be based on the model's m ethodology, its
Chapter 8 Supervisory Guidance on Model Risk Management
com plexity, data availability, and the magnitude of potential
model risk to the bank. O utcom es analysis should involve a
range of tests because any individual test will have weaknesses.
For exam ple, some tests are better at checking a model's abil­
ity to rank-order or segm ent observations on a relative basis,
whereas others are better at checking absolute forecast accu­
racy. Tests should be designed for each situation, as not all will
be effective or feasible in every circum stance, and attention
should be paid to choosing the appropriate type of outcom es
analysis for a particular model.
Models are regularly adjusted to take into account new data or
techniques, or because of deterioration in perform ance. Parallel
outcom es analysis, under which both the original and adjusted
models' forecasts are tested against realized outcom es, provides
an im portant test of such model adjustm ents. If the adjusted
model does not outperform the original model, developers,
users, and reviewers should realize that additional changes— or
even a wholesale redesign— are likely necessary before the
adjusted model replaces the original one.
Back-testing is one form of outcomes analysis; specifically, it
involves the comparison of actual outcomes with model forecasts
during a sample time period not used in model development and
at an observation frequency that matches the forecast horizon or
performance window of the model. The comparison is generally
done using expected ranges or statistical confidence intervals
around the model forecasts. When outcomes fall outside those
intervals, the bank should analyze the discrepancies and inves­
tigate the causes that are significant in terms of magnitude or
frequency. The objective of the analysis is to determine whether
differences stem from the omission of material factors from the
model, whether they arise from errors with regard to other aspects
of model specification such as interaction terms or assumptions of
linearity, or whether they are purely random and thus consistent
with acceptable model performance. Analysis of in-sample fit and
of model performance in holdout samples (data set aside and not
used to estimate the original model) are important parts of model
development but are not substitutes for back-testing.
A well-known exam ple of back-testing is the evaluation of
value-at-risk (VaR), in which actual profit and loss is com pared
with a model forecast loss distribution. Significant deviation in
expected versus actual perform ance and unexplained volatility
in the profits and losses of trading activities may indicate that
hedging and pricing relationships are not adequately measured
by a given approach. Along with measuring the frequency of
losses in excess of a single VaR percentile estimator, banks
should use other tests, such as assessing any clustering of
exceptions and checking the distribution of losses against other
estim ated percentiles.
■ 145
Analysis of the results of even high-quality and well-designed
back-testing can pose challenges, since it is not a straightfor­
ward, mechanical process that always produces unambiguous
results. The purpose is to test the model, not individual forecast
values. Back-testing may entail analysis of a large number of
forecasts over different conditions at a point in time or over
multiple time periods. Statistical testing is essential in such
cases, yet such testing can pose challenges in both the choice of
appropriate tests and the interpretation of results; banks should
support and docum ent both the choice of tests and the inter­
pretation of results.
Models with long forecast horizons should be back-tested, but
given the amount of time it would take to accum ulate the neces­
sary data, that testing should be supplem ented by evaluation
over shorter periods. Banks should em ploy outcom es analysis
consisting of "early warning" metrics designed to measure
perform ance beginning very shortly after model introduction
and trend analysis of perform ance over tim e. These outcomes
analysis tools are not substitutes for back-testing, which should
still be perform ed over the longer tim e period, but rather very
im portant com plem ents.
O utcom es analysis and the other elem ents of the validation
process may reveal significant errors or inaccuracies in model
developm ent or outcom es that consistently fall outside the
bank's predeterm ined thresholds of acceptability. In such cases,
model adjustm ent, recalibration, or redevelopm ent is warranted.
Adjustm ents and recalibration should be governed by the prin­
ciple of conservatism and should undergo independent review.
Material changes in model structure or technique, and all model
redevelopm ent, should be subject to validation activities of
appropriate range and rigor before im plem entation. A t times
banks may have a limited ability to use key model validation
tools like back-testing or sensitivity analysis for various reasons,
such as lack of data or of price observability. In those cases,
even more attention should be paid to the model's limitations
when considering the appropriateness of model usage, and
senior m anagem ent should be fully informed of those limitations
when using the models for decision making. Such scrutiny
should be applied to individual models and models in the
aggregate.
Validation of Vendor and Other
Third-Party Products
The widespread use of vendor and other third-party products—
including data, param eter values, and com plete models— poses
unique challenges for validation and other model risk m anage­
ment activities because the modeling expertise is external to the
user and because some com ponents are considered proprietary.
146 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Vendor products should nevertheless be incorporated into a
bank's broader model risk m anagem ent fram ework following
the same principles as applied to in-house m odels, although the
process may be som ewhat modified.
As a first step, banks should ensure that there are appropriate
processes in place for selecting vendor models. Banks should
require the vendor to provide developm ental evidence explain­
ing the product com ponents, design, and intended use, to
determ ine whether the model is appropriate for the bank's prod­
ucts, exposures, and risks. Vendors should provide appropriate
testing results that show their product works as expected. They
should also clearly indicate the model's limitations and assum p­
tions and where the product's use may be problem atic. Banks
should expect vendors to conduct ongoing performance moni­
toring and outcomes analysis, with disclosure to their clients, and
to make appropriate modifications and updates over time.
Banks are expected to validate their own use of vendor prod­
ucts. External models may not allow full access to com puter
coding and implementation details, so the bank may have to
rely more on sensitivity analysis and benchm arking. Vendor
models are often designed to provide a range of capabilities
and so may need to be customized by a bank for its particular
circum stances. A bank's customization choices should be docu­
mented and justified as part of validation. If vendors provide
input data or assumptions, or use them to build m odels, their
relevance for the bank's situation should be investigated. Banks
should obtain information regarding the data used to develop
the model and assess the extent to which that data is repre­
sentative of the bank's situation. The bank also should conduct
ongoing monitoring and outcom es analysis of vendor model
perform ance using the bank's own outcom es.
System atic procedures for validation help the bank to under­
stand the vendor product and its capabilities, applicability, and
limitations. Such detailed knowledge is necessary for basic con­
trols of bank operations. It is also very im portant for the bank to
have as much knowledge in-house as possible, in case the ven­
dor or the bank term inates the contract for any reason, or if the
vendor is no longer in business. Banks should have contingency
plans for instances when the vendor model is no longer avail­
able or cannot be supported by the vendor.
8.6 G O V E R N A N C E , P O L IC IE S ,
AN D CO N TRO LS
Developing and maintaining strong governance, policies,
and controls over the model risk management framework is
fundamentally important to its effectiveness. Even if model devel­
opment, implementation, use, and validation are satisfactory,
a weak governance function will reduce the effectiveness of over­
all model risk management. A strong governance framework pro­
vides explicit support and structure to risk management functions
through policies defining relevant risk management activities,
procedures that implement those policies, allocation of resources,
and mechanisms for evaluating whether policies and procedures
are being carried out as specified. Notably, the extent and
sophistication of a bank's governance function is expected to
align with the extent and sophistication of model usage.
Board of Directors and Senior
Management
Model risk governance is provided at the highest level by the
board of directors and senior m anagem ent when they establish
a bank-wide approach to model risk m anagem ent. As part of
their overall responsibilities, a bank's board and senior man­
agem ent should establish a strong model risk m anagem ent
fram ework that fits into the broader risk m anagem ent of the
organization. That fram ework should be grounded in an under­
standing of model risk— not just for individual models but also
in the aggregate. The fram ework should include standards for
model developm ent, im plem entation, use, and validation.
W hile the board is ultimately responsible, it generally delegates
to senior m anagem ent the responsibility for executing and
maintaining an effective model risk m anagem ent fram ework.
Duties of senior m anagem ent include establishing adequate
policies and procedures and ensuring com pliance, assigning
com petent staff, overseeing model developm ent and im plem en­
tation, evaluating model results, ensuring effective challenge,
reviewing validation and internal audit findings, and taking
prompt remedial action when necessary. In the same manner
as for other major areas of risk, senior m anagem ent, directly
and through relevant com m ittees, is responsible for regularly
reporting to the board on significant model risk, from individual
models and in the aggregate, and on com pliance with policy.
Board members should ensure that the level of model risk is
within their tolerance and direct changes where appropriate.
These actions will set the tone for the whole organization about
the im portance of model risk and the need for active model risk
m anagem ent.
Policies and Procedures
Consistent with good business practices and existing
supervisory expectations, banks should form alize model risk
m anagem ent activities with policies and the procedures to
im plem ent them . Model risk m anagem ent policies should be
consistent with this guidance and also be com m ensurate with
Chapter 8 Supervisory Guidance on Model Risk Management
the bank's relative com plexity, business activities, corporate
culture, and overall organizational structure. The board or its
delegates should approve model risk m anagem ent policies and
review them annually to ensure consistent and rigorous prac­
tices across the organization. Those policies should be updated
as necessary to ensure that model risk m anagem ent practices
remain appropriate and keep current with changes in market
conditions, bank products and strategies, bank exposures and
activities, and practices in the industry. All aspects of model risk
m anagem ent should be covered by suitable policies, including
model and model risk definitions; assessm ent of model risk;
acceptable practices for model developm ent, im plem entation,
and use; appropriate model validation activities; and gover­
nance and controls over the model risk m anagem ent process.
Policies should em phasize testing and analysis, and promote
the developm ent of targets for model accuracy, standards for
acceptable levels of discrepancies, and procedures for review
of and response to unacceptable discrepancies. They should
include a description of the processes used to select and retain
vendor m odels, including the people who should be involved in
such decisions.
The prioritization, scope, and frequency of validation activities
should be addressed in these policies. They should establish
standards for the extent of validation that should be performed
before models are put into production and the scope of ongo­
ing validation. The policies should also detail the requirements
for validation of vendor models and third-party products. Finally,
they should require m aintenance of detailed docum entation of
all aspects of the model risk m anagem ent fram ework, including
an inventory of models in use, results of the modeling and vali­
dation processes, and model issues and their resolution.
Policies should identify the roles and assign responsibilities
within the model risk m anagem ent fram ework with clear detail
on staff expertise, authority, reporting lines, and continuity. They
should also outline controls on the use of external resources for
validation and com pliance and specify how that work will be
integrated into the model risk m anagem ent fram ework.
Roles and Responsibilities
Conceptually, the roles in model risk m anagem ent can be
divided among ownership, controls, and com pliance. W hile
there are several ways in which banks can assign the responsi­
bilities associated with these roles, it is im portant that reporting
lines and incentives be clear, with potential conflicts of interest
identified and addressed.
Business units are generally responsible for the model risk asso­
ciated with their business strategies. The role of model owner
■ 147
involves ultimate accountability for model use and perform ance
within the fram ework set by bank policies and procedures.
Model owners should be responsible for ensuring that models
are properly developed, im plem ented, and used. The model
owner should also ensure that models in use have undergone
appropriate validation and approval processes, promptly identify
new or changed models, and provide all necessary information
for validation activities.
Model risk taken by business units should be controlled. The
responsibilities for risk controls may be assigned to individu­
als, com m ittees, or a combination of the tw o, and include
risk m easurem ent, limits, and monitoring. O ther responsibili­
ties include managing the independent validation and review
process to ensure that effective challenge takes place. A ppropri­
ate resources should be assigned for model validation and for
guiding the scope and prioritization of work. Issues and prob­
lems identified through validation and other forms of oversight
should be com m unicated by risk-control staff to relevant individ­
uals and business users throughout the organization, including
senior m anagem ent, with a plan for corrective action. Control
staff should have the authority to restrict the use of models and
monitor any limits on model usage. W hile they may grant excep ­
tions to typical procedures of model validation on a tem porary
basis, that authority should be subject to other control m echa­
nisms, such as tim elines for com pleting validation work and lim­
its on model use.
Com pliance with policies is an obligation of model owners and
risk-control staff, and there should be specific processes in place
to ensure that these roles are being carried out effectively and
in line with policy. Docum entation and tracking of activities
surrounding model developm ent, im plem entation, use, and vali­
dation are needed to provide a record that makes com pliance
with policy transparent.
Internal Audit
A bank's internal audit function should assess the overall effec­
tiveness of the model risk m anagem ent fram ework, including
the fram ework's ability to address both types of model risk
described in Section III, for individual models and in the aggre­
gate. Findings from internal audit related to models should be
docum ented and reported to the board or its appropriately
delegated agent. Banks should ensure that internal audit oper­
ates with the proper incentives, has appropriate skills, and has
adequate stature in the organization to assist in model risk
m anagem ent. Internal audit's role is not to duplicate model risk
m anagem ent activities. Instead, its role is to evaluate whether
model risk m anagem ent is com prehensive, rigorous, and effec­
tive. To accomplish this evaluation, internal audit staff should
148 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
possess sufficient expertise in relevant modeling concepts as
well as their use in particular business lines. If some internal
audit staff perform certain validation activities, then they should
not be involved in the assessm ent of the overall model risk man­
agem ent fram ework.
Internal audit should verify that acceptable policies are in place
and that model owners and control groups comply with those
policies. Internal audit should also verify records of model use
and validation to test w hether validations are performed in a
tim ely manner and whether models are subject to controls that
appropriately account for any weaknesses in validation activities.
Accuracy and com pleteness of the model inventory should be
assessed. In addition, processes for establishing and monitor­
ing limits on model usage should be evaluated. Internal audit
should determ ine whether procedures for updating models are
clearly docum ented, and test whether those procedures are
being carried out as specified. Internal audit should check that
model owners and control groups are meeting documentation
standards, including risk reporting. Additionally, internal audit
should perform assessm ents of supporting operational systems
and evaluate the reliability of data used by models.
Internal audit also has an im portant role in ensuring that valida­
tion work is conducted properly and that appropriate effective
challenge is being carried out. It should evaluate the objectivity,
com petence, and organizational standing of the key validation
participants, with the ultimate goal of ascertaining whether
those participants have the right incentives to discover and
report deficiencies. Internal audit should review validation activi­
ties conducted by internal and external parties with the same
rigor to see if those activities are being conducted in accor­
dance with this guidance.
External Resources
Although model risk m anagem ent is an internal process, a bank
may decide to engage external resources to help execute cer­
tain activities related to the model risk m anagem ent fram ework.
These activities could include model validation and review, com ­
pliance functions, or other activities in support of internal audit.
These resources may provide added knowledge and another
level of critical and effective challenge, which may improve the
internal model developm ent and risk m anagem ent processes.
However, this potential benefit should be weighed against the
added costs for such resources and the added tim e that external
parties require to understand internal data, system s, and other
relevant bank-specific circum stances.
W henever external resources are used, the bank should specify
the activities to be conducted in a clearly written and agreed-
upon scope of work. A designated internal party from the bank
should be able to understand and evaluate the results of valida­
tion and risk-control activities conducted by external resources.
The internal party is responsible for: verifying that the agreed
upon scope of work has been com pleted; evaluating and
tracking identified issues and ensuring they are addressed; and
making sure that com pleted work is incorporated into the bank's
overall model risk m anagem ent fram ework. If the external
resources are only utilized to do a portion of validation or com ­
pliance work, the bank should coordinate internal resources to
com plete the full range of work needed. The bank should have a
contingency plan in case an external resource is no longer avail­
able or is unsatisfactory.
Model Inventory
Banks should maintain a com prehensive set of information for
models im plem ented for use, under developm ent for im ple­
m entation, or recently retired. W hile each line of business
may maintain its own inventory, a specific party should also be
charged with maintaining a firm-wide inventory of all models,
which should assist a bank in evaluating its model risk in the
aggregate. Any variation of a model that warrants a separate
validation should be included as a separate model and cross-
referenced with other variations.
W hile the inventory may contain varying levels of inform ation,
given different model com plexity and the bank's overall level
of model usage, the follow ing are som e general guidelines.
The inventory should describe the purpose and products
for which the model is designed, actual or exp ected usage,
and any restrictions on use. It is useful for the inventory to
list the type and source of inputs used by a given model and
underlying com ponents (which may include other m odels), as
well as model outputs and their intended use. It should also
indicate w hether m odels are functioning properly, provide
a description of when they w ere last updated, and list any
excep tio ns to policy. O ther items include the names of individ­
uals responsible for various aspects of the model developm ent
and validation; the dates of com pleted and planned valid a­
tion activities; and the tim e fram e during which the model is
exp ected to remain valid.
Documentation
W ithout adequate docum entation, model risk assessm ent and
m anagem ent will be ineffective. Docum entation of model devel­
opm ent and validation should be sufficiently detailed so that
parties unfamiliar with a model can understand how the model
operates, its limitations, and its key assumptions. Docum enta­
tion provides for continuity of operations, makes com pliance
Chapter 8 Supervisory Guidance on Model Risk Management
with policy transparent, and helps track recom m endations,
responses, and exceptions. D evelopers, users, control and
com pliance units, and supervisors are all served by effective
docum entation. Banks can benefit from advances in information
and knowledge m anagem ent system s and electronic docum en­
tation to improve the organization, tim eliness, and accessibility
of the various records and reports produced in the model risk
m anagem ent process.
Docum entation takes time and effort, and model developers
and users who know the models well may not appreciate its
value. Banks should therefore provide incentives to produce
effective and com plete model docum entation. Model develop­
ers should have responsibility during model developm ent for
thorough docum entation, which should be kept up-to-date as
the model and application environment changes. In addition,
the bank should ensure that other participants in model risk
m anagem ent activities docum ent their work, including ongoing
monitoring, process verification, benchm arking, and outcomes
analysis. Also, line of business or other decision makers should
docum ent information leading to selection of a given model and
its subsequent validation. For cases in which a bank uses models
from a vendor or other third party, it should ensure that appro­
priate docum entation of the third-party approach is available so
that the model can be appropriately validated.
Validation reports should articulate model aspects that were
reviewed, highlighting potential deficiencies over a range of
financial and econom ic conditions, and determ ining whether
adjustments or other com pensating controls are warranted.
Effective validation reports include clear executive summaries,
with a statem ent of model purpose and an accessible synopsis
of model and validation results, including major limitations and
key assumptions.
C O N C L U S IO N
This docum ent has provided com prehensive guidance on effec­
tive model risk m anagem ent. Many of the activities described
in this docum ent are common industry practice. But all banks
should confirm that their practices conform to the principles in
this guidance for model developm ent, im plem entation, and use,
as well as model validation. Banks should also ensure that they
maintain strong governance and controls to help manage model
risk, including internal policies and procedures that appropri­
ately reflect the risk m anagem ent principles described in this
guidance. Details of model risk m anagem ent practices may vary
from bank to bank, as practical application of this guidance
should be com m ensurate with a bank's risk exposures, its busi­
ness activities, and the extent and com plexity of its model use.
■ 149
 Learning Objectives
A fter com pleting this reading you should be able to:

Identify the most common issues that result in data errors. Describe the operational data governance process, includ­
ing the use of scorecards in managing information risk.
Explain how a firm can set expectations for its data quality
and describe some key dimensions of data quality used in
this process.

E x c e rp t is C hapter 3 o f Risk M anagem ent in Finance: Six Sigma and O ther N ext Generation Techniques, by A nthony Tarantino and
D eborah Cernauskas.

151
It would not be a stretch of the imagination to claim that
most organizations today are heavily dependent on the use
of information to both run and im prove the ways that they
achieve their business objectives. That being said, the reliance
on dependable information introduces risks to the ability of
a business to achieve its business goals, and this means that
no enterprise risk m anagem ent program is com plete without
instituting processes for assessing, m easuring, reporting,
reacting to, and controlling the risks associated with poor data
quality.
However, the consideration of information as a fluid asset,
created and used across many different operational and ana­
lytic applications, makes it difficult to envision ways to assess
the risks related to data failures as well as ways to monitor
conform ance to business user expectations. This requires some
exploration into types of risks relating to the use of information,
ways to specify data quality expectations, and developing a data
quality scorecard as a m anagem ent tool for instituting data gov­
ernance and data quality control.
In this chapter we look at the types of risks that are attributable
to poor data quality as well as an approach to correlating
business impacts to data flaws. Data governance (DG)
processes can contribute to the description of data quality
expectations and the definition of relevant metrics and
acceptability thresholds for monitoring conform ance to those
expectations. Com bining the raw metrics scores with measured
staff perform ance in observing data service-level agreem ents
contributes to the creation of a data quality scorecard for
managing risks.
9.1 ORGANIZATIONAL RISK,
BUSINESS IMPACTS, AND DATA
QUALITY
If successful business o perations rely on high-quality data,
then the opposite is likely to be true as w ell: flaw ed data
will delay or o b struct the successful com pletion of business
p ro cesses. D eterm ining the sp ecific im pacts that are related
to the different data issues that em erge is a challenging
process, but assessing im pact is sim plified through the char­
acterization of im pacts within a business im pact taxonom y.
C ate g o rie s in this taxonom y relate to asp ects of the busi­
ness's financial, co n fid en ce, and com pliance activities, yet all
business im pact categ o ries deal with en terp rise risk. Th ere
are tw o aspects of looking at inform ation and risk; the first
looks at how flaw ed inform ation im pacts organizational risk,
w hile the other looks at the typ es of data failures that create
the exp o su re.
152 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Business Impacts of Poor Data Quality
Many data quality issues may occur within different business
processes, and a data quality analysis process should incorpo­
rate a business im pact assessm ent to identify and prioritize risks.
To simplify the analysis, the business impacts associated with
data errors can be categorized within a classification scheme
intended to support the data quality analysis process and help
in distinguishing between data issues that lead to material busi­
ness impact and those that do not. This classification scheme
defines six primary categories for assessing either the negative
im pacts incurred as a result of a flaw, or the potential opportuni­
ties for im provem ent resulting from improved data quality:
1. Financial im pacts, such as increased operating costs,
decreased revenues, missed opportunities, reduction or
delays in cash flow, or increased penalties, fines, or other
charges.
2. Confidence-based im pacts, such as decreased organiza­
tional trust, low confidence in forecasting, inconsistent
operational and m anagem ent reporting, and delayed or
im proper decisions.
3. Satisfaction impacts such as customer, em ployee, or sup­
plier satisfaction, as well as general market satisfaction.
4. Productivity impacts such as increased workloads,
decreased throughput, increased processing tim e, or
decreased end-product quality.
5. Risk impacts associated with credit assessm ent, investment
risks, com petitive risk, capital investm ent and/or develop­
ment, fraud, and leakage.
6 . Com pliance is jeopardized, whether that com pliance is with
governm ent regulations, industry expectations, or self-
imposed policies (such as privacy policies).
Despite the natural tendency to focus on financial im pacts, in
many environments the risk and com pliance impacts are largely
com prom ised by data quality issues. Some exam ples to which
financial institutions are particularly sensitive include:
• Anti-m oney laundering aspects of the Bank Secrecy A ct and
the USA PATRIO T A ct have m andated private organizations
to take steps in identifying and preventing money laundering
activities that could be used in financing terrorist activities.
• Sarbanes-O xley, in which section 302 mandates that the
principal executive officer or officers and the principal finan­
cial officer or officers certify the accuracy and correctness of
financial reports.
• Basel II Accords provide guidelines for defining the regula­
tions as well as guiding the quantification of operational
and credit risk as a way to determ ine the amount of capital
 financial institutions are required to maintain as a guard
against those risks.
• The Gram m -Leach-Bliley A ct of 1999 mandates financial
institutions with the obligation to "respect the privacy of its
custom ers and to protect the security and confidentiality of
those custom ers' nonpublic personal inform ation."
• Credit risk assessm ent, which requires accurate docum enta­
tion to evaluate an individual's or organization's abilities to
repay loans.
• System developm ent risks associated with capital investment
in deploying new application systems em erge when moving
those system s into production is delayed due to lack of trust
in the application's underlying data assets.
W hile the sources of these areas of risk differ, an interesting
similarity em erges: not only do these mandate the use or pre­
sentation of high-quality information, they also require means of
dem onstrating the adequacy of internal controls overseeing that
quality to external parties such as auditors. This means that not
only must financial institutions manage the quality of organiza­
tional information, they must also have governance processes in
place that are transparent and auditable.
Information Flaws
The root causes for the business impacts are related to flaws in
the critical data elem ents upon which the successful com ple­
tion of the business processes depend. There are many types of
erred data, although these common issues lead to increased risk:
• Data entry errors
• Missing data
• Duplicate records
• Inconsistent data
• Nonstandard form ats
• C om plex data transform ations
• Failed identity m anagem ent processes
• Undocum ented, incorrect, or misleading metadata
All of these types of errors can lead to inconsistent report­
ing, inaccurate aggregation, invalid data m appings, incorrect
product pricing, and failures in trade settlem ent, among other
process failures.
9.2 EXAM PLES
The general approach to correlating business impacts to data
quality issues is not new, and in fact there are some interest­
ing exam ples that dem onstrate different types of risks that are
attributable to flaws (both inadvertent and deliberate) in data.
Chapter 9 Information Risk and Data Quality Management
Employee Fraud and Abuse
In 1997, the D epartm ent of D efense G uidelines on Data
Q uality categorized costs into four areas: prevention, appraisal,
internal failure, and external failure. In turn, the im pacts were
evaluated to assess costs to correct data problem s as opposed
to costs incurred by ignoring them . Further assessm ent looked
at direct costs (such as costs for appraisal, correction, or
support) versus indirect costs (such as custom er satisfaction).
That report docum ents exam ples of how poor data quality
im pacts specific business processes: " . . . the inability to match
payroll records to the official em ploym ent record can cost
millions in payroll overpaym ents to deserters, prisoners, and
'ghost' soldiers. In addition, the inability to correlate purchase
orders to invoices is a major problem in unm atched
d isb u rsem en ts."1
The 2006 Association of Certified Fraud Exam iners Report to
the Nation1
23details a number of methods that unethical
em ployees can use to modify existing data to commit fraudulent
payments. Invalid data is dem onstrated to have significant busi­
ness impacts, and the report details median costs associated
with these different types of im proper disbursem ents.
Underbilling and Revenue Assurance
N TL, a cable operator in the United Kingdom , anticipated
business benefits in improving the efficiency and value of an
operator's network through data quality im provem ent. Invalid
data translated into discrepancies between services provided
and services invoiced, resulting in a waste of unknown excess
capacity. Their data quality im provem ent program was, to some
extent, self-funded through the analysis of "revenue assurance
to detect under billing. For exam ple, . . . results indicated leak-
age of just over 3 percent of total revenue."
Credit Risk
In 2002, a Pricew aterhouseCoopers study on credit risk data
indicated that a significant percentage of the top banks were
deficient in credit risk data m anagem ent, especially in the areas
1 U.S. D ept, of D efense, "D o D G uidelines on Data Q uality M anage­
m ent," 1997, accessible via w w w .tricare.m il/ocfo/_docs/D oD G uidelines
O nD ataQ ualityM anagem ent.pdf.
"2006 A C F E Report to the Nation on O ccupational Fraud and A b u se ,"
w w w .acfe.com /docum ents/2006-rttn.p d f.
3 H erbert, Brian, "D ata Q uality M anagem ent— A Key to O perator
Profitability," Billing and O S S W orld, March 2006, accessible at www
.billingw orld.com /articles/feature/Data-Q uality-M anagem ent-A-Key-to-
O perator.htm l.
■ 153
of counterparty data repositories, counterparty hierarchy data,
common counterparty identifiers, and consistent data
standards.4
Insurance Exposure
A 2008 Ernst & Young survey on catastrophe exposure data
quality highlighted that "shortcom ings in exposure data quality
are com m on," and that "not many insurers are doing enough to
correct these shortcom ings," which included missing or inaccu­
rate values associated with insured values, locations, building
class, occupancy class, as well as additional characteristics.5
Development Risk
Experience with our clients has indicated a common pattern in
which significant investm ent in capital acquisitions and accom ­
panying software developm ent has been made in the creation of
new business application system s, yet the deploym ent of those
systems is delayed (or perhaps even canceled) due to organiza­
tional mistrust of the application data. Such delayed application
developm ent puts investments at risk.
Compliance Risk
Pharmaceutical companies are bound to abide by the federal
Anti-Kickback Statute, which restricts companies from offering or
paying remuneration in return for arranging for the furnishing of
items or services for which payment may be made under Medicare
or a state health care program. Pharmaceutical companies fund
research using their developed products as well as market those
same products to potentially the same pool of practitioners and
providers, so there is a need for stringent control and segregation
of the data associated with both research grants and marketing.
O ur exp erience with som e of our clients has shown that an
assessm ent of party inform ation contained within m aster
data sets indicated som e providers within the sam e practice
working under research grants while others within the same
practice subjected to m arketing. D espite the fact that no
individual appeared within both sets of data, the fact that
individuals rolled up within the sam e organizational hierarchy
4 Inserro, Richard J ., "C red it Risk Data Challenges Underlying the New
Basel Capital A cco rd ," R M A Journal, April 2002, accessible at w w w .pw c
.com /tr/eng/about/svcs/abas/frm /creditrisk/articles/pwc_baselcreditdata-
rm a.pdf.
5 Ernst & Young, "Raising the Bar on Catastrophe D ata," 2008, acces­
sible via w w w .ey.co m /G lob al/assets.nsf/U S/A ctuarial_R aising _the_b ar_
catastro phe_d ata/$file/A ctuarial_R aising _the_b ar_catastro phe_d ata.pd f.
154 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
exposed the organization to potential violation of the Anti-
Kickback Statute.
9.3 DATA Q U A L IT Y E X P E C T A T IO N S
These exam ples are not unique, but instead dem onstrate pat­
terns that commonly em erge across all types of organizations.
Knowledge of the business impacts related to data quality issues
is the catalyst to instituting data governance practices that can
oversee the control and assurance of data validity. The first step
toward managing the risks associated with the introduction of
flawed data into the environment is articulating the business user
expectations for data quality and asserting specifications that can
be used to monitor organizational conformance to those exp ec­
tations. These expectations are defined in the context of "data
quality dim ensions," high-level categorizations of assertions that
lend them selves to quantification, measurement, and reporting.
The intention is to provide an ability to characterize business
user expectations in term s of acceptability thresholds applied
to quantifiers for data quality that are correlated to the different
types of business im pacts, particularly the different types of risk.
And although the academ ic literature in data quality enum erates
many different dimensions of data quality, an initial develop­
ment of a data quality scorecard can rely on a subset of those
dim ensions, namely, accuracy, com pleteness, consistency, rea­
sonableness, currency, and identifiability.
Accuracy
The dimension of accuracy measures the degree with which data
instances compare to the "real-life" entities they are intended to
model. O ften, accuracy is measured in term s of agreem ent with
an identified reference source of correct information such as a
"system of record," a similar corroborative set of data values
from another table, com parisons with dynamically computed
values, or the results of manually checking value accuracy.
Completeness
The com pleteness dimension specifies the expectations regarding
the population of data attributes. Com pleteness expectations can
be measured using rules relating to varying levels of constraint—
mandatory attributes that require a value, data elements with
conditionally optional values, and inapplicable attribute values.
Consistency
Consistency refers to measuring reasonable comparison of
values in one data set to those in another data. Consistency is
relatively broad, and can encom pass an expectation that two
data values drawn from separate data sets must not conflict
with each other, or define more com plex com parators with a set
of predefined constraints. More formal consistency constraints
can be encapsulated as a set of rules that specify relationships
between values of attributes, either across a record or m essage,
or along all values of a single attribute.
However, be careful not to confuse consistency with accuracy
or correctness. Consistency may be defined between one set of
attribute values and another attribute set within the same record
(record-level consistency), between one set of attribute values
and another attribute set in different records (cross-record con­
sistency), or between one set of attribute values and the same
attribute set within the same record at different points in time
(temporal consistency).
Reasonableness
This dimension is used to measure conform ance to consistency
expectations relevant within specific operational contexts. For
exam ple, one might expect that the total sales value of all the
transactions each day is not expected to exceed 105 percent of
the running average total sales for the previous 30 days.
Currency
This dimension measures the degree to which information is cur­
rent with the world that it m odels. Currency measures whether
data is considered to be "fresh ," and its correctness in the face
of possible tim e-related changes. Data currency may be m ea­
sured as a function of the expected frequency rate at which
different data elem ents are expected to be refreshed, as well
as verifying that the data is up to date. Currency rules may be
defined to assert the "lifetim e" of a data value before it needs
to be checked and possibly refreshed.
Uniqueness
This dimension measures the number of inadvertent duplicate
records that exist within a data set or across data sets. Asserting
uniqueness of the entities within a data set implies that no entity
exists more than once within the data set and that there is a key
that can be used to uniquely access each entity (and only that
specific entity) within the data set.
Other Dimensions of Data Quality
This list is by no means com plete— there are many other aspects
of expressing the expectations for data quality, such as semantic
consistency (dealing with the consistency of meanings of data
elem ents), structural form at conform ance, tim eliness, and valid
ranges, valid within defined data domains, among many others.
Chapter 9 Information Risk and Data Quality Management
The principal concept is that the selected dimensions character­
ize aspects of the business user expectations and that they can
be quantified using a reasonable m easurem ent process.
9.4 MAPPING BUSINESS POLICIES
TO DATA RULES
Having identified the dimensions of data quality that are relevant
to the business processes, we can map the information policies
and their corresponding business rules to those dimensions. For
exam ple, consider a business policy that specifies that personal
data collected over the web may be shared only if the user has
not opted out of that sharing process. This business policy defines
information policies: the data model must have a data attribute
specifying whether a user has opted out of information sharing,
and that attribute must be checked before any records may be
shared. This also provides us with a measurable metric: the count
of shared records for those users who have opted out of sharing.
The same successive refinem ent can be applied to almost every
business policy and its corresponding information policies. As
we distill out the information requirem ents, we also capture
assertions about the business user expectations for the result
of the operational processes. Many of these assertions can be
expressed as rules for determ ining whether a record does or
does not conform to the expectations. The assertion is a quanti­
fiable m easurem ent when it results in a count of nonconforming
records, and therefore monitoring data against that assertion
provides the necessary data control.
O nce we have reviewed methods for inspecting and measuring
against those dimensions in a quantifiable manner, the next step
is to interview the business users to determ ine the acceptability
thresholds. Scoring below the acceptability threshold indi­
cates that the data does not m eet business expectations, and
highlights the boundary at which noncompliance with exp ecta­
tions may lead to material im pact to the downstream business
functions. Integrating these thresholds with the methods for
m easurem ent com pletes the construction of the data quality
control. Missing the desired threshold will trigger a data quality
event, notifying the data steward and possibly even recom ­
mending specific actions for mitigating the discovered issue.
9.5 DATA Q UALITY INSPECTION,
CON TROL, AND OVERSIGHT:
OPERATIONAL DATA G O V ERN A N CE
In this section we highlight the relationship between data issues
and their downstream im pacts, and note that being able to con­
trol the quality of data throughout the information processing
■ 155
flow will enable immediate assessm ent, initiation of rem ediation,
and an audit trail dem onstrating the levels of data quality as well
as the governance processes intended to ensure data quality.
O perational data governance is the manifestation of the pro­
cesses and protocols necessary to ensure that an acceptable level
of confidence in the data effectively satisfies the organization's
business needs. A data governance program defines the roles,
responsibilities, and accountabilities associated with managing
data quality. Rewarding those individuals who are successful at
their roles and responsibilities can ensure the success of the data
governance program. To measure this, a "data quality scorecard"
provides an effective management tool for monitoring organiza­
tional performance with respect to data quality control.
Operational data governance combines the ability to identify data
errors as early as possible with the process of initiating the activi­
ties necessary to address those errors to avoid or minimize any
downstream impacts. This essentially includes notifying the right
individuals to address the issue and determining if the issue can
be resolved appropriately within an agreed-to time frame. Data
inspection processes are instituted to measure and monitor compli­
ance with data quality rules, while service-level agreements (SLAs)
specify the reasonable expectations for response and remediation.
Note that data quality inspection differs from data validation.
W hile the data validation process reviews and measures confor­
mance of data with a set of defined business rules, inspection is
an ongoing process to:
• Reduce the number of errors to a reasonable and m anage­
able level.
• Enable the identification of data flaws along with a protocol
for interactively making adjustments to enable the com ple­
tion of the processing stream.
• Institute a mitigation or remediation of the root cause within
an agreed-to tim e fram e.
The value of data quality inspection as part of operational data
governance is in establishing trust on behalf of downstream
users that any issue likely to cause a significant business impact
is caught early enough to avoid any significant im pact on
operations. W ithout this inspection process, poor-quality data
pervades every system , com plicating practically any operational
or analytical process.
9.6 M ANAGING INFORMATION RISK
VIA A DATA Q UALITY SCO RECARD
W hile there are practices in place for measuring and monitoring
certain aspects of organizational data quality, there is an oppor­
tunity to evaluate the relationship between the business impacts
156 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
of noncompliant data as indicated by the business clients and
the defined thresholds for data quality acceptability. The degree
of acceptability becom es the standard against which the data is
m easured, with operational data governance instituted within
the context of measuring perform ance in relation to the data
governance procedures. This m easurem ent essentially covers
conform ance to the defined standards, as well as monitoring
staff agility in taking specific actions when the data sets do not
conform. Given the set of data quality rules, methods for m ea­
suring conform ance, the acceptability thresholds defined by the
business clients, and the SLAs, we can monitor data governance
by observing not only com pliance of the data to the business
rules, but of the data stewards to observing the processes asso­
ciated with data risks and failures.
The dimensions of data quality provide a fram ework for defin­
ing metrics that are relevant within the business context while
providing a view into controllable aspects of data quality man­
agem ent. The degree of reportability and controllability may
differ depending on one's role within the organization, and cor­
respondingly, so will the level of detail reported in a data quality
scorecard. Data stewards may focus on continuous monitoring in
order to resolve issues according to defined SLAs, while senior
managers may be interested in observing the degree to which
poor data quality introduces enterprise risk.
Essentially, the need to present higher-level data quality scores
introduces a distinction between two types of m etrics. The
simple metrics based on measuring against defined dim en­
sions of data quality can be referred to as "base-level" metrics,
and they quantify specific observance of acceptable levels of
defined data quality rules. A higher-level concept would be the
"co m p lex" metric representing a rolled-up score com puted as
a function (such as a sum) of applying specific weights to a col­
lection of existing m etrics, both base-level and com plex. The
rolled-up metric provides a qualitative overview of how data
quality impacts the organization in different ways, since the
scorecard can be populated with metrics rolled up across dif­
ferent dimensions depending on the audience. Com plex data
quality metrics can be accum ulated for reporting in a scorecard
in one of three different views: by issue, by business process,
or by business impact.
Data Quality Issues View
Evaluating the impacts of a specific data quality issue across
multiple business processes dem onstrates the diffusion of
pain across the enterprise caused by specific data flaws. This
scorecard schem e, which is suited to data analysts attem pt­
ing to prioritize tasks for diagnosis and rem ediation, provides
a rolled-up view of the impacts attributed to each data issue.
Drilling down through this view sheds light on the root causes of
im pacts of poor data quality, as well as identifying "rogue pro­
cesses" that require greater focus for instituting monitoring and
control processes.
Business Process View
O perational managers overseeing business processes may be
interested in a scorecard view by business process. In this view,
the operational m anager can exam ine the risks and failures
preventing the business process's achievem ent of the expected
results. For each business process, this scorecard schem e con­
sists of com plex metrics representing the impacts associated
with each issue. The drill-down in this view can be used for
isolating the source of the introduction of data issues at specific
stages of the business process as well as informing the data
stewards in diagnosis and remediation.
Business Impact View
Business impacts may have been incurred as a result of a num­
ber of different data quality issues originating in a number of
different business processes. This reporting schem e displays
the aggregation of business impacts rolled up from the dif­
ferent issues across different process flows. For exam ple, one
scorecard could report rolled-up metrics documenting the accu­
mulated im pacts associated with credit risk, com pliance with
privacy protection, and decreased sales. Drilling down through
the metrics will point to the business processes from which the
issues originate; deeper review will point to the specific issues
within each of the business processes. This view is suited to a
more senior m anager seeking a high-level overview of the risks
associated with data quality issues, and how that risk is intro­
duced across the enterprise.
Managing Scorecard Views
Essentially, each of these views composing a data quality score-
card require the construction and m anagem ent of a hierarchy of
metrics related to various levels of accountability for support the
organization's business objectives. But no matter which scheme
Chapter 9 Information Risk and Data Quality Management
is em ployed, each is supported by describing, defining, and
managing base-level and com plex metrics such that:
• Scorecards reflecting business relevance are driven by a hier­
archical rollup of metrics.
• The definition of metrics is separated from its contextual
use, thereby allowing the same m easurem ent to be used in
different contexts with different acceptability thresholds and
weights.
• The appropriate level of presentation can be materialized
based on the level of detail expected for the data consumer's
specific data governance role and accountability.
SUMMARY
Scorecards are effective m anagem ent tools when they can sum­
marize im portant organizational knowledge as well as alerting
the appropriate staff members when diagnostic or remedial
actions need to be taken. Part of an information risk m anage­
ment program would incorporate a data quality scorecard that
supports an organizational data governance program; this
program is based on defining metrics within a business context
that correlate the metric score to acceptable levels of business
perform ance. This means that the metrics should reflect the
business processes' (and applications') dependence on accept­
able data, and that the data quality rules being observed and
monitored as part of the governance program are aligned with
the achievem ent of business goals.
These processes simplify the approach to evaluating risks to
achievement of business objectives, how those risks are associated
with poor data quality and how one can define metrics that cap­
ture data quality expectations and acceptability thresholds. The
impact taxonomy can be used to narrow the scope of describing
the business impacts, while the dimensions of data quality guide
the analyst in defining quantifiable measures that can be cor­
related to business impacts. Applying these processes will result
in a set of metrics that can be combined into different scorecard
schemes that effectively address senior-level manager, operational
manager, and data steward responsibilities to monitor information
risk as well as support organizational data governance.
■ 157
Validating Rating
Models
Learning Objectives
A fter com pleting this reading you should be able to:

Explain the process of model validation and describe best Describe challenges related to data quality and explain
practices for the roles of internal organizational units in steps that can be taken to validate a model's data quality.
the validation process.
Explain how to validate the calibration and the discrim ina­
Com pare qualitative and quantitative processes to vali­ tory power of a rating model.
date internal ratings, and describe elem ents of
each process.

E x c e rp t is C hapter 5 o f Developing, Validating and Using Internal Ratings: M ethodologies and Case Studies, by G iacom o De
Laurentis, Renato M aino and Luca M olteni.

S e e bibliography on p p . 411-413.

159
10.1 VALIDATION PROFILES
Ratings system s validation scopes and steps are presented in
this chapter. As a rating system 'com prises all of the methods,
processes, controls, and data collection and IT system s that sup­
port the assessm ent of credit risk, the assignm ent of internal
risk ratings, and the quantification of default and loss estim ates'
(Basel Com m ittee, 2004, §394), it is clear that the validation
scope is quite wide.
The validation of internal ratings is strictly required by the Basel
Com m ittee (2004, §530) for banks willing to opt for Internal Rat­
ing Based (IRB) approaches: 'banks must have a robust system in
place to validate the accuracy and consistency of their internal
models and modeling processes. A bank must dem onstrate
to its supervisor that the internal validation process enables it
to assess the performance of its internal model and processes
consistently and meaningfully'. However, the validation of an
internal rating system is critical to the validation of the whole
credit risk m anagem ent system of a bank, both from a regulatory
point of view and from a business m anagem ent point of view.
It is crucial to the form er perspective because capital adequacy
depends on rating systems for banks adopting Internal Rat­
ing Based Approaches according to the Basel II regulation (the
use of IRB approaches for the purposes of calculating capital
requirem ents is subject to an explicit approval by national super­
visory authorities and follows a 'supervisory validation' of rating
systems). In addition, it is critical because Pillar 2 of Basel II is
focused on the adequacy of risk m anagem ent system s in order
to safely and rationally manage the bank. It is also critical from
the latter perspective because key decisions concerning indi­
vidual loans underwriting decisions as well as credit portfolio
m anagem ent decisions depend on rating system s.
Therefore, the difference in scope of 'regulatory validation' and
of 'internal validation' is more apparent than real. In addition,
consider that in order to be validated for regulatory purposes,
a system has to be previously internally validated; on top of
that, the technical contents of validation processes are very
similar in both cases. These are reasons why we are going to use
almost indifferent regulatory requirements as internal validation
requirements.
On an ongoing basis, in the validation process, the bank has to
verify the reliability of the results generated by the rating system
and its continued consistency with regulatory requirem ents and
operational needs. The validation instruments and methods are
periodically reviewed also, and adjusted and updated to ensure
that they remain appropriate in a context of continually evolv­
ing market variables and operating conditions. According to the
'proportionality principle', the scope and depth of quantitative
160 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and qualitative validation should be correlated with the type of
credit portfolios exam ined, the overall com plexity of the bank,
and the stability of markets.
Rating system s must undergo a validation process consisting of
a set of formal activities, instruments, and procedures for assess­
ing the accuracy of the estim ates of all material risk com ponents
and the predictive power of the overall perform ance system.
The Basel II regulation states that: 'The institution shall have a
regular cycle of model validation that includes monitoring of
model perform ance and stability, review of model relationships,
and testing of model outputs against outcom es.' (Basel Com m it­
tee, 2004, §417). However, the same regulation underlines that
the validation process lies not only on statistical com parisons of
actual risk measures against the ex ante estim ates, checking of
param eter calibrations, benchmarking and stress tests, but also
involves analyses of all the com ponents of the internal rating
system , including operational processes, controls, docum enta­
tion, IT infrastructure, as well as an assessm ent of their overall
consistency. Therefore, validation also requires the assessm ent
of the model developm ent process, with particular reference to
the underlying logical structure and the methodological criteria
supporting the risk param eter estim ates.
Validation includes, too, the critical verification that the rat­
ing system is actually used (and how) in the various areas of
bank operations. This is known as the 'use test', also required
by Basel II and better specified in Basel Com m ittee (2006).
The results of the validation process need to be adequately
docum ented and periodically subm itted to the internal control
functions and the governing bodies. The reports shall specifi­
cally address any problem areas.
Figure 10.1 gives an overview of the essential steps of rating
system s validation.
validation p ro cess.
In summary, the validation process has the key role of reviewing
model building steps and application choices, detecting w eak­
nesses and limitations, verifying the proper use of the system,
and last, but not least, analyzing contingent solutions planned
in case the robustness of the model falls or is lacking. Best
practices have to be monitored to minimize misalignments of
the whole process of internal credit risk m anagem ent.
10.2 ROLES O F INTERNAL
VALIDATION UNITS
The Basel II regulation is particularly innovative in term s of
organizational requirem ents and internal controls. The rules lay
down essential notions and criteria that banks must adopt in
developing their rating system s. They also set down the orga­
nizational and quantitative requirem ents banks must com ply
with for recognition of their m ethods for capital adequacy pur­
poses. The organizational requirem ents set rules which govern
organization and controls, internal validation of rating system s,
characteristics of rating system s (e .g ., replicability, integrity,
and consistency), their use in operations (use test), inform a­
tion system s and data flow s. The quantitative requirem ents
regard the structure of rating system s, the determ ination of
risk param eters, stress tests, and the use of m odels developed
by third-party vendors.
Specific requirem ents are set for the senior m anagem ent and
those who have roles in corporate governance and oversight.
'All m aterial aspects of the rating and estim ation processes
must be approved by the bank's board of directors or a d es­
ignated com m ittee th ereo f and senior m anagem ent. These
parties must possess a general understanding of the bank's risk
rating system and detailed com prehension of its associated
m anagem ent reports. Senior m anagem ent must provide notice
to the board of directors or a designated com m ittee th ereo f of
m aterial changes or exceptions from established policies that
will m aterially im pact the operations of the bank's rating sys­
tem ' (Basel Com m ittee, 2004, §438).
'Senior m anagem ent also must have a good understanding of
the rating system 's design and operation, and must approve
m aterial differences betw een established procedure and actual
practice. M anagem ent must also ensure, on an ongoing basis,
that the rating system is operating properly. M anagem ent
and staff in the credit control function must m eet regularly to
discuss the perform ance of the rating process, areas needing
im provem ent, and the status of efforts to im prove previously
identified deficiencies' (Basel C om m ittee, 2004, §439). Inter­
nal ratings must also be an essential part of the reporting to
these parties.
In perform ing these tasks, senior m anagem ent must consider
recom m endations produced by the validation process and
review reports produced by the internal audit unit.
The validation process is perform ed by a specific organi­
zational unit that may partially leverage on the support of
operational units in perform ing its activities. In sm aller banks,
the least that is needed is the appointm ent of a m anager
devoted to coordinate and oversee these activities.
To perform these tasks, the validation unit has to be inde­
pendent of other functions devoted to develop and to main­
tain model tools and to handle credit risk processes and
procedures. It is advisable that the validation unit is also inde­
pendent from those involved in assigning ratings and lending.
Specifically, persons in charge of the function should not be
subordinate to persons responsible for such activities.
Specific attention has to be paid to ensure the appropriate skills
of human resources em ployed.
W here com pliance with this requirem ent would prove to be
excessively burdensom e, the validation unit may be involved in
the rating system design and developm ent process, provided
that appropriate organizational and procedural, precautions
are adopted and respected. In such a case, the internal audit
function should verify that these activities are perform ed in an
independent manner, fully achieving the intended objectives.
The validation unit should also be independent from the inter­
nal audit function, which should review the validation process
and findings.
In short, validation and control processes and organizational
roles involved are depicted in Table 10.1.
A lso, the internal audit function is deeply involved in validation
processes, including the continued analysis of the com pli­
ance in the use of rating system s with internal and regulatory
requirem ents. In particular, it is necessary to audit the inde­
pendence of the validation unit and the quality of resources
involved.
Validation is mostly performed on the basis of the docum enta­
tion received by functions in charge of the model developm ent
and implementation in banks' credit processes. Therefore, the
scope, transparency, and com pleteness of docum entation are
essential; these characteristics are im portant validation criteria.
Banking groups with significant cross-border operations may
have different organizational structures in different countries.
Nevertheless, in all cases the parent company has to ensure
that the organization of the validation and review functions
within the group enable the unified m anagem ent and control of
models and rating systems.
Chapter 10 Validating Rating Models ■ 161
Table 10.1 Processes and Roles of Validation and Control of Internal Rating Systems

Models Procedures Tools Management Decision

Basic Controls Task: model develop­
ment and back testing
Owner: credit risk
models developm ent
unit
Task: credit Task: operations Task: lending policy
risk procedures maintenance applications
maintenance Owner: lending units/ Owner: central and
Owner: lending units/ IT/internal audit decentralized units/
internal control units internal control units

Second controls layer Task: continuous test of Task: lending policy

m odels/processes/tools suitability
perform ance Owner: validation unit/
Owner: lending unit/ internal audit
internal audit

Third controls layer Risk m anagem ent/CRO O rganisation/CO O Lending unit/C LO /C O O Lending unit/CLO /CRO

Accountability for Top m anagem ent/Surveillance board/Board of directors

supervisory purposes

C R O : C red it Risk O fficer; C L O : C h ief Lending O fficer; C O O : C h ief O perating O fficer; IT: Information Technology D epartm ent.

10.3 QUALITATIVE AND
QUANTITATIVE VALIDATION
There are two main areas of validation: qualitative and quanti­
tative. Q ualitative validation ensures the proper application of
quantitative methods and the proper usage of ratings. Q uanti­
tative validation com prises all validation procedures of ratings
in which statistical indicators are calculated and interpreted on
the basis of an empirical dataset. In recent years, many books
and articles have dealt with this topic, included among which
are Engelmann and Rauhm eier (2006) and Christodoulakis and
Satchell (2008).
Qualitative and quantitative validation com plem ent each other.
A rating procedure should only be applied in practice if it
receives a positive assessm ent in the qualitative area. A positive
assessm ent by the quantitative validation is not sufficient p e r
se. Conversely, a negative quantitative assessm ent should not
be considered decisive because statistical estim ates are subject
to random fluctuations and a certain degree of tolerance in the
interpretation of results should be allowed. It is, therefore, nec­
essary to place em phasis on qualitative validation.
Qualitative Validation
Rating Systems Design
Rating system s design concerns the proper choice of the models
architecture in relationship to the market segm ents in which the
model is going to be used. It is necessary to ensure the trans­
parency of the assumptions and/or evaluations which form the
basis of the rating models design. The general suitability of a
rating approach for specific rating segm ents has to be assessed.
A number of other areas must be investigated:
• consistency of model developm ent processes and
m ethodologies,
• adequate calibration of model output to default probabilities,
• proper docum entation of all model functions,
• analytical description of the rating process, with duties and
responsibilities of key personnel,
• the robust procedures in place for validation and regular review.
In addition, there are im portant organizational profiles of rating
system s' qualitative validation; they concern the link between
the model, process, procedures, approval powers, and con­
trols. Even the best model does not produce the expected
added value to bank lending if it is m isunderstood or if it is not
adequately supported in daily applications. In this perspective,
adequate education, clear procedures, proper guidelines, and
support in tackling exceptions are fundam ental. The assessm ent
of the actual use of rating systems in credit approval processes
is a key com ponent of qualitative validation. In fact, the model
must not only be a formal requirem ent for capital adequacy
purposes or portfolio decisions; it must be fully integrated in
the decision making process concerning single loans. If the bank
credit culture does not accept the new model-based rating
assignm ent processes, the risk of having two different processes
(one being formal but inactive and the other informal but used
in daily lending decisions) is very high. The validation has to
detect these situations and suggest how to overcom e them .
In the earlier stages of rating system s developm ent in a bank, it
commonly happens that credit risk functions spend a lot of time

162 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
on model building, number crunching, statistical testing, and so
on. Procedural aspects are underestimated in term s of the tim e,
resources, and investments needed, as they are erroneously
considered less problem atic and easier to overcom e. Since these
early stages, the role of the validation unit in detecting the orga­
nizational readiness to accept and to correctly apply the new
rating system is essential. The validation unit should have great
visibility to top m anagem ent and should lever on it in order to
ask enough resources to properly take off the new process.
The essential requirem ents of rating system s that need to be
checked in qualitative validation can be summarized in the fol­
lowing five main features:
• obtaining probabilities of default
• com pleteness
• objectivity
• acceptance
• consistency.
O btaining p ro b a b ilities o f d efa u lt Ratings are the basis for
alm ost all risk m anagem ent applications once they have been
quantified and probabilities of default have been obtained. In
this perspective, different methods of rating assignm ent pro­
duce PDs in distinctive ways. Statistical models are developed
on the basis of an empirical dataset, which makes it possible
to determ ine the PD for individual rating classes by calibrat­
ing results with the empirical data. Logistic regression enables
the direct calcu latio n of default probabilities, while for other
methods (e.g ., discriminant analysis) a specific adjustm ent is
needed. Likewise, it is possible to validate the calibration of the
rating model (ex post) using data gathered from the operational
deploym ent of the model. Using this data, the default param ­
eter can be constantly monitored and validated over tim e to
maintain PDs aligned with real world outcom es.
Rating sy ste m co m p leten ess Com pleteness is the next impor­
tant feature of an internal rating system . In order to ensure
the com pleteness of credit rating procedures, banks need to
take all available information into account when assigning rat­
ings to borrowers or transactions (Basel Com m ittee, 2004,
§417). The nature of the chosen rating assignm ent approach
strongly impacts on this feature. Many default risk models use
a small number of characteristics of the borrower to infer its
creditworthiness. For this reason, it is im portant to verify the
com pleteness of factors used to determ ine a counterpart's
creditworthiness, at least in model building stages and/or in the
operational use (for instance, analyzing the scope of overrides
proposed by a credit analyst). In the estimation of statistical-
based m odels, as a large number of borrowers' characteristics
can be tested, the possibility to force variables to enter into the
model in order to increase the com pleteness of the relevant risk
factors should be verified. Usually, the computer-based pro­
cessing of information enables expert system s and fuzzy logic
system s to take a larger number of characteristics into consider­
ation, meaning that such system s can be more com prehensive if
properly m odeled.
Rating system o b je c tiv ity A good rating system needs pro­
cedures that capture creditworthiness factors clearly and also
minimize room for interpretation. Achieving high discriminatory
power of ratings requires that they are assigned as objectively
as possible, minimizing biases. In judgm ent-based approaches
this can only be ensured by precise and plausible guidelines,
common cultural backgrounds, appropriate training, ongoing
benchm arking, and adequate organizational choices (team work,
supervision, balancing individual analysts' specialization by sec­
tor, and analysts' team s' cross-sector mix). In statistical models,
borrowers' characteristics are selected and weighed using an
empirical dataset and objective methods; therefore, we can
regard these models as the most 'objective' rating procedures.
When the model is fed by the same information, unavoidably
the same results are obtained. This is also the case for expert
system s and neural networks, where borrowers' creditworthiness
is determ ined using defined algorithms and rules.
Rating system acceptance Rating system s have also to be
accepted by users, above all, internal users such as credit ana­
lysts, credit officers, and loan officers. Therefore, some require­
ments are necessary:
a. The rating system should not produce classifications that
are very often too far from those expected by bank analysts
and officers;
b. For small and medium enterprises, mechanical rating m od­
els often have higher discrim inatory power than a poorly
structured judgm ent-based approach developed by poorly
experienced and trained credit officers. However, they
are less easily accepted because many actors do not have
enough technical knowledge to understand them . Hence,
an adequate education and level of disclosure on model
fram eworks for all actors involved in the lending process are
indispensable.
Therefore, the validation process has to verify that rating models
are well understood and shared by the users.
Different rating approaches have different degrees of acceptabil­
ity. Generally speaking, as heuristic models are designed on the
basis of experts' experience in lending, these models are more
easily accepted; their credit assessments are considered warm er
by end-users because they replicate their common culture. The
acceptance of fuzzy logic systems may be lower as they require
a greater degree of technical knowledge due to their fuzzy
Chapter 10 Validating Rating Models ■ 163
algorithms and changing variables' weights in different con­
texts. One severe disadvantage for the acceptance of artificial
neural networks lies in their 'black box' nature. The increase in
discriminatory power achieved by such methods depends on the
network's ability to learn and on the parallel processing of infor­
mation within the network. However, it is precisely this com plex­
ity which makes it difficult to comprehend results.
R atin g sy s te m c o n siste n c y Consistency is the last but not
least feature. Models have to be coherent and suitable for the
borrowers to which they are applied and with the theoretical
fram eworks of users. When developing a statistical rating model,
relationships between indicators may arise which contradict eco­
nomic theory. Such contradictory indicators have to be excluded
from further analyses; filtering out these problem atic indicators
serves to ensure consistency. Heuristic models do not contradict
recognized scientific theories and methods, as these models are
based on the experience and observations of credit experts.
Pure statistical models depict business inter-relationships directly
from empirical datasets and consistency should be checked.
The Basel II regulation states specific validation requirements
in case statistical models and other mechanical methods are
used to assign borrower or facility ratings or in estimation of
PDs, LG D s, or EA D s (Basel Com m ittee, 2004, §417). First of all,
it is recognized that 'Although mechanical rating procedures
may som etim es avoid some of the idiosyncratic errors made by
rating systems in which human judgem ent plays a large role,
mechanical use of limited information also is a source of rating
errors. Credit scoring models and other mechanical procedures
are perm issible as the primary or partial basis of rating assign­
ments, and may play a role in the estimation of loss charac­
teristics. Sufficient human judgem ent and human oversight is
necessary to ensure that all relevant and material information,
including that which is outside the scope of the model, is also
taken into consideration, and that the model is used appropri­
ately'. This means that models must be part of a broader rating
system , in which other m ethodologies add further information
and expertise assuring com pleteness.
O ther requirem ents of §417 are as follows: 'the burden is on
the bank to satisfy its supervisor that a model or procedure has
good predictive power and that regulatory capital requirements
will not be distorted as a result of its use. The variables that are
input to the model must form a reasonable set of predictors.
The model must be accurate on average across the range of
borrowers or facilities to which the bank is exposed and there
must be no known material biases. The bank must have in place
a process for vetting data inputs into a statistical default or loss
prediction model which includes an assessm ent of the accuracy,
com pleteness and appropriateness of the data specific to the
assignm ent of an approved rating. The bank must dem onstrate
164 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
that the data used to build the model are representative of the
population of the bank's actual borrowers or facilities. When
combining model results with human judgem ent, judgem ents
must take into account all relevant and material information not
considered by the model. The bank must have written guidance
describing how human judgem ent and model results are to be
com bined. The bank must have procedures for human review of
model based rating assignm ents. Such procedures should focus
on finding and limiting errors associated with known model
weaknesses and must also include credible ongoing efforts to
improve the model's perform ance . . . The influence of individual
factors on rating results should be com prehensible and in line
with the current business research and practice. For exam ple, if
a multivariate statistical method is applied, factors in a statistical
ratio analysis have to be plausible and com prehensible, accord­
ing to the fundam entals of financial statem ent analysis and the
econom ic theory of the firm .'
Therefore, in Paragraph 417 of the Basel II regulation, all five
essential requirements (obtaining probabilities of default, com ­
pleteness, objectivity, acceptance, consistency) for a satisfactory
rating system have been detailed.
The same Basel II paragraph indicates two other important
aspects of validation processes, that is to say, the continuity of
validation processes and the com pleteness of docum entation:
'The bank must have a regular cycle of model validation that
includes monitoring of model performance and stability; review
of model relationships; and testing of model outputs against
outcomes . . . In statistical models, special emphasis is to be
placed on documenting the models statistical foundations, which
have to be in line with the standards of quantitative validation.'
In examining all these features, the validation unit also has to
take carefully into account external benchm arks, such as special­
ist literature and com petitors application. The rating system is
a decisional tool and can dram atically harm the bank's ability
to com pete if it is not aligned with those used by direct incum­
bents in the market.
Data Quality
In statistical m odels, data quality is essential. Good data give
outstanding results also using simple m odels, whereas the most
advanced models cannot overcom e poor data quality. Th ere­
fore, a com prehensive dataset is an essential prerequisite for
quantitative validation. In this context, a number of qualitative
aspects have to be considered:
• com pleteness of data,
• volume of available data,
• representativeness of sam ples used for model developm ent
and validation,
• consistency and integrity of data sources,
• adequacy of procedures used to ensure data cleansing and,
in general, data quality.
The validation unit has a central role in confirming the dataset
quality.
Particularly relevant are the reliability and com pleteness of
defaulted observations because these are the actual limit to
develop adequately large datasets for model developm ent,
rating quantification, and validation. The consistency of default
definition used throughout data collection processes (that per­
haps take place in different institution of a bank group, in dif­
ferent periods and countries) and its com pliance with the Basel
II definition of default (Basel Com m ittee, 2004, §452) are both
critical. Sample size is im portant as well as sample hom ogeneity:
ideally, a sam ple has to be generated from a unique popula­
tion using the same procedures, criteria, and m ethodology over
the tim e. In other words, the sam ple must be generated by the
same 'lending technology'. This is the set of information, rules,
contracts, and policies applied to credit origination and moni­
toring; changing one or more of these com ponents changes
the credit portfolio generation and the borrowers' profile in the
dataset (Berger and Udell, 2006) and can harm the consistency
between the model developm ent dataset and the population to
which the model is operationally applied to.
A further profile of data quality is the time span to which data
refers. Ideally, the dataset should be generated by considering
an entire credit cycle; otherwise, estimates will be dependent on
specific favorable or unfavorable cycle stages. Macroeconomic
conditions are one of the most important determinants of default
rates. If we miss a good representation of the credit cycle we
miss something really relevant in describing default probability.
The combination of the last two mentioned conditions (lending
technology stability and credit cycle coverage) proves to be very
restrictive. We rarely observe procedures and processes that
remain constant for five or more years of an entire credit cycle
(the last started in 2002 and ended in 2008). Changes are more
frequent because of the increasing technological opportuni­
ties to speed up processes and efficiency, discontinuities in the
econom ic environm ent that lead to radically modifying credit
policies, and new market segm ents becoming relevant; banks'
mergers and acquisitions strongly im pact on many aspects of
the lending technology, too.
The validation process also has to pay attention to preliminary
data treatm ent activities (such as finding and managing outliers,
missing values, and poor data representativeness for some cus­
tom ers' segm ents).
Data quality is so relevant that the validation unit has to dedi­
cate specific attention to these aspects. Figure 10.2 depicts the
Fiaure 10.2 From samples to market population:
data relationships.
conceptual structure of data links from the model developm ent
dataset to the m arket the bank potentially confronts with.
Sam ples used in model building should have some desirable
technical properties (low heteroscedasticity, no abnormal values,
and so forth). Actual populations do not share these properties.
The best way to extend a model's findings to populations is to
apply a proper calibration and to perform out-of-sam ple analy­
ses. These analyses are based on observations that are gener­
ated by the same lending technology but that were not included
in the developm ent sam ple. As a result, it is advisable to build
various sam ples, one dedicated to support model building and
others used for out-of-sample, out-of-time, and out-of-universe
validations of a model's perform ance.
The validation unit has an essential role in assessing two critical
aspects: (i) stability of the lending technology behind data and
(ii) proper model calibration in order to generalize results from
sample to population. The two issues overlap, to some extent. If
the observed in-sample default rate diverges from the total pop­
ulation, then calibration should reflect this divergence because
the sample's central tendency would be different from the popu­
lation's central tendency. This may simply be due to the fact that
bank's lending technology is selecting borrowers better or worse
than com peting banks. This circumstance may also occur when
lending technology changes: if the model is not re-calibrated, it
continues to apply old criteria to new states of business. This is
typically the case when m ergers, acquisitions, dem ergers and so
forth determ ine a change in the bank's lending technology.
The validation unit should be fully aware of the consequences
of lending technology changes as well as of misalignments
between borrowers' profiles in the original sam ple and popula­
tion's profiles. If the rupture is significant, an extraordinary phase
of model revision would be needed, at least in term s of model
calibration.
Focus on calibration. Suppose that we use a balanced sam ­
ple (50% perform ing, 50% defaulting borrowers) for model
Chapter 10 Validating Rating Models ■ 165
 Calibration effects on model scores
Cumulated percentiles
Balanced sample score distribution (def.rate 50%)
Population score distribution (calibration at def.rate 2,34%)
— — - Population score distribution (calibration at def.rate 1,0%)
Fiqure 10.3 Calibratio n effects on m odel score
estim ated PD s using different long term averag e
default rates.
developm ent in order to assure the best conditions for applying
statistical methods: luckily, real banks' loan portfolios are much
less risky. In other words, a normal long term annual default rate
may be close to 2.5% ; this value is far away from the 50% of the
balanced sam ple. Moreover, defaults cluster together during the
credit cycle with significant changes in default co-dependencies.
The impact on calibration is significant; even small changes in
model calibration have a big influence on a model's cut-off and
on estim ated default rates.
Figure 10.3 illustrates estim ated PDs in a balanced sam ple, in a
population where the default rate is 2.4% , and in a population
whose default rate is 1%.
An inaccuracy in determ ining the long term average annual
default rate modifies default probability measures. In fact, the
lending process is relatively slow in producing evident results,
also due to credit cycle m ovem ents. A credit cycle lasts years,
not days or w eeks. The central tendency (in statistics) is the
average value to which population characteristics converge after
many repetitions of the same process (this is the law of large
numbers). Think about tossing a coin: after a few tosses, we
cannot understand if the coin has been manipulated or not; we
need a large number of trials in order to be sure that the coin is
m anipulated. The statistical repetitions in lending activities are
relatively limited and it takes tim e to directly assess the effects
of an incorrect parameter. Normally, a robust check on the
validity of the central tendency is only possible after 18 or 36
months, depending on m arkets, types of facilities, and custom ­
ers' segm ents.
In any case, the central tendency is a compromise between
having long empirical series of observations and constant lend­
ing technology. Therefore, to set the central tendency is a very
166 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
delicate issue that soon becom es a m atter of discretion. The
calibration turns into a managerial decision, which is partly
based on empirical evidence and partly depends on strate­
gies and policies (such as fixing the implicit 'risk appetite' of
the organization). O ptim istic estim ates (default rate lower than
actual) reduce the risk perception and determ ine aggressive
com petitive policies. If rating is also used for pricing purposes,
then prices would not fully reflect the credit risk em bedded in
transactions (and loss provisions would be underestim ated). On
the contrary, if the estim ated default rate is pessim istic, a con­
servative credit policy would be adopted, which would lead to
missed business opportunities, to overestim ated provisions, and
to lower credit market shares.
In conclusion, the validation unit has an im portant role in verify­
ing the central tendency over tim e through back testing and
stress testing. It should carefully monitor m arket prices, signals
from marketing people, results of big ticket transactions (syndi­
cated loans, securities placing, securitisation, and so forth) and
fully exploit any other opportunity to benchm ark the bank (and
models used) against direct com petitors.
Quantitative Validation
Q uantitative validation covers four main areas:
1. Sample representativeness of the reference population at
the time of the estim ates and in subsequent periods.
2. Discriminatory power: the accuracy of ratings assignments
in term s of the m odels' ability to rank obligors by risk levels,
both in the overall sample and in its different breakdowns
(for exam ple, based on business sector, size and location).
3. Dynamic properties: the stability of rating system s and
properties of migration matrices.
4. Calibration: the predictive power concerning probabilities
of default.
We have already dealt with the issues of data quality exten­
sively. Here we consider the perspective of sam ples size. N owa­
days, the real constraint is usually given by the subsam ple size
of defaulted firms, as some loan portfolios are characterized by
very few defaults. As risks of these 'low-default portfolios' have
to be assessed in any case, rating system s have to be developed
and validated. A set of principles should be taken into consid­
eration. Firstly, we cannot exclude exposures from the scope of
application of the rating model simply because insufficient data
are available to validate the risk param eter estim ates on a sta­
tistical basis. In these cases, the validation unit has to contribute
to set an adequate margin of conservatism in the assumption
of risk param eters. Moreover, validation has to pay particular
attention to analysis techniques adopted in this estimation
process and to their limitations. Many statistical tests depend
on the amount of available information. For instance, for the
Chi-square test to give accurate results when dealing with con­
tingency tables cross-tabulating a dichotomous variable, such
as default/non-default with many rating classes, no more than
20% of cells should contain expected default frequencies less
than five and no cells should have expected frequencies less
than one. In many cases, minimum sam ple size requirements
are not achieved, mainly due to the small number of defaults.
This is particularly true when we are building models for market
'niches' or for specific industries (that are maybe im portant for
their econom ic im pact but that are com posed by few com ­
petitors and counterparties). In these cases, we need to apply
specific techniques to give more robustness to our estim ates
(Wehrspohn 2004, Basel Com m ittee 2005b, Pluto and Tasche,
2004); among them , 'bootstrap procedures' have an important
place. These procedures randomly generate many samples.
Retaining the number of (the few) available defaults, many bal­
anced sam ples can be iteratively generated by extracting an
equal number of units from the non-defaulted group, without
re-introduction. On each of these sam ples the rating model is
com pletely re-assessed, extracting the entire set of statistical
information (variables selected, means, standard deviations, like­
lihood tests, and so on). The set of models is then analyzed. If
a clear convergence on a final stable result (i.e., same final vari­
able selected, equivalent param eters, and so on) is found, we
can infer that the model solution is stable and robust enough.
If not, there would be a severe risk of instability and a more
in-depth analysis would be needed. A way to overcom e these
problems is to find more homogenous subsets (applying cluster
analysis, for instance). The model could be adapted to the sp e­
cific features of these subsets, adopting different calibrations
or integrating a specific successive qualitative analysis, maybe
based on experts' judgm ents.
The term 'discrim inatory power' refers to the fundam ental ability
of a rating model to differentiate between defaulting and per­
forming borrowers over the forecasting horizon. Note that the
forecasting horizon is usually set at 12 months for PD estimation
(this also is a Basel II requirement) but the relevant tim e horizon
for rating validation is the one set for rating assessm ent: in this
last case, Basel II also requires a longer time horizon. Therefore,
it is necessary to use longer forecasting horizons in order to
validate discrim inatory power. For exam ple, the discriminatory
power of a scoring model for installment loans is often calcu­
lated for the entire period of the credit transaction.
The discrim inatory pow er of a model can only be review ed
ex post using data on defaulted and non-defaulted cases
(back testing). Therefore, using a longer tim e horizon means
using an 'observation period' that is more distant from 'tim e
zero' and from the collection tim e of data which feeds model
explanatory variables.
On the basis of the resulting sam ple, various analyses of the
rating discrim inatory power are possible. The list of methods in
Basel Com m ittee (2005a) is:
• statistical tests such as Fisher's r2, W ilks' A,
Hosmer-Lemeshow;
• migration matrices;
• accuracy indexes such as Lorentz's concentration curves
and Gini ratios (in different variants, for instance RO C and
A uR O C );
• classification tests (binomial test, type 1 and type 2 errors, x 2
test, normality test and so forth).
The frequency distribution of good and bad cases is particularly
important. In fact, error rates are the best way to offer a glimpse
on model perform ances. The validation unit has to carefully
verify the cut-off choice, its calibration, and its consequence in
daily operations (as 'false good' cases create loss given default,
and 'false bad' cases cause opportunity costs).
Ratings stability can be assessed by observing 'migration
m atrices'. They can be built once the rating system has been
operational for at least two years. Desirable properties of annual
migration matrices are:
• Transition rates to default should be in ascending order as
rating classes worsen.
• High values should be on the diagonal and low values off-
diagonal, which would signal that ratings are stable over
tim e. This is also an indication of a through-the-cycle rating
model, as opposed to point-in-time ratings, which are much
more dynamic during the credit cycle, moving frequently
from one class to another.
• Off-diagonal values should be in descending order when
departing from the diagonal. That is to say, migration rates of
plus or minus one class should be higher than migration rates
of plus or minus two classes, and so forth. This means that
rating movements are gradual whereas sudden leaps of many
classes at one tim e are not that frequent.
These properties have to also hold for longer time horizons
than one year, despite a natural reduction in on-diagonal values
and an increase in off-diagonal values. This means that ratings
change over time but without large leaps.
If analyses of firms' fundam entals are dominant in rating assign­
ment, ratings change slowly over tim e because they are less
sensitive to credit cycles and to transitory circum stances. Th ere­
fore, stability of the migration m atrix is generally assumed as an
indicator of an analytical process which is mainly centered on
Chapter 10 Validating Rating Models ■ 167
counterparty's fundam entals, and hence as an expression of a
forward looking rating system.
This is a desirable technical property for many econom ic rea­
sons, such as lower pro-cyclical effects (on banks, firms and,
hence, on the econom y as a whole) and longer 'far-sightedness'
of credit allocation (Draghi, 2009).
Calibration is a key topic in quantitative validation. It is also a
critical issue because of the scarcity of statistical tools that are
available. A docum ent issued by the Basel Com m ittee which is
entirely dedicated to the validation of internal rating system s,
clearly states that: 'com pared with the evaluation of the discrim i­
natory power, methods for validating calibration are at a much
earlier stage . . . Due to the limitations of using statistical tests
to verify the accuracy of the calibration, benchmarking can be a
valuable com plem entary tool for the validation of estim ates for
the risk com ponents PD, LGD and EA D . Benchmarking involves
the comparison of a bank's ratings or estim ates to results from
alternative sources. It is quite flexible in the sense that it gives
banks and supervisors latitude to select appropriate bench­
marks' (Basel Com m ittee, 2005a, p. 3).
Therefore, validating calibration means analyzing differences
between forecasted PDs and realized default rates. The Basel
Com m ittee paper indicates a few tests to assess proper cali­
bration: Binomial test, Chi-square test (or Hosmer-Lemeshow),
Normal test, and Traffic lights approach. W hile the Binomial test
is applied to one rating category at a tim e, the Chi-square test
sim ultaneously checks several rating categories. The normal test
is applied to a single rating class but is a multiperiod test of cor­
rectness of default probability forecasts; it is based on a normal
approximation of the distribution of the tim e-averaged default
rates (and on the assumptions that the mean default rate does
not vary too much over tim e and that default events in different
years are independent). The Traffic light approach is a m ultipe­
riod back testing tool for a single rating category introduced
with the 1996 M arket Risk Am endm ent as a supervisory evalu­
ation tool of internal m arket risk m odels. Each of these tests
bears im portant limitations. Therefore, we can conclude with the
Basel Com m ittee's words: 'at present no really powerful tests of
adequate calibration are currently available' (Basel Com m ittee,
2005a, p. 34).
Back Testing, Benchmarking and Stress Testing
Back testing (accuracy of risk param eter estim ates when com ­
pared with ex p o st em pirical evidence), benchmarking (relative
perform ance of system s and risk param eter estim ates against
benchm arks), and stress testing (adequacy of models when
stress tests are applied) are three fundam ental activities for vali­
dating rating systems.
168 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
W hen back testing, realized default rates must regularly be com ­
pared with estim ated PDs for each rating grade. W here they do
not fall within the expected range for that grade, the validation
unit should analyze the reasons of deviations. Internal standards
should be set for situations where deviations from expectations
in realized PDs becom e significant enough to call the validity
of estim ates into question. These standards may take account
of business cycles and similar system atic variability in default
experiences. W here actual values continue to be higher than
expected values, the bank should revise estim ates upwards to
reflect their default experience.
When benchm arking, the validation unit establishes procedures
to specify acceptable deviations between internal estim ates and
benchm ark data and identifies, at least in general term s, the
actions to be taken when such deviations significantly exceed
acceptable levels. Banks should also identify possible sources
of unexpected volatility that could affect benchmarking results
over tim e. This analysis should be conducted at least once a
year. The adequacy and reliability of benchmarks is obviously
critical. The com parisons of synthetic measures of rating perfor­
mance must be carefully considered, as some very common indi­
cators are sam ple dependent (such as Gini ratio and A uR O C ). It
is much better to have benchm ark datasets for testing different
models on the same set of data.
Regarding a model's stress testing, the validation unit should
assess the robustness and reliability of models' results when
their independent variables are set to indicate extrem e
conditions.
Benchm arking, stress testing and, above all, back testing should
be reported in an effective, easy to understand and transpar­
ent way to top managers. This would enhance the internal
communication strategy of the validation unit: the clearer the
com m unication, the more effective a top manager's contribu­
tion (to improve rating system s and to enhance rating validation
activities) is.
As an exam ple, suppose a bank has 15,000 internally rated cus­
tom ers; the internal rating system is based on 17 classes, w ith­
out considering defaulted counterparties (Table 10.2).
Table 10.3 shows the loan portfolio by rating class at the begin­
ning and at the end of the observation period. As indicated
throughout this book, a number of perform ance measures and
statistical tests can be calculated.
Effective and simple representation of this data is im portant to
com m unicate to top managers and other bank personnel as
well. Table 10.4 and Figure 10.4 illustrate a comparison between
expected and actual default rates per rating classes. Deviations
from means are highly frequent, mainly because of the effects
of credit cycles. In periods of econom ic expansion, lower quality
Table 10.2 Internal Rating Classification
Probability of Default (%) Range (%)
Rating Class Min Mean Max Lower Bound Upper Bound
1 0.01 0.03 0.04 - 0.02 0.01
2 0.04 0.05 0.06 - 0.01 0.01
3 0.06 0.07 0.08 - 0.01 0.01
4 0.08 0.10 0.12 - 0.02 0.02
5 0.12 0.15 0.19 - 0.03 0.04
6 0.19 0.25 0.30 - 0.05 0.05
7 0.30 0.40 0.50 - 0.10 0.10
8 0.50 0.60 0.75 - 0.10 0.15
9 0.75 0.90 1.15 - 0.15 0.25
10 1.15 1.35 1.70 - 0.20 0.35
11 1.70 2.00 2.50 - 0.30 0.50
12 2.50 3.00 3.75 - 0.50 0.75
13 3.75 4.50 5.50 - 0.75 1.00
14 5.50 7.00 8.50 - 1.50 1.50
15 8.50 10.00 13.00 - 1.50 3.00
16 13.00 15.00 20.00 - 2.00 5.00
17 20.00 25.00 50.00 - 5.00 25.00

Table 10.3 Example of Portfolio Evolution in the Observation Period

Rating Initial Portfolio at Observation Period End Frequency Distribution by Class (%)
Classes Portfolio Defaults Non-defaulted Default Non-default
# Units % Cumulated Cumulated Cumulated Cumulated
1 15 0.1 0 0 15 15 0.0 0.0 0.1 0.1
2 38 0.3 0 0 38 53 0.0 0.0 0.3 0.4
3 23 0.2 1 1 22 74 0.3 0.3 0.1 0.5
4 105 0.7 0 1 105 179 0.0 0.3 0.7 1.2
5 150 1.0 0 1 150 329 0.0 0.3 1.0 2.2
6 375 2.5 3 4 372 701 0.8 1.1 2.5 4.8
7 1170 7.8 4 8 1166 1.867 1.1 2.2 8.0 12.8
8 2138 14.3 6 14 2132 3.999 1.6 3.8 14.6 27.3
9 1725 11.5 5 19 1720 5.719 1.4 5.2 11.8 39.1
10 1650 11.0 15 34 1635 7.354 4.1 9.3 11.2 50.3
11 2100 14.0 32 66 2068 9.422 8.7 18.0 14.1 64.4
12 2250 15.0 55 121 2195 11.617 15.0 33.0 15.0 79.4
13 1200 8.0 56 177 1144 12.761 15.3 48.2 7.8 87.2
14 750 5.0 58 235 692 13.453 15.8 64.0 4.7 91.9
15 675 4.5 72 307 603 14.056 19.6 83.7 4.1 96.1
16 525 3.5 45 352 480 14.536 12.3 95.9 3.3 99.3
17 113 0.7 15 367 98 14.633 4.1 100.0 0.7 100.0
15000 100.0 367 14633 100.0 100.0

Chapter 10 Validating Rating Models ■ 169

Table 10.4 Exam p le of A ctual V alues ag ain st E x p e cte d V alues in a Portfolio during a Favo rab le C re d it C ycle

Default Rate (%)

Defaults Actual A Actual versus
Rating Classes # Central PD (%) Expected Defaults Actual Expected Survival Rate (%)
1 0.03 0 0 0.0 0.0 100.0
2 0.05 0 0 0.0 0.0 100.0
3 0.07 0 1 4.4 4.4 95.6
4 0.10 0 0 0.0 - 0.1 100.0
5 0.15 0 0 0.0 - 0.2 100.0
6 0.25 1 3 0.8 0.6 99.2
7 0.40 5 4 0.3 - 0.1 99.7
8 0.60 13 6 0.3 - 0.3 99.7
9 0.90 16 5 0.3 - 0.6 99.7
10 1.35 22 15 0.9 - 0.4 99.1
11 2.00 42 32 1.5 - 0.5 98.5
12 3.00 68 55 2.4 - 0.6 97.6
13 4.50 54 56 4.7 0.2 95.3
14 7.00 53 58 7.7 0.7 92.3
15 10.00 68 72 10.7 0.7 89.3
16 15.00 79 45 8.6 - 6.4 91.4
17 25.00 28 15 13.3 - 11.7 86.7
447 367 2.4 97.6

deviations have a meaningful impact on portfolio perform ance.

Therefore, these effects need to be carefully managed to avoid
miscommunication (from this perspective, indicators like RO C
curve are particularly suitable).

Linking crude data of rating classifications to bank's lending

policy is useful for managers and for effective communication.
Figure 10.5 offers a way to illustrate this analysis. On the graph

Frequency distribution of default and no-default per rating cla sse s

— — - PD min Confidence at 67% (dx)
25.0%
PD central Confidence at 90% (dx)

— — PD max Confidence at 99% (dx)

Actual def.Rate Confidence at 99,9% (dx) 20 .0 % -

£
Figure 10.4 D efault rates p er rating class and
8
i?
> 15.0% -
O
o
c

statistical co n fid en ce intervals. *

fc

&
Q.

c 10 .0 %
a>
-
Credit
3
restriction/
classes perform better than expected; the reverse would be true
CT

recall/
ro
r, 5.0% - withdrawal
<
3

in periods of recessions. This is a well known phenom enon, well

docum ented by rating agencies migration matrices observed in 0 .0 %
t— i— i— i— i— i— i— i— r
different periods. 7 8 9 10 11 12 13 14 15 16 17 18

Internal rating classes

When classes have few units, unexpected events hugely effect Type 2 errors ■ ■ ■ Actual default frequency

relative deviations but have a small econom ic impact (see class 3 Type 1 errors Actual non-default frequency

for instance). The opposite is true for larger classes: even small Figure 10.5 D efault rates and lending policy.

170 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the frequency distributions of actual defaulted and non-defaulted
counterparts are shown. O f course, the two groups have different
distributions and there is a large overlapping area. Rating classes
are often the main drivers for bank lending policies. Different
commercial policies are put into practice in respect of counter­
party's credit risk, favoring aggressive marketing for safer clients
and conservative lending behaviors for riskier ones. Suppose that
aggressive marketing is pursued for better classes up to class 6,
while a conservative approach is recommended from class 14
onwards. This policy neither protects against defaults in classes
that benefit from aggressive marketing, nor avoids restricting
lending to solvent counterparties. In our exam ple, the target for
aggressive marketing is around 700 clients (the first 5% of the
portfolio) but three defaults were experim ented (the first 1.1%
of total defaults); see the gray area on the left in Figure 10.5. A t
the same time, if we withdraw credit to the worst three classes,
130 defaults could be avoided but business with 1200 clients
would be lost (gray area on the right in Figure 10.5).
The im portance of a model's discrim inatory power and ade­
quate calibration becom es evidently clear. The usefulness of
having clues on these perform ance measures of rating systems
becom es apparent. Also, the value of a prompt detection of
fading discrim inatory power and calibration becom es evident.
Chapter 10 Validating Rating Models ■ 171
Assessing the
Quality of Risk
Measures
Learning Objectives
A fter com pleting this reading you should be able to:

Describe ways that errors can be introduced into models.
Explain how model risk and variability can arise through
the im plem entation of VaR models and the mapping of
risk factors to portfolio positions.
Explain major defects in model assumptions that led
to the underestimation of system atic risk for residential
m ortgage backed securities (RMBS) during the 2007-2009
financial downturn.

Identify reasons for the failure of the long-equity tranche,

short-mezzanine credit trade in 2005 and describe how
such modeling errors could have been avoided.

E x c e rp t is from C hapter 11 o f Financial Risk M anagem ent: M odels, History, and Institutions, by Allan M. Ma/z.
VaR has been subjected to much criticism . Previously we
reviewed the sharpest critique: that the standard normal return
model underpinning most VaR estimation procedures is simply
wrong. But there are other lines of attack on VaR that are rele­
vant even if VaR estim ates are not based on the standard model.
This chapter discusses three of these viewpoints:
1. The devil is in the details: Subtle and not-so-subtle differ­
ences in how VaR is com puted can lead to large differences
in the estim ates.
2. VaR cannot provide powerful tests of its own accuracy.
3. VaR is "philosophically" incoherent: It cannot do what it
purports to be able to do, namely, rank portfolios in order
of riskiness.
We will also discuss a pervasive basic problem with all models,
including risk models: the fact that they can err or be used
inappropriately.
11.1 M O D E L R ISK
The basic modeling problem facing VaR is that the actual dis­
tribution of returns doesn't conform to the model assumption
of normality under which VaR is often com puted. Using a VaR
implementation that relies on normality without appreciating
the deviations of the model from reality is an exam ple of m odel
risk. Models are used in risk m easurem ent as well as in other
parts of the trading and investm ent process. The term "m odel
risk" describes the possibility of making incorrect trading or risk
m anagem ent decisions because of errors in models and how
they are applied. Model risk can manifest itself and cause losses
in a number of ways. The co n seq u en ces of model error can be
trading losses, as well as adverse legal, reputational, accounting,
and regulatory results.
All social science models are "w ro ng ," in the sense that model
assumptions are always more or less crude approxim ations to
reality. In Friedm an's (1953) view on the m ethodology of eco­
nomics, deviation from reality is a virtue in a m odel, because the
model then more readily generates testable hypotheses that
can be falsified em pirically, adding to knowledge. The so-called
Black-Scholes biases provide very useful insights into return
behavior, and yet are defined as violations of the model predic­
tions. A model may, however, be inherently wrong, in that it is
based on an incorrect overall view of reality. The data inputs can
be inaccurate, or may be inappropriate to the application.
Error can be introduced into models in any number of ways.
A seem ingly trivial channel, but one that can have large conse­
quences, is that the programming of a model algorithm can
contain bugs. An exam ple occurred in the ratings process for
174 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
structured credit products, and was revealed during the sub­
prime crisis. The press reported in May 2008 that Moody's had
incorrectly, given their own ratings m ethodology, assigned A A A
ratings to certain structured credit products using materially
flawed program m ing. Another exam ple occurred when A X A
Rosenberg Group LLC, an asset-m anagem ent subsidiary of the
French insurance com pany A X A , using a quantitative investment
approach, discovered a programming error in its models that
had likely induced losses for some investors.1
These episodes also provide exam ples of the linkages between
different types of risk. In the Moody's case, the model risk was
closely linked to the reputational and liquidity risks faced by
Moody's. The error had been discovered by Moody's before
being reported in the press, but had coincided with changes in
the ratings m ethodology for the affected products, and had not
resulted in changes in ratings while still known only within the
firm. Moody's therefore, once the bugs becam e public knowl­
edge, came under suspicion of having tailored the ratings model
to the desired ratings, tarnishing its reputation as an objective
ratings provider. W ithin a few days of the episode being
reported, S&P placed Moody's-issued commercial paper on
negative watch, illustrating the econom ic costs that reputational
risk events can cause. In the A X A Rosenberg episode, the dis­
covery of the error had not been communicated in a tim ely fash­
ion to investors, resulting in loss of assets under m anagem ent,
an S EC fine, and considerable overall reputational dam age.
Even when software is correctly program m ed, it can be used in
a way that is inconsistent with the model that was intended to
be im plem ented in the software. O ne type of inconsistency that
arises quite frequently concerns the mapping of positions to risk
factors, which we'll discuss in a moment. Such inconsistencies
can contribute to differences in VaR results.
Valuation Risk
Model errors can occur in the valuation of securities or in hedging.
Errors in valuation can result in losses that are hidden within
the firm or from external stakeholders. A portfolio can be more
exposed to one or more risk factors than the portfolio manager
realizes because of hedging errors.
Valuation errors due to inaccurate m odels are exam ples of
m arket risk as well as of operational risk. As a m arket risk phe­
nom enon, they lead, for exam ple, to buying securities that
are thought to be cheaply priced in the m arket, but are in fact
1 On M oody's, see Sam Jo n e s, Gillian Tett, and Paul J . Davies, "C P D O s
expose ratings flaw at M oody's," Financial Tim es, May 20, 2008. On
A X A Rosenberg, see Jean Eaglesham and Jen n y Strasburg, "B ig Fine
O ver Bug in 'Q uant' Program ," Wall S tre e t Journal, Feb. 4, 2011.
fairly priced or overpriced. A s an operational risk phenom enon,
the difficulty of valuing some securities accurately m akes it pos­
sible to record positions or trades as profitable that have in fact
lost money.
Model errors can, in principle, be avoided and valuation risk
reduced, by relying on market prices rather than model prices.
There are several problems with this approach of always
marking-to-market and never m arking-to-m odel. Some types
of positions, such as longer-term bank commercial loans, have
always been difficult to mark-to-market because they do not
trade frequently or at all, and because their value is determ ined
by a com plex internal process of monitoring by the lender.
Accounting and regulatory standards mandating marking such
positions to market have been held responsible by some for
exacerbating financial instability.
Variability of VaR Estimates
VaR also faces a wide range of practical problems. To understand
these better, we'll first briefly sketch the implementation process
for risk computation. This entire process and its results are some­
times referred to as the firm's "VaR m odel." We'll then discuss how
implementation decisions can lead to differences in VaR results.
Risk m anagem ent is generally carried out with the aid of com ­
puter system s that automate to some extent the process of
combining data and com putations, and generating reports.
Risk-measurement system s are available com m ercially. Vendor
system s are generally used by sm aller financial firms. Large firms
generally build their own risk-measurement system s, but may
purchase some com ponents com mercially.
One particular challenge of implementing risk-measurement sys­
tem s is that of data preparation. Three types of data are involved:
M arket data are time series data on asset prices or other data
that we can use to forecast the distribution of future portfolio
returns. Obtaining appropriate tim e series, purging them
of erroneous data points, and establishing procedures for
handling missing data, are costly but essential for avoiding
gross inaccuracies in risk m easurem ent. Even with the best
efforts, appropriate market data for some exposures may
be unobtainable.
Security m aster data include descriptive data on securi­
ties, such as maturity dates, currency, and units. Corporate
securities such as equities and, especially, debt securities
present particular challenges in setting up security master
databases. To name but one, issuer hierarchy data record
which entity within a large holding com pany a transaction is
with. Such databases are difficult to build and maintain, but
are extrem ely im portant from a credit risk m anagem ent point
Chapter 11 Assessing the Quality of Risk Measures
of view. Netting arrangem ents, for exam ple, may differ for
trades with different entities. Such issues becom e crucial if
counterparties file for bankruptcy. O ne im portant exam ple
from the subprim e crisis: Recovery by Lehman's counterpar­
ties depended in part on which Lehman subsidiary they had
faced in the transactions.
Position data must be verified to match the firm's books and
records. Position data may have to be collected from many
trading system s and across a number of geographical loca­
tions within a firm.
To com pute a risk measure, software is needed to correctly
match up this data, and present it to a calculation engine. The
engine incorporates all the formulas or computation procedures
that will be used, calling them from libraries of stored proce­
dures. The calculations have to be combined with the data
appropriately. Results, finally, must be conveyed to a reporting
layer that manufactures docum ents and tables that human man­
agers can read. All of these steps can be carried out in myriad
ways. We focus on two issues, the variability of the resulting
m easures, and the problem of using data appropriately.
The computation process we've just described applies to any
risk measure, not just to VaR, but for concreteness, we focus on
VaR. The risk manager has a great deal of discretion in actually
computing a VaR. VaR techniques— modes of computation and the
user-defined parameters— can be mixed and matched in different
ways. Within each mode of computation, there are major variants,
for example, the so-called "hybrid" approach of using historical
simulation with exponentially weighted return observations. This
freedom is a mixed blessing. On the one hand, the risk manager has
the flexibility to adapt the way he is calculating VaR to the needs of
the firm, its investors, or the nature of the portfolio. On the other
hand, it leads to two problems with the use of VaR in practice:
1. There is not much uniformity of practice as to confidence
interval and time horizon; as a result, intuition on what con­
stitutes a large or small VaR is underdeveloped.
2. Different ways of measuring VaR would lead to different
results, even if there were standardization of confidence
interval and time horizon. There are a number of com puta­
tional and modeling decisions that can greatly influence VaR
results, such as
• Length of time series used for historical simulation or to
estim ate moments
• Technique for estimating moments
• Mapping techniques and the choice of risk factors, for
exam ple, maturity bucketing
• Decay factor if applying EW M A
• In Monte Carlo simulation, randomization technique and
the number of simulations
■ 175
Dram atic changes in VaR can be obtained by varying these
param eters. In one well-known study (Beder, 1995), the VaRs of
relatively simple portfolios consisting of Treasury bonds and S&P
500 index options were com puted using different com binations
of these param eters, all of them well within standard practice.
For exam ple, 100 or 250 days of historical data might be used
to com pute VaR via historical simulation, or Monte Carlo VaR
might be com puted using different correlation estim ates. For a
given time horizon and confidence level, VaR com putations dif­
fered by a factor of six or seven tim es. O ther oddities included
VaR estim ates that were higher for shorter time horizons.
A number of large banks publish VaR estim ates for certain of
their portfolios in their annual reports, generally accom panied
by backtesting results. These VaR estim ates are generated
for regulatory purposes. Perusing these annual reports gives
a sense of how different the VaR models can be, as they use
inconsistent param eters and cannot be readily com pared.
Mapping Issues
M apping, the assignm ent of risk factors to positions, can also
have a large impact on VaR results. Some decisions about map­
ping are pragm atic choices among alternatives that each have
their pros and cons. An exam ple is the choice between cash
flow versus duration-convexity mapping for fixed-incom e. Cash
flow mappings are potentially more accurate than duration m ap­
pings, since, in the former, each cash flow is mapped to a fixed
income security with a roughly equal discount factor, to which
the latter is clearly only an approxim ation. But cash flow m ap­
ping requires using many more risk factors and more com plex
com putations, which are potentially more expensive and entail
risks of data errors and other model risks.
In other cases, it may be difficult to find data that address cer­
tain risk factors. Such mapping problem s may merely mirror
the real-world difficulties of hedging or expressing some trade
ideas. An exam ple is the practice, said to be widespread prior
to the subprim e crisis, of mapping residential m ortgage-backed
securities (RM BS) and other securitized credit products to time
series for corporate credit spreads with the same rating. M arket
data on securitization spreads generally is sparse, available only
for very generic types of bonds and hard to update regularly
from observed market prices. Prior to the crisis, the spread vola­
tility of investm ent-grade securitizations was lower than those of
corporate bonds with similar credit ratings. Yet during the finan­
cial crisis, spreads on securitizations w idened, at least relatively,
far more than corporate spreads. This episode illustrates not
only the model risks attendant on proxy m apping, but also the
inefficacy of VaR estim ates in capturing large moves in market
prices and the im portance of stress testing.
176 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Another exam ple is convertible bond trading. Convertible
bonds can be mapped to a set of risk factors including, among
others, implied volatilities, interest rates, and credit spreads.
Such mappings are based on the theoretical price of a convert­
ible bond, which is arrived at using its replicating portfolio.
However, at times theoretical and market prices of converts can
diverge dram atically. These divergences are liquidity risk events
that are hard to capture with market data, so VaR based on the
replicating portfolio alone can drastically understate risk. This
problem can be mitigated through stress testing.
In some cases, a position and its hedge might be mapped to the
same risk factor or set of risk factors. The mapping might be jus­
tified on the grounds that the available data do not make it pos­
sible to discern between the two closely related positions. The
result, however, will be a measured VaR of zero, even though
there is a significant basis risk; that is, risk that the hedge will
not provide the expected protection. Risk modeling of securi­
tization exposures provides a pertinent exam ple of basis risk,
too. Securitizations are often hedged with similarly-rated corpo­
rate CD S indexes. If both the underlying exposure and its C D X
hedge are mapped to a corporate spread tim e series, the m ea­
sured risk disappears.
For some strategies, VaR can be misleading for reasons over and
above the distribution of returns and VaR's dependence on sp e­
cific modeling choices. For some strategies, outcom es are close
to binary. O ne exam ple is event-driven strategies, a broad class
of strategies that includes trades that depend on the occurrence
of term s of a corporate acquisition or merger, the outcome of
bankruptcy proceedings, or of lawsuits. For many such trades,
there is no historical tim e series of return data that would shed
light on the range of results. Another exam ple are dynamic
strategies, in which the risk is generated by the trading strategy
over time rather than the set of positions at a point in tim e.
Case Study: The 2005 Credit Correlation
Episode
An episode of volatility in the credit markets that occurred in the
late spring of 2005 provides a case study of model risk stemming
from misinterpretation and misapplication of models. Some trad­
ers suffered large losses in a portfolio credit trade in which one
dimension of risk was hedged in accordance with a model, while
another dimension of risk was neglected. We start by reviewing
the mechanics of the trade, which involved credit derivatives
based on C D X .N A .IG , the investment grade CD S index.
Description of the Trade and Its Motivation
A widespread trade among hedge funds, as well as proprietary
trading desks of banks and brokerages, was to sell protection on
the equity tranche and buy protection on the junior mezzanine
tranche of the C D X .N A .IG . The trade was thus long credit and
credit-spread risk through the equity tranche and short credit
and credit-spread risk through the mezzanine. It was executed
using several C D X .N A .IG series, particularly the IG3 introduced
in Septem ber 2004 and the IG4 introduced in March 2005.
is —$6,880. The defaultOI of the mezzanine is —0.07212 times
the notional value, so the defaultOI of a $1,000,000 notional
position is —$721. With a hedge ratio of about 9.54— that is,
by shorting $9,540,000 of par value of the mezzanine for every
$1,000,000 notional of long equity— we create a portfolio that,
at the margin, is default-risk neutral.

The trade was designed to be default-risk-neutral at initiation, Figure 11.1 illustrates how the trade was set up. A t a default
by sizing the two legs of the trade so that their credit spread rate of 0.003, the portfolio has zero sensitivity to a small rise or
sensitivities were equal. The motivation of the trade was not decline in defaults. But the trade has positive convexity. The
to profit from a view on credit or credit spreads, though it was equity cheapens at a declining rate in response to spread w iden­
primarily oriented toward market risk. Rather, it was intended ing. A noteworthy feature is that, because at low default rates,
to achieve a positively convex payoff profile. The portfolio of the mezzanine tranche has negative convexity, the short position
two positions would then benefit from credit spread volatility. adds positive convexity to the portfolio. The trade benefits from
In addition, the portfolio had positive carry; that is, it earned a changes in the default rate in either direction. The actual C D X
positive net spread. Such trades are highly prized by traders, for trade benefitted from large credit spread changes. It behaved,
whom they are akin to delta-hedged long option portfolios in in essence, like an option straddle on credit spreads. In contrast
which the trader receives rather than paying away time value. to a typical option, however, this option, when expressed using
the C D X standard tranches at the market prices prevailing in
To understand the trade and its risks, we can draw on the tools
early 2005, paid a premium to its owner, rather than having
we developed earlier. The securities in the extended exam ple
negative net carry.
are similar enough in structure to the standard tranches of the
C D X .N A .IG that we can mimic the trade and understand what In the actual standard tranche trade, the mechanics were
went wrong. Let's set up a trade in tranches of illustrative C LO slightly different. Since the securities were synthetic C D O
that is similar in structure and motivation to the standard tranche liabilities, traders used spread sensitivities; that is, spreadO ls
trade we have been describing. The trade takes a long credit or risk-neutral defaultO ls, rather than actuarial defaultO ls. The
risk position in the equity tranche and an offsetting short credit sensitivities used were not to the spreads of the underlying
position in the mezzanine bond. Bear in mind that
we would unlikely be able, in actual practice, to
take a short position in a cash securitization, since
the bond would be difficult to locate and bor­
row. We might be able to buy protection on the
mezzanine tranche through a C D S, but the dealer
writing it would probably charge a high spread
to com pensate for the illiquidity of the product
and the difficulty of hedging it, in addition to the
default and correlation risk. The standard tranches
are synthetic C D S and their collateral pools also
consist of C D S. They are generally more liquid
than most other structured products, so it is eas­
ier to take short as well as long positions in them .

To determ ine the hedge ratio, that is, the amount

of the mezzanine we are to short, we use the
default sensitivities, the defaultO ls. These are
credit-risk sensitivities, while the 2005 C D X trade
em ployed market-risk sensitivities, the spreadO ls.
But the mechanics of hedging are similar. We
assume that, at the tim e the trade is initiated,
the expected default rate and implied correla­
tion are tt = 0.03 and p = 0.30. The defaultOI
of a $1,000,000 notional position in the equity
F ia u re 11.1 Convexity of CLO liabilities.
The graph plots the P&L, for varying default rates, of a portfolio consisting of (1) a long
credit position in the equity tranche of the C LO with a notional am ount of $1,000,000,
and (2) a short credit position in the mezzanine tranche of the same C LO with a notional
amount of $1,000,000 tim es the hedge ratio of 9.54, that is, a par value of $9,540,000.
The P&Ls of the constituent positions are also plotted. The default rates vary in the graph,
but the correlation is fixed at 0.30. That is, the hedge ratio is set at a default rate of
3 percent, and a correlation of 0.30, but only the default rate is perm itted to vary in
the plot. The default rates are m easured on the horizontal axis as decim als. The P&L is
expressed on the vertical axis in millions of dollars.

Chapter 11 Assessing the Quality of Risk Measures ■ 177

constituents of the C D X .N A .IG , but to the tranche spread. The
hedge ratio in the actual trade was the ratio of the P&L impact
of a 1 bp widening of C D X .N A .IG on the equity and on the junior
mezzanine tranches. The hedge ratio was between 1.5 and 2 at
the beginning of 2005, lower than our exam ple's 9.54, and at
the prevailing tranche spreads, resulted in a net flow of spread
income to the long equity/short mezz trade. However, the trade
was set up at a particular value of implied correlation. As we will
see, this was the critical error in the trade.
One additional risk should be highlighted, although it did not in
the end play a crucial role in the episode we are describing: The
recovery amount was at risk. In the event of a default on one or
more of the names in the index, the recovery amount was not
fixed but a random variable.
The Credit Environment in Early 2005
In the spring of 2005, the credit markets came under pressure,
focused on the autom obile industry, but not limited to it. The
three large U.S.-dom iciled original equipm ent manufacturers
(O EM s), Ford, G eneral Motors (GM ), and Chrysler, had long
been troubled. For decades, the O EM s had been among the
most im portant com panies in the U.S. investm ent-grade bond
market, both in their share of issuance and in their benchmark
status. The possibility of their being downgraded to junk was
new and disorienting to investors. They had never been constit­
uents of the C D X .N A .IG , but two "captive finance" com panies,
General Motors A cceptance Co. (G M AC) and Ford M otor Credit
Co. (FM C C ), were.
A third set of com panies at the core of the autom otive indus­
tries were the auto parts m anufacturers. Delphi Corp. had been
a constituent of IG3, but had been removed in consequence of
its downgrade below investm ent grade. Am erican A xle Co. had
been added to IG4.
From a financial standpoint, the im m ediate priority of the O EM s
had been to obtain relief from the UAW auto workers union
from commitments to pay health benefits to retired workers.
The "ho t" part of the 2005 crisis began with two events in mid-
April, the inability of GM and the UAW to reach an accord on
benefits, and the announcem ent by GM of large losses. On May
5, GM and Ford were downgraded to junk by S&P. Moody's did
the same soon after. The im m ediate consequence was a sharp
widening of some corporate spreads, including G M A C and
FM C C and other autom otive industry names. Collins and Aik-
man, a major parts manufacturer, filed for Chapter 13 protection
from creditors in May. Delphi and Visteon, another large parts
manufacturer, filed later in 2005.
The two captive finance arms and the two auto parts m anufac­
turers Am erican A xle and Lear together constituted 4 out of the
178 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
125 constituents of the IG4. The m arket now contem plated the
possibility of experiencing several defaults in the IG3 and IG4.
The probability of extrem e losses in the IG3 and IG4 standard
equity tranches had appeared to be rem ote; it now seem ed a
distinct possibility. O ther credit products also displayed sharp
widening; the convertible bond m arket, in particular, was exp eri­
encing one of its periodic selloffs, as seen in Figure 17-2.
The autom otive and certain other single-name spreads w id­
ened sharply, among them G M A C and FM C C . The IG indexes
widened in line with the widening in their constituents, many of
which did not widen at all. The pricing of the standard tranches,
however, experienced much larger changes, brought about by
the panicky unwinding of the equity-mezzanine tranche trade.
Figure 11.3 shows the behavior of credit spreads and the price
of the standard equity tranche during the episode.
• The mark-to-market value of the equity tranche dropped
sharply. This can be seen in the increase in points upfront
that buyers of protection had to pay.
• The implied correlation of the equity tranche dropped
sharply. Stated equivalently, its mark-to-market value
dropped more and its points upfront rose more sharply than
the widening of the IG4 spread alone would have dictated.
• The junior mezzanine tranche experienced a small w iden­
ing, and at tim es even some tightening, as market partici­
pants sought to cover positions by selling protection on
the tranche, that is, taking on long credit exposures via the
tranche.
• The relative value trade as a whole experienced large losses.
The implied correlation fell for two reasons. The automotive
parts supplier bankruptcies had a direct effect. All were in the
IG4, which meant that about 10 percent of that portfolio was
now near a default state. But the correlation fell also because
the widening of the IG4 itself was constrained by hedging. The
short-credit position via the equity tranche could be hedged
by selling protection on a m odest multiple of the mezzanine
tranche, or a large multiple of the IG4 index. Although spreads
were widening and the credit environm ent was deteriorating, at
least some buyers of protection on the IG4 index found willing
sellers among traders long protection in the equity tranche who
were covering the short leg via the index as well as via the m ez­
zanine tranche itself.
Modeling Issues in the Setup of the Trade
The relative value trade was set up in the fram ework of the stan­
dard copula model, using the analytics described earlier. These
analytics were sim ulation-based, using risk-neutral default prob­
abilities or hazard-rate curves derived from single-name C D S.
The timing of individual defaults was well m odeled. Traders
 generally used a normal copula. The cor­
relation assumption might have been
based on the relative frequencies of dif­
ferent numbers of joint defaults, or, more
likely, on equity return correlations or
prevailing equity implied correlations.

In any event, the correlation assum p­

tion was static. This was the critical flaw,
rather than using the "w rong" copula
function, or even the "w rong" value
of the correlation. The deltas used to
set the proportions of the trade were
partial derivatives that did not account
for changing correlation. Changing cor­

0.075 relation drastically altered the hedge

ratio between the equity and mezzanine
tranches, which more or less doubled to
nearly 4 by Ju ly 2005. In other words,
0.045 71 traders needed to sell protection on
nearly twice the notional value of the
mezzanine tranche in order to maintain
spread neutrality in the portfolio.
0.015
Figure 11.2 displays the P&L profile of
0.5 the trade for different spreads and cor­
relations, again using the C LO exam ple.
Fig u re 11.2 Correlation risk of the convexity trade.
The portfolio P&L plotted as a solid line
The graph plots the P&L of the convexity trade for default rates from 0.0075 to 0.0825 per annum in Figure 11.1 is a cross-section through
and constant pairwise Gaussian copula correlations from 0.0 to 0.5. The P&L is expressed on the
Figure 11.2 at a correlation of 0.30.
vertical (z) axis in millions of dollars.
Figure 11.2 shows that the trade was
profitable for a wide range of spreads,
but only if correlation did not fall. If correlation fell
abruptly, and spreads did not widen enough, the
trade would becom e highly unprofitable.

The model did not ignore correlation, but the trade

The graph plots the implied or base correlation of the equity (0-3 percent) tranche (solid
line, percent, left axis), the price of the equity tranche (dashed line, points upfront, right
axis), and the C D X IG 4 spread (dotted line, basis points, right axis).
Sou rce: JPM organ C hase.
thesis focused on anticipated gains from convexity.
The flaw in the model could have been readily cor­
rected if it had been recognized. The trade was put
on at a tim e when copula models and the concept
of implied correlation generally had only recently
been introduced into discussions among traders,
who had not yet becom e sensitized to the potential
losses from changes in correlation. Stress testing
correlation would have revealed the risk. The trade
could also have been hedged against correlation
risk by employing an overlay hedge: that is, by
going long single-name protection in high default-
probability names. In this sense, the "arbitrage"
could not be captured via a two-leg trade, but
required more com ponents.

Chapter 11 Assessing the Quality of Risk Measures ■ 179

Case Study: Subprime Default
Models
Am ong the costliest model risk episodes was the
failure of subprim e residential m ortgage-based
security (RM BS) valuation and risk m odels. These
models were em ployed by credit-rating agencies to
assign ratings to bonds, by traders and investors to
value the bonds, and by issuers to structure them .
W hile the models varied w idely, two widespread
defects were particularly important:

• In general, the models assumed positive future

house price appreciation rates. In the stress
case, house prices might fail to rise, but would
not actually drop. The assumption was based
Rolling indexes of A A A , A , and B B B - A B X . For each index, the graph displays the most
on historical data, which was sparse, but sug­ recent vintage.
gested there had been no extended periods
Sou rce: JPM organ Chase.
of falling house prices on a large scale in any
relevant historical period. House prices did in fact drop very
severely starting in 2007. Since the credit quality of the loans
depended on the borrowers' ability to refinance the loans
without additional infusions of equity, the incorrect assum p­
tion on house price appreciation led to a severe underesti­
mate of the potential default rates in underlying loan pools in
an adverse econom ic scenario.
• Correlations among regional housing markets were assumed
to be low. Bonds based on pools of loans from different geo­
graphical regions were therefore considered well-diversified.
In the event, while house prices fell more severely in some
regions than others, they fell— and loan defaults were much
higher than expected in a stress scenario— in nearly all.
Together, these model errors or inappropriate param eters led to
a substantial underestimation of the degree of system atic risk in
subprim e RM BS returns. O nce the higher-than-expected default
rates began to m aterialize, the rating agencies were obliged to
downgrade most RM BS. The large-scale downgrades of A A A
RMBS were particularly shocking to the m arkets, as it was pre­
cisely these that revealed the extent to which system ic risk had
been underestim ated and m ispriced. As of the end of 2009,
about 45 percent of U.S. RMBS with original ratings of A A A had
been downgraded by M oody's.2
The inaccuracy of rating agency models for subprim e RMBS is a
com plex phenomenon with a number of roots. Some observers
2 See Moody's Investors Service (2010), p. 19.
have identified the potential conflict of interest arising from
com pensation of rating agencies by bond issuers as a factor in
driving ratings standards lower. O thers have focused on reach­
ing for yield and the high demand for highly rated bonds with
even m odestly higher yields.
As we saw earlier in this chapter, a num ber of instances of
mapping problem s, contributing to seriously m isleading risk
m easurem ent results, arose in securitization and structured
credit products. Up until relatively recently, little tim e-series
data was available covering securitized credit products. Highly
rated securitized products were often m apped to tim e series
of highly rated corporate bond spread indexes in risk m easure­
ment system s, or, less frequently, to the A B X index fam ily,
introduced in 2006. VaR m easured using such m appings would
have indicated that the bonds were unlikely under any circum ­
stances to lose more than a few points of value. As can, how­
ever, be seen in Figure 11.4, the A B X index of the most highly
rated RM BS lost 70 percent of their value during the subprim e
crisis. Som ew hat lower, but still investm ent-grade RM BS lost
alm ost all their value. Securitizations suffered far greater losses
than corporate bonds. Losses varied greatly by asset class, the
year in which they w ere issued, or "vin tag e ," and position in
the capital structure. The corporate-bond and A B X m appings
w ere highly m isleading and would have understated potential
losses by several orders of m agnitude for investm ent-grade
bonds. Sim ilar issues arose for C M B S, and their relationship
to the ratings curves and the C M B X , an index of C M BS prices
analogous to the A B X .

180 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Risk Capital
Attribution and
Risk-Adjusted
Performance
Measurement
Learning Objectives
A fter com pleting this reading you should be able to:

Define, compare, and contrast risk capital, economic capital,
and regulatory capital, and explain methods and motivations
for using economic capital approaches to allocate risk capital.
Describe the RA RO C (risk-adjusted return on capital)
m ethodology and its use in capital budgeting.
Com pute and interpret the RA R O C for a project, loan, or
loan portfolio, and use RA RO C to com pare business unit
perform ance.
Explain challenges that arise when using RA RO C for
perform ance m easurem ent, including choosing a time
horizon, measuring default probability, and choosing a
confidence level.
Calculate the hurdle rate and apply this rate in making
business decisions using R A R O C .
Com pute the adjusted RA RO C for a project to determ ine
its viability.
Explain challenges in modeling diversification benefits,
including aggregating a firm's risk capital and allocating
econom ic capital to different business lines.
Explain best practices in implementing an approach that
uses RA RO C to allocate econom ic capital.

E x c e rp t is C hapter 17 o f The Essentials of Risk M anagem ent, S e co n d Edition, by M ichel Crouhy, Dan Galai, and R o b ert Mark.

181
This chapter takes a look at the roles of risk capital and at how
risk capital can be attributed to business lines as part of a risk-
adjusted perform ance m easurem ent (RAPM) system . RAPM rep­
resents a key challenge for financial institutions and nonfinancial
firms around the world today. Only by forging a connection
between risk m easurem ent, risk capital, risk-based pricing, and
perform ance m easurem ent can firms ensure that the decisions
they take reflect the interests of stakeholders such as bondhold­
ers and shareholders.
12.1 WHAT PURPOSE DO ES RISK
CAPITAL S E R V E ?
Risk capital is the cushion that provides protection against the
various risks inherent in the business of a corporation so that
the firm can maintain its financial integrity and remain a going
concern even in the event of a near-catastrophic worst-case
scenario. Risk capital gives essential confidence to the corpora­
tion's stakeholders, such as suppliers, clients, and lenders (for an
industrial firm), or claim holders, such as depositors and counter­
parties in financial transactions (for a financial institution).
Risk capital is often called econom ic capital, and in most
instances the generally accepted convention is that risk capital
and econom ic capital are identical (although later in this chapter
we introduce a slight wrinkle by defining econom ic capital as
risk capital plus strategic capital).
We should be careful not to confuse the concept of risk capital,
which is intended to capture the econom ic realities of the risks a
firm runs, and regulatory capital. First, regulatory capital only
applies to a few regulated industries, such as banking and insur­
ance com panies, where regulators are trying to protect the
interests of small depositors or policy holders. Second, while
regulatory capital performs something of the same function as
risk capital in the regulators' eyes, it is calculated according to a
set of industrywide rules and formulas and sets only a minimum
required level of capital adequacy. It rarely succeeds in captur­
ing the true level of risk in a firm— the gap between a firm's reg­
ulatory capital and its risk capital can be quite wide.
Furtherm ore, even if regulatory and risk capital are similar num­
bers at the level of the firm, they may not be similar for each
constituent business line (i.e., regulatory capital may suggest
that an activity is much riskier than m anagem ent believes to be
the case, or vice versa).1
1 This leads to various conundrum s in allocating capital and capital costs
to business lines. For exam ple, some practitioners square the circle by
allocating the higher of regulatory capital or econom ic capital to the
business line.
182 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The new regulatory capital requirem ents imposed by Basel III
make it likely that for some activities, such as securitization,
regulatory capital may end up much higher than econom ic capi­
tal. Still, econom ic capital calculation is essential for senior man­
agem ent as a benchm ark to assess the econom ic viability of the
activity for the financial institution. When regulatory capital is
much larger than econom ic capital, then it is likely that over time
the activity will migrate to the shadow banking sector, which can
price the transactions at a more attractive level.
Risk capital m easurem ent is based on the same concepts as the
value-at-risk (VaR) calculation m ethodology. Indeed, risk capital
numbers are often derived from, or supported by, sophisticated
internal VaR m odels. However, the choice of the confidence
level and tim e horizon when using VaR to calculate risk capital
are key policy param eters that should be set by senior m anage­
ment (or the senior risk m anagem ent com m ittee). Usually, these
decisions should be endorsed by the board.
Risk capital should be calculated in such a way that the institu­
tion can absorb unexpected losses up to a level of confidence in
line with the requirem ents of the firm's various stakeholders. No
firm can offer its stakeholders a 100 percent guarantee (or confi­
dence level) that it holds enough risk capital to ride out any
eventuality. Instead, risk capital is calculated at a confidence
level set at less than 100 percent— say, 99.9 percent for a firm
with conservative stakeholders. In theory, this means that there
is a probability of around 1/10 of 1 percent that actual losses will
exceed the amount of risk capital set aside by the firm over the
given time horizon (generally one year).2 The exact choice of
confidence level is typically associated with some target credit
rating from a rating agency such as Moody's, Standard & Poor's,
and Fitch as these ratings are them selves explicitly associated
with a probability of default. It should also be in line with the
firm's stated risk appetite.
12.2 EM ERGIN G USES O F RISK
CAPITAL NUMBERS
Risk capital is traditionally used to answer the question, "H ow
much capital is required for our firm to remain solvent, given our
risky activities?" As soon as a firm can answer this question, it
can move on to solve many other m anagem ent problem s.
Recently, therefore, risk capital numbers have been used to
answer more and more questions, particularly in banks and
2 In reality, risk capital model suffers from the model risks we discussed
in C hap ter 10, and the results require careful interpretation. Most firms
use the output of their capital model as one key input into a w ider set of
judgm ents about the amount of capital the firm should hold.
 BO X 12.1 W HY IS EC O N O M IC CAPITAL SO IMPORTANT TO FIN A N C IA L
IN STITU TIO N S?
Allocating risk capital using econom ic capital approaches is
im portant for financial institutions for at least four reasons.
First, capital is primarily used in a financial institution not only
to provide funding for investments (as for a manufacturing
corporation) but also to absorb risk. The fundamental reason
for this is that financial institutions can leverage them selves
to a much higher degree than other corporations at a much
lower cost without raising equity, by taking retail deposits
or issuing debt securities. (Their debt-to-equity ratio might
be as high as 20 to 1, com pared to perhaps 2 to 1 for an
industrial corporation.) Moreover, many activities undertaken
by financial institutions, such as derivatives trading, writing
guarantees, issuing letters of credit, and other contingent
com m itm ents, do not require significant financing. Yet all
these activities draw to some extent on the bank's stock of
risk capital, and therefore a risk capital cost must be imputed
to each activity.
This brings us to the second reason: a bank's target solvency
is a vital part of the product the bank is selling. In contrast
to an industrial com pany, the primary custom ers of banks
and other financial institutions are also their primary liabil­
ity holders— e .g ., depositors, derivatives counterparties,
insurance policy holders, and so on. These custom ers are
concerned about default risk on contractually promised pay­
ments. Custom ers make deposits with the expectation that
the safety of their deposits does not depend on the eco­
nomic perform ance of the bank. In over-the-counter markets,
institutions are concerned about counterparty risk: a bank
o
other financial institutions. (Box 12.1 explains why risk-based
calculations are so im portant for financial institutions.) These
new uses include:
• Perform ance m easurem ent and incentive com pensation at
the firm, business unit, and individual levels. Risk capital can
be plugged into risk-based capital attribution system s, often
grouped together under the acronym RAPM (risk-adjusted
perform ance measurement) or RA R O C (risk-adjusted return
on capital). These system s, a key focus of this chapter, pro­
vide both m anagem ent and external stakeholders with a risk-
adjusted measure of perform ance of various businesses. The
measure can be used to com pare the econom ic profitability,
as opposed to the accounting profitability (such as return on
book equity) of different activities. A t the same tim e, RA RO C 3
3 For an informal survey of how firms use econom ic capital and R A R O C ,
see T. Baer et. al., The Use o f E co n o m ic Capital in Perform ance M an­
a g em en t fo r Banks: A P ersp ective, M cKinsey W orking Papers on Risk,
No. 24, January 2011.
Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement
with a poor credit rating will find itself excluded from many
m arkets. Maintaining good creditworthiness is therefore an
ongoing cost of doing business for a bank.
Third, although bank creditworthiness is critical, banks are
also highly opaque institutions. Banks use proprietary tech­
nology for pricing and hedging financial instruments, esp e­
cially com plex financial transactions. A typical bank's balance
sheet is relatively liquid and can change very quickly. Any
outside assessm ent of the creditworthiness of a bank is there­
fore difficult to develop and rapidly becom es obsolete (as
the risk profile of the bank keeps on changing). Maintaining
enough risk capital and implementing a strong risk m anage­
ment culture allows the bank to reduce these "agency costs"
by convincing external stakeholders, including rating agen­
cies, of the bank's financial integrity.
Fourth, banks operate in highly com petitive financial mar­
kets. Increasingly, this makes bank profitability very sensitive
to the bank's cost of capital. Banks don't want to carry too
much risk capital, because risk capital represents the money
invested in the bank that does not have to be repaid under
any fixed contractual agreem ent (e.g ., equity capital). This
flexibility, which allows risk capital to act as a safety buffer for
the bank if tim es are hard, means that risk capital is relatively
expensive to raise and hold (e.g., com pared to debt capital).
But banks can't carry too little risk capital, for reasons w e've
already made clear. So understanding the dynamic balance
between the capital the bank carries and the riskiness of its
activities is very important.
numbers can be used as part of scorecards to com pensate
the senior m anagem ent of particular business lines, as well as
the infrastructure group, for their contribution to shareholder
value. Since the 2007-2009 financial crisis, firms have laid a
greater emphasis on com pensation schem es that adjust for
risk in some manner (as well as on com plem entary m echa­
nisms such as deferral periods and clawbacks).
• A ctive portfolio m anagem ent for entry/exit decisions. The
decision to enter or exit a particular business should be
based on both risk-adjusted perform ance m easurem ent and
the "risk diversification effect" of the business. For exam ple,
a firm that is focused on corporate lending in a particular
region is likely to find that its returns fluctuate in accordance
with that region's business cycle. Ideally, the firm might
diversify its business geographically or in term s of business
activity. Capital m anagem ent decisions seek an answer to the
question, "H ow much value will be created if the decision is
taken to allocate resources to a new or existing business, or
alternatively to close down an activity?"
■ 183
• Pricing transactions. Risk capital numbers can be used to
calculate risk-based pricing for individual transactions.
Risk-based pricing is attractive because it ensures that a
firm is com pensated for the econom ic risk generated by a
transaction. For exam ple, common sense tells us that a loan
to a non-investment-grade firm that is in relatively fragile
financial condition must be priced higher than a loan to an
investm ent-grade firm. However, the am ount of the differ­
ential can be determ ined only by working out the amount of
expected loss and the cost of the risk capital that has to be
set aside for each transaction. Trading and corporate loan
desks in many banks rely on the "m arginal econom ic capital
requirem ent" com ponent in the RA RO C calculation to price
deals in advance— and to decide whether those deals will
increase shareholder value rather than simply add to the vol­
ume of transactions.
One problem is that a single measure of risk capital cannot
accom m odate the four different purposes that we have just
described. W e'll look at the solution to this later on.
12.3 RAROC: RISK-ADJUSTED RETURN
ON CAPITAL
RA RO C is an approach— simple at the conceptual level— that is
used to allocate risk capital to business units and individual trans­
actions for the purpose of measuring economic performance.
Originally proposed by Bankers Trust in the late 1970s, the
approach makes clear the trade-off between risk and reward for
BO X 12.2 RAPM (RISK-A D JU STED P ER FO R M A N C E M EA SU REM EN T) Z O O LO G Y
It's long been recognized that traditional accounting-based
measures of perform ance at the consolidated level and for
individual business units, such as return on assets (ROA) or
return on book equity (RO E), fail to capture the risk of the
underlying activity. The amounts of both book assets and
book equity, which are accounting measures, are poor prox­
ies for risk m easures. Furtherm ore, accounting income misses
some critical risk adjustm ents, such as expected loss.
RAPM (risk-adjusted perform ance measurement) is a generic
term describing all the techniques used to adjust returns for
the risk incurred in generating those returns. It encom passes
many different concepts, risk adjustm ents, and performance
m easures, with RA RO C being the form that is most widely
used in the banking sector. These RAPM measures are not
fully consistent with one another. In the main text, we pro­
pose an adjusted RA RO C measure that is consistent with the
capital asset pricing model (CAPM ) and, therefore, with the
NPV measure defined here.
184 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
a unit of capital and, therefore, offers a uniform and com parable
measure of risk-adjusted perform ance across all business activi­
ties. If a business unit's RA RO C is higher than the cost of the
bank's equity (the minimum rate of return on equity required by
the shareholders), then the business unit is deem ed to be add­
ing value to shareholders. Senior m anagem ent can use this m ea­
sure to evaluate perform ance for capital budgeting purposes,
and as an input to the compensation for managers of business
units.
The generic RA RO C equation is really a formalization of the
trade-off between risk and reward. It reads:
after-tax expected risk-adjusted net income
RA RO C = -------------------------- :-------— ----------------
economic capital
We can see that the RA R O C equation em ploys econom ic
capital as a proxy for risk and after-tax expected risk-adjusted
net income as a proxy for reward. Later, we elaborate on how
to measure both the numerator and the denom inator of the
RA RO C equation, and on how to tackle the "hurdle-rate"
issue— that is, once we know our RA RO C number, how do
we know if this number is good or bad from a shareholder's
perspective?
Before beginning this discussion, however, we must acknowl­
edge that the generic RA RO C equation is one of a family of
approaches, all with strengths and weaknesses. The definition
of RA RO C that w e've just offered corresponds to industry prac­
tice and can be thought of as the traditional RA RO C definition.
Box 12.2 presents several variants grouped under the label
RAPM (risk-adjusted perform ance measures).
• R A R O C (risk-adjusted return on capital) = risk-adjusted
e x p e c te d net incom e/econom ic capital. R A R O C makes
the risk adjustm ent to the num erator by subtracting a risk
factor from the return— e .g ., expected loss. RA RO C also
makes the risk adjustm ent to the denom inator by substi­
tuting econom ic capital for accounting capital.
• R O R A C (return on risk-adjusted capital) = n et incom e/
econ om ic capital. R O R A C makes the risk adjustm ent
solely to the denominator. In practical applications,
P&L(profit and loss)
RO RAC = ------------------------
VaR
• R O C (return on capital) = R O R A C . It is also called RO CA R
(return on capital at risk).
• R O R A A (return on risk-adjusted assets) = n et incom e/
risk-adjusted assets.
• R A R O A (risk-adjusted return on risk-adjusted assets) =
risk-adjusted e x p e c te d net incom e/risk-adjusted assets.
 • S (Sharpe ratio) = (e x p e c te d return — risk-free rate)/
volatility. The ex post Sharpe ratio— i.e., that based on
actual returns rather than expected returns— can be
1
shown to be a multiple of RO C.
• N PV (n et p re se n t value) = d isco u n ted value o f future
e x p e c te d cash flow s, using a risk-adjusted expected rate
of return based on the beta derived from the C A PM ,
where risk is defined in term s of the covariance of changes
in the market value of the business with changes in the
value of the market portfolio. In the C A PM , the definition
of risk is restricted to the system atic com ponent of risk
that cannot be diversified away. For RA RO C calculations,
the risk measure captures the full volatility of earnings,
system atic and specific. NPV is particularly well suited for
12.4 RAROC FOR CAPITAL BUDGETING
The decision to invest in a new project or a new business ven­
ture, or to expand or close down an existing business line,
has to be made before the true perform ance of the activity is
known— no m anager has a crystal ball. When implementing the
generic after-tax RA R O C equation for capital budgeting, indus­
try practice therefore interprets it as meaning
expected revenues - costs - expected losses
RA RO C - ~~ taxes + return on risk capital + / - transfers
economic capital
where
• E x p e c te d revenues are the revenues that the activity is
expected to generate (assuming no losses).
• C osts are the direct expenses associated with running the
activity (e.g ., salaries, bonuses, infrastructure expenses, and
so on).
• E x p e c te d losses, in a banking context, are primarily the
expected losses from default; they correspond to the loan
loss reserve that the bank must set aside as the cost of doing
business. Because this cost, like other business costs, is
priced into the transaction in the form of a spread over fund­
ing cost, there is no need for risk capital as a buffer to absorb
this risk. Expected losses also include the expected loss from
other risks, such as market risk and operational risk.
• Taxes are the expected amount of taxes imputed to the activ­
ity using the effective tax rate of the company.
• Return on risk capital is the return on the risk capital allo­
cated to the activity. It is generally assumed that this risk
capital is invested in risk-free securities, such as governm ent
bonds.
Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement
ventures in which the expected cash flows over the life of
the project can be easily identified.
• EVA (econom ic value added), or N IA C C (net incom e after
capital charge), is the after-tax adjusted net income less
a capital charge equal to the amount of econom ic capital
attributed to the activity, tim es the after-tax cost of equity
capital. The activity is deem ed to add shareholder value,
or is said to be EVA positive, when its N IA C C is positive
(and vice versa). An activity whose RA R O C is above the
hurdle rate is also EVA positive.1
1 See David Shim ko, "See Sharpe or Be Flat," Risk 10(6), 1997, p. 33.
2 EVA is a registered tradem ark of Stern Stew art & Co.
• Transfers correspond to transfer pricing m echanisms, primar­
ily between the business unit and the treasury group, such as
charging the business unit for any funding cost incurred by
its activities and any cost of hedging interest rate and cur­
rency risks; it also includes overhead cost allocation from the
head office.
• Econom ic capital is the sum of risk capital and strategic capi­
tal where
strategic risk capital = goodwill + burned-out capital
Our last bullet point deserves some explanation. Risk capital is the
capital cushion that the bank must set aside to cover the worst-
case loss (minus the expected loss) from market, credit, opera­
tional, and other risks, such as business risk and reputation risk, at
the required confidence threshold (e.g., 99 percent). Risk capital is
directly related to the value-at-risk calculation at the one-year time
horizon and at the institution's required confidence level.
Strategic risk capital refers to the risk of significant investments
about whose success and profitability there is high uncertainty.
If the venture is not successful, then the firm will usually face
a major write-off, and its reputation will be dam aged. Cur­
rent practice is to measure strategic risk capital as the sum of
burned-out capital and goodwill. Burned-out capital refers to
the idea that capital is spent on, say, the initial stages of start­
ing up a business but the business may ultimately not be kicked
off due to projected inferior risk-adjusted returns. It should be
viewed as an allocation of capital to account for the risk of stra­
tegic failure of recent acquisitions or other strategic initiatives
built organically. This capital is am ortized over tim e as the risk of
strategic failure dissipates. The goodwill elem ent corresponds
to the investm ent premium— i.e., the amount paid above
the replacem ent value of the net assets (assets — liabilities)
when acquiring a company. (Usually, the acquiring company is
■ 185
prepared to pay a premium above the
fair value of the net assets because it
places a high value on intangible assets ^[Expected Losses
-T a x e s
that are not recorded on the target's bal­ + Return on
A fte r-T a x Economic Capital Loss (Outside of the
ance sheet.) Goodwill is also depreciated R isk-A d ju ste d
-(-/-Transfer Confidence Level)
E x p e c te d Return
over tim e.

Some banks also allocate risk capital for RAROC =

C a p ita l = D iffe re n ce
unused risk limits, because risk capacity Economic Capital: = 150 bp
15 bp
that can be tapped at any moment by Risk Capital
165 bp
-► Expevted Loss
* Credit Risk
the business units represents a poten­ * Market Risk Probability of Losses
tially costly facility (in term s of the adjust­ * Operational Risk Greater than This Amount is
* Etc. Equal to 1%
ments to risk capital the firm as a whole
Strategic Risk Capital (Confidence Level of 99%)
might have to make if the credit line
were drawn upon). Fiqure 12.1 The RAROC equation.
Figure 12.1 shows the linkage between a
risk loss distribution and the RA R O C calculation. We show both the $1 billion in borrowed funds). $10 million is the expected
the expected loss— in this exam ple, 15 basis points (bps)— and loss, and $3.75 million (= 0.05 X $75 million) is the return on
the worst-case loss, 165 bps, at the desired confidence level (in econom ic capital.
this exam ple, 99 percent) for the loss distribution derived over
The RA RO C for this loan portfolio is 14 percent. This number
a given horizon, say one year. The unexpected loss is, there­
can be interpreted as the annual after-tax expected rate of
fore, the difference between the total loss and the expected
return on equity needed to support this loan portfolio.
loss— that is, 150 bps at the 99 percent confidence level— over
a one-year horizon. The unexpected loss corresponds to the risk
capital allocated to the activity. 12.5 RAROC FOR PERFO RM AN CE
Now that we understand the trickiest part of the RA RO C equa­ M EASUREM EN T
tion, unexpected loss, we can look at a practical exam ple of how
to plug numbers into the RA R O C equation. We should em phasize at this point that RA R O C was first sug­
gested as a tool for capital allocation on an anticipatory or ex
Let us assume that we want to identify the RARO C of a $1 billion
ante basis. Hence, e x p e c te d revenues and losses should be
corporate loan portfolio that offers a headline return of 9 percent.
plugged into the num erator of the RA R O C equation for capital
The bank has an operating direct cost of $9 million per annum and
budgeting purpose. When RA RO C is used for ex post, or after
an effective tax rate of 30 percent. We'll assume that the portfo­
the fact, perform ance evaluation, we can use realized revenues
lio is funded by $1 billion of retail deposits with a transfer priced
and realized losses, rather than expected revenues and losses, in
interest charge of 6 percent. Risk analysis of the unexpected
our calculation.
losses associated with the portfolio tells us that we need to set
economic capital of around $75 million (i.e., 7.5 percent of the
loan amount) against the portfolio. We know that this economic RAROC Horizon
capital must be invested in risk-free securities, rather than being
All of the quantities that we plug into the RA RO C equation must
used to fund risky activities, and that the risk-free interest rate
be calculated on the basis of a particular tim e horizon, such as a
on government securities is 5 percent. The expected loss on this
one-year horizon or over the lifetime of a d eal.4 Box 12.3
portfolio is assumed to be 1 percent per annum (i.e., $10 million).

If we ignore transfer price considerations, then the after-tax

RA RO C for this loan is:
( 9 0 - 9 - 6 0 - 10 + 3 .7 5 X 1 - 0 .3 )
RARO C = --------------------------—--------------------------
75
= 0.14 = 14%
where $90 million is the expected revenue, $9 million is the
operating cost, $60 million is the interest expense (6 percent of
4 This chapter focuses on single-period R A R O C m odels, while some
large banks have moved to a m ultiperiod R A R O C m odeling approach in
order to better measure R A R O C over the life of long-running transac­
tions and loans. However, major m ethodological issues are still unre­
solved when the risk of a transaction, such as a swap, or a portfolio
changes substantially from one period to the next. In that case, which
amount of econom ic capital should be allocated to the transaction or
the portfolio? Allocating some average amount of capital would lead to
undercapitalization and overcapitalization depending on the period.

186 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 BO X 12.3 RISK TYPES AND TIM E HORIZON S
Risk capital can be characterized as the one-year value-at-risk Figure 12B.1 illustrates the calculation of risk capital when
exposure of the firm, at a confidence level consistent with the the core risk level is lower than the current risk position.
firm's target credit risk rating. But how does the time horizon in
Across every bank, there are many other activities that must
this characterization relate to the risk measurement approaches
be allocated capital in a way that is sensitive to time horizons.
for market risk, for credit risk, and for operational risk?
For exam ple, the bank should allocate capital to cover the
For credit risk, there is a straightforward equivalence risk of options that are em bedded in many of its products.
between the one-year VaR produced by credit portfolio The option to prepay a m ortgage is one obvious exam ple,
m odels, such as CreditM etrics or KMV, and risk capital. The but there are many subtle twists on the risks generated by
same is also true for operational risk: most internal models different types of products. For exam ple, m ortgage port­
used by institutions have a one-year horizon. Therefore, for folios in Canada often incur com mitment risks. These arise
both credit risk and operational risk, there is no need for any because the consum er autom atically receives the lowest
adjustm ent in the one-year VaR to determ ine risk capital. m ortgage rate looking backward over a prescribed com m it­
ment period, as a function of the specific type of m ortgage.
However, this is not the case for m arket risk. For trading
In effect, the consum er has what derivatives practitioners call
businesses, market risk is measured using only short-term
a "look-back option." The seriousness of the com mitment
horizons— one day for risk monitoring on a daily basis and 10
risk is governed by the length of the com m itm ent period; it
days for regulatory capital. So how do we translate a one-day
represents the com ponent that cannot be entirely eliminated
risk measure into one-year risk capital attribution?
by delta hedging (e.g ., the basis risk between the w hole­
O ne approach might be to use what is commonly called the sale rates and the m ortgage rate). All these considerations
"square root of tim e" rule. That is, the risk analyst might need to be taken into account in determining the risk capital
approxim ate the one-year VaR by multiplying the one-day needed to support a Canadian m ortgage business.
VaR by the square root of the number of business days in one
year— e .g ., 252 days. If we did this, however, w e'd be miss­
ing the point of risk capital. Risk capital is there to limit the VaR
risk of failure during a period of crisis, when the bank has
suffered huge losses. As a worst-case scenario unfolds, the
bank will naturally reduce its risk exposures in any way that
it can. In the case of a proprietary trading desk, with highly
liquid positions and no clients to service, this risk reduction
can take place very quickly indeed. For other activities, risk
can often be reduced only to a core risk level for the remain­
der of the year, defined as the minimum realistic size at
which the business can be considered to be a going concern
(i.e., can maintain its franchise).

Thus, to work out a meaningful one-year econom ic capital

allocation, we need to analyze the business in question so
that we can understand the tim e to reduce from the current
risk position to the core risk level, which in turn reflects the
relative liquidity of positions during adverse market condi­ Risk capital = square root [sum of squares (100, 97.62, 95.24, ... , 52.38)
tions. Estim ations of the time to reduce should not make the + 5 0 2 x 231]
assumption that there will be a fire sale, but instead assume = 839
a relatively orderly unwinding of positions. This can take = 52.8% x annualized VaR
w here annualized VaR = 100 x square root (252)
considerable tim e in some m arkets, as firms discovered to
their cost in the 2007-2009 financial crisis. Fiqure 12B.1 Risk capital calculation for market risk.

discusses one problem that this brings up: how to harmonize the
different time horizons used to measure credit, m arket, and
operational risk. Practitioners usually adopt a one-year tim e hori­
zon, as this corresponds to the business planning cycle and is
also a reasonable approxim ation of the length of tim e it might
take to recapitalize the com pany if it were to suffer a major
unexpected loss.
However, the choice of a risk horizon for RA R O C is som ewhat
arbitrary. O ne could choose to measure the volatility of risk and
returns over a longer period of tim e, say 5 or 10 years, in order
to capture the full effect of the business cycle in measuring risk.
Calculating econom ic capital over a longer period of tim e does
not necessarily increase capital, as the level of confidence in any
firm's solvency that we require decreases as the tim e horizon

Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement ■ 187

is extended. If this seem s surprising, consider the probability
of default of an AA-rated firm to be around 3 basis points over BO X 12.4 T EC H N IC A L D ISCU SSIO N :
a one-year period; while this probability of default naturally CA LCU LA TIN G THE HURDLE RATE
increases if we look at the same firm over a two-year or five-
Most firms use a single hurdle rate, hAT, for all business
year period, this increase clearly does not affect the one-year activities, based on the after-tax weighted-average cost of
credit rating of the firm . However, one of the practical chal­ equity capital:
lenges is that the risk and return data beyond one year may be CE X rCE + PE X rpe
of low quality. AT CE + PE
where C E and PE denote the market value of common
equity and preferred equity, respectively, and rCE and
Default Probabilities: Point-in-Time (PIT) rPE are the cost of common equity and preferred equity,
vs. Through-the-Cycle (TTC) respectively.
The cost of preferred equity is simply the yield on the firm's
A point-in-tim e (PIT) probability of default (PD), which is the
preferred shares. The cost of common equity is determined
approach of KM V and other econom ic/structural approaches, via a model such as the capital asset pricing model:
is reasonable for calculating near-term exp ected losses
(EL) and for pricing financial instrum ents that are sub ject to
r c E ~ r f ~

credit risk. A through-the-cycle (TTC) PD, which is largely the where rf is the risk-free rate, RM is the expected return on
approach taken by the rating ag encies, is more reasonable for the market portfolio, and fSCE is the firm's common equity
market beta.
calculating econom ic cap ital, current profitability, and stra te ­
gic decisions regarding products, geo graphies, and new busi­
ness ventures.

The probability of a firm's staying in the same rating when

Hurdle Rate and Capital Budgeting
it is assessed using a PIT approach is sm aller than when it is Decision Rule
assessed using a T T C approach. The T T C approach therefore
Most firms use a single hurdle rate for all business activities:
reduces the volatility of econom ic capital, com pared to PIT
the after-tax weighted-average cost of equity capital. Box 12.4
approaches. It is useful on a periodic basis to com pare the
explains in more technical detail how this hurdle rate is calcu­
im pact of using PIT PD versus T T C PD in the R A R O C calculation
lated. The hurdle rate should be reset periodically, say every six
for both a normal part of the econom ic cycle and the w orst part
months, or when it has changed by more than 10 percent.
of the cycle.
When a firm is considering investing in a business or closing
down an activity, it com putes the after-tax RA R O C for the busi­
ness or activity and com pares it to the firm's hurdle rate. In
Confidence Level
theory, the firm can then apply a simple decision rule:
We m entioned earlier that the confidence level in the econom ic
• If the RA RO C ratio is greater than the hurdle rate, the activity
capital calculation should be consistent with the firm's target
is deem ed to add value to the firm.
credit rating. For exam ple, most banks today hope to obtain
• In the opposite case, the activity is deem ed to destroy value
an A A credit rating from the agencies for their debt offerings,
for the firm and the activity should be closed down or the
which implies a one-year probability of default of 3 to 5 basis
project rejected.
points. This, in turn, corresponds to a confidence level in the
range of 99.95 to 99.97 percent. We can think of this confi­ However, one can show that applying this simple rule can lead
dence level as the quantitative expression of the risk appetite to a firm's accepting high-risk projects that will lower the value
of the firm. of the firm and rejecting low-risk projects that will increase the
value of the firm .5 High-risk projects, such as oil exploration, are
Setting a lower confidence level may significantly reduce the
characterized by very volatile returns, while low-risk projects,
amount of risk capital allocated to an activity, especially when
such as properly risk-managed retail banking, produce steady
the institution's risk profile is dom inated by operational, credit,
revenues with low volatility.
and settlem ent risks (for which large losses occur only with some
rarity). Therefore, the choice of the confidence level can m ateri­
ally affect risk-adjusted perform ance measures and the resulting 5 See Michel Crouhy, Stuart Turnbull, and Lee W akem an, "M easuring
capital allocation decisions of the firm. Risk-Adjusted Perform ance," Jo u rn a l o f Risk 2(1), 1999, pp. 5-35.

188 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency

BO X 12.5 A D JU STIN G RAROC
FO R THE RISK O F RETURNS
Ideally, we would like to adjust the traditional RA RO C
calculation to obtain a RA R O C measure that takes into
account the system ic riskiness of returns, and for which the
hurdle rate (the critical benchm ark above which a business
adds value) is the same across all business lines. To correct
the inherent limitations of the traditional RA R O C measure,
let's adjust the RA RO C ratio as follows:
Adjusted RARO C s RARO C - p£(/?M- rf )
where RM is the expected rate of return on the market
portfolio, rf denotes the risk-free interest rate— say, the
interest rate paid on three-month Treasury bills— and /3e is
the beta of the equity of the firm. The new decision rule is:
Accept (reject) projects whose adjusted
RARO C is greater (sm aller) than rf
The risk adjustm ent, /3(RM — rf), is the excess return above
the risk-free rate required to com pensate the sharehold­
ers of the firm for the nondiversifiable system atic risk they
bear when investing in the activity, assuming that the
shareholders hold a well-diversified portfolio. When the
returns are thus adjusted for risk, the hurdle rate becomes
the risk-free rate.
To overcom e this, we need to make an im portant adjustm ent
to the RA RO C calculation so that the system atic riskiness of the
returns from a business activity is fully captured by the decision
rule (see Box 12.5).
Diversification and Risk Capital
The risk capital for a particular business unit within a larger firm
is usually determ ined by viewing the business on a stand-alone
basis, using the top-of-the-house hurdle rate that we discussed
earlier. However, intuition suggests that the risk capital for the
firm should be significantly less than the sum of the stand-alone
risk capital of the individual business units, because the returns
generated by the various businesses are unlikely to be perfectly
correlated.6
Measuring the true level of this "diversification effect" is
extrem ely problem atic. As of today, there is no fully integrated
VaR model that can produce the overall risk capital for a firm,
6 It should be noted that from a purely econom ic point of view, disre­
garding strategic considerations, the decision to enter or exit a business
activity should be based on the risk and return param eters of the single
business activity.
Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement
taking into account all the correlation effects between market
risk, credit risk, and operational risk across all the business units
of a com pany. Instead, banks tend to adopt a bottom-up decen­
tralized approach, under which distinct risk models are run for
each portfolio or business unit.
For capital adequacy purposes, running these business-specific
models at the confidence level targeted at the top of the house,
for exam ple 99.97 percent, produces an unnecessarily large
amount of overall risk capital, precisely because it neglects
diversification effects (across both risk types and business
activities). It is therefore common practice to adjust for the
diversification effects by lowering the confidence level used
at the business level to, say, 99.5 percent or lower— an adjust­
ment that is necessarily more of an educated guess than a strict
risk calculation.
If this sounds unsatisfactory, we can at least put some boundar­
ies around the problem. The aggregate VaR figure obtained
by this approach should fall in between the two extrem e cases
of perfect correlation and zero correlation between risk types
and across businesses. For exam ple, ignoring business risk,
reputation risk, and strategic risk, for illustrative purposes, sup­
pose that w e've calculated the risk capital for each type of risk
as follows:
Market risk = $200
Credit risk = $700
Operational risk = $300
Then aggregate risk capital at the top of the house is either
Simple summation of the three risks
(perfect correlation) = $1,200
or
Square root of the sum of squares of the three risks
(zero correlation) = $787
We can say with some confidence, therefore, that any proposed
approach for taking diversification effects into account should
produce an overall VaR figure in the range of $787 to $1,200.
W hile the simple logic of our boundary setting makes sense,
these boundaries are pretty wide! They also leave us with the
reverse problem : how do we allocate any diversification benefit
that we calculate for the business as a whole back to the busi­
ness lines? The allocation of the diversification effect can be
im portant for certain business decisions, such as determining
the perform ance of each unit.
Logically, a business whose operating cash flows are strongly
correlated with the earnings of the other activities in the firm
should require more risk capital than a business with the same
■ 189
 Com bination of Econom ic Marginal Marginal
Businesses Capital Business Econom ic Capital
X +Y $100
X X $40
$60
Y $70 Y $30
Diversification $30 Total $70
Effect
Fiqure 12.2 Diversification effect.
volatility whose earnings move in a countercyclical fashion.
Bringing together countercyclical business lines produces stable
earnings for the firm as a whole; the firm can then operate to
the same target credit rating with less risk capital.
In truth, institutions continue to struggle with the problem of
attributing capital back to business lines, and there are diverg­
ing views as to the appropriate approach. For the moment, as a
practical solution, most institutions allocate the portfolio effect
pro rata with the stand-alone risk capital.
Diversification effects also com plicate matters within busi­
ness units. Let's look at this and other issues in relation to an
exam ple business unit, BU, which com prises two activities, X
and Y (Figure 12.2). W hen calculating the risk capital of the busi­
ness unit, let's assume that the firm's risk analysts have taken
into account all the diversification effects created by combining
activities X and Y and that the risk capital for BU is $100. The
complication starts when we try to allocate risk capital at the
activity level within the business unit. There are three different
measures of risk capital:
• Stand-alone capital is the capital used by an activity taken
independently of the other activities in the same business
unit— that is, risk capital calculated without any diversification
benefits. In our exam ple, the stand-alone capital for X is $60
and that for Y is $70. The sum of the stand-alone capitals of
the individual constituents of the business unit is generally
higher than the stand-alone risk capital of the business unit
itself (it is equal only in the case of perfectly correlated activi­
ties X and Y) .
• Fully diversified capital is the capital attributed to each
activity X and Y, taking into account all diversification
benefits from combining them under the same leader­
ship. In our exam ple, the overall portfolio effect is $30
($60 + $70 — $100). Allocating the diversification effect is
an issue here. Following our earlier discussion, we'll allocate
the portfolio effect pro rata with the stand-alone risk capital,
$30 X 60/130 = $14 for X and $30 X 70/130 = $16 for Y, so
that the fully diversified risk capital becom es $46 for X and
$54 for Y.
190 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• Marginal capital is the additional capital required by an
incremental deal, activity, or business. It takes into account
the full benefit of diversification. In our exam ple, the mar­
ginal risk capital for X (assuming that Y already exists) is $30
($100 — $70), and the marginal risk capital for Y (assuming
that X already exists) is $40 ($100 — $60). In the case where
more than two activities are included in the business unit BU,
marginal capital is calculated by subtracting the risk capital
required for the BU without this business from the risk capital
required for the full portfolio of businesses. Note that the
summation of the marginal risk capital, $70 in our exam ple, is
less than the full risk capital of the BU.
As this exam ple shows, the choice of capital measure depends
on the desired objective. Fully diversified measures should be
used for assessing the solvency of the firm and minimum risk
pricing. Active portfolio m anagem ent or business mix decisions,
on the other hand, should be based on marginal risk capital,
taking into account the benefit of full diversification. Finally,
perform ance m easurem ent should involve both perspectives:
stand-alone risk capital for incentive com pensation, and fully
diversified risk capital to assess the extra perform ance gener­
ated by the diversification effects.
However, we must be cautious about how generous we are in
attributing diversification benefits.7 Correlations between risk
factors drive the extent of the portfolio effect, and these corre­
lations tend to vary over tim e. During market crises, in particular,
correlations som etim es shift dram atically toward either 1 or —1,
reducing or totally eliminating portfolio effects for a period
of tim e.
12.6 RAROC IN PRACTICE
Econom ic capital is increasingly a key elem ent in the assessm ent
of business line perform ance, in the decision to exit or enter a
business, and in the pricing of transactions. It also plays a critical
role in the incentive com pensation plan of the firm. Adjusting
incentive com pensation for risk in this way is important, because
managers tend to align their perform ance to maximize whatever
perform ance measures are imposed on them .
N eedless to say, in firms in which RA RO C has been im ple­
m ented, business units often challenge the risk m anagem ent
function about the fairness of the amount of econom ic capital
attributed to them . The usual com plaint is that their econom ic
7 For a discussion of the common econom ic capital aggregation tech­
niques and how they capture diversification benefits, see Range o f
Practices and Issues in Eco n o m ic Capital Fram ew orks, BIS, March 2009,
pp. 24-31.
capital attribution is too high (never that it is too low!). Another
com plaint is that econom ic capital attribution is som etim es too
unstable— the numbers can move up and down in a way that is
disconcerting for a business trying to hit a target.
The best way to defuse this debate is for the RA RO C group to
be transparent about the m ethodology used to assess risk and
to institute forums where the issues related to the determination
of econom ic capital can be debated and analyzed. From our
own experience, the VaR m ethodologies for measuring market
risk and credit risk that underpin RA R O C calculations are gener­
ally well accepted by business units (although this is not yet true
for operational risk). It's the setting of the param eters that feed
into these models, and that drive the size of econom ic capital,
that causes acrimony.
Here are a number of recom m endations for implementing a
RA RO C system:
1. Sen ior m anagem ent com m itm ent. Given the strategic
nature of the decisions steered by a RA RO C system , the
marching orders must come from the top m anagem ent of
the firm. Specifically, the C E O and his or her executive team
should sponsor the im plem entation of a RA R O C system and
should be active in the diffusion, within the firm, of a new
culture in which perform ance is measured in term s of con­
tribution to shareholder value. The m essage to push down
to the business lines is this: W hat counts is not how much
income is generated, but how well the firm is com pensated
for the risks that it is taking on.
2 . Com m unication and education. The RA RO C group should
be transparent and should explain the RA RO C m ethodol­
ogy not only to the business's heads but also to the busi­
ness line managers and the C FO 's office, in order to gain
acceptance of the m ethodology throughout all the m anage­
ment layers of the firm.
3 . O ngoing consultation. The firm should institute a forum such
as a "param eter review group" that periodically reviews the
key param eters that drive risk and economic capital. This
group, composed of key representatives from the business
units and the risk m anagem ent function, will bring legiti­
macy to the capital allocation process. For credit risk, the
param eters that should be reviewed include probabilities
of default, credit migration frequencies, loss given default,
and credit line usage given default. These parameters evolve
over the business cycle and should be adjusted as more
data become available. An important issue to settle is the
choice of a historical period over which these parameters
are calibrated— i.e., should this be the whole credit cycle (in
order to produce stable risk capital numbers) or a shorter
period of time to make capital more procyclical (capital goes
Chapter 12 Risk Capital Attribution and Risk-Adjusted Performance Measurement
down when the credit environment improves and goes up
when it deteriorates)? For market risk, volatility and correla­
tion param eters should be updated at least every month,
using standard statistical techniques. O ther key factors, such
as the core risk level and "tim e to reduce" (see Box 12.3),
should be reviewed on an annual basis. For operational risk,
the risk measurement approach is currently more judgmental
and, as such, more open to heated discussions!
4 . Maintaining the integrity o f the process. As with other risk
calculations, the validity of RARO C numbers depends critically
on the quality of the data about risk exposures and positions
collected from the management systems (e.g., in a trading
business, the front- and back-office systems). Only a rigorous
process of data collection and centralization can ensure accu­
rate risk and capital assessment. The same rigor should also
be applied to the financial information needed to estimate the
adjusted-return element of the RARO C equation. Data collec­
tion is probably the most daunting task in risk management.
But the best recipe for failure in implementing a RARO C sys­
tem is to base calculations on inaccurate and incomplete data.
The RARO C group should be accountable for the integrity of
the data collection process, the calculations, and the report­
ing process. The business units and the finance group should
be accountable for the integrity of the specific data that they
produce and feed into the RARO C system.
5 . C om bine R A R O C with qualitative factors. Earlier in this
chapter, we described a simple decision rule for project
selection and capital attribution— i.e ., accept projects where
the RA R O C is greater than the hurdle rate. In practice,
other qualitative factors should be taken into consideration.
All the business units should be assessed in the context of
the two-dimensional strategic grid shown in Figure 12.3.
The horizontal axis of this figure corresponds to the RA RO C
Q uality of Earnings: Strategic Im portance/Long-Term Grow th Potentia
Figure 12.3 Strategic grid.
■ 191
 return calculated on an ex ante basis. The vertical axis
is a qualitative assessm ent of the quality of the earnings
produced by the business units. This measure takes into
consideration the strategic im portance of the activity for
the firm, the growth potential of the business, the sustain­
ability and volatility of the earnings in the long run, and any
synergies with other critical businesses in the firm. Priority
in the allocation of balance sheet resources should be given
to the businesses in the upper right quadrant. A t the other
extrem e, the firm should try to exit, scale down, or fix the
activities of businesses that fall into the lower left quadrant.
The businesses in the category "m anaged grow th," in the
lower right quadrant, are high-return activities that have low
strategic im portance for the firm. In contrast, businesses in
the category "investm ent," in the upper left quadrant, are
currently low-return activities that have high growth poten­
tial and high strategic value for the firm.
6 . Put an active capital m anagem ent process in place. Balance
sheet requests from the business units, such as economic cap­
ital, leverage ratio, liquidity ratios, and risk-weighted assets,
should be channeled to the RARO C group every quarter. Lim­
its are then set for economic capital, leverage ratio, liquidity
ratios, and risk-weighted assets based on the kind of analysis
we've discussed in this chapter. The treasury group often
reviews limits to ensure that they are consistent with fund­
ing limits. This limit-setting process is a collaborative effort,
with any disagreements about the amount of balance sheet
resources attributed to a business put to arbitration by the
senior executive team. Leverage ratios may restrain manage­
ment from growing the bank beyond a certain level, but this
in itself makes it more important that banks work every dollar
of capital hard— and RARO C analysis is one way to do this.
CO N CLUSIO N
RA RO C system s, developed first by large financial institutions,
are being im plem ented in sm aller banks and other trading firms,
192 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Bank M anagem ent
Safety < ► Profitability
• D ebt Holders • Shareholders
• D eposit Holders • Analysts
• Counterparties on Derivatives
• Transaction
• Regulators
• D eposits Insurance Com pany
• Rating Agencies
Fiaure 12.4 How RAROC balances the desires of
various stakeholders.
such as energy trading com panies. W herever risk capital is an
im portant concern, RA R O C balances the divergent desires of
the various external stakeholders, while also aligning them with
the incentives of internal decision makers (Figure 12.4). When
business units (or transactions) earn returns in excess of the
hurdle rate, shareholder value is created, while the allocated risk
capital indicates the amount of capital required to preserve the
desired credit rating.
RA RO C information allows senior managers to better under­
stand where shareholder value is being created and where it is
being destroyed. It promotes strategic planning, risk-adjusted
profitability reporting and incentive com pensation schem es,
proactive allocation of resources, better m anagem ent of con­
centration risk, and better product pricing.
Because RA RO C is not just a common language of risk, but a
quantitative technique, we can also think of a RARO C-based
capital budgeting process as akin to an internal capital market
in which businesses are com peting with one another for scarce
balance sheet resources— all with the objective of maximizing
shareholder value. This makes RA RO C a useful tool for capital
allocation, both for banks and for nonbank corporations.
Range of Practices
and Issues in
Economic Capital
Frameworks
Learning Objectives
A fter com pleting this reading you should be able to:

Within the econom ic capital implementation fram ework Explain benefits and im pacts of using an econom ic capital
describe the challenges that appear in: fram ework within the following areas:
Defining and calculating risk measures Credit portfolio m anagem ent
Risk aggregation ■ Risk based pricing
Validation of models Custom er profitability analysis
■ Dependency modeling in credit risk M anagem ent incentives
Evaluating counterparty credit risk
Assessing interest rate risk in the banking book Describe best practices and assess key concerns for the
governance of an econom ic capital fram ework.
Describe the BIS recom m endations that supervisors
should consider to make effective use of internal risk m ea­
sures, such as econom ic capital, that are not designed for
regulatory purposes.

E x c e rp t is rep rin ted by perm ission from the Basel C om m ittee on Banking Supervision.

193
13.1 EXECUTIVE SUMMARY
Economic capital can be defined as the methods or practices
that allow banks to consistently assess risk and attribute capital
to cover the economic effects of risk-taking activities. Economic
capital was originally developed by banks as a tool for capital
allocation and performance assessment. For these purposes,
economic capital measures mostly need to reliably and accu­
rately measure risks in a relative sense, with less importance
attached to the measurement of the overall level of risk or capi­
tal. Over time, the use of economic capital has been extended
to applications that require accuracy in estimation of the level of
capital (or risk), such as the quantification of the absolute level
of internal capital needed by a bank. This evolution in the use of
economic capital has been driven by both internal capital man­
agement needs of banks and regulatory initiatives, and has been
facilitated by advances in risk quantification methodologies and
the supporting technological infrastructure.
While there has been some convergence in the understand­
ing of key concepts of economic capital across banks with such
frameworks in place, the notion of economic capital has broad­
ened over time. This has occurred in terms of the underlying
risks (or building blocks) that are combined into an overall eco­
nomic capital framework and also in terms of the relative accep­
tance and use of economic capital across banks.
Economic capital can be analysed and used at various levels—
ranging from firm-wide aggregation, to risk-type or business-line
level, and down further still to the individual portfolio or expo­
sure level. Many building blocks of economic capital, therefore,
are complex and raise challenges for banks and supervisors.
In particular, Pillar 2 (supervisory review process) of the Basel
II Framework may involve an assessment of a banks' economic
capital framework. Accordingly, this paper makes recommen­
dations of particular interest to supervisors and bankers where
economic capital models are used in the supervisory dialogue.
In addition, supervisors have an interest in promoting robust,
transparent and effective risk management, which in many cases
requires an understanding of banks economic capital frame­
works. Nevertheless, it is recognised that economic capital is a
business tool developed and used by individual institutions for
internal risk management purposes.
This paper emphasises the importance of understanding the
relationship between overall economic capital and its building
blocks, as well as ensuring that the underlying building blocks
(individual risk assessments) are measured in a consistent and
coherent fashion. The main body of the paper focuses on issues
associated with the overall economic capital process, rather
than on the component risks measured by economic capital.
194 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Therefore it covers issues related to the use and governance
of economic capital, the choice of risk measures, aggregation
of risk, and validation of economic capital. In addition, three
important building blocks of economic capital (dependency
modelling in credit risk, counterparty credit risk and interest
rate risk in the banking book) are examined in separate, stand­
alone annexes. This list of building blocks is chosen due to the
significance and complexity of the topics, and (with the excep­
tion of counterparty credit risk) partly because the topics are not
covered in Pillar 1 of the Basel II Framework. This list is by no
means exhaustive.
Use o f Economic Capital and Governance
The robustness of economic capital and the governance and
controls surrounding the process have become more critical as
the use of economic capital has extended beyond relative risk
measurement and performance to the determination of the
adequacy of a bank's absolute level of capital.
The viability and usefulness of a bank's economic capital pro­
cesses depend critically on the existence of a credible com­
mitment or "buy-in" on the part of senior management to the
process. In order for this to occur, it is necessary for senior
management to recognise the importance of using economic
capital measures in conducting the bank's business. In addition,
adequate resources are required to ensure the existence of a
strong, credible infrastructure to support the economic capital
process. Economic capital model results should be transparent
and taken seriously in order to be useful for business decisions
and risk management. At the same time, management should
fully understand the limitations of economic capital measures.
Moreover, senior management needs to take measures to help
ensure the meaningfulness and integrity of economic capital
measures. It should also seek to ensure that the measures com­
prehensively capture all risks and implicit and/or explicit man­
agement actions embedded in measurement processes are both
realistic and actionable.
Risk Measures
Banks use a variety of risk measures for economic capital pur­
poses with the choice of risk measure dependent on a number
of factors. These include the properties of the risk measure, the
risk- or product-type being measured, data availability, trade­
offs between the complexity and usability of the measure, and
the intended use of the risk measure. While there is general
agreement on the desirable properties a risk measure should
have, there is no singularly preferred risk measure for economic
capital purposes. All risk measures observed in use have
advantages and disadvantages which need to be understood
within the context of their intended application.
Risk Aggregation
O ne of the more challenging aspects of developing an eco­
nomic capital fram ework relates to risk aggregation.
Practices and techniques in risk aggregation are generally less
sophisticated than the m ethodologies that are used in measur­
ing individual risk com ponents. They rely heavily on ad-hoc
solutions and judgm ent without always being theoretically
consistent with the m easurem ent of the com ponents. Most
banks rely on the summation of individual risk com ponents
either equally-weighted (i.e., assuming no diversification or a
fixed percentage of diversification gains across all components)
or weighted by an estim ated variance-covariance matrix that
represents the co-m ovem ent between risks. Few banks attem pt
technically more sophisticated aggregation methods such as
copulas or even bottom-up approaches that build overall eco­
nomic estim ates from the common relationship of individual risk
com ponents to underlying factors.
Validation is a general problem with aggregation techniques.
Diversification benefits em bedded in inter-risk aggregation
processes (including in the estimation of entries in the variance-
covariance matrix) are often based on (internal or external)
"exp ert judgm ent" or average industry benchm arks. These have
not been (and very often cannot be) com pared to the actual his­
torical or expected future experience of a bank, due to lack of
relevant data.
Since individual risk com ponents are typically estim ated without
much regard to the interactions between risks (e.g ., between
market and credit risk), the aggregation m ethodologies used
may underestim ate overall risk even if "no diversification"
assumptions are used. Moreover, harmonisation of the m easure­
ment horizon is a difficult issue. For exam ple, extending the
shorter horizon applied to market risk to match the typically-
used annual horizon of econom ic capital assessm ents for other
types of risk is often performed by using a square root of time
rule on the econom ic capital measure. This simplification can
distort the calculation. Similar issues arise when risk measured
at one confidence level is then scaled to becom e (nominally)
com parable with other risk com ponents measured at a different
confidence level.
Validation
Econom ic capital models can be com plex, embodying many
com ponent parts and it may not be im m ediately obvious that
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
a com plex model works satisfactorily. Moreover, a model may
em body assumptions about relationships between variables or
about their behaviour that may not hold in all circumstances
(e.g ., under periods of stress). Validation can provide a degree
of confidence that the assumptions are appropriate, increasing
the confidence of users (internal and external to the bank) in
the outputs of the model. Additionally, validation can be also
useful in identifying the limitations of econom ic capital models,
i.e., where em bedded assumptions do not fit reality.
The validation of econom ic capital models is at a very prelim i­
nary stage. There exists a wide range of validation techniques,
each of which provides evidence for (or against) only some of
the desirable properties of a model. Moreover, validation tech­
niques are powerful in some areas such as risk sensitivity but not
in other areas such as overall absolute accuracy or accuracy in
the tail of the loss distribution. Used in com bination, particularly
in combination with good controls and governance, a range of
validation techniques can provide more substantial evidence for
or against the perform ance of the model. There appears to be
scope for the industry to improve the validation practices that
shed light on the overall calibration of models, particularly in
cases where assessm ent of overall capital is an im portant appli­
cation of the model.
Dependency Modelling in Credit Risk
Portfolio credit risk models form a significant com ponent of
most econom ic capital fram eworks. A particularly im portant and
difficult aspect of portfolio credit risk modelling is the modelling
of the dependency structure, including both linear relationships
and non-linear relationships, between obligors. Dependency
modelling is an im portant link between the Basel II risk weight
function (with supervisory imposed correlations) and portfolio
credit risk models which rely on internal bank modelling of
dependencies. Understanding the way dependencies are mod­
elled is im portant for supervisors when they exam ine a bank's
internal capital adequacy assessm ent process (ICAAP) under
Pillar 2, since these dependency structures are not captured in
regulatory capital measures.
The underlying m ethodologies applied by banks in the area of
dependency modelling in credit risk portfolios have not changed
much over the past ten years. Rather, im provem ents have been
made in the infrastructure supporting the m ethodologies (e.g.,
improved databases) and better integration with internal risk
m easurem ent and risk m anagem ent. The main concern in this
area of econom ic capital continues to centre on the accuracy
and stability of correlation estim ates, particularly during tim es of
stress. The correlation estim ates provided by current models still
depend heavily on explicit or implicit model assumptions.
■ 195
Counterparty Credit Risk
The m easurem ent and m anagem ent of counterparty credit risk
creates unique challenges for banks. M easurem ent of counter­
party credit risk represents a com plex exercise, as it involves
gathering data from multiple system s; measuring exposures
from potentially millions of transactions (including an increas­
ingly significant percentage that exhibit optionality) spanning
variable tim e horizons ranging from overnight to thirty or more
years; tracking collateral and netting arrangem ents; and cat­
egorising exposures across thousands of counterparties.
This com plexity creates unique market-risk-related challenges
(requiring calculations at the counterparty level and over mul­
tiple and extended holding periods) and credit risk-related
challenges (estimation of credit risk param eters for which the
institution may not have any other exposures). In addition,
wrong-way risk, operational risk-related challenges, differences
in treatm ent between margined and non-margined counterpar­
ties, and a range of aggregation challenges need to be over­
come before a firm can have a bank-wide view of counterparty
credit risk for econom ic capital purposes. Banks usually employ
one of two general modelling approaches to quantify coun­
terparty credit risk exposures, a value-at-risk (VaR)-type model
or a Monte Carlo Simulation approach. The decision of which
approach to use involves a variety of trade-offs. The VaR-type
model cannot produce a profile of exposures over tim e, which
is necessary for counterparties that are not subject to daily
margining agreem ents, whereas the simulation approach uses
a sim plified risk factor representation and may therefore be
less accurate. W hile these models may be supplem ented with
com plem entary m easurem ent processes such as stress testing,
such diagnostics are frequently not fully com prehensive of all
counterparty credit risk exposures.
Interest Rate Risk in the Banking Book
The main challenges in the calculation of econom ic capital for
interest rate risk in the banking book relate to the long holding
period for balance sheet assets and liabilities and the need to
model indeterm inate cash flows on both the asset and liability
side due to em bedded optionality in many banking book items.
If not adequately measured and m anaged, the asymmetrical
payoff characteristics of instruments with em bedded option fe a­
tures can present risks that are significantly greater than the risk
measures suggest.
The two main techniques for assessing interest rate risk in the
banking book are repricing schedules (gap and duration analy­
ses) and simulation approaches. Although commonly used, the
simple structure and restrictive assumptions make repricing
196 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
schedules less suitable for the calculation of econom ic capital.
Most banks use simulation approaches for determ ining their
econom ic capital, based on losses that would occur given a set
of worst case scenarios. The magnitude of such losses and their
probability of occurrence determ ine the amount of economic
capital. The choice of the techniques depends on the bank's
preference towards either econom ic value or earnings, and
also on the type of business. Some businesses, such as com ­
mercial lending or residential m ortgage lending, are managed
on a present value basis, while others such as credit cards are
managed on an earnings basis. The use of an earnings based
measure creates aggregation challenges when other risks are
measured on the basis of econom ic capital. Conversely, the use
of an econom ic value based approach may create inconsisten­
cies with business practices.
Summary
Econom ic capital modelling and m easurem ent practices
continue to evolve. In some aspects, practices have converged
and becom e more consistent over tim e, however the notion of
econom ic capital has broadened as its use has expanded. There
remain significant m ethodological, implementation and business
challenges associated with the application of econom ic capital in
banks, particularly if econom ic capital measures are to be used
for internal assessm ents of capital adequacy. These challenges
relate to the overall architecture of econom ic capital modelling
and to the underlying building blocks.
13.2 R E C O M M E N D A T IO N S *1
Econom ic capital models and the overall fram eworks for their
internal use can provide supervisors with information that is
com plem entary to other assessm ents of bank risk and capital
adequacy. W hile there is benefit from engaging with banks on
the design and use of the m odels, supervisors should guard
against placing undue reliance on the overall level of capital
implied by the models in assessing capital adequacy. The follow ­
ing recom m endations identify issues that should be considered
by supervisors in order to make effective use of internal m ea­
sures of risk that are not designed for regulatory purposes.
1 . U se o f econom ic cap ital m odels in assessin g cap ital
ad e q u acy. A bank using an econom ic capital model in its
dialogue with supervisors, should be able to dem onstrate
how the econom ic capital model has been integrated into
the business decision-making process in order to assess
its potential impact on the incentives affecting the bank's
strategic decisions about the mix and direction of inherent
 risks. The bank's board of directors should also be able to
dem onstrate conceptual awareness and understanding of
the gap between gross (stand alone) and net enterprise
wide (diversified) risk when they define and communicate
measures of the bank's risk appetite on a net basis.
2 . S en io r m an ag em en t. The viability, usefulness, and ongoing
refinem ent of a bank's econom ic capital processes depend
critically on the existence of credible com mitment or "buy-
in" on the part of senior m anagem ent to the process. In
order for this to occur, senior m anagem ent should recog­
nise the im portance of using econom ic capital measures
in conducting the bank's business and capital planning,
and should take measures to ensure the meaningfulness
and integrity of econom ic capital measures. In addition,
adequate resources should be com m itted to ensure the
existence of a strong, credible infrastructure to support the
econom ic capital process.
3 . Tran sp are n cy and in te g ra tio n into decisio n-m aking. A
bank should effectively docum ent and integrate econom ic
capital models in a transparent way into decision-making.
Econom ic capital model results should be transparent and
taken seriously in order to be useful to senior m anagem ent
for making business decisions and for risk m anagem ent.
A bank should take a careful approach to its use of eco­
nomic capital in internal assessm ents of capital adequacy.
For this purpose, greater emphasis should be placed on
achieving robust estim ates of stand-alone risks on an abso­
lute basis, as well as developing the flexible capacity for
enterprise-wide stress testing.
4 . R isk id e n tifica tio n . Risk m easurem ent begins with a robust,
com prehensive and rigorous risk identification process. If
relevant risk drivers, positions or exposures are not cap­
tured by the quantification engine for econom ic capital,
there is great room for slippage between inherent risk and
measured risk.
Not all risks can be directly quantified. Material risks that
are difficult to quantify in an econom ic capital fram ework
(e.g ., funding liquidity risk or reputational risk) should be
captured in some form of com pensating controls (sensitivity
analysis, stress testing, scenario analysis or similar risk con­
trol processes).
5 . R isk m easu res. All risk measures observed in use have
advantages and disadvantages which need to be under­
stood within the context of their intended application.
There is no singularly preferred risk measure for economic
capital purposes. A bank should understand the limitations
of the risk measures it uses, and the implications associated
with its choice of risk measures.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
6 . R isk ag g re g a tio n . A bank's aggregation methods should
address the implications stemming from the definition and
m easurem ent of individual risk com ponents. The accuracy of
the aggregation process depends on the quality of the mea­
surem ent of individual risk com ponents, as well as on the
interactions between risks em bedded in the m easurem ent
process. Aggregation of individual risk com ponents often
requires the harmonisation of risk m easurem ent param eters
such as the confidence level or m easurem ent horizon.
Care must be taken to ensure that the aggregation m eth­
odologies used (e.g ., variance-covariance m atrices, use of
broad market proxies, and simple industry averages of cor­
relations) are, to the extent possible, representative of the
bank's business composition and risk profile.
7 . V alid atio n . Econom ic capital model validation should be
conducted rigorously and com prehensively. Validation of
econom ic capital models should be aimed at dem onstrating
that the model is fit for purpose. Evidence is likely to come
from multiple techniques and tests. To the extent that a
bank uses models to determ ine an overall level of economic
capital, validation tools should dem onstrate to a reason­
able degree that the capital level generated by the model
is sufficient to absorb losses over the chosen horizon up to
the desired confidence level. The results of such validation
work should be com m unicated to senior m anagem ent to
enhance econom ic capital model usage.
8 . D ep en d en cy m odelling in cre d it ris k . Since the depen­
dency structures em bedded in portfolio credit risk models
have an im portant im pact on the determ ination of eco­
nomic capital needs for credit risk, banks should carefully
assess the extent to which the dependency structures they
use are appropriate for their credit portfolio. Banks should
identify and understand the main limitations of their credit
portfolio models and their im plem entation. They should
address those limitations by using adequate supplem entary
risk m anagem ent approaches (e.g ., sensitivity analysis, sce­
nario analysis, tim ely review of param eters).
9 . C o u n te rp a rty cre d it risk . A bank should understand the
trade-offs involved in choosing between the currently used
methodologies for measuring counterparty credit risk. Com ­
plementary measurement processes such as stress testing
should also be used, though it should be recognised that such
approaches may still not fully cover all counterparty credit
risk exposures. The measurement of counterparty credit risk
is com plex and entails unique market and credit risk related
challenges. A range of aggregation challenges needs to be
overcome before a firm can have a bank-wide view of coun­
terparty credit risk for economic capital purposes.
■ 197
1 0. In te re st ra te risk in th e banking b o o k. Close attention
should be paid to measuring and managing instruments
with em bedded option features, which if not adequately
perform ed can present risks that are significantly greater
than suggested by the risk measure. Trade-offs between
using an earnings-based or econom ic value based approach
to measuring interest rate risk in the banking book need to
be recognised. The use of an earnings based measure cre­
ates aggregation challenges when other risks are measured
on the basis of econom ic value. Conversely, the use of an
econom ic value based approach may create inconsistencies
with business practices.
13.3 IN T R O D U C T IO N 1
Econom ic capital, which can be defined as the methods or prac­
tices that allow financial institutions to consistently assess risk
and to attribute capital to cover the econom ic effects of risk­
taking activities, has increasingly becom e an accepted input into
decision-making at various levels within banking organisations.
Econom ic capital measures may be one of several key factors
used to inform decision-making in areas such as profitability,
pricing, and portfolio optim isation— particularly at the business­
line level. Econom ic capital measures may also feed into senior
m anagem ent decisions relating to issues such as acquisitions
and divestitures. Such measures are also used, primarily at the
consolidated entity level, to assess overall capital adequacy. The
increased use of econom ic capital by banks has been driven by
rapid advances in risk quantification m ethodologies, greater
com plexity and sophistication of banks' portfolios, and super­
visory expectations that banks must develop internal processes
to assess capital adequacy, beyond regulatory capital adequacy
guidelines that are not designed to fully reflect all the underly­
ing material risks in a given bank's business activities.
Across banks there has been a narrowing in the range of defini­
tions and treatm ent of the majority of risks that form the build­
ing blocks of econom ic capital models, particularly the risks that
are more readily quantifiable. A t the same tim e, however, the
notion of econom ic capital is broadening in term s of the risks
that it encom passes and the extent to which it is gaining accep­
tance across banks. That is, the inputs (or risks) that feed into
the m easurem ent of econom ic capital are subject to ongoing
change and evolution.
1 This paper was prepared by the Basel Committee's Risk Management
and Modelling Group (RMMG). The RMMG comprises risk management
specialists and supervisors from member countries within and outside
the Basel Committee. The RMMG has developed its views based on
information sourced from a wide range of presentations and documents
provided by banks, supervisors and other industry participants.
198 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Many banks appear to be sufficiently com fortable in using their
econom ic capital fram ework in discussions with external stake­
holders. Moreover, to varying degrees of granularity, banks have
in recent years disclosed qualitative and quantitative aspects of
their econom ic capital, including econom ic capital model
descriptions, risk thresholds, m ethodologies for particular risks,
use of econom ic capital, capital allocation by risk type and busi­
ness units, and diversification estim ates.2
Despite the advances that have been made by banks in devel­
oping their econom ic capital m odels, the further use and rec­
ognition of risk measures derived from these models remain
subject to significant m ethodological, implementation and busi­
ness challenges. These challenges stem from:
• the wide variety of applications of econom ic capital models
(from business-line use to firm-wide decision-making to capi­
tal adequacy assessm ents);
• m ethodological challenges (particularly in the area of risk
aggregation, coverage of risks, validation challenges, and
risks that are not easily quantifiable);
• the ability of econom ic capital models to adequately reflect
business-line operating practices and therefore provide
appropriate incentives to business units;
• potential gaps in the coverage of risks (e.g ., valuation risks in
structured credit products);
• the feasibility of any single risk measure to capture ade­
quately all the com plex aspects of banking risks; and
• the ability of econom ic capital models to be extended from
being used as a common metric for relative risk m easurem ent
and perform ance to the determ ination of the adequacy of
the absolute level of capital.
This paper provides an overview of the range of practices in
econom ic capital modelling at large banking organisations, and
based on this review discusses a range of issues and challenges
surrounding econom ic capital models. The paper also discusses
practices im plem ented by banks that attem pt to address these
challenges, and supervisory concerns relating to the current
state of practice.
As econom ic capital has to varying degrees becom e a com ­
ponent of many banks' internal capital adequacy assessm ent
processes (ICA A P), this paper is addressed to banks that have
im plem ented or are considering implementing econom ic capi­
tal into their internal processes. The paper is also addressed
to supervisors, who are required under Pillar 2 of the Basel II
Fram ework, to review and evaluate banks' internal capital ade­
quacy assessm ents.
2 See Samuel (2008).
The main body of this paper focuses on aspects of the overall
architecture of economic capital models. First, the paper cov­
ers the use of economic capital models and the governance and
control framework. Second, it reviews the range of risk measures
used by banks in their economic capital models. Next, it cov­
ers the range of practice in risk aggregation methods before
the paper moves to issues arising in the validation of economic
capital models. The main body of the paper therefore focuses on
issues that are at a level above that of individual risks. The paper
does not discuss the estimation of important building blocks of
economic capital models, such as the estimation of probability
of default (PD), loss given default (LGD) and exposure at default
(EAD) in credit risk models. This is not to say that estimation of
these parameters is simple or without issues. Rather, these issues
are outside the scope of this work and have been covered in
detail in other publications. Nevertheless, the annexes to this
chapter discuss three building blocks of economic capital models,
namely dependency modelling in credit risk, counterparty credit
risk and interest rate risk in the banking book. These topics are
given closer attention in this paper due to a combination of their
significance, inherent challenges and (with the exception of coun­
terparty credit risk) partly because the topics are not covered in
Pillar 1 (minimum capital requirements) of the Basel II Framework.
Should the need arise, further work on other significant elements
of economic capital may be undertaken in the future.
Finally, it is worth noting that this work was initiated well before
the market turmoil that began in August 2007. This paper there­
fore exam ines general issues that are deem ed to be relevant for
econom ic capital modelling. It does not attem pt to analyse or
assess the perform ance of econom ic capital models during the
market turmoil.
1 3 .4 U S E O F E C O N O M IC C A P IT A L
M EA SU RES AN D G O V ER N A N C E
In order to achieve a common measure across all risks and busi­
nesses, econom ic capital is often param eterised as an amount
of capital that a bank needs to absorb unexpected losses over
a certain tim e horizon at a given confidence level. Because
expected losses are accounted for in the pricing of a bank's
products and loan loss provisioning, it is only unexpected losses
that require econom ic capital. Econom ic capital analysis typically
involves an identification of the risks from certain activities or
exposures, an attem pt to measure and quantify those risks, the
aggregation of those risks, and an attribution or allocation of
capital to those risks.
Historically, banks have followed a path in their use of eco­
nomic capital that begins with (i) business unit-level portfolio
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
m easurem ent and pricing profitability analysis followed by
(ii) enterprise-wide relative perform ance m easurem ent that
migrates to capital budgeting/planning, acquisition/divestiture
analysis, external reporting and internal capital adequacy assess­
ment processes.
Business-Level Use
The effective use of econom ic capital at the business-unit level
depends on how relevant the econom ic capital allocated to
or absorbed by a business unit is with respect to the decision­
making processes that take place within it. Frequently, the
success or failure of an econom ic capital fram ework in a bank
can be assessed by looking at how business line managers
perceive the constraints econom ic capital imposes and the
opportunities it offers in the following areas: (i) credit portfolio
m anagem ent; (ii) risk-based pricing; (iii) custom er profitability
analysis, custom er segm entation, and portfolio optim isation;
and (iv) m anagem ent incentives.
Credit Portfolio Management
Credit portfolio m anagem ent refers to activities in which banks
assess the risk/return profiles of credit portfolios and enhance
their profitability through credit risk transfer transactions and/
or control of the loan approval process. In credit portfolio man­
agem ent, the creditworthiness of each borrower is assessed in
a portfolio setting. A loan with a higher stand-alone risk does
not necessarily contribute more risk to the portfolio. A loan's
marginal contribution to the portfolio, as a result, is critical to
assessing the concentration of the portfolio. Econom ic capital
is a m easurem ent of the level of concentration. It is one of the
factors used to determ ine which hedging facilities to employ
in reducing concentration. According to the results presented
in Rutter Associates LLC (2004), the use of credit portfolio
m anagem ent for reducing econom ic capital seem s to be less
dominant than for "m anagem ent of concentrations" and for
"protection against risk deterioration."
Risk-Based Pricing
The relevance of allocated econom ic capital for pricing certain
products (especially traditional credit products) is widely recog­
nised. In theory, under the assumption of com petitive financial
m arkets, prices are exogenous to banks, which act as price-
takers and assess the expected return (ex ante) and/or perfor­
mance (ex post) of deals by means of risk-adjusted perform ance
m easures, such as the risk-adjusted return on capital (RARO C).
In practice, however, markets are segm ented. For exam ple, the
market for loans can be viewed as com posed of a wholesale
segm ent, where banks tend to behave more as price-takers,
■ 199
and a commercial banking segm ent, where, due to well-known
market im perfections (e.g ., information asym m etries, monitor­
ing costs, etc.), banks have a greater ability to set prices for
their custom ers.
From an operational point of view, the difference is not so
straightforward, as decisions on deals will be based on ex ante
considerations with regard to expected RA RO C in a price-taking
environment (leading to rejection of deals whose RA RO C is
below a given threshold) and on the proposal of a certain price
(interest rate) to the custom er in a price-setting environm ent. In
both cases, decisions are driven by a floor (the minimum RA RO C
or minimum interest rate) com puted according to the amount of
econom ic capital allocated to the deal.
Risk-based pricing typically incorporates the variables of a
value-based m anagem ent approach. For exam ple, the pricing
of credit risk products will include the cost of funding (such as
an internal transfer rate on funds), the expected loss (in order
to cover loan loss allowances), the allocated econom ic capital,
and extra-return (with respect to the cost of funding) as required
by shareholders. Econom ic capital influences the credit process
through the computation of a (minimum) interest rate consid­
ered to be adequate for increasing (or, at least, not decreasing)
shareholders' value. Depending on the product and the internal
rules governing the credit process, decisions regarding prices
can som etim es be overridden. For exam ple, this situation could
occur because of consideration about the overall profitability
of the specific custom er relationship, or its desirability (e.g .,
due to reputational side-effects stemming from maintenance of
the custom er relationship, even when it proves to be no longer
econom ically profitable). G enerally, these exceptions to the rule
are strictly monitored and require the decision be elevated to a
higher level of m anagem ent.
Customer and Product Profitability Analysis,
Customer Segmentation and Portfolio
Optimisation
Regardless of the role played by the bank as a price-taker or a
price-maker, the process cannot be considered com plete until
feedback has been provided to m anagem ent about the final
outcome of the decisions taken. The m easurem ent of perfor­
mance can be extended down to the custom er level, through
the analysis of custom er profitability. Such an analysis aims at
providing a broad and com prehensive view of all the costs, reve­
nues and risks (and, consequently, econom ic capital absorption)
generated by each single custom er relationship.
W hile implementation of this kind of analysis involves com plex
issues related to the aggregation of risks at the custom er level,
its use is evident in identifying unprofitable or marginally profit­
able custom ers who attract resources that could be allocated
200 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
more efficiently to more profitable relationships. This task is
generally accom plished by segm enting custom ers in term s of
ranges of (net) return per unit of risk. Provided the underlying
inputs have been properly measured and allocated (not a simple
task as it concerns risks and, even more, costs), this technique
provides a straightforward indication of areas for intervention in
assessing custom er profitability.
By providing evidence on the relative risk-adjusted profitabil­
ity of customer relationships (as well as products), economic
capital can be used in optimising the risk-return trade-off in
bank portfolios.
Management Incentives
To becom e deeply engrained in internal decision-m aking
processes, the use of econom ic capital needs to be extended
in a way that directly affects the objective functions of decision­
makers at the business unit level. This is achieved by influenc­
ing the incentive structure for business-unit m anagem ent.
Anecdotal evidence suggests that incentives are the most
sensitive elem ent for the majority of bank m anagers, as well
as being the issue that m otivates their getting involved in the
technical aspects of the econom ic capital allocation process.
However, evidence suggests that com pensation schem es rank
quite low among the actual uses of econom ic capital m easures
at the business unit level.
Enterprise-Wide or Group-Level Use
Econom ic capital provides banks with a common currency for
measuring, monitoring, and controlling: (i) different risk types;
and (ii) the risks of different business units. The risk types that
are typically covered by banks' econom ic capital models are
credit risk, market risk (including interest rate risk in the bank­
ing book— IRRBB) and operational risk. Concentration risk as an
aspect of credit risk is also common. O ther risks included are
business/strategic risk, counterparty credit risk, insurance risk,
real estate risk and model risk.
Q uantitative approaches are generally applied to credit risk
(including concentration and counterparty credit risk), market
risk, interest rate risk in the banking book and operational
risks. Strategic and reputational/legal risks are more likely to
be assessed by non-quantitative approaches (with an exception
being where reputational/legal risks are subsumed in opera­
tional risk). For these risks, no best practices have em erged so
far within the industry. Challenges lie mainly in insufficient data
and difficulties in m odelling.
Some risks are viewed by banks as better covered by ensuring
that internal control procedures are in order to mitigate risk
and/or prepare contingency funding plans (e.g ., liquidity risk).
Consequently, capital typically is not allocated for such risks.
Relative Performance Measurement
In order to assess relative perform ance on a risk-adjusted basis,
banks calculate risk-adjusted perform ance m easures, where eco­
nomic capital measures play an im portant role. The most com ­
monly used risk-adjusted perform ance measures are
risk-adjusted return on capital (RARO C) and shareholder value
added (SVA). Many banks calculate these measures at various
levels of the enterprise (e.g ., entity level, large business unit
level and portfolio level). The major difference between these
two measures is that RA RO C is a relative measure, while SVA is
an absolute measure. RA R O C provides information which is use­
ful in comparing the perform ances of two portfolios with the
same amount of econom ic net incom e, but with substantially
different econom ic capital measures.
O ne of the key issues in using both RA RO C and SVA for perfor­
mance m easurem ent is how to set the hurdle rate that reflects
the bank's cost of capital. In this regard practices vary across
banks. Some banks set a single cost of capital (e.g ., weighted
average cost of capital or target return on equity— ROE) across
all business units, while other banks set required returns that
vary according to the risks of the business units.
Some banks use lower confidence levels for perform ance assess­
ment of business units than for their enterprise-wide capital
adequacy assessm ent. This approach is based on the view
that econom ic capital measures calculated at high confidence
levels focus on extrem e events and do not always provide
appropriate information for senior m anagem ent. Calculation
of risk-adjusted perform ance measures at the large business
unit levels (e.g ., wholesale banking, trading) is more commonly
observed than at the sm aller business unit levels. In calculating
econom ic net income, one of the challenges is how to allocate
profits and costs to each unit, if more than one unit contrib­
utes a profit-generating transaction or benefits from a cost
generating activity.
Banks use risk-adjusted perform ance measures in their perfor­
mance assessm ent (e.g ., comparing perform ance with a target,
analysing historical performance) and com pensation setting.
Use of econom ic capital measures for risk-adjusted perform ance
measures in a capital budgeting process is much more common
practice than incorporating econom ic capital measures into the
determ ination of com pensation for business managers and staff.3
3 There are other risk-adjusted performance measures that could be
used. Some of these measures include RORAC (return on risk-adjusted
capital), ROCAR (return on capital at risk) and RAROA (risk-adjusted
return on risk-adjusted assets). See Crouhy et. al. (2006).
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
Capital Budgeting, Strategic Planning, Target
Setting and Internal Reporting
Many banks allocate (hypothetical) capital to each business unit
in their budgeting process, where econom ic capital measures
play an im portant role. This process is also part of strategic
planning (e.g ., defining the bank's risk appetite) and target
setting (e.g ., profit, capital ratio or external rating). In order to
facilitate business growth that improves risk-adjusted profit­
ability, while operating within an overall risk appetite set by
the board, many banks have established internal reporting/
monitoring fram eworks.
G enerally, banks have a num ber of ways to conduct capital
planning, most of which are not em pirically-based, but instead
are based on judgm ent and stress testing exercises. These
include scenario analysis and sensitivity analysis, which intro­
duce forward-looking elem ents into the capital planning pro­
cess. That is, banks place more em phasis on qualitative rather
than quantitative tools and exp ect to rely on m anagem ent
actions to deal with future events. It seem s that banks take only
a rough, judgm ental approach to reviewing the perform ance
and interaction of econom ic capital "dem and" figures and
available capital "sup p ly" figures during tim es of stress. It does
not appear that banks have a rigorous process for determ ining
their capital buffers, although some banks system atically set
their capital buffers at levels above regulatory minimums (about
120% -140% ). Banks' capital planning scenarios differ by chosen
tim e horizon, with some choosing one year, and others choos­
ing three to five years. Banks usually look at adverse events
that would affect the bank individually or would affect m arkets
more broadly (a pandem ic is one scenario chosen by some
banks for the latter). Some banks stress certain param eters in
their econom ic capital m odels (e .g ., they shock PDs based on
a severe recession scenario) to assess the potential im pact on
econom ic capital.
Acquisition/Divestiture Analysis
In corporate developm ent activities, such as mergers and acqui­
sitions, some banks use the targets' econom ic capital measures
as one of the factors in conducting due diligence. However, the
number of banks using econom ic capital measures for corporate
developm ent activities is relatively sm aller than the number of
those using econom ic capital measures for the other purposes
described above. According to the results of the IFRI and C RO
Forum (2007) survey, only 25% of participating banks use eco­
nomic capital measures for corporate developm ent activities,
such as mergers and acquisitions. On the other hand, it seem s
that this approach is more often used for mergers and acquisi­
tions in emerging m arkets, where information on the targets'
market values is far less readily available.
■ 201
External Communication
The major external communication channels where economic
capital measures could be used include disclosure (e.g ., annual
reports, presentation materials for investors), dialogue with
supervisory authorities and dialogue with rating agencies. Some
banks disclose econom ic capital measures for each business unit
and/or risk category and provide com parisons with allocated
capital in their annual reports. Many more banks disclose this
kind of information in other docum ents, such as presentation
materials for investors.
Capital Adequacy Assessment
Econom ic capital is a measure of risk, not of capital held. As
such, it is distinct from familiar accounting and regulatory capital
measures. Nevertheless, banks have extended the use of this
enterprise-wide metric beyond perform ance m easurem ent and
strategic decision-making to include an assessm ent of the ade­
quacy of the institution's overall capitalisation. This practice is
commonly observed at banks, including those whose econom ic
capital implementation is in the earlier stages of developm ent.
The comparison of an internal assessment of capital needs
against capital available is part of banks' overall ICAAP. Large
banks (which are likely to adopt internal ratings-based— IRB—
approaches under Basel II) tend to use an economic capital model
for their ICAAP, whereas some smaller banks primarily use the
minimum regulatory capital numbers for the ICAAP. Some of these
banks adjust the Pillar 1 numbers (using multiples of the regula­
tory capital requirements, using different model parameters, look­
ing at different confidence levels, etc.). Beyond risks that feature
in regulatory capital computations, approaches are rather het­
erogeneous. Larger banks may use economic capital models for
quantifiable risks while relying upon more subjective approaches
for less quantifiable risks like reputational risk. Traditional eco­
nomic capital methods are used in some cases to calculate risks
beyond minimum regulatory capital requirements. In other cases,
stress tests based on scenario analysis are used (e.g., for IRRBB).
Governance
The corporate governance and control fram ework surround­
ing econom ic capital processes is an im portant indicator of
the reliability of econom ic capital measures used by banking
institutions. Important parts of an effective econom ic capital
fram ework include strong controls for making changes in risk
m easurem ent techniques, thorough docum entation regarding
risk m easurem ent and allocation m ethodologies and assum p­
tions, sound policies to ensure that econom ic capital practices
adhere to expected procedures, and the meaningful applica­
tion of econom ic capital measures to day-to-day business
202 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
decision-m aking. Moreover, the viability of a bank's economic
capital processes depends critically on the existence of a cred­
ible com m itm ent on the part of senior m anagem ent to the
process. In order for this to occur, however, senior m anagem ent
must recognise the im portance of using econom ic capital m ea­
sures in running the bank's business.
This section exam ines the current range of practices with regard
to governance in the following areas: (i) senior m anagem ent
involvement and experience in the econom ic capital process;
(ii) the unit involved in the econom ic capital process, e .g ., risk
m anagem ent, strategy planning, treasury, etc. and its level of
knowledge; (iii) the frequency of econom ic capital m easure­
ments; and (iv) policies, procedures, and approvals relating to
econom ic capital model developm ent, validation, on-going
m aintenance and ownership.
Senior Management Involvement and Experience
in the Economic Capital Process
The most widely cited reasons for adopting an econom ic capi­
tal fram ework are to improve strategic planning, define risk
appetite, improve capital adequacy, assess risk-adjusted busi­
ness unit perform ance and set risk limits. For those institutions
that have adopted or plan to adopt econom ic capital, the risk
m anagem ent team , senior m anagem ent, supervisors and the
board of directors were the most influential parties behind the
decision. However, not all banks choose to adopt an econom ic
capital fram ework, citing difficulties inherent in collecting and
modelling data on infrequent and often unquantifiable risk at
extrem ely high confidence levels.
There are clear signs that acceptance of the role played by eco­
nomic capital is increasingly em bedded in the business culture
of banks, driven both by industry progress and supervisory pres­
sure. In addition, banks now seem to be broadly com fortable
with the accuracy of the econom ic capital measures. This has
resulted in increased use of econom ic capital in m anagem ent
applications and business decisions, as well as use in discussions
with external stakeholders.
The barriers to the successful implementation of econom ic capi­
tal vary widely. However, according to the PricewaterhouseCoo-
pers Survey (2005) only 14% of respondents cite lack of support
from senior m anagem ent as a barrier to successful im plem enta­
tion of an econom ic capital fram ew ork.4
4 Among the other barriers selected by respondents, 64% cite difficulty
of integrating economic capital within management decision-making;
62% cite difficulty in quantifying certain risk types; 59% cite problems
with data integrity; 31% cite lack of incentives for specific business lines
and product areas to co-operate; 23% cite lack of in-house expertise;
and 23% cite uncertainty regarding supervisors attitudes toward
economic capital.
Unit Involved in the Economic Capital Process and
Its Level of Knowledge
There is a wide range of organisational governance structures
responsible for the econom ic capital fram ework at banking insti­
tutions. These governance structures range from involving highly
concentrated responsibilities to involving highly decentralised
responsibilities. For exam ple, some banking institutions house a
centralised econom ic capital unit within corporate Treasury, with
formal responsibilities. However, com ponents of the overall eco­
nomic capital model or some param eters are outside the direct
control of the econom ic capital owner. O ther banks share
responsibility for the econom ic capital fram ework between the
risk function and the finance function, while others have a more
decentralised structure, with responsibilities spread among a
w ider range of units.5
O nce capital has been allocated, each business unit then man­
ages its risk so that it does not exceed its allocated capital. In
defining units to which capital is allocated, banks som etimes
take into account their governance structure. For exam ple,
banks that delegate broader discretion to business unit heads
tend to allocate capital to the business unit, leaving the business
unit's internal capital allocation within the business line's control.
On the other hand, m anagem ent is likely to be more involved in
the allocation of capital within business units if the bank's gov­
ernance structure is more centralised. There seem s to be diver­
gence in the approach to this process. Some banks prefer rigid
operation, where allocation units adhere to the original capital
allocation throughout the budgeting period. On the other hand,
other banks prefer a more flexible fram ework, allowing reallo­
cation of capital during the budgeting period, som etim es with
thresholds that trigger reallocation before consuming all the
allocated capital.
Frequency of Economic Capital Measurements
and Disclosure
Econom ic capital calculations have a strong manual com ponent
and data quality is a prominent concern. Hence, most banks cal­
culate econom ic capital on a monthly or quarterly basis.
Implementation of Basel II has fostered public disclosure of
quantitative information on econom ic capital measures among
banks. Although disclosure of quantitative econom ic capital
measures is not m andatory under Pillar 3 (market discipline) of
Basel II, the aim of Pillar 3 is to encourage market discipline by
5 According to the IFRI and CRO Forum (2007) survey, about 80% of the
economic capital work is undertaken centrally, and about 20% by the
business units. About 60% of the banks participating in the survey have
economic capital functions that report directly to the Chief Risk Officer,
while others have reporting lines to the Chief Financial Officer or the
Corporate Treasury.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
accurately conveying the actual financial condition of banks to
the m arket. In addition to quantitative econom ic capital m ea­
sures, qualitative information on the governance surrounding
the econom ic capital fram ework of banks is becoming more
important, since external market participants take into account
the sophistication of the econom ic capital fram ework and bank
m anagem ent in their assessm ents of banks.
Policies, Procedures, and Approvals Relating to
Economic Capital Model Development, Validation,
On-Going Maintenance and Ownership
Most banks have form alised policies and procedures for eco­
nomic capital governance and analytics to ensure the consistent
application of econom ic capital across the enterprise. For those
banks that have adopted enterprise-wide policies and proce­
dures, it is the responsibility of the business units to ensure that
those policies and procedures are being followed. Some insti­
tutions that do not have formal policies and procedures have
econom ic capital processes and analytics (e.g ., coverage of off-
balance sheet items, confidence level and holding period) that
are inconsistent across organisational units.
Change-control processes for econom ic capital models are
generally less form alised than for pricing or risk m anagem ent
models. They typically leverage off change-control processes of
the underlying models and param eters. Changes to econom ic
capital-specific m ethodologies (e.g ., aggregation m ethodolo­
gies) are managed by the bank's econom ic capital owner, and
may not be the same as the change control processes in other
areas on the banking institution. Diagnostics procedures are
typically run after an econom ic capital model change. Some
banks require responsible parties to sign-off on any changes to
m ethodology. However, form alised validation processes after
changes, or internal escalation procedures in the event of unex­
pectedly large differences in the econom ic capital numbers,
are uncommon.
Some banks specifically name an owner of the econom ic capi­
tal model. Typically, the owner provides oversight of the eco­
nomic capital fram ework. However, few formal responsibilities
are assigned the owner other than ensuring reports from all
model areas are received in a tim ely manner and mechanically
aggregating the individual com ponents of the econom ic capital
fram ework into a report.
Supervisory Concerns Relating to Use of
Economic Capital and Governance
Senior m anagem ent needs to ensure that there are robust con­
trols and governance surrounding the entire econom ic capital
process. There are several supervisory concerns relating to the
■ 203
use of econom ic capital measures and governance surrounding
the econom ic capital fram ework.
Standard for Absolute versus Relative Measures
of Risk
The robustness and conservativeness of econom ic capital as an
estim ate of risk becom es more im portant when a bank extends
the use of measures designed initially as a common m etric for
relative risk m easurem ent and perform ance to the determination
of the adequacy of the absolute level of capital. Critical issues
include: (i) com prehensive capture of the risks by the m odel; (ii)
diversification assumptions; and (iii) assumptions about m anage­
ment actions.
Comprehensive Capture of Risks
The types of risk that are included in econom ic capital models
and the IC A A P vary across banks in a given country as well as
across countries (partly because some risk types are more pro­
nounced in some countries). Risks that the econom ic capital
model cannot easily measure may be considered as a separate
judgm ental adjustm ent in the ICAAP. W hether a risk type is
included in the IC A A P may depend on the risk profile of the
individual bank, and whether the individual bank regards these
risks as material.
There can be variation between banks in the risks covered by
their econom ic capital m odels, since an identically named risk
type may be defined differently across banks and across coun­
tries. The term business risk, for exam ple, is som etim es con­
fused with or lumped together with less quantifiable legal and
reputational risk.
Diversification Assumptions
In most cases, intra-risk diversification assumptions are built into
the models for individual risk types. For inter-risk diversification
assumptions, current practices vary among banks and the bank­
ing industry does not seem to have agreed on best practices.
Thus, the methods remain preliminary and require further analy­
sis. In light of the uncertainty in estimating diversification effects,
especially for inter-risk diversification, due consideration for con­
servatism may be important. The issue of inter-risk diversification
is addressed in detail later in the chapter and intra-risk diversifica­
tion (within portfolio credit risk modelling) is discussed in Annex I.
Assumptions about Management Actions
In some banks, potential m anagem ent actions are taken into
account in econom ic capital m odels. However, one of the
main reasons that banks do not include m anagem ent actions
in their econom ic capital models is that these actions are
204 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
difficult to model. Even if m anagem ent actions are not explicitly
included in econom ic capital models due to unreliability, banks
would nevertheless prepare for them via contingency plans in
stress situations.
Potential m anagem ent actions are grouped into two catego­
ries: (i) those actions that increase capital supply; and (ii) those
actions that reduce capital dem and. Exam ples of the form er
are raising new capital, reducing costs and cutting dividends.
Exam ples of the latter include reducing new investm ent or
selling assets with positive risk weights. In addition to explicit
actions, actions may be implicitly accounted for in the econom ic
capital model itself. In measuring m arket risk, for exam ple, some
assumptions may be made to adjust the short time horizon in
the model to the typically longer tim e horizon used in an eco­
nomic capital fram ework.
Finally, banks do not seem to take into account constraints that
could im pede the effective implementation of m anagem ent
actions. Such constraints may relate to legal issues, reputa­
tional effects, and cross-border operations. Further analysis
of the range and plausibility of these built-in assumptions
about m anagem ent action, particularly in tim es of stress, may
be warranted.
Role of Stress Testing
Currently, many banks apply stress tests, including scenario
analysis and sensitivity analysis, to individual risks, although the
fram ework and procedures still need to be im proved. The use
of integrated stress tests is gradually becoming more w ide­
spread in the industry, probably reflecting the need to assess
the impact of stress events on overall econom ic capital m ea­
sures and to provide com plem entary estim ates of capital needs
in the context of IC A A R A t present, there exists wide variation
among banks in the level and extent of integrated stress tests
being utilised. In general however, practices are still in the
developm ent stage.
Stress test results do not necessarily lead to additional capital.
Rather, it seem s more common that stress tests are used to
confirm the validity of econom ic capital m easures, to provide
com plem entary estim ates of capital needs, to consider contin­
gency planning and m anagem ent actions, and gradually to for­
mulate capital planning. In some cases, banks use stress tests to
determ ine the effects of stressed market conditions on earnings
rather than on econom ic capital measures.
Economic Capital Should Not Be the Sole
Determinant of Required Capital
In general, both rating agencies and shareholders influence
the level of a bank's capital, with the form er stressing higher
capital for solvency and the latter lower capital for profitability.
Banks also look to peers in targeting their capital ratios. Nearly
all large, internationally active banks set their economic capital
solvency standard at a level they perceive to be required to
maintain a specific external rating (e.g ., A A ). Banks tend to look
to peers in choosing external ratings and associated solvency
standards. There is not a lot of evidence that bank counterparties
have an impact on capital levels, other than indirectly through
the need to deal with institutions having an acceptably high
external rating. Many banks claim to target a high external rating
because of their desire to access capital and derivatives markets.
Definition of Available Capital
There is no common definition of available capital across banks,
either within a country or across countries. Some of the confu­
sion surrounding the notion of available capital may arise from
the fact that econom ic capital has its origin in assessing relative
profitability for the shareholder on a risk-adjusted basis. To the
extent that a bank recognises its capital needs are not limited
by the more quantifiable risks in its econom ic capital model, the
broader it may choose to define available capital.
W hile no common definition of available capital exists, there are
several elem ents that many banks have in common with regard
to their available capital. A t the root of many banks' definitions
of available capital are tangible equity, tier 1 capital or capital
definitions used by rating agencies. In order to cover losses at
higher levels of confidence, some banks consider capital instru­
ments that may be loss-absorbing, more innovative or uncertain
forms of capital such as subordinated debt. Am ong the various
items that can be included in the definition of available capital
(some of them included in the regulatory definition of capital)
are common equity, preferred shares, adjusted common equity,
perpetual non-cumulative preference shares, retained earning,
intangible assets (e.g ., goodwill), surplus provisions, reserves,
contributed surplus, current net profit, planned earning, unre­
alised profits and m ortgage servicing rights.
This range of practices is confirmed by the IFRI and C R O Forum
(2007) survey of enterprise-wide risk m anagem ent at banks and
insurance com panies, which found 80% of participants adjusted
their tier 1 capital in arriving at available capital resources
against which econom ic capital was com pared.
Banks do not limit them selves to a single capital measure. Some
banks manage their capital structure against external dem ands,
such as regulatory capital requirem ents or credit rating agency
expectations. O ften banks' definition of capital aligns with the
more tangible capital measures such as those used by rating
agencies and are, therefore, more restrictive than regulatory
definitions of capital.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
Senior Management Commitment to the
Economic Capital Process
The viability and usefulness of a bank's econom ic capital pro­
cesses depend critically on the existence of credible com m it­
ment or "buy-in" on the part of senior m anagem ent to the
process. In order for this to occur, senior m anagem ent must
recognise the im portance of using econom ic capital measures in
conducting the bank's business and capital planning. In addition,
adequate resources must be com mitted to ensure the existence
of a strong, credible infrastructure to support the econom ic
capital process.
Transparency and Meaningfulness of Economic
Capital Measures
Economic capital model results need to be transparent and taken
seriously in order to be useful to senior management for making
business decisions and for risk management. The level of docu­
mentation and integrity of calculations and model version control
increase with the scope and significance of economic capital
models in a bank's decision-making process. Internal transpar­
ency is a necessary condition for internal acceptance and use.
1 3 .5 R IS K M E A S U R E S
W hile risk is a notion with a clear intuitive meaning, it is less clear
how risk should be quantified. Current practice in banks com ­
monly involves trying to identify ways to characterise entire loss
distributions (i.e., going beyond estimating selected moments of
the loss distribution, such as the mean and standard deviation),
resulting in a wide range of potential risk measures that may be
used. The choice of risk measure has important implications for
the assessm ent of risk. For exam ple, the choice of risk measure
could have an impact on the relative risk levels of asset classes
and thus on the bank's strategy. Com parisons between ICAAP
measures of capital under Pillar 2 with minimum regulatory capi­
tal requirements under Pillar 1 should consider the impact of
using different measures of risk in the two approaches.
Desirable Characteristics of Risk Measures
An ideal risk measure should be intuitive, stable, easy to com ­
pute, easy to understand, coherent and interpretable in eco­
nomic term s. Additionally, risk decom position based on the risk
measure should be simple and meaningful.
Intuitive: The risk measure should meaningfully align with some
intuitive notion of risk, such as unexpected losses.
Stable: Small changes in model param eters should not produce
large changes in the estim ated loss distribution and the risk
■ 205
measure. Similarly, another run of a simulation model in order
to generate a loss distribution should not produce a dramatic
change in the risk measure. Also, it is desirable for the risk m ea­
sure not to be overly sensitive to m odest changes in underlying
model assumptions.
Easy to co m p u te: The calculation of the risk measure should be
as easy as possible. In particular, the selection of more com plex
risk measures should be supported by evidence that the incre­
mental gain in accuracy outweighs the cost of the additional
com plexity.
Easy to understand: The risk measure should be easily under­
stood by the bank's senior m anagem ent. There should be a link
to other well-known risk measures that influence the risk man­
agem ent of a bank. If not understood by senior m anagem ent,
the risk measure will most likely not have much impact on daily
risk m anagem ent and business decisions, which would limit its
appropriateness.
C oh eren t: The risk measure should be coherent and satisfy the
conditions of: (i) monotonicity (if a portfolio Y is always worth at
least as much as X in all scenarios, then Y cannot be riskier
than X); (ii) positive hom ogeneity (if all exposures in a portfolio
are multiplied by the same factor, the risk measure also multi­
plies by that factor); (iii) translation invariance (if a fixed, risk-free
asset is added to a portfolio, the risk measure decreases to
reflect the reduction in risk); and (iv) subadditivity (the risk m ea­
sure of two portfolios, if com bined, is always sm aller or equal to
the sum of the risk measures of the two individual portfolios). O f
particular interest is the last property, which ensures that a risk
measure appropriately accounts for diversification.6
Sim ple and m eaningful risk decom position (risk contributions or
capital allocation): In order to be useful for daily risk m anage­
ment, the risk measured for the entire portfolio must be able
to be decom posed to sm aller units (e.g ., business lines or indi­
vidual exposures). If the loss distribution incorporates diversifica­
tion effects, these effects should be meaningfully distributed to
the individual business lines.
Types of Risk Measures
In practical applications, a wide range of risk measures are used.
This section exam ines standard deviation, value-at-risk (VaR),
expected shortfall (ES), and spectral and distorted risk m ea­
sures.7 All the risk measures have strengths and weaknesses,
6 See Artzner et. al. (1997) on coherent risk measures for a complete
discussion.
7 See Hull (2007) for a detailed discussion of the various risk measures.
206 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
since no single measure can capture all the com plex elem ents of
risk m easurem ent. As such, there is no ideal risk measure.
Table 13.1 presents (with some degree of subjective judgm ent)
the characteristics of the main types of risk measures.
In practice, VaR and ES are the tw o m ost w id ely used risk
m easures. W hile VaR is more easily exp lained and understood,
it may not alw ays satisfy the subad ditivity condition and this
(lack of coherence) can cause problem s in banks' internal cap i­
tal allocation and limit setting for su b -p o rtfo lio s.8 ES, on the
other hand, is coherent, making capital allocation and internal
limit setting consistent with the overall portfolio m easure of
risk. However, ES does not lend itself to easy interpretation
and does not afford a clear link to a bank's desired targ et rat­
ing. A new er class of risk m easures, known as spectral and
distorted risk m easures, allow for different w eights to be
assigned to the quantiles of a loss distribution, rather than
assum ing equal w eights for all observations, as is the case
for E S .9
Banks typically use several of the aforem entioned risk measures,
and som etim es different measures for different purposes. How­
ever, VaR is the most widely used risk measure. Some banks
use VaR for measuring the absolute risk level, but increasingly
ES is used (at a confidence level consistent with overall VaR) for
capital allocation within the bank. The argument is often made
that VaR as an absolute risk measure or loss limit is still easier to
com m unicate to senior m anagem ent due to its link to a bank's
target rating. On the other hand, ES is a more stable measure
than VaR with respect to allocating the overall portfolio capital
to individual facilities. ES is a loss measure estim ate given a loss
range in the tail of the loss distribution, while VaR is a loss m ea­
sure estim ated given a particular point in the tail of the loss dis­
tribution. It should be noted that, while a bank may use different
risk m easures, these measures are typically based on the same
estim ated loss distribution.
8 VaR is subadditive for elliptical distributions, such as the Gaussian (or
normal) distribution, whereas it is not subadditive for non-elliptical dis­
tributions. The non-subadditivity of VaR can occur when assets in port­
folios have very skewed loss distributions; when the loss distributions
of assets are smooth and symmetric, but their dependency structure
or copula is highly asymmetric; and when underlying risk factors are
independent but very heavy-tailed. The lack of subadditivity for VaR is
probably more of a concern for credit risk and operational risk than for
market risk, where an elliptical model may be a reasonable approximate
model for various kinds of risk-factor data. For a detailed discussion,
see McNeil et. al. (2005). Many practitioners note however, that the
technical reservations concerning VaR are mainly academic in nature
and that the problems described are encountered by banks only rarely
in practice.
9 Spectral and distorted risk measures are not widely used in practice
and are currently largely of academic interest.
Table 13.1 Risk Measures
S p e ctra l and D isto rte d
S tan d ard D eviatio n VaR E xp e c te d S h o rtfa ll R isk M easu res

In tu itive Sufficiently intuitive Yes Sufficiently intuitive No (involves choice of

spectrum or distortion
function)

S tab le No, depends on No, depends on Depends on the loss Depends on the loss
assumptions about loss assumptions about loss distribution distribution
distribution distribution

E a sy to com pute Yes Sufficiently easy Sufficiently easy Sufficiently easy

(requires estim ate of loss (requires estim ate of (weighing of loss
distribution) loss distribution) distribution by spectrum/
distortion function)

E a sy to u nd erstand Yes Yes Sufficiently Not im m ediately

understandable

C o h e ren t Violates monotonicity Violates subadditivity Yes Yes

(for non-elliptical loss
distributions)

Sim p le and m eaningful Sim ple, but not very Not sim ple, might Relatively simple and Relatively simple and
risk d eco m p o sitio n meaningful induce distorted choices meaningful meaningful

Calculation of Risk Measures
Confidence Level
In their internal use of risk m easures, banks need to deter­
mine an appropriate confidence level for their econom ic capi­
tal models that may vary for different business models. The
banks' target rating plays an im portant role in the choice of
confidence level.
The link between a bank's target rating and the choice of con­
fidence level may be interpreted as the amount of econom ic
capital that must be exceeded by available capital resources to
prevent the bank from eroding its capital buffer at a given con­
fidence level. According to this view, which can be interpreted
as a going concern view, capital planning is seen more as a
dynamic exercise than a static one, where it is the probability
of eroding such a buffer (rather than all available capital) that is
linked to the target rating. This would reflect the expectation (by
analysts, rating agencies and the market) that the bank operates
with capital that exceeds the regulatory minimum requirem ent.
Establishing the link between a bank's target rating and the
choice of confidence level, however, is far from being an easy
exercise. It involves the mapping between ratings and PDs,
which can change, depending on the rating agency scale
adopted, and it suffers from significant statistical noise, espe­
cially at the higher rating grades which are typically targeted by
banks. Banks can use a range of confidence levels for the same
target rating, with overlaps between different rating classes.
For exam ple, the IFRI and C R O Forum (2007) survey found that
PDs mapped to a A A target rating range from two to seven
basis points, while the range for an A target rating is four to ten
basis points.
Apart from considerations about the link to a target rating, the
choice of a confidence level might differ based on the question
to be addressed. On the one hand, high confidence levels reflect
the perspective of creditors, rating agencies and supervisors in
that they are used to determ ine the amount of capital required
to minimise bankruptcy risk. On the other hand, banks may use
lower confidence levels for m anagem ent purposes in order to
allocate capital to business lines and/or individual exposures and
to identify those exposures that are critical for profit objectives
in a normal business environment. Consequently, banks typically
use different confidence levels for different purposes.
Another interesting aspect of the internal use of different risk
measures is that the choice of risk measure and confidence
level heavily influences relative capital allocations to individual
exposures or portfolios. In short, the farther out in the tail of
a loss distribution, the more relative capital gets allocated to
concentrated exposures. As such, the choice of the risk measure
as well as the confidence level can have a strategic impact since
some portfolios might look relatively better or worse under risk-
adjusted perform ance measures than they would based on an
alternative risk measure.

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 207

Time Horizon supervisors should consider the advantages and disadvantages
of the risk measure used at each bank. Stability in computation
All risk measures depend on the tim e horizon used in their m ea­
is an im portant issue, as the calculation of risk measures typically
surem ent. The choice of an appropriate time horizon depends
involves the use of simulation techniques. The ability to easily
on a range of factors: the liquidity of the bank's assets under
and sensibly aggregate and decom pose risk also determ ines the
consideration; the risk m anagem ent needs of the bank; the
effective use of risk measures in the bank. The degree to which
bank's standing in the m arkets; the risk type, etc. M arket risk
econom ic capital is engrained in the decision-making processes
is typically estim ated over a very short tim e horizon (days or
is strongly affected by the availability of a broad assessm ent of
weeks). In contrast, credit risk is typically measured using a
risks at the senior m anagem ent level, where strategic decisions
one-year tim e horizon, while an even longer tim e horizon may
are made with respect to capital m anagem ent. In contrast, more
be appropriate for other portfolios (e.g ., project finance). The
granular measures of risk are needed at the risk-taking levels
choice of tim e horizon is also influenced by regulatory require­
where econom ic capital is likely to influence operational deci­
ments. For exam ple, a one-year tim e horizon is specified for
sions through factors such as capital allocation, limit setting, and
operational risk, while a 10-day time horizon is specified for gen­
perform ance m easurem ent.
eral and specific m arket risk.
W hile each bank chooses both the risk measure and the confi­
The heterogeneity of tim e horizons used in risk m easurem ent
dence level it deem s most appropriate for its econom ic capital
poses an im portant challenge to banks in aggregating econom ic
purposes, the bank must be able to provide a convincing eco­
capital across different risk types. According to the IFRI and
nomic rationale for the choice. If different risk measures and/
C RO Forum (2007) survey about 80% of participants use a time
or confidence levels are used for external and internal m anage­
horizon of one year for their econom ic capital calculations, with
ment purposes, a clear and convincing link must be established
the rem ainder using various time horizons.
between the two risk measures.

Aggregation/Decomposition Supervisors should be aware of differences between internal and

regulatory measures of capital that stem from different risk mea­
M easurem ent of risk is typically perform ed at the portfolio
sures and/or confidence levels and take these into account when
level. However the ability to easily and sensibly aggregate and
evaluating a banks' IC A A R A simple comparison of internal and
decom pose risks is an im portant feature of any risk measure.
regulatory capital figures will not tell supervisors much about the
In order to be effectively used, risk measures should be fle x­ underlying risks in a bank's portfolio.
ible and able to be com puted at either a broad or narrow level.
More specifically:

• Decom position: Within a portfolio, risk needs to be decom ­

1 3 .6 R IS K A G G R E G A T IO N
posed in order to establish for each subset (e.g ., positions
Typically, econom ic capital is calculated using an approach that
assigned to each desk) its risk contribution (taking into
first assesses individual risk com ponents, and then proceeds to
account any diversification effects). Decom position of risk
aggregate these com ponents up to the level of the entire bank.
is fundamental for capital allocation, limit setting, pricing of
The aggregation process is characterised by identification of the
products, risk-adjusted perform ance m easurem ent and value-
individual risk types and by the methodological choices made in
based m anagem ent.
aggregating these risk types.
• Aggregation: Adopting a wider point of view, risks arising
from several portfolios need to be aggregated in order to con­
vey a representation of risk at the business unit or entity level. Aggregation Framework
Aggregation also deals with different types of risk (credit, mar­
Risk aggregation begins with a classification of risk types that
ket, operational, liquidity, legal, etc.). Typically, the outcome of
are combined to produce the overall econom ic capital measure.
risk aggregation is the bank's total economic capital.
Banks typically classify risk into different types along two dim en­
sions: (i) the econom ic nature of the risk (market risk, credit risk,
Supervisory Concerns Relating to Risk operational risk, etc.); and (ii) the organisational structure of the
Measures bank (along business lines or legal entities).

From a supervisory point of view, there is no obvious prefer­ In contrast to classification along organisational lines, which
ence for one risk measure over another among the measures presents few conceptual difficulties, classification along risk
most widely used for calculating econom ic capital. Rather, types can be im precise. Definitions of risk types may differ

208 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
across institutions, or even across portfolios within a single bank­
ing organisation, often reflecting the nature of the bank's busi­
ness or the degree of sophistication of its risk m easurem ent. As
discussed below, this imprecision has implications for the aggre­
gation process.
The following list provides a brief description of the main cat­
egories into which the typical fram ework classifies risks.
M arket risk: Refers to portfolio value changes due to changes
in rates and prices that are perceived as exogenous from the
viewpoint of the bank. These com prise exposures to asset
classes such as equities, com m odities, foreign exchange and
fixed-incom e, as well as to changes in discount factors such as
the risk-free yield curve and risk premiums. A specific type of
market risk is IRRBB, which stem s from repricing risk (arising
from differences in the maturity and repricing term s of custom er
loans and liabilities), yield curve risk (stemming from asym m etric
movements in rates along the yield curve), and basis risk (arising
from im perfect correlation in the adjustm ent of the rates earned
and paid on different financial instruments with otherwise similar
repricing characteristics). IRRBB also arises from the em bed­
ded option features of many financial instruments on banks'
balance sheets.
C red it risk: Refers to portfolio value changes due to shifts in the
likelihood that an obligor (or counterparty) may fail to deliver
cash flows (principal and interest) as previously contracted. The
distinction between market and credit risk, while fairly clear
on the surface, is less so in practice since individual exposures
typically contain elem ents of both risks. For exam ple, prices of
corporate bonds can vary because of changes in the perceived
likelihood of issuer default but also because shifts in the risk-free
yield curve. In addition, credit and market risk factors can inter­
act in ways that com plicate the distinction between the two (see
the next section).
O perational risk: Refers to the risk of loss associated with human
or system failures, as well as fraud, natural disaster and litiga­
tion. W hile not a pure econom ic risk it does represent losses
(either outright outlays or foregone earnings) from all types of
activity where banks engage, and it is indirectly linked to the
level, intensity and com plexity of these activities.
Business risk: Captures the risk to the firm's future earnings, divi­
dend distributions and equity price. In leading practice banks,
business risk is more clearly defined as the risk that volumes
may decline or margins may shrink, with no opportunity to offset
the revenue declines with a reduction in costs. For exam ple,
business risk measures the risk that a business may lose value
because its custom ers sharply curtail their activities during a
market down-turn or because a new entrant takes market share
away from the bank. Moreover, this risk increasingly extends
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
beyond balance-sheet items to fee-generating services, such as
origination, cash m anagem ent, asset m anagem ent, securities
underwriting and client advisory services.
For business or (local) regulatory reasons, some banks may
select to distinguish individual types of risk within the listed cat­
egories. For exam ple, they may isolate real estate risk, or pen­
sion risk. Some banks may also distinguish other risk types such
as liquidity risk and legal risk.
Range of Practices in the Choice of Risk Types
All the risk types discussed above can be sim ultaneously pres­
ent in a bank's portfolio. For exam ple, a traded bond portfolio
will have an im portant credit and market risk com ponent, as well
as operational risk related to the efficiency of trading execution
and settlem ent. In practice, however, risks are often measured
by reference to different lines of business and/or portfolios.
A loan portfolio that is held to maturity and managed on an
accrual accounting basis is often considered as representing
credit risk and not market risk. By contrast, a trading portfolio
of credit derivatives is often taken to represent mainly market
risk by virtue of it containing actively traded exposures that are
marked-to-market.
The majority of banks prefer to aggregate risk initially into silos
by risk-type across the entire bank before combining the silos.
This approach, however, is by no means the only approach fol­
lowed, with the business unit silo approach preferred by other
banks. Some banks use a mixed approach, which combines
elem ents of both approaches. This practice is observed where
either particular business units or risk exposures are too small to
be meaningfully measured separately.
Grouping of risks first across hom ogeneous risk types has a
benefit of addressing these questions at a single stage and in
a centralised and potentially more consistent way. By com pari­
son, grouping risks first by business unit leverages the existing
organisational structures within the bank and deals with inter­
risk relationships at an earlier stage of aggregation.
Aggregation Methodologies
The risk aggregation m ethodology used by a bank has two
(interrelated) com ponents: the choice of the unit of account and
the approach taken to combining risk com ponents.
The Unit of Account
Before risk types are aggregated into a single measure, they
need to be expressed in com parable units, often referred to as a
common risk currency. Meaningful aggregation requires that the
underlying risk measures conform to each other, especially when
■ 209
they relate to single number summaries of the corresponding
risk distributions. There are three main characteristics of the unit
of risk accounting.
Risk m etric: The choice of the risk metric for econom ic capital
depends on the metrics that are used in the quantification of dif­
ferent risk com ponents. In particular, w hether the chosen metric
satisfies the subadditivity property is relevant for quantifying
diversification across risk typ e s.101
C on fid en ce level: The fact that the loss distribution for different
risk types are typically assumed to have different shapes (i.e.,
different fam ilies of probability distributions are assumed to bet­
ter capture the characteristics of different types of risk) may also
suggest a difference in term s of the relevant confidence levels.
For exam ple, long-tailed risk distributions would suggest using
higher confidence levels. Lack of harmonisation in term s of the
choice of confidence level creates additional com plexity in
aggregation approaches.11 Moreover, the choice of confidence
level can influence the ranking of risks since risk types that have
a loss distribution with a longer loss tail tend to dom inate as the
confidence level increases.
Time horizon: The choice of the horizon over which risk is m ea­
sured is one of the thorniest issues in risk aggregation. Business
practice, accounting standards and regulatory requirements
combine to imply that different types of risk are managed over
different horizons. Traded portfolios are managed over horizons
that are typically measured in days. Less liquid exposures, such
as loans, are managed over longer horizons of one year or lon­
ger.12 Com bining risk measures that have been calculated on
the basis of different horizons is problem atic regardless of the
specific m ethodology used. The conflict between business prac­
tices and risk aggregation requirem ents is typically resolved by
using a common (usually one year) horizon. This means that it is
necessary for time aggregation of certain types of risk (most
often market risk) by using scaling-up methods such as the
square-root-of-time rule. It should be noted that there is no con­
ceptual inconsistency in the use of different horizons for risk
m easurem ent and EC purposes, on the one hand, and for the
actual m anagem ent of underlying exposures, on the other. D eci­
sions related to the m anagem ent of portfolios are based on the
10 See the section on risk m easures for a more detailed discussion of the
properties of different m etrics of risk.
11 More sophisticated m ethods that use full simulation approaches or
those that describe the entire loss distribution (such as those based on
copulas) would not be influenced by this choice.
12 Even with the same tim e horizon for default, the practice of active
credit portfolio m anagem ent can result in the use of point-in-time
default probabilities for day-to-day risk m anagem ent with through-the-
cycle estim ates for econom ic capital com putations.
210 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
characteristics of the exposures (including their liquidity) and on
the purpose for which they are held. However, for the purpose
of risk m easurem ent and, especially, risk aggregation the use of
different horizons will result in im proper com parisons between
risk com ponents. The difficulty that arises for the latter purposes
can be overcom e by methods similar to the constant level of risk
over a common horizon approach outlined in the consultative
paper of the BCBS on computing incremental risk in the trading
book.13
Inter-Risk Diversification
The way that individual risks are com bined relates closely to the
scope of inter-risk diversification, namely to the notion that the
combination of two portfolios would result in lower risk per unit
of investm ent in the combined portfolio than the (weighted)
average of the two com ponent portfolios. The basic intuition
stems from the fact that the variance of the pooled portfolio's
return will be no greater (and typically smaller) than a similarly
sized portfolio which is exposed to only one or the other risk
factor. This logic will carry over to measures of risk that are
directly related to variance.
In the context of risk aggregation across different portfolios
or business units, some of the assumptions that underpin the
above logic may fail to hold. One issue is purely technical and
relates to the choice of VaR as a metric because it can fail to sat­
isfy the subadditivity property. That is, it is possible for the VaR
of a pooled portfolio to be higher than the sum of the VaR of
the individual constituent portfolios.
A more im portant reason why aggregate risk may be larger than
the sum of its com ponents is independent of the choice of m et­
ric (i.e., it applies to metrics other than VaR) and relates to the
econom ic underpinnings of the portfolios that are pooled. The
logic outlined above assumes that covariance (a linear measure
of dependence) fully captures and summarises the dependen­
cies across risks. W hile this may be a reasonable approximation
in many cases, there are instances where the risk interactions are
such that the resulting combination may represent higher, not
lower, risk. For exam ple, measuring separately the market and
credit risk com ponents in a portfolio of foreign currency denom ­
inated loans can underestim ate risk, since probabilities of obli­
gor default will also be affected by fluctuation in the exchange
rate, giving rise to a compounding e ffe ct.14 Similar types of
13 Basel Com m ittee on Banking Supervision (2009).
14 See Breuer et. al. (2008) for further details. The forthcom ing working
paper on the "Interactions betw een m arket and credit risk" produced by
the Research Task Force of the Basel Com m ittee also offers an elabora­
tion on this set of issues.
"wrong-way" interactions could occur in the context of portfolio
positions that may be sim ultaneously affected by directional
market moves and the failure of counterparties to a hedging
tr
position. From a more "m acro" perspective, asset price volatil­
a
ity often interacts with the risk appetite of market participants
and feeds back to market liquidity leading to a magnification of
risk rather than diversification.
A final issue that relates to the degree of diversification has to
do with the granularity of the classification system of risks. The
more granular the classification system (i.e., the finer the system
of categories where risk is slotted) the more reduced should be
the scope for intra-risk diversification and the higher the scope
for inter-risk diversification. For exam ple, holding everything
else equal, some of the overall diversification between the retail
and wholesale credit portfolio of a bank will be subsumed in
the measure of overall credit risk for a bank that does not dis­
tinguish between the two types of risks in its econom ic capital
fram ework, while it will be picked up by the aggregation pro­
cess in the case that the bank maintains a separation between
the two com ponents until the final aggregation stage.
Typically Used Aggregation Methodologies
Banks differ in their choice of m ethodology for the aggregation
of econom ic capital. The list below provides an overview of the
main approaches followed by a brief discussion of their advan­
tages and disadvantages. The approaches are listed in increas­
ing order of com plexity (decreasing order of restrictiveness).
(i) Sim ple sum m ation: This simple approach involves adding
the individual risk com ponents. Typically, this is perceived
as a conservative approach since it ignores potential diver­
sification benefits and produces an upper bound to the
true econom ic capital figure. Technically, it is equivalent
to assuming that all inter-risk correlations are equal to one
and that each risk com ponent receives equal weight in the
summation.
(ii) Applying a fixe d diversification percentage: This approach
is essentially the same as the simple summation approach
with the only difference that it assumes the sum delivers a
fixed level of diversification benefits, set at some pre-speci-
fied level of overall risk.
(iii) Aggregation on the basis of a risk variance-covariance
m atrix: The approach allows for a richer pattern of inter­
actions across risk types. However, these interactions are
still assumed to be linear and fixed over tim e. The overall
diversification benefit depends on the size of the pairwise
correlations between risks.
1^
See A nnex 2 on counterparty credit risk for a fuller discussion.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
(iv) C opulas: This is a much more flexible approach to com bin­
ing individual risks than the use of a covariance matrix. The
copula is a function that com bines marginal probability
distributions into a joint probability distribution. The choice
of the functional form for the copula has a material effect
on the shape of the joint distribution and can allow for rich
interactions between risks.
(v) Full modelling of common risk drivers across all portfolios:
This represents the theoretically pure approach. Common
underlying drivers of risk are identified and their interac­
tions m odelled. Simulation of the common drivers (or
scenario analysis) provides the basis for calculating the dis­
tribution of outcom es and econom ic capital risk measure.
Applied literally, this method would produce an overall risk
measure in a single step since it would account for all risk
interdependencies and effects for the entire bank. A less
com prehensive approach would use estim ated sensitivities
of risk types to a large set of underlying fundamental risk
factors and construct the joint distribution of outcomes
by tracking the effect of simulating these factors across all
portfolios and business units.
Table 13.2 provides a summary of the trade-offs between
numerical accuracy, m ethodological consistency, intuitive
appeal, practicality, flexibility, and resource implications associ­
ated with each of the aggregation m ethodologies.
Although the m ost restrictive of the alternative m ethod­
o logies, the main advantages of the sum m ation and fixed
diversification m ethodologies are sim plicity in term s of data
and com putational requirem ents, and ease of com m unica­
tion about the m ethod and interpretation of the outcom e.
A b stractin g from the possibility of m ism easurem ent and
negative correlation betw een the underlying risk com ponents,
the sim ple sum m ation approach could also produce a conser­
vative m easure of overall risk (i.e ., o verstatem ent of risk). The
degree of conservatism associated with the fixed d ive rsifica­
tion m ethod depend s on the chosen diversification param ­
eter. Both m ethods are relatively crude and do not allow for
m eaningful interactions betw een risk typ es or for differences
in the w ay these risk typ es may create diversification benefits.
In addition, both m ethods ignore com plications stem m ing
from using different confidence levels in m easuring individual
risk com ponents.
The use of a variance-covariance m atrix (or correlation matrix)
which sum marises the interdependencies across risk types
provides a more flexible fram ework for recognising diversifica­
tion benefits, while still maintaining the desirable features of
being intuitive and easy to com m unicate. The correlation matrix
between risks is of key im portance. This m atrix can vary across
■ 211
Table 13.2 C o m p ariso n of Risk A g g reg atio n M eth o d o lo g ies

Aggregation Methodology Advantages Disadvantages

Summation: Adds together individual Simplicity It does not discrim inate across risk types;
capital com ponents Typically considered to be conservative imposes equal weighting assumption
Does not capture nonlinearities

Constant diversification: Similar Sim plicity and recognition of The fixed diversification effect is not
to summation but subtracts fixed diversification effects sensitive to underlying interactions between
percentage from overall figure com ponents.
Does not capture nonlinearities

Variance-Covariance: W eighted sum Better approxim ation of analytical method Estim ates of inter-risk correlations difficult
of com ponents on basis of bilateral Relatively simple and intuitive to obtain
correlation between risks Does not capture nonlinearities

Copulas: combine marginal More flexible than covariance matrix Param eterisation very difficult to validate
distributions through copula functions Allows for nonlinearities and higher order Building a joint distribution very difficult
dependencies

Full modelling/Simulation: Simulate
the impact of common risk drivers on
all risk com ponents and construct the
joint distribution of losses
Theoretically the most appealing method Practically the most demanding in term s of
Potentially the most accurate method inputs
Intuitive Very high dem ands on IT
Tim e consuming
Can provide false sense of accuracy

banks reflecting differences in their business mix, and the cor­
relations that reflect these institution-specific characteristics
can be difficult as well as costly to estim ate and validate. This
is particularly true for operational risk, where data are scarce
and do not cover long time periods. In addition, by focusing on
average covariance between risks, the linearity assumption will
tend to underestim ate dependence in the tail of loss distribu­
tions and underestim ate the effects of skewed distributions and
non-linear dependencies.
Copulas offer even greater flexibility in the aggregation of risks
and promise a better approxim ation of the true risk distribu­
tion. This com es at the expense of more dem anding input
requirem ents: com plete distributions of the individual risk
com ponents rather than sim ple sum mary statistics (such as VaR)
and at least as much data as the variance-covariance approach
for estim ating the copula param eters. As for the variance-
covariance m ethod, these estim ates are hard to derive and to
validate. Many of the same draw backs apply to the case of full
m odels of econom ic capital, including full simulation m ethods.
The input requirem ents in term s of data on exposures and
underlying risk factor dynam ics, as well as the com putational
dem ands associated with large scale sim ulations represent a
strain for most banks, especially those banks with more com ­
plex business risk profiles.
Range of Practices in the Choice of
Aggregation Methodology
Currently, there is no established set of best practices con­
cerning risk aggregation in the industry. G enerally the cho­
sen approaches tend to be towards the sim pler end of the
spectrum , with very few (typically large) banks using the more
sophisticated m ethodologies. The vast majority of banks use
some form of the summation approach, where risks are either
explicitly w eighted, as in the case of the variance-covariance
approach, or implicitly weighted (as in the case of simple aggre­
gation). The IFRI and C RO Forum (2007) survey suggests that
more than 60% of banks use the variance-covariance approach
while less than 20% use the simulation approaches. Reportedly,
the stability of the latter approach over tim e is an attractive
aspect from a governance perspective, since it leads to a more
stable allocation of diversification benefits back to individual
business units.
Banks use a variety of approaches in setting values for the inter­
risk variance-covariance matrix. These approaches include direct
estimation using historical time series on underlying risks, expert
judgm ent, and industry benchmarks (frequently supplied by con­
sulting firms). The estimation based on internal data is arguably
more appropriate since it reflects the actual experience of the

212 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
bank and is more directly applicable to its business and risk pro­ sophisticated econom ic capital m ethodologies to follow a prin­
file. As suggested above, the interactions between risk com po­ ciple of conservatism in their approaches.
nents can be com plex, non-linear, tim e varying, and dependent
W hatever the method and the estim ates used, there are a num­
on m easurem ent choices. If the bank possesses relevant data of
ber of com m onalities in the assumptions made by banks. For
sufficient quality and length, these data should provide the most
instance, a high correlation between market and credit risks is
appropriate indicators of inter-risk dependencies. These data
usually assum ed, a lower correlation between business risk and
can be related to the perform ance of portfolios (P&L, earnings,
credit or m arket risk, and a very low correlation between opera­
loss history, etc.). Often risks that present greater quantification
tional risk and all other risks.
challenges need to be approxim ated by banks with less well
developed IT system s. In these cases, the correlation between Related to the calibration of the covariance m atrix of risks is

risk com ponents is in practice often approxim ated by the co­ the overall level of diversification across risk types. A cco rd ­

m ovem ent of asset price indices representative of these risk fac­ ing to the IFRI and C R O Forum (2007) survey, the estim ated
tors, or similar proxies. range of inter-risk diversification is 10% to 30% for banking
organisations (with 40% of banks reporting gains between 15%
Very often bank-specific data are simply not available or of poor
and 20%). This range depends on the m ethod used by banks
quality. In this case the entries in the variance-covariance matrix
in order to take into account inter-risk diversification and the
are filled on the basis of expert judgm ent, in the form of param ­
varying estim ates of correlation betw een risk types. A cadem ic
eters that reflect the consensus of risk officers and business
studies on this issue indicate that this range can vary very sub­
managers within the firm, and this is frequently com plem ented
stantially depending on the applied m ethodology and the data
with input from external consultants and industry benchm arks.
used. Rosenberg and Schuerm ann (2006) estim ate this diver­
This is particularly true when it applies to some risk com po­
sification at more than 40% at the 99.9% confidence level but
nents such as operational risk or business risk. The reliance on
underscore that this might vary depending on the specific port­
externally supplied inputs may be a necessity for medium and
folio com position. Dim akos and Aas (2004) on the other hand
small-sized institutions that lack the capacity, scope and scale
find only 10%—12% diversification at confidence intervals of
econom ies to develop risk correlation measures based on their
95% to 99% , but a num ber closer to 20% at confidence interval
own experience. The same applies to proportionately small
of 99.97% .
exposures in the case of larger institutions.

There is a tendency for banks to use what they consider as a

"conservative" variance-covariance matrix. The correlations are Supervisory Concerns Relating to Risk
often reported to be approxim ate (e.g ., rounded up to multiples Aggregation
of 25 percentage points) and biased upwards (i.e., towards
An im portant overall m essage is that meaningful aggregation
unity). In an effort to reduce the need for expert judgm ent
of risk necessarily involves com prom ises and ju d g m e n t to aug­
banks might consciously limit the dim ensionality of the m atrix by
ment quantitative m ethods. Risk m easurem ent in portfolios
consolidating risk categories to a small number, not recognising
that are more hom ogeneous in term s of their risk drivers can
that such consolidation itself represents a form of aggregation
be quite detailed and can address different facets of risk. The
and em beds correlation assumptions. One drawback of this
com bination of different types of risk into a common m etric,
practice is that each category becom es less hom ogeneous and
however, presents many more com plications stem ming either
thus harder to quantify. In light of uncertainties for estimating
from the different statistical profiles of risk types or from dif­
inter-risk diversification effects as well as the possibility that cor­
ferences in the perspective and requirem ents of the business
relations may be time-varying, some (but not all) banks use
units that m anage different portfolios (e.g ., the use of different
stressed values that refer to the periods when these correlations
m etrics and/or m anagem ent horizons). A ggregation, therefore,
may be higher than they are on average, or even set equal to
1A typically requires that some of the richness of assessm ents
unity. Even in those cases where average values are used,
made on the individual com ponents is sacrificed in order to
banks report that they exam ine the effect on the calculated eco­
achieve com parability.
nomic capital from using such stressed correlations as a robust­
ness check. G enerally, there is a tendency for banks with less1
*
6 In particular, supervisory concerns with the econom ic capital
aggregation relate to validation of the inputs, m ethodology, and
outputs of the process.
16 Using stressed correlations is also justified on the basis that, in peri­
ods of stress, available capital resources might be less "fungible" across Econom ic capital fram eworks are very difficult to validate. Eco­
risks/business units as im plicitly assumed in the aggregation of its uses. nomic capital refers to holistic measures of risk in often very

Chapter 13 Range of Practices and Issues in Economic Capital Frameworks ■ 213

diverse business environments. Moreover, the more tailored the
process to the character and needs of the individual bank, the
more difficult for an external observer to independently vali­
date the inputs. Additionally, the short history of available data
renders backtesting im practicable in most cases. Many supervi­
sors report that validation processes typically do not m eet their
expectations. In particular, many supervisors are sceptical as to
the validity of the size of diversification benefit estim ates and do
not accept them for supervisory use.
As mentioned above, the degree of diversification is linked to
the m easurem ent m ethodology of individual com ponents. From
an applied point of view the potential com plications with risk
m easurem ent are primarily related to the common practice of
identifying risk categories with individual portfolios. For a num­
ber of practical reasons that have to do with the way banks man­
age different types of risk, with financial reporting practices, and
with the regulatory fram ework, different types of risk are often
identified with single portfolios. For exam ple, market risk is
thought of being primarily associated with portfolios that are
held with the intention of active trading, are managed on a short
risk horizon, and are often marked-to-market. Credit risk is asso­
ciated mainly with the banking book which contains exposures
with a longer holding horizon, that they are often illiquid and
valued on an accrual basis. This sim plistic distinction can give
rise to mistaken assessm ents of m arket and credit risk com po­
nents that can bias the aggregation process.17 The main m es­
sage from the supervisory perspective is that diversification
cannot be taken as given irrespective of the portfolio of risks
and risk m easurem ent practices. There is a theoretical possibility
that risk com ponents may be mis-measured and that aggregate
risk may be higher than the sum of the risk com ponents. This
may be the exception rather than the rule, but the fact remains
that mis-measurement can often lead to under-estimation of
overall risk.
Finally a possible drawback of the more sophisticated m ethod­
ologies is more of a behavioural nature. Often greater m eth­
odological sophistication leads to greater confidence in the
accuracy of the outcom es. Given the diversity in the nature of
inputs, the im portance of assumptions that underline the param ­
eters used, and the scale of the task in practical applications,
the scope for hard-to detect and quantify inaccuracies is con­
siderable. C om plex approaches that are not accom panied by
robustness checks and estim ates of possible specification and
m easurem ent error can prove misleading.
17 A working paper of the Basel Com m ittee's W orking Group on the
Interaction of M arket and C red it Risk contains a more in-depth discus­
sion of these issues and references to relevant papers.
214 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
13.7 VALIDATION O F INTERNAL
ECO N O M IC CAPITAL M ODELS
In some cases the term validation is used exclusively to refer to
statistical ex post validation, while in other cases it is seen as
a broader but still quantitative process that also incorporates
evidence from the model developm ent stage. In this paper, the
term "validation" is used in a broad sense, meaning all the p ro ­
ce sse s that provide evid en ce-b a sed assessm ent about a m odel's
fitness for pu rp o se. This assessm ent might extend to the man­
agem ent and system s environm ent within which the model is
operated. Moreover, it is advisable that validation processes are
designed alongside developm ent of the m odels, rather than
chronologically following the model building process.
Validation provides evidence that a model works as planned.
Econom ic capital models can be com plex, embodying a lot of
moving parts and it may not be im m ediately obvious that a com ­
plex model works satisfactorily. Moreover, a model may em body
assumptions about relationships between variables or about
their behaviour under periods of stress. Validation can perm it
a degree of confidence that the assumptions are appropriate,
increasing the confidence of users (internal and external to the
bank) in the outputs of the model. Notably, validation also aids
in identifying model limitations, since no model (even when fully
validated) is ever a perfect representation of reality. W hile vali­
dation can provide powerful tools for the assessm ent of many
aspects of m odels, such as its risk sensitivity, it is less powerful
where other aspects of models are concerned, such as confirm­
ing the accuracy of high quantiles in a loss distribution.
Achieving an accurate fit may not always be the prime consider­
ation. For exam ple, some models may be developed because of
their usefulness as a fram ework for analysis or decision-making
rather than because of their ability to fit historical data. Some
m acroeconom ic models of econom ic behaviour may fall into
this category.
O ur interpretation of validation is consistent with that devel­
oped by the Basel Com m ittee (2005a) in relation to the Basel II
Fram ework, which is phrased in term s of the IRB param eters18
and was developed in the context of assessm ent of risk esti­
mates for use in minimum capital requirem ents. However, valida­
tion of econom ic capital models differs to the validation of an
IRB model as the output is a distribution rather than a single
18 From the 2005 Validation principles: "In the context of rating system s,
the term 'validation' encom passes a range of processes and activities
that contribute to an assessm ent of w hether ratings adequately differen­
tiate risk, and w hether estim ates of risk com ponents (such as PD, LG D or
EAD ) appropriately characterise the relevant aspects of risk."
predicted forecast against which actual outcom es may be com­
pared. Econom ic capital models are conceptually similar to VaR
m odels, though the long tim e horizon, high confidence levels,
and the scarcity of data force validation methods to differ in
practice to those used for VaR. Full internal econom ic capital
models are not used for Pillar 1 minimum capital requirem ents,
and so fitness for purpose needs to cover a range of uses, most
of which and perhaps all are internal to the firm in question. It
should also be noted that econom ic capital models and regula­
tory capital serve different objectives and so may reasonably dif­
fer in some of the details of their implementation for these
differing purposes.
Principle 1 of the Basel Com m ittee's validation principles refers
to assessm ent of the predictive ability of credit rating system s.192
0 incorporated into the Basel II Fram ework. Its relevance as a
The em phasis is on the perform ance of forecasts generated by
the model. As it stands, Principle 1 is about rating system s: the
natural developm ent of this principle for econom ic capital m od­
els is that validation is concerned with the predictive properties
of those models. Econom ic capital models em body forward-
looking estim ates of risk and their validation is intimately bound
up with assessing those estim ates and so this (re-stated) princi­
ple remains appropriate. The validation processes as set out in
this paper are, in their different ways, all providing insight into
the likely predictive ability of the m odel, interpreted broadly.
The other Basel II principles related to validation principles are:
the bank has primary responsibility for validation; validation is an
iterative process, there is no single m ethod, validations should
encom pass both quantitative and qualitative elem ents; and
validation processes and outcom es should be subject to inde­
pendent review. The notion of validation expressed in this paper
is consistent with these principles. Our discussion of validation
does not address, however, the question of who needs to per­
form the model assessm ent or which party needs to be satisfied
by that model assessm ent.
What Validation Processes Are in Use?
Most of this section describes the types of validation processes
that are in use or could be used. The list is not com prehensive,
and it is not suggested that all techniques should be used by
banks. O ther surveys that provide fuller descriptions of tech-
on
niques are available. O ur purpose is to make two points. First,
to dem onstrate that there is a wide range of techniques that
19 Principle 1 reads: "Validation is fundam entally about assessing the
predictive ability of a bank's risk estim ates and the use of ratings in
credit processes."
20 See B C B S (2005b).
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
would be covered by our broad definition of validation, creating
a layered approach. The more layers that can be provided, the
more com fort that validation is able to provide evidence for or
against the perform ance of the model. Conversely, where few er
layers of validation are used, the level of com fort diminishes.
Second, that each validation process provides evidence for (or
against) only some of the desirable properties of a model. The
list presented below moves from the more qualitative to the
more quantitative validation processes, and the extent of use is
briefly discussed.
Qualitative Processes
(i) Use test. The philosophy of the use test has been fully
tool of validation is straightforward. If a bank is actually
using its risk m easurem ent system s for internal purposes,
then supervisors can place more reliance on the system s'
outputs for regulatory capital. Applying the use test suc­
cessfully will entail gaining a careful understanding of which
model properties are being used and which are not.21
(ii) Qualitative review. Banks tend to subject their models to
some form of qualitative assessm ent process. This process
could entail review of docum entation, review of develop­
ment work, dialogue with model developers, review and
derivation of any form ulae, comparison with what other
firms are known to do, comparison with publicly avail­
able information. Qualitative review is best able to answer
questions such as: Does the model work in theory? Does it
incorporate the right risk drivers? Is any theory underpin­
ning it conceptually well-founded? Is the m athem atics of
the model right?
(iii) System s im plem entation. Production-level risk m easure­
ment system s should go through extensive testing prior to
im plem entation, such as user acceptance testing, check­
ing of model code, etc. These processes could be viewed
as part of the overall validation effort, since they would
assist in evaluating whether the model is im plem ented with
integrity.
21 Paragraph 4 of the Basel Com m ittee's validation principles sets out
some of the uses of capital m odels. In discussing the use test for IRB,
the paper notes " . . . as a quality check of IRB com ponents and under­
lying processes, the use test is a necessary supplem ent to the overall
validation process. . . . the use test plays a key role in ensuring and
encouraging the accuracy, robustness and tim eliness of a bank's IRB
com ponents, confirms the bank's trust in those com ponents and allows
supervisors to place more reliance on their robustness and thus on the
adequacy of regulatory cap ital." We think that this philosophy still holds
true when considering internal capital m odels.
■ 215
(iv) M anagem ent oversight. M anagem ent oversight refers to
the involvement of senior m anagem ent in the validation
process, in reviewing output from the model, and using the
results in business decisions. Senior m anagem ent need to
be clear how the model is used and how the model outputs
are interpreted, taking account of the specific im plem enta­
tion fram ework that their firm has adopted and the assum p­
tions underlying the model and its param eterisation.
(v) Data quality checks. Not traditionally viewed by the industry
as a form of validation but increasingly forming a major part
of regulatory thinking. Data quality checks refers to the pro­
cesses designed to provide assurance of the com pleteness,
accuracy and appropriateness of data used to develop, vali­
date and operate the model. These processes could include
qualitative review (e.g ., of data collection and storage), data
cleaning processes such as identifying errors, reviews of the
extent of proxy data, review of any processes that need to
be followed to convert raw data into suitable model inputs
(e.g ., scaling processes), and verification of transaction data
such as exposure levels. Such a list is often a helpful indica­
tion of the level of understanding of the model.
(vi) Exam ination o f assum ptions— sensitivity testing. Models
rest on assumptions of various kinds, some of which are
obvious, but some are less so. As such, certain aspects of
models are "built-in" and cannot be altered without chang­
ing the model. To illustrate, these assumptions could be:
assumptions about fixed model param eters such as cor­
relations or recovery rates; assumptions about the shape
of tail distributions; and assumptions about the behaviour
of senior m anagem ent or of custom ers. Some banks go
through a deliberate process of detailing the assumptions
underpinning their models. This should include examination
of the impact on model outputs, and the limitations that the
assumptions place on model usage and applicability.
Quantitative Processes
(i) Validation o f inputs and param eters. Some model param ­
eters may be estim ated. Exam ples include the main IRB
param eters and correlation param eters. A com plete model
validation would involve validation of the inputs them selves.
Validation of input param eters to econom ic capital models
would entail validation of those param eters not included in
IRB, such as correlations. Techniques could include check­
ing model param eters against historical data, comparison
of param eters against outcom es over tim e, comparison of
model param eters to market-implied param eters such as
implied volatility or implied correlation, and assessing m ate­
riality of model output to input and param eters through
sensitivity testing. Testing of input param eters would be a
216 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
com plem ent to the examination of assumptions and sensi­
tivity testing described in the preceding paragraph.
It is worth noting that checking of model inputs is unlikely
to be fully satisfactory since every model is based on
underlying assumptions. The richer or more sophisticated
the model, the more susceptible it may be to model error.
Checking of input param eters will not shed light on this
area. However, model accuracy and appropriateness can
be assessed, at least to some degree, using the processes
described in this section.
(ii) M o d el replication. A useful quantitative technique is to try
to replicate the model results obtained by the bank. A truly
independent replication would use independently devel­
oped algorithms and an alternative source of data but in
practice replication might be done by leveraging some of
the bank's processes. For exam ple, it could be done by run­
ning the bank's algorithms on a different data set or using
the bank's own databases with independently derived algo­
rithms, once the banks' processes have been validated and
are reliable. This technique (and the questions that often
arise in attem pting to replicate results) can help to identify
whether or not the definitions and the algorithms that the
bank says it is using are correctly understood by staff in
the bank who develop, maintain, operate and validate the
model and that they are used in practice by the bank. The
technique also facilitates code checking and may be help­
ful in determ ining whether the databases analysed in the
validation process are those used by the bank to obtain its
results. This technique is rarely sufficient to validate m od­
els and in practice there is little evidence of it being used
by banks for either validation or to explore the degree of
accuracy of their models. Note that replication simply by
re-running a set of algorithms to produce an identical set
of results would not be sufficient model validation due
diligence.
(iii) Benchm arking and hypothetical p o rtfo lio testing. This refers
to the exam ination of whether the model produces results
com parable to a standard reference model or comparing
models on a set of reference portfolios. Exam ples of bench­
marking could include comparison of risk ranking provided
by internal rating systems and agency ratings, or com pari­
son of an in-house portfolio credit model to other well-
known models after standardisation of param eters. In the
regulatory field, this permits comparison of several banks'
models against the same reference model. It would allow
identification of models that produce outliers. Hypotheti­
cal portfolio testing means comparison of models against
the same reference portfolio. It is capable of addressing
similar questions to benchmarking by different means. The
 technique is a powerful one and can be adapted to anal­
yse many of the preferred model properties such as rank­
ordering and relative risk quantification. But there are also
limitations. In particular, benchmarking can only compare
one model against another and may provide little assurance
that the model accurately reflects reality or about the abso­
lute levels of model output. In a benchmarking exercise,
there may be good reasons why models produce outliers.
They may, for exam ple, be designed to perform well under
differing circum stances, or may be conservatively param-
eterised, or may differ in their econom ic foundations, all of
which com plicate interpretation of the results.
Benchmarking is a commonly used form of quantitative
validation. Com parisons are made with industry survey
results, against alternative models such as a rating agency
model, industry-wide m odels, consultancy firms, academ ic
papers and regulatory capital models. However, as a valida­
tion technique, benchmarking has limitations, providing
comparison of one model against another or one calibration
to others, but not testing against "reality." It is therefore
difficult to assess the degree of com fort provided by such
benchmarking m ethods, as they may only be capable of
providing broad com parisons confirming that input param ­
eters or model outputs are broadly com parable.
(iv) Backtesting. Backtesting addresses the question of how
well the model forecasts the distribution of outcom es. Back­
testing may take many forms and there is a wide literature
on the subject. All backtesting approaches entail some
degree of comparison of outcomes to forecasts, and there
is a wide literature on the subject.
For portfolio credit m odels, the weak power of backtesting
is noted in BC BS (1999). As has been suggested by some
authors, there are variations to the basic backtesting
approach which can increase the power of the tests. Exam ­
ples include: performing backtesting more frequently over
shorter holding periods (e.g ., using a one-day market risk
backtesting standard versus the 10-day regulatory capital
standard); using cross-sectional data by backtesting on a
range of reference portfolios;222
3using information in fore-
casts of the full distribution; testing expected losses only;
and comparing outcom es against the expected values of
distributions as opposed to high quantiles.
Backtesting is useful principally for models whose outputs
can be characterised by a quantifiable metric with which
to com pare an outcom e. There may be risk m easurem ent
22 See Lopez and Saidenberg (1999).
23 See Frerichs and Loffler (2002) and Berkowitz (2000).
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
system s in use whose outputs cannot be interpreted in
this way. Exam ples could include rating system s, sensitivity
tests and aggregated stress losses. Such risk m easurem ent
approaches might nevertheless be valuable tools for banks.
The role of backtesting for such m odels, if they were to be
used, would need elaboration.
In practice, backtesting is not yet a key com ponent of
banks' validation practices for econom ic capital purposes.
(v) Profit and loss attribution. Analysis of profit and loss on
a regular basis (e.g ., annually) and comparison between
causes of actual profit and loss and the risk drivers in the
model. Attribution is not widely used except for m arket risk
pricing models.
(vi) Stress testing. This covers both stressing of the model and
comparison of model outputs to stress losses.
The outputs of the model might be exam ined under conditions
of stress, where model inputs and model assumptions might be
stressed. This process can reveal model limitations or highlight
capital constraints that might only becom e apparent under
stress. Stress testing of regulatory capital m odels, particularly
IRB m odels, is undertaken by banks but there is more limited
evidence of stress testing of econom ic capital models.
Through a com plem entary programme of stress testing, the
bank may be able to quantify the likely losses that the firm
would confront under a range of stress events. Com parison of
stress losses against model-based capital estim ates may provide
a m odest degree of com fort of the absolute level of capital.
Banks report some use of this stress testing technique to vali­
date the approxim ate level of model output.
Internal audit is not included in the above list, however vali­
dation of the overall implementation fram ework and process
should also be subject to independent and periodic review and
this work should be made by parties within the banking organ­
isation that are independent of those accountable for the design
and implementation of the validation process. O ne possibility
could be that internal audit would be in charge of undertaking
this review process. As such it could be viewed as comprising
a part of the m anagem ent oversight process listed above. The
paper does not otherwise discuss the role of internal audit in the
validation process.
The list of validation tools does not address the issue of ad e­
quate standards. Banks may operate internal standards that are
relevant for validation. For exam ple, a description of the issues
that need to be addressed as part of validation, the standards
that capital models are expected to achieve, a series of quanti­
tative thresholds that models need to m eet, warning indicators
for particular monitoring metrics, assessm ent against model
developm ent standards.
■ 217
What Aspects of Models Does Validation
Cover?
The validation steps presented above can be used in assessing
most of the desirable properties of models. This is an encourag­
ing observation and stands in contrast to the fairly negative view
of validation taken in BC BS (1999).
Opinions may reasonably differ about the strength or weakness
of any particular process in respect of any given property. The
properties that could be assessed using a powerful tool and
hence that are capable of robust assessm ent include: integrity of
im plem entation; grounded in historical experience; risk sensitiv­
ity; sensitivity to the external environm ent; good marginal prop­
erties; rank ordering; and relative quantification. The properties
for which only w eaker processes are available include: concep­
tual soundness; forward-looking; and absolute risk quantifica­
tion. Again, it is im portant to stress the judgm ental evaluation of
the power of individual tests and to acknowledge that views as
to strength and weakness are likely to differ.
The difficulty of validating the conceptual soundness of a capital
model needs some elaboration. In developing a model, sev­
eral assumptions about the model and its inputs are likely to
be made. These could include assumptions about the family of
statistical distributions, the econom ic processes driving default
or loss, the dependency structure among defaults or losses,
the likely behaviour of m anagem ent or other econom ic agents,
and the extent to which these vary over tim e. Moreover, some
internal capital models are risk aggregation m odels, where risk
estim ates for individual categories (e.g ., m arket, credit and
operational risk) are aggregated to generate a single total eco­
nomic capital figure, with the method of aggregation relying on
some underpinning assumptions. These assumptions, however,
may be untestable. As a result it may be impossible to be cer­
tain that a model is conceptually sound. W hile the conceptual
underpinnings may appear coherent and plausible, they may in
practice be no more than untested hypotheses.
This section presented the main validation tools available with
which to assess internal capital models and provided some eval­
uation of their power and their use in practice. The conclusion is
that tools are powerful in some areas such as risk sensitivity but
not in other areas such as overall absolute accuracy.
Supervisory Concerns Relating to
Validation
Com pared to practice at the time of the BC BS (1999) report,
there is greater em phasis currently on the validation of mod­
els. The main areas of im provem ent are in benchmarking of
model param eters and the conduct of cross-firm com parisons of
218 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
models, typified by the IACPM and ISDA study (2006) on portfo­
lio credit risk models. There is some evidence that banks wish to
ensure that models are sensitive to the expected drivers of risk,
and that models generate outputs that perm it adequate evalu­
ation of the relative risk between business lines and to provide
suitable trend analysis. Although there is scope for practices to
improve further, the signs of progress in these areas are moder­
ately encouraging.
In other respects industry validation practices are weak, par­
ticularly when the total capital adequacy of the bank and the
overall calibration of the model is an im portant consideration. It
is recognised that this validation task is intrinsically difficult since
it will typically require evaluation of high quantiles of loss distri­
butions over long periods combined with data scarcity coupled
with technical difficulties such as tail estim ation. Moreover, it is
recognised that validation practices will depend on what the
model is being used for. N evertheless, difficult as the validation
task might be, weaknesses in validation practices targeted at
evaluation of overall perform ance might result in banks operat­
ing with inappropriately calibrated models. This could be of con­
cern if assessm ent of overall capital adequacy is an im portant
application of the model. Improvements in these areas could
include further benchmarking and industry-wide exercises, back­
testing, profit and loss analysis and stress testing.
Additionally, institutions should recognise clearly that when vali­
dation is difficult and has limitations, i.e., when for one reason or
another models cannot be appropriately validated, users of those
models and senior management should be informed that full
validation could not be conducted. Such communication is nec­
essary so that model users and senior management understand
that there is greater uncertainty around the output from models
that have not been validated and that such model output should
generally be treated with extra conservatism. In that vein, model
users and senior management should understand and explore the
potential costs of using models that have not been fully validated
(i.e., if key assumptions in the models prove to be inaccurate).
13.8 A N N E X 1: D E P E N D E N C Y
M O D E L L IN G IN C R E D IT R IS K M O D E L S
A particularly im portant and difficult aspect of portfolio credit
risk modelling is the modelling of the dependency structure
between borrowers. This encom passes linear and non-linear
dependency relationships between obligors. Dependency
modelling is im portant because it forms an im portant distinc­
tion between the Basel II risk w eight function (with supervisory
imposed correlations) and portfolio credit risk models which rely
on banks' internal modelling of dependencies.
Understanding the way dependencies are modelled is im portant
for supervisors when they assess a bank's IC A A P under Pillar 2,
since internal bank modelling of portfolio credit risk may be an
im portant elem ent of a bank's IC A A P and can generate the big­
gest reduction of capital needs in comparison with the Pillar 1
minimum capital requirem ent for credit risk.
This annex briefly describes the main methods used for m odel­
ling credit dependencies and discusses progress since the pub­
lication of the BC BS (1999) report. It also discusses the impact
that different methods have on banks' econom ic capital, and
makes some observations linked to recent developm ents in
dependency m odelling. Finally, it raises some supervisory con­
cerns about the current state of industry practice.
Types of Models
The majority of banks use one of three types of credit models.
These m odels, often referred to by their commercial names, are
M oody's/KM V (M KM V), CreditM etrics, and C red itR isk+ . The
annex follows the same convention even though other vendors
offer similar models and some banks have developed their own
internal models that are consistent with the structure of one of
these model typ es.24
Most models of credit portfolio risk estim ate asset correla­
tions among obligors in term s of common dependence on
system atic risk factors. The assumption is that these underlying
factors— e .g ., country, region, or industry of a borrower— fluctu­
ate over tim e and typically follow a (joint) normal distribution. All
borrowers are linked to these underlying system atic risk factors
to varying degrees and tend to move in a correlated way. Thus,
by modelling dependencies, banks account implicitly for con­
centration (both single name and sectoral) because large parts
of their books are subject to the same underlying risk factors or
to multiple risk factors.
Extensions of the three credit portfolio models are used by
some banks. For exam ple, this is the case for a few banks with
specialised portfolios (e.g ., small and medium-size European
corporate loans) which have integrated a contagion approach
into variants of the standard credit portfolio models (see
Box 13.1). By integrating information on business relationships
among borrowers into the credit portfolio model, this approach
tries to address the clustering of defaults observed within their
24 The discussion of these model types is descriptive and is not intended
as an endorsem ent of any of the vendor m odels. Reference to these
prototype m odels should not be construed as an endorsem ent of these
m odels, or as an indication of their standing relative to other models
that might be used by banks or offered by other vendors.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
BO X 13.1 CO N TAG IO N APPRO ACH
Motivated by the financial crises in South East Asia and
the US in the 1990s, and the Enron default crisis in late
2001, where the downfall of a small number of firms had
an economy-wide impact, academ ic researchers have
attem pted to incorporate counterparty relationships, or
microstructure correlation, into portfolio credit models
(Davis and Lo (2001), and Jarrow and Yu (2001)). The com­
mon feature of contagion models is that they distinguish
between macrostructure and microstructure dependencies.
In contrast to macrostructure dependencies, microstruc­
ture dependencies attem pt to capture business relation­
ships and legal dependencies within and across sectors.
This approach is also relevant for pricing C D Ss, C D O s, and
basket derivatives, since the prices for these products are
influenced by dependencies between the firms in a basket,
a business (e.g ., suppliers and com petitors), etc.
The microstructure contagion effect can be integrated
using different approaches, (e.g ., reduced-form models).
The idea behind contagion models is that contagion risk
produces upward jum ps in the default intensity of non-
defaulted firms, implying a higher conditional default
probability for these firms given additional information
on other firm s' defaults. The driving principle behind
such modelling is that considering only m acroeconom ic
dependencies for a portfolio subject to microstructure
dependencies could potentially underestim ate credit
risk. By integrating microstructure dependencies into the
model, the standard deviation of rating changes over time
is increased, even for well-diversified credit portfolios with
m oderate microstructure dependencies.
Generally, the contagion approach is supposed to be con­
servative since it lengthens the tail of the loss distribution
and therefore increases the capital needed to cover credit
risk. However, it is difficult to gauge whether the increase
in capital is sufficient to capture the risk dependencies.
Additionally, practical and theoretical issues need to be
addressed, such as the reliability of the required expert
judgm ent and ability to identify the frailty/contagion factors.
portfolios that are linked to bank specific portfolio concentration
and exposure mix.
In addition, few banks model dependencies using copulas (see
Box 13.2), at least for their econom ic credit risk m odelling. This
technique can be used to capture several alternative general
types of dependencies, as opposed to the more restrictive
Gaussian copula m odels.25*
Some banks also use models that are based on the asym ptotic
single-risk-factor (ASRF) model, which is the basis for the Basel II
0^
See for exam ple Hull (2007) for a discussion of copulas.
■ 219
 BOX 13.2 CO PU LA S
Some banks model dependencies using copulas. Within the
context of credit risk modelling, copulas are used to model
dependencies between the defaults of credit obligations in
a portfolio. Given that one obligor has defaulted, other obli­
gors in the portfolio might be more likely to default because
they are connected to the defaulted obligor directly (e.g ., if
the defaulted obligor is the creditor of another) or indirectly
(e.g ., if another obligor is in the same industry).
For a collection of random variables with given marginal
distributions (the univariate probability distribution of each
random variable) a copula specifies how these random vari­
ables combine into a multivariate distribution, and thus speci­
fies the dependencies between the random variables. Some
copulas like the Gaussian copula are characterised by a corre­
lation matrix, while other copulas describe dependencies that
are non-linear or too com plicated to be accurately described
by correlation param eters. A copula is a mapping that trans­
forms the marginal distributions for a collection of random
variables into a joint distribution for all the random variables.
W hen copulas are used in credit risk m odelling, the underly­
ing random variables of interest may be the time to default
of each obligation in a portfolio, or in Merton type m odels,
the asset values of the obligors. In the latter case, the obligor
defaults when its asset value falls below a certain threshold.
These underlying variables are continuous random variables,
and they express the likelihood of default in a different way
from the more fam iliar (discrete) indicator random variables,
risk weights for credit risk. Within this modelling approach,
banks may use their own estim ates of correlations or may use
multiple system atic risk factors in order to address concentra­
tions. Such a modelling approach raises several supervisory con­
cerns about the method used to calibrate the correlations and
the ways in which the bank addresses the infinite granularity and
single-factor structure of the A SR F model.
Under the impetus of the Basel II Fram ework, banks have also
increased their use of bottom-up approaches in their credit risk
dependency m odelling. As a result, credit portfolio models are
much more integrated into daily risk m easurem ent and m anage­
ment than was the case in 1999.
The IACPM and ISDA Study
Given the differing approaches to modelling dependencies
between borrowers described above, the question arises as to
26 The A S R F model is also referred to as a single-factor Gaussian copula
m odel. For this m odel, the capital charge for an exposure depends on
the risk characteristics of this exposure only (i.e ., PD, LG D , EA D , matu­
rity) and does not depend on the com position of the portfolio to which
the exposure is added.
220 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
which are 1 if default occurs during a specified period and 0
otherwise. If q ,• is the underlying random variable denoting
for exam ple the tim e to default of obligor /, and lj T is the
indicator random variable denoting default before tim e T, the
relation between q(- and liT is:
’ ! if <7, < T
0 , if q >T
If the distributions of these time-to-default variables are
com bined using a copula, a joint distribution function for the
time-to-default variables is obtained. Taking random samples
from this joint distribution, and given a specified tim e hori­
zon, each sam ple from the distribution will translate into a set
of defaulting and non-defaulting obligations within the port­
folio over that tim e period.
The first copula to be widely used in the context of credit
modelling was the Gaussian copula. O ne im portant short­
coming of the Gaussian copula is that it displays zero tail
dependence. Besides the Gaussian copula, copulas based
on other multivariate distributions (particularly the Student-t
distribution) are often used with the goal of capturing depen­
dencies between defaults that have a stronger impact on the
tail of the loss distribution. For exam ple, the t-copula has a
param eter for "tail association" or dependence. The distribu­
tions produced by copulas are usually not tractable analyti­
cally, and as a result, copulas are most frequently used in
running portfolio default simulations.
what extent the economic capital estimates produced by the
models differ from each other. To shed some light on this empiri­
cal question, the International Association of Credit Portfolio
Managers (IACPM ) and International Swaps and Derivatives Asso­
ciation (ISDA) conducted a study in 2006 to explore the economic
credit capital models in use by their member institutions.
The IACPM and ISDA (2006) study evaluated the degree of con­
vergence of econom ic capital estim ates across commercially
available credit portfolio models and across internally developed
credit risk models im plem ented by banks. Given that most
banks use one of the three main com mercially available credit
risk models mentioned above or internally developed im ple­
mentations of the same types of m odels, the study was effec­
tively a comparison of the econom ic capital estim ates generated
by these com mercially available m odels, run either in default
mode or in mark-to-market m ode.27 The study applied the
27 C redit Risk-t- is exclusively a "default m ode" m odel. Default mode
refers to the situation where credit losses arise only if a borrower
defaults within the planned tim e horizon. M ark-to-market credit losses
can arise in response to deterioration in an asset's credit quality before
the end of the planning horizon.
different credit models to a representative portfolio of transac­
tions that was assem bled with pre-specified data assumptions
regarding risk characteristics. By eliminating different data char­
acteristics and portfolio composition as sources of potential dif­
ferences in econom ic capital estim ates, remaining differences
are largely due to differences in the modelling approaches. O ut­
com es of the study may also be dependent on the composition
and characteristics of the test portfolios used in the study.
The study showed significant differences in econom ic capital
estim ates between the different m odels, in default-only mode
as well as in mark-to-market mode. The differences in econom ic
capital estim ates between the models can be explained in
term s of the following factors: correlation structure; treatm ent
of interest payments due between tim e zero (point of valua­
tion) and the tim e horizon (point of default) and whether this
was accounted for in the definition of loss; and other modelling
differences.
O f special interest in the context of this annex is the question:
How much of the difference in econom ic capital is due to corre­
lation structure/dependency modelling assumptions? In default-
only mode, the differences could be explained to a large extent
by the different treatm ent of interest payments (i.e., by the dif­
ference in definition of loss), with the correlation structure play­
ing only a minor role. However, in mark-to-market mode, where
changes in revaluations at the horizon for non-defaulted assets
may also be correlated, and where the impact of differences in
the modelling of correlations is larger, roughly a quarter of the
observed difference in econom ic capital estim ates is attributable
to correlation assumptions.
Another issue involves the sensitivity of econom ic capital esti­
mates to changes in portfolio concentrations and model param ­
eters. Sensitivity analysis perform ed in the IACPM and ISDA
study showed that a change in the sector or country com posi­
tion of the representative portfolio had a large impact on eco­
nomic capital estim ates.28 Furtherm ore, the im pact differed
between the different types of credit risk m odels. This evidence
provides empirical support for the notion that the output of
credit risk models significantly depends on the underlying corre­
lation structure. Differences in correlations could be structural in
nature since different models may use different data to calibrate
correlations (e.g ., historical equity returns versus default rate
data), or could be due to time-varying correlations.29
28 For exam ple, it could double the am ount of econom ic capital for
credit risk.
29 The IACPM and ISD A study concludes that when loss assum ptions are
aligned across both vendor and internal credit portfolio m odels, esti­
mates of econom ic capital for credit risk can be shown to converge for
default-m ode m odels. D ifferences in the capital estim ates for mark-to-
m arket m odels can be reduced, but not elim inated.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
Supervisory Concerns Relating to
Currently Used Credit Portfolio Models
Shortcomings of Dependency Modelling
Regarding dependency assumptions used in credit portfolio
m odels, supervisors can question the accuracy and robustness
of correlation estim ates used by banks since these estim ates
depend heavily on (explicit or implicit) model assumptions and
can significantly influence econom ic capital calculations. These
assumptions are even more problem atic when the dependency
modelling and calibration methods used are em bedded in pro­
prietary third-party vendor credit risk models, which essentially
can be viewed as "black boxes."
Beyond the issues raised by the basic approaches used in struc­
tural and reduced-form credit portfolio m odels, the validity of
several other assumptions has been exam ined in the academ ic
literature. For exam ple, the validity of the following assum p­
tions has been drawn into question: the asym ptotic single-factor
Gaussian copula approach; the normal distribution for the vari­
ables driving default; the stability of correlations through tim e;
and the joint assumptions of correctly specified default probabil­
ities and doubly-stochastic processes, which imply that default
correlation is adequately captured by common risk factors.
Several academ ic papers question the ability of some models
using such assumptions to explain the time-clustering of defaults
that is observed in some m arkets. This in turn, when combined
with inadequately integrating the correlation between PD and
LGD in the models and inadequately modelling LGD variability,
can lead to an underestimation of econom ic capital needed. In
addition, it will make it difficult to identify the different sources
of correlations and the clustering of defaults and losses.
For exam ple, Das et. al. (2007) found that U.S. corporate default
rates between 1979 and 2004 vary beyond what can be
explained by a model that only includes observable covariates.
Moreover, Duffie et. al. (2006) found evidence of the presence
among U.S. corporate default rates of one or more unobserv­
able common sources of default risk that increase default corre­
lation and extrem e portfolio loss beyond that implied by
observable common and correlated m acroeconom ic and firm-
specific sources of default risk.30 However, there are practical
limitations of the "frailty approach" (i.e., modelling default clus­
tering with latent risk factors) including the computational cost,
and the failure to identify the frailty factor, hampering the ability
30 As pointed out by Das et. al. (2007) and others, known factors
account for a very large fraction of the default correlation observed in
the data. As a result, a practical approach to overcom ing the shortcom ­
ing of the frailty factor is to use conservative estim ates of asset correla­
tions and to conduct stress testing.
■ 221
of banks to make practical decisions in managing the risk from
the frailty factor.
With respect to the stable correlation hypothesis, Bangia et. al.
(2000) found that rating transitions are sensitive to the business
cycle and are explained by different models during expansion­
ary and recessionary periods. Therefore, the sample period and
approach used to calibrate the dependency structure could be
im portant in assessing whether correlation estim ates are overes­
tim ated or underestim ated, and therefore whether they should
be reviewed.
O ther assumptions can also impact correlation calibration.
For exam ple, when a model assumes that unobservable asset
returns can be approxim ated by changes in equity prices, it
does not account for the fact that the relationship between
asset returns and equity prices is unobservable and could also
be non-linear. Similarly, when equity prices are used to estim ate
credit default probability, the issue arises that although such
prices can cover a wide range of industries and geographical
locations, they also reflect information that is unrelated to credit
risk. Consequently, the use of equity prices can introduce some
noise in the correlation estim ates.
On the other hand, when banks use a regulatory-type approach,
with single or multiple risk factors, the assumptions of such
an approach poses two im portant issues for both banks and
supervisors:
• Since the correlation estim ates are explicit param eters in the
Basel A SR F model, they would need to be estim ated. There
may be limited historical data on which to base the correla­
tion estim ates, and the assumptions used to generate the
correlations may not align with the underlying assumptions of
the Basel II credit risk model.
• If a bank uses the Basel II risk w eight model (either with
supervisory or with its own correlations), it must account for
concentration risk (single name and industry/regional con­
centrations) by other measures and/or m anagem ent methods
(e.g ., limit setting), and supervisors will have to evaluate
these approaches.
The concern about assumptions is im portant since they can have
a significant impact on measures of portfolio credit risk and the
m easurem ent of econom ic capital. For exam ple, Tarashev and
Zhu (2007) dem onstrate, by comparing the loss distributions
produced by the KMV and the A SR F m odels, that the single-
risk-factor and infinite granularity assumptions of the A SR F
model have small impacts on m easurem ent of capital needs,
especially for large, well-diversified portfolios. By contrast, the
use of m isspecified or incorrectly calibrated correlations and the
use of a normal distribution (which fails to replicate the tails of
222 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the distribution of asset returns)31 can lead to significant inaccu­
racies in measures of portfolio credit risk and econom ic capital.
Use of Credit Dependency Modelling
O ne of the main supervisory concerns is that some banks use
credit portfolio models without always having a full understand­
ing of all the underlying assumptions and modelling techniques
em bedded in them . W hether such models are suitable for differ­
ent portfolios (retail, structured products, etc.) as well as for the
specific concentration and exposure mix characteristics of their
own portfolios should be assessed.
For exam ple, it seem s that the use of asset return correlations
derived from equity prices has becom e a market standard for
portfolios of large corporates, despite the limitations associated
with such an approach.
It is im portant to consider whether the uncritical use of asset
correlations for other portfolios such as SM E and retail borrow­
ers is adequate. The estim ated correlations could be m eaning­
fully used as long as they are applied to large, publicly traded
borrowers. The appropriateness of using such data to estim ate
correlations for other exposures such as non-traded, small and
medium-sized enterprises and retail borrowers is less clear. Spe­
cifically, corporate, SM E and retail portfolios are data-rich, which
means that the derivation of different default correlations from
internal bank data could be envisaged in some cases. For non
traded SM E portfolios, there are third-party vendors that might
also provide relevant data for some local markets.
However, banks do not generally calibrate their retail and SM E
correlations separately. Instead they use shortcuts, such as assign­
ing retail borrowers to the no industry category in a credit portfo­
lio model. It remains to be seen whether these shortcuts provide
a meaningful measure of risk for SM E and retail portfolios.
The use of more com plex models (e.g ., contagion models and
Gaussian and non-Gaussian copulas), which need technical,
judgm ental and modelling expertise, could also be viewed as
too burdensom e, uncertain, unstable or inappropriate to im ple­
ment. Assuming that banks gather enough data to estim ate
more reliable correlations using internal data in the future, it
would be useful for the industry to make progress in estimating
correlations for other exposures, such as SM E, retail, and struc­
tured products, and to analyse which data, m odels, and tech­
niques are the most relevant for these portfolios.
31 With respect to the loss distributions, they are more likely to follow
double-t distributions with medium to high degrees of freedom instead
of normal distributions. Such m isspecification can imply an underestim a­
tion of econom ic capital that ranges from 22-86% .
13.9 A N N EX 2: COUNTERPARTY
CREDIT RISK
Counterparty credit risk (CCR) at large, com plex banks centres
on the m easurem ent and m anagem ent of financial exposure
and the resulting credit risk associated with core credit exten­
sion activities of these financial institutions to a wide range of
counterparty types. Counterparty credit risk takes a variety of
form s, including credit risk emanating from activities in O T C and
exchange-traded derivatives, from securities financing activities,
and from foreign exchange settlem ents. The counterparties to
these financial institutions take a wide variety of forms, ranging
from sovereigns and local governm ent entities, to regulated
financial concerns and potentially unregulated financial parties
such as hedge funds, to corporate entities (both investment-
grade and below-investm ent-grade).
This annex is organized in two sections. The first section high­
lights the challenges that the industry faces in quantifying coun­
terparty credit risk for econom ic capital purposes, while the
second section addresses the range of practices that financial
institutions undertake in quantifying this risk. The primary focus
is on modelling challenges in the quantification of counterparty
credit risk, and thus there is no explicit consideration of the
com prehensive set of risk m anagem ent practices that are meant
to mitigate risks or to provide com pensating controls for model
deficiencies, unless those practices (such as initial margin and
ongoing collateral practices related to counterparty credit risk)
directly influence the quantification of risk.
Counterparty Credit Risk Challenges
M easurem ent of counterparty credit risk represents a com plex
exercise, as it involves gathering data from multiple systems;
measuring exposures from potentially millions of transactions
(including an increasingly significant percentage that exhibit
optionality) spanning variable time horizons ranging from over­
night to thirty or more years; tracking collateral and netting
arrangem ents; and categorising exposures across thousands of
counterparties. The com plexities of the processes highlighted
below indicate a need for institutions to have specialised pro­
cesses and personnel to tackle these issues and challenges.
Measuring Exposure and Measuring Risk
A bank's counterparty credit m easurem ent can be conceptually
broken down into two distinct steps. First is the m easurem ent
of counterparty cred it exposure— that is, how much money the
counterparty will owe the bank in the event of default. This
exposure number is further broken down into current exposure,
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
which measures the exposure if the counterparty were to default
today, and potential exp o su re, which measures the potential
increase in exposure that could occur between today and some
time horizon in the future. One feature of derivatives and securi­
ties financing relationships is that, while the amount of current
exposure to a counterparty is known, the amount of potential
exposure to a counterparty is an unknown quantity (in fact,
given the nature of derivatives contracts and securities financing
arrangem ents, there may be no exposure to the financial institu­
tion at the tim e of a counterparty default). Therefore, counter­
party credit exposure is generally measured as some statistic
(such as a mean or a percentile) of the distribution of possible
future exposures to the counterparty.
The second part of the counterparty credit m easurem ent is
converting the exposure to a risk amount for econom ic capital
purposes or risk m anagem ent purposes more generally (for
exam ple, to inform a counterparty credit risk limit system). The
risk m easurem ent will be a function of the probability of default
(PD) for the counterparty, the loss given default (LGD) for the
exposure, and the exposure m easurem ent, which is effectively
the exposure at default (EAD) value. The EAD value is driven by
market-risk-related factors (the volatility and correlation among
market risk factors and how they affect the derivative contract
or valuation of the securities being financed), while the PD and
LGD are effectively determ ined by firm's assessm ent of the
credit quality of the counterparty.
Counterparty credit risk measurement, therefore, necessarily
combines the tools from standard market risk measurement with
the tools from standard credit risk determination. Market risk mea­
surement practices are used, for example, in mapping derivatives
exposures to a set of market risk factors, simulating those factors
out to a forward-looking time horizon, and determining the distri­
bution of the level of exposures over various risk factor realisations
in the simulation. Separately, standard credit risk processes provide
assessments of the credit quality of the counterparty, frequently
resulting in a credit rating of the counterparty, both from the PD
and LGD perspectives. Counterparty credit risk measurement
offers unique challenges related to both the market-risk-related
and the credit-risk-related processes, which are described next.
Market-Risk-Related Challenges to Counterparty
EAD Estimation
Counterparty credit exposure m easurem ent requires simulation
of market risk factors and the revaluation of counterparty posi­
tions under the simulated risk factor shocks, much like a value-
at-risk (VaR) model requires. Two unique challenges present
them selves when attem pting to leverage a VaR model technol­
ogy for counterparty credit exposure m easurem ent.
■ 223
First, m arket risk VaR m odels com bine all positions in a port­
folio into a single sim ulation, so that gains from one position
are allowed to fully offset the losses in another position in the
same sim ulation run. C ounterparty credit risk exposure m ea­
surem ent, however, cannot allow netting across counterparties
(e .g ., a decline in exposure to one counterparty cannot be net­
ted against an increased exposure to another counterparty).
Therefore, the analysis of counterparty exposure must be done
at the "netting set" level (that is, on each set of transactions
that form the basis of a legally enforceable netting ag ree­
ment). M ost banks have many thousands of counterparties,
and each of these counterparties may have many different
netting agreem ents (segregated, for exam ple, by product type
or legal jurisdiction). This situation, therefore, requires the
counterparty exposure m easurem ent to perform a calculation
at the netting-set level, thereby increasing the com putational
intensity of the calculation.
Second, market risk VaR calculations are traditionally performed
for a single short-term holding period— for exam ple, for a single
day or a ten-day holding period. Counterparty credit exposure
m easurem ent, however, must be performed for multiple hold­
ing periods into the future, as certain derivatives contracts, for
exam ple, can extend years, or even decades, into the future.
As a result, market risk factors have to be simulated over much
longer time periods than in the standard VaR calculation, and
revaluation of the potential exposure in the future must be done
for the entire portfolio at certain points in the future.
The com bination of the large num ber of counterparties and the
large num ber of holding periods in the future im plies that the
com putation challenges in effectively m easuring VaR are dra­
m atically increased when financial institutions attem pt to m ea­
sure counterparty exposures for derivatives transactions. A s a
result, a bank may decide to reduce the num ber of m arket risk
factors considered in the sim ulation for counterparty credit risk
relative to the num ber considered in the m arket risk VaR calcu­
lation. The resulting sim plification can result in a reduction in
precision of the final result, but the m ateriality of the reduced
precision is highly dependent on the circum stances of the posi­
tions relative to the m odel. For exam ple, ignoring the volatil­
ity sm ile in a business with few trades m ight not be m aterial,
but using a single-factor term structure of interest rate model
may result in significant reduction in accuracy of the model for
these exposures.
Credit-Risk-Related Challenges to PD and LGD
Estimation
Frequently, counterparties to financial firm s for derivatives or
securities financing transactions have other credit-risk-related
relationships, so that the financial firm would already have a
224 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
credit rating, and an associated PD and ability to calculate an
LG D for the exposure. However, some im portant derivatives
and securities financing activities are done with counterparties
(such as hedge funds) with which the financial institution may
have no other exposures. In those cases, the financial firm must
determ ine a PD and LG D associated with the counterparty and
the facility. In the case of hedge funds, the counterparty may
have little transparency in term s of underlying fund volatility,
leverage, or types of investm ent strategies em ployed, which
creates a significant challenge. In the cases of counterparties to
which the institution has other credit exposures (e.g ., a corpo­
rate client), the institution will typically be using the same PD
used for the other exposures, but will need to arrive at a facility-
specific LG D .
Interaction between Market Risk and Credit
Risk— Wrong-Way Risk
W hile counterparty credit risk can conceptually be broken down
into a market-risk-driven EAD calculation and a credit-risk-driven
PD-LGD determ ination, these two processes are frequently not
independent. This interaction, where PD and LGD may tend
to rise at the same time as the exposure to the counterparty is
rising, is known as "wrong-way risk." For counterparty credit
exposure system s that separate EA D estimation from PD-LGD
estim ation, the incorporation of wrong-way risk in the econom ic
capital calculation is not directly feasible, but may be incorpo­
rated via an add-on in the econom ic capital process. Challenges
arise when trying to capture wrong-way risk. W rong-way risk
is som etim es difficult to identify, as it requires understanding
the m arket risk factors that the counterparty is exposed to, and
relating those factor sensitivities to the factor sensitivities of the
institution's own exposures to the counterparty. Understanding
the counterparties' risk factor sensitivities can be challenging,
especially for counterparties (such as some hedge funds) that
tend to be opaque. Even when wrong-way risk can be identified
directionally, it is often difficult to quantify its magnitude in an
econom ic capital model (in particular, over a one-year horizon at
a high confidence level).
Operational-Risk-Related Challenges in Managing
Counterparty Credit Risk
Managing counterparty credit risk is a very resource-intensive
activity, and requires specialised system s and personnel to effec­
tively im plem ent. Daily limit monitoring, marking-to-market,
collateral m anagem ent processes, and intraday liquidity and
credit extensions are all com plicated and interlinked processes
that give rise to the possibility of operational risk difficulties.
Such operational risk exposure is generally not captured for eco­
nomic capital purposes within counterparty credit risk, but may
be captured within an operational risk quantification process.
O perational risks related to counterparty risk that are particu­
larly difficult to quantify involve risks of new or rapidly growing
businesses, risks in new products or processes, risks in intraday
extensions of credit which are not properly captured in systems
designed for end-of-day exposure capture, and risks in areas
where there have been few historical instances of losses but
where potential "tail events" may have severe consequences.
Differences in Risk Profiles between Margined
and Non-Margined Counterparties
O ne im portant input in the m easurem ent of counterparty
credit risk among firm s' counterparties is w hether the coun­
terp arty is a m argined counterparty or not. A m argined coun­
terp arty has agreed to post collateral, either in the form of
cash or securities, when their exposure to the financial firm is
positive. W hile there are w ide variations in the practices sur­
rounding margining of counterparties (minimum thresholds
before a margin call is m ade, the frequency of margin calls,
the treatm ent of valuation of illiquid products, etc.), an im por­
tant distinction in the m odelling approaches must be made
betw een counterparties who have agreed to margining (also
known as "having a C S A " — a credit support annex to the
m aster netting agreem ent that lays out the term s of the mar­
gining agreem ent) and those who have not. Frequently, the
m odelling difference betw een these classes of counterparties
surrounds the treatm ent of the look-ahead forecasting period:
For m argined counterparties, the forecasting period is short,
associated with a reasonable "cure p eriod " betw een when a
counterparty misses a margin call and when the underlying
positions can be closed out; for non-margined counterparties,
the forecasting period is generally much longer, as long as the
life of the contract. The variation in m odelling horizons makes
the aggregation of risk across these two classes of counterpar­
ties a challenge, as most risk m odelling approaches take a sin­
gle m odelling horizon (e .g ., one day for VaR m odels, one year
for econom ic capital m odels) for all positions. A ggregation is
further com plicated if, for a given counterparty, som e positions
are m argined but others are not.
Note that there still is a gap risk, even for margined counterpar­
ties, which needs to be m odelled and accounted for. In stress
situations that adversely affect the assets being financed, there
could be a risk of market gapping and rapid loss of value. Banks
may need to take possession of collateral at a tim e when its
value is deteriorating and the market for it may be illiquid. This
risk may be am plified by the presence of exposure concentra­
tions within the firm, or by "crow ded trad es," where several
firms may be taking possession of similar collateral and seeking
to liquidate it at the same tim e.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
Aggregation Challenges
W hile calculation of counterparty credit risk for an individual
counterparty has its challenges, these challenges are magnified
when attem pting to get a firm-wide view of risk for economic
capital purposes. Independently of the challenges in arriving at
a counterparty credit risk econom ic capital measure outlined
above, this risk measure must be aggregated in a sensible, rigor­
ous, and risk-sensitive way with other exposures at the financial
firm in order for the overall econom ic capital measure to be a
reliable indicator of the aggregate inherent risk-taking by the
firm. If a single counterparty has both derivatives and securities
financing transactions, the firm may face challenges in aggrega­
tion across the counterparty's exposures, as the various models
and system s architectures may not be conducive to aggregation.
Furtherm ore, a firm's counterparty credit risk must be aggre­
gated with other credit risk-taking activities of the firm , both in
term s of loans in the banking book and credit risk in the trading
book. Finally, these more com prehensive credit risk measures
must be aggregated with overall m arket and operational risk in
order to arrive at the final econom ic capital measure.
A related challenge involves the ability of the counterparty credit
risk system to allow risk management to have a detailed under­
standing of the various breakdowns of risk that are common in
the market risk world. Breakdowns by product, by risk factor, by
geography, by business line, or by legal entity are difficult for
many firms to produce, for a variety of reasons. The computation
intensity of the calculations makes the provision of such "drill
down capabilities" expensive in terms of time to produce on a
daily basis. Fragm ented com puter systems and IT infrastructures,
frequently driven by a variety of legacy infrastructures from
merger and acquisition activity, are frequently cited culprits to
the limitations associated with counterparty credit risk systems'
lack of flexibility. The IT requirements associated with Basel
M's internal models approach to the use of counterparty credit
risk for regulatory capital purposes were often mentioned as a
possible mechanism to address some of the existing systems'
rigidities, but it remains uncertain how much of the planned IT
investments will address the existing systems' limitations.
Range of Practices
Given the variation in size and com plexity of counterparty credit
exposures across large financial firm s, these institutions display
a range of practices in measuring C C R for econom ic capital pur­
poses. Firms em ploy one of two general modelling approaches
to quantify the counterparty credit risk exposures. W hile these
models may be supplem ented with com plem entary m easure­
ment processes, firms typically have adopted one of two m ea­
surem ent "eng ines":
■ 225
The first is a stand-alone sim ulation engine, typically im ple­
menting a M onte Carlo approach ("M onte C arlo M o d el"). This
sim ulation norm ally spans a long forecasting horizon— often
encom passing the contractual life of the transaction— and then
selects an average exposure m easurem ent or a percentile of
the resulting exposure distribution to quantify the exposure
for a transaction or a portfolio of transactions at different
points in tim e over the forecasting horizon. The banks em ploy­
ing this approach for collateralised counterparties will typically
use the sam e approach to m easure uncollateralised counter­
party exposures.
The second approach is a "value-at-risk" ("VaR")-type C C R
exposure engine ("VaR M odel"), typically achieved by leverag­
ing the firm's existing market risk VaR processes. This approach
estim ates the distribution of C C R exposures over a relatively
short-term liquidation (or "closeout") horizon. The banks
employing this approach for collateralised counterparties still
typically use a Monte Carlo approach to measure uncollater­
alised exposures with longer-term horizons.
The decision of whether to use Monte Carlo Model or VaR-type
model to quantify C C R exposures for collateralised counterpar­
ties involves a variety of trade-offs.
The VaR-type model leverages well-developed and already vali­
dated data and analytical systems, thereby permitting usage of
a large set of risk factors deployed for market risk measurement.
Due to the computational intensity, however, the VaR-type model
is practical only for quantifying the exposure profile over a single
short-term forecasting horizon, which can be utilised for collat­
eralised counterparty credit risk assessments. Consequently, the
VaR-type model exhibits the limitation that it cannot produce a
profile of exposures over tim e, which is necessary for counterpar­
ties that are not subject to daily margining agreem ents.
The Monte Carlo m odel, on the other hand, allows for the quan­
tification of longer-term exposures but at the potential expense
of a less accurate m easurem ent of C C R exposure given the nec­
essary use of simplified risk factor representation.
Use of Add-Ons
Counterparty credit risk engines may not effectively capture
the risks of all financial products. For products not effectively
captured by counterparty credit exposure measurements, many
firms revert to an "add-on" factor, which provides a simplified
but conservative measurement of the exposure for that product.
W hile generally calibrated to be conservative, the add-on factors
are frequently not risk sensitive (e.g., the factors may not change
as market volatility rises and falls) and frequently do not allow for
netting, hedging or diversification effects across risk factors.
226 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Counterparty Credit Risk Processes for High Risk
Counterparties
Firms continue to be challenged by the opacity of risks for cer­
tain counterparties, such as hedge funds, and have developed
enhanced processes to identify, measure, monitor, limit, control
and report the risks from these counterparty relationships.
Ancillary Processes to View Counterparty
Credit Risk
Due to the challenges of developing a highly nuanced view of
counterparty credit risk for economic capital purposes, banks
have developed ancillary processes to help manage and measure
these risks. Concentration risk identification and stress testing
are two of the key risk management processes that attempt to
quantify the risks in counterparty credit relationships that may be
poorly measured by the core counterparty credit risk engines.
Concentration risk identification involves a set of ancillary analyt­
ics, mostly outside of the main counterparty credit risk engine,
which attempts to identify large exposures by individual coun­
terparty, by the set of counterparties of lower credit ratings,
by underlying risk factor, or by other dimensions that the firms
have identified as important measures of concentration that are
deemed worthy of monitoring. However, one should keep in mind
that concentration of positions with larger counterparties— ones
that may actually enjoy enhanced diversification benefits dur­
ing moments of stress— may be less harmful than the aggregate
exposure of trades with a collection of smaller counterparties.
Stress testing, also performed outside of the main counterparty
credit risk engines, involves a variety of diagnostic tools designed
to identify risk vulnerabilities that the main risk engine may not cap­
ture or identify. Stress tests, however, are frequently not fully com­
prehensive of all counterparty credit risk exposures. Stress tests
may be performed on a subset of the entire universe of counter­
parties (for example, on only counterparties that do not have daily
margining agreements, or on only "highly leveraged" counterpar­
ties). Sometimes, not all counterparty positions are included in the
stress tests (for example, positions that are treated with "add-ons"
may be excluded from the stress tests, as the simple add-on may
deemed to be a sufficiently conservative treatment of the risks for
stress testing purposes). Finally, stress tests are frequently treated
as a diagnostic tool of risk management, and may have no associ­
ated limits or escalation procedures associated with them.
Additionally, while wrong-way risk may be missed in the main
counterparty credit risk quantification process, many firms have
separate processes to measure and to limit the level of wrong­
way risk in their counterparty credit risk relationships, where it
can be m easured.
Haircut Determination for Securities Financing
Activities
The processes for determ ining haircuts for securities financing
activities generally do not consider stressful market conditions,
but are based on the range of historical experience, including
normal market environm ents. When econom ic capital is calcu­
lated for these positions, however, the market risk factors are
shocked to a stressed level, and the risks beyond the haircut are
included in the determination of econom ic capital of the securi­
ties financing activity.
Counterparty Credit Risk Model Validation
Counterparty credit risk models for econom ic capital purposes
generally do not have specialised validation processes associ­
ated with them , but rather use the results of validation work
done by others, such as by risk m anagem ent, to support the use
of the counterparty credit risk model. When there is a difference
between the counterparty credit risk model for econom ic capital
purposes and the counterparty credit risk model for risk man­
agem ent purposes (for exam ple, the holding period may vary),
there appears to be little additional testing or validation to
support the difference, as the differences are generally viewed
as m echanic differences in implementation and not as separate
models requiring separate validation. For exam ple, backtesting,
an established practice for market risk exposures, is still in the
early stages of developm ent for counterparty credit risk models.
13.10 A N N EX 3: INTEREST RATE RISK
IN THE BANKING BO O K
Interest rate risk refers to the exposure of a bank's financial con­
dition to adverse movements in interest rates. It should be inter­
preted for the purposes of this annex as the current or
prospective risk to both the earnings and capital of an institution
arising from adverse movements in interest rates, which affect
the institution's banking book. Changes in interest rates affect
an institution's earnings by altering interest-sensitive income and
expenses, and the underlying value of an institution's assets, lia­
bilities, and off-balance sheet instruments because the present
value of future cash flows changes when interest rates change.32*
32 Interest rate risk arises from the natural mismatch betw een repricing
characteristics desired by investors and depositors and those desired
by borrowers. A s such, interest rate risk derives from the mismatched
m aturities or durations of assets which are typically longer than the
liabilities. A sudden change in the shape of the term structure will affect
the values of assets differently from those of liabilities.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
An indirect effect can also occur, which is linked to the impact
that rate changes can have on business volum es. Although inter­
est rate risk in the banking book is a normal part of financial
interm ediation, excessive interest rate risk poses a significant
threat to an institution's earnings and capital adequacy.
The main challenges in the calculation of econom ic capital for
interest rate risk in the banking book come from the long hold­
ing period assumed for a bank's structural balance sheet and the
need to model indeterm inate cash flows on both the asset and
liability side due to the em bedded optionality of many banking
book items.
Many banks use some type of internal transfer funds pricing
to move structural interest rate into a centralised place within
the organisation, typically the bank's treasury unit, in order to
achieve matched funds transfer pricing between all other busi­
ness units of the bank. This unit is responsible for interest rate
modelling and maintaining gap positions within agreed upon
risk limits.
Sources of Interest Rate Risk
The main sources of interest rate risk in the banking book
are repricing risk (arising from differences in the m aturity and
repricing term s of custom er loans and liabilities), yield curve
risk (stem m ing from asym m etric m ovem ents in rates along
the yield curve), and basis risk (arising from im perfect cor­
relation in the adjustm ent of the rates earned and paid on
different financial instrum ents with otherw ise sim ilar repricing
characteristics).
Interest rate risk in the banking book also arises from the option
features of many financial instruments. Retail products in the
banking book that have em bedded options include bonds and
notes with call or put provisions, loans such as m ortgages which
give borrowers the option to prepay balances, adjustable-rate
loans with explicit interest rate caps and floors that limit the
amount by which the rate may adjust, and various types of non­
maturity deposits which give depositors the option to withdraw
funds at any tim e often without penalty. If not adequately m ea­
sured and m anaged, the asymmetrical payoff characteristics of
instruments with em bedded option features can pose significant
interest rate risks.
33 According to Principle 16 of the Basel Com m ittee's Principles for the
M anagem ent and Supervision of Interest Rate Risk (B C B S, 2004), "An
additional and increasingly im portant source of interest rate risk arises
from the options em bedded in many bank assets, liabilities, and off-
balance sheet portfolios."
■ 227
Interest Rate Measurement Techniques may be adapted to allow for the rolling over of current posi­

and Indicators tions. In its dynamic version EV E may provide forward risk mea­
sures that also take into account future growth in existing or
There are two basic techniques for assessing interest rate risk in new business activities.
the banking book: repricing schedules (gap and duration analy­
W hen the EV E model is com plem ented with an estim ate of the
ses) and simulation approaches. Although commonly used, the
probabilities of the interest-rate scenarios used, the EV E model
simple structure and restrictive assumptions make repricing
becom es a value-at-risk (VaR) model, which builds a statistical
schedules less suitable for the calculation of econom ic capital.34
distribution of profit and losses that may occur over a specified
Most banks use simulation approaches for determ ining their
tim e horizon at a given confidence level owing to movements in
econom ic capital, based on estim ated losses occurring in case
interest rates. The method not only measures the magnitude of
of a set of worst case scenarios. The magnitude of such losses
the loss, but also the probability of the loss.
and their probability of occurrence determ ine the amount of
econom ic capital. In practice the calculation of econom ic capital follows three
steps: in the first step, the change in econom ic value of both
The banking book is traditionally based on accrual accounting
assets and liabilities is modelled as a result of changes in interest
and measures such as earnings volatility or Earnings at Risk (EaR)
rates and an EV E is derived. The second step involves modelling
are used. EaR measures the loss of net interest income result­
the term structure of interest rates or the yield curve. Some
ing from interest rate m ovem ents, either gradual movements
banks model volatility changes over tim e, while other banks
or one-off large interest rate shock, over a given tim e horizon
assume volatility is constant. In the third step the economic
(typically one to two years). A disadvantage of the EaR method
value of assets and liabilities and the term structure of interest
is that it only measures the short-term earnings effect (accrued
rates are combined to produce the final value distribution which
interest) resulting from interest rate fluctuations and not the
can be used to com pute VaR or econom ic capital. It is worth
econom ic value effects (capital gains/capital losses).
mentioning that many of the assets and liabilities in the banking
Some banks have moved towards an econom ic value orientation book are not regularly traded and are therefore difficult to value
and measures based on Econom ic Value of Equity (EVE), VaR, at market prices. Most assets and liabilities are valued on a
and Extrem e Value Theory (EVT) are becoming popular. EV E, mark-to-model basis, using path-dependent projections of run­
which is defined as the present value of assets minus liabilities, off and future cash flo w s.38
measures the change in the market value of equity resulting
In contrast to EV E, EVT is well suited to the estimation of
from interest rate shock scenarios, com pared with the market
extrem e probabilities and quantiles of a distribution. This
value of equity under a base scenario. It is a com prehensive risk
approach is based on the extrem e value theorem , which indi­
measure, consistent with the Basel standard interest rate shock
cates what the limiting distribution of extrem e values should
used to identify outliers.353
*The accuracy of the valuation of bal­
6
look like and im portantly dem onstrates that it is not the nor­
ance sheet positions is strongly dependent upon the calculated
O / mal distribution. Drawbacks are the scarcity of extrem e value
cash flows and discount rates used. For practical purposes,
observations, and the model risk associated with EVT estim ates,
most EVE models use static or liquidation concepts, in the sense
which are usually very sensitive to the precise assumptions
that they show a snapshot in tim e of the risk based upon the
made by users.
current portfolio or balance sheet com position. In principle, EVE
The choice of techniques used in assessing interest rate risk
depends on the bank's orientation tow ards either econom ic
value or earnings, and also on the type of business model pur­
34 Particularly for larger banks, gap analysis is nothing more than the first
sued by the bank. Some businesses, such as commercial lend­
step (in this case, the distribution of the relevant assets and liabilities
according to maturity) in analyzing the interest rate risk in the banking ing or residential m ortgage lending, are managed on a present
book.

35 Under current guidelines, interest rate risk is identified as the banking

book econom ic value sensitivity with respect to a standard interest rate
shock of plus/minus 200 basis points; outlier banks are then identified
as those having greater than 20% sensitivity with respect to regulatory
capital.
36 W hen the cash flows are calculated, account needs to be taken of the
fact that the size and the timing of the cash flows may differ under the
various scenarios as a result of custom er behavior regarding changes in
deposit balances and also prepaym ent speeds.
37 Single-factor m odels, such as C o x et. al. (1985), Black and Karasin-
sky (1991), or Black et. al. (1990) may be used, or more advanced term
structure m odels, such as Heath et. al. (1992), Dai and Singleton (2000),
and the lognormal forw ard-LIBO R model of Brace et. al. (1997) may be
used.
38 Although this can be true also for instrum ents held in the trading
book, the typical sh o rtte rm horizon of the instrum ents held in the trad ­
ing book provides a more frequent test of model prices.

228 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
value approach, while others, such as credit cards, are managed
on an earnings approach. This poses issues when the bank
wants to convert risk measures to a common m etric, for aggre­
gation purposes.
Modelling Issues
The main modelling issues involve the type of simulation, the
assumptions surrounding the timing of interest rate shocks, the
holding period and tim e horizon. As for simulation, com puta­
tional intensity derives from the large number of points along
the term structure of interest rates, the large number of curren­
cies to track, with different implied volatilities for each currency/
term structure com bination, the availability of many related,
but not identical interest rate curves. Many banks adopt some
dimension-reduction techniques, such as principal com ponent
analysis, to address the magnitude of the computational burden.
Simulation can be static or dynamic. Static simulation models
are mostly based on the current on- and off-balance sheet exp o­
sures, although they generally do take into account interest rate
sensitivities of prepaym ents and rollovers. Some models include
also expected balance sheet growth, but generally not the
interest-tare-induced changes in the rate of growth, which are
difficult to project. Dynamic simulation models allow for changes
in business activities, incorporate optionality, prepaym ents, sav­
ing behaviour, etc. under different scenarios, explicitly m odel­
ling m anagem ent and custom er action. Although this approach
offers a more realistic setting, it comes at a cost. Dynamic
models require the use of more assumptions, lead to a loss of
tractability and an increase in computing tim e. Moreover, the
longer the horizon of the analysis, the less accurate assumptions
regarding future business may be. In order for econom ic capi­
tal numbers to be realistic, the assumptions need to be tested
against internal processes and m anagem ent action.
As for the type of interest rate shock, it is im portant to consider
whether a scenario is assumed to occur gradually, giving banks
tim e to actively manage their interest rate position, or whether
an interest rate shock is assumed to occur suddenly. The pace of
the interest rate movements affects interest income during the
horizon of the analysis and may also affect custom er behaviour,
resulting in an im pact on the result of the (dynamic) simulation.
When using simulation-based approaches, a tim e horizon should
be considered that is consistent with the policy intention of
holding asset and liability positions for a long period of tim e.
For capital calculations in the banking book, typically an eco­
nomic capital measure (VaR) over a short time horizon (one to
ten days) is scaled up to the one-year horizon used in the eco­
nomic capital fram ework. When scaling up VaR numbers, often
the assumption is made that VaR realisations are independently
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
and identically distributed over tim e. Factors to be taken into
account in the calculation are that interest rates may be serially
correlated39 and that m anagem ent intervention may affect the
interest rate risk profile over the course of the tim e horizon.
Although most econom ic capital models are calibrated over a
one-year holding period, many banks that use simulations will
run multi-year simulations in order to value those instruments
held at the one-year horizon which are not valued via closed
form analytical form ula.
Main Challenges for the Measurement of
Interest Rate Risk in the Banking Book
Optionality in the Banking Book
One of the most fundamental challenges in the m easurem ent
of interest rate risk in the banking book is the identification and
incorporation of non-linear risk deriving from long-dated fixed-
income obligations with em bedded options for the borrower
to prepay, frequently without penalty, and from the em bedded
options in non-maturity deposits.
Prepaym ent risk options are the predominant form of em bed­
ded optionality on the asset side of the balance sheet. C on­
sumer loans, m ortgages, and m ortgage-backed securities
(MBSs) are exam ples of assets with prepaym ent risk. Prepaym ent
risk arises because borrowers have a call option on the loans:
for exam ple, in the case of fixed-rate m ortgages, borrowers
will choose to exercise this option and prepay their mortgages
as interest rates fall sufficiently below the contract mortgage
coupon rates. Because of the prepaym ent option, the cash flows
associated with a mortgage are uncertain and the expected life
of a mortgage is much shorter than its stated maturity.
Since the rate of prepaym ents increases as rates fall (especially
as they fall below the mortgage contract rate), the price-yield
curve for m ortgages exhibits negative convexity and price com ­
pression. This occurs because interest rate decreases do not
produce increases in the values of m ortgages as large as those
of option-free bonds. In addition, holders of m ortgages are
forced to invest the cash flows that are prepaid at a lower rate
of interest.40 When interest rates increase above m ortgage con­
tract coupon rates, the speed of m ortgage prepaym ents by
39 There are different reasons underlying this serial correlation of interest
rate risk factors returns: the bid-ask spreads, the discontinuity in trading
volum es of som e interest rate sensitive instrum ents, the structural fac­
tors of some markets (i.e., low thickness and liquidity), etc.
40 Contraction risk is that part of prepaym ent risk that derives from the
decrease in the duration of m ortgages and the reinvestm ent risk associ­
ated with the speedup of prepaym ents resulting from a decline in inter­
est rates within the negatively convex region of the price-yield curve.
■ 229
borrowers slows. The rate increase produces an increase in the
duration of m ortgages and a steeper decline in the value of
these instruments than is the case for option-free bonds. This
occurs because holders of m ortgages are not able to reinvest
the expected principal cash flows at the higher interest rate
because of slower actual prepaym ents.41 Prepaym ent risk is
therefore related to the variability or uncertainty in the rate at
which the borrowers will prepay, depending on the evolution of
the interest rates. It should be observed that m ortgages also
contain a second type of em bedded option, whereby borrowers
have a put option to default on their m ortgage loans.42
On the liability side of the balance sheet, the em bedded options
in non-maturity deposits are the most common. In effect, non­
maturity deposits contain two em bedded options: (i) the institu­
tion holds the option to determ ine the interest rate offered to
depositors and when to change the rate; and (ii) the depositor
holds the option to withdraw all or part of the balance in the
deposit account at par. The first option makes the deposit
behave as a floating-rate bond, while the second option allows
the depositor to put the bond back to the institution.43 As such,
non-maturity deposits can be viewed essentially as floating-rate,
putable bonds. Moreover, the two em bedded options induce a
volume risk, which cannot be hedged directly since the volume
is not traded in the market.
Although non-maturity deposits can be withdrawn by deposi­
tors on dem and, most of these deposits stay at the institution
for months or years. In addition, while banking institutions may
change the offered deposit rates when market interest rates
change, they do so with a lagged response, and by less than
the full amount of the change in market rates. This is particu­
larly true when rates increase. The interaction between the two
em bedded options found in non-maturity deposits makes the
valuation and interest rate sensitivity of these liabilities one of
the most widely debated issues currently in measuring interest
rate risk in the banking book.
Although optionality is an im portant issue, the degree of
sophistication in the techniques used by the institutions varies,
depending not only on the type of institution, but also on the
41 Extension risk is that part of prepaym ent risk that derives from the
increase in the duration of m ortgages and the reinvestm ent risk associ­
ated with a rise in interest rates.
42 Typically, they will choose to exercise this option when the rem ain­
ing loan balance exceed s the m arket value of the property. A s such,
m ortgage lenders are essentially selling em bedded Am erican straddle
options (i.e., com bined call and put options) to m ortgagors.
43 Holding other things equal, custom er's options have an im pact on
both principal and interest cash flow s, while issuer's options have a
direct im pact on interest cash flows only.
230 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
evolution of the legislation and prevailing m arket practices in
the jurisdictions.
Income simulation models, such as EaR, are generally unable
to analyse option risk fully and generally are only accurate for
the short-term (i.e., two to three years) earnings com ponent.
Econom ic value approaches, such as EV E, provide better m ea­
surem ents of exposures with em bedded options. However,
accurately representing these exposures requires the use of
stochastic-path evaluation techniques, which are com putation­
ally dem anding, and mostly developed in the jurisdictions where
market practice makes the optionality issues, such as m ortgage
prepaym ent, more relevant. Standard practice is to use dis­
counted cash flows on those positions that have linear or highly
uncertain valuation profiles, and use stochastic-path techniques
on those parts of the balance sheet that have non-linear valua­
tion profiles.
In such instances, most firms combine in simulation models
stochastic interest rate modelling techniques with behavioural
assumptions on prepaym ents and on decisions to remain cus­
tom ers or not (deposit modelling or credit card custom er reten­
tion modelling). A prepaym ent model must not only be able to
predict current prepaym ent speeds, but also expected future
prepaym ent speeds, which are largely a function of expected
future m ortgage interest rates. Larger institutions use more
sophisticated statistical prepaym ent models to forecast prepay­
ment speeds and account for the statistical relationships among
the factors that drive prepaym ents. A modelling approach is
required in which prepaym ent models are often combined with
a term structure model of interest rates and dynamic simulation
models, in producing m ortgage valuations based on option-
adjusted spreads. The prepayment/non-maturity deposit mod­
elling may be carried out at local business level, to generate
sensitivity to rate shocks at various stress levels, producing dif­
ferent prepaym ent/custom er retention forecasts across interest
rate shocks. Incorporating such assumptions should involve also
considering model uncertainty on those assumptions, and incor­
porating a measure of model risk (e.g ., prepaym ent error risk).
Industry use of com peting risks models for mortgage prepay­
ment and default is in its infancy, although several of the largest
institutions have em braced this approach.
Banks' Pricing Behaviour
An important aspect of interest rate risk modelling is the effec­
tive responsiveness of individual bank interest rates to changes in
market rates. The measurement of the interest rate risk of bank­
ing book items requires: (i) a model for the analysis of the persis­
tence of the volumes of different non-maturity banking products;
and (ii) a model for the determination of bank interest rates,
taking into account general market conditions, customer relation­
ships, bank commercial power, and optimal commercial policies.
The degree by which the interest rates set by banks react to
market rates (interest rates pass-through) may depend on indi­
vidual bank characteristics and may differ for different products.
Changes in market interest rates may also result in changes in
banks' interest rate policy, driven by changes in the com petitive
environm ent and the need to defend market share.44
A typical finding in the literature is that banking interest rates
pass-through is relatively slow and heterogeneous across both
products and countries. It is slow er for retail banking products
(e .g ., deposits, consum er loans, m ortgages) than for corporate
products; short-term products are more responsive than long­
term products.45 Individual bank characteristics, such as the
bank's liability structure, its liquidity, and capitalisation position
or the proportion of long-term lending, are also relevant for
interest rate determ ination; heterogeneity in the banking rates
pass-through exists only in the short run.46 There is also some
evidence of asym m etries in the interest rate pass-through,
existing also in the short run: banks adjust their loan lending
rate faster during periods of m onetary tightening, and their
deposit rates faster during periods of m onetary easin g .47
A relevant aspect for determ ining bank interest rates is the pric­
ing for credit risk, which influences the duration of bank loans
and represents a "spread duration" com ponent with a non-mar­
ginal effect on econom ic value, especially on longer term loans.
To determ ine the price of credit risk applied on different bank­
ing products would ultimately require a pricing rule that links
the credit spread to changes in m acroeconom ic conditions and
interest rate variations.48 This also indicates that interest rate
risk on the banking book is not independent from credit risk,
and that interest rate stress scenarios should also incorporate
the possible interaction of interest rate and credit risk factors.
The Choice of Stress Scenarios
Stress testing is commonly used in interest rate modelling as a
way to com plem ent the com plexities of interest rate risk
44 A s such, some banks may not regard such policy changes as part of
their interest rate risk, but rather as part of business risk.
45 For Europe, see Cam pa and Gonzales-M inguez (2006).
46 G am bacorta (2007).
47 G am bacorta and lannotti (2007).
48 The price of credit risk varies with the counterparty credit rating in
a way which is also influenced by the level of interest rates and more
generally by the position in the econom ic cycle, especially if the banks
adopt forward-looking econom ic capital calculations and provisioning
and pricing policies.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
system s with transparent interest rate shocks. As such, stress
test results serve as a benchmark risk m easure.49
Following the guiding principles of the Basel Com m ittee, the
current regulatory choice of a stress scenario focuses on parallel
shifts in the yield curve of + /— 200 basis points.50 The Com m it­
tee acknowledges that the parallel shifts of + /— 200 basis points
are relatively sim plistic, but it argues that these shocks appear
to adequately cover volatilities across G 10 countries, even
though the appropriateness of the proposed shock needs to be
monitored on an ongoing basis, and recalibrated should the rate
environment shift m aterially.51
The benefits of using simple interest rate shocks of + /— 200
basis points are that these shocks are very simple and easy to
communicate and that it is easier to com pare the im pact of
these shocks on different portfolios. The drawbacks are that the
shocks are not probabilistic and hence very hard to integrate
into econom ic capital models based on V aR;52 it is not
49 The Com m ittee on Global Financial Stability survey on stress te st­
ing (C G FS , 2005) reveals that a majority of banks run interest rates risk
stress tests. Popular historical scenarios are the bond m arket sell-offs
in 1994 and 2003; the Asian crisis in 1997, LTCM and Russia in 1998,
or Septem ber 11, 2001. Hypothetical scenarios look at changes in the
national or global econom ic outlook, increases in inflation expectations
or unexpected changes in m onetary policy. Scenarios generally cover
environm ents where not only the level but also the slope and curvature
of the yield curve are changing.
50 The Basel Com m ittee (B C B S, 2004) has suggested several guiding
principles for the selection of interest rate risk scenarios. The three most
important are: the rate shock should reflect a fairly uncommon and stress­
ful rate environment; the magnitude of the rate shock should be signifi­
cant enough to capture the effects of em bedded options and convexity
within bank assets and liabilities so that underlying risk may be revealed;
and the rate shock should be straightforward and practical to implement,
and should be able to accom m odate the diverse approaches inherent in
single-rate-path simulation models and statistically driven value-at-risk
models for banking book positions. A s a practical guidance, in addition to
considering 200 bps scenarios, the Com m ittee also suggests looking at
parallel shifts using the 1st and 99th percentile of observed interest rate
changes with a one year horizon and five years of data.
51 Further, the Com m ittee argues that, "w hile more nuanced rate
scenarios (such as twists and turns in the yield curve) might tease out
certain underlying risk characteristics, for the more m odest objectives
of supervisors in detecting institutions with significant levels of interest
rate risk, a sim ple parallel shock is adequate. Such an approach also
recognises the potential for spurious precision that occurs when undue
attention to fine detail is placed on one aspect of a m easurem ent sys­
tem without recognition that assum ptions em ployed for certain asset
and liability categories, such as core deposits, are by necessity blunt
and judgm ental. Such judgm ental aspects of an interest rate risk model
often drive the resulting risk measure and conclusion, regardless of the
detailed attention paid to other aspects of the risk m easure."(A nnex 3,
para7, B C B S , 2004).
52 Even though the scenario has been calibrated on the 1°/99° percen­
tile of observed interest rate changes.
■ 231
necessarily sensitive to the current rate or econom ic environ­
ment; it doesn't take into account changes in the slope or curva­
ture of the yield curve; and that it doesn't allow for an
integrated analysis of interest rate and credit risk on banking
book items.
Am ong the possible developm ents are: (i) scenarios based on
historical distributions; (ii) scenarios based on principal com po­
nent (PC) decom position of the yield curve; (iii) scenarios based
on the G A RC H m odels; (iv) scenarios based on options; (v) sce­
narios based on m acroeconom ic factors; and (vi) scenarios link­
ing credit and interest rate risk.
Scenarios Based on Historical Distributions
The suggestion in BC BS (2004) to use the 1st and 99th per­
centile of the observed interest rate changes over the last five
years would be an easy way to look at a probabilistic scenario.
However the historical distribution is backward-looking, which is
inherently problem atic for a forward-looking risk m easurem ent.
For exam ple, given long interest rate cycles it may be the case
that there are limited observations in one direction. It should
also be observed that the empirical distribution generally does
not include both a plus and minus 200 basis points shock.
Scenarios Based on Principal Component
Decomposition of the Yield Curve
A possible solution is to build a scenario simulation procedure
based on PC decom position of the yield curve in order to pro­
duce realistic scenarios of interest rates changes along various
rQ
points of the term structure.
The PC distribution functions are used in a Monte Carlo sim ula­
tion in order to reproduce the correlation observed between the
original risk factors. The usual assumption is that the PC are nor­
mally distributed; some recent work has applied a non-paramet-
ric simulation to account for the fact that PCs are skewed and
heavy-tailed, recovering the empirical distribution through a ker­
nel density estim ation.54
In the context of PC representation, stress testing analysis can
be performed by changing the volatility of interest rates along
53 In the PC representation, interest rate changes at different maturities
are expressed as a function of the new risk factors PCs, where the w eight­
ing coefficients (the so called "factor loading") capture the correlation in
the system . The factor loadings account for the contribution of each risk
factor to the overall variance. The PC decom position of the yield curve
usually reveals the existence of three underlying risk factors explaining
a large part of total variance (around 95%): the parallel shift of the yield
curve; the tilt or rotation; the twist, that is a change in the curvature.
54 See Fiori and lannotti, 2007.
232 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the yield curve and/or the correlation structure of the data.
Correlation can be stressed by modifying the m atrix of factor
weights (the so called factor loadings), while assuming constant
volatility. Conversely, one can shock the volatility of interest rate
changes while maintaining the m atrix of factor loading fixed at
historical values.
The main advantage of this simulation procedure is that it
assigns a level of confidence to all plausible scenarios (in term s
of percentiles of the simulated distributions). The plausibility of
scenarios is derived from the calibration of the procedure to the
correlation structure observed in the market.
Scenarios Based on GARCH Models
Simple autoregressive (AR) models with G A RC H effects could be
used to simulate the evolution of individual interest rates over a
specific horizon. Such an approach would be forward looking and
partially condition on the current environment in term s of level
and volatility. A t the same time it is relatively easy to implement.
Scenarios Based on Options
A distribution of future changes of interest rates could also be
extracted from options. The key (and so far not successfully
solved) problem for such an approach is to translate the risk-
neutral PDs (necessary for trading and pricing) to real-world or
physical PDs (im portant for risk m anagem ent).55
Scenarios Based on Macroeconomic Factors
Similar to credit risk models, it is conceptually possible to sim u­
late a distribution of future yield curve changes based on macro-
econom ic fundam entals.56 W hereas there has been much
progress in this field, explanatory power of m acroeconom ic fac­
tors remains weak and forecast and estimation errors are sub­
stantial. Even though these models could be used to condition
changes on the current and future m acroeconom ic environment,
technical difficulties could im pede a consistent use of these
models for econom ic capital calculation.
Scenarios Linking Credit and Interest Rate Risk
It is a well established fact that interest rates are an important
negative driver of the credit quality of banks' assets— one
55 It has to be noted however that for stochastic-path m odelling, risk
neutral im plied volatilities are necessary to validate the model by check­
ing for convergence to m arket prices at a reasonable O ption Adjusted
Spread (O AS), a key validation test for m ortgage m odels.
56 See for exam ple Ang and Piazzesi (2003), Cochrane (2007). Rude-
busch and W illiam s (2007) provide an up-to date survey of the literature
linking macro factors to yield curves.
indication that credit risk and interest rate risk in the banking
book are interdependent.57 The integration of credit and interest
rate risk requires a sophisticated fram ework. First, the loss distri­
bution of credit risk must condition on the macro and interest
rate environment. Second, decreased net interest income due to
default must be taken into account. Finally, for an earnings per­
spective, future cash flows need to be simulated. This necessi­
tates a robust fram ework to price assets in the future conditional
on the simulated macro and interest rate environment.
Banking versus Trading Book
The exclusion of the trading book from the m easurem ent of
interest rate risk elim inates the problem of double counting
arising from the presence of a market risk requirem ent for inter­
est rate sensitive positions held in the trading book. However
it should be pointed out that the problem of double counting
does not preclude the possibility that the exposures in the trad ­
ing book and in the banking book offset each other.
In certain cases, the interest rate risk exposure of the trading
book com pensates partially the exposure of the banking book.
For exam ple, it is possible that the trading book has a short
position with respect to interest rate shocks (in the sense that
a rise in interest rates causes an increase in the econom ic value
of the trading book), while the position in the banking book is
long with respect to interest rate shocks (in the sense that a rise
in interest rates causes a decrease in the econom ic value of the
banking book). In cases such as this, it might be appropriate to
consider the net exposure of the entire balance sheet.
References
Akhavein, J D and A E Kocagil (2005): "A com parative empirical
study of asset correlation", Fitch Ratings: Q uantitative Financial
Research Special R eport, 14 July.
Ang, A and M Piazzesi (2003): "A no-arbitrage vector autore­
gression of term structure dynamics with m acroeconom ics and
latent variables", Journal o f M onetary Econom ics, vol 50, no 5.
Artzner, P, F Dalbaen, J M Eber and D Heath (1999): "C oherent
measures of risk", M athem atical Finance, no 9, pp 203-228.
Bangia, A , F X Diebold and T Schuermann (2000): "Rating
migration and the business cycle, with applications to credit
portfolio stress testin g ", The Wharton School, working paper
00-26.
57 Drehmann et. al. (2007) show that interactions betw een credit risk
and interest rate risk can indeed be substantial and should be taken into
account.
Chapter 13 Range of Practices and Issues in Economic Capital Frameworks
Bank of Japan (2005): A dvan cing In teg ra ted Risk M anagem ent,
htt p://w w w. b oj . o r.j p.
Bank o f Japan (2007): Econom ic Capital W orkshop Sum m ary
R ecord, http://w w w .boj.or.jp.
Basel Com m ittee on Banking Supervision (1999): C redit risk
m odelling: current practices and applications, Basel, April.
— (2004): Principles for the m anagem ent and supervision o f
interest rate risk, Basel, July.
— (2005a): "U pdate on work of the Accord Implementation
Group related to validation under the Basel II Fram ew ork", Basel
C om m ittee N ew sletter, No 4, January.
— (2005b): "Studies on the validation of internal rating system s"
W orking Paper, no 14, May.
— (2009): G uidelines for com puting capital for increm ental risk
in the trading book, Consultative Docum ent, Basel, January.
Berkowitz, J (2000): "Testing Density Forecasts, with A pp lica­
tions to Risk M anagem ent", University o f California, Decem ber,
mimeo.
Black, F, E Derman and W Toy (1990): "A one-factor model of
interest rates and its application to treasury bond options",
Financial Analysts Journal, vol 46.
Black, F and P Karasinski (1991): "Bond and Option Pricing when
Short Rates are Lognorm al", Financial Analysts Journal, vol 47.
Brace, A , D G atarek and M Musiela (1997): "The M arket Model
of Interest Rate D ynam ics", M athem atical Finance, vol 7.
Breuer, T, M Jandacka, K Rheinberger and M Summer (2008):
"Regulatory capital for market and credit interaction: is current
regulation always conservative?", forthcom ing, Journal o f Bank­
ing and Finance.
Burns, R L (2004): "Econom ic Capital and the Assessm ent of
Capital A d eq u acy", Su pervisory Insights, vol 1, no 2, pp 5-16.
Burtschell, X, J Gregory and J P Laurent (2007): B eyo n d the
Gaussian Copula: Stochastic and Local Correlation, January,
mimeo.
Cam pa, J M and J M Gonzalez Minguez (2006): "D ifferences in
exchanges rate pass-through in the euro area", European E c o ­
nom ic Review , vol 50.
Cochrane, J H (2007): "C om m entary", Fed era l R eserve Bank o f
S t Louis Review , July/August.
Com m ittee of the Global Financial System (2005a): Stress te st­
ing at m ajor financial institutions: survey results and practice,
Basel, January.
— (2005): The role o f ratings in stru ctu red finance: issues and
im plications, Basel, January.
■ 233
Cox, J C , J E Ingersoll and S A Ross (1985): "A theory of the
term structure of interest rates", Econom etrica 53, pp 385-467.
Crouhy, M, D Galai and R Mark (2006): The Essentials o f Risk
M anagem ent, M cGraw-Hill.
Dai, Q , and K J Singleton (2000): "Specification Analysis of
Affine Term Structure M odels", Journal o f Finance, vol 55.
Das, S R, D Duffie, N Kapadia and L Saita (2007) "Com m on fail­
ings: how corporate defaults are correlated", Journal o f Finance,
vol LXII, no 1, February.
Davis, M and V Lo (2001): "Infectious D efault", Quantitative
Finance, vol 1, no 4, pp 382-387.
De N ederlandsche Bank (2005): G uidelines on Interest Rate Risk
in the Banking Book, Am sterdam .
Diebold, F X, G D Rudebush and S B Arouba (2006) "The
macroeconom y and the yield curve: a dynamic latent factor
approach", Journal o f Econ om etrics, vol 131.
Dimakos X K and K Aas (2004): "Integrated risk m odelling", Sta­
tistical M odelling 4, pp 265-277.
Drehmann, M, S Sorensen and M Stringa (2008): "The inte­
grated impact of credit and interest rate risk on banks: An
econom ic value and capital adequacy p ersp ective", Bank o f
England W orking Paper 339.
Duffie, D, A Eckner, G Horel and L Saita (2006): "Frailty corre­
lated default", O ctober 19, mimeo.
Duffie, D and D Lando (2001): "Term structures of credit spreads
with incom plete accounting inform ation", Econom etrica, vol 69,
no 3, pp 633-664.
Duffie, D, L Saita and K W an g (2005): "Multi-period corporate
default prediction with stochastic covariates", September, mimeo.
Egloff, D, M Leippold and P Vanini (2004): "A simple model of
credit contagion", mimeo.
Fabozzi, F (2000): B on d M arkets, Analysis and Strategies, Fourth
Edition, Prentice Hall, New Jersey.
Fender, I and J Kiff (2004): "C D O rating m ethodology: Some
thoughts on model risk and its im plications", BIS W orking Paper,
no 163, Basel, November.
Ferm anian, J D and M Sbai (2005): A com parative analysis of
dependence levels in intensity based and Merton style credit
risk models.
Fiori, R and S lannotti S (2007): "Scenario based Principal C om ­
ponent Value-at-Risk: an application to Italian banks' interest
rate risk exposure", Journ al o f Risk, vol 9, no 3, pp 63-99.
Frerichs, H and G Loffler (2002): "Evaluating credit risk models:
A critique and a proposal", May, mimeo.
234 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Frey, R and A J McNeil (2003): "D ependence m odelling, model
risk and model calibration in models of portfolio credit risk",
Journal o f Risk 6(1).
Gam bacorta L (2007) "H ow do banks set interest rates", Euro­
pean Econom ic Review , forthcom ing.
Gam bacorta L and S lannotti (2007): "A re There Asym m etries
in the Response of Bank Interest Rates to M onetary Shocks?",
A p p lie d Econom ics, forthcom ing.
Heath, D, R Jarro w and A Morton (1992): "Bond Pricing and the
Term Structure of Interest Rates: A New M ethodology", E co n o ­
m etrica, vol 60.
Hull, J C (2007): Risk m anagem ent and financial institutions,
Pearson Prentice Hall, New Jersey.
IACPM and ISDA (2006): C on verg en ce o f C red it Capital M o d els.
IFRI and C R O Forum (2007): Insights from the Jo in t IFRI/CRO
Forum Survey on Econ om ic Capital Practice and A pplications.
Jarrow , R A and F Yu (1999): "Counterparty risk and the pricing
of defaultable securities," Septem ber, mimeo.
Jarrow , R A and F Yu (2001): "Counterparty risk and pric­
ing of defaultable securities", Journal o f Finance, vol 53,
pp. 2225-2243.
Lopez J A and M R Saidenberg (1999): "Evaluating Credit Risk
M odel", Fed era l R eserve Bank o f San Francisco, Working paper
no 99-06.
M cNeil, A , R Frey and Em brechts (2005): Q uantitative Risk M an­
agem ent; C o n cep ts, Techniques, and Tools. Princeton Series in
Finance.
PriceW aterhouseCoopers (2005): Effective Capital M anagem ent:
Econom ic Capital as an Industry Standard?
Rosenberg J V and T Schuermann (2006): "A general approach
to integrated risk m anagem ent with skew ed, fat-tailed risks",
Journal o f Financial Econom ics, vol 9, no 3, pp 569-614.
Rudebusch, G D and J C W illiams (2007): "Forecasting reces­
sions: The puzzle of the enduring power of the yield curve",
Fed era l R eserve Bank o f San Francisco, Working Paper, No
2007-16.
Rutter Associates LLC (2004): 2004 R utter A sso cia tes Survey o f
C redit Portfolio M anagem ent Practices.
Samuel (2008): "Disclosure of Econom ic C ap ital", Federal
R eserve Bank o f N ew York, Available from the author or Policy
Departm ent, Federal Reserve Bank of New York, email: Jeffrey.
Sam uel@ ny.frb.org. April 18.
Tarashev, N and H Zhu (2007): "Modelling and calibration errors in
measures of portfolio credit risk", BIS Working Paper, Number 230.
Capital Planning at
Large Bank Holding
Companies
Supervisory Expectations and
Range of Current Practice

Learning Objectives
A fter com pleting this reading you should be able to:

Describe the Federal Reserve's Capital Plan Rule and
explain the seven principles of an effective capital
adequacy process for bank holding com panies (BHCs)
subject to the Capital Plan Rule.
Describe practices that can result in a strong and effective
capital adequacy process for a BHC in the following areas:
■ Risk identification
Internal controls, including model review and validation
■ Corporate governance
Capital policy, including setting of goals and targets
and contingency planning
Stress testing and stress scenario design
Estimating losses, revenues, and expenses, including
quantitative and qualitative m ethodologies
Assessing the impact of capital adequacy, including
risk-weighted asset (RWA) and balance sheet
projections.

E x c e rp t is co u rtesy o f Board o f G overn ors o f the Federal R eserve System .

14.1 INTRODUCTION
The Federal Reserve has previously noted the im portance of
capital planning at large, com plex bank holding com panies
(BH Cs). Capital is central to a BH C's ability to absorb unex­
pected losses and continue to lend to creditw orthy businesses
and consum ers. It serves as the first line of defense against
losses, protecting the deposit insurance fund and taxp ayers.
As such, a large BH C's processes for managing and allocating
its capital resources are critical not only to its individual health
and perform ance, but also to the stability and effective func­
tioning of the U.S. financial system . The Federal Reserve's
Capital Plan Rule and the associated annual Com prehensive
Capital Analysis and Review (C C A R ) have em phasized the
im portance the Federal Reserve places on BH C s' internal cap i­
tal planning processes, and on the supervisory assessm ent of
all aspects of these processes, which is a key elem ent of a
supervisory program that is focused on prom oting resiliency at
the largest B H C s.1
These initiatives have focused not just on the amount of capital
that a BH C has, but also on the internal practices and policies a
firm uses to determ ine the amount and composition of capital
that would be adequate, given the firm's risk exposures and cor­
porate strategies as well as supervisory expectations and regula­
tory standards. BH Cs have long engaged in some form of capital
planning to address the expectations of shareholders, creditors,
custom ers, and other stakeholders. The Federal Reserve's inter­
est in and expectations for effective capital planning reflect
the im portance of the ongoing viability of the largest BHCs
even under stressful financial and econom ic conditions. Even if
current assessments of capital adequacy suggest that a BHC's
capital level is sufficient to withstand potential econom ic stress,
robust capital planning helps ensure that this outcom e will con­
tinue to hold in the future. Robust internal capital planning can
also help ensure that BH Cs have sufficient capital in a broad
range of future m acroeconom ic and financial m arket environ­
ments by governing the capital actions— including dividend pay­
ments, share repurchases, and share issuance and conversion— a
BHC takes in these situations.
The Federal Reserve's Capital Plan Rule requires all U.S.-domiciled,
top-tier BH Cs with total consolidated assets of $50 billion or
more to develop and maintain a capital plan supported by
a robust process for assessing their capital ad eq u acy.2
1 See SR Letter 12-17, "C onsolidated Supervision Fram ew ork for Large
Financial Institutions," (D ecem ber 17, 2012), w w w .federalreserve.gov/
bankinforeg/srletters/sr1217.htm ; 12 C FR 225.8.
2 12 C FR 225.8.
236 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
C C A R is the Federal Reserve's supervisory program for assessing
the capital plans. In 2013, C C A R covered 18 BHCs that partici­
pated in the 2009 Supervisory Capital Assessment Program
(SCAP). The Federal Reserve's assessment of a BHC's capital
planning process includes an evaluation of the risk-identification,
-measurement, and -management practices that support the
BHC's capital planning and stress scenario analysis, an assessment
of stressed loss and revenue estimation practices, and a review of
the governance and controls around these practices. The pream­
ble to the Capital Plan Rule outlines the elements on which the
Federal Reserve evaluates the robustness of a BHC's internal capi­
tal planning— also referred to as the capital adequacy process, or
"CAP." These principles are summarized in Figure 14.1.3
4
This publication describes the Federal Reserve's expectations
for internal capital planning at the large, com plex BH Cs subject
to the Capital Plan Rule in light of the seven C A P principles. It
expands on previous articulations of these supervisory exp ecta­
tions by providing exam ples of observed practices among the
BH Cs participating in C C A R 2013 and by highlighting those
practices considered to be stronger or leading practices at these
firms. In addition, it identifies practices that the Federal Reserve
deem s to be weaker, or in some cases unacceptable, and thus in
need of significant im provem ent. However, practices identified
in this publication as leading or industry-best practices should
not be considered a safe harbor. The Federal Reserve antici­
pates that leading practices will continue to evolve as new data
becom e available, econom ic conditions change, new products
and businesses introduce new risks, and estimation techniques
advance further.
W hile the supervisory scenarios and supervisory stress tests
that are required under the D odd-Frank A c t5 play an im portant
role in C C A R ,6 they are not meant to be and should not be
view ed as providing for an all-encom passing assessm ent of the
possible risks a BH C may face. A robust internal capital plan­
ning process should include m odeling practices and scenario
assum ptions that reflect BH C-specific factors. In certain
instances, these practices and assum ptions may differ consider­
ably from those used by the Federal Reserve. Indeed, design­
ing an internal capital planning process that sim ply seeks to
mirror the Federal Reserve's stress testing is a w eak practice.
3 The plans of the remaining BH Cs subject to the Capital Plan Rule have
been assessed through a separate process (the Capital Plan Review).
Beginning in 2014, the capital plans of all BH Cs subject to the Capital
Plan Rule will be evaluated in a single, unified process through C C A R .
4 See 76 Fed . R eg. 74631, 74634 (D ecem ber 1, 2011).
5 12 C FR part 225, subpart F.
6 See 12 C FR 225.8(d)(2), 225.8(e)(1).
Figure 14.1 Seven principles of an effective capital adequacy process.

Principle 1: Sound foundational risk management

The BH C has a sound risk-measurement and risk-management infrastructure that supports the identification, m easurem ent,
assessm ent, and control of all material risks arising from its exposures and business activities.

Principle 2: Effective loss-estimation methodologies

The BH C has effective processes for translating risk measures into estim ates of potential losses over a range of stressful scenarios
and environments and for aggregating those estim ated losses across the BH C.

Principle 3: Solid resource-estimation methodologies

The BH C has a clear definition of available capital resources and an effective process for estimating available capital resources
(including any projected revenues) over the same range of stressful scenarios and environments used for estimating losses.

Principle 4: Sufficient capital adequacy impact assessment

The BH C has processes for bringing together estim ates of losses and capital resources to assess the combined impact on capital
adequacy in relation to the BHC's stated goals for the level and composition of capital.

Principle 5: Comprehensive capital policy and capital planning

The BH C has a com prehensive capital policy and robust capital planning practices for establishing capital goals, determining
appropriate capital levels and composition of capital, making decisions about capital actions, and maintaining capital
contingency plans.

Principle 6: Robust internal controls

The BH C has robust internal controls governing capital adequacy process com ponents, including policies and procedures; change
control; model validation and independent review; com prehensive docum entation; and review by internal audit.

Principle 7: Effective governance

The BH C has effective board and senior m anagem ent oversight of the CAP, including periodic review of the BHC's risk
infrastructure and loss- and resource-estimation m ethodologies; evaluation of capital goals; assessm ent of the appropriateness
of stressful scenarios considered; regular review of any limitations and uncertainties in all aspects of the C A P ; and approval of
capital decisions.

Many lagging practices identified in this publication involve
modeling approaches or BH C stress scenarios that fail to reflect
BH C-specific factors or that rely on generic assum ptions or
"standard" modeling techniques, without sufficient consider­
ation of w hether those assum ptions or techniques are the most
appropriate ones for the BH C.
The supervisory expectations summarized here are broad and
reflect, at a general level, the key characteristics of a sound and
robust internal capital planning process. W hile certain aspects
of the detailed discussion that follows may be less relevant to
individual BH Cs based on their business mix and risk profile, the
core tenets espoused are broadly applicable to all BH Cs subject
to the Capital Plan Rule.
Importantly, the Federal Reserve has tailored expectations for
BH Cs of different sizes, scope of operations, activities, and
system ic im portance in various aspects of capital planning.
For exam ple, the Federal Reserve has significantly heightened
supervisory expectations for the largest and most com plex
BH Cs— in all aspects of capital planning— and expects these
BH Cs to have capital planning practices that are widely consid­
ered to be leading practices. In addition, the Federal Reserve
recognizes the challenges facing BH Cs that are new to C C A R
and further recognizes that these BH Cs will continue to develop
and enhance their capital planning system s and processes to
m eet supervisory expectations.
The purpose of this publication is two-fold. First, it is intended
to assist BHC m anagem ent in assessing their current capi­
tal planning processes and in designing and implementing
improvements to those processes. Second, it is intended to
assist a broader audience in understanding the key aspects of
capital planning practices at large, com plex U.S. BHCs and the
im portance the Federal Reserve puts on ensuring that these
firms have robust capital resources.
The sections that follow provide greater detail on supervisory
expectations and the range of current practice across several
dimensions of BH Cs' internal capital planning processes. The
first section discusses foundational risk m anagem ent, including
identification of risk exposures. The next two sections focus on
controls and governance around internal capital planning pro­
cesses. The fourth section covers expectations and the range of
current practice concerning BH Cs' capital policies— the internal
guidelines governing the capital action decisions made by a
BHC under a range of potential future conditions for the firm
and for the m acroeconom ic and financial market environments

Chapter 14 Capital Planning at Large Bank Holding Companies ■ 237

in which it operates. The subsequent three sections focus on
the key elem ents of BH Cs' internal enterprise-wide scenario
analysis: design of the stress scenarios and modeling the impact
of the scenarios on losses, revenues, balance sheet composition
and size, and capital. The final section summarizes the Federal
Reserve's conclusions on the current range of practice at BHCs.
14.2 FOUNDATIONAL RISK
M AN AGEM EN T
BHCs are expected to have effective risk-identification, -mea­
surem ent, -m anagem ent, and -control processes in place to sup­
port their internal capital planning.7 In addition to the
assessments of a BHC's stress scenario analysis and stressed
loss- and revenue-estimation practices, supervisory assessments
of BH Cs' internal capital planning will continue to focus on fun­
damental risk-identification, -m easurement, and -management
practices, as well as on internal controls and governance. W eak­
nesses in these areas may contribute to a negative supervisory
assessm ent of a BHC's capital planning process that could lead
to an objection to a BHC's capital plan.8
A key lesson from the recent financial crisis is that many financial
com panies simply failed to adequately identify the potential
exposures and risks stemming from their firm-wide activities.
This was in part a failure of information technology and man­
agem ent information system s (MIS), the often fractured nature
of which made it difficult for some com panies to identify and
aggregate exposures across the firm. But more importantly,
many com panies failed to consider the full scale and scope
of exposures, and to analyze how the size and risk character­
istics of their exposures and business activities might evolve
as econom ic and market conditions changed. Com bining a
com prehensive identification of a firm's business activities and
associated positions across the organization with effective
techniques for assessing how those positions and activities may
evolve under stressful econom ic and market conditions, and
assessing the potential impact of that evolution on the capital
needs of the firm , are critical elem ents of capital planning. A
robust internal capital adequacy assessm ent process relies on
the underlying strength of each of these elem ents.
Risk Identification
BHCs should have risk-identification processes that ensure that
all risks are appropriately accounted for when assessing capital
7 1 2 C F R 225.8(d)(2).
8 12 C FR 225.8(e)(2).
238 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
needs.9 These processes should evaluate the full set of potential
exposures stemming from on- and off-balance sheet positions,
including those that could arise from provisions of noncontrac­
tual support to off-balance-sheet entities, and risks conditional
on changing econom ic and financial m arket conditions during
periods of stress. BHCs should have a system atic and repeatable
process to identify all risks and consider the potential im pact to
capital from these risks. In addition, BH Cs should closely assess
any assumptions about risk reduction resulting from risk transfer
and/or mitigation techniques, including, for exam ple, analysis of
the enforceability and effectiveness of any guarantees or netting
and collateral agreem ents and the access to and valuation of
collateral as exposures and asset values are changing rapidly in
a stressed market.
Stronger risk-identification practices include standardized pro­
cesses through which senior m anagem ent regularly update risk
assessm ents, review risk exposures and consider how their risk
exposures might evolve under a variety of stressful situations.
For exam ple, many BHCs maintain a com prehensive inventory
of risks to which they are exposed, and refresh it as conditions
warrant (such as changes in the business mix and the operat­
ing environment) with input from various units across the BH C.
Senior representatives from major lines of business, corporate
risk m anagem ent, finance and treasury, and other business and
risk functions with perspectives on BHC-wide positions and risks
provide input to the process. Consideration of the risks inherent
in new products and activities should be a key part of risk-iden­
tification and -assessment programs, which should also consider
risks that may be associated with any change in the BHC's stra­
tegic direction.
Risk measures should be able to capture changes in an institu­
tion's risk profile— whether due to a change in the BHC's strate­
gic direction, specific new products, increased volum es, changes
in concentration or portfolio quality, or the overall econom ic
environm ent— on a tim ely basis. These risk measures should
support BH Cs' assessm ents of capital adequacy and may be
helpful in capital contingency plans as early warning indicators
or contingency triggers, where appropriate.
BH Cs should be able to dem onstrate how their identified risks
are accounted for in their capital planning processes. If certain
risks are om itted from the enterprise-wide scenario analysis,
BH Cs should note how these risks are accounted for in other
aspects of the capital planning process (see Box 14.1 for illustra­
tion of how BH Cs identified and captured certain risks that are
more difficult to quantify in their capital planning process). If
a BH C employs risk quantification m ethodologies in its capital
9 12 C FR 225.8(d)(2).

BO X 14.1 IN CO RPO RATIN G RISKS
THAT A RE M ORE D IFFICU LT TO
Q U A N TIFY
Scenario-based stress testing is a critical elem ent of
robust capital planning. However, stress testing based on
a limited number of discrete scenarios cannot and is not
expected to capture all potential risks faced by a BH C,
and therefore, it should serve as one of several inputs to
the capital planning process. Given the scope of opera­
tions at and the associated breadth of risks facing large,
com plex BH Cs— including the risk of losses from exp o ­
sures and of reduced revenue generation— they are often
exposed to risks, other than credit or market risk, that are
either difficult to quantify or not directly attributable to
any of the specific integrated firm-wide scenarios that are
evaluated as part of the BHC's scenario-based stress test­
ing ("other risks"). Exam ples of these other risks include
reputational risk, strategic risk, and com pliance risk. As
noted in the section on risk identification, a BH C should
identify and assess all risks as part of its risk-identification
process and should capture the potential effect of all risks
in its capital planning process. A BHC's capital planning
process should assess the potential im pact of these other
risks on the BHC's capital position to ensure that its capital
provides a sufficient buffer against all risks to which the
BH C is exposed.
There is a wide range of practices around how BHCs
account for other risks as part of their capital planning
process. Many BH Cs used internal capital tar gets to
account for such risks, putting in place an incremental
cushion above their targets to allow for difficult-to-
quantify risks and the inherent uncertainty represented
by any forward-looking capital planning process. O ther
BH Cs assessed the effect of in term s of some combination
of reduced revenue, added expenses, or a m anagem ent
overlay on top of loss estim ates. BH Cs with lagging prac­
tices did not even attem pt to account for other risks in
their capital planning process.
To the extent possible, BHCs should incorporate the effect
of these other risks into their projections of net income
over the nine-quarter planning horizon. BH Cs should
clearly articulate and support any relevant assumptions
and the methods used to quantify the effect of other risks
on their revenue, expenses, or losses.
For those BHCs that did not incorporate the potential
impact of these other risks into their capital targets, stron­
ger practices included a clear articulation of which risks
were being addressed by putting in place a cushion above
the capital target, and how this cushion is related to identi­
fied risks. BH Cs should clearly support the method they
used to measure the potential effect of such risks. Using
a simple rule (such as a percent of capital) or expert ju d g ­
ments to determ ine the cushion above the capital target,
without providing analysis or support, is a lagging practice.
Chapter 14 Capital Planning at Large Bank Holding Companies
planning that are not scenario-based, it should identify which
risks each of the m ethodologies covers, to facilitate com parabil­
ity and informed decision-making with respect to overall capital
adequacy. BHCs with lagging practice did not transparently link
their evaluation of capital adequacy to the full range of identi­
fied risks. These BH Cs were not able to show how all their risks
were accounted for in their capital planning processes. In some
cases, staff responsible for capital planning operated in silos
and developed standalone risk inventories not linked to the
enterprise-wide risk inventory or to other risk governance func­
tions within their BH Cs.
14.3 IN T E R N A L C O N T R O L S
As with other aspects of key risk-management and finance area
functions, a BHC should have a strong internal control fram e­
work that helps govern its internal capital planning processes.
These controls should include (1) regular and com prehensive
review by internal audit; (2) robust and independent model
review and validation practices; (3) com prehensive docum enta­
tion, including policies and procedures; and (4) change controls.
Scope of Internal Controls
A BHC's internal control fram ework should address its entire
capital planning process, including the risk m easurem ent and
m anagem ent system s used to produce input data, the models
and other techniques used to generate loss and revenue esti­
m ates; the aggregation and reporting fram ework used to pro­
duce reports to m anagem ent and boards; and the process for
making capital adequacy decisions. W hile some BH Cs may natu­
rally develop com ponents of their internal capital planning along
separate business lines, the control fram ework should ensure
that BH C m anagem ent reconciles the separate com ponents in a
coherent manner. The control fram ework also should help assure
that all aspects of the capital planning process are functioning as
intended in support of robust assessm ents of capital needs.
BH Cs with stronger control coverage reviewed the controls
around capital planning on an integrated basis and applied
them consistently. M anagem ent responded quickly and
effectively to issues identified by control areas and devoted
appropriate resources to continually ensure that controls were
functioning effectively.
Internal Audit
Internal audit should play a key role in evaluating internal capital
planning and its various com ponents. Audit should perform a
review of the full process, not just of the individual com ponents,
■ 239
periodically to ensure that the entire end-to-end process is func­
tioning in accordance with supervisory expectations and with a
BHC's board of directors' expectations as detailed in approved
policies and procedures. Internal audit should review the man­
ner in which deficiencies are identified, tracked, and rem edi­
ated. Audit staff should have the appropriate com petence and
influence to identify and escalate key issues, and the internal
audit function should report regularly on the status of all aspects
of the capital planning process— including any identified defi­
ciencies related to the BHC's capital plan— to senior m anage­
ment and the board of directors.
BHCs with stronger audit practices provided a com prehensive,
robust review of all com ponents of the capital planning process,
including all of the control elem ents noted earlier.101BH Cs with
leading internal audit practices around internal capital planning
had strong issue identification and remediation tracking as well.
They also ensured that audit staff had strong technical expertise,
elevated stature in the organization, and proper independence
from m anagem ent.11
Independent Model Review
and Validation
BHCs should conduct independent review and validation of all
models used in internal capital planning, consistent with existing
supervisory guidance on model risk m anagem ent (SR Letter
11-7).12 Validation staff should have the necessary technical
com petencies, sufficient stature within the organization, and
appropriate independence from model developers and business
areas, so that they can provide a critical and unbiased evaluation
of the models they review.
• The model review and validation process should include
• an evaluation of conceptual soundness;
• ongoing monitoring that includes verification of processes
and benchm arking; and
• an "outcom es analysis."
BHCs should maintain an inventory of all models used in the cap­
ital planning process, including all input or "feed er" models that
10 See 1 2 C F R 225.8(d)(1)(iii).
11 See SR Letter 13-1, "Supplem ental Policy Statem ent on the Internal
A udit Function and Its O utsourcing," (January 23, 2013) www.feder-
alrserve.gov/bankinforeg/srletters/sr1301.htm , for detailed guidance
on expectations for the governance and operational effectiveness of an
institution's internal audit function.
12 See SR Letter 11-7, "Supervisory G uidance on Model Risk M anage­
m ent," (April 4, 2011), w w w .federalreserve.gov/bankinforeg/srletters/
sr1 107.htm .
240 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
produce projections or estimates used by the models that gener­
ate the final loss, revenue or expense projections. Consideration
should be given to the validity of the use of a model under
stressed conditions as models designed for ongoing business
activities may be inappropriate for estimating net income and
capital under stress conditions. BH Cs should also maintain a pro­
cess to incorporate well-supported adjustments to model esti­
mates when model weaknesses and uncertainties are identified.
BH Cs continue to face challenges in conducting outcomes
analysis of their stress testing m odels, given limited realized
outcom es against which to assess loss, revenue, or expense pro­
jections under stressful scenarios. BH Cs should attem pt to com ­
pensate for the challenges inherent in backtesting stress models
by conducting sensitivity analysis or by using benchm ark or
"challenger" m odels. BH Cs should ensure that validation covers
all models and assumptions used for capital planning purposes,
including any adjustments m anagem ent has made to the model
estim ates (m anagem ent overlay).
Supervisory reviews have found that, in general, BH Cs should
give more attention to model risk m anagem ent, including
strengthening practices around model review and validation.
Nonetheless, some BHCs exhibited stronger practices in their
capital planning, including
• maintaining an updated inventory of all models used in the
process;
• ensuring that models had been validated for their intended
use; and
• being transparent about the validation status of all models
used for capital planning and appropriately addressing any
models that had not been validated (or those that had identi­
fied weaknesses) by restricting their use, or using benchmark
or challenger models to help assess the reasonableness of
the primary model output.
BH Cs with lagging practices were not able to identify all m od­
els used in the capital planning process. They also did not for­
mally review all of the models or assumptions used for capital
planning purposes (including some high-impact stress testing
models). In addition, they did not have validation staff that were
independent and that could critically evaluate the models.
Policies and Procedures
BH Cs should ensure they have policies and procedures covering
the entire capital planning p ro cess.13 Policies and procedures
should ensure a consistent and repeatable process for all
A Q
See FR Y-14A reporting form : Summary Schedule Instructions, pp. 5-7.
com ponents of the capital planning process and provide trans­
parency to third parties regarding this process. Policies should
be reviewed and updated at least annually and more frequently
when warranted. There should also be evidence that m anage­
ment and staff are adhering to policies and procedures in prac­
tice, and there should be a formal process for any policy
exceptions. Such exceptions should be rare and approved by
the appropriate level of m anagem ent.
Ensuring Integrity of Results
BH Cs should have internal controls that ensure the integrity of
reported results and the docum entation, review, and approval
of all material changes to the capital planning process and its
com ponents. A BH C should ensure that such controls exist at all
levels of the capital planning process. Specific controls should
be in place to
• ensure that MIS are sufficiently robust to support capital
analysis and decision-m aking, with sufficient flexibility to run
ad hoc analysis as needed;
• provide for reconciliation and data integrity processes for all
key reports;
• address the presentation of aggregate, enterprise-wide
capital planning results, which should describe any manual
adjustm ents made in the aggregation process and how those
adjustm ents com pensate for identified w eaknesses; and
• ensure that reports provided to senior m anagem ent and the
board contain the appropriate level of detail and are accurate
and tim ely. The party responsible for this reporting should
assess and report whether the BHC is in com pliance with its
internal capital goals and targets, and ensure the rationale for
any deviations from stated capital objectives is clearly docu­
mented and obtain any necessary approvals.14
BH Cs with stronger practices in this area ensured that good
information flows existed to support decisions, with significant
investm ent in controls for data and information. For exam ple,
some BHCs had an internal audit group review the data for
accuracy and ensured that any data reported to the board
and senior m anagem ent were given extra scrutiny and cross­
checking. In addition, BHCs with stronger practices had strong
MIS in place that enabled them to collect, synthesize, analyze,
and deliver information quickly and efficiently. These systems
also had the ability to run ad hoc analysis to support capital
planning as needed without employing substantial resources.
O ther BH Cs, however, continue to face challenges with MIS.
14 See id.
Chapter 14 Capital Planning at Large Bank Holding Companies
Many BH Cs have systems that are antiquated and/or siloed and
not fully com patible, requiring substantial human intervention to
reconcile across systems.
Documentation
BH Cs should have clear and com prehensive docum entation for
all aspects of their capital planning processes, including their
risk-measurement and risk-management infrastructure, loss- and
resource-estimation m ethodologies, the process for making cap­
ital decisions, and efficacy of control and governance func­
tio n s.15 Docum entation should contain sufficient detail,
accurately describe BH Cs' practices, allow for review and chal­
lenge, and provide relevant information to decision-m akers.16
1 4 .4 G O V E R N A N C E
BH Cs should have strong board and senior m anagem ent over­
sight of their capital planning p rocesses.171
8This includes ensur­
ing periodic review of the BHC's risk infrastructure and loss- and
resource-estimation m ethodologies; evaluation of capital goals
and targets; assessm ent of the appropriateness of stress scenar­
ios considered; regular review of any limitations in key processes
supporting internal capital planning, such as uncertainty around
estim ates; and approval of capital decisions. Together, a BHC's
board and senior m anagem ent should establish a com prehen­
sive capital planning process that fits into broader risk-manage­
ment processes and that is consistent with the risk-appetite
fram ework and the strategic direction of the BH C.
Board of Directors
A BHC's board of directors has ultimate oversight responsibility
and accountability for capital planning and should be in a posi­
tion to make informed decisions on capital adequacy and capital
1O
actions, including capital distributions. The board of directors
should receive sufficient information to understand the BHC's
material risks and exposures and to inform and support its deci­
sions on capital adequacy and planning. The board should
receive this information at least quarterly, or when there are
material developm ents that affect capital adequacy or the man­
ner in which it is assessed. Capital adequacy information
15 See id.
16 See id.
17 See 12 C FR 225.8(d)(1)(iii)(A)-(B).
18 See 12 C FR 225.8(d)(1)(iii)(C).
■ 241
provided to the board should include capital measures under
current conditions as well as on a post-stress, pro forma basis
and should be fram ed against the capital goals and targets
established by the BH C.
The information provided to the board should include sufficient
details on scenarios used for the BHC's internal capital plan­
ning so that the board can evaluate the appropriateness of the
scenarios, given the current econom ic outlook and the BHC's
current risk profile, business activities, and strategic direction.
The information should also include a discussion of key limita­
tions, assumptions, and uncertainties within the capital planning
process, so that the board is fully informed of any weaknesses
in the process and can effectively challenge reported results
before making capital decisions. The board should also receive
summary information about mitigation strategies to address key
limitations and take action when weaknesses in internal capital
planning are identified, applying additional caution and conser­
vatism as needed.
BHCs with stronger practices had boards that were informed of
and generally understood the risks, exposures, activities, and
vulnerabilities that affected the BHC's capital adequacy. They
also understood the major drivers of loss and revenue changes
under the scenarios used. The boards of BHCs with stronger
practices had sufficient expertise and level of engagem ent
to understand and critically evaluate information provided by
senior m anagem ent. Importantly, they recognized that internal
capital planning results are estim ates and should be viewed as
part of a range of possible results. In addition, the boards of
BHCs with stronger practices discussed weaknesses identified
in the capital planning process, whether they needed to take
immediate action to address those w eaknesses, and whether the
weaknesses were material enough to alter their view of current
capital planning results. They also discussed whether a sufficient
range of potential stress events and conditions had been con­
sidered in assessing capital adequacy.
Board Reporting
The board of directors is required to approve a BHC's capital
plan under the Capital Plan Rule.19 In order for boards to carry
out this requirem ent, m anagem ent should provide adequate
reporting on key areas of the analysis supporting capital plans.
BHCs with stronger practices included information about the
independent review and validation of m odels, information on
issues identified by internal audit, as well as key assumptions
underpinning stress test results and a discussion of the sensitiv­
ity of capital levels to those assumptions. BH Cs with stronger
19 Id.
242 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
practices also supplied their boards with information about past
capital planning perform ance to provide a perspective on how
the capital planning process has functioned over time.
BH Cs with w eaker practices provided insufficient information
to the board of directors. For exam ple, at some BH Cs, capital
distribution recom m endations did not include all relevant sup­
porting information and appeared to be based on optim istic
expectations about how a given scenario may affect the BH C.
In addition, the information did not specifically identify and
address key assumptions that supported the capital planning
process. In other cases, the board of directors did not receive
information about governance and controls over internal capital
planning, making it difficult to assess the strength of its
capital planning processes and whether results were reliable
and credible.
Senior Management
Senior m anagem ent is responsible for ensuring that capital plan­
ning activities authorized by the board are im plem ented in a sat­
isfactory manner and is accountable to the board for the
effectiveness of those activities. Senior m anagem ent should
ensure that effective controls are in place around the capital
planning process— including ensuring that the BHC's stress sce­
narios are sufficiently severe and cover the material risks and
vulnerabilities facing the B H C .20
Senior m anagem ent should make informed recom m endations
to the board of directors about the BHC's capital, including
capital goals and distribution decisions. Senior m anagem ent
also should ensure that proposed capital goals have sufficient
analytical support and fully reflect the expectations of important
stakeholders, including creditors, counterparties, investors, and
supervisors. Senior m anagem ent should identify weaknesses and
potential limitations in the capital planning process and evaluate
them for materiality. In addition, it should develop remediation
plans for any weaknesses affecting the reliability of internal capi­
tal planning results. Both the specific identified limitations and
the remediation plans should be reported to the board.
Senior m anagem ent with stronger practices recognized
the imprecision and prevalence of uncertainty in predicting
future outcom es when reviewing information and results from
enterprise-wide scenario analysis. A t BH Cs with stronger prac­
tices, senior m anagem ent maintained an ongoing assessm ent of
all capital planning areas, identifying and clearly documenting
any weaknesses, assumptions, limitations, and uncertainties, and
did not consider a one-time assessm ent of the capital planning
20 12 C FR 225.8(d)(2)(i)(A)-(D).
process to be sufficient. Furtherm ore, m anagem ent developed
clear remediation plans with specific tim elines for resolving
identified w eaknesses. In some cases, based on its review of
the full capital planning process, senior m anagem ent made
more cautious or conservative adjustm ents to the capital plan,
such as recommending less aggressive capital actions. M anage­
ment also included key assumptions and process weaknesses in
reports and specifically pointed them out to the board, in some
cases providing analysis showing the sensitivity of capital to
alternative outcom es.
Documenting Decisions
BH Cs should docum ent decisions about capital adequacy and
capital actions taken by the board of directors and senior man­
agem ent, and describe the information used to reach those
decisions.21 Final decisions regarding capital planning of the
board or of a designated com m ittee thereof should be recorded
and retained in accordance with the company's policies and
procedures.
BH Cs with stronger docum entation practices had board minutes
that described how decisions were made and what inform a­
tion was used. Some docum entation provided evidence that
the board challenged results and recom m endations, including
reviewing and assessing how senior m anagem ent challenged
the same information. BH Cs with w eaker docum entation prac­
tices had board minutes that were very brief and opaque, with
little reference to information used by the board to make its
decisions. Some BH Cs did not form ally docum ent key decisions.
14.5 CAPITAL PO LICY
As noted earlier, a capital policy is the principles and guidelines
used by a BH C for capital planning, capital issuance, and usage
and distributions. A capital policy should include internal capital
goals; quantitative or qualitative guidelines for dividends and
stock repurchases; strategies for addressing potential capital
shortfalls; and internal governance procedures around capital
policy principles and guidelines.22 The capital policy, as a com ­
ponent of a capital plan, must be approved by the BH C's board
of directors or a designated com m ittee of the board.23 It
should be a distinct, com prehensive written docum ent that
addresses the major com ponents of the BHC's capital planning
21 See FR Y-14A reporting form : Sum m ary Schedule Instructions, p. 6.
22 12 C FR 225.8(c)(4).
23 See 12 C FR 225.8(d)(1)(iii)(C), 225.8(d)(2)(iii).
Chapter 14 Capital Planning at Large Bank Holding Companies
processes and links to and is supported by other policies (risk-
m anagem ent, stress testing, model governance, audit, and oth­
ers). A capital policy should provide details on how a BH C
m anages, m onitors, and makes decisions regarding all aspects
of capital planning. The policy should also address roles and
responsibilities of decision-m akers, process and data controls,
and validation standards. Finally, the capital policy should
explicitly lay out expectations for the information included in
the BHC's capital plan.
A capital policy should describe targets for the level and com po­
sition of capital and provide clarity about the BHC's objectives
in managing its capital position. The policy should explain how
the BHC's capital planning practices align with the im perative of
maintaining a strong capital position and being able to continue
to operate through periods of severe stress. It should include
quantitative metrics such as common stock dividend (and other)
payout ratios as maximums or targets for capital distributions.
The policy should include an explanation of how m anagem ent
concluded that these ratios are appropriate, sustainable, and
consistent with its capital objectives, business model, and capital
plan. It should also specify the capital metrics that senior man­
agem ent and the board use to make capital decisions. In addi­
tion, a capital policy should include governance and escalation
protocols that are clear, credible, and actionable in the event an
actual or projected capital ratio target is breached.
The policy should describe processes surrounding how common
stock dividend and repurchase decisions are made and how the
BHC arrives at its planned capital distribution amounts. Specifi­
cally, the policy should discuss the following:
• the main factors and key metrics that influence the size, tim ­
ing, and form of capital distributions
• the analytical materials used in making capital distribution
decisions (e.g ., reports, earnings, stress test results, and
others)
• specific circum stances that would cause the BH C to reduce
or suspend a dividend or stock repurchase program
• factors the BHC would consider if contem plating the replace­
ment of common equity with other forms of capital
• key roles and responsibilities, including the individuals or
groups responsible for producing the analytical material ref­
erenced above, reviewing the analysis, making capital distri­
bution recom m endations, and making the ultimate decisions
BH Cs should establish a minimum frequency (at least annually)
and other triggers for when its capital policy is reevaluated and
ensure that these triggers remain relevant and current. The
capital policy should be reevaluated and revised as necessary to
address changes to organizational structure, governance struc­
ture, business strategy, capital goals, regulatory environment,
■ 243
risk appetite, and other factors potentially affecting a BHC's
capital adequacy. BH Cs should develop a formal process for
approvals, change m anagem ent, and docum entation retention
relating to their capital policies.
W eak capital policies were typically characterized by a limited
scope. They only addressed parts of the capital planning pro­
cess, did not provide sufficient detail to convey clearly how
capital action decisions will be m ade, were not well integrated
with or supported by other risk and finance policies, and/or did
not contain all of the elem ents described above (e.g ., clearly
defined capital goals, guidelines for capital distributions and
capital com position, etc.). In some cases, the capital policy
was overly generic and not tailored to the BHC's unique
circum stances. For exam ple, the policy appeared to be restat­
ing supervisory expectations without concrete exam ples or
BHC-specific considerations. In other cases, the more detailed
procedures were not presented to the board, thus limiting the
board's ability to understand the analysis underlying its capital
planning decisions.
Capital Goals and Targets
BHCs should establish capital goals aligned with their risk ap p e­
tites and risk profiles as well as expectations of internal and
external stakeholders, providing specific goals for the level and
composition of capital, both current and under stressed condi­
tions. Internal capital goals should be sufficient to allow a BHC
to continue its operations during and after the impact of stress­
ful conditions. As such, capital goals should reflect current and
future regulatory capital requirem ents, as well as the exp ecta­
tions of shareholders, rating agencies, counterparties, creditors,
supervisors, and other stakeholders.
BHCs should also establish capital targets above their capital
goals to ensure that capital levels will not fall below the goals
during periods of stress. Capital targets should take into consid­
eration forward-looking elem ents related to the econom ic out­
look, the BHC's financial condition, the potential im pact of stress
events, and the uncertainty inherent in the capital planning pro­
cess. The goals and targets should be specified in the capital
policy and reviewed and approved by the board.24
In developing their capital goals and targets, particularly with
regard to setting the levels of capital distributions, BH Cs should
explicitly take into account general econom ic conditions and
their plans to grow their on- and off-balance-sheet size and risks
organically or through acquisitions. BH Cs should consider the
impact of external conditions during both normal and stressed
24 12 C FR 225.8(c)(4).
244 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
econom ic and market environments and other factors on their
overall capital adequacy and ability to raise additional capital,
including the potential impact of contingent exposures and
broader market or system ic events, which could cause risk to
increase beyond the BHC's chosen risk-tolerance level. BHCs
should have contingency plans for such outcom es.
Additionally, BH Cs should calculate and use several capital
measures that represent both leverage and risk, including
quarterly estim ates of regulatory capital ratios (including tier 1
common ratio) under both baseline and stress conditions. BHCs
with w eaker practices in this area did not clearly link decisions
regarding capital distributions to capital adequacy metrics or
internal capital goals.
W eak practices observed in this area included establishing capi­
tal goals based solely on regulatory minimums and the ratios
required to be considered well-capitalized without consideration
of a BHC's specific capital needs given its risk profile, financial
condition, business model and strategies, overall com plexity, and
sensitivity to changing conditions. Some BHCs did not recognize
uncertainties and limitations in capturing all potential sources of
loss and in projecting loss and revenue estim ates, which reduced
the BHCs' ability to establish effective capital goals and targets.
O ther BHCs were not transparent about how they determined
the capital goals and targets in their capital policies.
Capital Contingency Plan
BHCs should outline in their capital policies specific capital con­
tingency actions they would consider to remedy any current or
prospective deficiencies in their capital position.25 In particular, a
BHC's policy should include a detailed explanation of the
circumstances— including deterioration in the economic environ­
ment, market conditions, or the financial condition of the BH C—
in which it will reduce or suspend a dividend or repurchase
program or not execute a previously planned capital action. The
policy also should define a set of capital triggers and events that
would correspond with these circumstances. These triggers
should be established for both baseline and stress scenarios and
measured against the BHC's capital targets in those scenarios.
These triggers and events should be used to guide the frequency
with which board and senior management will revisit planned
capital actions as well as review and act on contingency capital
plans. The capital contingency plan should be reviewed and
updated as conditions warrant, such as where there are material
changes to the BHC's organizational structure or strategic direc­
tion or to capital structure, credit quality, and/or market access.
25 Id.
Capital triggers should provide an "early w arning" of capital
deterioration and should be part of a m anagem ent decision­
making fram ework, which should include target ranges for a
normal operating environment and threshold levels that trig­
ger m anagem ent action. Such action should include escalation
to the board, potential suspension of capital actions, and/or
activation of a capital contingency plan. Triggers should also be
established for other metrics and events that measure or affect
the financial condition or perceived financial condition of the
firm— for exam ple, liquidity, earnings, debt and credit default
swap spreads, ratings downgrades, stock perform ance, supervi­
sory actions, or general market stress.
Contingency actions should be flexible enough to work in a
variety of situations and be realistic for what is achievable during
periods of stress. The capital plan should be prepared recogniz­
ing that certain capital-raising and capital-preserving activities
may not be feasible or effective during periods of stress. BHCs
should have an understanding of market capacity constraints
when evaluating potential capital actions that require accessing
capital m arkets, including debt or equity issuance and also con­
tem plated asset sales. Contingency actions should be ranked
according to ease of execution and their impact and should
incorporate the assessm ent of stakeholder reactions (e.g.,
im pacts on future capital-raising activities).
W eak capital contingency plans provided few options to address
contingency situations and/or did not consider the feasibility of
options under stressful conditions. Plans with overly optim istic
assumptions or excessive reliance on past history (in term s of
both possible contingency situations and options to address
those situations) were also considered w eak, as were plans that
lacked support for the feasibility and availability of possible
contingency actions. O ther w eak practices included establishing
triggers based on actual results but not on projected results, or
based on minimum regulatory capital ratios only with no con­
sideration of the expectations of other stakeholders including
counterparties, creditors and investors, or of other metrics or
market indicators.
1 4 .6 B H C S C E N A R IO D E S IG N
Under the Capital Plan Rule, a BH C is required to use a BHC-
developed stressed scenario that is appropriate for its business
model and portfolios.26 Accordingly, BH Cs should have a pro­
cess for designing scenarios for enterprise-wide scenario analy­
sis that reflects the BHC's unique business activities and
associated vulnerabilities.
26 12 C FR 225.8(d)(2)(i)(A).
Chapter 14 Capital Planning at Large Bank Holding Companies
The range of observed practice for developing BHC stress sce­
narios was broad. Some BH Cs designed stress scenarios using
internal models and expertise. O ther BH Cs used vendor-defined
m acroeconom ic scenarios or used vendor models to define
customized m acroeconom ic scenarios. For BHCs with internally
developed scenarios, those with stronger scenario-design prac­
tices used internal models in combination with expert judgm ent
rather than relying solely on either models or expert judgm ent
to define scenario conditions and variables. Among BH Cs that
used third-party scenarios, those with stronger practices tai­
lored third-party-defined scenarios to their own risk profiles and
unique vulnerabilities.
Regardless of the method used to develop the scenario, BHCs
should have a scenario-selection process that engages a broad
range of internal stakeholders such as risk experts, business man­
agers, and senior management. Although they are required to sub­
mit only one BHC stress scenario for C C A R, BHCs should develop
a suite of scenarios that collectively capture their material risks and
vulnerabilities under a variety of stressful circumstances and should
incorporate them into their overall capital planning processes.
Scenario Design and Severity
As indicated in the preamble to the Capital Plan Rule, "the bank
holding company-designed stress scenario should reflect an indi­
vidual company's unique vulnerabilities to factors that affect its
firm-wide activities and risk exposures, including macroeconomic,
market-wide, and firm-specific even ts."27 Thus, BHC stress sce­
narios should reflect macroeconomic and financial conditions that
are tailored specifically to stress a BHC's key vulnerabilities and
idiosyncratic risks, based on factors such as its particular business
model, mix of assets and liabilities, geographic footprint, portfo­
lio characteristics, and revenue drivers. A BHC stress scenario
that simply features a generic weakening of macroeconomic con­
ditions similar in magnitude to the supervisory severely adverse
scenario does not meet these expectations.
BH Cs with stronger scenario-design practices clearly and
creatively tailored their BH C stress scenarios to their unique
business-model features, emphasizing im portant sources of risk
not captured in the supervisory severely adverse scenario. Exam ­
ples of such risks observed in practice included a significant
counterparty default; a natural disaster or other operational-risk
event; and a more acute stress on a particular region, industry,
and/or asset class as com pared to the stress applied to gen­
eral m acroeconom ic conditions in the supervisory adverse and
severely adverse scenarios.
27 See 77 Fed . R eg. 74631, 74636 (D ecem ber 1, 2011).
■ 245
A t the same tim e, BH C stress scenarios should not feature
assumptions that specifically benefit the BH C. For exam ple,
some BH Cs with w eaker scenario-design practices assumed that
they would be viewed as strong com pared to their com petitors
in a stress scenario and would therefore experience increased
market share. Such assumptions are contrary to the supervisory
expectations for and the intent of a stress testing exercise that
informs capital planning.
W hile a broad-based recession adversely affects a wide range of
most BH Cs' business activities, BH Cs may have business m od­
els or im portant business activities that generate vulnerabili­
ties that are not particularly well captured by scenario analysis
based on a stressed m acroeconom ic environment (or for which
even a severe recession is not the primary source of potential
vulnerability). These BH Cs should incorporate into their stress
scenarios elem ents that address the key revenue vulnerabilities
and sources of loss for their specific businesses and activities.
In com bination, the recession incorporated into the BH C stress
scenario and any additional elem ents intended to address sp e­
cific businesses or activities should result in a substantial stress
for the organization, including a significant reduction in capital
ratios relative to baseline projections. However, a BH C stress
scenario that produces post-stress capital ratios lower than
those under the supervisory severely adverse scenario is not,
in and of itself, a safe harbor. The stress scenario included in a
BHC's capital plan should place substantial strains on its abil­
ity to generate revenue and absorb losses, consistent with its
unique risks and vulnerabilities.
Variable Coverage
The set of variables that a BHC includes in its stress scenario
should be sufficient to address all material risks arising from its
exposures and business activities. A business line could face
significant stress from multiple sources, requiring more than one
risk factor or m acroeconom ic variable. The scenario should gen­
erally contain the relevant variables to facilitate pro forma finan­
cial projections that capture the impact of changing conditions
and environm ents. BHCs should have a consistent process for
determining the final set of variables and provide this rationale
as part of the scenario narrative.
O verall, BH Cs with stronger scenario-design practices gener­
ated scenarios in which the link between the variables included
in the scenario and sources of risk to the BHC's financial outlook
were transparent and straightforward. Clear narratives helped
make these links more transparent. BH Cs with w eaker scenario-
design practices developed stress scenarios that excluded
some variables relevant to the BHC's risk profile and idiosyn­
cratic vulnerabilities. For exam ple, some BH Cs with significant
246 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
trading activities and revenues included a limited set of relevant
financial variables. O ther BH Cs with significant regional and/or
industry concentrations did not include relevant geographic or
industry variables.
Clear Narratives
The scenario should be supported by a clear narrative describ­
ing how the scenario addresses the particular vulnerabilities
and material risks facing the BH C. BH Cs with stronger scenario-
design practices provided narratives describing how the sce­
nario variables related to the risks faced by a BHC's significant
business lines and, in some cases, how the scenario variables
corresponded to variables in the BHC's internal risk-manage­
ment models. The narratives also provided explanations of how
a scenario stressed a BHC's unique vulnerabilities specific to
its business model and how the paths of the scenario variables
related to each other in an econom ically intuitive way. W eaker
practices included scenario narratives that did not provide any
context for the variable paths as well as scenario narratives that
described features that were not reflected in any variables con­
sidered in a BHC's internal capital planning.
14.7 ESTIMATION M ETH O D O LO GIES
FO R LO SSES, REVEN U ES, AND
EX PEN SES
A BHC's capital plan must include estim ates of projected reve­
nues, expenses, losses, reserves, and pro forma capital levels,
including any minimum regulatory capital ratios, the tier 1 com ­
mon ratio and any additional capital measures deem ed relevant
by the BH C, over the planning horizon under expected condi-
o n
tions and under a range of stressed scenarios.
General Expectations
Projections of losses, revenues, and expenses under hypotheti­
cal stressed conditions serve as the fundamental building blocks
of the pro forma financial analysis supporting enterprise-wide
scenario analysis. BH Cs should have stress testing m ethod­
ologies that generate credible estim ates that are consistent
with assumed scenario conditions. It is im portant for BH Cs to
understand the uncertainties around their estim ates, including
the sensitivity of the estim ates to changes in inputs and key
assumptions. O verall, BH Cs' estim ates of losses, revenues, and
expenses under each of the scenarios should be supported by2
8
28 1 2 C F R 225.8(d)(1).
em pirical evidence, and the entire estimation process should
be transparent and repeatable. The Federal Reserve generally
expects BH Cs to use models or other quantitative methods as
the basis for their estim ates; however, there may be instances
where a m anagem ent overlay or other qualitative approaches
may be appropriate due to data limitations, new products or
businesses, or other factors. In such instances, BH Cs should
ensure that such processes are well supported, transparent, and
repeatable over tim e.
Establishing a Quantitative Basis
for Enterprise-Wide Scenario Analysis
G enerally, BH Cs should develop and use internal data to esti­
mate losses, revenues, and expenses as part of enterprise-wide
scenario analysis.29 However, in certain instances, it may be
more appropriate for BH Cs to use external data to make their
models more robust. For exam ple, BH Cs may lack sufficient, rel­
evant historical data due to factors such as system s limitations,
acquisitions, or new products. W hen using external data, BHCs
should take care to ensure that the external data reasonably
approxim ate underlying risk characteristics of their portfolios,
and make adjustm ents to modeled outputs to account for iden­
tified differences in risk characteristics and perform ance
reflected in internal and external data.
BH Cs can use a range of quantitative approaches to estim ate
losses, revenues, and expenses, depending on the type of port­
folio or activity for which the approach is used, the granularity
and length of available tim e series of data, and the materiality
of a given portfolio or activity. W hile the Federal Reserve does
not require BHCs to use a specific estimation m ethod, each BHC
should estim ate its losses, revenues, and expenses at sufficient
granularity so that it can identify common, key risk drivers and
capture the effect of changing conditions and environments.
For exam ple, loss models should be estim ated at a sufficiently
granular subportfolio or segm ent level so that they can capture
observed variations in risk characteristics and perform ance
across the subportfolios or segm ents and across tim e, and
account for changing exposure or portfolio characteristics over
the planning horizon.
W hile BH Cs often segm ent their portfolios and activities along
functional areas, such as by line of business or product type, the
leading practice is to determ ine segm ents based on common
risk characteristics (e.g ., credit score ranges or loan-to-value
ratio ranges) that exhibit meaningful differences in historical per­
form ance. The granularity of segm ents typically depends on the
29 BH Cs are required to collect and report a substantial amount of risk
information to the Federal Reserve on FR Y-14 schedules. These data
may help to support the BH C's enterprise-w ide scenario analysis.
Chapter 14 Capital Planning at Large Bank Holding Companies
type, size, and composition of the BHC's portfolio. For exam ple,
a more diverse portfolio— both in term s of borrower risk char­
acteristics and perform ance— would generally require a greater
number of segm ents to account for the heterogeneity of the
portfolio. However, when segm enting portfolios, it is important
to ensure that each risk segm ent has sufficient data observations
to produce reliable model estim ates.
As a general practice, BH Cs should separately estim ate losses,
revenues, or expenses for portfolios or business lines that are
sensitive to different risk drivers or sensitive to risk drivers in a
m arkedly different way. For instance, losses on commercial and
industrial loans and commercial real estate (CRE) loans are, in
part, driven by different factors, with the path of property values
having a more pronounced effect on C R E loan losses. Similarly,
although falling property value affects both income-producing
C R E loans and construction loans, the effect often differs m ate­
rially due to structural differences between the two portfolios.
Such differences can becom e more pronounced during periods
of stress. BHCs with leading practices have dem onstrated clearly
the rationale for selecting certain risk drivers over others. BHCs
with lagging practices used risk drivers that did not have a clear
link to results, either statistically or conceptually.
Many models used for stress testing require a significant number
of assumptions to im plem ent. Further, the relationship between
m acroeconom ic variables and losses, revenues, or expenses
could differ considerably in the hypothetical stress scenario from
what is observed historically. As a result, while traditional tools
for evaluating model perform ance (such as comparing projec­
tions to historical out-of-sample outcomes) are still useful, the
Federal Reserve expects BH Cs to supplem ent them with other
types of analysis. Sensitivity analysis is one tool that some BHCs
have used to test the robustness of models and to help model
developers, BH C m anagem ent, the board of directors, and
supervisors identify the assumptions and param eters that m ate­
rially affect outcom es. Sensitivity analysis can also help ensure
that core assumptions are clearly linked to outcom es. Using
results from different estimation approaches (challenger models)
as a benchm ark is another way BH Cs can gain greater comfort
around their primary model estim ates, as the strengths of one
approach could potentially com pensate for the weaknesses of
another. W hen using multiple approaches, however, it is impor­
tant that BH Cs have a consistent fram ework for evaluating the
results of different approaches and supporting rationale for why
they chose the methods and estim ates they ultimately used.
In certain instances, BH Cs may need to rely on third-party
models— for exam ple, due to limitations in internal modeling
capacity. In using these third-party models (vendor models or
consultant-developed models), BH Cs should ensure that their
internal staff have working knowledge and a good conceptual
■ 247
understanding of the design and functioning of the models and
potential model limitations so that m anagem ent can clearly
communicate them to those governing the process. An off-the-
shelf vendor model often requires some level of firm-specific
analysis and customization to dem onstrate that it produces esti­
mates appropriate for the BHC and consistent with scenario
conditions. Sensitivity analysis can be particularly helpful in
understanding the range of possible results of vendor models
with less transparent or proprietary elem ents. Importantly, all
vendor and consultant-developed models should be validated in
or\
accordance with SR 11-7 guidelines.
Some BHCs generated annual projections for certain loss, rev­
enue, or expense items and then evenly distributed them over
the four quarters of each year. This practice does not reflect a
careful estim ate of the expected quarterly path of losses, net
revenue, and capital, and thus is only acceptable when a BHC
can clearly dem onstrate that the projected item is highly uncer­
tain and the practice likely results in a conservative estim ate.
Qualitative Projections, Expert Judgment,
and Adjustments
W hile quantitative approaches are im portant elem ents of
enterprise-w ide scenario analysis, BH Cs should not rely on
w eak or poorly specified m odels sim ply to have a m odeled
approach. In fact, most BH Cs use some form s of exp ert ju d g ­
ment for some purposes— generally as a m anagem ent adjust­
ment overlay to m odeled outputs. And BH Cs can, in limited
cases, use exp ert judgm ent as the prim ary method to produce
an estim ate of losses, revenue, or expenses. BH Cs may use a
m anagem ent overlay to account for the unique risks of certain
portfolios that are not well captured in their m odels, or oth­
erwise to com pensate for specific model and data limitations.
Material changes in BH Cs' businesses or lim itations in relevant
data may lead som e BH Cs to rely wholly on exp ert judgm ent
for certain loss, revenue, or expense projections. In using
exp ert judgm ent, BH Cs should ensure that they have a trans­
parent and repeatable process, that m anagem ent judgm ents
are well supported, and that key assum ptions are consistent
with assum ed scenario conditions.
As with quantitative methods, the assumptions and processes
that support qualitative approaches should be clearly docu­
mented so that an external reviewer can follow the logic and
evaluate the reasonableness of the outcom es.3
31 Any potential
0 cannot be reasonably assured to occur in stressed environments
30 See SR Letter 11-7, "Supervisory G uidance on Model Risk M anage­
m ent," (April 4, 2011), w w w .federalreserve.gov/bankinforeg/srletters/
sr1 107.htm .
See FR Y-14A reporting form : Summary Schedule Instructions, pp. 5-6.
248 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
shortcomings should be investigated and com m unicated to
decision-m akers. In addition, any m anagem ent overlay or quali­
tatively derived projections should be subject to effective review
and challenge. BH Cs should evaluate a range of potential esti­
mates and conduct sensitivity analysis for key assumptions used
in the estimation process. For exam ple, if a BHC makes exten­
sive adjustm ents to its modeled estim ates of losses, revenue,
and expenses, the impact of such adjustm ents should be quanti­
fied relative to unadjusted estim ates, and these results should
be docum ented and made available to BH C m anagem ent and
the board of directors. Finally, extensive use of m anagem ent
judgm ent to adjust m odeled estim ates should trigger review
and discussion as to whether new or improved modeling
approaches are needed. In reporting to the board of directors,
m anagem ent should always provide both the initial results and
the results after any judgm ental adjustm ents.
Conservatism and Credibility
Given the uncertainty inherent in a forward-looking capital plan­
ning exercise, the Federal Reserve expects BHCs to apply gen­
erally conservative assumptions throughout the stress testing
process to ensure appropriate tests of the BH Cs' resilience to
stressful conditions. In particular, BHCs should ensure that m od­
els are developed using data that contain sufficiently adverse
outcom es. If a BHC experienced better-than-average perfor­
mance during previous periods of stress, it should not assume
that those prior patterns will remain unchanged in the stress
scenario. BH Cs should carefully review the applicability of key
assumptions and critically assess how historically observed pat­
terns may change in unfavorable ways during a period of severe
stress for the econom y, the financial m arkets, and the BH C.
In the context of C C A R loss and revenue estim ates, BHCs
should generally include all applicable loss events in their analy­
sis, unless a BH C no longer engages in a line of business or its
activities have changed such that the BH C is no longer exposed
to a particular risk. BHCs should not selectively exclude losses
based on arguments that the nature of the ongoing business or
activity has changed— for exam ple, because certain loans were
underwritten to standards that no longer apply or were acquired
and, therefore, differ from those that would have been origi­
nated by the acquiring institution.
Similarly, BH Cs should not rely on favorable assumptions that
given the high level of uncertainty around market conditions.
BH Cs should also not assume any foresight of scenario condi­
tions over the projection horizon beyond what would reasonably
be knowable in real-life situations. For exam ple, some BHCs
have used the path of stress scenario variables to make optim is­
tic assumptions about possible m anagem ent actions ex ante in
anticipation of stressful conditions, such as preem ptively rebal­
ancing their portfolios or otherwise adjusting their risk profiles
to mitigate the expected im pact. In the event of a downturn,
the future path or progression of econom ic and market condi­
tions would not be clearly known, and this uncertainty should be
reflected in the capital plans.
Documentation of Estimation Practices
The Federal Reserve exp ects BH Cs to clearly docum ent their
key m ethodologies and assum ptions used to estim ate losses,
revenues, and e xp e n se s.323BH Cs with stronger practices pro­
vided docum entation that concisely explained m ethodologies,
with relevant m acroeconom ic or other risk drivers, and dem on­
strated relationships betw een these drivers and estim ates.
Docum entation should clearly delineate among model out­
puts, qualitative overlays to model outputs, and purely qualita-
tive estim ates. BH Cs with w eaker practices often had limited
docum entation that was poorly organized and that relied
heavily on subjective m anagem ent judgm ent for key model
inputs with lim ited em pirical support for and docum entation of
these adjustm ents.
Loss-Estimation Methodologies
As noted earlier, a BHC's internal stress testing processes should
be designed to capture risks inherent in its own exposures and
business activities. Consistent with any good modeling prac­
tices, when developing loss-estimation m ethodologies, BHCs
should first determ ine w hether there is a sound theoretical basis
for m acroeconom ic and other explanatory variables (risk drivers)
used to estim ate losses, and then em pirically dem onstrate that
a strong relationship exists between those variables and losses.
For exam ple, most BH Cs' residential-m ortgage loss models
used some measure of unem ploym ent and a house price index
as explanatory variables, which affect a borrower's ability and
incentive to repay.
Beyond the core set of macroeconomic variables that typically
represents a given scenario, such as gross dom estic products
(GDP), unemployment rate, Treasury yields, credit spreads, and
various price indices, BH Cs often project additional variables
that have a more direct link to particular portfolios or exposures.
Some exam ples of these variables include regional macro-
econom ic variables that better capture the BHC's geographic
exposures and sector-specific variables, such as office vacancy
rates and corporate profits. Using these additional variables to
estim ate the model can enhance the sensitivity of loss estimates
32 See id.
33 See id.
Chapter 14 Capital Planning at Large Bank Holding Companies
to a given scenario and also improve the overall fit of the model.
Any models used to produce additional risk drivers are key com ­
ponents of the loss-estimation process and, therefore, should be
included in BHCs' model inventories and receive the same model
risk-management treatm ent as core loss-estimation models.
Generally, BHCs sum up losses from various portfolios and
activities to produce aggregate losses for the enterprise-wide
scenario analysis. BHCs should have a repeatable process to
aggregate losses, particularly when they transform model esti­
mates to combine disparate risk measures (such as accounting-
based and econom ic loss concepts), different m easurem ent
horizons, or otherwise dissimilar loss estim ates.
BH Cs with leading practices used automated processes that
showed a clear audit trail from source data to loss estimation
and aggregation, with full reconcilem ent to source systems and
regulatory reports and mechanisms requiring approval and log­
ging of judgm ental adjustm ents and overrides. These systems
often leveraged existing enterprise-wide financial and regulatory
consolidation processes.
BH Cs with lagging practices exhibited a high degree of manual
intervention in the aggregation process, and applied aggregate-
level m anagem ent adjustm ents that were not transparent or
well supported.
Retail and Wholesale Credit Risk
BH Cs used a range of approaches to produce loss estim ates
on loans to retail and corporate custom ers, often using differ­
ent estimation methods for different portfolios. This section
describes the observed range of practice for the methods used
to project losses on retail and wholesale loan portfolios.
Data and Segmentation
Sources of data used for loss estimation have often differed
between retail and wholesale portfolios. Due to availability
of a richer set of retail loss data, particularly from the most
recent downturn, BH Cs generally used internal data to estim ate
defaults or losses on retail portfolios and only infrequently used
external data with longer history to benchm ark estim ated losses
on portfolios that had more limited loss experience in the recent
downturn. For wholesale portfolios, some BH Cs supplem ented
internal data with external data or used external data to cali­
brate their models due to a short time series (5-10 years) that
included only a single downturn cycle.
BH Cs with stronger practices accounted for dynamic changes
in their portfolios, such as loan m odifications or changes in
portfolio risk characteristics, and made appropriate adjustments
to data or estim ates to com pensate for known data limitations
(including lack of historical periods of stress).
■ 249
BHCs with w eaker practices failed to com pensate for data limi­
tations or adequately dem onstrate that external data reasonably
reflect the BHC's actual exposures, often failing to capture geo­
graphic, industry, or lending-type concentrations.
The level of segm entation used for modeling varied depending
on the type and size of portfolio and estimation methods used.
For exam ple, BH Cs often segm ented the retail portfolio based
on some com binations of product; lien position; risk characteris­
tics such as credit score, loan-to-value ratio, and collateral; and
underlying collateral information (e.g ., single-family home ver­
sus condominium), though some models were estim ated at the
loan-level and others at the portfolio level.
BHCs with stronger practices had segm entation schem es that
were well supported by the BHC's data and analysis, with suf­
ficient granularity to capture exposures that react differently to
risk drivers under stressed conditions.
BHCs with w eaker practices used a single model for multiple
portfolios, without sufficiently adjusting modeling assumptions
to capture the unique risk drivers of each portfolio. For exam ple,
in estimating losses on wholesale portfolios, these BH Cs did not
adequately allow for variation in loss rates commonly attributed
to industry, obligor type, collateral, lien position, or other rel­
evant information.
Common Credit Loan Loss-Estimation Approaches
BHCs have used a wide range of methods to estimate credit
losses, depending on the type and size of portfolios and
data availability. These methods can be based on either an
accounting-based loss approach (that is, charge-off and recovery)
or an economic loss approach (that is, expected losses). BHCs
have flexibility in selecting a specific loss or estimation approach;
however, it is important for BHCs to understand differences
between the two loss approaches, particularly in terms of the tim ­
ing of loss recognition, and to account for the differences in set­
ting the appropriate level of reserves at the end of each quarter.
Expected Loss Approaches
Under the expected loss approach, losses are estimated as a func­
tion of three components— probability of default (PD), loss given
default (LGD), and exposure at default (EAD). PD, LG D , and EAD
can be estimated at a segment level or at an individual loan level,
and using different models or assumptions. In general, BHCs used
econometric models to estimate losses under a given scenario,
where the estimated PDs were conditioned on the macroeconomic
environment and portfolio or loan characteristics. Some BHCs
used other approaches, such as rating transition models, to esti­
mate stressed default rates as part of an expected loss framework.
250 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
BH Cs with leading practices were able to break down losses
into PD, LG D , and EAD com ponents, separately identifying key
risk drivers for each of those com ponents, though they typically
did not dem onstrate this level of granularity consistently across
all portfolios. For certain wholesale portfolios, some BH Cs used
long-run average PD, LG D , and EAD for a particular segm ent,
such as a rating grade, to estim ate losses. By design, estim ates
based on long-run average behavior over a mix of conditions,
including periods of econom ic expansion and downturn, are not
appropriate for projecting losses under stress and should not be
used for these purposes.
BH Cs with leading practices clearly tied LGD to underlying
risk drivers, accounted for collateral and guarantees, and also
incorporated the likelihood of a decline in collateral values
under stress. However, most BHCs have more limited data on
LGD and, as a result, BH Cs often applied a sim ple, conserva­
tive assumption (e.g ., 100 percent LGD for credit cards), based
stressed LGD on their experience during the crisis, or scaled
up the historical average LGD using expert judgm ent. In using
such m ethods, it is im portant for BHCs to ensure that the pro­
cess is well supported and transparent in line with the Federal
Reserve's general expectation for expert judgm ent-based esti­
mates. W herever possible, BH Cs should benchm ark their esti­
mates with external data or research and analysis.
BH Cs with lagging practices modeled LGD using a weighted-
average approach at an aggregate portfolio level, without some
level of segm entation (e.g ., by lending product, priority of claim,
collateral type, geography, vintage, or LTV). Or, they failed to
dem onstrate that LGD estim ates were consistent with the sever­
ity of the scenario.
Although some BH Cs found a relationship between EAD and
credit quality, most BH Cs did not model EA D s to vary according
to the m acroeconom ic environm ent, in large part due to data
limitations. Rather, many BH Cs applied a static assumption to
estim ate stressed EA D .
BH Cs with stronger practices included the use of loan equiva­
lent calculations (i.e., estim ated additional draw-downs as a
percentage of unused com m itm ents, which are added to the
outstanding or drawn balance) and credit-conversion factors
(i.e., additional drawdowns during the period leading up to
default— usually one year prior— as a percentage of both drawn
and undrawn commitments) to capture losses associated with
undrawn com mitments.
BH Cs with w eaker practices did not project stressed exposures
associated with undrawn com m itm ents and/or relied on the
assumption that they can actively manage down com m itted lines
during stress scenarios.
Rating Transition Models
Many BH Cs have used a rating transition-based approach
to produce a stressed rating transition m atrix for each quar­
ter, which is then used to estim ate losses for their w holesale
portfolios under stress. These approaches used credit ratings
applied to individual loans by the BH C and projected how
these ratings would change over tim e given the m acroeco­
nomic scenario. Although the details of techniques used to link
rating transitions to scenario conditions varied across firm s,
the process usually involved the following steps: (1) co nvert­
ing the rating transition m atrix into a single sum m ary m easure;
(2) estim ating a tim e-series model linking the sum m ary m ea­
sure to scenario variables; (3) projecting the sum m ary measure
over the nine-quarter planning horizon, using the param eter
estim ates from the tim e-series m odel; and (4) converting the
projected sum m ary m easure into a full set of quarterly transi­
tion m atrices. BH Cs using such an approach should be able to
dem onstrate that the sum m ary m easure responds to changes
in econom ic conditions as exp ected (that is, w orsens as the
econom ic condition deteriorates) and results in projected rat­
ing transition m atrices that are consistent with the severity of
scenario. Jud g m entally selecting transition m atrices from past
stress periods is a w eak p ractice, as it may produce loss esti­
m ates that are not consistent with a given scenario and fails to
recognize that conditions in the future may not precisely mirror
conditions observed by the BH C in the past.
Sound rating transition m odels require tw o fundam ental build­
ing blocks: a robust tim e series of data and w ell-calibrated,
granular-risk rating system s. The Federal Reserve expects
BH Cs that use rating transition m odels to have robust tim e
series of data that include a sufficient num ber of transitions,
which allows BH Cs to establish a statistically significant rela­
tionship betw een the transition behavior and m acroeconom ic
variables. Data availability has been a w idespread constraint
inhibiting the developm ent of granular transition m odels
because a sufficient num ber of upgrades and dow ngrades are
necessary to preclude sparse m atrices. In order to overcom e
these data lim itations, BH Cs have often relied on third-party
data to develop rating transition m odels. C onsistent with the
Federal Reserve's general exp ectatio ns, when using third-party
data, BH Cs should be able to dem onstrate that the transition
m atrices estim ated with external data are a reasonable proxy
for the m igration behavior of their portfolios. Rating transition
m odels also require granular ratings system s that capture dif­
ferences in the potential for defaults and losses for a given set
of exposures in various econom ic environm ents. BH Cs that lack
w ell-calibrated, granular credit-risk rating system s are often
unable to produce useful transition m atrices.
Chapter 14 Capital Planning at Large Bank Holding Companies
BH Cs with stronger practices typically had more granular ratings
system and accounted for limitations in their data and/or credit
rating system s by making adjustm ents to model assumptions or
estim ates, or by supplem enting internal data with external data.
BH Cs with w eaker practices often failed to dem onstrate that
supplem ented external data adequately reflected the ratings
perform ance of the BHC's portfolio. BHCs with weaker practices
also som etim es relied on a risk rating process that historically
resulted in lumpiness in rating upgrades and downgrades or
material concentrations in one or two rating categories. As
a result, these BH Cs often produced transition matrices with
limited sensitivity to scenario variables, and resulting estim ates
were more consistent with long-term average default rates than
with default rates that would be experienced under severe eco­
nomic stress.
Roll-Rate Models
Many BH Cs have used roll-rate models to estim ate losses for
various retail portfolios. Roll-rate models generally estim ate
the rate at which loans that are current or delinquent in a given
quarter roll into delinquent or default status in the next period.
As a result, they are conceptually similar to rating transition
models. The Federal Reserve expects BH Cs that use roll-rate
models to have a robust tim e series of data with sufficient gran­
ularity. The robust tim e series data allow the BH C to establish
a strong relationship between roll rates and scenario variables,
while the availability of granular data enables BH Cs to model
all relevant loan transitions and to segm ent the portfolio into
subportfolios that exhibit meaningful variations in perform ance,
particularly during the period of stress. In general, BH Cs should
estim ate roll rates using models that are conditioned on sce­
nario variables. For certain transition states where statistical rela­
tionships between roll rates and scenarios are weak (such as late
stage loan delinquency), BH Cs should incorporate conservative
assumptions rather than relying solely on statistical relationships.
W hile roll-rate models have some advantages, including trans­
parency and ease of use, they often have a weak predictive
power outside the near future, particularly if they are not prop­
erly conditioned on scenario variables. As a result, some roll-rate
models have limited usefulness for stress testing over a longer
horizon, such as the nine-quarter planning horizon required in
C C A R . Some BH Cs have used roll-rate models in conjunction
with other estimation approaches (such as a vintage model
described below) that project losses for later periods. In general,
it is a w eaker practice to combine two different m odels, as it can
introduce unexpected jum ps in estim ated losses over the plan­
ning horizon, though some BH Cs have judgm entally weighed
two different estimation methods to smooth projected losses. If
■ 251
BHCs combine two m odels, they should be able to dem onstrate
that such an approach is em pirically warranted based on output
analysis, including sensitivity analysis, and that the process of
transitioning from one set of results to the other is consistent,
well supported, and transparent.
Vintage Loss Models
Some BHCs use vintage loss m odels, also known as age-cohort-
time m odels, to estim ate losses for certain retail portfolios.
BHCs that use vintage loss models generally segm ent their retail
portfolios by vintage and collateral- or credit-quality-based
segm ents. Losses are estim ated using a multistep process—
developing a baseline seasoning curve for each segm ent and
using a regression model to estim ate sensitivity of losses to
m acroeconom ic variables at each seasoning level (e.g ., four
quarters after origination). This technique is commonly used in
several vendor models, but BH Cs also have developed and used
proprietary models using this technique.
These models have several advantages (such as natural seg­
mentation of portfolio by cohort and maturity) and ease of
application to credit products (such as auto loans) that exhibit
lifecycle effects. However, vintage models can be very challeng­
ing to construct, calibrate, and validate. In particular, it may be
difficult to separately identify vintage effects from the effects of
m acroeconom ic variables, which can result in poorly specified
models. These models also assume that different cohorts will
experience similar losses over tim e, generating results that are
representative of average years, rather than during the period of
stress. In using vintage m odels, it is im portant for a BHC to be
able to dem onstrate that the approach appropriately reflects its
portfolio composition and history, and that modeled outputs are
consistent with stressed conditions.
Charge-Off Models
A m inority of BH Cs have used net charge-off (N CO ) m odels as
either a prim ary loss-estim ation model or a benchm ark m odel.
Typically, the N C O m odels BH Cs used estim ated a statistical
relationship betw een charge-off rates and m acroeconom ic
variables at a portfolio level, and often included auto regres­
sive term s (lagged N C O rates). W hile som e BH Cs also incorpo­
rated variables that describe the underlying risk characteristics
of the portfolio, N C O m odels that BH Cs used for capital plan­
ning generally did not capture variation in sensitivities to risk
drivers across im portant portfolio segm ents nor accounted for
changes in portfolio risk characteristics over tim e. A s a m at­
ter of general practice, BH Cs should not use m odels that do
not capture changes in portfolio risk characteristics over tim e
and in scenarios used for stress testing as part of their internal
capital planning.
252 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
N CO models often exhibit lower explanatory power than m od­
els that consider distinct portfolio risk drivers. In addition, N CO
models implicitly assume that historical charge-off performance
is a good predictor of future perform ance; however, the histori­
cal relationship between charge-offs and macro variables may
not be realized under very stressful scenarios that fall outside
the portfolio's actual historical experience. Accordingly, a N CO
model that is estim ated without using sufficient segm entation or
does not account for current or changing portfolio composition
is unlikely to produce robust loss estim ates. Thus, BH Cs should
avoid using such a N CO model as the primary loss-estimation
approach for a material portfolio.
Scalar Adjustments
Some BH Cs have used simple scalars to adjust portfolio loss
estim ate under a baseline scenario upward for stress scenarios.
Scalars have been calibrated based on some combination of
historical perform ance, the ratio of modeled stressed losses to
baseline losses estim ated for other portfolios, and expert ju d g ­
ment. Scalar adjustm ents are easy to develop, im plem ent, and
com m unicate; however, the approach has significant shortcom ­
ings, including lack of transparency and lack of sensitivity to
changes in portfolio composition and scenario variables. C on­
sequently, the use of these types of approaches should be, at
most, limited to immaterial portfolios.
Available-for-Sale (AFS) and Held-to-Maturity
(HTM) Securities
BH Cs should test all credit-sensitive A FS and HTM securities for
potential other-than-temporary impairment (OTTI) regardless of
current im pairm ent status. The threshold for determ ining O TTI
for structured products should be based on cash-flow analysis
and credit analysis of underlying obligors. Most BHCs used a
ratings-based approach to determ ine O TTI of direct obligations
such as corporate bonds, based on the projection of ratings
migration under a stress scenario and a ratings-based O TTI
threshold. However, some BHCs with w eaker practice used a
ratings-based approach that kept the ratings static over the sce­
nario horizon.
BH Cs should have quantitative methods that capture appropri­
ate risk drivers and explicitly translate assumed scenario condi­
tions into estim ated losses. Estimation methods should generate
results that conform to standard accounting treatm ent, are con­
sistent with scenario conditions, and are appropriately sensitive
to changes in key variables. Any assumptions (e.g ., assumptions
related to loss recognition) should be consistent with the intent
of a stress testing exercise. Additionally, models should be inde­
pendently validated for their use in projecting O TTI losses for
specific classes of securities.
O TTI processes for A FS and HTM securities portfolios varied in
sophistication across BH Cs. BH Cs with leading practices used
estimation methods that capture both security-specific and
country-specific perform ance data for relevant portfolios. For
securitized products, they m odeled the credit risk of underlying
exposures (e.g ., commercial real estate loans) to estim ate poten­
tial losses. W here BH Cs used m anagem ent judgm ent, it was lim­
ited and well supported in the m ethodology docum entation.
In addition, BH Cs with leading practices chose conservative
approaches and assumptions for O TTI loss estim ation, such as
recognizing losses in early quarters rather than over the entire
scenario horizon. Though, under current accounting rules, O TTI
losses are recognized only up to the amount of unrealized
losses, some BH Cs have taken a conservative approach to allow
O TTI losses to exceed projected unrealized losses.
BH Cs with lagging practices did not test all credit-sensitive
securities for potential O TTI; rather, they tested only currently
impaired positions or securities that met a certain criteria (e.g .,
only securities rated below investm ent grade) for O TTI. BHCs
should not rely solely on a ratings-based threshold to deter­
mine O TTI for structured products. BHCs with lagging practices
had O TTI loss-estimation m ethodologies that did not capture
appropriate risk drivers or scenario conditions and/or were not
applied at a sufficiently granular level. In some cases, BHCs
excluded key explanatory variables for certain asset classes.
For exam ple, the unem ploym ent rate was used to project O TTI
losses for non-agency residential m ortgage-backed securities
(RM BS), but the housing price index (HPI) was excluded even
though the theory and empirical evidence points to a strong
relationship between m ortgage losses and housing prices. As a
result of these m ethodology deficiencies, these BH Cs projected
O TTI losses that were inconsistent with the risk characteristics of
the portfolio and assumed scenario conditions.
Operational Risk
Best practices in operational-risk models are still evolving, and
the Capital Plan Rule does not require BH Cs to use advanced
m easurem ent approach (AM A) models for stressed operational-
risk loss estim ation.34 However, BH Cs that have developed a
rich set of data to support the A M A should consider leveraging
the same data and risk-management tools to estim ate opera­
tional losses under a stress scenario, regardless of a particular
m ethodology they choose to estim ate losses.
Most operational-risk models use historical data on operational-
risk loss "even ts"— incidences in which a BHC has experienced a
loss or been exposed to loss due to inadequate or failed internal
34 12 C FR part 225, appendix G .
Chapter 14 Capital Planning at Large Bank Holding Companies
processes, people, or systems or from external events. Generally,
operational-risk events are grouped into one of several event-
type categories, such as internal fraud, external fraud, or damage
o r
to physical assets. In general, BHCs should use internal
operational-loss data as a starting point to provide historical per­
spective, and then incorporate forward-looking elem ents, idio­
syncratic risks, and tail events to estimate losses. Most BHCs
have supplem ented their internal loss data with external data
when modeling operational-risk loss estim ates and scaled the
losses to make the external loss data more commensurate with
their individual risk profiles. The Federal Reserve expects such
scaling approaches to be well supported. Few BHCs have incor­
porated business environment and internal control factors such
as risk control self-assessments and other risk indicators into their
operational-risk methodology. W hile the Federal Reserve does
not expect BHCs to use these qualitative tools as direct inputs in
a model, they can help identify areas of potential risk and help
BHCs select appropriate scenarios that stress those risks.
Internal Data Collection and Data Quality
The Federal Reserve expects BH Cs to have a robust and com ­
prehensive internal data-collection method that captures key
elem ents, such as critical dates (i.e., occurrence, discovery, and
accounting), event types, and business lines. In general, BHCs
should use com plete data sets of internal losses when modeling,
and not judgm entally exclude certain loss data.
Data quality and com prehensiveness have varied consider­
ably across BHCs. BHCs with lagging practices often excluded
certain internal loss data from model input for various reasons.
Exam ples include
• excluding large items such as legal reserves and tax/ com pli­
ance penalties;
• omitting losses from merged or acquired institutions mergers
or acquisitions due to com plications in collection and aggre­
gation; and
• excluding loss data from discontinued business lines, even
though the loss events were reasonably generic and appli­
cable to remaining business lines within the organization.
Some BHCs have addressed observed outliers by omitting them
from the data set, modeling them separately, or applying an add­
on based on scenario analysis or management input. If BHCs do
not have the data from potential mergers and acquisitions, one
35 For exam ple, the seven event-type categories used for A M A are inter­
nal fraud; external fraud; em ploym ent practices and w orkplace safety;
clients, products, and business practices; dam age to physical assets;
business disruption and system failures; and execution, delivery, and
process m anagem ent.
■ 253
way to account for this limitation is to scale existing internal data
using the size of operations and apply an add-on to applicable
business lines or units of measure. If a BHC excludes data or uses
data-smoothing techniques, especially as they affect large losses,
it should have a well-supported rationale for doing so, and clearly
n /
document the rationale and the process.
The Federal Reserve expects BH Cs to segm ent their loss data
into units of measure that are granular enough to capture similar
losses while balancing it with the availability of data. Most BHCs
have segm ented datasets by event type; however, some BHCs
have segm ented the loss data by consolidated business lines,
event types, or some combination of the two.
Correlation with Macroeconomic Factors
Most BH Cs have attem pted to identify correlation between
m acroeconom ic factors and operational-risk losses, but some
have struggled to identify a clear relationship for some types
of operational-risk loss events. BH Cs that did not identify a
significant correlation typically developed other m ethodolo­
gies, such as scenario analysis layered onto modeled results, to
project stressed operational-risk losses. These approaches can
be reasonable alternatives if BH Cs can dem onstrate that their
approach results in sufficiently conservative loss estim ates that
are consistent with the stress scenario.
BHCs that identified correlations between m acroeconom ic fac­
tors and operational-risk elem ents typically had large data sets
and often used external loss data to supplem ent internal data.
These BHCs often identified correlations between loss fre­
quency and m acroeconom ic factors for certain event types and
adjusted the frequency distributions for the respective event
type accordingly.
Common Operational-Loss-Estimation Approaches
Most BH Cs have used their annual budgeting or forecasting
process to estim ate operational losses in the baseline scenario.
The process typically uses a combination of historical loss data
and m anagem ent input at a business-line level. Some BHCs
have used historical averages from internal loss data to estim ate
losses in the baseline scenario.
BHCs with stronger practices used a combination of approaches
to incorporate historical loss experience, forward-looking ele­
ments, and idiosyncratic risks into their stressed loss projections.
Using a combination of approaches can help address model
and data limitations. Some BH Cs used separate models for
certain events types such as fraud or litigation, and used other
approaches (e.g ., using historical averages) for event types *
O /
See FR Y-14A reporting form : Sum m ary Schedule Instructions, p. 5.
254 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
where no correlation with m acroeconom ic factors was identified.
A simple approach may be acceptable depending on the size
and com plexity of the BHC as well as data and sophistication of
models available to them . Very few BHCs have yet developed
benchmarks to either challenge or further support the projec­
tions provided by their main models.
Regression Models
Most BHCs have used a regression model, either by itself or with
another approach described below, to estimate operational-
risk losses for stress scenarios. Some BHCs also have used a
regression model for the baseline scenarios, albeit with different
param eters. Operational-risk regression models are generally
used to estim ate two variables: loss frequency (i.e., the number
of operational-risk losses) and loss severity (i.e., the loss amount).
BH Cs that were able to identify significant correlation between
m acroeconom ic variables and operational-risk losses have
used regression models to stress the loss frequency or total
operational-risk losses. Some m acroeconom ic variables were
adjusted for the purpose of correlation analysis or to reflect
time-lag assumptions. Most BH Cs judgm entally chose time peri­
ods for estimation and model specification rather than justifying
them with statistical evidence.
Most BHCs were not able to find meaningful correlation
between m acroeconom ic variables and operational-risk loss
severity. As a result, BH Cs that used a regression model to esti­
mate loss frequency typically applied the loss-severity assum p­
tion (e.g ., static or four-quarter moving average) based on the
most recent crisis period to estim ate operational losses.
Modified Loss-Distribution Approach (LDA)
The LD A is an empirical modeling technique commonly used
by BH Cs subject to the A M A to estim ate annual value-at-risk
(VaR) measures for operational-risk losses based on loss data
and fitted param etric distributions. The LD A involves estim at­
ing probability distributions for the frequency and the severity
of operational loss events for each defined unit of measure,
whether it is a business line, an event type, or some combination
of the two.
The estim ated frequency and severity distributions are then
com bined, generally using a Monte Carlo simulation, to esti­
mate the probability distribution for annual operational-risk
losses at each unit of measure.
For purposes of C C A R , LD A models have generally been used
in one of two ways: (1) by using a lower confidence interval than
the 99.9th percentile used by the A M A , or (2) by adjusting the
frequency based on outcom es of correlation analysis. BHCs
that modified the LD A by using a lower confidence interval
typically have used either the mean or median for the baseline
estim ates and higher confidence intervals— typically ranging
from 70th percentile to 98th percentile— for the stressed esti­
mates. Additionally, some BH Cs have used different confidence
intervals for different event types. The Federal Reserve does not
require BH Cs to use a particular percentile to produce stressed
estim ates. However, it expects BH Cs to im plem ent a credible,
transparent process to select a percentile; be able to dem on­
strate why the percentile is an appropriate choice given the
specific scenario under consideration; and perform sensitivity
analyses around the selection of a percentile to test the impact
of this assumption on model outputs. Some BHCs modified the
LD A by adjusting frequency distributions based on the observed
correlation between m acroeconom ic variables and operational-
risk losses.
Scenario Analysis
Scenario analysis is a system atic process of obtaining opinions
from business managers and risk-management experts to assess
the likelihood and loss im pact of plausible severe operational-
loss events. Some BHCs have used this process to determ ine a
m anagem ent overlay that is added to losses estim ated using a
model-based approach. BH Cs have used this overlay to incor­
porate idiosyncratic risks (particularly for event types where cor­
relation was not identified) or to capture potential loss events
that the BH C had not previously experienced. BH Cs should be
able to dem onstrate the quantitative effect of the m anagem ent
overlay on final loss estim ates.
Scenario analysis, if used effectively, can help com pensate for
data and model limitations, and allows BH Cs to capture a wide
range of risks, particularly where limited data are available. The
Federal Reserve expects BHCs using scenario analysis to have a
clearly defined process and provide an appropriate rationale for
the specific scenarios included in their loss estim ate. The pro­
cess for choosing scenarios should be credible, transparent, and
well supported.
Historical Averages
Some BH Cs used historical averages of operational-risk losses,
in combination with other approaches noted above, to estimate
operational-risk losses under stress scenarios. For exam ple,
BH Cs have used historical averages for event types where no
correlation between m acroeconom ic factors and operational-
risk losses was identified but used a regression model for
event types where correlations were identified. A small number
of BH Cs have used historical averages as the sole approach
to develop stressed loss estim ates. When used alone, this
approach is backward-looking and excludes potential risks the
BH Cs have not experienced. When using historical averages,
Chapter 14 Capital Planning at Large Bank Holding Companies
BH Cs should support the chosen tim e periods, thresholds,
and any excluded or adjusted outliers and dem onstrate that
loss estim ates are consistent with what are expected in the
stress scenario.
Legal Exposures
Since legal exposure represents a significant portion of opera­
tional losses for many BH Cs, a number of BHCs have analyzed
and projected legal losses separately from non-legal losses. The
Federal Reserve expects BH Cs to include all legal reserves and
settled legal losses in their total loss estim ate for operational
risk. BH Cs have used various methods to estim ate legal losses,
such as applying a judgm ent-based add-on for significant losses;
using legal reserves; using historical averages; or creating sepa­
rate regression models for the clients, products, and business
practices event type. To estim ate litigation losses resulting from
representations and warranties liabilities related to mortgage
underwriting activities, some BH Cs have developed hazard-rate
models based on historical loan perform ance to estim ate default
rates and then estim ated repurchase claim rates.
Market Risk and Counterparty Credit Risk
BH Cs that have sizeable trading operations may incur significant
losses from such operations under a stress scenario due to valu­
ation changes stemming from credit and/or market risk, which
may arise as a result of moves in risk factors such as interest
rates, credit spreads, or equity and com m odities prices, and
counterparty credit risk owing to potential deterioration in the
credit quality or outright default of a trading counterparty.37
BH Cs use different techniques for estimating such potential
losses. These techniques can be broadly grouped into two
approaches: probabilistic approaches that generate a distribu­
tion of potential portfolio-level profit/loss (P/L) and determ inistic
approaches that generate a point estim ate of portfolio-level
losses under a specific stress scenario.
Both approaches have different strengths and weaknesses. A
probabilistic approach can provide useful insight into a range of
scenarios that generate stress losses in ways that a determ inistic
stress testing approach may not be able to do. However, the
probabilistic approach is com plex and often lacks transparency,
and as a result, it can be difficult to communicate the relevant
scenarios to senior managers and the board of directors. In addi­
tion, the challenges inherent in tying probabilistic loss estimates
37 Under the Federal Reserve's stress testing rules, BH Cs with greater
than $500 billion in total consolidated assets who are subject to the
m arket risk rule (12 C FR part 225, appendix E) are required to apply the
global m arket shock as part of their annual Dodd-Frank A ct company-
run stress tests.
■ 255
to specific underlying scenarios can make it difficult for m anage­
ment and the board of directors to readily discern what actions
could be taken to mitigate portfolio losses in a given scenario.
Com bined, these factors com plicate the use of probabilistic
approaches as the primary elem ent in an active capital planning
process that reflects well-informed decisions by senior m anage­
ment and the board of directors. The Federal Reserve expects
BHCs using a probabilistic approach to provide evidence that
such an approach can generate scenarios that are potentially
more severe than what was historically experienced, and also to
clearly explain how BH Cs use the scenarios associated with tail
losses to identify and address their idiosyncratic risks.
By com parison, a determ inistic approach generally produces
scenarios that are easier to com m unicate to senior m anagem ent
and the board of directors. However, a determ inistic approach
often uses a limited set of scenarios, and may miss certain
scenarios that may result in large losses. The Federal Reserve
expects BH Cs using a determ inistic approach to dem onstrate
that they have considered a range of scenarios that sufficiently
stress their key exposures.
For C C A R , most BH Cs generally relied on a determ inistic
approach. BH Cs using determ inistic approaches often relied
on statistical m odels— for exam ple, to inform the magnitude of
risk-factor movements and covariances between risk factors—
and also considered multiple scenarios as part of the broader
internal stress testing supporting their capital planning process.
BHCs using determ inistic approaches used a three-step process
to generate P/L losses under a stress scenario:
1. Design and selection of stress scenarios
2. Construction and implementation of the scenario (that is,
translation to risk-factor moves)
3. Revaluation (and aggregation) of position and portfolio-
level P&L under the stress scenarios
The Federal Reserve expects BH Cs to have robust operational
and im plem entation practices in all areas, including position
inclusion, risk-factor representations, and revaluation methods.
Stress Scenarios
Most BH Cs using determ inistic approaches developed a set of
broad narratives and considered a number of market shock sce­
narios that address the breadth of the BH Cs' risks before select­
ing the scenario included in their capital plans. In general, these
BHCs used some combination of historical events and hypo­
thetical projections to inform and develop the market shock
scenarios. They also developed certain core them es or narra­
tives for each scenario, which was som etim es supplem ented
with an overlay to capture additional nuances. BH Cs generally
256 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
developed the overlays using expert judgm ent based on the
knowledge of their positions and market developm ents.
The Federal Reserve expects BH Cs to consider multiple market
shock scenarios as part of their internal stress testing. BHCs
should develop and use stress scenarios that severely stress
BH Cs' mark-to-market positions and account for BH Cs' idiosyn­
cratic risks, in the event of a market-wide or firm -specific stress.
In developing scenarios, BH Cs should ensure that stress scenar­
ios appropriately stress positions or products in which the BHC
has a large market share (net or gross) or is a dominant player
and should also consider more unusual basis risks arising from
com plex interlocking and interdependent positions, if such
moves could result in large losses. BHCs that only use a scenario
that closely mirrors the Federal Reserve's global market shock
com ponent of the severely adverse and adverse scenarios
should be aware that such an approach may omit significant
risks that are unique to their positions, and that such omissions
could lead to a negative assessm ent of a firm's capital planning
process. BHCs should clearly docum ent the process they use to
select stress scenarios, with sufficient justification and clear artic­
ulation of key aspects of the scenarios.38
Translating Scenarios to Risk Factor Shocks
O nce broad scenarios were developed, BH Cs translated these
scenarios into concrete specification of individual risk factors
that were the actual inputs to pricing m odels, typically using the
existing risk infrastructures and processes used for risk m anage­
ment, such as VaR and credit valuation adjustm ent (CVA). Most
BH Cs used instantaneous market shocks for stress testing, which
assumed highly stressful outcomes that have typically occurred
over a period of time (days, w eeks, or months) will occur instan­
taneously. Given the uncertainty surrounding a firm's ability to
exit or manage positions during a period of severe market
stress, this is an appropriate practice and suitably conservative
for capital planning. Consistent with general supervisory exp ec­
tations around risk-measurement processes, BH Cs should clearly
docum ent the approxim ations and assumptions used as part of
their m easurem ent of risks under stress, assess the potential
im pacts, and address any deficiencies identified.39
The size of shocks assumed in the stress scenario is often quite
large. A s a result, mechanical application of such shocks to cur­
rent levels of risk factors could result in implausible outcomes
such as negative riskfree rates or negative forward rates. BH Cs
should ensure that the proposed shocks produce results that are
38 See FR Y-14A reporting form : Summary Schedule Instructions, pp. 5-6.
39 See id., p. 6.
plausible. In particular, BH Cs should take care in modeling dislo­
cations and discordant moves of risk factors that normally move
similarly. Additionally, while dislocations and discordant moves
are expected under stress, BH Cs should have a process to
assess that the resulting joint moves of risk factors are reason­
able. Also, the dislocations and discordant moves implied by a
stress scenario may require risk-factor mappings that deviate
from the normal m appings. BHCs should clearly docum ent
instances of such deviation and provide support.40
Revaluation Methodologies and P/L Estimates
In principle, revaluation for stress testing can be carried out
using the same infrastructure and calculators as conventional
risk-measurement tools. However, practical revaluation methods
may em bed a number of approxim ations, which could introduce
m ism easurem ent into the stress test results. In particular, VaR
m ethodologies often use approxim ation methods for a number
of reasons— for exam ple, to econom ize on computational costs
related to running a large number of scenarios daily. Although
approxim ation methods may perform adequately for the risk-
factor moves that are considered in normal conditions (for a
small number of scenarios), BHCs should generally use "full-
revaluation" methods for stress testing, given the very large
risk-factor moves, especially for nonlinear positions with value
dependent on multiple risk factors. BHCs can use approxim ation
methods on a limited basis if extensive tests and analyses sug­
gest that the potential m ism easurem ent from using such m eth­
ods is not significant. BH Cs should clearly support the process
they use to ascertain the extent of such m ism easurem ents. Also,
for certain param eters that are not easily "m arket-observable"
and, therefore, cannot be inferred from traded instruments
(e.g ., correlations for credit-default baskets and correlations for
certain interest-rate and exchange-rate pairs), BH Cs should con­
sider suitably perturbed values of the model param eters.
In addition, BHCs should ensure that P/L estimates under the stress
scenario are relatively easy to interpret and explain. For example,
BHCs with leading practices easily identified key P&L drivers in
terms of positions, asset classes, and risk types. BHCs should also
conduct sensitivity analysis to ensure that P/L estimates under the
stress scenario are robust, without being unduly sensitive to small
changes in inputs, assumptions, and modeling choices.
Counterparty and Issuer Defaults
Defaults of counterparties or issuers and/or reference entities
are typically not em bedded directly within the instantaneous
40 See id., pp. 5-6.
Chapter 14 Capital Planning at Large Bank Holding Companies
market shock scenario. BH Cs often use a model similar to that
used for the incremental risk regulatory capital charge— a proba­
bilistic approach based on some measure of PD, LG D , and EAD
of counterparties or issuers— to estim ate losses from possible
defaults over some future horizon (e.g ., to the typical margin
period of risk). BH Cs with leading practices also considered for
their internal stress testing an explicit default scenario of one
or more of their largest counterparties and/or custom ers. This
approach has the benefit of allowing the BHC to consider tar­
geted defaults of counterparties and custom ers to which the
BHC has large exposures.
Risk Mitigants and Other Assumptions
Some BH Cs have incorporated m anagem ent responses to the
stress, assuming, for exam ple, some positions would be sold
or hedged over tim e under the stress scenario. The Federal
Reserve expects any assumptions about risk mitigation to be
conservative. W here BHCs assume m anagem ent actions that
have the effect of reducing losses under the scenario, they
should be able to dem onstrate that such actions are consistent
with established policy, supported by historical experience,
and executable with high confidence in the market environ­
ment contem plated by the scenario. BH Cs should recognize
that their ability to take mitigating actions may be more limited
in the stress scenario. For exam ple, it may not be reasonable
to assume that BHCs can easily sell their positions to other
BH Cs under the stress scenario. In addition, BH Cs should avoid
making unrealistic assumptions about their ability to foresee
precisely how a scenario would play out, and take action on the
basis of that information.
PPNR Projection Methodologies
Th e C ap ital Plan Rule requires BH C s to estim ate revenue and
exp en ses over the nine-quarter planning ho rizo n.41 A cc o rd ­
ingly, BH C s should have effective processes fo r projecting
PPN R and its revenue and exp en se subcom ponents over the
sam e range of stressful scenarios and environm ents used for
estim ating losses. In projecting these am ounts, BH C s should
consider not only th eir current positions, but also how their
activities and business focus may evolve over tim e under the
varying circum stances and operating environm ents reflected
in the scenarios being used.
41 12 C FR 225.8(d)(2)(i).
■ 257
General Considerations for Robust
PPNR Projections
As part of a com prehensive enterprise-wide scenario analysis
program, BH Cs should have m ethodologies that generate
robust projections of PPNR consistent with the current and
projected paths of on- and off-balance-sheet exposures, risk-
weighted assets (RWA), and other exposure assumptions used
for related loss estim ation. PPNR projections should also be
consistent with assumed scenario conditions and be projected in
accordance with the same accounting basis that would be used
to calculate relevant capital ratios. BH Cs should project all key
elem ents of PPNR at a level of granularity consistent with the
m ateriality of revenue and expense com ponents and sufficient
to capture differing drivers of revenue and expenses across
the organization. Finally, BH Cs should consider the effects that
regulatory changes (e.g ., changes in deposit insurance coverage
limits) may have on their ability to replicate historical perfor­
mance or achieve stated goals.
Key assumptions that may m aterially affect PPNR estim ates
should be consistent with assumed scenario conditions and
internally consistent within each scenario, particularly assum p­
tions related to the business model and strategy (e.g ., deposit
growth, pricing assumptions, expense reductions, and other
m anagem ent actions). M anagem ent is expected to evaluate the
reasonableness and timing of projected strategies, including
mitigating actions taken in a stressful scenario, to ensure that
the assumptions reflect realistic and achievable outcom es for
a given scenario. W here possible, assumptions should be sup­
ported by quantitative analysis or empirical evidence.
In all cases, BHCs should ensure that projections (including
those of PPNR, loss, balance sheet size and com position, and
RWA) present a coherent story within each scenario. BHCs
should clearly establish a relationship among revenue, expenses,
the balance sheet, and any applicable off-balance-sheet items
and docum ent how their process generates a consistent and
coherent evolution of these items over the course of the sce­
nario.42 For exam ple, origination assumptions should be the
same for projecting loan balances, related loan fees, origination
costs, and loan losses. Similarly, there should be coherence
among trading revenue projections, trading assets, trading lia­
bilities, and trading RWA projections. M anagem ent should doc­
ument the relationships among these items and avoid cases
where outcom es move in counterintuitive directions.43
42 See 12 C FR 225.8(d)(i)-(ii); FR Y-14A reporting form : Summary
Schedule Instructions, pp. 5-6.
43 See id.
258 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Observed PPNR Projection Practices
The translation of m acroeconom ic assum ptions into projections
of PPNR over a range of stressful scenarios and environm ents
can take many form s, and BH Cs used a variety of approaches
and m odels to make these projections. BH Cs with stronger
practices dem onstrated strong interactions among central
planning functions, business lines, and the treasury group, with
an open flow of inform ation and a robust challenge process.
A t these BH C s, the role of the central group was not just to
aggregate com ponents of PPNR projections. In som e cases,
the corporate planning areas also provided independent pro­
jections that w ere com pared to the aggregated business line
results as a part of the challenge process. A t other BH C s, the
corporate planning group derived the PPNR projections, which
w ere then discussed and challenged by business lines. Both
approaches resulted in better-supported assum ptions and
projections than approaches in which the central group sim ply
aggregated projections made by others.
In addition, BH Cs with stronger practices made projections
based on a full exploration of the most relevant relationships
between assumed scenario conditions and revenues and
expenses. A t these BH Cs, business-line expertise was leveraged
in the developm ent of m ethodologies. A key part of this explo­
ration was determ ining the way that revenues and expenses
were segm ented for projection purposes. BH Cs with stronger
practices did not rely exclusively on the line-item definitions in
regulatory reports, though these BH Cs often established a pro­
cess to clearly map internal BH C reporting conventions to the
various line items on the FRY-14 schedules.
In contrast, BH Cs with lagging practices lacked clear processes
for translating assumed scenario conditions into revenue and
expense projections. Frequently, it was observed that one or
more material com ponents of their projections appeared incon­
sistent with scenario conditions. In some cases, projections of
certain revenue and expense com ponents relied heavily on
m anagem ent judgm ent, which was not transparent, well sup­
ported, or subject to a robust challenge process. In other cases,
revenue estim ates varied from historical experience and conven­
tional expectations, and m anagem ent provided no docum ented
support or analysis around the reasonableness and sensitivity
of modeling assumptions. O verall, data limitations, unclear or
unsubstantiated m anagem ent assumptions, and poor docum en­
tation were the problems most prevalent across the BH Cs.
A nother com m only observed practice for estim ating PPNR
under stressed conditions was the adjustm ent of budget or
baseline estim ates, with budget estim ates largely qualitatively
derived through input from a variety of business lines and/or
stakeholders across the BH C . Although a process of adjusting
baseline estim ates is not problem atic in itself, some BH Cs
relied heavily on baseline estim ates to develop stress scenario
outcom es w ithout considering favorable strategic actions and
assum ptions incorporated into baseline results that might not
be realistic or feasible under stressed conditions. If a BH C
derives stressed estim ates by applying a stress overlay to b ase­
line estim ates, it should dem onstrate the link betw een baseline
estim ates and baseline conditions, dem onstrate the appro­
priateness of the overlay based on the differing conditions
betw een the scenarios, and appropriately consider changes
in m anagem ent actions or other related assum ptions under a
stress scenario.
BH Cs with w eaker practices used models with low predictive
power, in part due to data limitations. BH Cs should not use
w eak models just for the sake of using a modeled approach to
PPNR. Some BH Cs used weak models either as a fram e of refer­
ence or a starting point to translate econom ic factors into esti­
mates of key PPNR com ponents, but then adjusted the results
using expert judgm ent. In such cases, BH Cs should thoroughly
explain and docum ent why results, once adjusted, are consistent
with the scenario conditions.44 In cases where models have low
predictive power, BH Cs with stronger practices found other
ways to com pensate, such as using industry-level models with
BHC-specific market share assumptions to project revenue. In all
cases, BH Cs with stronger practices provided supplem ental
analysis describing why the approach was appropriate.
In cases where BH C-specific data w ere lim ited, BH Cs with
stronger practices used external data to augm ent and extend
their internal data. BH Cs with w eaker practices relied on
m odels that w ere overly influenced by lim ited data covering a
single econom ic cycle. This approach is particularly problem ­
atic if the BH C also experienced favorable conditions, such as
a significant recovery, during the single cycle, which m ight not
recur in future dow nturns. In some cases, data w ere limited to
as few as 10 quarters, which would not encom pass a period
of econom ic weakening or be sufficient to estim ate a robust
m odel, and thus would not be appropriate for considering
potential results in a dow nturn. Many BH Cs cited challenges
due to system s m ergers or changes that limited data availabil­
ity, but failed to adequately com pensate for these lim itations
by supplem enting internal data with external industry data,
where appropriate, or by considering w hether longer tim e
series of available aggregate data would be preferable to a
shorter tim e series of more granular data.
Some BH Cs with w eaker practices made business model and
strategy assumptions (e.g ., new business, expense reductions,
44 See id.
Chapter 14 Capital Planning at Large Bank Holding Companies
the assumption of mitigating actions) that were not consistent
with stressed scenario conditions and the intent of a capital
planning and stress testing exercise. For exam ple, m anagem ent
assumed it would be able to drastically reduce loan origina­
tion activity, cut expenses, or take other mitigating actions in a
severely adverse scenario without considering the longer-term
consequences on the BHC's strategy and operating structure.
The following sections provide specific expectations for project­
ing key com ponents of PPNR, as well as summary points on
observed range of practice.
Net Interest Income
Net interest income projections are closely linked to many other
elem ents of a BHC's capital plan. Balance sheet assumptions
used to project net interest income should be consistent with
balance sheet assumptions considered as part of loss estimation
as well as with other asset and liability m anagem ent assum p­
tions. Loan pricing should be consistent with both scenario
conditions and com petitive and strategic factors, including pro­
jected changes to the size of the portfolio. Deposit projections
should incorporate the impact of strategic plans and pricing on
deposit growth or decline, in addition to scenario factors.
Net interest income projections are expected to incorporate
the balances and contractual term s of current portfolio holdings
as well as the behavioral characteristics of these portfolios. The
methods BHCs use to project their net interest income should
be able to capture dynamic conditions for both current and pro­
jected balance sheet positions. Such conditions include but are
not limited to prepaym ent rates, new business spreads, re-pric-
ing rates due to changes in yield curves, behavior of em bedded
optionality such as caps or floors, call options, and/or changes in
loan perform ance (that is, transition to nonperforming or default
status) consistent with loss estim ates.
Some BH Cs specified product characteristics and conducted
analysis around these characteristics (e.g ., repricing behavior,
line utilizations) both for current assets and new originations in
order to understand the variance in behaviors under the different
scenarios considered. They also attem pted to capture the prod­
uct mix changes that would occur as a result of custom er and
market conditions (e.g., changes in dom estic deposit mix due to
anticipated growth in demand for time deposits for a specified
scenario). BHCs with stronger documentation practices provided
detailed tables explaining underlying assumptions such as bal­
ance drivers and spread and growth assumptions by product.
Some BH Cs partially integrated loss projections into net interest
income projections but did not adequately align all projection-
related assumptions. For exam ple, these BH Cs might take the
full loan loss projections and allocate them across the portfolios
■ 259
based on the current mix of nonperform ance across those
loan portfolios, without considering the changing relative per­
form ance of those portfolios over the course of the scenario.
O ther BH Cs were unable to dem onstrate coherence between
net interest income projections and loss projections, generally
because one or both modeling approaches did not fully capture
the behavioral characteristics of the loan portfolio.
BHCs with stronger practices had net interest income projection
m ethodologies that captured adjustm ents in the amortization of
discounts or premiums for assets held at a value other than par
that would occur under various scenarios. Under FASB State­
ment No. 9 1 ,45 yields would adjust under varying scenarios as
amortization schedules change due to changes in expected pay­
ment speeds.
For pricing, many BHCs assumed a constant spread to a desig­
nated index. BH Cs with stronger practices considered whether
this assumption was consistent with historical experience and
assumed scenario conditions as well as the BHC's strategy as
reflected in the balance sheet projections. Some BH Cs rec­
ognized that new business pricing could differ as a result of
tightening or widening of spreads and docum ented these
assumptions.
Non-Interest Income
BHCs are expected to produce stressed projections of non­
interest income that are consistent with assumed scenario
conditions, as well as with stated business strategies. Due to
inherent challenges in estimating certain non-interest income
com ponents, some BHCs used more than one method and/
or em ployed benchmark analysis to inform estim ates. Stronger
m ethodologies estim ated non-interest income at a granular-
enough level to capture key risk factors or characteristics
specific to an activity or product. For exam ple, for asset man­
agem ent, many BH Cs used different methods to project revenue
from brokerage activities and fund m anagem ent activities.
Like all aspects of PPNR, internal consistency between non­
interest income and other assumptions such as projected paths
for the balance sheet and RWA is important. BH Cs should estab­
lish relationships between material com ponents of non-interest
income and the balance sheet for com ponents that are highly
correlated with the path of the balance sheet, such as some
kinds of loan-related fee income. BH Cs with trading assets
should docum ent how trading revenue projections are linked to
trading assets, trading liabilities, and trading RW A and how all
these elem ents are consistent with conditions in the stress sce­
nario.46 BH Cs with business profiles driven by off-balance-sheet
items should docum ent how revenue projections are linked to
on- and off-balance-sheet behavior.47 Although relationships
between revenue and trading assets or off-balance-sheet items
may be weak over short periods, BH Cs should nevertheless
establish a procedure for projecting relevant balance sheet and
RWA categories in support of those revenues and test for the
reasonableness of the implied return on assets (RO A). If a BHC
estim ates trading or private equity revenue by tying balance
changes to changes in broad indices, the BH C should establish
the level of sensitivity of its positions relative to the indices and
not autom atically assume a perfect correlation between the two.
BH Cs with mortgage servicing right (MSR) assets should ensure
that delinquency, default, and voluntary prepaym ent assum p­
tions are robust and scenario-dependent. These models should
capture m acroeconom ic variables, especially home prices. For
those BH Cs that routinely hedge MSR exposure, hedge assum p­
tions and results for enterprise-wide scenario analysis should
reflect the stress scenario. Some BH Cs assumed a perfect or
near-perfect hedge relationship between changes in the value of
their MSR and hedge portfolio, and captured the ineffectiveness
of the hedge under the stress scenario through the net carry,
transaction costs, and/or bid-ask spread com ponents. BHCs with
stronger practices used an optimization routine that dynamically
rebalanced the hedge portfolio each quarter.
BH Cs with stronger practices considered individual business
models and client profiles when projecting revenue and fee
income from various business activities. BHCs with stronger
practices also considered capacity constraints when estimating
m ortgage loan production and loan sales over the scenario hori­
zon, whereas BH Cs with w eaker practices assumed significant
increases in volume without regard to market saturation or other
factors. O ther w eaker practices observed included using the
same strategic business assumptions in both the baseline and
stress scenarios and making favorable assumptions around new
business and/or market share gains. For exam ple, some BHCs
assumed that all baseline initiatives would be im plem ented
in stress scenarios without interruption or changes to the
outcom es.
In addition, BH Cs with weaker practices did not show sufficiently
stressed declines in revenue relative to assumed scenario condi­
tions, despite stated correlations to m acroeconom ic and other

45 Financial Accounting Standards Board, "Accounting for Nonrefund-

able Fees and Costs Associated with O riginating or Acquiring Loans
and Initial Direct Costs of Leases— an Am endm ent of FASB Statem ents
No. 13, 60, and 65 and a Rescission of FASB Statem ent No. 17 (Issued
12/86)," FASB Statem ent No. 91.
46 See FR Y-14A reporting form : Summary Schedule Instructions, p. 5.
47 12 C FR 225.8(d)(3)(iii); see also FR Y-14A reporting form : Summary
Schedule Instructions, pp. 5-6.

260 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
drivers. For exam ple, while many BH Cs showed significant
declines in credit card gross-interchange fee revenue due to
declines in consumer spending, some BH Cs also assumed that
significant declines in marketing expenses recorded as contra-
revenue would more than offset the declines in gross inter­
change revenue, resulting in an increase in net revenue. O ther
BH Cs assumed revenue com ponents, such as fees or trading
revenue, could not fall below historical levels.
Further, BHCs with w eaker practices considered only a very lim­
ited set of scenario variables and/or drivers in establishing rela­
tionships, which resulted in estim ates that appeared inconsistent
with the scenario. For exam ple, some BH Cs used interest rates
only to project origination activity or solely used asset balances
(instead of the number of accounts) to estim ate account fees.
O ther BH Cs simply regressed high-level revenue items against
scenario factors rather than considering how scenario condi­
tions would affect the key drivers of those line items (such as
volume). For instance, modeling interchange revenues or asset
m anagem ent fees is likely to be less effective than modeling
custom er spending or assets under m anagem ent, respectively,
given the scenario being used, and then considering fee and/or
rate m ovement.
Non-Interest Expense
BH Cs should fully consider the various impacts of the assumed
scenario conditions on their non-interest expense projections,
including costs that are likely to increase during a downturn.
For exam ple, items such as other real estate owned or credit-
collection costs may spike, whereas m anagem ent may have
some ability to control other expenses. Like other projections,
non-interest expense projections should be consistent with bal­
ance sheet and revenue estim ates and should reflect the same
strategic business assumptions. BHCs with w eaker practices did
not account for additional headcount needs in certain areas, nor
for any corresponding changes to compensation expense asso­
ciated with increased collections activity resulting from declines
in portfolio quality and/or increased underwriting activity to sup­
port any assumed portfolio growth.
To the extent the projections assume mitigating actions to offset
revenue declines, BH Cs should dem onstrate that such actions
are attainable in the scenario, given assumed asset levels and
the resources necessary to support operations. If the projections
em bed material expense reductions, such assumptions should
be supported with analysis of historical data or empirical evi­
dence and subject to challenge and review. BH Cs with weaker
practices assumed mitigating actions consistent with past
actions but failed to consider how differences in the business
environm ent and the severity of the econom ic conditions might
affect their ability to execute such actions. BH Cs are expected
Chapter 14 Capital Planning at Large Bank Holding Companies
to evaluate the timing of projected strategies and their impact
on future revenue, expenses, and operating structure.
BH Cs with stronger practices had estimation m ethodologies
that considered the drivers of individual expense items and the
sensitivity of those drivers to changing scenario conditions and
business strategies. They considered the timing of non-interest
expense cuts and recognized that the BH C might not be able
to react to a developing stressful scenario im m ediately or might
be subject to existing contractual obligations that could not be
altered. BHCs with w eaker practices generated non-interest
expense estim ates that appeared unrealistic in light of assumed
scenario conditions. Some BH Cs assumed that they could
im m ediately reduce costs through dram atic cuts in marketing
and rewards programs, com pensation, or other discretionary
expenses. Projecting sizeable reductions in key expense com po­
nents without providing sufficient support as to the reasonable­
ness of the cuts, how m anagem ent intends to realize the cuts,
and how the cuts will affect future revenue is not acceptable.
Additionally, such assumptions imply perfect knowledge of
the conditions as they unfold, rather than a series of indepen­
dent decisions that would be made by m anagem ent as the
scenario unfolds.
14.8 ASSESSIN G CAPITAL
A D EQ U A C Y IMPACT
Balance Sheet and RWAs
BH Cs should have a well-docum ented process for generating
projections of the size and composition of on- and off-balance
sheet positions and RWA over the scenario horizon.48 Balance
projections are a key input to enterprise-wide scenario analysis
given their direct im pact on the estimation of losses, PPNR, and
RWA. Estim ating the evolution of balance sheet size and com ­
position under stress integrates many interrelated features. For
exam ple, loan balances and the stock of A FS securities at a
point in time will depend upon origination, purchase, and sale
activity from period to period, as well as m aturities, prepay­
ments, and defaults. Due to com plexities related to dynamically
projecting and integrating various com ponents (e.g ., origina­
tions, prepaym ents and defaults), most BHCs made direct pro­
jections of balances for each major segm ent of the balance
sheet (e.g ., loans, deposits, trading assets and liabilities, and
other assets) for each quarter of the scenario horizon.
48 12 C FR 225.8(d)(2)(i)(A); see also FR Y-14A reporting form : Summary
Schedule Instructions, p. 6.
■ 261
BHCs often faced challenges in integrating the ultimate bal­
ance projections with other aspects— for exam ple, borrower
or depositor behavior. BH Cs with stronger practices separately
considered the drivers of change to asset and funding balances,
such as contractual paydowns, m odeled prepaym ents, nonper­
form ance, and new business activity for assets, rather than sim­
ply projecting targeted balances directly. A t these BH Cs, each
elem ent was separately assessed for consistency with scenario
conditions and other m anagem ent assumptions. BH Cs with
stronger practices also either directly considered the impact of
these various factors in their balance projections or had proce­
dures to evaluate the reasonableness of any implied behavior
by including input from businessline leaders in the process and
iterating to reasonable estim ates in a well-supported and trans­
parent manner.
BHCs should clearly establish and incorporate into their sce­
nario analysis the relationships among and between revenue,
expense, and on- and off-balance-sheet items under stressful
conditions. Most BH Cs used asset-liability m anagem ent (ALM)
software as a part of their enterprise-wide scenario-analysis
toolkit, which helps integrate these items. BHCs that do not use
ALM software must have a process that integrates balance sheet
projections with revenue, loss, and new business projections.
BHCs with more tightly integrated procedures were better able
to ensure appropriate relationships among the scenario condi­
tions, losses, expenses, revenue, and balances.
As noted above, BH Cs should not rely on favorable assumptions
that cannot be reasonably assured in stress scenarios given the
high level of uncertainty around market conditions. Exam ples
of aggressive or favorable balance sheet assumptions include
(1) large changes in asset mix that serve to decrease BH Cs' risk
weights and improve post-stress capital ratios but that are not
adequately supported or reflected in PPNR or loss estim ates;
(2) "flight-to-quality" assumptions and funding mix changes
that increase deposits and reduce the dollar cost of funding; (3)
significant balance sheet shrinkage with no consideration of the
potential losses associated with reducing positions in periods
of market stress; and (4) operating margin im provem ent. BHCs
that make favorable assumptions should have sufficient evi­
dence that they can be reasonably assured in the assumed stress
scenario.
BH Cs' RWA projections should be based on corresponding pro­
jections of on- and off-balance-sheet exposures and their risk
attributes and should be consistent with the severity of the
stress conditions under each scenario. For general credit-risk
exposures, BH Cs should project balances for material asset cat­
egories with sufficient granularity to facilitate application of reg­
ulatory risk-weighting approaches associated with different asset
categories. For trading exposures, BH Cs should translate
262 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
changes in scenario variables into risk-param eter estim ates that
drive RWA calculations (e.g ., the potential for RWA per dollar of
some trading book positions to increase in periods of higher lev­
els of general market volatility). W here RWA projections are
based on internal risk m odels, BH Cs should not assume any
RWA reductions from potential data or model enhancem ents to
RWA calculation m ethodologies over the projection period. In
all cases, BH Cs should docum ent any assumptions made as part
of the balance sheet and RW A projection process and perform
independent reviews and validations of balance sheet and RWA
projection m ethodologies and resulting estim ates.49
Allowance for Loan and Lease
Losses (ALLL)
BH Cs should maintain an adequate A LLL along the scenario
path and at the end of the scenario horizon. Reserve adequacy
should be assessed against projected size, com position, and
risk characteristics of the loan portfolio throughout the scenario
horizon. In general, the A LLL build and release should be consis­
tent with the scenario path, portfolio credit quality, loss recogni­
tion approach, loan loss estim ates, and loan portfolio balance
projections (including any portfolio growth assumptions). If
BH Cs use estimation approaches that implicitly delay the rec­
ognition of losses, such as net charge-off m odels, they should
adequately build reserves to account for losses not recognized
during the scenario horizon. If the approach relies on top-down
coverage levels, BHCs should com pare coverage ratios and
loss-emergence periods to historical stress environments and
to internal policies and explain the differences if material differ­
ences exist.
Aggregation of Projections
BH Cs should have a well-established and consistently executed
process for aggregating loss, revenue and expense, and on- and
off-balance sheet and RWA estim ates, as part of enterprise-wide
scenario analysis, to assess the post-stress impact of those esti­
mates on capital ratios. BH Cs that are more effective at im ple­
menting such a process have established centralized groups
with responsibility for
• combining loss, revenue, balance sheet, and RWA
projections;
• providing strong governance and controls around the
process;
49 See id.
• ensuring coherence of com ponent estim ates and aggregate
results; and
• applying and docum enting any adjustm ents.50
These centralized groups have been able to source estimates from
a range of internal parties involved in enterprise-wide scenario
analysis and develop consolidated pro forma financial results that
are internally consistent and conform to accounting standards.
BH Cs should develop a governance structure around the
enterprise-wide scenario analysis process that provides for a
robust analysis and challenge of the coherence of the aggregate
results and determ ine whether any adjustm ents need to be
made based on the analysis. In particular, BH Cs should assess
whether the paths of individual loss and revenue com ponents
are consistent with the paths of balance sheet and RWA esti­
mates and the overall scenario path. For exam ple, an increase
in PPNR amid declining balances would appear generally
inconsistent and should warrant further investigation. In assess­
ing consolidated financial results, BH Cs should account for any
potential changes in relationships between losses and financial
perform ance drivers during periods of stress.
BH Cs should have good understanding of instances when exp o­
sures with similar underlying risk characteristics that are part of
different portfolios or business lines exhibit different sensitivities
to scenario conditions. BH Cs should identify instances where
the differences are due to inconsistent assumptions or m odel­
ing approaches that require m anagem ent attention, rather
than differences in accounting treatm ent. In addition, if a BHC's
enterprise-wide scenario analysis results in post-stress outcomes
that are more favorable than those under baseline conditions,
BH Cs should critically evaluate the reasonableness and consis­
tency of assumptions across portfolios, business lines, and other
areas of loss and revenue estimation.
BH Cs that had an effective aggregation process leveraged their
business planning and financial and regulatory reporting systems
as part of that process. Using standalone tools or spreadsheets
in the aggregation process is a weak process. If a BH C needs to
use standalone tools or spreadsheets due to system s limitation,
m anagem ent should ensure robust controls are in place, includ­
ing access and change controls, and should maintain an audit
trail and docum ent all approvals for any adjustm ents made.
BH Cs should also have reconciliation procedures and data qual­
ity and logic checks in place to ensure that the results from the
enterprise-wide scenario analysis reconcile to both m anagem ent
reporting and regulatory reports, with a transparent mapping
between various reporting taxonom ies.
50 See id.
Chapter 14 Capital Planning at Large Bank Holding Companies
BH Cs with w eaker practices had limited or no reconciliation
procedures or other controls in place to ensure the integrity,
com pleteness, and accuracy of the consolidated post-stress
capital m etrics. BH Cs with w eaker practices also had no process
to ensure consistency in the BHC-wide application of scenario
assumptions and m anagem ent adjustm ents, and had weak gov­
ernance and docum entation standards.
14.9 CO N CLUDIN G OBSERVATIONS
The goal of this publication is to outline the Federal Reserve's
expectations for internal capital planning at large BH Cs and to
highlight the range of current practice as observed during the
2013 C C A R . This discussion is intended to provide a more com ­
prehensive set of criteria to assist BH C m anagem ent in assess­
ing their current capital planning processes and in designing and
implementing improvements to those processes, as well as to
provide insight to a broader audience about the key aspects of
BH Cs' capital planning practices.
Internal capital planning practices have evolved considerably
since the financial crisis and the implementation of the Federal
Reserve's Capital Plan Rule in 2011. BHCs have made advances
in the identification and m easurem ent of the risks to their capital
and in the integration of stress testing and capital planning into
their broader strategic planning processes. The fundamental
insight governing the Federal Reserve's expectations about capi­
tal planning is the im portance of having a forward-looking per­
spective on the risks to a BHC's capital resources under severely
stressful conditions. In particular, a forward-looking perspective
involves understanding how a BHC's revenue-generating capac­
ity and potential losses could be affected in stressed economic
and financial market conditions; understanding the particular
vulnerabilities arising from its business model and activities; and
having a capital policy in place that governs the BHC's capital
actions under both "norm al" and stressed econom ic conditions.
These elem ents represent substantial conceptual and opera­
tional improvements in capital planning that go well beyond sim ­
ple consideration of current and expected future capital ratios.
W hile many of the large BH Cs subject to the Capital Plan Rule
have made substantial im provem ents in capital planning, there
is still considerable room for advancem ent across a number of
dimensions. Areas where some BH Cs continue to fall short of
leading practice include
• not being able to show how all their risks were accounted for
in their capital planning processes;
• using stress scenarios and modeling techniques that did not
address the particular vulnerabilities of the BHC's business
model and activities;
■ 263
• generating projections for at least some com ponents of loss,
revenue, or expenses using approaches that were not robust,
transparent, and/or repeatable, or that did not fully capture
the impact of stressed conditions;
• having capital policies that did not clearly articulate a BHC's
capital goals and targets, did not provide analytical sup­
port for how these goals and targets were determ ined to
be appropriate, and/or were not com prehensive or detailed
enough to provide clear guidance about how the BH C would
respond as its capital position changed in different econom ic
circum stances; and
• having less-than-robust governance or controls around the
capital planning process, including around fundamental risk-
identification, -m easurement, and -m anagem ent practices
that are among the critical elem ents that support robust capi­
tal planning.
264 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
All the BH Cs that participated in C C A R faced challenges across
one or more of these areas. And although many BH Cs dem on­
strated leading practices in several dimensions of capital plan­
ning, the leading capital planning practices identified in this
paper will continue to evolve as new data becom e available,
econom ic conditions change, new products and businesses
introduce new risks, and estimation techniques advance fur­
ther. A s the frontier of capital planning practice advances, the
Federal Reserve's expectations for how BH Cs im plem ent the
requirements of the Capital Plan Rule and the related company-
run stress testing required under the Dodd-Frank A ct will
also evolve.51 Such advances in capital planning practices will
enhance the health and stability of individual BH Cs and of the
overall banking system .
51 12 C FR part 252, subpart G .
Stress Testing
Banks
Learning Objectives
A fter com pleting this reading you should be able to:

Describe the historical evolution of the stress testing Explain challenges in modeling a bank's revenues, losses,
process and com pare m ethodologies of historical EB A , and its balance sheet over a stress test horizon period.
C C A R and SC A P stress tests.

Explain challenges in designing stress test scenarios,

including the problem of coherence in modeling
risk factors.

Excerp t by Til Schuermann is reprinted from the International Journal o f Forecasting 30, no. 3, (2014) pp. 717-728.

265
ABSTRACT
How much capital and liquidity does a bank need to support its
risk taking activities? During the recent (and still ongoing) finan­
cial crisis, answers to this question using standard approaches,
e.g., regulatory capital ratios, were no longer credible, and thus
broad-based supervisory stress testing became the new tool.
Bank balance sheets are notoriously opaque and susceptible to
asset substitution (easy swapping of high risk for low risk assets),
so stress tests, tailored to the situation at hand, can provide clarity
by openly disclosing details of the results and approaches taken,
allowing trust to be regained. With that trust re-established, the
cost-benefit of stress testing disclosures may tip away from bank-
specific towards more aggregated information. This paper lays
out a framework for the stress testing of banks: why it is useful
and why it has become such a popular tool for the regulatory
community in the course of the recent financial crisis; how stress
testing is done (design and execution); and finally, with stress test­
ing results in hand, how one should handle their disclosure, and
whether it should be different in crisis vs. "norm al" times.
15.1 INTRODUCTION
There are three kinds of capital and liquidity: (1) the capital/liquid-
ity you have; (2) the capital/liquidity you need (to support your
business activities); and (3) the capital/liquidity the regulators
think that you need.1 Stress testing, regulatory capital/liquidity
and bank-internal (so-called "econom ic capital/liquidity") models
all seek to do the same thing: to assess the amount of capital and
liquidity which is needed to support the business activities of the
financial institution. Capital adequacy addresses the right side of
the balance sheet (net worth), and liquidity the left side (share of
assets that are "liquid", however defined). If all goes well, both
the economic and regulatory capital/liquidity are less than the
required regulatory minimum, and their difference (between eco­
nomic and regulatory) is small, that is, regulatory models do not
deviate substantially from the results of internal models.
Prior to their failure or near-failure, financial institutions such as
Bear Stearns, Washington Mutual, Fannie Mae, Freddie Mac,
Lehman and Wachovia were adequately or even well capitalized,
at least according to the regulatory capital rules disclosed in their
public filings.2 This set of institutions spans a broad range of regu­
latory capital regimes and regulators: the SEC and Basel 2 capital
rules (Bear Stearns, Lehman), the O C C and the Federal Reserve
1 This pithy sum m ary I owe to Peter Nakada.
2 Kuritzkes and Scott (2009) make the case for a more market-oriented
assessm ent of capital adequacy.
266 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
and Basel 1 (Wachovia), the O TS (WaMu), and O FH EO (Fannie and
Freddie)—the last actually based on a narrow stress scenario. All
firms had a broad exposure to residential real estate assets, in the
form of either whole loans (mortgages) or securities (MBS), or
both, and all had internal risk models which may or may not have
deviated materially from the regulatory models (we do not know
this, as it is/was firm proprietary information).3 Yet the answer to
the question of what is the capital you need vs. the capital you
have came out wrong in each case. O f course, neither firm-internal
(economic) nor regulatory capital and liquidity models can guaran­
tee failure prevention; indeed, that is not their purpose, as every
firm accepts some probability of failure, sized by its risk appetite.
Nevertheless, the cascading of defaults, and the resulting deep
skepticism of the market's stated capital adequacy, forced regula­
tors to turn to a new tool for assessing the capital adequacy of
banks in a credible way. That tool turned out to be stress testing.4
This paper lays out a fram ework for the stress testing of banks:
why it is useful and why it has becom e such a popular tool for
the regulatory community in the course of the recent financial
crisis; how stress testing is done (design and execution); and
finally, with stress testing results in hand, how one should handle
their disclosure, and whether it should be different in crisis vs.
"norm al" tim es. The fram ework is equally applicable to capital
and liquidity adequacy, but for the sake of sim plicity, the bulk of
the discussion will focus on capital.
A successful macro-prudential stress testing program, particu­
larly in a crisis, has at least two com ponents: first, a credible
assessm ent of the capital strength of the tested institutions, to
size the capital "hole" that needs to be filled, and second, a
credible way of filling that hole. The US bank stress test in 2009,
the Supervisory Capital Assessm ent Program or SCAP, may
serve as a useful exam ple. The US entered 2009 with an enor­
mous uncertainty about the health of its banking system . In the
absence of a more concrete and credible understanding of the
problems with bank balance sheets, investors were reluctant to
com mit capital, especially given the looming threat of possible
governm ent dilution. With a credible assessm ent of losses under
a sufficiently stressful m acroeconom ic scenario, the supervisors
hoped to draw a line in the sand for the m arkets: fill this hole,
and you won't risk being diluted later because the scenario
wasn't tough enough. Moreover, if some institutions could not
3 Lester, Reynolds, Schuerm ann, and Walsh (2012) report that, out
of 16 banks (US and non-US) that publicly disclosed their econom ic
capital before the crisis, four actually exp erienced losses exceed ing
those requirem ents, all of which w ere calibrated to at least the 99.9%
level (im plying an accep tab le annual default probability of no more
than 10bp).
4 Flannery (2012) argues that stress tests should be evaluated on a fair
value (rather than book capital) basis.
convince investors to fill the hole, a US governm ent program,
namely the Treasury's Capital Assistance Program (CAP), stood
ready to supply the required capital. Importantly, the US Trea­
sury was a sufficiently credible debt issuer that the C A P promise
was itself cred ib le.5 All banks with assets greater than $100 bn
(YE 2008) were included, accounting for two-thirds of the total
assets and about half of the total loans in the US banking sys­
tem . In the end, ten of the 19 SC A P banks were required to
raise a total of $75 bn in capital within six months, and indeed
raised $77 bn of Tier 1 common equity in that period.6 None
needed to draw on C A P funds.
The European experience in 2010 and 2011 stands in stark con­
trast to the 2009 SCAP. Against the background of a looming
sovereign debt crisis in the peripheral eurozone countries, the
Com m ittee of European Bank Supervisors (CEBS) conducted a
stress test of 91 European banks in 2010, covering about two-
thirds of the total European bank assets and at least half of that
in any given participating country. The stress test included impos­
ing haircuts on the market value of sovereign bonds held in the
trading book; however, the bulk of the sovereign exposure was
(and is) in the banking book. O f the 91 banks, only seven were
required to raise a total of €3.5 bn (< $5 bn at the time) in capital.
The level of disclosure provided was rather less than in the SCAP.
For instance, loss rates by firm were only made available for two
sub-categories: overall retail and overall corporate.7 By contrast,
the SCA P results released loss rates by major asset class such as
first-lien m ortgages, credit cards, commercial real estate, and so
on. Markets reacted benignly nonetheless— until a few months
later, when Ireland requested financial assistance from the EU and
the IMF. Subsequent stress tests of just the Irish banks, con­
ducted largely by outside independent advisors (Black-Rock)
revealed a total capital need of €24 bn; all of these banks had
previously passed the C EB S stress test. Moreover, to help close
the credibility gap, the extent and degree of disclosure was far
greater than in any of the stress testing exercises to date.8 The
markets reacted favorably, with both bank and Irish sovereign
credit spreads tightening. The stakes for the 2011 European
stress test, now conducted by the successor to the C E B S — the
European Banking Authority (EBA )— had risen substantially.
5 Note that the act of a sovereign recapitalizing its banks involves that
sovereign issuing debt and then investing ("dow nstream ing") it as equity
in the bank(s).
6 http://w w w .federalreserve.gov/bankinforeg/scap.htm .
7 http://w w w .eba.europa.eu/EU -w ide-stress-testing/2010/2010-EU-wide-
stress-test-results.aspx.
8 http://www.centralbank.ie/regulation/industry-sectors/credit-institutions/
D ocum ents/The% 20Financial% 20M easures% 20Program m e% 20Report
.pdf.
A t first glance, the results of the 2011 EB A stress test of 90
banks in 21 countries were mild, sim ilar to the previous year's.9
Eight banks w ere required to raise a total of only €2.5 bn.
However, the degree of disclosure was much more extensive,
approaching the high bar set by the Central Bank of Ireland in
March 2011, including information on exposure by asset class
by geography. Im portantly, all bank level results were available
to download in spreadsheet form , to enable m arket analysts to
easily im pose their own loss rate assum ptions. In this way, the
"official" results were no longer so final: analysts could (and
did) easily apply their own sovereign haircuts on all exposures,
and thus test the solvency of any of the 90 institutions
them selves.
In an uncom fortable parallel to the Irish experience in 2010, the
2011 E B A stress test did nothing to alleviate concerns about the
Spanish banking system . Five of the 25 Spanish banks in the
EB A stress test did not pass, though once provisions and man­
datory bond conversions (to equity) were taken into account,
the required additional capital raise was €0. By the spring of
2012, Spain was engaged in or had announced several addi­
tional stress tests. First was the IMF's Financial Sector A ssess­
ment Program (FSAP), conducted jointly with the Banco de
Espana. The results of this were released on June 8, 2 0 1 2 ,101
with 11 of the 29 banks requiring a total of €17.7 bn capital
using a post-stress hurdle similar to that of the SC A P (4% core
Tier 1 capital), or 17 banks requiring a total of €37.1 bn using
the higher hurdle of 7% core Tier 1 capital. Second was a short
(4-week) top-down exercise conducted by two outside advisers
(working in parallel to provide, ostensibly, two further indepen­
dent assessm ents), and those results were released on June 21,
2012. No firm -specific results were provided, only an overall
capital need. The first estim ate, provided by Roland Berger, was
€51.8 bn, while O liver W yman provided a range of € 51-62 b n .12
A more detailed and intensive bottom-up analysis by O liver
Wyman follow ed, with results released on Septem ber 28, 2012,
showing that 7 of 14 the banking groups needed a total of
€57.3 bn using the post-stress core Tier 1 threshold of 6%;
9 http://w w w .eba.europa.eu/EU -w ide-stress-testing/2011/2011-EU-wide-
stress-test-results.aspx.
10 http://w w w .im f.org/external/pubs/ft/scr/2012/cr12137.pdf.
11 Most European exercises have tested to a post-stress hurdle of 6%
core T ie r 1; see the discussion in Section 3.
12 Roland Berger: http://w w w .bde.es/w ebbde/G A P/Secciones/
SalaPrensa/Inform acionlnteres/ReestructuracionSectorFinanciero/
Ficheros/en/inform e_rolandbergere.pdf; O liver W ym an: http://w w w
.bde.es/w ebbde/G A P/Secciones/SalaPrensa/lnform acionlnteres/
ReestructuracionSectorFinanciero/Ficheros/en/inform e_oliverw ym ane
.pdf.
Chapter 15 Stress Testing Banks ■ 267
Table 15.1 Summary of Disclosures Across Stress Test Exercises

Exposure detail Bank vs.

Base and stress Bank level Asset/product (asset class, maturity, supervisory/3rd
scenario results level loss rates geography) party estimates

SCA P Stress / /
March 2009

CEBS Both / Retail, all

corporate only
Ju ly 2010

CCAR

March 2011

Ireland Both / / Sovereign only /

March 2011

EB A Both / Retail, corporate, High

CRE
Ju ly 2011

CCAR Stress / /
March 2012

Spain (IMF) Both A sset class (aggregate)

June 8, 2012

Spain (top-down) Both / A sset class (aggregate)

June 21, 2012

Spain (bottom-up) Both / / A sset class (aggregate)

Sept. 28, 2012

m erger activity had resulted in a significant reduction in inde­ Table 15.2 Features of Stress Testing, Pre- and
pendent banking en tities.13 Post-SCAP
A summary of the major macro-prudential stress tests to date P re-SC A P P o st-SC A P
is provided in Table 15.3, and a summary of their disclosures is
• Mostly single shock • Broad macro scenario and
given in Table 15.1.
• Product or business market stress
The SCA P was the first of the macro-prudential stress tests of this unit level • Com prehensive, firm-wide
crisis, but the changes at the micro-prudential or bank-specific • Static • Dynamic and path dependent
• Not usually tied to • Explicit post-stress common
level were at least equally significant, and they are summarized
capital adequacy equity threshold
in Table 15.2. With the SCAP, stress testing at banks went from
• Losses only • Losses, revenues and costs
mostly single factor shocks (or a handful) to using a broad macro
scenario with market-wide stresses; from product or business
unit stress testing, focusing mostly on losses, to firm-wide and
a discussion of how to design the stress sce n ario , in clu d ­
comprehensive testing, encompassing losses, revenues and costs;
ing the choice of a post-stress capital hurdle. Sectio n 4
and with all of these tied to a post-stress capital ratio to ensure a
going concern. d e scrib e s m odeling ap p ro ach es fo r the th ree co m p o nents
needed to im p lem ent stress te stin g : lo sses, net revenues
The rem aind er of the p ap er p ro ceed s as fo llo w s. Sectio n 2 (p ro fitab ility), and balance sh eet dynam ics. Sectio n 5 review s
b riefly review s the scant lite ra tu re , and Sectio n 3 p ro vid es the d isclo su re regim es across the d ifferen t stress te sts to
date in m ore d e ta il, and presents a discussion of disclo sure

13 http://w w w .bde.es/f/w ebbde/SSICO M /20120928/inform e_ow 280912e in "n o rm a l" tim e s, afte r w hich Section 6 p ro vid es som e co n ­
.pdf. cluding rem arks.

268 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Table 15.3a Summary of Macroprudential Stress Tests to Date

Risk types included:

# of Total required market, credit,
Target capital participating Participation criteria (total Balance sheet capital raise (for liquidity (funding),
ratio3 banks coverage) assumptions # of banks) operational
SC A P • 4% T1C 19 • All bank holding com pa­ Constant RWA $75 bn (19) M b, C
• 6% T1 nies with at least $100 bn
March 2009
total assets
• (~2/3 of total banking
assets)

CEBS • 6% T1 91 (20 countries) • Largest banks in country Constant total €3.5 bn (7) M ,C
until at least 50% of total assets
July 2010
assets are included
• (~2/3 of total banking
assets)

CCAR • 5% T1 C 19 • Original SCAP-19 None M, C

March 2011

Ireland • 6% T1 C 4 • Largest banks not in wind- Allowed for balance €24 bn (4) M, C , L, O
• 10.5% T 1 C down mode sheet shrinkage
March 2011
(in base)

EB A • 5% T1 C 90 (21 countries) • Largest banks in country Constant total €2.5 bn (8) M, C , Lc, O
until at least 50% of total assets
July 2011
assets are included
• (~2/3 oftotal banking
assets)
d
CCAR • 5% T1C 19 • SCAP-19 None M, C , O
• 4% T1; 8% Total; • An additional 11 BHCs
March 2012
3%-4% leverage with assets > $50 bn

a T1: Tier 1 capital ratio; T 1 C : Tier 1 common (or core) capital ratio.

b O nly banks with at least $100 bn in trading assets were required to conduct the m arket risk stress test.

c Liquidity risk was not assessed directly, though funding stresses were taken into account, especially as they related to sovereign stress impacting the funding costs for financial
institutions.

Four of the 19 did not pass, in the sense of not having gained non-objection to their subm itted capital plans.

Chapter 15 Stress Testing Banks

■
269
Table 15.3b Summary of Macroprudential Stress Tests to Date— Spain 2012

Risk types
included:
market, credit,
# of Balance Total required liquidity
Target participating Participation criteria sheet capital raise (for (funding),
capital ratio3 banksb (total coverage) assumptions # of banks) operational

IMF • 7% T1 C 29 • Large and medium Deleveraging • €37.1 (17) C, L

banks and cajas, under 7% T1 C
June 8, 2012
together making
up ~90% of total
bank assets

Top-down • 9% T1C 14 entities • Large and medium Deleveraging • €16-25 [base] C, L

[base] banks and cajas, • €51-62 [stress]
June 21, 2012
• 6% T1C together making
[stress] up ~90% of total
bank assets

Bottom-up • 9% T1C 14 entities • Large and medium Deleveraging • €24.1 (5) [base] C, L
[base] banks and cajas, • €57.3 (7) [stress]
Sept. 28, 2012
• 6% T1C together making
[stress] up ~90% of total
bank assets

a T 1 : Tier 1 capital ratio; T 1 C : T ie r 1 common (or core) capital ratio.

b The 14 entities are the result of m ergers.

15.2 S T R E S S T E S T IN G IN T H E Risk management as a technical discipline came into its own with
the publication of the RiskMetrics technical document in 1994,
LIT ER A T U R E
and stress testing (of both kinds, sensitivities and scenarios) is
mentioned throughout. The first edition of Jorion's
Stress testing has been part of the risk m anager's toolkit for a
standard-setting VaR book (Jorion, 1996) had a subsection
long tim e. It is perhaps the most basic of risk-based questions
devoted to the topic (which was elevated to a chapter in subse­
to w ant to know the resilience of an exposure to deteriorating
quent editions), and there must surely be earlier exam ples. Stress
conditions, be it a single position or loan or a w hole portfolio.
testing as a risk management discipline was found largely in the
Typically, the stresses take the form of sensitivities (spreads
relatively data rich environment of the trading room, with the
double, prices drop, volatilities rise) or scenarios (black
closely related treasury function of conducting interest rate sce­
M onday 1987, autumn of 1998, post- Lehman bankruptcy,
narios and shocks.14 The Com m ittee on Global Financial Systems
severe recession, stagflation). These types of stresses lend
(CG FS) of the BIS conducted a survey on stress testing in 2001,
them selves naturally to understanding financial risks, particu­
and it reinforces this view .15 In their summary of the C G FS report,
larly in a data rich environm ent such as that found in a trading
Fender et al. (2001) point out that most of the scenarios involve
operation. Nonfinancial risks, such as operational, reputational
shocks to market rates, prices or volatilities. Typical exam ples are
and other business risks, are much harder to quantify and
equity market crashes such as O ctober 1987, rates shocks such
param eterize yet rely heavily on scenario analysis (earthquakes
as 1994, credit spread widening such as during the fall of 1998,
and other natural disasters, com puter hacking, legal risks, and
and so on. Such stress scenarios have the virtue of being
so on). W hile the original Basel I A ccord of 1988 did not make
any form al mention of stress testin g , it m erited its own se c­
tion in the M arket Risk A m endm ent of 1995, and thus becam e
14 See Berkowitz (2000) and Kupiec (1998) for more extensive discus­
em bedded in the regulatory co d ex. Indeed, evidence of stress sions of VaR-based stress testing.
testing cap ab ilities is a requirem ent for regulatory approval of 15 See C G F S (2001) and the summary of its principal findings by Fender,
internal m odels. G ibson, and M osser (2001).

270 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
unambiguously articulated and defined, and are thus transparent
and easy to implement and communicate, at least on assets that
have them selves natural market prices or analogs, as is mostly
the case in the trading book. More typical banking assets, such
as corporate loans (especially to privately held firms) and con­
sumer loans (e.g. auto loans), are less naturally amenable to this
approach.
Formal stress testing of the banking book, which is dominated by
credit risk, is more recent, partly because quantitative credit risk
H /
modeling is itself a newer discipline. Perhaps stimulated by the
success of RiskMetrics, the late 1990s saw a spurt of activity in the
developm ent of credit portfolio models, with the two most promi­
nent examples being CreditM etrics (Gupton, Finger, & Bhatia,
1997) and CreditRisk+ (Wilde, 1997).1
17 However, stress testing
6
did not feature in these papers. A t the same time, as Koyluoglu
and Hickman (1998) show quite clearly, all of these credit portfolio
models share a common framework of mapping outcomes in the
real economy, often represented by an abstract state vector, to
the credit loss distribution, and thus, they should lend themselves
naturally to stress testing. With that in mind, Bangia, Diebold, Kro-
nimus, Schagen, and Schuermann (2002), broadly following the
CreditM etrics framework, show how to use credit migration matri­
ces to conduct macroeconomic stress tests on credit portfolios.
Foglia (2008) provides a survey of the literature (at least through
to late 2008) of stress testing credit risk, both for individual banks
or portfolios and for banking systems. More recently, Rebonato
(2010), with his suggestively titled book Coherent stress testing
(we return to the problem of coherence below), argues for a
Bayesian approach to financial stress testing, i.e., one which is
able to formally include expert knowledge in the stress testing
design, with an emphasis on exploring causal relationships using
Bayesian networks.
With few exceptions, regulatory requirements for stress testing
were thin prior to the crisis, though considerable expectations of
stress testing capabilities were voiced in supervisory guidance in
the US. Examples include the Joint Policy Statement on Interest Rate
Risk (SR 96-13), guidance on counterparty credit risk (SR 99-0318),
and country risk management (SR 02-05). However, banks had a
significant degree of discretion with regard to the specific design
16 O f course, the credit rating agencies, having been in the business
of rating corporate bonds for nearly a century, probably em ploy stress
testing in their bond rating m ethodology, but old docum entation to this
effect is hard to com e by.
17 For an excellent overview and com parison of these and related mod­
els, see Koyluoglu and Hickman (1998).
18 The most recent guidance on counterparty credit risk, SR 11-10, has
greatly expanded on stress testing expectations. All SR letters can be
found at http://www.federalreserve.gov/bankinforeg/srletters/srletters.htm.
and implementation of their stress tests. Brian Peters, then head of
risk in bank supervision at the New York Fed, observed at an indus­
try conference in March 2007 that no firm had a fully-developed
program of integrated stress testing that captured all major finan­
cial risks on a firmwide basis.19 Market risk stress tests were most
advanced, while corporate or enterprise-wide stress testing,
whereby all businesses were subjected to a common set of stress
scenarios, was in a developmental phase at best.
15.3 S T R E S S T E S T IN G D E S IG N
Perhaps the most fundamental choice in stress testing design is the
risk appetite of the authorities: how severe and how long the stress
scenario should be, and what the post-stress hurdle is. To take a
sailing analogy: how severe and how long is the storm, and how
solid does the boat still need to be once the storm has passed? In
stark contrast to standard capital regimes, the target calibration is
not strict solvency (i.e., just enough capital to have a positive net
worth), but rather some notion of adequate capitalization p o st­
stress. For instance, the 2009 SCAP in the US presented a two-year
scenario with a post-stress hurdle of 4% Tier 1 common capital. The
2012 bottom-up Spanish stress test used a three-year scenario with
a post-stress hurdle of 6% core Tier 1 capital, suggesting a lower
risk appetite by the Spanish authorities than by the American.
W hile length and post-stress hurdles are easy to com pare across
macro-prudential stress tests, scenario severity is not. Authori­
ties are reluctant to make statem ents like "a 1 in 100 scenario"
which would allow such com parisons, in part because such a
statem ent is very difficult to make credibly. In its stress testing
program, the Federal Reserve makes available tim e series of
relevant variables to allow users to assess the severity of a given
scenario, at least for those variables.20 O f course, a multivariate
assessm ent is much more difficult.
Once the risk appetite has been established, one of the principal
challenges faced by both the supervisors and the firms when
designing stress scenarios is coherence. The scenarios are inher­
ently multi-factor: we are seeking to develop a rich description of
adverse states of the world in the form of several risk factors, be
they financial or real, taking on extrem e yet coherent (or possi­
ble) values. It is not sufficient to specify only high unemployment
or only a significant widening of credit spreads or only a sudden
drop in equity prices; when one risk factor moves significantly,
19 Presentation delivered at Marcus Evans conference "Im plem ent­
ing stress tests into the risk m anagem ent process", W ashington D C ,
March 1-2, 2007.
S e e http://w w w .federalreserve.gov/bankinforeg/bcreg20121115a3.xlsx.
Chapter 15 Stress Testing Banks ■ 271
the others move too. The real difficulty is in specifying a coher­
ent joint outcome of all of the relevant risk factors. For instance,
not all exchange rates can depreciate at once; some have to
appreciate. A high inflation scenario needs to account for likely
monetary policy responses, such as an increase in the policy
interest rate. Every market shock scenario resulting in a flight
from risky assets— "flight to quality"— must have a (usually small)
set of assets that can be considered safe havens. These are typi­
cally governm ent bonds from the safest sovereigns (e.g., the US,
Japan, Germ any, Switzerland). O f course, as sovereign govern­
ment budgets are increasingly strained, questioning the ultra-low
risk assumption of such treasury instruments would certainly be a
worthwhile stress scenario, but it would need to define an alter­
native "risk-free" asset class to which capital can flee.
While the problem of coherence is generic to scenario design, it is
especially acute when considering stress scenarios for market risk,
i.e., for portfolios of traded securities and derivatives. These port­
folios are typically marked to market as a matter of course, and risk
managed in the context of a value-at-risk (VaR) system. In practice,
this means that the hundreds of thousands (or more) of positions in
the trading book are mapped to tens of thousands of risk factors,
which are tracked on a (usually) daily basis and form the "data"
used to estimate risk parameters like volatilities and correlations.
Finding coherent outcomes in such a high dimensional space,
short of resorting to historical realizations, is daunting indeed.
Compounding the problem is the challenge of finding a scenario
in which the real and financial factors are jointly coherent. The
2009 SCA P had a rather simple scenario specification. The state
space had only three dimensions— G D P growth, unemployment,
and the house price index (HPI)— and the market risk scenario was
based in historical experience: an instantaneous risk factor impact
reflecting changes from June 30 to Decem ber 31, 2008. This
period represented a massive flight to quality, with the markets
experiencing the failure of at least one global financial institution
(Lehman), and risk premia at the time arguably placed a signifi­
cant probability on the kind of adverse real economic outcome
painted by the tri-variate SCA P scenario. This solution achieved
a loose coherence of the real and financial stresses. However, the
price that one pays for choosing a historical scenario is the usual
one: it does not test for anything new. Figures 15.3 and 15.4 com­
pare some of these risk factors (real GDP, unemployment, equity
and home prices indices) across the four US stress tests to date,
both to each other and to actual realizations since 2008 Q4.
For the 2011 E B A test, the supervisors specified over 70 risk
factors for the trading book, eight macro-factors for each of
21 countries (macro-factors such as G D P growth, inflation,
unem ploym ent, real estate price indices, both residential and
com m ercial, short and long term governm ent rates, and stock
prices), plus sovereign haircuts across seven maturity buck­
ets. The m acroeconom ic stress scenario was generated by
272 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
econom ists at the EC B with reference to the EU Commission
baseline econom ic forecast.
All supervisory stress tests to date have imposed the same sce­
nario on all banks. Naturally, any scenario may be more severe for
some banks and much less so for others, depending on the busi­
ness mix and geographic footprint. This one-size-fits-all approach
is analogous to the problem of regulatory vs. internal economic
capital models: the former is the same for all banks by design,
while the latter, being limited to a given bank, takes the particular
business mix of that bank into account directly. This problem of
same vs. specific stress scenarios becomes especially acute when
we move from crisis times, when there may be less debate about
what a relevant adverse scenario might look like, to "normal"
times. The US C C A R program, which has been in operation since
2011, recognized this problem and asks banks to submit results
using their own scenarios (baseline and stress) in addition to results
under the common supervisory stress scenario. This was an impor­
tant step forward from the 2009 SCAP: by asking banks to develop
their own stress scenario(s), thus revealing the particular sensitivi­
ties and vulnerabilities of their specific portfolio and business mix,
supervisors could learn what the banks themselves thought to be
the high risk scenarios. This is useful not just for micro-prudential
supervision— learning about the risk of a given bank— but also
for macro-prudential supervision, by allowing for the possibility
of learning about common risks across banks which may hitherto
have been undiscovered or under-emphasized. With this dual
approach, supervisors could compare results across banks from the
common scenario directly, without sacrificing risk-discovery.
15.4 E X E C U T IN G T H E S T R E S S
S C E N A R IO : L O S S E S A N D R E V E N U E S
With the macro-scenario in hand, how does one arrive at the
corresponding micro-outcomes: losses and revenues under
adverse m arket and m acroeconom ic conditions? To date, there
has been very little discussion in the public domain on how to
solve this problem , except perhaps for stress testing the trading
book. Indeed, one of the more im portant contributions of the
supervisory stress tests in the US and Europe has been the
accom panying m ethodology docum ents that have been dis­
closed by the supervisors, which are, understandably, more
heavily focused on the banking book.21
21 For SCAP, see http://w w w .federalreserve.gov/bankinforeg/
bcreg20090424a1.pdf. For EB A , see http://w w w .eba.europa
.eu/EU-wide-stress-testing/2011/The-EBA-publishes-details-of-it
s-stress-test-scena.aspx. For the 2 0 1 1 and 2012 C C A R , see http://
w w w .federalreserve.gov/new sevents/press/bcreg/bcreg20110318a 1
.p d f and http://w w w .federalreserve.gov/new sevents/press/bcreg/
bcreg20120313a1 .p d f respectively.
Modeling Losses
For a firm which is active in many markets (product and geogra­
phy), the first task is to map from the few macro-factors to the
many intermediate risk factors that drive losses for particular
products by geography. The EB A was forced to confront the
problem of geographic heterogeneity directly, since it spans 21
sovereign nations with rather different economies. US supervisors,
in stress testing an economic region only slightly smaller than that
of the EB A , left the task of accounting for the not-inconsiderable
geographic heterogeneity to individual firms. Regional differences
are critical in modeling losses for real estate lending (residential
and commercial), but are hardly limited to those products. Since
the US experiences regional business cycles— the national busi­
ness cycle obscures a considerable degree of variation across
states— nearly all lending has some geographic component. For
exam ple, credit card losses are especially sensitive to unemploy­
ment, and in July 2011, with the national rate at 9.1 %, the state-
level unemployment rate ranged from 3.3% in North Dakota to
12.9% in Nevada. Similar dynamics are at work in wholesale lend­
ing, particularly for SM E (small and medium enterprise) lending,
whose performance has a strong geographic component.
The problem of mapping from macro to more interm ediate risk
factors is not limited to geography. An interesting exam ple is
auto lending and leasing, where the collateral assets are used
cars. W hile auto sales invariable decline during a recession, and
the decline in 2008-2009 was unprecedented in the post-war
period, used car sales typically suffer less. Yes, households buy
few er cars in a recession, but if they do need to purchase a
car, it is relatively more likely to be a used car. Thus, even if the
default rate on auto loans increases significantly during a reces­
sion, the corresponding loss given default (LGD) or loss severity
need not. A useful indicator of the health of the used car mar­
ket, and thus the collateral of an auto lending portfolio, is the
Manheim index. O ver the course of the most recent recession
(Dec. 2007-June 2009), the index rose 4%, while total new auto
and light truck sales declined by 37%.
The problem of loose coupling of the loss severity to the busi­
ness cycle is not limited to auto loans. Acharya, Bharath, and
Srinivasan (2007) show that for corporate credit, an important
determ inant of LG D is w hether the industry of the defaulted
firm is in distress at the time of default. The authors make a
com pelling asset specificity argument: if the airline industry is in
distress, and a bank is stuck with the collateral on defaulted air­
craft loans or leases, it will be hard to sell those aircraft except
at very depressed prices. The healthcare sector may be relatively
robust at the tim e, as indeed it was in the recent recession, but
it is difficult to transform an airplane into a hospital.
The EB A disclosure on methodology is especially rich. In the
March 2011 document, for exam ple, detailed guidance is
provided on stressed probabilities of default (PDs) and stressed
LGDs. Note that such guidance presumes that a bank has imple­
mented an internal credit rating system for its commercial loan
portfolio. For a Basel II bank this may not be unreasonable, since
internal ratings, mapped to a common external scale such as
those used by the rating agencies, are a cornerstone of the
Accord. With a credit rating (internal or external) in hand, com­
puting stressed default rates for the portfolio becomes a straight­
forward exercise, either by assigning higher PDs to a given rating,
or by imposing a downward migration on the current portfolio.22
Since the EB A stress test was based on risk weighted assets
(RWA) computed using Basel II risk weights, which are ratings
sensitive, banks were forced to make use of stress migration
matrices to compute not only increased defaults (the last column
of the matrix), but also the entire future ratings distribution, to
arrive at the correct RWA value. The US stress tests were con­
ducted under Basel I risk weights, which are not obligor ratings
sensitive. The fuss about RWA calculations is important, since the
denominator of capital ratios, used to determine whether or not
a bank needs to raise capital, is RWA. Clearly, this complicates
any comparison of US and European stress test results.
Implementation in the trading book is more straightforward, and
has been discussed extensively in the public domain; see inter
alia Allen, Boudoukh, and Saunders (2004), Jorion (2007), or
Rebonato (2010). In a nutshell, existing positions are simply
repriced using the stress scenario risk factors, subject to the pro­
viso that the risk factor mapping problem, discussed in Section 3,
has been solved. The corresponding problem of stressing the
counterparty credit risk that comes with the activities of deriva­
tives has received less attention.23 Counterparty credit risk arises
when, in a derivative transaction which is revalued to the stress
scenario, the bank finds itself in the money (i.e., enjoys a deriva­
tive receivable), but cannot be sure that the counterparty to the
transaction will be solvent in order to make good on the pay­
ment. Thus, the value is discounted, where the discount is a func­
tion of the expected default likelihood of the counterparty under
the stress scenario, which is presumably higher than today. This
adjustment is called a credit value adjustm ent (CVA), and banks
with significant derivative activities manage CVA as a matter of
course. As Canabarro (2010) and Hopper (2010) point out, the
modeling challenge of stress testing counterparty credit risk is
considerable. Not only does the PD of the counterparty change
in a stressful environment, the exposure does likewise. Thus, any
CVA stress test involves two distinct simulation exercises. If the
22 O f the 90 participating banks, 59 w ere so-called IRB (internal ratings
based) banks, meaning that their internal m odels w ere validated to the
supervisor's satisfaction for at least one regulatory portfolio (e.g ., corpo­
rate, com m ercial real estate, etc.). Non-IRB banks w ere given very non­
specific guidance (EB A , 2011, Section 5.5.1.1).
23 For an excellent treatm ent, see Canabarro (2010) and Hopper (2010).
Chapter 15 Stress Testing Banks ■ 273
 2009 SCAP P/L coverage
</) 5
CD 4
</)
</) Median:58%
O 3
2
1
0L 0 n
Q-
U
-1
u <
x CD
LU C
66 >
E
o
o H
<
CD Z
o
CD
CD
4CD-»
£
CD
Q.
•

u
CD
<
2012 CCAR P/L coverage
5
4
(/>
a >
3 Median:63%
i/)
(/>
2
o 1
0 1
Z
-1 □
Q_ -2
Q_ X CD u
<
<D 4—* 4-» CO
u
<J CL w— > o if) CD
o
LU C • _CD C CD if)
o 66 > CD
__I z CD =3 LO I
E E o o d

<
CD +-* C Q_
CD Z
o 32 Q_ CJ 4—1
CD CD CD *6 ) f- £
CD 4CD-» o CD
4—
LO
* CD
LO
CD
C
•

DC 4—* D
Q. C CD CO
<
CD O CD 4-J
u CD LO
O

2011 EBA P/L coverage (adverse scenario)

+-»
c
V) 3
CD
CD
E
V)
V)
2 Median:66%
_0
a

■_ i illl.ll
CD "v)
Q- U ) 1 i in mi h II
0 I knt m
E • *c*
m n iiiiiiiiiin m -i« 1■i . 1111111. ii n ii m i ii m i n n ii
1
•
c
i
CD
CD
-
1 r
CD
-1
0 0 LD N O O O C N J ^ N O O ^ O C N ^ v O O O O C N ^ v O C O O C N j C N ^ s o O ^ ^ r O L n N O ^ O O u i N O ^ C D L n ^ O N
o O O o ^ - c \ j r s j c \ j c N j ( N O ^ - N O s O v O O O N r \ N r ss r s» c o c o ^ - ^ - ^ - c o Ov f ^ r^ r^ r 0 r^ ,:^ ^ ' ^ ^ t ,::t i ; LD L^ c o c o L r )
o O_ O
_000000000000000000000000000000000000g00000
|— L U > - L U L U L U L U L U L U ^ ^ L O C O L O L O L O C O L O C O L O L O L O C O l i _ Q C : Q C : G Q G Q ^ C £ ^ u -j l l , I— f“ l 0 ^ t " L U L U LO
< CD ( J Q Q Q Q Q Q Q Q LU LU LU LU LU LU LU LU LU LU LU LU L L U - O O O O O Q_ Q_ to CO

Fiqure 15.1 Projected coverages of losses with profits in the 2009 SCAP and 2011 EBA stress tests.

collateral posted by the counterparty is anything other than conditions. Banks' total incom e can be divided roughly into
cash or a cash equivalent, a revaluation of that collateral interest and non-interest incom e. The interest income is clearly
under the same stress scenario needs to be added to the a function of the yield curve and credit spreads posited under
process. 24 the stress scenario, but the net im pact of rising or falling rates
on bank profitability remains am biguous, perhaps in part
because of interest rate hedging strategies (English, 2002;
Modeling Revenues Purnanandam , 2007). The im pact of stress scenarios on the
Im plem enting stress scenarios on the revenue side of the equa­ noninterest incom e, which includes service charges, fiduciary,
tion remains largely a black box, and seem s far less well devel­ fees, and other income (e.g ., from trading), is far harder to
oped than stress testing for losses. N either the 2009 S C A P nor assess, and there has been precious little discussion of its
the otherw ise richly docum ented 2011 E B A disclosures determ inants in the literature. This is concerning, since Stiroh
devoted much space or revealed much detail about the m eth­ (2004) shows that not only has the share of noninterest income
ods and approaches for com puting revenues under stressful2
*
4 in US banks been rising steadily, from 25% in 1985 to 43% in
2001, but it is associated with a greater volatility and lower
risk-adjusted returns. If we com pare the 2009 SCAP, the 2011
E B A and the 2012 C C A R stress tests, the median bank in the
24 There is the added com plication that major derivatives dealers actively
manage CVA risk using a range of strategies and instruments that them ­ US was able to cover about 58% of its total projected losses
selves vary in price and availability depending on market conditions. with profits (including reserve releases, if any) in 2009 and 63%

274 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Two year dynamic forecast
Starting Q1 end
balance Q1 income balance
sheet j 7 statem ent sheet
r\
L L
A P&L
E E
V /
Capital
and
iquidity
ratios
F ia u re 15.2 Stress testing balance sheet and income statement dynamics.
o r
in 2012, com pared with 66% in the European case. As
Figure 15.1 shows, there is a considerable degree of variability
across banks, especially in the E B A test, where in som e cases
profits are projected to outpace losses 4:1, even under the
stress scenario!
Modeling the Balance Sheet
Recall that capital adequacy is defined in term s of a capital
ratio, roughly capital over assets. O f course, both the num era­
tor and denom inator are nuanced. All supervisory stress tests
have insisted, to varying degrees, that the relevant form of
capital be common equity. The 2010 C E B S test allowed for
some forms of hybrid capital which are typical of state partici­
pations, but the requirem ents were tightened a year later. As
was discussed in Section 4.1, the denom inator is typically risk-
w eighted assets (RW A), where the risk weights are determ ined
by the prevailing regulatory capital regim e, namely Basel I (in
the US cases of the SC A P and C C A R ) and Basel II (in the Euro­
pean stress tests). The many subtleties of what this implies are
beyond the scope of this paper; suffice it to say that a bank
may be forced to raise capital under one regime but not the
other, and there is no way to know which regime will result in a
more favorable treatm ent without knowing about the portfolio
in considerable detail.
Regardless of the risk w eight regim e, determ ining the post­
stress capital adequacy requires modeling of both the income
statem ent and the balance sheet, both flows and stocks, over
the course of the stress test horizon, which is typically two
25 PPNR calculations in the 2012 C C A R were net of operational risk
related losses and O R EO expenses, as well as mortgage repurchase and
put-back costs, meaning that these items were not reported separately
(though they totaled $115 bn for all 19 banks) (Board of Governors, 2012).
Q 2 end Q 8 end
Q 2 income balance balance
statem ent sheet sheet
A
Q/
years. This is illustrated in Figure 15.2 below. The point of
departure is the current balance sheet, at which point the bank
meets the required capital (and, if included, liquidity) ratios. The
starting balance sheet generates the first quarter's income and
loss, which in turn determ ines the quarter-end balance sheet.
The m odeler is then faced with the problem of considering the
nature and amount of new assets originated and/or sold during
the quarter, and any other capital depleting or conserving
actions such as acquisitions or spin-offs, dividend changes or
share (re-)purchase or issuance programs, including em ployee
stock and stock option programs. The problem of balance sheet
modeling exists under a static (be it in raw form , as in the 2011
EB A , or in risk weighted form, as in the 2009 SCA P) or dynamic
balance sheet assumption. The bank should not drop below the
required capital (and liquidity) ratios in any quarter. Moreover, at
the end of the stress horizon, the bank needs to estim ate the
amount of reserves needed to cover expected losses on loans
and leases for the following year. In this way, the stress tests are
really three years (or T + 1 years for a T-year stress test).
15.5 S T R E S S T E S T IN G D IS C L O S U R E
Stress testing is here to stay, whether because it is just good
risk management practice, or because it is enshrined in legisla­
tion (through the Dodd-Frank Act). In the debate on disclosure
regimes, it is not clear that more is always better. We divide the
discussion into crisis and noncrisis or normal times, with the simple
point that normal times may not require or even desire the same
degree of transparency as is clearly needed in times of crisis.
We have seen very large differences in disclosure across the dif­
ferent supervisory stress tests, as summarized in Tab lel 5.1. The 2
6
26 The horizon is 9 quarters for the C C A R , as it is based on Q 3, not Q 4,
balance sheets.
Chapter 15 Stress Testing Banks ■ 275
Real GDP growth
Stress-test scenarios vs. recent historical observations
Stressed quarter
C C A R 1 from 2010 Q4
C C A R 2 from 2011 Q3
— C C A R 3 "severely adverse" from 2012 Q3
— C C A R 3 "adverse" from 2012 Q3
— S C A P "more adverse scenario" from 2008 Q4
— Historical from 2008 Q4
Fig u re 15.3 US real GDP and unemployment scenarios compared
S o u rce: Fed, The Supervisory Capital Assessm ent Program : Design and Im plem entation, 24 April 2009; Fed, Com prehensive Capital Analysis and
Review: O bjectives and O verview , 18 March, 2011; Fed, "Com prehensive Capital Review " docum ent and "C apital Plan review " 22 N ovem ber 2011;
Fed, "Supervisory Scenarios" 15 N ovem ber 2012; Datastream .
SC A P in 2009 opened Pandora's box by disclosing projected
stress losses for each of the 19 participating banks, for eight dif­
ferent categories or asset classes, as well as resources other than
capital for absorbing losses (mostly pre-provision net revenue
and reserve releases, if any). Until then, regulatory disclosures
(e.g., Y-9C reports for US bank holding companies) reported only
realized losses (the past), not projected losses (a possible future).
This allowed the market to check the severity of the stress test
easily, not just in term s of the scenario, but also, and much more
importantly, in term s of the resulting outcomes at the bank
level. Given the crisis of confidence which was prevalent in the
market at the tim e, this amount of transparency was crucial. Two
years later, the C C A R displayed a radically different disclosure
regime: only the macro-scenario was published, with no bank-
level results. The only indications of bank-level outcomes were
the subsequent dividend and other capital actions announced by
some banks: banks which were allowed to raise their dividends
were interpreted as having "passed" the stress test. The market
digested this m eager information event without a hiccup.
Dodd-Frank, however, requires the Fed to disclose the results of
regular stress testing, and the 2012 C C A R , with the
276 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Unemployment rate
Stress-test scenarios vs. recent historical observations
Stressed quarter
------- C C A R 1 from 2010 Q4
------- C C A R 2 from 2011 Q3
C C A R 3 "severely adverse" from 2012 Q3
------- C C A R 3 "adverse" from 2012 Q3
SC A P "more adverse scenario" from 2008 Q4
— — Historical from 2008 Q4
accompanying rules (final and proposed27), gave a glimpse of
what regular disclosure might look like. The 2012 C C A R dis­
closed nearly the same level of detail as the 2009 SCAP, namely
bank-level loss rates and dollar losses by major regulatory asset
classes (following the categories of the FR Y-9C bank holding
company reports): first and second lien m ortgages, commercial
and industrial (C&l) lending, C R E , credit cards, other consumer,
and other loans. In addition, the Fed reported the dollar PPNR,
gains/losses on the AFS/H TM securities portfolio, and trading
and counterparty losses for those firms who were required to
conduct the trading book stress.28 Again, as with the 2009 SCAP,
the numbers reported were supervisory estim ates, not the banks'
own estim ates of losses (and PPNR) under the stress scenario.
By contrast, the 2011 Irish and 2011 Europe-wide EB A stress tests,
both of which were disclosed after the C C A R , were consider­
able in their detail, including comparisons of bank and third-party
27 http://w w w .gpo.gov/fdsys/pkg/FR-2011-12-01/p d f/2011-30665.pdf.
28 In 2012, these w ere the six institutions with the largest trading
portfolios.
Dow Jones total stock market index level House Price index
Stress-test scenarios vs. recent historical observations Stress-test scenarios vs. recent historical observations

18,000 -|

16,000 -

14.000 -

12.000 -

10,000 -

8,000 -

6,000 -

4.000 -

2.000 -

0 H---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1---- 1
0 1 2 3 4 5 6 7 8 9 10 11 12 13
Stressed quarter Stressed quarter
C C A R 1 from 2010 Q4 ------- C C A R 1 from 2010 Q4
------- C C A R 2 from 2011 Q3
C C A R 2 from 2011 Q3
C C A R 3 "severely adverse" from 2012 Q3
C C A R 3 "severely adverse" from 2012 Q3
------- C C A R 3 "adverse" from 2012 Q3
C C A R 3 "adverse" from 2012 Q3
S C A P "more adverse scenario" from 2008 Q4
Historical from 2008 Q4 — — Historical from 2008 Q4
Fiq u re 1 5 .4 US equity and house price indices compared
S o u rce: Fed, The Supervisory Capital A ssessm ent Program : Design and Im plem entation, 24 April 2009; Fed, Com prehensive Capital Analysis and
Review: O bjectives and O verview , 18 March, 2011; Fed, "Com prehensive Capital Review " docum ent and "C apital Plan review " 22 N ovem ber 2011;
Fed, "2013 Supervisory Scenarios" 15 N ovem ber 2012; Datastream .

estimates of losses in the Irish case (revealing the bias that any
bank is likely to have when estimating its own potential losses),
and data in electronic, downloadable form in the EBA case. Ire­
land in particular was suffering from an acute credibility problem,
having emerged from the C EB S stress test with flying colors in
July 2010, only to require massive external aid four months later.
This difference in experiences between Europe and the US
provides some hints on how to design a disclosure regime dur­
ing "norm al" tim es. The discussion of the benefits and costs of
stress test disclosures by Goldstein and Sapra (2012) is helpful.
They argue persuasively that in a world with frictions and stra­
tegic environm ents, the benefits (better market discipline) may
not outweigh the costs: banks may make poor portfolio choices
which are designed to maximize the chance of passing the test
(window dressing), thereby giving up longer term value; while
traders may place too much weight on the public information of
stress test disclosure and lose their incentive to produce private
information about the banks; and finally, with the information
content of market prices having been dam aged, market disci­
pline is harmed, and supervisors will find market prices less use­
ful for policy decisions (micro- as well as macro-prudential).
Clearly, some disclosure is still preferable to no disclosure, and
Goldstein and Sapra propose the disclosure of aggregated but
not necessarily bank-specific results, with sufficient information
about category outcom es (loss rates by major asset class, for
instance). Aggregation has the advantage of being less wrong,
since the idiosyncratic errors in estimating bank conditions
under hypothesized stress scenarios are averaged out. In this
way, supervisors can still provide the useful macro-prudential
information which only they can provide— loss rates by asset
class, total capital decline in the system (or significant fraction
of the banking system)— without drowning out signals about
individual banks from the market participants them selves. Such
a disclosure gives the market an anchor point for system-wide
possibilities, without diluting the incentive to dig hard into a
particular firm's financials.
During tim es of crisis, with the enormous uncertainty about
the health of the banking system , the benefit of detailed bank-
specific stress test disclosure is significant, given the ability of
supervisors to assess the health of individual firms correctly, and
the resulting inability of the market distinguish between a good
bank and a bad. Indeed, Goldstein and Sapra argue that stress

Chapter 15 Stress Testing Banks ■ 277

test disclosures, when more disaggregated, ought to be accom ­
panied by detailed descriptions of the exposures of the banks.
This is precisely what was done in the Irish bank stress test of
2011, an acute case of loss of confidence (and a subsequent
regaining of confidence), as well as in the 2011 EB A stress test.
Because the credibility of European supervisors was rather low
by that point, only with a very detailed disclosure, bank by bank,
of their exposures by asset class, by country and by maturity
bucket, could the market do its own math and arrive at its own
conclusions.
Between March 2009 and March 2011, the 19 SCA P banks had
raised about $300 bn in capital and the S&P500 had increased
by 65% ; by the end, the econom y was no longer in recession,
and, arguably, the supervisory agencies had regained credibility.
The non-event of the nondisclosure of the 2011 C C A R suggests
that the market seem s content to live in a state of "sym m etric
ignorance", to borrow a term from Dang, Gorton, and Holm-
strom (2010). O f course, this might change were the economy to
receive another adverse shock, but until it does, it is not clear
that an EBA-like disclosure regime is necessarily either desirable
or stability-enhancing. In contrast, Europe is not yet out of the
woods (at the time of writing); yet even the EB A was not limit­
less with its disclosure of the 2011 stress test results. It is worth
noting that funding liquidity was also stressed for banks, but
without disclosing the results. Because liquidity positions are
highly dynamic, and thus subject to rapid change, snapshot dis­
closure, especially with a delay (the as-of date for the 2011 EBA
stress test was Y E 2010), is unlikely to be informative at the time
of disclosure.29
Recall the discussion in the introduction: regulatory capital
models (risk weighting), internal economic capital models and
stress testing all have the same goal, namely to determ ine the
amount of capital needed to support the business (risk taking)
of the bank. Both regulatory and economic capital models (and
especially the former) evolve very slowly, and thus have difficulty
in adapting to financial innovations and rapidly changing macro
conditions. Indeed, some of the innovation is motivated by those
slowly evolving, one-size-fits-all regulatory capital rules. M ore­
over, bank balance sheets are notoriously opaque and subject to
easy-to-hide asset substitution (higher risk for lower risk assets);
see Morgan (2002). Stress tests, especially macro-prudential
supervisory stress tests, are adapted to the then-current envi­
ronment and bank portfolios by construction. Between balance
sheet opacity, asset substitution and regulatory arbitrage, it is
easy to see the value of a "pop quiz" in the form of bespoke
stress testing (Acharya, Mehran, Schuermann, & Thakor, 2011).
29 Reuters, Sept. 2, 2011, " E B A w on't seek disclosure of bank liquidity".
A vailable at http://w w w .reuters.com /article/2011/09/02/
id U S L5 E7 K 2 3 P I2 0 1 10902.
278 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
C O N C L U S IO N
The problem of sizing the amount of capital needed to support a
bank's risk taking is not new, but the use of broad-based super­
visory stress tests for an entire banking system is. The first use of
such tests was in the US in 2009, and its success there has made
it the supervisory and risk management hammer for dealing with
all nails. A critical com ponent of the exercise is the disclosure of
the results. The reason why stress testing became an imperative
was precisely because existing approaches that were publicly dis­
closed, such as regulatory capital ratios, were no longer informa­
tive, and were heavily (if not entirely) discounted by the market.
In order to regain their credibility, supervisory authorities needed
to disclose enough to allow the market to "check the m ath".
However, broad-based supervisory stress testing has not been
universally successful, as the 2010-2011 European experience
has shown. Nor is it clear how useful such broad supervisory
stress testing with concom itant disclosure would be as a m at­
ter of routine. Its value in the crisis was undoubtedly due to its
"pop quiz" nature. It was sprung on the banks at short notice,
and thus was very difficult for them to manipulate through care­
ful pre-positioning; and it was tailored to the situation at hand,
genuinely revealing new information to all participants and the
public. As a result, trust was regained. O nce that trust has been
re-established, the cost-benefit of stress testing disclosures may
tip away from bank-specific towards more aggregated informa­
tion. This still provides the m arket with unique information (after
all, supervisors have access to proprietary bank data) without
taking away market participants' incentives to produce private
information and trade on it— with all the downstream benefits of
information-rich prices and m arket discipline.
A CKN O W LED G M EN TS
I would like to thank John Fell, Mark Flannery, Itay Goldstein,
Bengt Holmstrom, Bill Janew ay, Umit Kaya, Ugur Koyluoglu,
Andy Kuritzkes, John Lester, Clinton Lively, Hashem Pesaran,
Brian Peters, Barry Schachter, Hal Scott, and members of the
Com m ittee for Capital Markets Regulation for helpful discus­
sions and suggestions. I am also thankful to Cary Lin for helpful
research assistance, as well as the participants in the workshop
on "Predicting Rare Events" sponsored by the IF/Federal
Reserve Bank of San Francisco. All errors remain mine, of course.
References
Acharya, V. V., Bharath, S. T., & Srinivasan, A . (2007). Does
industry-wide distress affect defaulted firm s? Evidence from
creditor recoveries. Journal o f Financial Econom ics, 85, 787-821.
Acharya, V., Mehran, H., Schuerm ann, T., & Thakor, A . (2011).
R o b u st capital regulation. Federal Reserve Bank of New York
Staff report no. 490.
Allen, L., Boudoukh, J ., & Saunders, A . (2004). U nderstanding
m arket, cred it and operational risk: the value at risk approach.
Blackwell: New York, NY.
Bangia, A ., Diebold, F. X ., Kronimus, A ., Schagen, C ., &
Schuerm ann, T. (2002). Ratings migration and the business cycle,
with applications to credit portfolio stress testing. Journal o f
Banking and Finance, 26(2-3), 235-264.
Berkowitz, J . (2000). A coherent fram ework for stress testing.
Journal o f Risk, 2, 1-11.
Board of Governors of the Federal Reserve System (2012). C om ­
prehensive capital analysis and review 2012: m ethodology and
results for stress scenario projections. 13 March, 2012. Available
at: http://w w w .federalreserve.gov/new sevents/press/bcreg/
bcreg20120313a1 .pdf.
Canabarro, E. (2010). Pricing and hedging counterparty risk: les­
sons relearned? In E. Canabarro (Ed.), C ounterparty cred it risk
(C hapter 6). London, UK: Risk Books.
Com m ittee on the Global Financial System (2001). A survey of
stress tests and current practice at major financial institutions.
Available at: http://w w w .bis.org/publ/cgfs18.htm .
Dang, T.V., Gorton, G ., & Holmstrom, B. (2010). Financial crises and
the optimality o f d e b t for liquidity provision. Working paper. Avail­
able at: http://mfi.uchicago.edu/publications/papers/ignorance-
crisis-and-the-optimality-of-debt-for-liquidity-provision.pdf.
English, W. B. (2002). Interest rate risk and bank net interest
margins. BIS Q uarterly Review , D ecem b er, 67-82.
European Banking Authority (2011). 2011 EU-wide stress test:
methodological note. 18 March 2011. Available at: http://www
.eba.europa.eu/EU-w ide-stress-testing/2011/The-EBA-publishes-
details-of-its-stress-test-scena.aspx.
Fender, I., G ibson, M. S., & Mosser, P. C . (2001). An international
survey of stress tests. Current Issues in Econom ics and Finance,
7(10), Federal Reserve Bank of New York.
Flannery, M. J . (2012). M easuring equity capital fo r stress-testing
large financial institutions. Working paper.
Foglia, A . (2008). Stress testing cred it risk: a survey o f authori­
ties' approaches. Banca d'ltalia occasional paper, No. 37.
G oldstein, I., & Sapra, H. (2012). Should banks' stress te st results
b e d isclo se d ? An analysis o f the co sts and ben efits. Working
paper. Available at: http://finance.wharton.upenn.edu/~itayg/
Files/disclosure.pdf.
Gupton, G . M ., Finger, C ., & Bhatia, M. (1997).
C red itM etricsT M — technical docum ent. This version: April 2.
J .P Morgan. Available at: http://w w w .defaultrisk.com /_pdf6j4/
creditm etrics_techdoc.pdf.
Hopper, G . (2010). Stress testing and scenario analysis: some
second generation approaches. In E. Canabarro (Ed.), Counter­
party credit risk (C hapter 71). London, UK: Risk Books.
Jo rio n, P. (1996). Value at risk: the new benchm ark for managing
financial risk (1st ed.). New York, NY: M cGraw Hill.
Jo rio n, P. (2007). Value at risk: the new benchm ark for managing
financial risk (3rd ed.). New York, NY: M cGraw Hill.
Koyluoglu, H. U., & Hickman, A . (1998). Credit risk: reconcilable
differences. Risk, 7 7(10), 56-62.
Kupiec, P. H. (1998). Stress testing in a value at risk fram ework.
Journal o f D erivatives, 6(1), 7-24.
Kuritzkes, A ., & Scott, H. (2009). Markets are the best judge of
bank capital. Financial Tim es, Septem ber 23.
Lester, J ., Reynolds, P., Schuermann, T., & W alsh, D. (2012).
Stra teg ic capital: defining an effective real w orld view o f capital.
O liver Wyman financial services report. Available at: http://www
.oliverwym an.com /strategic-capital-defining-an-effective-real-
world-view-of-capital.htm .
Morgan, D. P. (2002). Rating banks: risk and uncertainty in an
opaque industry. Am erican Econom ic Review , 92(4), 874-888.
Purnanandam, A . (2007). Interest rate risk m anagem ent at com ­
mercial banks: an em pirical investigation. Journal o f M onetary
Econom ics, 54, 1769-1808.
Rebonato, R. (2010). C oh eren t stress testin g: a Bayesian
approach to the analysis o f financial stress. New York: John
W iley & Sons.
Stiroh, K. (2004). Diversification in banking: is noninterest
income the answer? Journal o f M oney, C redit and Banking,
36(5), 853-882.
W ilde, T. 1997. CreditRisk+ — a credit risk m anagem ent fram e­
work. Available at: http://www.csfb.com /institutional/research/
assets/creditrisk.pdf.
W ym an, O . (2012a). Bank of Spain stress testing exercise. A vail­
able at: http://w w w .bde.es/w ebbde/G AP/Secciones/SalaPrensa/
Inform acionlnteres/ReestructuracionSectorFinanciero/Ficheros/
en/inform e_oliverw ym ane.pdf.
W ym an, O . (2012b). A sset quality review and bottom-up stress
test exercise. Available at: http://w w w .bde.es/f/webbde/
SSICO M /20120928/inform e_ow 280912e.pdf.
Chapter 15 Stress Testing Banks ■ 279
 Learning Objectives
A fter com pleting this reading you should be able to:

Explain how risks can arise through outsourcing activities Describe topics and provisions that should be addressed
to third-party service providers, and describe elem ents of in a contract with a third-party service provider.
an effective program to manage outsourcing risk.

Explain how financial institutions should perform due dili­

gence on third-party service providers.

E x c e rp t is Supervisory Le tte r SR 13-19/CA 13-21 from the Board o f G overnors o f the Federal R eserve System , D ece m b er 2013.

281
16.1 P U R P O S E
In addition to traditional core bank processing and information
technology services, financial institutions1 outsource operational
activities such as accounting, appraisal m anagem ent, internal
audit, human resources, sales and m arketing, loan review, asset
and wealth m anagem ent, procurem ent, and loan servicing. The
Federal Reserve is issuing this guidance to financial institutions
to highlight the potential risks arising from the use of service
providers and to describe the elem ents of an appropriate ser­
vice provider risk m anagem ent program. This guidance supple­
ments existing guidance on technology service provider (TSP)
risk,1
2 and applies to service provider relationships where busi­
ness functions or activities are outsourced. For purposes of this
guidance, "service providers" is broadly defined to include all
entities3 that have entered into a contractual relationship with a
financial institution to provide business functions or activities.
16.2 R ISK S FR O M T H E U SE
O F S E R V IC E P R O V ID E R S
The use of service providers to perform operational functions
presents various risks to financial institutions. Some risks are
inherent to the outsourced activity itself, whereas others are
introduced with the involvement of a service provider. If not
managed effectively, the use of service providers may expose
financial institutions to risks that can result in regulatory action,
financial loss, litigation, and loss of reputation. Financial institu­
tions should consider the following risks before entering into
and while managing outsourcing arrangem ents.
• Com pliance risks arise when the services, products, or activi­
ties of a service provider fail to com ply with applicable U.S.
laws and regulations.
• C oncentration risks arise when outsourced services or prod­
ucts are provided by a limited number of service providers or
are concentrated in limited geographic locations.
• Reputational risks arise when actions or poor perform ance of
a service provider causes the public to form a negative opin­
ion about a financial institution.
1 For purpose of this guidance, a "financial institution" refers to state
m em ber banks, bank and savings and loan holding com panies (includ­
ing their nonbank subsidiaries), and U.S. operations of foreign banking
organizations.
2 Refer to the ' F F IE C ' O utsourcing Technology Services B o o k let (June
2004) at http://ithandbook.ffiec.gov/it-booklets/outsourcing-technology-
services.asp x.
3 Entities may be a bank or nonbank, affiliated or non-affiliated, regu­
lated or non-regulated, or dom estic or foreign.
282 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• Country risks arise when a financial institution engages a
foreign-based service provider, exposing the institution to
possible econom ic, social, and political conditions and events
from the country where the provider is located.
• Operational risks arise when a service provider exposes a finan­
cial institution to losses due to inadequate or failed internal
processes or systems or from external events and human error.
• Legal risks arise when a service provider exposes a financial
institution to legal expenses and possible lawsuits.
16.3 B O A R D O F D IR E C T O R S
A N D S E N IO R M A N A G E M E N T
R E S P O N S IB IL IT IE S
The use of service providers does not relieve a financial insti­
tution's board of directors and senior m anagem ent of their
responsibility to ensure that outsourced activities are conducted
in a safe-and-sound manner and in com pliance with applicable
laws and regulations. Policies governing the use of service
providers should be established and approved by the board
of directors, or an executive com m ittee of the board. These
policies should establish a service provider risk m anagem ent
program that addresses risk assessm ents and due diligence,
standards for contract provisions and considerations, ongoing
monitoring of service providers, and business continuity and
contingency planning.
Senior m anagem ent is responsible for ensuring that board-
approved policies for the use of service providers are appro­
priately executed. This includes overseeing the developm ent
and implementation of an appropriate risk m anagem ent and
reporting fram ework that includes elem ents described in this
guidance. Senior m anagem ent is also responsible for regularly
reporting to the board of directors on adherence to policies
governing outsourcing arrangem ents.
16.4 S E R V IC E P R O V ID E R R ISK
M A N A G EM EN T PROGRAM S
A financial institution's service provider risk m anagem ent pro­
gram should be risk-focused and provide oversight and controls
com m ensurate with the level of risk presented by the outsourc­
ing arrangem ents in which the financial institution is engaged.
It should focus on outsourced activities that have a substantial
im pact on a financial institution's financial condition; are critical
to the institution's ongoing operations; involve sensitive cus­
tom er information or new bank products or services; or pose
material com pliance risk.
The depth and form ality of the service provider risk m anage­
ment program will depend on the criticality, com plexity, and
number of material business activities being outsourced. A com ­
munity banking organization may have critical business activities
being outsourced, but the number may be few and to highly
reputable service providers. Therefore, the risk m anagem ent
program may be sim pler and use less elem ents and consider­
ations. For those financial institutions that may use hundreds or
thousands of service providers for numerous business activities
that have material risk, the financial institution may find that they
need to use many more elem ents and considerations of a ser­
vice provider risk m anagem ent program to manage the higher
level of risk and reliance on service providers.
W hile the activities necessary to im plem ent an effective service
provider risk m anagem ent program can vary based on the scope
and nature of a financial institution's outsourced activities, effec­
tive programs usually include the following core elem ents:
A. Risk assessm ents;
B. Due diligence and selection of service providers;
C. Contract provisions and considerations;
D. Incentive com pensation review;
E. O versight and monitoring of service providers; and
F. Business continuity and contingency plans.
A. Risk Assessments
Risk assessm ent of a business activity and the im plications of
performing the activity in-house or having the activity per­
form ed by a service provider are fundam ental to the decision
of w hether or not to outsource. A financial institution should
determ ine w hether outsourcing an activity is consistent with
the strategic direction and overall business strategy of the
organization. A fter that determ ination is m ade, a financial insti­
tution should analyze the benefits and risks of outsourcing the
proposed activity as well as the service provider risk, and deter­
mine cost im plications for establishing the outsourcing arrange­
ment. Consideration should also be given to the availability
of qualified and experienced service providers to perform the
service on an ongoing basis. Additionally, m anagem ent should
consider the financial institution's ability and expertise to pro­
vide appropriate oversight and m anagem ent of the relationship
with the service provider.
This risk assessm ent should be updated at appropriate intervals
consistent with the financial institution's service provider risk
m anagem ent program. A financial institution should revise its
risk mitigation plans, if appropriate, based on the results of the
updated risk assessm ent.
Chapter 16 Guidance on Managing Outsourcing Risk
B. Due Diligence and Selection of Service
Providers
A financial institution should conduct an evaluation of and
perform the necessary due diligence for a prospective service
provider prior to engaging the service provider. The depth and
form ality of the due diligence perform ed will vary depending
on the scope, com plexity, and im portance of the planned out­
sourcing arrangem ent, the financial institution's fam iliarity with
prospective service providers, and the reputation and industry
standing of the service provider. Throughout the due diligence
process, financial institution technical experts and key stake­
holders should be engaged in the review and approval process
as needed. The overall due diligence process includes a review
of the service provider with regard to:
1. Business background, reputation, and strategy;
2 . Financial perform ance and condition; and
3 . O perations and internal controls.
1. Business Background, Reputation, and Strategy
Financial institutions should review a prospective service pro­
vider's status in the industry and corporate history and qualifi­
cations; review the background and reputation of the service
provider and its principals; and ensure that the service provider
has an appropriate background check program for its em ployees.
The service provider's experience in providing the proposed ser­
vice should be evaluated in order to assess its qualifications and
competencies to perform the service. The service provider's busi­
ness model, including its business strategy and mission, service
philosophy, quality initiatives, and organizational policies should be
evaluated. Financial institutions should also consider the resiliency
and adaptability of the service provider's business model as factors
in assessing the future viability of the provider to perform services.
Financial institutions should check the service provider's references
to ascertain its performance record, and verify any required licenses
and certifications. Financial institutions should also verify whether
there are any pending legal or regulatory compliance issues (for
example, litigation, regulatory actions, or complaints) that are asso­
ciated with the prospective service provider and its principals.
2. Financial Performance and Condition
Financial institutions should review the financial condition of the
service provider and its closely-related affiliates. The financial
review may include:
• The service provider's most recent financial statem ents and
annual report with regard to outstanding com m itm ents, capi­
tal strength, liquidity and operating results.
■ 283
• The service provider's sustainability, including factors such as
the length of tim e that the service provider has been in busi­
ness and the service provider's growth of market share for a
given service.
• The potential im pact of the financial institution's business
relationship on the service provider's financial condition.
• The service provider's com m itm ent (both in term s of financial
and staff resources) to provide the contracted services to the
financial institution for the duration of the contract.
• The adequacy of the service provider's insurance coverage.
• The adequacy of the service provider's review of the financial
condition of any subcontractors.
• O ther current issues the service provider may be facing that
could affect future financial perform ance.
3. Operations and Internal Controls
Financial institutions are responsible for ensuring that services
provided by service providers comply with applicable laws and
regulations and are consistent with safe-and-sound banking
practices. Financial institutions should evaluate the adequacy of
standards, policies, and procedures. Depending on the charac­
teristics of the outsourced activity, some or all of the following
may need to be reviewed:
• Internal controls;
• Facilities m anagem ent (such as access requirements or shar­
ing of facilities);
• Training, including com pliance training for staff;
• Security of systems (for exam ple, data and equipm ent);
• Privacy protection of the financial institution's confidential
information;
• M aintenance and retention of records;
• Business resumption and contingency planning;
• Systems developm ent and m aintenance;
• Service support and delivery;
• Em ployee background checks; and
• Adherence to applicable laws, regulations, and supervisory
guidance.
C. Contract Provisions and Considerations
Financial institutions should understand the service contract
and legal issues associated with proposed outsourcing arrange­
ments. The term s of service agreem ents should be defined in
written contracts that have been reviewed by the financial insti­
tution's legal counsel prior to execution. The characteristics of
the business activity being outsourced and the service provider's
284 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
strategy for providing those services will determ ine the terms
of the contract. Elem ents of well-defined contracts and service
agreem ents usually include:
• S c o p e : Contracts should clearly define the rights and respon­
sibilities of each party, including:
• Support, m aintenance, and custom er service;
• Contract tim efram es;
• Com pliance with applicable laws, regulations, and regula­
tory guidance;
• Training of financial institution em ployees;
• The ability to subcontract services;
• The distribution of any required statem ents or disclosures
to the financial institution's custom ers;
• Insurance coverage requirem ents; and
• Terms governing the use of the financial institution's prop­
erty, equipm ent, and staff.
• C o st and co m p e n sa tio n : Contracts should describe the
com pensation, variable charges, and any fees to be paid
for non-recurring items and special requests. Agreem ents
should also address which party is responsible for the pay­
ment of any legal, audit, and examination fees related to
the activity being perform ed by the service provider. W here
applicable, agreem ents should address the party responsible
for the expense, purchasing, and m aintenance of any equip­
ment, hardware, software or any other item related to the
activity being perform ed by the service provider. In addition,
financial institutions should ensure that any incentives (for
exam ple, in the form of variable charges, such as fees and/or
commissions) provided in contracts do not provide potential
incentives to take im prudent risks on behalf of the institution.
• R ig h t to a u d it: Agreem ents may provide for the right of the
institution or its representatives to audit the service provider
and/or to have access to audit reports. Agreem ents should
define the types of audit reports the financial institution will
receive and the frequency of the audits and reports.
• E sta b lish m e n t and m o n ito rin g o f p e rfo rm a n ce sta n d a rd s:
Agreem ents should define m easurable perform ance stan­
dards for the services or products being provided.
• C o n fid e n tia lity and se c u rity o f in fo rm a tio n : Consistent with
applicable laws, regulations, and supervisory guidance, ser­
vice providers should ensure the security and confidentiality
of both the financial institution's confidential information and
the financial institution's custom er information. Information
security measures for outsourced functions should be viewed
as if the activity were being perform ed by the financial insti­
tution and afforded the same protections. Financial institu­
tions have a responsibility to ensure service providers take
 appropriate measures designed to meet the objectives of the
information security guidelines within Federal Financial Insti­
tutions Exam ination Council (FFIEC ) guidance,4 as well as
com ply with section 501(b) of the Gram m -Leach-Bliley A ct.
These measures should be mapped directly to the security
processes at financial institutions, as well as be included or
referenced in agreem ents between financial institutions and
service providers.
Service agreem ents should also address service provider use
of financial institution information and its custom er inform a­
tion. Information made available to the service provider
should be limited to what is needed to provide the con­
tracted services. Service providers may reveal confidential
supervisory information only to the extent authorized under
applicable laws and regulations.5
If service providers handle any of the financial institution cus­
tom er's Nonpublic Personal Information (NPPI), the service
providers must com ply with applicable privacy laws and regu­
lations.6 Financial institutions should require notification from
service providers of any breaches involving the disclosure of
NPPI data. G enerally, NPPI data is any nonpublic personally
identifiable financial information; and any list, description, or
other grouping of consumers (and publicly available inform a­
tion pertaining to them) derived using any personally identifi­
able financial information that is not publicly available.7
Financial institutions and their service providers who main­
tain, store, or process NPPI data are responsible for that
information and any disclosure of it. The security of, retention
of, and access to NPPI data should be addressed in any con­
tracts with service providers.
W hen a breach or com prom ise of NPPI data occurs, financial
institutions have legal requirem ents that vary by state and
these requirem ents should be made part of the contracts
between the financial institution and any service provider that
provides storage, processing, or transmission of NPPI data.
Misuse or unauthorized disclosure of confidential custom er
data by service providers may expose financial institutions
to liability or action by a federal or state regulatory agency.
Contracts should clearly authorize and disclose the roles and
responsibilities of financial institutions and service providers
regarding NPPI data.
4 For further guidance regarding vendor security practices, refer to the
'F F IE C ' Inform ation Secu rity B o o k le t (July 2006) at http://ithandbook.
ffiec.gov/it-booklets/inform ation-security.aspx.
5 See 12 C FR Part 261.
6 See 12 C FR Part 1016.
7 See 12 U .S .C . 6801(b).
Chapter 16 Guidance on Managing Outsourcing Risk
• O w n ersh ip and lice n se : Agreem ents should define the abil­
ity and circum stances under which service providers may use
financial institution property inclusive of data, hardware, soft­
ware, and intellectual property. Agreem ents should address
the ownership and control of any information generated by
service providers. If financial institutions purchase software
from service providers, escrow agreem ents may be needed
to ensure that financial institutions have the ability to access
the source code and programs under certain conditions.8
• In d em n ifica tio n : Agreem ents should provide for service pro­
vider indemnification of financial institutions for any claims
against financial institutions resulting from the service pro­
vider's negligence.
• D efa u lt and term in a tio n : Agreem ents should define events
of a contractual default, list of acceptable rem edies, and pro­
vide opportunities for curing default. Agreem ents should also
define termination rights, including change in control, merger
or acquisition, increase in fees, failure to m eet perform ance
standards, failure to fulfill the contractual obligations, failure
to provide required notices, and failure to prevent viola­
tions of law, bankruptcy, closure, or insolvency. Contracts
should include termination and notification requirem ents that
provide financial institutions with sufficient time to transfer
services to another service provider. Agreem ents should also
address a service provider's preservation and tim ely return of
financial institution data, records, and other resources.
• D isp u te re so lu tio n : Agreem ents should include a dispute
resolution process in order to expedite problem resolution
and address the continuation of the arrangem ent between
the parties during the dispute resolution period.
• Lim its on liability: Service providers may want to contractually
limit their liability. The board of directors and senior manage­
ment of a financial institution should determine whether the
proposed limitations are reasonable when compared to the
risks to the institution if a service provider fails to perform .9
• In su ra n ce: Service providers should have adequate insurance
and provide financial institutions with proof of insurance.
Further, service providers should notify financial institutions
when there is a material change in their insurance coverage.
8 Escrow agreem ents are established with vendors when buying or leas­
ing products that have underlying proprietary softw are. In such agree­
ments, an organization can only access the source program code under
specific conditions, such as discontinued product support or financial
insolvency of the vendor.
9 Refer to SR letter 06-4, "Interagency Advisory on the Unsafe and
Unsound Use of Limitations on Liability Provisions in External Audit
Engagem ent Letters," regarding restrictions on the liability limitations
for external audit engagem ents at http://w w w .federalreserve.gov/
boarddocs/srletters/2006/SR0604.htm .
■ 285
• C u sto m e r co m p la in ts: Agreem ents should specify the
responsibilities of financial institutions and service provid­
ers related to responding to custom er com plaints. If service
providers are responsible for custom er com plaint resolu­
tion, agreem ents should provide for summary reports to
the financial institutions that track the status and resolution
of com plaints.
• B u sin ess resu m p tio n an d co n tin g e n cy plan o f th e se rv ic e
p ro v id e r: Agreem ents should address the continuation of
services provided by service providers in the event of opera­
tional failures. Agreem ents should address service provider
responsibility for backing up information and maintaining
disaster recovery and contingency plans. Agreem ents may
include a service provider's responsibility for testing of plans
and providing testing results to financial institutions.
• F o re ig n -b a se d se rv ic e p ro v id e rs: For agreem ents with
foreign-based service providers, financial institutions should
consider including express choice of law and jurisdictional
provisions that would provide for the adjudication of all dis­
putes between the two parties under the laws of a single,
specific jurisdiction. Such agreem ents may be subject to
the interpretation of foreign courts relying on local laws.
Foreign law may differ from U.S. law in the enforcem ent of
contracts. As a result, financial institutions should seek legal
advice regarding the enforceability of all aspects of proposed
contracts with foreign-based service providers and the other
legal ramifications of such arrangem ents.
• S u b c o n tra c tin g : If agreem ents allow for subcontracting, the
same contractual provisions should apply to the subcontrac­
tor. Contract provisions should clearly state that the primary
service provider has overall accountability for all services that
the service provider and its subcontractors provide. A g ree­
ments should define the services that may be subcontracted,
the service provider's due diligence process for engaging and
monitoring subcontractors, and the notification and approval
requirem ents regarding changes to the service provider's
subcontractors. Financial institutions should pay special
attention to any foreign subcontractors, as information secu­
rity and data privacy standards may be different in other juris­
dictions. Additionally, agreem ents should include the service
provider's process for assessing the subcontractor's financial
condition to fulfill contractual obligations.
D. Incentive Compensation Review
Financial institutions should also ensure that an effective process
is in place to review and approve any incentive compensation
that may be em bedded in service provider contracts, including
286 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
a review of w hether existing governance and controls are
adequate in light of risks arising from incentive compensation
arrangem ents. As the service provider represents the institu­
tion by selling products or services on its behalf, the institution
should consider whether the incentives provided might encour­
age the service provider to take im prudent risks. Inappropri­
ately structured incentives may result in reputational dam age,
increased litigation, or other risks to the financial institution.
An exam ple of an inappropriate incentive would be one where
variable fees or commissions encourage the service provider to
direct custom ers to products with higher profit margins without
due consideration of whether such products are suitable for
the customer.
E. Oversight and Monitoring of Service
Providers
To effectively m onitor contractual requirem ents, financial
institutions should establish accep tab le perform ance m etrics
that the business line or relationship m anagem ent determ ines
to be indicative of accep tab le perform ance levels. Financial
institutions should ensure that personnel with oversight and
m anagem ent responsibilities for service providers have the
appropriate level of exp ertise and stature to m anage the
outsourcing arrangem ent. The oversight process, including
the level and frequency of m anagem ent reporting, should be
risk-focused. H igher risk service providers may require more
frequent assessm ent and m onitoring and may require finan­
cial institutions to designate individuals or a group as a point
of contact for those service providers. Financial institutions
should tailor and im plem ent risk m itigation plans for higher
risk service providers that may include processes such as ad d i­
tional reporting by the service provider or heightened m oni­
toring by the financial institution. Further, more frequent and
stringent m onitoring is necessary for service providers that
exh ib it perform ance, financial, com pliance, or control con­
cerns. For lower risk service providers, the level of m onitoring
can be lessened.
Financial co n d itio n : Financial institutions should have estab­
lished procedures to monitor the financial condition of service
providers to evaluate their ongoing viability. In performing
these assessm ents, financial institutions should review the
most recent financial statem ents and annual report with regard
to outstanding com m itm ents, capital strength, liquidity and
operating results. If a service provider relies significantly on
subcontractors to provide services to financial institutions, then
the service provider's controls and due diligence regarding the
subcontractors should also be reviewed.
Internal co n tro ls: For significant service provider relationships,
financial institutions should assess the adequacy of the provider's
control environment. Assessm ents should include reviewing
available audits or reports such as the Am erican Institute of
Certified Public Accountants' Service Organization Control
2 report. If the service provider delivers information technology
services, the financial institution can request the FFIEC Technol­
ogy Service Provider examination report from its primary federal
regulator. Security incidents at the service provider may also
necessitate the institution to elevate its monitoring of the
service provider.
Esca la tio n o f o v e rsig h t a c tiv itie s: Financial institutions should
ensure that risk m anagem ent processes include triggers to
escalate oversight and monitoring when service providers are
failing to m eet perform ance, com pliance, control, or viability
expectations. These procedures should include more frequent
and stringent monitoring and follow-up on identified issues,
on-site control reviews, and when an institution should exercise
its right to audit a service provider's adherence to the term s of
the agreem ent. Financial institutions should develop criteria for
engaging alternative outsourcing arrangem ents and terminating
the service provider contract in the event that identified issues
are not adequately addressed in a tim ely manner.
F. Business Continuity and Contingency
Considerations
Various events may affect a service provider's ability to provide
contracted services. For exam ple, services could be disrupted by
a provider's performance failure, operational disruption, financial
difficulty, or failure of business continuity and contingency plans
during operational disruptions or natural disasters. Financial insti­
tution contingency plans should focus on critical services pro­
vided by service providers and consider alternative arrangements
in the event that a service provider is unable to perform .11 When
preparing contingency plans, financial institutions should:
• Ensure that a disaster recovery and business continuity plan
exists with regard to the contracted services and products;
• Assess the adequacy and effectiveness of a service provider's
disaster recovery and business continuity plan and its align­
ment to their own plan;1
0
10 Refer to w w w .A IC P A .o rg .
11 For further guidance regarding business continuity planning with ser­
vice providers, refer to the 'F F IE C ' Business Continuity B o o k le t (March
2008) at http://ithandbook.ffiec.gov/it-booklets/business-continuity-
planning.aspx.
Chapter 16 Guidance on Managing Outsourcing Risk
• Docum ent the roles and responsibilities for maintaining and
testing the service provider's business continuity and contin­
gency plans;
• Test the service provider's business continuity and contin­
gency plans on a periodic basis to ensure adequacy and
effectiveness; and
• Maintain an exit strategy, including a pool of com parable ser­
vice providers, in the event that a contracted service provider
is unable to perform.
G. Additional Risk Considerations
S u s p ic io u s A c tiv ity R e p o r t (S A R ) re p o r tin g fu n c tio n s :
Th e co n fid en tiality of suspicious activity reporting m akes
the outsourcing of any SA R-related function more co m p lex.
Financial institutions need to identify and m onitor the risks
associated with using service providers to perform certain
suspicious activity reporting functions in com pliance with
the Bank Secrecy A ct (B SA ). Financial institution m anag e­
m ent should ensure they understand the risks associated
with such an arrang em ent and any B SA -sp ecific guidance in
this area.
F o re ig n - b a se d s e rv ic e p r o v id e r s : Financial institutions should
ensure that foreign-based service providers are in com pliance
with ap plicable U .S. laws, regulations, and regulatory guid­
ance. Financial institutions may also w ant to consider laws
and regulations of the foreign-based provider's country or
regulatory authority regarding the financial institution's ability
to perform on-site review of the service provider's operations.
In addition, financial institutions should consider the authority
or ability of home country supervisors to gain access to the
financial institution's custom er inform ation while exam ining the
foreign-based service provider.
In tern a l a u d it: Financial institutions should refer to existing
guidance on the engagem ent of independent public accounting
firms and other outside professionals to perform work that has
10.
been traditionally carried out by internal auditors. The
Sarbanes-O xley A ct of 2002 specifically prohibits a registered
12 Refer to SR 13-1, "Supplem ental Policy Statem ent on the Internal
Audit Function and Its O utsourcing," specifically the section titled,
"D epository Institutions Subject to the Annual Audit and Reporting
Requirem ents of Section 36 of the FDI A ct" at http://w w w .federalreserve
.gov/bankinforeg/srletters/sr1301.htm . Refer also to SR 03-5, "Am ended
Interagency G uidance on the Internal A udit Function and Its O utsourc­
ing," particularly the section titled, "Institutions Not Subject to Section
36 of the FDI A ct That Are Neither Public Com panies Nor Subsidiaries of
Public Com panies" at http://w w w .federalreserve.gov/boarddocs/
srletters/2003/sr0305.htm .
■ 287
public accounting firm from performing certain non-audit ser­
vices for a public company client for whom it performs financial
statem ent audits.
Risk m a n a g em en t a ctiv itie s: Financial institutions may out­
source various risk m anagem ent activities, such as aspects of
interest rate risk and model risk m anagem ent. Financial institu­
tions should require service providers to provide information
that dem onstrates developm ental evidence explaining the
product com ponents, design, and intended use, to determ ine
whether the products and/or services are appropriate for the
288 Financial Risk Manager Exam Part II: Operational Risk and Resiliency
institution's exposures and risks.13 Financial institutions should
also have standards and processes in place for ensuring that ser­
vice providers offering model risk m anagem ent services, such as
validation, do so in a way that is consistent with existing model
risk m anagem ent guidance.
13 Refer to SR 11-7, "Guidance on Model Risk Management" which informs
financial institutions of the importance and risk to the use of models and
the supervisory expectations that financial institutions should adhere to
http://www.federalreserve.gov/bankinforeg/srletters/sr1107.htm.
Management of
Risks Associated
with Money
Laundering
and Financing
of Terrorism
Learning Objective
A fter com pleting this reading you should be able to:

Explain best practices recom m ended for the assessm ent,

m anagem ent, mitigation and monitoring of money
laundering and financial terrorism (M L/FT) risks.

By Mark Carey of the G A R P Risk Institute.

Many nations and international bodies have developed laws,
regulations or guidelines focused on limiting the use of banking
services to support criminal activities, particularly money laun­
dering (ML) or financing of terrorism (FT). Though involvement
with ML or FT is an operational risk, m anagem ent of this risk
has becom e a separate subfield due to the intensity of regula­
tory attention to the issue, the significant level of fines, and the
creativity of criminals and terrorists.
This chapter summarizes the Basel Committee's 2016 "Sound
Management of Risks Related to Money Laundering and Financing
of Terrorism," as well as some of the Financial Action Task Force's
(FATF) 2016 "The FATF Recommendations" and other documents.
Note that this chapter is only an overview. Risk managers in areas
where management of M L/FT risks is central should examine this
topic in further readings and undergo any requisite training.
17.1 B A C K G R O U N D
Crim inals and terrorists use payment services to finance their
activities, or to convert funds linked to criminal activity (includ­
ing tax evasion) to an untainted or laundered form . Because
banks are at the heart of the global paym ent system , they are
uniquely vulnerable to being ensnared in such activities, which
can expose them to reputational losses, fines, convictions, and
restrictions on their ability to do business.
In addition to the usual attention to governance arrangem ents,
policies and procedures, M L/FT risk m anagem ent includes some
specific activities that supervisors and other authorities expect
at every bank:
• Risk assessm ent
• Custom er due diligence and acceptance (CDD) [aka Know
Your Custom er (KYC)]
• Transaction and other monitoring
• Reporting of suspicious activity and freezing assets
• Addressing risks associated with global operations
• Attention to third-party risk and correspondent banking risks
• Aw areness of an array of official sector pronouncem ents.
Am ong the most im portant are standards issued by the
Financial Action Task Force (FATF), an intergovernmental
coordinating body.1
A
1 FATF, "International Standards on Com bating Money Laundering
and the Financing of Terrorism and Proliferation," February 2012; and
"M ethodology" February 2013.
290 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Some others appear in the list of references at the end of this
chapter.
On D ecem ber 3, 2018, several financial regulatory agencies
of the U .S. governm ent issued a "Jo in t Statem ent on Innovative
Efforts to Com bat M oney Laundering and Terrorist Financing,"
which expressed their openness to "innovative efforts" and
noted that some banks have been experim enting with machine
learning m odels and digital identity technologies to identify
risks, monitor transactions, and aid in the reporting of suspi­
cious activity. To date, Bank Secrecy A ct (BSA) and Anti-M oney
Laundering (AML) supervisory activity in the United States has
focused on com pliance, with detailed guidance influencing
bank internal procedures. The agencies state that any flaws
found in banks' internal procedures as a result of innovative
activities will not be used against these firm s by supervisors.
Although the agencies imply that internal procedures might
som eday be perm itted to depart from existing com pliance
requirements where innovations are successful, they also imply
that for the moment banks must continue to satisfy existing
com pliance requirem ents.
17.2 A P P LIC A T IO N O F ST A N D A R D
P R A C T IC E S *•
Banks should apply (though not limit them selves to) standard
risk m anagem ent practices:
• G o vern an ce: The board of directors should approve and
oversee risk assessm ents, policies, organization, risk
m anagem ent and com pliance in the sp ecific context
of M L/FT. To that end, a chief M L/FT officer should be
ap pointed.
• As in other risk areas, banks are expected to have three lines
of defense
1. Business units must identify, assess and control M L/FT
risks; have w ritten policies and procedures as well as
em ployee training; and screen potential em ployees.
2. The risk function and/or the function under the chief
M L/FT officer must monitor the effectiveness of first line
m anagem ent of M L/FT risks and com pliance with all
policies and procedures. Conflicts of interest on the part
of second line em ployees should be avoided. The chief
M L/FT officer should have direct reporting lines to senior
m anagem ent or the board.
3. Internal auditors and/or external eq uivalents should
in d ep end ently evaluate M L/FT risk m anagem ent and
controls.
17.3 R ISK A S S E S S M E N T
Banks should assess and understand the M L/FT risks inherent
within their businesses and custom er base:
• All relevant risk factors at the country, sector, bank and
business relationship levels should be considered. C harac­
teristics of the custom er base, products and services offered,
and delivery channels should be considered.
• For each custom er or business relationship, a profile of
normal activity should be built to support identification of
abnormal activity.
• Risk assessm ents should be docum ented for potential
inspection by authorities.
• International banks should be attentive to national risk
assessm ents and country reports.
1 7 .4 C U S T O M E R D U E D IL IG E N C E
AND A CCEPTA N CE•
Some customers pose a low risk of involving a bank in M L/FT
activity (e.g., a long established client employed in the commu­
nity with regular, small account inflows and outflows) and some
pose a high risk (e.g., a person with a past record of criminal
activity with large and intermittent account inflows and outflows).
If a bank chooses to do business with a high-risk customer,
more intensive ongoing monitoring of that customer's activity is
needed. Moreover, to classify customers by level of risk, a bank
should have well-developed customer identification and accep­
tance policies and procedures. Such policies and procedures
should not prevent the general public, nor people who are finan­
cially or socially disadvantaged, from accessing banking services.
• W ritten policies and procedures should exist to ensure that
a custom er is not accepted, and business is not done, until
the customer's identity has been satisfactorily established.
Reliable, independent source docum ents and information
should be used in identification. Consideration should be
given to a customer's home jurisdiction(s), including whether
that jurisdiction is known to have M L/FT deficiencies. The
reasons the custom er is opening accounts should also be
considered.
• Politically exposed persons (PEP), such as form er high gov­
ernm ent officials, pose higher risk given the possibility that
some wealth may have been obtained through corruption.
• Consider the potential customer's background, occupation,
source of wealth and income, and country of origin and
residence.
Chapter 17 Management of Risks Associated with Money Laundering and Financing of Terrorism
• Though information about a customer's previous banking
relationships may be helpful, the fact that a custom er previ­
ously had accounts at another bank is not sufficient to classify
the custom er as low-risk or as well-identified. For exam ple,
the previous bank may have ejected the custom er due to
M L/FT concerns.
• Due diligence and monitoring may be more com plex for
banks operating internationally, particularly for those
operating in jurisdictions that do not perm it custom er
inform ation to cross borders. However, inform ation should
be com bined and analyzed across the group as much as
possible.
• In some jurisdictions, banks may be perm itted to rely on
third parties for some custom er due diligence. Banks should
ensure that the third parties' own m anagem ent of M L/FT
risks is sound and are ultimately responsible even if deci­
sions are made by third parties. Arrangem ents, controls and
reviews should be docum ented.
17.5 T R A N S A C T IO N A N D O T H E R
M O N IT O R IN G A N D R E P O R T IN G
Banks should monitor custom er and transaction activity for
unusual patterns to identify potential M L/FT activity.
• A profile of normal activity and transactions must be built
in order to aid identification of abnormal activity, such as
unusual business relationships and transactions.
• The higher the assessm ent of the risk posed by a customer,
the more intense and wide-ranging the monitoring.
• Changes in a customer's risk profile should trigger changes in
the intensity of monitoring.
• Monitoring should cover all accounts and transactions.
• C D D information should be used.
• The larger and more com plex the bank and its businesses,
and the more international its operations, the more likely that
autom ated monitoring applications will be needed.
• Monitoring activity should be docum ented.
• Especially where required by law, suspicious activity revealed
by monitoring should be reported to appropriate law
enforcem ent authorities.
17.6 C O R R E S P O N D E N T B A N K IN G
Correspondent banking involves the provision of banking ser­
vices by one bank to another bank. O f most concern in the
■ 291
context of M L/FT is execution of cross-border payments by a
correspondent bank for a respondent bank's customer.
• Because the correspondent bank does not have a rela­
tionship with the ultim ate custom er, it must perform due
diligence on the respondent bank. Details of the services
provided and of counterparties are relevant to the risk.
The quality of the respondent banks' m anagem ent of ML/
FT risks is vitally im portant. A s such, due diligence must
be done on such m anagem ent, and agreem ents among
correspondent and respondent banks should set out
responsibilities.
• Some correspondent banking activity involves nested
respondent banks (i.e., the ultimate custom er may have a
relationship with the respondent bank's respondent bank).
For exam ple, a small bank might use a medium-sized bank,
which in turn uses a large international bank as correspon­
dent. Though many legitimate transactions and activities are
conducted through such nested relationships, M L/FT risks are
higher. This is especially true if relationships among respon­
dent banks cross borders.
• W hen information about the risk changes, termination of
correspondent banking relationships with a respondent bank
may be appropriate.
17.7 W IR E T R A N S F E R S
W ire transfers are accom plished by sending paym ent m essages
among banks. Information about the originating bank and the
custom er should appear in the m essages, and such information
should be monitored.
292 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
17.8 IN T E R N A T IO N A L S C O P E
Banks with a presence in multiple countries should:
• Understand and abide by laws and regulations in each
country. If a country's laws and regulations prevent adequate
m anagem ent of M L/FT risks, consider cessation of business
in the country.
• A pply consistent group-wide policies and procedures.
• Share information across the group and usie groupwide
information and understanding in monitoring and risk
assessm ent.
Good official-sector supervisory exam ination and enforcem ent
in each country of bank m anagem ent of M L/FT risks is important
to global containm ent of M L/FT activity.
References
Basel Com m ittee on Banking Supervision, 2016, "Sound Manage­
ment of Risks Related to Money Laundering and Financing of
Terrorism."
Financial Action Task Force, 2016, "The FA TF Recom m endations."
Board of Governors of the Federal Reserve System , Federal
Deposit Insurance Corporation, Financial Crim es Enforce­
ment Network, National Credit Union Adm inistration, Office
of the Com ptroller of the Currency, 2018, "Jo in t Statem ent on
Innovative Efforts to Com bat Money Laundering and Terrorist
Financing."
Regulation of the
OTC Derivatives
Market
Learning Objectives
A fter com pleting this reading you should be able to:

Summarize the clearing process in O T C derivative

markets.

Describe changes to the regulation of O T C derivatives

which took place after the 2007-2009 financial crisis and
explain the impact of these changes.

Excerp t is Chapter 17 of Risk M anagem ent and Financial Institutions, Fifth Edition, by John C . Hull.
The exchange-traded market is a market where products devel­
oped by an exchange are bought and sold on a trading platform
developed by the exchange. A market participant's trade must
be cleared by a m em ber of the exchange clearing house. The
exchange clearing house requires margin (i.e., collateral) from
its m em bers, and the m em bers require margin from the brokers
whose trades they are clearing. The brokers in turn require mar­
gin from their clients.
The O T C market is a market where financial institutions, fund
managers, and corporate treasurers deal directly with each other.
An exchange is not involved. Before the 2007-2008 credit crisis,
the O TC market was largely unregulated. Two market participants
could enter into any trade they liked. They could agree to post
collateral or not post collateral. They could agree to clear the
trade directly with each other or use a third party. Also, they were
under no obligation to disclose details of the trade to anyone else.
Since the crisis, the O T C market has been subject to a great
deal of regulation. This chapter will explain the regulations and
show that regulatory pressure is leading to the O T C market
becoming more like the exchange-traded market.
18.1 C L E A R IN G IN O T C M A R K E T S
We start by describing how transactions are cleared in the
O T C m arket. There are two main approaches: central clear­
ing and bilateral clearing. They are illustrated schem atically in
Figure 18.1 (which makes the simplifying assumption that there
are only eight market participants and only one C C P ). In bilateral
clearing, market participants clear transactions with each other.
In central clearing, a third party, known as a central counterparty
(CC P), clears the transactions.
Margin
Before proceeding to describe bilateral and central clearing
in more detail, we review the operation of margin accounts.
Margin is the word now used to describe the collateral posted
in O T C markets as well as exchange-traded markets.
Bilateral clearing Clearing through a single CCP
Fiq u re 18.1 Bilateral and central clearing.
294 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Variation margin is the collateral posted to reflect the change in
the value of a derivatives portfolio. Consider the situation where
Party A is trading with Party B and the collateral agreem ent
states that variation margin (with no threshold or minimum
transfer amount) has to be posted by both sid es.1 This means
that, if the value of outstanding transactions changes during a
day so that they increase in value by $ X to A (and therefore
decrease in value by $ X to B), B has to provide A with $ X of
acceptable collateral. The cumulative effect of variation margin
is that, if outstanding derivatives have a value of + $ V to A and
—$\/ to B at a particular tim e, B should have posted a total of $V
of collateral with A by that tim e.1
2
Variation margin provides some protection against a counterparty
default. It would provide total protection in an ideal world where
(a) the counterparty never owes any variation margin at the time
of default and (b) all outstanding positions can be replaced at
mid-market prices as soon as the counterparty defaults.
In practice, defaulting counterparties often stop posting collateral
several days before they default, and the non-defaulting
counterparty is usually subject to a bid-offer spread as it replaces
transactions.3 To allow for adverse movements in the value of the
portfolio during a period prior to defaulting when no margin is
being posted, market participants sometimes require initial mar­
gin in addition to variation margin. Note that, in this context,
adverse market movements are increases in the value of the port­
folio to the non-defaulting party, not decreases. This is because
increases in the value during a period when variation margin is not
being posted lead to increases in replacement costs.4 Initial mar­
gin, which can change through time as the outstanding portfolio
and relevant volatilities change, reflects the risk of a loss due to
adverse market moves and the costs of replacing transactions.5
1 A and B could be two derivatives dealers or a derivatives dealer and
one of its clients. A lso, one of A and B could be a CCP. A threshold is a
minimum value of the portfolio to one side before it can dem and mar­
gin, and the minimum transfer amount is the minimum change in value
necessary for a margin to have to be posted.
2 In this context, note that if A buys an option from B for $10,000, it
must pay $10,000 to B, but B must then return the $10,000 to A as varia­
tion margin.
3 As explained later, the non-defaulting counterparty is able to claim
from the defaulting party the cost related to the bid-offer spread that it
would incur in replacing the transaction.
4 It may seem strange that a m arket participant would be worried about
the value of its transactions increasing. But suppose a transaction with a
defaulting counterparty is hedged with another transaction entered into
with another counterparty (as is often the case). The transaction with the
other party can be exp ected to lose value without any com pensating
gain on the defaulted transaction.
5 As indicated earlier, the non-defaulting party is allowed to keep all
margin posted by the defaulting party up to the amount that can be
legitim ately claim ed.
Most margin is cash, but the agreem ents in place may specify
that securities can be posted instead of cash. The securities
may be subject to a haircut. This means that the market value
of the securities is reduced to determ ine their value for margin
purposes. For exam ple, a Treasury bond might be subject to
a 10% haircut, indicating that, if its market value were $100, it
would cover only $90 of a margin requirem ent.
Should cash margin earn interest? There is a difference between
futures markets and O T C markets here. A futures exchange clear­
ing house requires both initial margin and variation margin from
members. Members earn interest on the initial margin. But they
do not do so on variation margin because futures contracts are
settled daily so that variation margin does not belong to the mem­
ber posting it. In the case of O T C trades, interest is usually earned
on all cash margin posted because trades are not settled daily.
Central Clearing
In central clearing, a central counterparty (CCP) handles the
clearing. A C C P operates very much like an exchange clearing
house. W hen two com panies, A and B, agree to an over-the-
counter derivatives transaction and decide to clear it centrally,
they present it to a CCP. Assuming that the C C P accepts it, the
C C P acts as an interm ediary and enters into offsetting transac­
tions with the two com panies.
Suppose, for exam ple, that the transaction is an interest rate
swap where company A pays a fixed rate of 5% to com pany B
on a principal of $100 million for five years and company B pays
LIBO R to company A on the same principal for the same period
of tim e. Two separate transactions are created. Com pany A has
a transaction with the C C P where it pays 5% and receives LIBOR
on $100 million. Com pany B has a transaction with the C C P
where it pays LIBO R and receives 5% on $100 million. The two
com panies no longer have credit exposure to each other. This is
illustrated in Figure 18.2. If one or both parties to the transac­
tion are not members of the CCP, they can clear the transaction
through members.
Three large C C P s are
1. Sw apCIear (part of LCH Clearnet in London),
2. C learPort (part of the C M E Group in Chicago), and
3 . IC E Clear Credit (part of the Intercontinental Exchange).
A C C P requires its members to provide initial margin and varia­
tion margin for the transactions being cleared. Typically, the
initial margin is calculated so that there is a 99% probability that
it will cover market moves over five days. This protects the C C P
from losses as it tries to close out or replace the positions of a
defaulting member.
Chapter 18
The OTC Trade
Role of CCP
Fig u re 1 8.2 Role of CCP in OTC markets.
Consider the swap in Figure 18.2. Suppose for sim plicity that
it is the only transaction each side has with the CCP. The C C P
might require an initial margin of $0.5 million from each side. If,
on the first day, interest rates fall so that the value of the swap
to A goes down by $100,000, Party A would be required to pay
a variation margin equal to this to the CCP, and the C C P would
be required to pay the same amount to B. There could also be
a change to the initial margin requirem ents determ ined by the
CCP. If required margin is not paid by one of its m em bers, the
C C P closes out its transactions with that member. Cash and
Treasury instruments are usually accepted as margin by C C P s.
Typically the interest rate paid on cash balances is close to the
overnight federal funds rate for U.S. dollars (and close to similar
overnight rates for other currencies).
In practice, market participants are likely to have multiple
transactions outstanding with the C C P at any given tim e. The
initial margin required from a participant at any given time
reflects the volatility of the value of its total position with the
CCP. The role of a C C P in the O T C market is similar to the
role of a clearing house in the exchange-traded market. The
main difference is that transactions handled by the C C P are
usually less standard than transactions in the exchange-traded
market so that the calculation of margin requirem ents is more
com plicated.
The key advantage of clearing a transaction through a C C P
is that O T C market participants do not need to worry about
the creditworthiness of the counterparties they trade with.
Credit risk is handled by the C C P using initial and variation
margin.
A C C P requires its members to contribute to a default fund.
(As m entioned, if one or both parties to a transaction are not
members of the CCP, they can clear the transaction through
m em bers. They will then have to post margin with the mem­
bers.) If a m em ber fails to post margin when required, the
m em ber is in default and its positions are closed out. In closing
out a member's positions, the C C P may incur a loss. A waterfall
Regulation of the OTC Derivatives Market ■ 295
defines who bears the loss. The order in which the loss is funded
is usually as follows:
1. The initial margin of the defaulting member
2. The default fund contribution of the m em ber
3. The default fund contributions of other members
4 . The equity of the C C P 6
This is similar to the way losses in the event of a default are
funded by an exchange clearing house.
Bilateral Clearing
In bilateral clearing , each pair of m arket p articip ants enters
into an ag reem ent describing how all future transactio ns
betw een them will be cleared . Typically this is an ISD A
m a ster a g reem en t. (ISD A is short for International Sw aps
and D erivatives A sso ciatio n .) An annex to the ag reem ent,
known as the c re d it s u p p o rt annex (C S A ), defines collateral
arrang em ents. In particular, it defines w hat collateral (if any)
has to be posted by each sid e, w hat assets are accep tab le as
co llateral, w hat haircuts will be ap p lie d , and so on. Th e main
body of the ag reem ent defines w hat happens when one side
defaults (e .g ., by declaring bankruptcy, failing to make p ay­
m ents on the d erivatives as they are due, or failing to post
collateral when required). W e will discuss this in more detail
shortly.
Netting
We discussed netting in connection with the Basel I rules in the
section "N e ttin g ." Netting is a feature of ISD A m aster ag ree­
ments and a feature of the agreem ents between C C P s and
their m em bers. It states that all transactions between two
parties are considered to be a single transaction when
(a) collateral requirem ents are being calculated and (b) early
term inations occur because of a default. As explained in the
section "N e ttin g ," netting reduces credit risk because it means
that the defaulting party cannot choose to default on transac­
tions that are out-of-the-money while keeping transactions that
are in-the-money.
Netting can also save initial margin. Suppose Party A has two
transactions with a C C P that are not perfectly correlated. The
6 In som e cases, the non-defaulting m em bers are required to provide
additional default fund contributions when there is a default, with a cap
on the amount of these additional contributions. (This is true of both
exchange clearing houses and C C P s.)
296 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
initial margin for the portfolio is likely to be less than that for the
two transactions separately.
Events of Default
D erivatives transactions are treated differently from other
transactions in the event that a m arket participant fails to
m eet its obligations. For exam p le, in ISD A m aster agreem ents
there is an early term ination provision that takes precedence
over bankruptcy rules. This states that, if there is an "e ven t of
d e fa u lt," the non-defaulting party has the right to term inate
all transactions with the defaulting party after a short period
of tim e has e la p se d .7 Events of default include declarations of
bankruptcy, failure to make paym ents as they are due, and
failure to post collateral when req u ired .8 N on-derivative con­
tracts cannot always be term inated in this w ay. A nother
im portant difference betw een derivatives transactions and
non-derivatives transactions is that in the case of derivatives
transactions the non-defaulting party can take im m ediate
possession of any collateral that has been posted by the
defaulting party. It does not have to get a court order to allow
it to do this.
If there is an event of default under an ISD A m aster ag ree­
ment, the non-defaulting party calculates the m id-m arket value
of outstanding transactions. It then adjusts this valuation in
its favor by half the bid-offer spreads on the transactions for
the purposes of calculating a settlem ent am ount. This adjust­
ment is com pensation for the fact that it will have to trade with
other dealers to replace the transactions and it will be subject
to their bid-offer spreads when it does so. Suppose that one
transaction has a m id-m arket value of $20 million to the non­
defaulting party and that the transaction is bid $18 million,
offer $22 million. For the purposes of settlem ent, the trans­
action would be valued at $22 million because this is what it
would cost the non-defaulting party to replace the defaulting
party's position in the transaction. If the non-defaulting party
had the other side of the transaction so that its mid-market
value was - $ 2 0 million, it would be valued at —$18 million for
settlem ent purposes. In this case, the assumption is that a third
party would be prepared to pay only $18 million to take the
defaulting party's position.
7 The non-defaulting party is not obliged to term inate transactions.
Counterparties that are out-of-the-money som etim es consider that it is
in their best interests not to term inate.
8 Failure resolution mechanisms have been proposed where transactions
are stayed (i.e., not term inated) for a period of tim e even if there is a
bankruptcy filing, provided m argin/collateral continues to be posted.
These would allow the derivatives portfolios of bankrupt m arket partici­
pants to be unwound in an orderly way.
18.2 PO ST-CRISIS R E G U L A T O R Y
CH A N G ES
The O T C derivatives market was considered by many to have
been partly responsible for the 2008 credit crisis. When the G20
leaders met in Pittsburgh in Septem ber 2009 in the aftermath of
the 2008 crisis, they wanted to reduce system ic risk by regulat­
ing the O T C market. The statem ent issued by the leaders after
the meeting included the following paragraph:
All standardized O T C derivative contracts should be
traded on exchanges or electronic trading platforms,
where appropriate, and cleared through central coun­
terparties by end-2012 at the latest. O T C derivative
contracts should be reported to trade repositories.
Non-centrally cleared contracts should be subject to
higher capital requirem ents. We ask the FSB and its rel­
evant members to assess regularly implementation and
whether it is sufficient to improve transparency in the
derivatives m arkets, mitigate system ic risk, and protect
against market abuse.
The results of this were three major changes affecting O T C
derivatives:
1. A requirem ent that all standardized O T C derivatives be
cleared through C C P s. Standardized derivatives include
plain vanilla interest rate swaps (which account for the
majority of O T C derivatives traded) and default swaps on
credit indices. The purpose of this requirem ent is to reduce
system ic risk (see Business Snapshot 21.1). It leads to deriv­
atives dealers having less credit exposure to each other so
that their interconnectedness is less likely to lead to a col­
lapse of the financial system.
2. A requirement that standardized O T C derivatives be traded
on electronic platforms. This is to improve transparency. The
thinking is that, if there is an electronic platform for matching
buyers and sellers, the prices at which products trade should
be readily available to all market participants.9 The platforms
are called swap execution facilities (SEFs) in the United
States and organized trading facilities (OTFs) in Europe. In
practice, standardized products, once they have been traded
on these platforms, are passed automatically to a CCP.
3 . A requirem ent that all trades in the O T C market be
reported to a central trade repository. This requirem ent
9 An issue here is that the type of electronic platform that is appropriate
for swaps may not be the same as the one that is used by exchanges.
Sw aps are traded interm ittently with large notional principals. Futures
and options on an exchange trade continually and the size of trades is
usually much smaller.
Chapter 18
provides regulators with im portant information on the risks
being taken by participants in the O T C market. It is partly a
response to the AIG fiasco where regulators were not aware
of the huge risks being taken by a subsidiary of AIG until
the insurance company asked to be bailed out.
The first two of these requirements apply only to transactions
between two financial institutions (or between a financial insti­
tution and a non-financial company that is considered to be
system ically im portant because of the volume of its O T C deriva­
tives trading). Derivatives dealers can therefore continue to
trade with many of their non-financial corporate clients in the
same way that they did pre-crisis.
A bout 25% of O T C transactions were cleared through C C P s pre­
crisis and the remaining 75% were cleared bilaterally. As a result
of the new rules, these percentages have flipped so that approx­
imately 75% of O T C transactions are now cleared through C C P s,
while 25% are cleared bilaterally.
Uncleared Trades
Following another G 20 meeting in 2011, the rules have been
tightened for non-standard O T C derivatives. These are the
derivatives that are not covered by the rules just m entioned.
They are cleared bilaterally rather than centrally and are referred
to as uncleared trades. Regulations, which are being im ple­
mented between 2016 and 2020, require uncleared trades
between two financial institutions (or between a financial insti­
tution and a non-financial company that is considered to be
system ically important) to be subject to rules on the margin that
has to be posted. Previously, one of the attractions of bilateral
clearing was that m arket participants were free to negotiate any
credit support annex to their ISDA master agreem ents.
The rules state that both initial margin and variation margin must
be posted for uncleared trades by both sides. Variation margin
was fairly common in the O TC market pre-crisis (particularly in
trades between derivatives dealers), but initial margin was rare.
When entering into a transaction with a much less creditworthy
counterparty, a derivatives dealer might insist on the counterparty
posting initial margin. But the posting of initial margin by both
sides was almost unheard of in the bilaterally cleared market.
Variation margin is usually transm itted directly from one coun­
terparty to the other. Initial margin when posted by both sides
cannot be handled in this way. If, for exam ple, A transm itted
$1 million of initial margin to B and B transm itted $1 million of
initial margin to A , the initial margin would not serve the desired
purpose because the transfers would cancel each other. For this
reason the regulations require initial margin to be transm itted to
a third party, where it is held in trust.
Regulation of the OTC Derivatives Market ■ 297
Determination of Initial Margin: SIMM To calculate the incremental effect on initial margin of gamma
risk, SIMM first considers the situation where all deltas are zero
For the new rules on uncleared transactions to work, the two and there is no cross gamm a. The mean and standard deviation
sides to an ISDA master agreem ent must agree on the varia­ of the change in the value of the portfolio over one day are:
tion margin and initial margin. The variation margin requires
agreem ent on the valuation of outstanding transactions, £ (A P ) =
Z. I
and procedures have been established for resolving any dis­
agreem ents on this. The calculation of initial margin is more 2,-r2
SDCAP) = j
com plicated than valuing the transactions and there is more
scope for different models to give different results. As a result where y (- is the gamma with respect to the fth risk factor.
there have been attem pts to develop an industry standard.
Estim ates of the mean and standard deviation of portfolio
Initial margin is specified in the regulations for portfolios of
change over 10 days are obtained by replacing a, with V 1 0 cr,.
uncleared transactions between two parties as the gain in value Defining
over 10 days that we are 99% certain will not be exceeded in
stressed m arket conditions. Note that initial margin is the mirror C. = —y. (yf\0<j.
/ 2 ' \ '
image of VaR. When we are calculating VaR, we are determining
extrem e percentiles of the loss distribution, but when we are the mean, m, and standard deviation, s, of the 10-day change
calculating initial margin we are determ ining extrem e percen­ are therefore given by
tiles of the gain distribution. This is because exposure increases
as the uncollateralized value of a portfolio increases.

The Basel Com m ittee proposed a grid approach for calculating

initial margin, which specified initial margin as a percentage of
notional principal for different types of transactions. This was
unpopular because it did not incorporate netting. If a m arket SIMM then sets
participant entered into a certain transaction on Day 1 and an
IM(Gamma) = m +
alm ost offsetting transaction on Day 5, both with the same
counterparty, the initial margin on Day 5 would be alm ost The param eter A in this equation is (see Problem 18.14) defined
double that on Day 1— even though the net exposure to the in term s of
counterparty would be close to zero. ISDA proposed what is
known as the Standard Initial Margin Model (SIMM) as a way
of overcom ing this. This model has now been approved by
regulators.
as indicated in Figure 18.3. This relationship produces results
Delta and vega risks are handled using the weighted sensitivities that have the right properties and correspond closely with tests
and risk weights so that carried out using Monte Carlo simulation.

I n n

IM (Delta and Vega) = j Y >i^ 8.S .p .W W .

V /=1 7=1

where the W-, is the risk weight for risk factor / (specified by the
regulators), 8, is the sensitivity of the position held to risk factor /
(determ ined by the bank), and p,y is the correlation between
risk factors / and j (specified by the regulators). Because a
10-day tim e horizon with 99% confidence is used, a possible
formula for Wi; is

Wj = V lO x (0.99)a . (18 -i)

where cr, is the daily volatility (or standard deviation, in the case
of interest rates, credit spreads, and volatilities) of the fth risk
factor in stressed m arket conditions. Fiq u re 18.3 Relation b etw een A and (3.

298 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
There are a number of other details in SIM M . To
B
simplify m atters, gamma is calculated from vega A < B
(§ >
using the relationship between the two that holds
for European options. Risk factors are divided into
buckets, and some risk factors involve term struc­
tures with vertices. There are rules specified for
calculating the correlations p tj both within buckets
and between buckets.

18.3 IM PA CT O F T H E
Exposure Exposure
CH A N G ES Exposure after after netting after netting
Dealver bilateral netting Dealer including CCP excluding CCP
The new regulations have led to a world where A 0 A 120 0
B 100 B 120 120
more collateral is required for O T C derivatives
C 20 C 90 90
transactions. Pre-crisis, most O T C transactions
Average 40 Average 110 70
were cleared bilaterally and an initial margin was
usually not required. Under the new regulations,
F ia u re 1 8 .4 Example where there are three market participants,
most transactions will be cleared through C C Ps one CCP, and two product types. One product type (represented by
where both initial and variation margin will be dotted lines) can be cleared; the other (represented by solid lines)
required from both sides. Furtherm ore, transac­ cannot.
tions that are cleared bilaterally between financial
institutions will require even more collateral than are three market participants and one CCP. For exam ple, in B's
they would if they could be cleared through C C Ps. dealings with A , the nonstandard transactions are worth 100 to

As discussed by Duffie and Zhu, there is one potential partial B and —100 to A ; the standard transactions are worth +50 to A

offset to the huge increase in collateral requirem ents mandated and —50 to B.

by the new rules.10 Under central clearing there is the potential
for more netting. In Figure 18.1, under bilateral clearing a mar­
ket participant has many different netting sets, one for each of
the other market participants. Under central clearing, there is
only one netting set. Bank A can, for exam ple, net its transac­
tions where Bank B is the counterparty with its transactions
where Bank C is the counterparty, provided that all go through
the same CCP.
W ithout central clearing, the average exposure before collateral
of the three parties is +40. With central clearing, the average
exposure is 110 when the exposure to the C C P is included and
70 when it is not. Central clearing is likely to increase the col­
lateral market participants have to post in this simple situation.
This happens because without the central clearing rules stan­
dard transactions can be netted with nonstandard transactions,
but with the central clearing rules this is no longer possible.

Figure 18.1, however, is a sim plification. It suggests that the
choice is between a 100% bilateral world and a world where
all transactions are cleared through a single CCP. The reality is
that (a) there will be a number of C C P s and it is quite likely that
they will not cooperate with each other to reduce initial margin
requirem ents, and (b) some transactions will continue to be
cleared bilaterally; so banks will face a situation that is a mixture
of the two worlds depicted in Figure 18.1.
Most experts think that there will be an increase in netting,
but the overall effect of the changes will be an increase in
margin requirem ents. Pre-crisis, relatively few O T C derivatives
attracted initial margin. Post-crisis, the vast majority of O T C
derivatives will require initial margin. A related consideration is
that, as more transactions are cleared through C C P s, more of
the funds of a financial institution will be tied up in default fund
contributions.

It is even possible that the new rules requiring the use of C C Ps

could reduce rather than increase netting in some cases. This is
illustrated by Figure 18.4, which shows the situation where there
10 See D. Duffie and H. Zhu, "D oes a Central Counterparty Reduce
Counterparty Risk?" Review of A sset Pricing Studies 1 (2011): 74-95.
Liquidity
Most of the collateral required under the new regulations will
have to be in the form of cash or governm ent securities. An
increasingly im portant consideration for all derivatives market
participants is therefore liquidity. Not only will the collateral

Chapter 18 Regulation of the OTC Derivatives Market ■ 299


posted at any given tim e be a drain on liquidity, but banks will
have to keep a sufficient quantity of liquid assets on hand to
ensure that they are able to m eet any margin calls. (Margin calls
from a C C P have to be met almost im m ediately.) A s we saw in
Chapter 22, Basel III has recognized the im portance of liquidity
by proposing two new liquidity ratios that banks must adhere to.
Capital has in the past been the key metric in determ ining the
profitability of different business units and different projects at
a bank. In the future, a two-dimensional metric involving capital
and liquidity is likely to be used. O ften there will be a trade-off
between capital and liquidity in that a project will look attractive
from a capital perspective and unattractive from a liquidity per­
spective, or vice versa.
Rehypothecation
Liquidity pressures are likely to increase because of another
post-crisis change. W hat is known as "rehypothecation" was
common in some jurisdictions (particularly the United Kingdom)
pre-crisis. (See Business Snapshot 18.1.) It involved a dealer
using collateral posted with it by one counterparty to satisfy a
collateral demand by another counterpart. It is estimated that
pre-crisis about $4 trillion of collateral was required in derivatives
markets, but that because of rehypothecation only $1 trillion of
BUSIN ESS SN A PSH O T 18.1
REH YPO TH ECA TIO N
A practice in the m anagem ent of collateral known as rehy­
pothecation can cause problem s. If Party A posts collateral
with Party B and rehypothecation is perm itted, Party B can
use the same collateral to satisfy a demand for collateral
from Party C ; Party C can then the use the collateral to
satisfy a demand for collateral from Party D; and so on. In
2007, it was estim ated that U.S. banks had more than
$4 trillion of collateral, but that this was created by
using $1 trillion of original collateral in conjunction with
rehypothecation. Rehypothecation was particularly com ­
mon in the United Kingdom , where title to collateral is
transferred.
A fter Lehman declared bankruptcy in Septem ber 2008,
clients (particularly European hedge fund clients) found it
difficult to get a return of the collateral they had posted
with Lehman because it had been rehypothecated. As a
result of this experience, many market participants are
more cautious than they used to be, and clauses in C SA s
banning or limiting rehypothecation are now common.
300 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
11
new collateral was posted. In other words, each item of collat­
eral was used on average four tim es. Rehypothecation will be
restricted under new rules developed by the Basel Com m ittee
and the International Organization of Securities Commissions
(IO SCO ). These rules allow initial margin to be rehypothecated
once, but only if certain conditions are satisfied. Variation margin
can be rehypothecated. But increasingly dealers them selves
impose restrictions on rehypothecation because they do not
want to be disadvantaged in the same way that some of
Lehman's counterparties were (see Business Snapshot 18.1).
The Convergence of O TC and
Exchange-Traded Markets
The developm ents we have been discussing are blurring the
distinction between O T C derivatives and exchange-traded
derivatives. Many O T C transactions are now traded on platforms
similar to exchanges and cleared through organizations simi­
lar to exchange clearing houses. As time goes by, more O T C
transactions are likely to be classified as "standard" so that the
percentage of O T C transactions handled similarly to exchange-
traded transactions will increase. W hat is more, even those
O T C transactions between financial institutions that are cleared
bilaterally may begin to look more like exchange-traded transac­
tions. This is because margin has to be posted with a third party,
and we can expect organizations (som ewhat similar to exchange
clearing houses) to be set up to facilitate this.
It is also the case that exchanges are increasingly trying to offer
less standard products to institutional investors in an attem pt
to take business away from the O T C market. As a result, while
O T C markets are moving in the direction of becoming more like
exchange-traded m arkets, exchange-traded markets are moving
in the opposite direction and becoming more like O T C m arkets.
Many C C P s and exchanges have a common ownership and will
find areas for cooperation on margin requirem ents and business
practices. W hether a transaction is being cleared through an
exchange or a C C P may not be im portant in the future because
it will be handled in the same way by the same organization.
18.4 C C P S A N D B A N K R U P T C Y
The key objective of regulators is to reduce system ic risk. Some
com m entators have criticized the new derivatives regulations as
replacing too-big-to-fail banks by too-big-to-fail C C P s. 1
11 See M. Singh and J . A itken, "Th e (Sizable) Role of Rehypothecation in
the Shadow Banking System ," Working Paper, International M onetary
Fund, 2010.
It certainly would be a disaster for the financial system if a major
C C P such as LCH Clearnet's Sw apCIear and CM E's ClearPort
were to fa il.12 In theory, as described in Hull (2012), it is possible
to design the contract between C C P s and their members so that
it is virtually impossible for a C C P to fail. In practice, it is consid­
ered im portant that a C C P has "skin in the gam e." It is then
motivated to take good decisions with respect to key issues
such as whether a new m em ber should be adm itted, how initial
margins should be set, and so on.
The main reason why it makes sense to replace too-big-to-fail
banks by too-big-to-fail C C P s is that C C P s are much sim pler
organizations than banks. They are therefore much sim pler to
regulate than banks. In essence, regulators need ensure only
that the C C P follows good practices in (a) choosing members,
(b) valuing transactions, and (c) determ ining initial margins and
default fund contributions. In the case of banks, a myriad of dif­
ferent, much more com plex activities must be monitored. It is
of course im portant for regulators to ensure that C C P s are not
allowed to becom e more com plex organizations by expand­
ing outside their core activity of interm ediating derivatives
transactions.
SUM M ARY
Prior to the 2007-2008 credit crisis, the over-the-counter (O TC)
derivatives market was largely unregulated. Two market partici­
pants could agree to any transaction they liked and then reach
any agreem ent they liked on how the transaction would be
cleared. They were also free to choose any arrangem ents they
liked for the posting of collateral. This is no longer the case.
The O T C derivatives market is now subject to a great deal of
regulation throughout the world. The extent to which the O T C
derivatives market should be blamed for the crisis is debatable,
but post-crisis regulatory changes are having more effect on this
market than on almost any other sector of the economy.
Most standard O T C derivatives between two financial institu­
tions must be cleared through central counterparties. These
are very similar to exchanges. They require initial margin and
12 See J . Hull, "C C P s, Their, Risks, and How They Can Be Reduced,"
Jo u rn a l o f D erivatives 20, no. 1 (Fall 2012): 26-29.
Chapter 18
variation margin to be posted by both sides. Nonstandard trans­
actions between financial institutions will continue to be cleared
bilaterally, but are subject to regulation on the collateral that
must be posted. Specifically, transactions between financial
institutions are subject to initial margin (segregated) and varia­
tion margin (transferred from one side to the other when the
value of outstanding transactions changes).
W hat will the derivatives world look like in 15 or 20 years? Pres­
ent trends indicate the there will be a convergence between
O T C and exchange-traded markets, and the distinction between
the two will becom e blurred. But it should be acknowledged
that there is no certainty that this trend will continue. The O T C
market as it existed before the crisis was very profitable for a
few large banks. It is possible that they will chip away at the reg­
ulations so that they are able eventually to find a way of creating
a new O T C m arket som ewhat similar to the one that existed
before the crisis. A battle is likely to take place pitting the deter­
mination of regulators against the ingenuity of banks.
Further Reading
Basel Com m ittee on Banking Supervision and IO SC O .
"M argin Requirem ents for Non-Centrally Cleared D erivatives,"
Septem ber 2013.
Duffie, D ., and H. Zhu. "D oes a Central Counterparty Reduce
Counterparty Risk?" R eview o f A ss e t Pricing Stu dies 1 (2011):
74-95.
Hull, J . "C C P s, Their Risks, and How They Can Be Reduced."
Journal o f D erivatives 20, no. 1 (Fall 2012): 26-29.
Hull, J . "The Changing Landscape for D erivatives." Journal o f
Financial Engineering 1, no. 2 (2014).
Hull, J . "O T C Derivatives and Central Clearing: Can All Transac­
tions Be Cleared?" Financial Stability Review 14 Ouly 2010): 71-89.
Singh, M ., and J . Aitken. "The (Sizable) Role of Rehypothecation
in the Shadow Banking System ." Working Paper, International
Monetary Fund, 2010.
Regulation of the OTC Derivatives Market ■ 301
Capital Regulation
Before the Global
Financial Crisis
Learning Objectives
A fter com pleting this reading you should be able to:

Explain the motivations for introducing the Basel regula­
tions, including key risk exposures addressed, and explain
the reasons for revisions to Basel regulations over tim e.
Explain the calculation of risk-weighted assets and the
capital requirem ent per the original Basel I guidelines.
Describe measures introduced in the 1995 and 1996
am endm ents, including guidelines for netting of credit
exposures and methods to calculate m arket risk capital for
assets in the trading book.
Com pare the standardized IRB approach, the Foundation
Internal Ratings-Based (IRB) approach, and the advanced
IRB approach for the calculation of credit risk capital under
Basel II.
Com pare the basic indicator approach, the standardized
approach, and the Advanced M easurem ent Approach for
the calculation of operational risk capital under Basel II.
Summarize elem ents of the Solvency II capital fram ework
for insurance com panies.

Describe changes to the Basel regulations made as part of

Basel II, including the three pillars.

By Mark Carey of the G A R P Risk Institute.

303
Financial regulation has developed increm entally over the cen­
turies, often in response to stressful periods which exposed the
limitations of previous regulations.
In the days before governm ent regulation, banks or insurance
com panies could be created without official approval. Success
(or failure) was based primarily on w hether they could persuade
clients to use their services.
As such, these businesses have often found it essential to
establish trustworthy reputations. They did this by enlisting
the support of prominent people in the community, carrying
large amounts of capital at creation, and constructing promi­
nent buildings. These measures provided com fort that deposits
would be returned and claims paid as promised. Later, govern­
ments required new financial institutions to obtain a license
before being allowed to operate
Financial institution failures were frequent, and som etimes
occurred not because of insolvency but because of a loss
of client confidence. When losses occurred, clients naturally
attem pted to withdraw funds from the institution in question.
When these withdrawals grew into a run or panic, even a solvent
institution could fail if it could not liquidate assets or raise new
funds quickly enough.
The first "regulations" were the result of financial firms band­
ing together to share resources in the event of runs. The Bank
of England, for exam ple, was originally a private-sector entity
that would provide support to other banks. In addition, early
clearinghouses were partly arrangem ents for mutual support.
Specifically, clearinghouse m em bers shared financial statem ents
with each other and had rights of inspection, and so monitoring
and enforcem ent of solvency was a part of the arrangem ents.
However, this was done privately.
Such private arrangem ents had several limitations.
• If a panic was big enough, no entity without the power to
print money would have enough resources to support the
financial system . As a result, governm ent controlled central
banks gradually replaced clearinghouses and private banks as
lenders of last resort.1
• Governm ents learned that financial crises imposed large
costs on the econom y as a whole (e.g ., crises were often fol­
lowed by depressions). Desiring stability, governm ents began
making attem pts to ensure that financial institutions were sol­
vent and liquid enough to survive plausible levels of distress.
Such regulations becam e more wide-ranging in the wake of
each crisis.
1 Central banks may operate independently from political interference
but are usually considered governm ental entities.
304 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• Custom ers of failed financial institutions were unhappy (at the
very least) when large fractions of their wealth disappeared.
Fraud was not uncommon, but even when a failure was not
associated with fraud, custom ers com plained of unfairness
and of the difficulty of adequately monitoring a financial insti­
tution's safety-and-soundness.
• Globalization was the fourth trigger of regulation ,and espe­
cially of international coordination of regulation. Central
banks have facilitated international transfers and capital
movements for centuries. As international trade blossomed
in the 1960s and 1970s, and as multinational corporations
becam e more numerous, foreign exchange flows and capital
flows grew ever larger.
Multinationals valued financial service providers who operated
in many countries, which gave rise to several issues.
• First, large financial firms, especially international banks,
becam e interlinked, so a failure of one would cause problems
in many countries, not just its home country.
• Second, as described further below, banks and regulators
becam e concerned about com petitive (dis)advantages flow ­
ing from differences in capital requirem ents across nations.
• Third, technical arrangem ents in clearing and settlem ent
proved to be im portant. For exam ple, when Herstatt Bank
failed in the summer of 1974, differences in the required
delivery tim es for currencies across countries and time zones
caused large amounts of foreign exchange transactions to fail
to clear. In turn, this raised concerns about a potential col­
lapse of the global financial system.
It becam e evident that only official-sector cooperation and
coordination could address these risks. As a result, what is now
called the Basel Com m ittee on Banking Supervision (BCBS) was
created 1974, following the Herstatt failure. Perhaps motivated
in part by the perceived success of the B C B S, the International
Association of Insurance Supervisors (IAIS) and the International
Organization of Securities Com m issioners (IO SCO ) were created
in 1994 and 1983, respectively.
This chapter focuses on solvency regulation of banks and insur­
ance com panies before the Global Financial Crisis (i.e., before
2009), with a particular attention to the Basel Accord. Later
chapters focus on regulation after the crisis.
19.1 T H E B A S E L A C C O R D : B A S E L I
V A R IA N T
In the late 1980s, the BCBS developed a specification for capital
(solvency) regulation. First published in December 1987, it was
formally agreed in July 1988 fully implemented by the end of 1992.
This accord, which has come to be known as Basel I, was ini­
tially agreed upon by the members of the BC BS (roughly, the
G 10 nations). By the early 2000s, however, it becam e a de facto
global minimum capital standard. Note that Basel I has no legal
standing in and of itself. Rather, nations haven chosen to incor­
porate its standards through dom estic law and regulation.
Two events motivated creation of Basel I.
• First, the growth of cross-border finance continued after Her-
statt's failure and it was evident that the G 1 0 nations had a
common interest in ensuring that banks had enough equity
to absorb large losses.
• Second, international banks were com peting vigorously in
each other's home countries. However, minimum levels of
required capital varied significantly across nations, creating
a perception that banks headquartered in countries with
low minimums had a com petitive advantage. In response,
m em bers of the B C B S decided to develop a global mini­
mum standard to "level the playing field " and avoid a race
to the bottom . Th at is, while the Basel Accord was partly
about ensuring safety and soundness, negotiations also
had an elem ent of m aneuvering for perceived com petitive
advantage.
The central elem ents of Basel I are a risk-based capital ratio, a
minimum level of this ratio, and definitions of the num erator and
denominator.
The Risk-Based Capital Ratio
A goal of Basel I was to ensure that financial institutions would
have sufficient assets to remain solvent during periods of stress.
However, the BC BS had to find a way of measuring sufficiency.
Since banks differ greatly in size, specifying minimum amounts
of capital (in dollars, pounds, etc.) would be infeasible. A ratio
of capital to the book value of assets (i.e., "leverage ratio"), on
the other hand, would seem ingly allow for a universal standard
that could apply to institutions of all sizes. However, banks can
also differ greatly in the composition and riskiness of their bal­
ance sheets.
Given the perception that minimums specified in term s of
leverage ratios would disadvantage banks with low-risk port­
folios and advantage those with high-risk portfolios, the BCBS
decided on a risk-based capital ratio (i.e., a ratio of capital to
risk-weighted assets (RWA)) instead. Moreover, these assets
included not only assets on the balance sheet according to
accounting conventions (e.g ., loans or securities), but also off-
balance-sheet exposures (e.g ., loan commitments) and deriva­
tive exposures. Though crude by modern standards, these
risk-based ratios represented a major innovation at the tim e.
Chapter 19 Capital Regulation Before the Global Financial Crisis
The Ratio and Minimum Values
Basel I required consolidated banking organizations to maintain
Tier 1 capital >4%
RWA
and
Total capital > 8%
RWA
Total capital is the sum of Tier 1 capital and Tier 2 capital. By
design, Tier 2 capital may com prise no more than half of total
capital. To the extent that Tier 1 capital exceeded 4 percent of
risk-weighted assets, the excess could be included with Tier 2
capital to satisfy the second (8%) requirem ent.
"Capital"
Under the Basel I fram ework, Tier 1 capital consists of common
equity and disclosed reserves (i.e., retained earnings plus some
types of minority interest in subsidiaries) minus goodwill. Later
fram eworks include a limited amount of non-cumulative per­
petual preferred stock.
In contrast, Tier 2 capital consists of
• loan loss reserves not already allocated to im pairm ent of
particular assets;
• undisclosed reserves (including some revaluation reserves); and
• hybrid instruments (i.e., unsecured, subordinated, not
redeem able at the investor's behest, on which payment
default would not precipitate bankruptcy or resolution, and
on which interest or dividend payments could be deferred.)
A limit was placed on the proportion of loan loss reserves
allowed into capital (originally 2%, later reduced to 1.25% of
RWA). Some kinds of subordinated debt and preferred stock
were in the latter category. In the years after Basel I was im ple­
m ented, consultants and investm ent bankers invented instru­
ments that would qualify as Tier 1 or Tier 2 capital.
Though never expressed by the B C B S, two assumptions were
implicit in these definitions.
• First, preservation of solvency was the job of Tier 1 capital,
whereas Tier 2 capital would provide resources for recapi­
talization of an entity in resolution and reduce the impact of
failures on depositors.
• Second, although general loan loss reserves were often viewed
as covering losses that are likely already embedded in the
entity's portfolio but that have not yet occurred, they were not
counted as loss-absorbing capacity that could preserve solvency.
2 The ratios are som etim es referred to as "C o o ke " ratios, for Peter
Cooke of the Bank of England.
■ 305
Table 19.1 Risk Weights by Asset Category

Risk Weight Asset Category

0% Cash; claims on O E C D governm ents such as bonds issued by the central governm ent; other
instruments with a full guarantee from an O E C D governm ent

20% Claim s on O E C D banks and on O E C D public sector entities, such as claims on municipalities or on
Fannie Mae and Freddie Mac

50% Uninsured residential m ortgages

100% All other exposures, such as commercial or consum er loans

Risk-Weighted Assets off-balance-sheet exposures (along with as nontraditional on-

balance-sheet exposures such as derivatives).
To make the ratio risk-sensitive, the on-balance-sheet amount of
each type of asset is multiplied by a percentage w eight accord­ Traditional off-balance-sheet exposures were converted to a
ing to the risk it poses. The RWA is the sum of such products credit-equivalent amount (i.e., on-balance-sheet equivalent) by
N multiplying by one of the credit conversion factors shown in
RW A= ^ Table 19.2. The risk w eight was then determ ined by the nature
i =1 of the counterparty.

where W| is the risk w eight and A| is the size of the asset.
In Basel I, the weights are as shown in Table I, which includes a
summary of the assets in each category. In the absence of other
adjustm ents, the maximum amount that a position could con­
tribute to RWA was the book value of its assets (since the m axi­
mum risk w eight was 100 percent).
Implicit in Table 19.1 is a view that no O E C D governm ent would
ever default on its obligations as well as that residential mort­
gages and claims on banks are much less likely to impose losses
than a typical bank loan. Though these assumptions appear
unreasonable today, they were consistent with what was experi-
o V. If the current market value is negative (making it a
enced in the decades preceding Basel I.
Example 19.1:
The assets of a Canadian bank consist of C $200 million of loans
to corporations, C$100 million of Canadian central governm ent
bonds, C$100 million of residential m ortgages insured by the
central governm ent, and C$100 million of uninsured residential
m ortgages. Though the book value of assets is C$500 million,
the sum of risk-weighted assets is C$250 million since
RWA = 100% x 200 + 0% x 100 + 0% x 100 + 50% x 100 = 250
Though the concept of RW A was natural for traditional
balance-sheet exposures, banking organizations also had many
3 Im plicit in the beneficial treatm ent of sovereign debt is the expectation
that governm ents can print money to address potential defaults. This
assumption does not hold when debt is borrowed in foreign currencies,
or where a national governm ent is not fully in control of its own m one­
tary policy, as could be the case in the European M onetary Union today.
For exam ple, a $100 million five-year loan com m itm ent to an
O E C D m unicipality would first be converted to a $20 million
credit equivalent, and then be assigned a 20 percent risk
w eight. Thus, its contribution to RW A would be only $4 million.
With respect to derivatives, Basel I offered authorities in each
nation a choice between two methods of computing a credit
equivalent amount (this structure was revised in 1995 with the
addition of a maturity bucket greater than five years)
1. Current Exposure Method:
a. First, calculate the current market value of the contract
liability rather than an asset), set V = 0.
b. Second, add an amount D to account for changes in the
contract's future market value. For interest rate swaps,
D was
i. zero for for maturities of less than one year,
ii. 0.5% of the notional value of the swap for remaining
maturities of five years or less; and
iii. 1.5% for more than five years.
c. For foreign exchange swaps, D was
i. 1% of notional value for maturities of less than one
year,
ii. 5% of notional value for maturities between one and
five years, and
iii. 7.5% of notional value for maturities greater than
five years.
2. Original Exposure Method (only for interest rate and foreign
exchange contracts)
a. Nations could ignore the current market value of the
contract and choose whether to use the original or
remaining maturity.

306 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Table 19.2 Credit Conversion Factors for Traditional Off-Balance-Sheet Exposures

Credit Conversion Factor Off-balance-sheet Category

100% Guarantees on loans and bonds, bankers acceptances, and equivalents

50% W arrantees and standby letters of credit related to transactions

20% Loan commitments with original maturity greater than or equal to one year

0% Loan commitments with original maturity less than one year

b. For interest rate contracts, D was Netting

i. 0.5% for maturities of less than one year,
A market convention is that entities engaged in over-the-counter
ii. 1% for maturities between one and two years, and
derivatives transactions sign an International Swaps and Deriva­
iii. 1% + 1% X IN T [M — 1] for maturities greater than
tives Association master agreem ent specifying that, in the event
two years respectively4
of a default by a counterparty, the defaulting entity's transactions
c. For foreign exchange contracts, D was
with each other counterparty could be considered as a single
i. 2%, for maturities of less than one year,
transaction. Choices in these agreem ents permit bilateral trans­
ii. 5%, for maturities between one and two years, and
actions with positive and negative values to offset one another.
iii. 5% + 3% X IN T [M — 1] for maturities of greater
than two years For exam ple, Bank A might enter an interest rate swap to buy
Equity and com m odity derivatives were not discussed in Basel I. protection from Bank B against an increase in interest rates, and
The risk w eight was set according to the nature of the counter­ later enter another swap with an identical notional amount with
party, excep t that no risk w eight could be more than 50%. The Bank B to sell protection. If rates did not move in the interim
1995 Am endm ent included add-on factors for such derivatives. between these two agreem ents, their com bined im pact on
Bank A's (and Bank B's) net exposure and portfolio value is zero.
The 1995 and 1996 A m endm ents ("M a rk e t Risk A m endm ent")
Put bluntly, the handling of derivative exposures in Basel I was However, the original Basil I allowed alm ost no capital credit for
crude. However, as Basel I was being developed, the 1987 stock netting. Though changes in interest rates would have offsetting
market crash had not yet occurred, value-at-risk (VaR) was not in effects on the market value of the two swaps in the previous
widespread use, and quantitative market risk m anagem ent was exam ple, the treatm ent in the original Basil I would apply an
in its infancy. By 1995, all of this had changed. add-on to each swap, disincentivizing hedging. The rationale
for this was that (as of 1988) master agreem ents had not been

Example 19.2: sufficiently tested in bankruptcy courts.

By 1995, the m em bers of the BC BS were more confident that

The derivatives book of an international bank contains $300 mil­
such agreem ents would function as intended and thus the 1995
lion of notional value of interest rate swaps with $100 million
Am endm ent allowed reductions in credit equivalent amounts
each having remaining maturity of 0.5, 1.5 and 2.5 years. Their
when enforceable bilateral netting agreem ents were in place.
market value is $30 million.
In calculating credit equivalent amounts, the com plete net­
The book also has $300 million of foreign exchange swaps with
ting of the market values of all positions was allowed for each
a similar maturity profile and a market value of -$10 million.
counterparty i, and add-ons Dj for future changes in value were
All counterparties are private corporations, so the risk w eight is reduced for each category of derivative j
100 percent. Under the exposure method described above, the
credit equivalent amount would be: CEA = m ax 0 + V [ 0 . 4 * Dj + 0.6 * Dj * N R R ]
C E = 30 + 0% x 100 + 0.5% x 200 + 1% x 100 + 5 % x2 0 0 L= 1 J

= $42 million where NRR (i.e., the net replacem ent ratio) is

Under the original exposure m ethod, it would be max(YIi=i Vt, 0)

N RR =
S L i max(Vu 0)
C E = 0.5% x 100 + 1% x 100 + 2% x 100 + 2% x 100 + 5% x 100
The numerator is the market value of positions of type j with net­
+ 8% x 100 = $18.5 million
ting, while the denominator is the market value with no netting.
Note that the net replacement ratio is an average across all posi­
tions; although add-on factors and the impact of netting may differ
4 where INT[X] returns the closes integer to X. across types of derivatives, the impact of the latter is ignored.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 307

Example 19.3 Credit Equivalent Amount for Derivatives
Suppose a bank has a portfolio of five derivatives with two counterparties, as described in the following table

Counterparty Type Maturity Notional Market value Add-on factor

1 Interest rate 2 100 -5 0.5%

1 Interest rate 3 100 0 0.5%

1 Foreign exch. 2 200 10 5%

2 Equity option 6 100 0 10%

2 W heat option 0.5 300 -1 0 10%

With netting, the current exposure portion of the credit equiva­
lent amount is 5 for the first counterparty (i.e., the —5 exposure
on the first interest rate derivative is netted against the 10 exp o­
sure on the foreign exchange derivative) and 0 for the second,
for a total of 5. Note that current exposure may not be less than
zero, and the —10 market value on the wheat option may only
be netted against positive exposures at the second counter­
party, not at the first counterparty.
The standardized approach details separately for five categories
of positions:
• fixed income securities and interest rate derivatives other
than options, for which remaining maturity was a key driver;
• equity securities and equity derivatives other than options;
• foreign exchange;
• com m odities; and

In this case, NRR = 0.5 because the num erator of NRR is the
current exposure of 5 and the denom inator is the sum of the
positive exposures (i.e., 10).
The add-on for potential future exposure must be calculated
separately for each type of derivative, multiplying the total
notional value for each type by the add-on factor to obtain
values of Dj. For the interest rate derivatives, 200 X 0.5% yields
a value of 1, while for the remaining types in the table D is 10,
10, and 30 for the foreign exchange, equity, and wheat types,
respectively. Applying the formula for C E A
• all types of options.
These approaches were relatively simple for some categories,
while for others there were many operational com plexities (e.g.,
the separate treatm ent of sp e cific risk and general m arket risk,
where the latter is due to general movements in m arket prices
and the form er is driven by idiosyncratic changes in a specific
position's value).
The internal models-based approach em bodied a major change
in philosophy by permitting banks to use internally developed
risk measures as the inputs to formulas specified by regulators.

C E A = 5 + (0.4*1+0.6*1*.5) + (0.4*10+0.6* 10*. 5) + (0.4*10+0.6*10*.5)
+ (0.4*30-0.6*30*.5) = 5 + .7 + 7 + 7 + 21 = 40.7
To limit manipulation of the internal m easures, monitoring was
built in. In contrast, the standardized approach specified most of
the details and was based on observable characteristics of posi­
tions (e.g ., remaining maturity).

Capital for Market Risks Associated with Trading
Activities
W hile m arket risk (i.e., changes in market value of trading
book assets) is the primary risk for the trading book, it was not
captured by the requirements described previously. The 1996
Am endm ent to Basel I offers two ways to measure of for market
risk: a standardized approach and an internal models-based
approach.
For banks with trading books of material size, the internal
models-based approach was preferred because it generally
yielded smaller capital requirem ents. This is in part due to the
fact that asset values were not assumed to be perfectly corre­
lated, as they were in the standardized approach.
Under both approaches, capital charges were calculated sepa­
rately for specific risk (SR) and general market risk (MR) for each
of the five categories. These were summed and multiplied by
12.5 so that the usual multipliers on risk weighted assets could
also be applied to them 5
Total capital for trading assets = 0.08 * l2.5£y=1(M/?7- + S R j)
To measure m arket risk, a bank using the internal models-based
approach must calculate value-at-risk (VaR) for each asset
5 12.5 is the inverse of 8%. The m ultiplier has the effect of turning a
capital requirem ent into an RWA m easure. This adjustm ent is based on
the total capital requirem ent rather than Tier 1 adjustm ent.

308 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
category. A 10-day VaR at the 99th percentile was required,
based on at least one year of daily data, usually using a scaled
one-day VaR multiplied by V T o . Correlations within a category
of position were considered by the internal model, whereas
adjustm ents for correlations across categories were allowed at
the discretion of the national supervisor.
Thus, m arket risk was given by
MR = max(VaRt-i, m*VaRaVg)
where VaRavg was the average VaR over the past 60 days and m
was a m ultiplier that was never less than 3 (and could be larger
if national supervisors found deficiencies in the bank's models
or other system s, or if monitoring implied other deficiencies.)
Given a multiplier of 3, the second term was usually larger
than the 10-day VaR com puted for the preceding business day
(i.e., t — 1).
Capital for specific risk, which was required for fixed income,
equity instruments, and derivatives, could be determ ined using
either the standardized approach or the bank's internal models.
In the latter case, the approach was similar to that for market
risk, but the multiplier was 4 rather than 3 and capital for sp e­
cific risk could not be less than half of capital calculated using
the standardized approach.6
The 1996 Am endm ent created a new class of capital (i.e., Tier 3
capital), com posed mainly of unsecured subordinated debt with
an original maturity of at least two years, that could be used to
meet part of the m arket risk capital requirem ent. However, only
about 70 percent of the market risk capital requirements could
be satisfied with Tier 3 capital.
Th e 1996 A m en d m en t sp ecified several q u alitative criteria
th at banks using the internal m odels-based approach must
m eet (e .g ., sound risk m anagem ent, in d ep en d en t risk m an­
ag em ent units, lim its, active invo lvem ent of the board, and
so on).
It also required daily back testing. Each day, for each model,
the bank was required to use its current model and procedures
to calculate one-day 99% VaR for each of the most recent 250
days, and to com pare the actual loss for the day to the VaR.
Each day with actual loss larger than VaR was term ed an e x c e p ­
tion. Five or less exceptions enabled the m ultiplier m to be 3,
but larger numbers of exceptions could lead to larger multipliers
at the discretion of the supervisor. With 10 or more exceptions,
a m ultiplier of 4 was required.
6 Thus, as a practical matter, a bank using internal m odels was also
required to calculate capital under the standardized approach.
Chapter 19 Capital Regulation Before the Global Financial Crisis
19.2 T H E B A S E L A C C O R D : B A S E L II
V A R IA N T
Some supervisors had becom e concerned by the mid-1990s that
Basel I, while more risk-based than capital requirem ents based
on equity-to-asset ratios, was not risk-based enough. The 100
percent risk weight, for exam ple, incorporated exposures pos­
ing a wide range of risk, from very safe loans made to highly-
rated corporations to very risky loans to commercial real estate
developm ent projects.
Moreover, banking crises in the Nordic countries had dem ­
onstrated that system ic problem s could occur even in well-
capitalized banking system s. M eanwhile, there had been several
technical advances in market and credit risk m easurem ent and
m anagem ent since 1987, signaling a potential for more precise
risk weighting and vastly improved risk m anagem ent at all levels
of banking organizations.
Basel II was the reaction to such concerns. Discussions among
supervisors about a revised accord began in the late 1990s
and the "final" revision was published in 2004 (further revisions
occurred frequently in the years that followed).
W hile retaining much of Basel I, Basel II contained four signifi­
cant innovations:
1 . Risk w eight formulas for credit risk based on modern
credit risk m anagem ent concepts and banks' internal risk
measures;
2. Required capital for operational risk, in addition to credit
risk and m arket risk.
3. In addition to minimum capital requirements (Pillar 1), Basel
II included specific requirements for supervision related to
capital and risk m anagem ent (Pillar 2) and required public
disclosures (Pillar 3).
4. Repeated use of Q uantitative Impact Studies (QIS) to fine-
tune the design of the accord. In each Q IS, banks contrib­
uted detailed data which was then analyzed by supervisors.
Although the first two innovations have received the most
attention from the public, the three pillars represented a major
developm ent as well. Through the early 2000s, regulatory phi­
losophy differed across nations, ranging from supervision-heavy
approaches (in which rules played much less of a role than the
judgm ent of field supervisors) to rules-heavy approaches (in which
regulators presented detailed rules and field supervisors focused
on evaluating compliance with the rules). Moreover, at the time of
Basel II developm ent, disclosures of bank condition and risk also
varied widely across nations. For exam ple, banks in some nations
did not disclose Basel I capital ratios or risk weighted assets.
■ 309
The three pillars represented a push toward convergence of
national practices. Specifically, Pillar 2 mandated that supervi­
sors require banks to have more than the minimum amount of
capital as well as internal capital adequacy and assessm ent pro­
cesses (ICAAP) that take their risk profile into account. Supervi­
sors were to assess bank IC A A Ps and were to act if they were
not satisfied. Additionally, supervisors were to intervene early if
there was danger that a bank's capital would fall below the mini­
mum by requiring prompt corrective actions. Supervisors were
also to encourage banks to improve risk m anagem ent practices
and to actively push for im provem ent of deficiencies. National
discretion regarding enforcem ent of the accord's provisions was
reduced, and national regulators were to be transparent about
their implementation efforts, including those concerning the
requirem ents in excess of the minimums.
Pillar 3 required more qualitative and quantitative disclosures,
in the hope that pressure from market participants would help
improve banks' practices. Q ualitative disclosures included
aspects of corporate structure, applicability of the accord and
approaches used, accounting practices, and other matters.
M eanwhile, quantitative disclosures included many characteris­
tics of a bank's capital, exposures, and risk measures.
However, some found the requirements difficult to interpret and
disclosure practices remained uneven for many years, until addi­
tional clarity (and pressure) was provided by the Basel Comm ittee.
Capital for Credit Risk
A t Basel II was developed, supporting data and analysis
remained limited, and many supervisors were concerned that
banks would manipulate internal risk measures to reduce
required capital. Negotiators addressed such concerns by
including three options for determination of minimum capital
requirem ents for credit risk:
1. The standardized approach. Like Basel I, this included some
increased sensitivity of risk weights to credit quality for bor­
rowers with external ratings.7
2. The Foundation Internal Ratings-Based (IRB) approach.
Here, risk weights were sensitive to internal measures of
default probability, with the use of regulatory-specified loss
given default param eters.
3. The Advanced IRB approach. Risk weights were sensitive to
internal measures of default probability, loss given default,
and exposure at default.
7 The United States chose not to im plem ent the Standardized Approach.
Internationally active banks were required to use IRB approaches, while
all other banks w ere required to use an updated version of the Basel I
requirem ents.
310 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The Standardized Approach
As under Basel I, the Basel II standardized approach was
intended for banks with internal risk measures and risk man­
agem ent practices that were insufficient to support the IRB
approaches. However, the risk weights were som ewhat more
sensitive to variations in risk. Under Basel I, the headline risk
weights depended on asset type and nationality of the obligor.
Under the Basel II standardized approach, the headline risk
weights depended on obligor type and rating for some obli­
gor types, and on asset type for others. Exam ples appear in
Table 19.3:
Although the risk weights appear less generous for banks and
sovereigns than was the case under Basel I (e.g ., the ratings of
many banks and sovereigns were such that risk weights of 20 or
50 percent or more would apply), much of the generosity was
restored at national discretion:
• A supervisor could choose to apply risk weight of 0 on a
bank's holding of claims on its own sovereign debt that were
issued in the nation's own currency. W here a supervisor
exercises such discretion, banks in other nations could also
risk-weight claims on that sovereign at 0%. This option was
widely exercised.
• Claim s issued by banks had a risk w eight of one category
less favorable than the sovereign's (and capped at 100%) or
a risk w eight based on the bank's own ratings, (or one cat­
egory more favorable where the obligation had no more than
3 months' original maturity, subject to a floor of 20%). Risk
weights on bank obligations could be capped at 100 percent.
The Standardized Approach included two ways of adjusting for
collateral. Under the "sim ple approach," which was similar to
Basel I, the risk w eight of a counterparty could be replaced by
the risk w eight of collateral for the portion of exposure covered
by the collateral. A minimum risk w eight on the collateral was
set at 20 percent, unless the collateral was sovereign debt in the
same currency as the exposure.
The alternative "com prehensive approach" required changes in
exposure and collateral am ounts to allow for possible changes
in the value. The risk w eight of the collateral was applied to
the reduced am ount of collateral, and the counterparty's risk
w eight was applied to the remaining exposure. Any netting
was applied separately to exposures and collateral, and either
Basel rules or (approved) internal m odels could be used to
make the adjustm ents.
The IRB Approach
The Gordy (2003) "asym ptotic single risk factor" model of
credit losses, now more commonly referred to as a one-factor
Table 19.3 Risk Weights Under the Standardized Approach

Obligation of: A A A to A A - A + to A — BBB+ to BBB — BB+ to B B — B+ to B — Unrated

Countries 0 20 50 100 150 100

Banks 20 50 50 100 150 50

Corporation 20 50 100 100 150 100

Obligation type:

Retail 75

M ortgage 35

Cash 0

O ther 100

Gaussian copula m odel, was an expression of the thinking that
led to the IRB A p p ro ach .8 The paper dem onstrates that in
large, well-diversified credit portfolios, a positive relationship
exists between the probability of default of an obligor and that
obligor's contribution to the capital needed to limit the proba­
bility of portfolio losses exceeding a percentile of the
loss distribution.
Using the Basel Com m ittee's choices of a one-year time horizon
for credit losses and a desire that capital be enough to absorb
losses up to the 99.9th percentile of the credit loss distribution,
the formula is:
Because the Basel Com m ittee did not view loan loss reserves
as Tier 1 capital, and yet loan loss reserves were thought to be
approxim ately equal to expected losses, the Com m ittee chose
to make capital a function only of unexpected losses (i.e., net
of expected losses). In cases where loan loss reserves are less
than EL, a reduction in capital is made for the shortfall. See
Figure 19.1 for a depiction of the capital for total stress losses,
expected losses, and unexpected losses.
This setup allowed the Basel Com m ittee to specify a loss per­
centile and an asset correlation p for each type of asset.101Each
individual asset's contribution to capital at any bank would then

Capital = Z iE A D i * LGDt * D R99.9i] - E L depend only on the bank's estim ates of EA D , LGD and PD for
that asset.
where
Basel II included two variants of the IRB approach:
• Capital is expressed in dollars;
• Foundation IRB, in which the bank would provide only the
• EADj is the exposure at default for asset i (i.e., the amount
PD, with the accord specifying values of EAD and LGD for
expected to be owed by the counterparty on asset i at the
each class of asset; and
tim e of default);
• Advanced IRB, in which the bank would provide all three
• LGD| is the expected loss given default for asset i (i.e., the
values.
fraction of EADj that is expected to be lost);9
Earlier work had found that, at least in the United States, most
• DR99.9i is the default rate at the 99.9th percentile for a large
large banks had internal rating system s that could be used to
portfolio of assets of type i. Gordy's research provides a for­
obtain a PD for each loan.11 Thus, supervisors expected that
mula for DR99.9
Foundation IRB would be feasible for most large banks. The lim­
^/p/V-1 (0 .9 9 9 ) ited available data on EAD and LGD made it likely that few er
DR99.9i = N N~1(PDi) +
V1~ P banks would be able to use Advanced IRB.

• EL is the expected loss (i.e., the expected mean annual credit

loss) on a portfolio and is given by
E L = Y,[EAD i * LGDi * P D i]
8 G ordy, M. B., 2003, A risk-factor model foundation for ratings-based
capital ratios, Jo u rn a l o f Financial Interm ediation 12, 199-232.
9 In the United States, the historical average LG D value was around 0.3
10 For large banks, with diversified portfolios representative of the mar­
ket, correlations were not expected to differ very much across banks. An
assumption is m ade that exposures are infinitely granular and that no
individual credit could affect the overall loss m etrics. The developm ent
of the Large Exposure Fram ew ork in 2014 was necessary when banks
w ere found to have sizable exposures to single counterparties.
11 Carey, Mark S., and W illiam F. Treacy, 1998, C redit risk rating at large
U .S. banks, Fed era l R eserve Bulletin, November.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 311


Fig u re 19.1 Loss distribution, expected and unexpected loss, and
capital.
Even Foundation IRB made capital quite risk-sensitive, as shown
in Table 19.4, which shows the values of DR given by the formula
for different values of PD and p at the 99.9th percentile.
Bank; Corporate, and Sovereign Exposures
Under IRB
For bank, corporate and sovereign exposures, Basel II assumes
that p and PD are related based on the work of Lopez (2004)12
1 — e x p (- S O P D ) 1 — e x p { —5 0 P D )
p = 0 .1 2 + 0 .2 4 1 -
1 — e x p { —5 0 ) 1 — e x p { —5 0 )
The formula implies that p decreases as PD increases, which
agrees with the idea that the determ inants of default for very
high-risk borrowers are often rather idiosyncratic, whereas
middle-risk borrowers tend to default mainly when the mac­
roeconomy is distressed (i.e., middle-risk borrowers are more
likely to default together). That defaults of the safest borrowers
are also rather idiosyncratic is ignored, but this does little harm
because values of DR for them are small.
The effect of the specified relationship between p and PD is that
DR increases som ewhat less quickly with PD than in Table 19.4.
The capital calculation for bank, corporate and sovereign exp o­
sures also includes a maturity adjustm ent to account for the
fact that assets with more than 1 year of remaining maturity will
remain on the balance sheet at the end of the loss-forecasting
12 Lopez, J ., 2004, The em pirical relationship between average asset
correlation, firm probability of default, and asset size, Jo u rn a l o f Finan­
cial Interm ediation 13(2), 265-283.
312 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
period and may have deteriorated in credit
quality. The maturity adjustm ent factor is
b ( M - 2 .5 )
MA = 1+
1 - 1.5 b
where M A is remaining maturity of the asset and
b = [0.11852 - 0.05478ln(PD)]2
Com bining all the elem ents discussed p revi­
ously, and recalling that Basel II expressed
required capital in term s of risk-w eighted assets,
the RW A for bank, corporate and sovereign
exposures is
RWA = 12.5 * EAD * LGD * (DR-PD) * MA
Under Foundation IRB, PD can be no lower than
.0003 for bank and corporate exposures (implicitly
it can be zero for sovereigns). LGD is 45 percent
for senior assets and 75 percent for subordinated
assets. When an asset is protected by collateral, the com prehen­
sive approach discussed earlier is applied (i.e., LGD is reduced
by the ratio of adjusted collateral to adjusted exposure. MA is
set to 2.5 in most cases.
As mentioned previously, values of PD, EA D , LGD and MA
under the Advanced IRB are given by the bank based on its own
data, m odels, estim ates and analysis.
For exam ple, suppose that a bank's assets consist only of $100
million BB-rated drawn loans with a remaining maturity of 3
years. PD is estim ated to be 0.01 and the LGD is 30 percent.
Then
M A = 1/(1 -1 .5 *0 .1 3 7 ) = 1.26
DR is 0.14, so RW A = 12.5*10 0 *.3 *(0 .14—0.01 )*1.26 =
$61.4 million.
Under Basel I, RWA would have been $100 million, and under
the Basel II standardized approach RWA would have also been
$100 million.
Retail Exposures Under IRB
For retail exposures, only a treatm ent like the Advanced IRB
approach is used (i.e., banks provide internal estim ates of PD,
LGD and EAD ). However, there is no maturity adjustm ent.
Rather, three correlations are used: p = 0.15 for residential
m ortgages; p = 0.04 for qualifying revolving assets (mostly
credit card balances), and for all other retail assets
1 — e x p ( —3 5 P D ) 1 — e x p ( —3 5 P D )
p = 0 .0 3 + 0 .1 6 1-
1 — e x p ( - 35) 1 - e x p (- 35)
Table 19.4 DR Values for different combinations of PD and
PD = 0.001 PD = 0.005
p = 0.0 0.001
p = 0.2 0.028
p = 0.4 0.071
p = 0.6 0.135
That is, correlations are lower for retail than for wholesale
exposures.
Like the previous exam ple, suppose a bank has
$100 million of residential m ortgages with a PD = .01
and an LGD of 30 percent. DR is 0.09 rather than 0.14, so
RW A = 12.5*100*.3*(0.09 - 0.01) = $30 million. This is less
than Basel I's $50 million for such a portfolio and the Basel II
Standardized Approach's value of $35 million.
Credit Mitigants Other Than Collateral
A credit substitution approach is used to handle arrangem ents
like guarantees and credit default swaps. Under this approach,
the credit rating of the guarantor is substituted for that of the
obligor in capital calculations, up to the amount covered by the
mitigant.
However, this approach is not quite generous enough relative
to the actual loss outcom es, given that a double default (both
guarantor and borrower) is implied in the treatm ent. How­
ever, Basel II assumes relatively low correlations of wholesale
counterparty defaults, meaning that double defaults should be
infrequent.
As an alternative, in 2005 the Basel Com m ittee am ended the
accord to allow capital without the mitigant to be multiplied by
0.15 + 160*PDg, where PD g is the one-year PD of the guarantor.
Capital for Operational Risk
The Basel C o m m ittee defined o p era tio n a l risk as the risk of
loss resulting from inadequate or failed internal processes,
people and system s, or from external events. In the w ake of
rogue trad er losses at Barings Bank in the m id-1990s, the
possibility of large losses from sources other than credit or
m arket risk becam e more concrete. Basel II im plem ented
capital requirem ents for operational risk, perm itting three
approaches:
1. Basic Indicator Approach: 15 percent of the bank's average
annual gross income over the past three years, ignoring any
Chapter 19 Capital Regulation Before the Global Financial Crisis
p
PD = 0.01 PD = 0.02
0.005 0.01 0.02
0.092 0.146 0.226
0.211 0.316 0.449
0.387 0.542 0.705
-1 o
years of negative gross income. This could be a material
amount of capital, given that gross income is usually far
larger than net income. However, this approach is relatively
easy to im plem ent and may be chosen by banks that do not
expect to be constrained by capital requirem ents.
2. Standardized Approach: Like the basic indicator approach,
but different multipliers are applied to gross income from
different business lines.
3 . The Advanced M easurem ent Approach (AM A): Internal
models are used to calculate a one-year VaR-like measure of
operational risk losses at the 99.9th percentile. Operational
risk capital is this amount less expected operational losses.
This approach allows recognition of risk mitigants such as
insurance under some circum stances.
Example 19.4 Capital for the Basic Indicator and
Standardized Approaches (Sbillions)
The table above provides an exam ple of a bank's gross income
for each of the eight business lines specified in the Standardized
Approach over a period of three years. It also shows the opera­
tional risk capital levels each year for each business line under
the Standardized Approach, which are obtained by multiplying
gross income tim es the business-line-specific multiplier.
Negative capital may offset positive capital within a year, but
years for which total estim ated capital is negative are ignored in
computing the three-year average. Thus, under the Standard­
ized Approach, operational risk capital in this exam ple would be
(8.73 + 9.69)72 = $9.21 billion.1
3
13 The definition of "gross incom e" provided by the B C B S for
the first quantitative im pact study w as: Net interest income
(interest received minus interest paid) + net fees and commissions
(fees and com m issions received minus fees and com m issions paid)
+ net trading incom e + gross other incom e. Income should be reflected
gross of any provisions (e.g . for unpaid interest) and gross of any opera­
tional costs and losses. Income should exclude extraordinary or irregular
items and also income derived from insurance.
■ 313
 Business Line Multiplier Gross Income Capital

Year 1 Year 2 Year 3 Year 1 Year 2 Year 3

Corporate Finance 18% 5 3 6 .90 .54 1.08

Trading & Sales 18% 1 -5 3 .18 - .9 0 .54

Retail Banking 12% 20 25 30 2.40 3.00 3.60

Com m ercial Banking 15% 30 40 35 4.50 6.00 5.25

Payment & Settlem ent 18% 2 3 -1 0 0 0.36 0.54 - 1 8 .0 0

A gency Services 15% 1 1 1 0.15 0.15 0.15

A sset M anagem ent 12% 1 2 2 0.12 0.24 0.24

Retail Brokerage 12% 1 1 2 0.12 0.12 0.24

Sum 61 70 -2 1 8.73 9.69 - 6 .9 0

Under the Basic Indicator approach, total gross income for each
year is multiplied by 15 percent, (again ignoring years of nega­
tive total gross income) and so the capital requirem ent in this
exam ple would be 0.15*(61 + 70)/2 = $9.83 billion.
Some Details of the AM A Approach
Banks using the A M A approach are expected to estim ate a dis­
tribution of operational risk losses in seven categories that incor­
porates estim ates of both the incidence of operational loss
events and their severity.14
A M A m ethodologies vary w idely across different banks, but two
broad approaches are most popular:
• A param etric and Monte Carlo approach, in which data are
used to param eterize the bank's choice of probability dis­
tribution for incidence (e.g ., Poisson) and for severity (e.g .,
W eibull). These distributions are then used to produce large
numbers of simulated loss observations from which the value
at the 99.9th percentile can be read; and/or
• Generate a moderate number of detailed scenarios in which
losses occur, and then measure operational losses in each
scenario. Separate scenario analyses are often conducted for
each category of operational losses. Scenario analysis has the
advantage of generating informative narratives and being
forward-looking. However, the number of data points gener­
ated is usually small and it is not obvious how to best convert
such data into losses at the 99.9th percentile. As a result, many
banks use a combination of scenario and parametric methods.
14 The categories are: C lients, Products and Business Practices; Execu ­
tion, Delivery and Process M anagem ent; External Fraud; Internal Fraud;
Dam age to Physical A ssets; Em ployee Practices and W orkplace Safety;
Business Disruption and System Failures.
The BC BS requires the inclusion of both expected and unex­
pected losses, and that the overall program use internal data
(at least five years of experience), external data, scenario analy­
sis, and a consideration of the business environment and the
bank's controls. Though each supporting elem ent need not be
included directly in calculations, the overall process must include
all four. Moreover, a bank must make a convincing argument
that its process can capture bad-tail events and, if it chooses to
assume that losses across business lines and loss categories are
anything but perfectly correlated, it must convincingly defend
its correlation assumptions. A bank may offset at most 20 per­
cent of the operational risk capital charge with insurance, and
only insurance arrangem ents that m eet stringent requirements
are acceptable.
In recent years, required capital for operational at some banks
risk was a material fraction of total required capital, in part
because the internal loss data that was required to be used
under the A M A included many large penalties for com pliance
failures, scandals, or misbehavior. As a result, the A M A approach
has lost favor and is no longer perm itted.
Solvency II
Minimum capital requirem ents also exist for insurance com pa­
nies in many nations. Though international standards do not yet
exist, sophisticated approaches have been im plem ented in the
United States and the European Union.
In the mid-1990s, the U.S.-based National Association of Insur­
ance Com m issioners (NAIC) promulgated a capital standard that
anticipated some elem ents of Basel II. In addition to capital
requirements covering the risks associated with liabilities, capital
is required for risky assets at levels that depend on ratings

314 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
assigned by the N AIC to each asset.15 Insurance regulation is at Also similar to Basel II, requirements may be satisfied by a com ­
the state level in the United States, but most states have im ple­ bination of Tier 1 capital (equity, retained earnings, and equiva­
mented these requirem ents. lents), Tier 2 capital (liabilities subordinated to policyholders and
available for write-off in liquidations), and Tier 3 capital (subor­
In Europe, regulation of insurance companies is done by the Euro­
dinated to policyholders but not satisfying the other criteria for
pean Union's (EU) European Insurance and Occupational Pensions
Tier 2).
Authority (EIOPA). The first capital regulations at the EU level were
known colloquially as Solvency I, which has recently been replaced
by Solvency II. More than 10 years in the making, Solvency II
resembles Basel II in that many elements of its capital requirements
SUMMARY
are based on a one-year VaR concept (at the 99.5th percentile) and
This chapter has provided an overview of internationally agreed
it has three pillars (quantitative requirement, internal governance
capital requirem ents that were created before the Global Finan­
and official supervision, and disclosure and transparency). Under­
cial Crisis. The 1988 Basel Accord (Basel I) introduced risk-based
writing risk, credit and market risk, and operational risk are all
capital requirem ents, while the 1995 and 1996 am endments
considered. Underwriting risk is further subdivided into risks arising
introduced much more sophisticated treatm ents of netting and
from life insurance, property & casualty, and health insurance.
market risk than had been previously available.
Solvency II also has elem ents found in Basel III (see Chapter ##),
Basel II introduced additional approaches to capital for credit
such as required buffers of capital above the minimum amount.
risk that were much more risk-sensitive and more aligned with
If an insurance com pany breaches Solvency ll's minimum capital
modern credit risk m anagem ent analysis. It also introduced
requirem ent (M CR), supervisors may prevent the stressed firm
two new pillars in addition to quantitative capital requirem ents:
from writing new policies or put it into resolution (e.g ., a sale to
supervision and disclosure.
a stronger com pany, or liquidation). The required buffer above
the M CR is defined by the solvency capital requirem ent" (SCR)
less the M CR. If the SCR is breached, the insurance company
References
should present a plan for capital restoration, and the supervisor
might impose additional requirem ents. Bank for International Settlem ents, 2006, "Basel II: International
Solvency II includes both standardized and internal model-based Convergence of Capital M easurem ent and Capital Standards."
approaches to calculating the SCR. Internal models must satisfy
Bank for International Settlem ents, 1988, "International conver­
three criteria. gence of capital m easurem ent and capital standards."
• First, the data and m ethodology must be sound.
Carey, Mark S., and William F. Treacy, 1998, C redit risk rating at
• Second, risk assessm ents must be calibrated to be in accor­ large U.S. banks, Federal Reserve Bulletin, November.
dance with target criteria set by the regulator.
Gordy, M. B., 2003, A risk-factor model foundation for ratings-
• Finally, the model must be used in actual business based capital ratios, Journal of Financial Intermediation 12,
decision-making. 199-232.

Lopez, J ., 2004, The empirical relationship between average

15 Unlike at banks, liabilities are a major source of risk at insurance com ­
panies, since most insurance policies are liabilities for the insurer and asset correlation, firm probability of default, and asset size,
variation in claim amounts has the potential to impose large losses. Journal of Financial Intermediation 13(2), 265-283.

Chapter 19 Capital Regulation Before the Global Financial Crisis ■ 315

Solvency,
Liquidity and
Other Regulation
After the Global
Financial Crisis
Learning Objectives
A fter com pleting this reading you should be able to:

Describe and calculate the stressed VaR introduced in
Basel 2.5, and calculate the market risk capital charge.
Explain the process of calculating the incremental risk
capital charge for positions held in a bank's trading book.
Describe the com prehensive risk (CR) capital charge for
portfolios of positions that are sensitive to correlations
between default risks.
Describe the motivations for and calculate the capital conser­
vation buffer and the countercyclical buffer, including special
rules for globally systemically important banks (G-SIBs).
Describe and calculate ratios intended to improve the man­
agement of liquidity risk, including the required leverage ratio,
the liquidity coverage ratio, and the net stable funding ratio.
Describe the mechanics of contingent convertible bonds

Define in the context of Basel III and calculate where (CoCos) and explain the motivations for banks to issue them.

appropriate:
Explain motivations for "gold plating" of regulations and
Tier 1 capital and its com ponents
provide exam ples of legislative and regulatory reforms
Tier 2 capital and its com ponents
that were introduced after the 2007-2009 financial crisis.
Required Tier 1 equity capital, total Tier 1 capital, and
total capital

By Mark Carey of the G A R P Risk Institute.

317
The financial crisis that began in the summer of 2007 revealed
limitations and gaps in the existing solvency and liquidity regula­
tions. It also revealed market practices and product designs that
proved ill-suited to stressed environments. Global regulators
reacted with more restrictive regulations and supervision and
with more coordination across nations.
20.1 T H E F IN A N C IA L
STA B ILITY B O A R D
The Financial Stability Forum , a body that undertook o cca­
sional studies, was reconstituted as the Financial Stability
Board (FSB) in the wake of the financial crisis. The FSB is com ­
posed of representatives from finance m inistries, central banks,
prudential regulators, securities regulators, and others from
dozens of nations.
Although organizations like the Basel Com m ittee and IO SC O
appeared to retain their independence and authority, as a
practical m atter the FSB becam e the body in which many
changes in international standards w ere approved. Later, as
the regulatory tsunam i receded, the FSB's began to focus on
other m atters.
20.2 B A S E L 2.5
M arket prices of financial assets fell sharply during 2007-2009. In
addition, many assets not already illiquid becam e so, the sound­
ness of securitizations was doubted, and many hedging strate­
gies failed. It was clear that minimum capital charges under the
market risk am endm ent were inadequate for the trading-book
risks revealed during the crisis.
The Basel Com m ittee responded with updated rules for capital
for the trading book, making three major changes:
1. VaR calculations were expanded to include a stressed-VaR
com ponent;
2. Capital for incremental risk was added (roughly capturing
the jum p-to-default risk);
3. C om prehensive risk capital requirem ents were added for
securitizations and related instruments.
These changes were im plem ented by the end of 2011.
Stressed VaR
Most banks com puted capital under the market risk am end­
ment using historical simulation, (i.e., 1-day VaR was com puted
by drawing daily changes in value from recent history and then
318 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
converted to VaR by multiplying by \/T o ). During periods of
low volatility, such a practice causes measured VaR to gradually
decline because all or nearly all of the historical observations
have small changes in value. When volatility rises again, as it did
in 2007 for many assets, VaR from historical simulation was slow
to follow because most historical observations were from a low-
volatility period.
The Basel Com m ittee introduced a requirem ent for use of
stressed-VaR measures to counter such tendencies. Rather
than drawing daily observations from the most recent historical
period, a bank is required to identify the one-year (i.e., 250 day)
period from the most recent seven years that was most stress­
ful for its current portfolio. Because this will be the sub-period
with the highest fraction of portfolio-weighted large declines
in value, the resulting 1-day VaR will be relatively large and will
not change much as tim e passes (unless a period of low volatility
persists for 7 years).
Stressed VaR was combined with the traditional VaR measure in
an expanded formula
MR2.5 = max(VaRt-i, mr*VaRavg) + max(SVaRt-i, ms*SVaRavg)
where VaRt_i and VaRavg are the traditional 10-day, 99 percent
VaR calculated by drawing from the the previous day and the
average of the 60 most recent days, respectively. SVaRt_-| and
SVaRavg are calculated by drawing from the equivalent times
during the most stressful period in the past seven years. The
multipliers mr and ms must be at least 3 as under the 1996
Am endm ent.
Because the definition of the stress period is such that the
most recent period cannot be more stressed than the stressed
period, and the charges based on traditional and stressed VaR
are sum m ed, MR25 must be at least tw ice as large as MR cal­
culated under the 1996 Am endm ent as long as the m ultipliers
are equal.
Incremental Risk Charge
The incremental risk charge (IRC) combines two strands of
work, one released in 2005 as a reaction to regulatory arbitrage
opportunities between the banking and trading book, and the
other released in the wake of the crisis.
Although the specific risk charge was intended to capture
default risk (as well as other sources of idiosyncratic risk), banks
had learned by the early 2000s that even with the specific
risk charge, most banking-book exposures had sm aller capital
requirements in the trading book than in the banking book.
Thus, many illiquid instruments posing default risk were placed
in the trading book.
To remove this incentive, the Basel Com m ittee proposed adding
an incremental default risk charge (IDRC). Two variants were
proposed:
• An internal model of default risk calibrated to the same
99.9th percentile at a one-year horizon as the Com m ittee's
IRB approach
• Or, in the absence of such a model, either a "standardized"
or a "current exposure" approach that had some similarity to
Basel I capital charges for specific risk.
As a practical matter, capital in the trading book would be the
greater of market risk capital and banking book cap ital.1
Late in the crisis, however, the Com m ittee had realized that
most losses in portfolio value associated with credit risk had
been due to changes in ratings, credit spreads, or liquidity, not
defaults. As a result, the scope of the proposal was increased to
include changes in ratings. The same 99.9th percentile was used,
but in addition to defaults, banks were required to estim ate
losses associated with rating downgrades. Portfolio credit qual­
ity is held approxim ately constant by an assumption that any
position that is downgraded or that defaults is replaced by a
position with the same pre-downgrade rating. A loss is recorded
from sale of the downgraded or defaulted position. The period
over which replacem ent could occur differs across positions
according to their liquidity but is never less than three m onths.1
2*•
Correlations and the Comprehensive
Risk Measure
An assumption em bedded in Basel II is that the correlation
param eter in the Gordy (2003) model is constant across obli­
gors and over time (though not across types of assets). This
assumption is reasonable for portfolios of debt instruments
for purposes of determ ining banking-book capital, but not
for instruments in the correlation b o o k (e.g ., securitizations,
re-securitizations and derivatives written on securitizations).
Such instruments place a portfolio in a special-purpose vehicle
and create tranched liabilities that differ in seniority, and thus in
their exposure to credit losses in the portfolio. In reality, correla­
tions change over tim e and such changes can have large effects
on the value of tranches For exam ple, the market prices of A A A ­
rated tranches were consistent with a near-zero probability of
default pre-crisis, but during the crisis market estim ates of PD
increased significantly and tranche prices fell.
1 See BCBS, The Application of Basel II to Trading Activities and the
Treatment of Double Default Effects, July 2005.
2 See BCBS, Guidelines for computing capital for incremental risk in the
trading book, July 2009.
Chapter 20 Solvency, Liquidity and Other Regulation After the Global Financial Crisis
Table 20.1 Comprehensive Risk Capital Charge
Under the Standardized Approach
<BB,
AAA, AA A BBB BB unrated
Securitizations 1.6% 4% 8% 28% 100%
Re-securitizations 3.2% 8% 18% 52% 100%
The Basel Com m ittee addressed this issue by replacing the IRC
and specific risk charge with a com prehensive risk (CR) charge
for the correlation book. Under the new rules, banks may use a
standardized approach (summarized in Table 20.1) that depends
only on the rating of the instrument. (Note that percentages are
capital as a fraction of the exposure, not risk weights.)
Because re-securitizations (for which the underlying pool of
assets are the tranched liabilities of securitization vehicles) are
more vulnerable to changes in correlations, capital requirements
are much higher for them . M eanwhile, tranches rated below BB
are the most exposed to losses in the underlying pool (i.e., in
effect they must be financed entirely with capital).
Banks may also use an internal model to estim ate the CR
charge if approved to do so by supervisors, though the model-
based charge may not be less than a fraction of the charge
under the standardized approach. Given the com plexity of
the underlying instrum ents and the rationale for using an
internal m odel, which often includes the capture of hedges
with more sophistication than the standardized approach, the
internal m odels must be unusually com plete, com plicated and
robust. M ultiple default and rating change events; volatility
in correlations and credit spreads; basis risk (e .g ., the differ­
ence betw een C D S and underlying index values); the dynam ics
of hedges; and volatility in recovery rates must be m odeled,
ideally with sim ulations that revalue the whole portfolio for
each iteration of a sim ulation.
20.3 B A S E L 3
In addition to the need for more capital for risks in the trading
book, the crisis revealed many other weaknesses of the Basel II
fram ework:
• In the depths of the crisis, market participants cared only
about tangible Tier 1 common equity capital (i.e., capital that
could absorb losses and maintain a bank as a going concern).
Many elem ents of the pre-crisis definition of capital proved
limited in their ability to maintain banks as going concerns.
• The official sector came to believe that distress at some
banks posed greater threats to society than distress at other
■ 319
 banks, and that those in the form er category should be bet­
ter able to manage distress. Categories of "system ically
im portant" financial firms were created and em bedded in a
wide range of regulatory and supervisory practices.
• Risk-based capital ratios were thought to have been too sus­
ceptible to gaming. Leverage-ratio capital requirem ents were
needed as a backstop, especially since market participants
who focused only on tangible common equity tended to also
focus only on leverage ratios.
• It was not enough for banks to remain solvent up to the
point of maximum losses - they also had to be able to
operate as a going concern thereafter, which meant they
needed substantial capital a fter absorbing the losses.
In many cases, governm ents provided capital, but such
provision was unpopular. Buffers of capital above the
minimum requirem ents were needed, as w ere means of
recapitalizing failed banks.
• Entities that were thought to be solvent by regulators nev­
ertheless suffered runs and, in some cases, failed. This was
in part because their liquid reserves proved inadequate to
cover withdrawn funding and in part because wholesale fund­
ing proved to be unstable. Thus, liquidity requirem ents were
needed.
• Especially after the failure of Lehman, which did not honor
its com m itm ents as a counterparty in derivative contracts, it
becam e clear that capital was needed to cover counterparty
credit risk.
• In addition, a Large Exposures Fram ework was created in
2014 to set a common global standard to limit exposure
concentrations to a single counterparty, particularly between
system ically im portant institutions. Specifically, there limits
are 25% of capital (and 15% between global system ically
im portant banks). This fram ework assumes 100% probability
of default and 100% loss given default (after netting and col­
lateral adjustm ents), limited use of models that failed in the
crisis, and aggregates across wholesale credit, trading and
other books. LEF also addresses a limitation of the capital
fram ework, which does not adjust capital requirements for
significant concentrations under either the Standardized
Approach or the G ordy Model used in IRB (which assumes
exposures are granular, not concentrated).
Proposals to remedy the deficiencies were published in 2010
and 2011 and am ended in later years.3
3 BCBS, "Basel III: A global regulatory framework for more resilient
banks and banking systems," June 2011; and BCBS, "Basel III: Interna­
tional framework for liquidity risk measurement standards and monitor­
ing," December 2010.
320 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The Definition of Capital
Basel III eliminated Tier 3 Capital and divided Tier 1 Capital into
Tier 1 Equity Capital (also known as Core Tier 1 Capital) and
Additional Tier 1 Capital, restricting the form er to high-quality
capital.
Minimum capital requirem ents were also changed: Core Tier 1
must be at least 4.5 percent of risk-weighted assets, and Total
Tier 1 (i.e., the sum of Core and Additional Tier 1) capital must
be at least 6 percent of risk-weighted assets. The Total Capital
requirem ent (Tier 1 plus Tier 2) was left unchanged at 8 percent.
The com ponents of each category are:
• Tier 1 Equity Capital includes
• common equity,
• retained earnings, and
• a limited amount of minority interest and unrealized gains
and losses.
Goodwill and other intangibles are deducted, as are deferred
tax assets and any shortfall of reserves relative to IRB
expected losses.
• Additional Tier 1 Capital includes:
• Unsecured, unguaranteed, non-cumulative perpetual
preferred equity instruments subordinated to depositors and
subordinated debt, and callable only after five years or more.
• Debt with appropriate triggers that cause conversion to
equity or write-downs.
• Approved minority interest not included in Core Tier 1.
• Tier 2 capital is designed to absorb losses after failure,
protecting depositors and other creditors. It includes:
• Subordinated debt. Specifically, unsecured, unguaranteed,
debt instruments subordinated to depositors and subordi­
nated debt, with five years or more original maturity, and
callable only after five years or more.
• General loan loss reserves. These are reserves not allo­
cated to absorb losses on specific positions. Reserves
included in capital are capped at 1.25% of standardized
approach RWAs, or 0.6% of IRB RWAs.
A number of other deductions are required, such as
• defined-benefit pension plan deficits,
• certain cross-holdings within a group, and
• m ortgage servicing rights greater than 10 percent of com ­
mon equity.
O verall, capital requirem ents were significantly increased rela­
tive to Basel 2 because minimum ratios were increased, and
allowable capital was constricted.
Leverage Ratio Capital Requirements
Prior to Basel 3, minimum capital ratios specified by the Basel
Com m ittee were expressed as a percentage of risk-weighted
assets (RWA). However, during and after the crisis many observ­
ers felt that RWA had understated the risks borne by banking
organizations and thus led them to be over-leveraged. Though
known weaknesses in the calculation of RW A were addressed,
the possibility of future m ism easurem ent rem ained. Moreover,
during the crisis market participants had focused on simple
ratios of equity to unweighted assets as they assessed the
soundness of banking organizations, making risk-weighted ratio
values peripheral to the debates of the tim e.
The Com m ittee's reaction was to introduce a "sim ple" lever­
age ratio capital requirem ent as a supplem ent to the risk-based
requirem ents: banking organizations must maintain a ratio of
Core Tier 1 Capital to Leverage Exposure of 3 percent or more.
Leverage Exposure includes both on-balance-sheet assets and
fractions of off-balance-sheet assets (e.g ., derivatives or poten­
tial futures exposures). Though the IFRS and G A A P accounting
standards differ som ewhat in their handling of off-balance sheet
assets, the Com m ittee's Leverage Exposure measure is specified
in some detail to promote com parability across nations.
Systemically Important Financial
Institutions
The FSB publishes lists of globally system ically im portant banks
(G-SIBs) and (in cooperation with the IAIS) globally system ically
im portant insurers (G-SII). Some nations also designate other
banks as dom estically system ically im portant (D-SIBs).
Collectively, these and other firms fall into the category of sys­
tem ically im portant financial institutions (SIFIs). To determ ine
whether an entity is a G-SIB, the FSB com bines variables that
proxy for size, interconnectedness, com plexity, international
activity and other matters.
An entity is system ically im portant if its failure or distress would
cause substantial problems in the financial system or the real
econom y. For exam ple, the aftermath of Lehman's failure dem ­
onstrated that it was system ically im portant because many finan­
cial markets were disrupted, and many counterparties suffered
because Lehman failed to satisfy its obligations.
SIFIs are often presumed to be "too big to fail," but key goals
of reforms include reducing the likelihood of failure while also
making it possible for any entity to "fail" without disrupting
the financial system or the real econom y. Though shareholders
likely would be wiped out in a failure and some creditors would
suffer losses, the goal is for the entity to keep operating and
Chapter 20 Solvency, Liquidity and Other Regulation After the Global Financial Crisis
be recapitalized without governm ent assistance. A s described
ahead, system ically im portant firms are often subjected to more
wide-ranging supervision and regulation.
Buffers
As of early 2019, the Basel specifications feature three require­
ments for capital above the minimum fractions of RWA:
1. A 2.5 percent capital conservation buffer (CCB) requirement.
2. An additional G-SIB requirem ent that depends on an
organization's score when the Com m ittee applies its
method to identify G-SIBs. These additions are 1, 1.5, 2,
2.5 and 3.5 percent.4
3 . A Countercyclical Capital Buffer (CCyB) that varies at the
discretion of national supervisors and is between 0 and
2.5 percent.
The rationales for the buffers differ som ewhat. In the case of the
C C B , the rationale roughly follows that for the Prompt C o rrec­
tive Action (PCA) system built into U.S. capital regulation begin­
ning in 1991 (i.e., a bank with ratios that begin to approach the
minimums should be subject to increasingly stringent supervi­
sory intervention in order to induce a return to well-capitalized
status). Though the only restrictions form ally imposed by the
Com m ittee involve restrictions on dividend payments and
bonuses, as well as a requirem ent for plans to restore capital
ratios, supervisors may try to act more broadly as w e ll.5
In the case of the G-SIB buffer, the rationale is similar to that
for the C C B but also recognizes the very large costs to society
of distress at G-SIBs (and the higher volatility of losses at some
of them). Thus, larger buffers are specified to further reduce
the chance of failure. A breach of the G-SIB buffer has conse­
quences similar to a breach of the C C B .
The C C yB has two rationales. O ne is to provide an instrument
for macroprudential restraint of overheating; the other is atten­
tive to the cost of capital.
The overheating rationale posits that higher bank capital
requirements tend to restrict credit supply by banks, and thus
4 The 2018 list of G-SIBs contained 29 entities. Since the list of G-SIBs
was first published in 2011, none have been in the 3.5 percent category,
and since 2013 only HSBC and JP Morgan Chase have appeared in the
2.5 percent category.
5 Supervisors have a range of tools at their disposal and may be
constrained from certain actions when a bank is still meeting its
minimums. In stressed environments it may be difficult to achieve asset
sales, capital raises, or mergers that provide a remedy to deal with a
weak bank. A failure to meet a buffer is less severe than failing to meet
a minimum requirement.
■ 321
overheating in the credit markets, thereby damping the amplitude
of the credit cycle and perhaps reducing the frequency and sever­
ity of financial crises. A consequence of the overheating rationale
is that computation of the CCyB requirement is complicated for
banks with international operations. This is beucase the C C yB may
differ across nations, and a bank with operations in several nations
will have a consolidated C C yB requirement that is a weighted
average of the requirements in each nation in which it operates.
The cost-of-capital rationale presumes that a bank's costs of
increasing its capital ratio are sm aller in good tim es than in
bad tim es, which implies that increased financial stability can
be obtained at lower cost by increasing the C C yB during good
times and reducing it during bad tim es. Implicitly, this rationale
focuses on capital market costs for the entity as a whole, without
regard to conditions in different nations' credit markets.
As a practical matter, different supervisors have given different
weights to the two rationales. The consequences of violating
the C C yB are similar to those of violating the C C B . However,
because national supervisors can reduce the C C yB at any
tim e, such consequences can be m itigated by changing the
requirem ent.
All of the aforem entioned requirem ents apply only to risk-based
capital ratios. In 2017, the Com m ittee introduced a leverage
ratio buffer for G-SIBs as well, equal to one-half of its risk-based
G-SIB buffer (not including the C C B or C C y B ).6 Earlier, the U.S.
had im plem ented a 2 percentage point leverage buffer require­
ment for G-SIB consolidated organizations, and a 3 percentage
point buffer for subsidiary banks, for an aggregate minimum of
5 and 6 percent, respectively. In 2018, the U.S. proposed to
change its G-SIB leverage buffer to half of the sum of C C B and
G-SIB risk-based buffer requirem ents.
Basel III Finalizing the Post-Crisis Reforms
In D ecem ber 2017, the BC BS finalized a set of reforms that
include revisions to
a) the standardized approach to credit,
b) the Internal ratings-based approach,
c) the CVA fram ework for counterparty credit,
d) operational risk, and
e) the leveraged ratio.
In addition, an output floor was introduced to ensure that
capital calculations under the ratings-based and other modelled
approaches is constrained at not less than 72.5% of the stan­
dardized approach.
6 Though it will not be implemented until 2022.
322 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Key Changes - Standardized Approach
• Risk weights for banks have been adjusted, with one set of
weights linked to external rating agencies, and another to
credit risk assessm ents (i.e., G rade A , B or C) used when
a country does not perm it external ratings to be used for
capital measures. Range is 20% RWA for A A A up to 150%
RW A for lower than B-.
• Covered bonds (i.e., bonds issued by banks and secured by
a portfolio of collateral) meeting specific criterial carry a risk
weight of between 10% and 100%.
• Corporate bonds carry risk weights of 20%, 50%, 75%, 100%
and 150% tied to ratings. In countries that do not allow
ratings, a 65% risk weight applies to investm ent grade and
100% to non-investment grade. Favorable treatm ent is pro­
vided to loans to small and medium enterprises (SM Es).
• Specialized lending has several buckets (e.g ., project finance
or object finance) with detailed definitions and specific risk
weights.
• Equities have a 400% risk weight (with exceptions) and
sub-debt or other instruments have a 150% risk weight.
• New risk weights were set for real estate tied to loan value
and type (e.g ., retail versus commercial).
• New credit conversion factors were set for a range of
off-balance sheet exposures.
• A definition of default was added. It includes payments past
due for 90 days, non-accrual assets, write-offs in anticipation
of default, sale of asset at loss, distressed restructuring, bank­
ruptcy, and inability to pay without recourse to collateral.
• Treatm ent of hedges and collateral was expanded into
significant detail.
Key Changes - IRB
• Categories include corporate, sovereign, bank, retail, and
equity. W ithin retail there are three subtypes. Five subcat­
egories of specialty lending include project finance, object
finance, com m odities, income producing real estate and high
volatility real estate.
• IRB is not perm itted for large corporates or banks where
modeling is problem atic, given few historical defaults and a
limited number of exposures in the data set.
• Banks must apply IRB to all assets in a given asset class and
cannot cherry pick some exposures to be covered under SA
alone and IRB for others.
• Minimum UL risk weights apply for specialized lending.
Collateral haircuts are applied for secured lending.
• Input floors for LGD calculations are provided for corporates,
with 25% minimum LGD on unsecured exposures and a
 range of 0% to 15% minimum on secured exposures. Retail
exposures have a 50% minimum LDG on credit cards, 30%
on other unsecured exposures, and a similar 0% to 15% mini­
mum LG D on secured loans.
Key Changes - CVA Risk
• Two approaches are available for calculating CVA risk:
the standardized approach (SA-CVA) and basic approach
(BA-CVA).
Key Changes - Operational Risk
• The standardized approach replaces existing Basel II
approaches for operational risk. Key elem ents include the
business indicator (Bl) and the Business indicator com ponent
(BIC), which equals the Bl tim es an Internal Loss M ultiplier
(ILM) (i.e., a scaling factor based upon historical losses).
Bl =ILD C + SC + FC
W here ILDC = Min [(Abs(lnterest Income — Interest Expense);
2.25% X Income Earning Assets -L Dividend Income); SC —
Max [O ther O perating Income; O ther O perating Expense] +
Max [Fee Income; Fee Expense]; and FC = A bs(N et P&L
Trading book) + A bs(N et P&L Banking book)
BIC
Bucket 1 (under Euro 1 billion) 12%
Bucket 2 (1 to 30 billion Euro) 15%
Bucket 3 (over 30 billion Euro) 18%
ILM
ILM =Ln(exp( 1)-1 +(LC/BIC)A0.8))
Liquidity Requirements
Solvent financial institutions can som etim es fail because their
depositors and counterparties withdraw more rapidly than
assets can be sold. Regardless of the causes of a run, authorities
value having tim e to diagnose the problem and find a solution,
ideally one not involving governm ent guarantees.
During the crisis, perhaps the most notable exam ple of a failure
involving a run was that of Northern Rock. Heavily dependent
on securitization markets to fund its mortgage business, the
bank had trouble finding enough wholesale funding to finance
its pipeline of m ortgage loans when securitization became
difficult.
The trouble began when news broke on Septem ber 13 (a
Thursday) that the Bank of England would provide liquidity sup­
port. In the response to the prospect of government intervention,7
Chapter 20 Solvency, Liquidity and Other Regulation After the Global Financial Crisis
a substantial fraction of retail deposits was withdrawn and North­
ern Rock's wholesale funding fell. With most of its remaining assets
illiquid, Northern Rock found itself in imminent danger of being
unable to meet further requests for withdrawals. By the following
Monday, the government announced that all deposits would be
guaranteed for all U.K. banks.
Basel 3 addressed liquidity risk by specifying two requirem ents,
the liquidity coverage ratio (LCR) and the net stable funding
ratio (NSFR).
The LCR is designed to give banks and authorities a month to
manage a crisis by selling liquid assets. The idea is that if the
bank has more liquid assets than it needs to meet liquidity
dem ands during the month, it can sell the assets while attem pt­
ing to restore confidence in itself. To be "liq uid," the likelihood
must be high that the asset can be sold quickly and with little
reduction in price. The requirem ent is defined as
H ig h q u a lit y liq u id a s s e ts
LCR = > 1
N et ca sh o u t f lo w s in a 30 d a y p e r io d
The quantity of a bank's high-quality liquid assets (HQ LA) is
measured by placing assets in categories and applying hair­
cuts according to the likely availability of buyers at prices near
normal-times values.
For exam ple, included in H Q LA without a haircut are deposits
at central banks and securities issued by central governm ents
with a 0 percent risk weight in the standardized approach.
In contrast, corporate debt and equity have 50 percent
haircuts and individual m ortgage loans are excluded from
H Q LA entirely.
Net cash outflows are com puted by applying assumptions about
the tendency of different classes of liabilities to be withdrawn in
stress situations, and the tendency credit line holders to draw on
them . For exam ple, only 3 percent of insured retail deposits are
assumed to be withdrawn, whereas that number is 100 percent
for most non-operational wholesale deposits and 30 percent
for undrawn capacity of lines of credit to nonfinancial wholesale
custom ers. These exam ples only scratch the surface of a vast
structure of asset/com m itm ent categories and their associated
percentages. As such, the definition of the LCR is simple but the
implementation is com plicated.
The NSFR uses a one-year period and is conceptually slightly
different, in that it focuses not on what can be sold but rather
what funding would remain after a stressful year. It is defined as
A v a ila b le a m o u n t o f s ta b le f u n d in g
NSFR = > 1
R e q u ir e d a m o u n t o f s ta b le f u n d in g
7 A t the tim e, deposit insurance in the U .K . was relatively m eaqer (up to
G B P 31,700).
■ 323
The available am ount of stable funding is calculated by Using a 5% runoff rate for the stable retail deposits, a 100%
m ultiplying the am ount in several categories of funding by runoff rate for the one-third of wholesale CD s that mature in the
available stable funding (ASF) factors (which are sim ilar to next month, and a 0% runoff rate for senior bonds and equity,
haircuts). However, these categories are different from those net 30-day cash outflows are 25 + 67 = 92, so
of the LC R. The required stable funding is sim ilarly calculated
LCR = = 2.72
by m ultiplying am ounts in each category of asset by required
stable funding (RSF) facto rs, where the factor is higher the
Thus, the bank in this exam ple would be in com pliance with the
more illiquid the asset (since it cannot be sold as easily when
LCR and N FSR. Note that a very large number of categories,
funding runs off).
factors and haircuts were not discussed in this exam ple and the
The new liquidity requirements represent a major change in liquidity requirem ents are operationally com plex.
bank regulation and m anagem ent. Prior to the crisis, the pre­
sumption was that regulators would instantly know whether a
bank was solvent or not. If a bank was solvent, central banks Derivatives Counterparty Credit Risk
could im m ediately provide enough em ergency funding until
Banks calculate a credit valuation adjustm ent (CVA) for
market participants becam e com fortable with its solvency, each derivatives counterparty, which is the difference in
whereas insolvent banks would be closed im m ediately.
value betw een a risk-free portfolio of derivatives with that
One lesson of Northern Rock is that provision of funding by counterparty and the actual portfolio. CVA increases with the
central banks can make funding stresses w orse, not better, counterparty's credit spread and also changes with the m arket
and doing so for one bank can destabilize a banking system. value of the portfolio. The com ponent from changes in m arket
Thus, banks must be much better prepared to survive periods values affects profit, while the com ponent associated with
of funding stress with their own resources. This means that bal­ counterparty credit spreads appears in m arket risk capital.
ance sheet composition is som ewhat constrained, with a smaller
proportion of illiquid assets and a larger proportion of illiquid
liabilities. 2 0 .4 R E S O L U T IO N P LA N N IN G
A N D P R EP A R A TIO N
Example of LCR and NSFR
Banks will fail in the future in spite of Basel I, II, III and later
A bank's liabilities consist of USD 500 of stable retail deposits
reforms. To limit the disruptions caused by such failures, the
with 9 months or less remaining maturity, USD 200 of 3-month
FSB agreed in 2014 that national resolution regimes for G-SIBs
wholesale certificates of deposit with one-third maturing each
would have 12 key attributes and that each G-SIB should have
month, USD 200 of 10-year senior bonds with none maturing
sufficient total loss absorbing capacity (TLAC) to enable it to
in the next year, and USD 100 of common equity. A S F factors
recapitalize itself.
for these categories of liability are 95% , 0%, 100%, and 100%,
respectively. Recapitalization might be accom plished by causing convertible
bonds to becom e equity or by bail-in, in which certain w hole­
The bank's assets consist of USD 100 of vault cash, USD 100 of
sale debt liabilities are either written down or converted to
the debt of its sovereign, USD 100 of corporate debt securities
equity. The term s of conversion are written into the indentures
rated BBB in the trading account, and USD 700 of loans to busi­
of convertible bonds and often require conversion when a bank
nesses with more than one year of remaining maturity and risk
appears to be solvent, whereas bail-ins are governed by national
weights of 50% or more. The RSF factors for these assets are
law and details are generally chosen by authorities after they
0%, 5%, 50%, and 85%, respectively. Thus
have seized control of a bank.
475 + 0 + 200 + 100
N SFR = 1.19
0 + 5 + 50 + 595
CoCos
For the LCR, H Q LA factors (1-haircut) are 100%, 100%, 50%,
0%, presuming the supervisory allows inclusion of the corporate Traditionally, convertible bonds were issued by non-financial
debt securities. Note that the corporate debt securities are firms who wished to avoid the dilution of issuing equity before
Level 2 assets, which may not com prise more than 40% of H Q LA the firm's perform ance im proved. Such bonds would, at the
after the haircut. This is satisfied since total H Q LA is USD 250, of option of the holder, convert into equity when the firm's share
which USD 50 is the corporate debt securities. price exceeded thresholds specified in the indenture.

324 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
For banks, contingent convertible bonds (CoCos) are the mirror
im age: they cause a bank's equity to increase when distress
occurs, as reflected by triggers written into the indenture, and
not at the option of the holder. With C o C o s, equity increases
either because the bond converts to equity or because its value
is written down.
Triggers have varied som ewhat across C o C o s, but a common
trigger is when the ratio of Core Tier 1 Capital to RW A falls
below a threshold, or when a bank's primary regulator declares
it to be nonviable. C oC os may be included in Additional Tier 1
Capital if the threshold is 5.125 percent or higher, and Tier 2
capital otherwise.
Econom ically, it is not obvious why the m arket would price
C o C o s to make the cost of capital for them less than the cost
of equity. Because C oC os are debt instruments when issued,
holders receive little or none of the high returns received by
equity holders when a bank does w ell, but holders bear losses
not so different from those of equity holders when a bank fails.
Thus, they should be expensive for a bank to issue. But they do
have an accounting advantage: because they do not appear in
the equity account until converted, a bank can report a higher
return on equity.
Living Wills
In many countries, G-SIBs (and som etim es D-SIBs) are required
to prepare detailed resolution plans in which they specify
how they would fund them selves when distressed, how they
would recapitalize, how they would continue to operate as a
going concern even if some subsidiaries failed, and many other
related matters.
2 0 .5 S T R E S S T E S T IN G A N D O T H E R
L O C A L A P P L IC A T IO N S O F B A S E L
W hile Basel I, II and III have achieved som e level of
harm onization across countries, sig nificant d ifferen ces p ersist.
Little effort has been m ade to fully adjust for differences
in accounting standards, bankruptcy laws, or other rules or
regulations with differences across co untries. Even w here
there is ag reem ent in B asel, som e ju risd ictio n s apply tig h ter
treatm ents than others. For exam p le, many European
countries treat all banks as internationally active and
su b ject to Basel rules, w hile the U .S. considers only its
largest banks as internationally active, with less stringent
requirem ents ap p lied to many regional and com m unity
banks that only o p erate in one or a few states with little
international activity.
Chapter 20 Solvency, Liquidity and Other Regulation After the Global Financial Crisis
Though participating countries are not supposed to promulgate
dom estic laws and regulations that are less onerous for inter­
nationally active banks, they may enact requirem ents that are
superequivalent (i.e., imposing a different but higher, or just a
higher standard than Basel requires).
This approach som etim es acts as a safety valve in the Basel
negotiations, allowing those who want stronger standards for
everyone to at least have them dom estically, and som etim es it
reflects a nation's special circum stances. Switzerland's choices
are in the latter category: as a small country with two huge
G-SIBs, it found itself during the crisis in the uncom fortable situ­
ation of being unable to recapitalize its G-SIBs should that have
been necessary. Thus, its capital requirem ents are more onerous
than those of Basel 3, and in resolution planning it has required
the G-SIBs to structure them selves so that dom estic opera­
tions could continue even if international operations failed. The
United Kingdom has taken a som ewhat similar step, requiring
that retail operations be ringfenced (i.e., separated from) w hole­
sale operations.
Basel anticipates that in addition to minimum standards, each
jurisdiction will supervise banks and take other actions to ensure
they have adequate capital and liquidity, and strong risk man­
agem ent and governance. In the U .S., coordinated stress tests
based upon supervisory designs and scenarios ensure that banks
have capital and liquidity planning processes, risk m anagem ent,
and sufficient buffers to allow com pliance with minimum capital
and liquidity standards even in a stressed situation.
Th e Federal Reserve's C o m p rehensive C ap ital A nalysis and
Review (C C A R ), which requires participation by G -SIBs and
D-SIBs with m aterial operations in the United States, includes
a sup erviso ry severe scenario that has been one of the more
severe stress te sts. For som e banks, C C A R stress testing is
the binding capital co nstraint, as restrictions on dividend
paym ents and share buybacks apply if the bank's capital
ratios fall below the requirem ent m inim um s after losses in
the "se ve re ly ad ve rse " scenario are included. This approach
requires banks to hold buffers that should allow them to
m eet th eir minimum capital requirem ents even in stressed
scenarios and is co nsistent with past exp ectatio n s that
banks should have a cushion above Basel minimum capital
requirem ents. Furtherm o re, th at cushion is likely g reater
than in the past.
Similarly, there is a program for liquidity known as C LA R that
assesses bank stress testing and supervisory provided stress
tests to ensure liquidity buffers are maintained. In 2019, ele­
ments of C C A R have been relaxed to reduce in future periods
the use of qualitative criteria (relating to bank risk m anagem ent
and capital planning processes) in judging results.
■ 325
20.6 O T H E R R E F O R M S
A vast array of legislation and regulations was im plem ented
across the globe in the decade after 2007. These include:
• Capacity to conduct macroprudential policy was added
through institutional reforms in some nations where legal
authority was previously lacking. For exam ple, in the United
States, bank regulators' missions often restricted them to
consider only the soundness of individual banks, not the
financial system as a whole. The Financial Stability O versight
Council (FSO C) was created to take a more m acropruden­
tial view, though its legal authority was som ewhat limited.
In the United Kingdom , the Financial Policy Com m ittee was
created at the Bank of England, with some power to take
macroprudential policy actions and to recommend others to
Parliament.
• Pre-crisis com pensation practices at large banks that made
pay effectively independent of risk-taking were widely
blamed for im prudent risk taking. The FSB promulgated prin­
ciples for better com pensation practices, and many nations
responded with increased supervision and regulation. Some
elected to take a more form ulaic approach, in some cases
restricting the level of pay, while other nations focused on
supervision of the presence of risk-sensitive features in com ­
pensation arrangem ents.
• In the United States, the Volcker Rule (part of the Dodd Frank
Act) restricts proprietary trading and investments in hedge
funds and private equity at deposit-taking financial firms. The
rationale is that banks should not be perm itted to "sp ecu­
late" while being funded by insured depositors. However, the
Volcker Rule has proved difficult to enforce because of chal­
lenges in identifying the intent of a trade and in separating
hedging activity from speculative activity. N evertheless, most
banks shut down their proprietary trading desks.
• In the United States and in the European Union, some over-
the-counter derivatives (i.e., those that are relatively standard
in form and terms) must be traded on swap execution facili­
ties (SEFs), which are electronic platforms that promote price
transparency. Derivatives traded between financial institu­
tions must be cleared by central counterparties (CCPs).
• In the United States, an Office of Credit Ratings was created at
the Securities and Exchange Commission to provide oversight
of rating agencies, though its powers were somewhat limited.
Prior to the crisis, rating agencies had been subject to rela­
tively little regulatory oversight and they were widely blamed
for underestimates of the credit risks posed by securitizations.
• In the United States, a Consum er Financial Protection
Bureau (CFPB) was created to improve information flows to
326 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
consumers of financial products and to curb abuses by finan­
cial firms of all kinds.
• In the United States, m ortgage lenders were required to
determ ine w hether borrowers have the ability to repay the
loans they take. The legal and financial liabilities associated
with mistakes in such determ inations have caused many
banks to exit the m ortgage market.
• In the United States, large banks were required to have
board risk com m ittees where at least one m em ber has risk
m anagem ent experience at a large financial firm.
• In the United States and the European Union, issuers of secu­
ritizations were required to retain at least 5 percent of each
tranche, in an attem pt to better-align the incentives of issuers
and investors.
References
Basel Com m ittee on Banking Supervision, "The Application
of Basel II to Trading Activities and the Treatm ent of Double
Default Effects," Ju ly 2005.
Basel Com m ittee on Banking Supervision, "G uidelines for
computing capital for incremental risk in the trading book,"
January 2009.
Basel Com m ittee on Banking Supervision, "Revisions to the
Basel II m arket risk fram ew ork," Ju ly 2009 and February 2011.
Basel Committee on Banking Supervision, "Guidelines for comput­
ing capital for incremental risk in the trading book," July 2009.
Basel Com m ittee on Banking Supervision, "Basel III: A global
regulatory fram ework for more resilient banks and banking
system s - revised version June 2011," Ju n e 2011.
Basel Com m ittee on Banking Supervision, "Basel III: A global
regulatory fram ework for more resilient banks and banking
system s," D ecem b er 2010.
Basel Com m ittee on Banking Supervision, "Basel III: the net
stable funding ratio," O cto b e r 2014.
Basel Com m ittee on Banking Supervision, "Basel III: the
Liquidity Coverage Ratio and liquidity risk monitoring tools,"
January 2013.
Basel Com m ittee on Banking Supervision: Basel III Finalising
Post Crisis Reforms, D ecem ber 2017
Basel Com m ittee on Banking Supervision: Minimum capital
Requirem ents for M arket Risk, R evised 14 January 2019.
Basel Com m ittee on Bank Supervision: Large Exposures
Fram ework, A pril 2014.
 Learning Objectives
A fter com pleting this reading you should be able to:

Explain the motivations for revising the Basel III fram ework The CVA risk fram ework
and the goals and im pacts of the D ecem ber 2017 reforms
The operational risk fram ework
to the Basel III fram ework.
The leverage ratio fram ework
Summarize the D ecem ber 2017 revisions to the Basel III
fram ework in the following areas: Describe the revised output floor introduced as part of
the Basel III reforms and approaches to be used when
The standardized approach to credit risk
calculating the output floor.
The internal ratings-based (IRB) approaches for
credit risk

Basel Com m ittee on Banking Supervision Publication, D ecem ber 2017.

327
This note summarises the main features of the finalised Basel III
reforms. The standards text, which provides the full details of
the reforms, is published separately and is available on the BIS
w ebsite at w w w .bis.org/bcbs/publ/d424.htm .
The Basel III fram ework is a central elem ent of the Basel C om ­
mittee's response to the global financial crisis. It addresses a
number of shortcomings in the pre-crisis regulatory fram ework
and provides a foundation for a resilient banking system that will
help avoid the build-up of system ic vulnerabilities. The fram e­
work will allow the banking system to support the real economy
through the econom ic cycle.
The initial phase of Basel III reforms focused on strengthening
the following com ponents of the regulatory fram ework:
• improving the quality of bank regulatory capital by placing a
greater focus on going-concern loss-absorbing capital in the
form of Common Equity Tier 1 (CET1) capital;
• increasing the level of capital requirem ents to ensure that
banks are sufficiently resilient to withstand losses in tim es of
stress;
• enhancing risk capture by revising areas of the risk-weighted
capital fram ework that proved to be acutely m iscalibrated,
including the global standards for market risk, counterparty
credit risk and securitisation;
• adding macroprudential elem ents to the regulatory fram e­
work, by: (i) introducing capital buffers that are built up in
good tim es and can be drawn down in tim es of stress to
limit procyclicality; (ii) establishing a large exposures regime
that m itigates system ic risks arising from interlinkages across
financial institutions and concentrated exposures; and (iii)
putting in place a capital buffer to address the externalities
created by system ically im portant banks;
• specifying a minimum leverage ratio requirem ent to constrain
excess leverage in the banking system and com plem ent the
risk-weighted capital requirem ents; and
• introducing an international fram ework for mitigating exces­
sive liquidity risk and maturity transform ation, through the
Liquidity Coverage Ratio and Net Stable Funding Ratio.
The Com m ittee's now finalised Basel III reforms com plem ent
these im provem ents to the global regulatory fram ework. The
revisions seek to restore credibility in the calculation of risk-
weighted assets (RWAs) and improve the com parability of
banks' capital ratios by:
• enhancing the robustness and risk sensitivity of the stan­
dardised approaches for credit risk, credit valuation adjust­
ment (CVA) risk and operational risk;
• constraining the use of the internal model approaches, by
placing limits on certain inputs used to calculate capital
328 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
requirem ents under the internal ratings-based (IRB) approach
for credit risk and by removing the use of the internal model
approaches for CVA risk and for operational risk;
• introducing a leverage ratio buffer to further limit the lever­
age of global system ically im portant banks (G-SIBs); and
• replacing the existing Basel II output floor with a more robust
risk-sensitive floor based on the Com m ittee's revised Basel III
standardised approaches.
S T A N D A R D IS E D A P P R O A C H
F O R C R E D IT R ISK *•
Credit risk accounts for the bulk of most banks' risk-taking activi­
ties and hence their regulatory capital requirem ents. The stan­
dardised approach is used by the majority of banks around the
world, including in non-Basel Com m ittee jurisdictions.
The Com m ittee's revisions to the standardised approach for
credit risk enhance the regulatory fram ework by:
• improving its granularity and risk sensitivity. For exam ple, the
Basel II standardised approach assigns a flat risk w eight to all
residential m ortgages. In the revised standardised approach
m ortgage risk weights depend on the loan-to-value (LTV)
ratio of the m ortgage;
• reducing mechanistic reliance on credit ratings, by requiring
banks to conduct sufficient due diligence, and by developing
a sufficiently granular non-ratings-based approach for juris­
dictions that cannot or do not wish to rely on external credit
ratings; and
• as a result, providing the foundation for a revised output
floor to internally m odelled capital requirements (to replace
the existing Basel I floor) and related disclosure to enhance
com parability across banks and restore a level playing field.
The revisions to the standardised approach for credit risk,
relative to the existing standardised approach, are outlined in
Table 21.1. In summary, the key revisions are as follows:
• A more granular approach has been developed for unrated
exposures to banks and corporates, and for rated exposures
in jurisdictions where the use of credit ratings is perm itted.
• For exposures to banks, some of the risk weights for rated
exposures have been recalibrated. In addition, the risk-
weighted treatm ent for unrated exposures is more granular
than the existing flat risk weight. A standalone treatm ent for
covered bonds has also been introduced.
• For exposures to corporates, a more granular look-up
table has been developed. A specific risk w eight applies to
exposures to small and medium-sized enterprises (SM Es).
 In addition, the revised standardised approach includes a
standalone treatm ent for exposures to project finance, object
finance and com m odities finance.
• For residential real estate exposures, more risk-sensitive
approaches have been developed, whereby risk weights
vary based on the LTV ratio of the mortgage (instead of the
existing single risk weight) and in ways that better reflect
differences in market structures.
• For retail exp o su res, a more granular treatm en t ap p lies,
which distinguishes betw een different typ es of retail
exp o su res. For exam p le, the regulatory retail portfolio
distinguishes betw een revolving facilities (w here cred it is
typ ically drawn upon) and transacto rs (w here the facility
is used to facilitate transactio ns rather than a source
of credit).
• For commercial real estate exposures, approaches have
been developed that are more risk-sensitive than the flat risk
w eight which generally applies.
• For subordinated debt and equity exposures, a more granu­
lar risk w eight treatm ent applies (relative to the current flat
risk weight).
• For off-balance sheet item s, the credit conversion factors
(C C Fs), which are used to determ ine the amount of an
exposure to be risk-weighted, have been made more risk-
sensitive, including the introduction of positive C C F s for
unconditionally cancellable commitments (UCCs).

Table 21.1 O v e rv ie w of R evised S tan d ard ised A p p ro ach to C re d it Risk

Exposures to banks

Risk weights in jurisdictions where the ratings approach is perm itted

External rating AAA to A A - A+ to A - BBB+ to B B B - BB+ to B - Below B - Unrated

Risk weight 20% 30% 50% 100% 150% As for SC R A below

Short-term exp o su res

Risk weight 20% 20% 20% 50% 150% As for SC R A below

Risk weights where the ratings approach is not perm itted and for unrated exposures

Standardised Credit Risk Grade A Grade B Grade C

Assessment Approach (SCRA)
grades

Risk weight 40% 1 75% 150%

Short-term exposures 20% 50% 150%

Exposures to covered bonds

Risk weights for rated covered bonds

External issue-specific rating AAA to A A - A+ to B B B - BB+ to B - Below B—

Risk weight 10% 20% 50% 100%

Risk weights for unrated covered bonds

Risk weight of issuing bank 20% 30% 40% 50% 75% 100% 150%

Risk weight 10% 15% 20% 25% 35% 50% 100%

Exposures to general corporates

Risk weights in jurisdictions where the ratings approach is perm itted

External rating AAA to A A - A+ to A — BBB+ to B B B - BB+ to B B - Below B B - Unrated

of counterparty

Risk weight 20% 50% 75% 100% 150% 100% or 85%

if corporate SM E

(Continued)

1 A risk w eight of 30% may be applied if the exposure to the bank satisfies all of the criteria for G rade A classification and in addition the counterparty
bank has (i) a CET1 ratio of 14% or above; and (ii) a T ie r 1 leverage ratio of 5% or above.

Chapter 21 High-Level Summary of Basel III Reforms ■ 329

Table 21.1 Continued
Risk weights where rating approach is not perm itted

SCRA grades Investment grade All other

G eneral corporate (non-SME) 65% 100%

SM E general corporate 85%

Exposures to project finance, object finance and commodities finance

Exposure (excluding real estate) Project finance Object and commodity finance

Issue-specific ratings available Same as for general corporate (see above)

and perm itted

Rating not available or not 130% pre-operational phase 100%

perm itted
100% operational phase
80% operational phase (high quality)

il exposures excluding real estate

Regulatory Regulatory retail (revolving) Other retail

retail
Transactors Revolvers
(non-revolving)

Risk weight 75% 45% 75% 100%

Residential real estate exposures

LTV bands Below 50% 50% to 60% to 70% to 80% to 90% to above Criteria not met
60% 70% 80% 90% 100% 100%

G eneral R R E

W hole loan 20% 25% 30% 40% 50% 70% RW of counterparty

approach RW

Loan-splitting 20% RW of counterparty RW of counterparty

approach2 RW

Incom e-producing residential real estate (IPRRE)

W hole loan 30% 35% 45% 60% 75% 105% 150%

approach RW

Commercial real estate (CRE) exposures

G eneral C R E

W hole loan approach LTV < 60% LTV > 60% Criteria not m et

Min (60%, RW of counterparty) RW of counterparty RW of counterparty

Loan-splitting LTV < 55% LTV > 55% Criteria not m et

approach2
Min (60%, RW of counterparty) RW of counterparty RW of counterparty

Incom e-producing com m ercial real estate (IPCRE)

W hole loan LTV < 60% 60% < LTV < 80% LTV > 80% Criteria not m et
approach
70% 90% 110% 150%

2 Under the loan-splitting approach, a supervisory specified risk w eight is applied to the portion of the exposure that is below 55% of the property
value and the risk w eight of the counterparty is applied to the rem ainder of the exposure. In cases where the criteria are not met, the risk w eight of
the counterparty is applied to the entire exposure.

330 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Land acquisition, d evelo p m en t and construction (ADC) exp o su res

Loan to com pany/SPV 150%

Residential A D C loan 100%

Subordinated debt and equity (excluding amounts deducted)

Subordinated debt Equity exposures "Speculative unlisted All other equity

and capital other than to certain legislated equity" exposures
equities programmes
Risk weight 150% 100% 400% 250%

Credit conversion factors for off-balance sheet exposures

UCCs Commitments, NIFs and RUFs, ST self-liquidating Direct credit

except UCCs and certain trade letters of credit substitutes and
transaction- related arising from the other off balance
contingent items movement of goods sheet exposures
CCF 10% 40% 50% 20% 100%

IN T E R N A L R A T IN G S-B A SED Table 21.2 Revised Scope of IRB Approaches

A P P R O A C H E S F O R C R E D IT R ISK for Asset Classes
Basel III:
As noted above, the financial crisis highlighted a number Portfolio/ Basel II: Available Available
of shortcom ings related to the use of internally modelled Exposure Approaches Approaches
approaches for regulatory capital, including the IRB approaches
Large and mid­ A-IRB, F-IRB, SA F-IRB, SA
to credit risk. These shortcom ings include the excessive com ­
sized corporates
plexity of the IRB approaches, the lack of com parability in banks' (consolidated
internally m odelled IRB capital requirem ents and the lack of revenues >
robustness in modelling certain asset classes. €500m)

To address these shortcom ings, the Com m ittee has made the Banks and A-IRB, F-IRB, SA F-IRB, SA
following revisions to the IRB approaches: (i) removed the other financial
institutions
option to use the advanced IRB (A-IRB) approach for certain
asset classes; (ii) adopted "input" floors (for metrics such as Equities Various IRB SA
probabilities of default (PD) and loss-given-default (LGD)) to approaches

ensure a minimum level of conservativism in model param eters Specialised A-IRB, F-IRB, A-IRB, F-IRB,
for asset classes where the IRB approaches remain available; and lending3 slotting, SA slotting, SA
(iii) provided greater specification of param eter estimation prac­
tices to reduce RWA variability.
of RWA variability as it applies fixed values to the LGD and EAD
param eters. In addition, all IRB approaches are being removed

Removing the Use of the Advanced IRB for exposures to equities, which are typically a small com ponent
of the credit risk of banks.
Approach for Certain Asset Classes
Table 21.2 outlines the revised scope of approaches available
The revised IRB fram ework removes the use of the A-IRB
under Basel III for certain asset classes relative to the Basel II
approach— which allows banks to estim ate the PD, LG D , exp o­
fram ework.
sure at default (EAD ) and maturity of an exposure - for asset
classes that cannot be m odelled in a robust and prudent man­
ner. These include exposures to large and mid-sized corporates,
3 W ith respect to specialised lending, banks would be perm itted to
and exposures to banks and other financial institutions. As a
continue using the advanced and foundation IRB approaches. The
result, banks with supervisory approval will use the foundation Com m ittee will review the slotting approach for specialised lending in
IRB (F-IRB) approach, which removes the two im portant sources due course.

Chapter 21 High-Level Summary of Basel III Reforms ■ 331

Table 21.3 Minimum Parameter Values in the Revised IRB Framework4

Loss-Given-Default (LGD)
Probability of Exposure at
Default (PD) Unsecured Secured Default (EAD)
Corporate 5 bp 25% Varying by collateral type:
• 0% financial
• 10% receivables
• 10% commercial or residen­
tial real estate
• 15% other physical EAD subject to a floor
that is the sum of (i) the
Retail classes: on-balance sheet exp o ­
M ortgages 5 bp N/A 5% sures; and (ii) 50% of the
off-balance sheet exposure
Q R R E transactors 5 bp 50% N/A
using the applicable Credit
Q R R E revolvers 10 bp 50% N/A Conversion Factor (C C F) in
O ther retail 5 bp 30% Varying by collateral type: the standardised approach
• 0% financial
• 10% receivables
• 10% commercial or residen­
tial real estate
• 15% other physical

Specification of Input Floors C V A R IS K F R A M E W O R K

The revised IRB framework also introduces minimum "floor" val­
The initial phase of Basel III reforms introduced a capital charge
ues for bank-estimated IRB parameters that are used as inputs
for potential mark-to-market losses of derivative instruments as
to the calculation of RWA. These include PD floors for both the
a result of the deterioration in the creditworthiness of a coun­
F-IRB and A-IRB approaches, and LGD and EAD floors for the
terparty. This risk - known as CVA risk - was a major source of
A-IRB approach. In some cases, these floors consist of recali­
losses for banks during the global financial crisis, exceeding
brated values of the existing Basel II floors. In other cases, the
losses arising from outright defaults in some instances.
floors represent new constraints for banks' IRB models. Table 21.3
summarises the set of input floors in the revised IRB framework. The Com m ittee has agreed to revise the CVA fram ework to:

Additional Enhancements
The Com m ittee agreed on various additional enhancem ents to
the IRB approaches to further reduce unwarranted RW A variabil­
ity, including providing greater specification of the practices that
banks may use to estim ate their model param eters. Adjustm ents
were made to the supervisory specified param eters in the F-IRB
approach, including: (i) for exposures secured by non-financial
collateral, increasing the haircuts that apply to the collateral and
reducing the LG D param eters; and (ii) for unsecured exposures,
reducing the LG D param eter from 45% to 40% for exposures to
non-financial corporates.
Given the enhancem ents to the IRB fram ework and the introduc­
tion of an aggregate output floor (discussed further below), the
Com m ittee has agreed to remove the 1.06 scaling factor that is
currently applied to RWAs determ ined by the IRB approach to
credit risk.
• enhance its risk sensitivity: the current CVA fram ework does
not cover an im portant driver of CVA risk, namely the exp o ­
sure com ponent of CVA. This com ponent is directly related
to the price of the transactions that are within the scope of
application of the CVA risk capital charge. As these prices are
sensitive to variability in underlying market risk factors, the
CVA also materially depends on those factors. The revised
CVA fram ework takes into account the exposure com ponent
of CVA risk along with its associated hedges;
• strengthen its robustness: CVA is a com plex risk, and is
often more com plex than the majority of the positions in4
4The LGD and EAD floors are only applicable in A-IRB approaches. The
EAD floors are for those exposures where EAD modelling is still permit­
ted. The LGD floors for secured exposures apply when the exposure is fully
secured (ie the value of collateral after the application of haircuts exceeds
the value of the exposure). The LGD floor for a partially secured exposure is
calculated as a weighted average of the unsecured LGD floor for the unse­
cured portion and the secured LGD floor for the secured portion.

332 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 banks' trading books. Accordingly, the Com m ittee is of the
view that such a risk cannot be m odelled by banks in a robust
and prudent manner. The revised fram ework removes the
use of an internally modelled approach, and consists of: (i) a
standardised approach; and (ii) a basic approach. In addition,
a bank with an aggregate notional amount of non-centrally
cleared derivatives less than or equal to €100 billion may
calculate their CVA capital charge as a simple multiplier of its
counterparty credit risk charge.
• improve its consistency: CVA risk is a form of market risk as
it is realised through a change in the mark-to-market value of
a bank's exposures to its derivative counterparties. As such,
the standardised and basic approaches of the revised CVA
fram ework have been designed and calibrated to be con­
sistent with the approaches used in the revised market risk
fram ework. In particular, the standardised CVA approach, like
the market risk approaches, is based on fair value sensitivities
to market risk factors and the basic approach is benchmarked
to the standardised approach.
O P E R A T IO N A L R ISK F R A M E W O R K
The financial crisis highlighted two main shortcomings with the
existing operational risk framework. First, capital requirements
for operational risk proved insufficient to cover operational risk
losses incurred by some banks. Second, the nature of these
losses— covering events such as misconduct, and inadequate
systems and controls— highlighted the difficulty associated with
using internal models to estimate capital requirements for opera­
tional risk.
The Com m ittee has stream lined the operational risk fram ework.
The advanced m easurem ent approaches (AM A) for calculating
operational risk capital requirem ents (which are based on banks'
internal models) and the existing three standardised approaches
are replaced with a single risk-sensitive standardised approach
to be used by all banks.
The new standardised approach for operational risk determ ines
a bank's operational risk capital requirem ents based on two
com ponents: (i) a measure of a bank's income; and (ii) a measure
of a bank's historical losses. Conceptually, it assumes: (i) that
operational risk increases at an increasing rate with a bank's
income; and (ii) banks which have experienced greater opera­
tional risk losses historically are assumed to be more likely to
experience operational risk losses in the future.
The operational risk capital requirem ent can be summarised as
follows:
O perational risk capital = BIC X ILM
Chapter 21
where:
• Business Indicator Com ponent (BIC) = 2 > i Bli)
• Bl (Business Indicator) is the sum of three com ponents: the
interest, leases and dividends com ponent; the services com ­
ponent and the financial com ponent
• a\ is a set of marginal coefficients that are multiplied by the
Bl based on three buckets (i = 1, 2, 3 denotes the bucket), as
given below:
Marginal Bl
Bl Bucket Bl Range Coefficients ( c * j)
1 < €1 bn 0.12
2 €1 bn < Bl < € 3 0 bn 0.15
3 > € 3 0 bn 0.18
• ILM (the Internal Loss Multiplier) is a function of the BIC
and the Loss Com ponent (LC), where the latter is equal to
15 tim es a bank's average historical losses over the preceding
10 years. The ILM increases as the ratio of (LC/BIC) increases,
although at a decreasing rate.5
A t national discretion, supervisors can elect to set ILM equal
to one for all banks in their jurisdiction. This means that capital
requirements in such cases would be determined solely by the
BIC. That is, capital requirements would not be related to a bank's
historical operational risk losses. However, to aid comparability,
all banks would be required to disclose their historical operational
risk losses, even in jurisdictions where the ILM is set to one.
L E V E R A G E RATIO F R A M E W O R K
Buffer for Global Systemically
Important Banks
The leverage ratio com plem ents the risk-weighted capital
requirem ents by providing a safeguard against unsustainable
levels of leverage and by mitigating gaming and model risk
across both internal models and standardised risk measurement
approaches. To maintain the relative incentives provided by
both capital constraints, the finalised Basel III reforms introduce
a leverage ratio buffer for G-SIBs. Such an approach is consis­
tent with the risk-weighted G-SIB buffer, which seeks to mitigate
the externalities created by G-SIBs.
The leverage ratio G-SIB buffer must be met with Tier 1 capital
and is set at 50% of a G-SIB's risk- weighted higher-loss absor­
bency requirem ents. For exam ple, a G-SIB subject to a 2%
5 Specifically, ILM = In [exp(1) — 1 + (LC /B IC )08].
High-Level Summary of Basel III Reforms ■ 333
risk-weighted higher-loss absorbency requirem ent would be
subject to a 1% leverage ratio buffer requirem ent.
The leverage ratio buffer takes the form of a capital buffer
akin to the capital buffers in the risk-weighted fram ework. As
such, the leverage ratio buffer will be divided into five ranges.
As is the case with the risk-weighted fram ework, capital distribu­
tion constraints will be imposed on a G-SIB that does not meet
its leverage ratio buffer requirem ent.
The distribution constraints imposed on a G-SIB will depend on
its CET1 risk-weighted ratio and Tier 1 leverage ratio. A G-SIB
that m eets: (i) its CET1 risk-weighted requirem ents (defined as
a 4.5% minimum requirem ent, a 2.5% capital conservation buf­
fer and the G-SIB higher loss-absorbency requirement) and; (ii)
its Tier 1 leverage ratio requirem ent (defined as a 3% leverage
ratio minimum requirem ent and the G-SIB leverage ratio buffer)
will not be subject to distribution constraints. A G-SIB that does
not m eet one of these requirements will be subject to the asso­
ciated minimum capital conservation requirem ent (expressed
as a percentage of earnings). A G-SIB that does not meet both
requirem ents will be subject to the higher of the two associated
conservation requirem ents.
definition of the leverage ratio exp o sure m easure. These
refinem ents include m odifying the w ay in which d erivatives
are reflected in the exposure m easure and updating the tre a t­
m ent of off-balance sh eet exp o sures to ensure consistency
with th eir m easurem ent in the standardised approach to
cred it risk.
The Com m ittee has also agreed that jurisdictions may exercise
national discretion in periods of exceptional m acroeconomic
circum stances to exem pt central bank reserves from the lever­
age ratio exposure measure on a tem porary basis. Jurisdictions
that exercise this discretion would be required to recalibrate
the minimum leverage ratio requirem ent com m ensurately to
offset the impact of excluding central bank reserves, and require
their banks to disclose the im pact of this exem ption on their
leverage ratios.
The Com m ittee continues to monitor the impact of the Basel III
leverage ratio's treatm ent of client-cleared derivative transac­
tions. It will review the impact of the leverage ratio on banks'
provision of clearing services and any consequent impact on the
resilience of central counterparty clearing.

As an exam ple, Table 21.4 shows the minimum capital conser­ OUTPUT FLO O R
vation standards for the CET1 risk-weighted requirements and
Tier 1 leverage ratio requirem ents of a G-SIB in the first bucket The Basel II fram ework introduced an output floor based on
of the higher loss-absorbency requirements (ie where a 1% risk- Basel I capital requirem ents. That floor was calibrated at 80%
weighted G-SIB capital buffer applies). of the relevant Basel I capital requirem ents. Implementation of
the Basel II floor has been inconsistent across countries, partly
because of differing interpretations of the requirem ent and also
Refinements to the Leverage Ratio
because it is based on the Basel I standards, which many banks
Exposure Measure
and jurisdictions no longer apply.
In addition to the introduction of the G -SIB buffer, the
The Basel III reform s replace the existing Basel II floor with a
C o m m ittee has agreed to m ake various refinem ents to the
floor based on the revised Basel III standardised approaches.
C o n sisten t with the original floor, the revised floor places
Table 21.4 Capital Conservation Ratios for a G-SIB a lim it on the regulatory capital benefits that a bank using
Subject to a 1% Risk-Weighted Buffer and 0.5% internal m odels can derive relative to the standardised
Leverage Ratio Buffer ap p ro aches. In effe ct, the output flo o r provides a risk-based
backstop that lim its the exte n t to which banks can lower their
Minimum Capital
capital requirem ents relative to the standardised ap p ro aches.
Conservation
This helps to m aintain a level playing field betw een banks
CET1 Risk- Ratios (Expressed
using internal m odels and those on the standardised
Weighted Tier 1 Leverage as a Percentage
ap p ro aches. It also supports the cred ib ility of banks' risk-
Ratio Ratio of Earnings)
w eig hted calculatio ns, and im proves co m p arab ility via the
4.5-5.375% 3-3.125% 100% related disclo sures.
> 5 .3 7 5 -6 .2 5 % > 3 .1 2 5 -3 .2 5 % 80% Under the revised output floor, banks' risk-weighted assets
> 6 .2 5 -7 .1 2 5 % > 3 .2 5 -3 .3 7 5 % 60% must be calculated as the higher of: (i) total risk-weighted assets
calculated using the approaches that the bank has supervisory
> 7 .1 2 5 -8 % > 3 .3 7 5 -3 .5 0 % 40%
approval to use in accordance with the Basel capital fram e­
> 8.0% > 3.50% 0%
work (including both standardised and internal model-based

334 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Implementation Dates of Basel III Post-Crisis Reforms and Transitional Arrangement for Phasing in the
Aggregate Output Floor
Revision Implementation Date

Revised standardised approach for credit risk • 1 January 2022

Revised IRB fram ework • 1 January 2022

Revised CVA fram ework • 1 January 2022

Revised operational risk fram ework • 1 January 2022

Revised market risk fram ework • 1 January 20226

Leverage ratio • Existing exposure definition:7 1 January 2018

• Revised exposure
definition: 1 January 2022
• G-SIB buffer: 1 January 2022

O utput floor • 1 January 2022: 50%

• 1 January 2023: 55%
• 1 January 2024: 60%
• 1 January 2025: 65%
• 1 January 2026: 70%
• 1 January 2027: 72.5%

approaches); and (ii) 72.5% of the total risk-weighted assets
calculated using only the standardised approaches.
The standardised approaches to be used when calculating the
output floor are as follows:
|• • | | | |• | | r |• • |
• C re d it risk: the standardised approach tor cred it risk
outlined ab o ve. W hen calculating the degree of credit
risk m itigation, banks m ust use the carrying value when
applying the sim ple approach or the com prehensive
approach with standard sup erviso ry haircuts. This also
includes failed trad es and non-delivery-versus-paym ent
transactio ns as set out in A n n e x 3 of the Basel II fram ew ork
(Ju n e 2006).
• M arket risk: the standardised (or simplified standardised)
approach of the revised m arket risk fram ework. The SEC-
ER B A , the SEC -SA or a 1250% risk w eight must also be used
when determ ining the default risk charge com ponent for
securitisations held in the trading book.
• O p eratio n al risk: the standardised approach for opera-
tional risk.
Banks will also be required to disclose their risk-weighted assets
based on the revised standardised approaches. Details about
these disclosure requirem ents will be set forth in a forthcoming
consultation paper.

• C o unterp artv credit risk: to calculate the exposure for

d erivatives, banks must use the standardised approach for
m easuring counterparty credit risk (SA -C C R ). The exposure
am ounts must then be m ultiplied by the relevant borrow er
risk w eig ht using the standardised approach for credit risk
to calculate RW A under the standardised approach for
credit risk.
• Credit valuation adjustm ent risk: the standardised approach
for CVA (SA-CVA), the Basic Approach (BA-CVA) or 100% of a
bank's counterparty credit risk capital requirem ent (depend­
ing on which approach the bank is eligible for and uses for
CVA risk).
• Securitisation fram ework: the external ratinqs-based
approach (SEC -ER B A ), the standardised approach (SEC-SA)
or a 1250% risk weight.
T R A N S IT IO N A L A R R A N G E M E N T S
Table 21.5 sum m arises the im plem entation dates and
transitional arrangem ents related to the standards
d escrib ed abo ve.
In addition, at national discretion, supervisors may cap
the increase in a bank's total RW As that results from the
application of the output floor during its phase-in period.
6 This will constitute both the im plem entation and regulatory reporting
date for the revised market risk fram ew ork published in January 2016.
7 Based on the January 2014 definition of the leverage ratio exposure
m easure. Jurisdictions are free to apply the revised definition of the
exposure measure before 1 January 2022.

Chapter 21 High-Level Summary of Basel III Reforms ■ 335

The transitional cap on the increase in RW As will be set at
25% of a bank's RW As before the application of the floor.
Put differently, if the supervisor uses this discretion, the bank's
RW As will effectively be capped at 1.25 tim es the internally
calculated RW As during that tim e. The cap would apply for
the duration of the phase-in period of the output floor
(i.e ., the cap would be rem oved on 1 Jan u ary 2027).
More generally, a jurisdiction which does not im plem ent some
or all of the internal-modelled approaches but instead only
im plem ents the standardised approaches is com pliant with the
Basel fram ework. More generally, jurisdictions may elect to
im plem ent more conservative requirements and/or accelerated
transitional arrangem ents, as the Basel fram ework constitutes
minimum standards only.

336 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Basel III: Finalising
Post-Crisis Reforms
Learning Objectives
A fter com pleting this reading you should be able to:

Explain the elem ents of the new standardized approach
to measure operational risk capital, including the business
indicator, internal loss multiplier, and loss com ponent, and
calculate the operational risk capital requirem ent for a
bank using this approach.
• Describe general and specific criteria recom m ended by
the Basel Com m ittee for the identification, collection, and
treatm ent of operational loss data.

Com pare the SM A to earlier methods of calculating

operational risk capital, including the Advanced
M easurem ent Approaches (AM A).

Basel Com m ittee on Banking Supervision Publication, D ecem ber 2017.

22.1 IN T R O D U C T IO N
Operational risk is defined as the risk of loss resulting from
inadequate or failed internal processes, people and system s or
A
from external events. This definition includes legal risk, but
excludes strategic and reputational risk.
The standardised approach for measuring minimum operational
risk capital requirem ents replaces all existing approaches in the
Basel II fram ew ork.1
2 That is, this standard replaces paragraphs
644 to 683 of the Basel II fram ework.
Consistent with Part I (Scope of Application) of the Basel II
Fram ework, the standardised approach applies to internationally
active banks on a consolidated basis. Supervisors retain the dis­
cretion to apply the standardised approach fram ework to non-
internationally active banks.
2 2 .2 T H E S T A N D A R D IS E D A P P R O A C H
The standardised approach m ethodology is based on the fo l­
lowing com ponents: (i) the Business Indicator (Bl) which is a
financial-statem ent-based proxy for operational risk; (ii) the
Business Indicator Com ponent (BIC), which is calculated by
multiplying the Bl by a set of regulatory determ ined marginal
coefficients («[); and (iii) the Internal Loss M ultiplier (ILM), which
is a scaling factor that is based on a bank's average historical
losses and the BIC.
The Business Indicator
The Business Indicator (Bl) com prises three com ponents: the
interest, leases and dividend com ponent (ILDC); the services
com ponent (SC), and the financial com ponent (FC).
The Bl is defined as:
Bl = ILD C + SC + F C
1 Legal risk includes, but is not limited to, exposure to fines, penalties,
or punitive dam ages resulting from supervisory actions, as well as pri­
vate settlem ents.
2 Basel Com m ittee on Banking Supervision, Basel II: International
C o n verg en ce o f Capital M easu rem en t and Capital Standards: A
R evised Fram ew ork— C om prehen sive Version, Ju n e 2006, w w w .bis.org/
pub7bcbs128.htm .
338 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
In the formula below, a bar above a term indicates that it is ca
culated as the average over three years: t, t-1 and t-2, and :3
ILD C = Min A b s (Interest Incom e - Interest E xp e n se);
2.25% • Interest Earning A sse ts ] + Dividend Income
S C = Max [ O ther Operating incom e; O ther Operating
E xp en se l + Max [ Fee incom e; F e e Exp en se
F C = A b s (N et P & LTrading B o o k ) + A b s (N et P & L
Banking B o o k )
The definitions for each of the com ponents of the Bl are
provided in the annex of this section.
The Business Indicator Component
To calculate the BIC, the Bl is multiplied by the marginal
coefficients («j). The marginal coefficients increase with the
size of the Bl as shown in Table 22.1. For banks in the first
bucket (ie with a Bl less than or equal to €1 bn) the BIC is
equal to Bl X 12%. The marginal increase in the BIC result­
ing from a one unit increase in the Bl is 12% in bucket 1,
15% in bucket 2 and 18% in bucket 3. For exam ple, given
a Bl = € 3 5 b n , the BIC = (1 X 12%) + (3 0 -1 ) X 15% +
(3 5 -3 0 ) X 18% = € 5 .3 7 b n .
The Internal Loss Multiplier
A bank's internal operational risk loss experience affects the
calculation of operational risk capital through the Internal Loss
M ultiplier (ILM). The ILM is defined as:
( / \0.8 ^
LC
ILM = Ln exp(l) - 1 +
V \ BIC / /
w here the Loss C o m p o nent (LC) is equal to 15 tim es average
annual operational risk losses incurred over the previous 10
years. The ILM is equal to one when the loss and business
indicator com ponents are equal. W hen the LC is greater
than the B IC , the ILM is g reater than one. Th at is, a bank
with losses that are high relative to its BIC is required to hold
higher capital due to the incorporation of internal losses into
the calculation m ethodology. C o n verse ly, w here the LC is
3 The absolute value of net items (eg, interest income - interest
expense) should be calculated first year by year. O nly after this year
by year calculation should the average of the three years be calculated.
Table 22.1 Bl R anges and M arginal C o efficien ts
Bl Marginal
Bucket Bl Range (in €bn) Coefficients (cO
1 < 1 12%
2 1 < Bl < 30 15%
3 > 30 18%
low er than the B IC , the ILM is less than one. Th at is, a bank
with losses th at are low relative to its BIC is required to hold
low er capital due to the incorporation of internal losses into
the calculation m ethodology.
The calculation of average losses in the Loss Com ponent must
be based on 10 years of high-quality annual loss data. A s part of
the transition to the standardised approach, banks that do not
have 10 years of high-quality loss data may use a minimum of
five years of data to calculate the Loss Com ponent.4 Banks that
do not have five years of high-quality loss data must calculate
the capital requirem ent based solely on the Bl Com ponent.
Supervisors may however require a bank to calculate capital
requirements using few er than five years of losses if the ILM is
greater than 1 and supervisors believe the losses are representa­
tive of the bank's operational risk exposure.
The Standardised Approach Operational
Risk Capital Requirement
The operational risk capital requirem ent is determ ined by the
product of the BIC and the ILM. For banks in bucket 1 (ie with
Bl < €1 billion), internal loss data does not affect the capital
calculation. That is, the ILM is equal to 1, so that operational risk
capital is equal to the BIC (= 12% • Bl).
A t national discretion, supervisors may allow the inclusion of
internal loss data into the fram ework for banks in bucket 1, sub­
ject to meeting the loss data collection requirem ents. In addi­
tion, at national discretion, supervisors may set the value of ILM
equal to 1 for all banks in their jurisdiction. In case this discretion
is exercised, banks would still be subject to the full set of disclo­
sure requirem ents.
4 This treatm ent is not expected to apply to banks that currently use the
advanced m easurem ent approaches for determ ining operational risk
capital requirem ents.
Chapter 22
Minimum operational risk capital (O RC) is calculated by multiply­
ing the BIC and the ILM :5
ORC = BIC ■ILM
22.3 APPLICATION O F THE
STANDARDISED APPROACH
WITHIN A GROUP
A t the consolidated level, the standardised approach cal­
culations use fully consolidated Bl figures, which net all the
intragroup income and expenses. The calculations at a sub-con­
solidated level use Bl figures for the banks consolidated at that
particular sub-level. The calculations at the subsidiary level use
the Bl figures from the subsidiary.
Similar to bank holding com panies, when Bl figures for sub-con­
solidated or subsidiary banks reach bucket 2, these banks are
required to use loss experience in the standardised approach
calculations. A sub-consolidated bank or a subsidiary bank uses
only the losses it has incurred in the standardised approach cal­
culations (and does not include losses incurred by other parts of
the bank holding company).
In case a subsidiary of a bank belonging to bucket 2 or higher
does not m eet the qualitative standards for the use of the Loss
Com ponent, this subsidiary must calculate the standardised
approach capital requirem ents by applying 100% of the Bl C om ­
ponent. In such cases supervisors may require the bank to apply
an ILM which is greater than 1.
22.4 MINIMUM STANDARDS FOR
THE USE O F LOSS DATA UNDER
THE STANDARDISED APPROACH
Banks with a Bl greater than €1 bn are required to use loss data
as a direct input into the operational risk capital calculations.
The soundness of data collection and the quality and integrity
of the data are crucial to generating capital outcom es aligned
with the bank's operational loss exposure. National supervisors
should review the quality of banks' loss data periodically.
Banks which do not meet the loss data standards are required
to hold capital that is at a minimum equal to 100% of the BIC.
In such cases supervisors may require the bank to apply an ILM
5 Risk-weighted assets for operational risk are equal to 12.5 tim es O R C .
Basel III: Finalising Post-Crisis Reforms ■ 339
which is greater than 1. The exclusion of internal loss data due
to non-compliance with the loss data standards, and the applica­
tion of any resulting m ultipliers, must be publicly disclosed.
22.5 G EN ER A L CRITERIA ON LOSS
DATA IDENTIFICATION, CO LLECTIO N
AND TREATM ENT
The proper identification, collection and treatm ent of internal
loss data are essential prerequisites to capital calculation under
the standardised approach. The general criteria for the use of
the LC are as follows:
a. Internally generated loss data calculations used for regula­
tory capital purposes must be based on a 10-year observa­
tion period. When the bank first moves to the standardised
approach, a five-year observation period is acceptable on
an exceptional basis when good-quality data are unavail­
able for more than five years.
b. Internal loss data are most relevant when clearly linked to a
bank's current business activities, technological processes and
risk management procedures. Therefore, a bank must have
documented procedures and processes for the identification,
collection and treatment of internal loss data. Such proce­
dures and processes must be subject to validation before the
use of the loss data within the operational risk capital require­
ment measurement methodology, and to regular indepen­
dent reviews by internal and/or external audit functions.
c. For risk m anagem ent purposes, and to assist in supervisory
validation and/or review, a supervisor may request a bank
to map its historical internal loss data into the relevant Level
I supervisory categories as defined in A nnex 9 of the Basel
II Fram ework and to provide this data to supervisors. The
bank must docum ent criteria for allocating losses to the
specified event types.
d. A bank's internal loss data must be com prehensive and
capture all material activities and exposures from all appro­
priate subsystem s and geographic locations. The minimum
threshold for including a loss event in the data collection
and calculation of average annual losses is set at €20,000.
A t national discretion, for the purpose of the calculation of
average annual losses, supervisors may increase the thresh­
old to €100,000 for banks in buckets 2 and 3 (ie where the
Bl is greater than €1 bn).
e. Aside from information on gross loss amounts, the bank must
collect information about the reference dates of operational
risk events, including the date when the event happened or
first began ("date of occurrence"), where available; the date
340 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
on which the bank became aware of the event ("date of dis­
covery"); and the date (or dates) when a loss event results in
a loss, reserve or provision against a loss being recognised in
the bank's profit and loss (P&L) accounts ("date of account­
ing"). In addition, the bank must collect information on
recoveries of gross loss amounts as well as descriptive infor­
mation about the drivers or causes of the loss event.6 The
level of detail of any descriptive information should be com­
mensurate with the size of the gross loss amount.
f. O perational loss events related to credit risk and that are
accounted for in credit risk RWAs should not be included
in the loss data set. O perational loss events that relate to
credit risk, but are not accounted for in credit risk RWAs
should be included in the loss data set.
g. Operational risk losses related to market risk are treated as
operational risk for the purposes of calculating minimum
regulatory capital under this framework and will therefore be
subject to the the standardised approach for operational risk.
h. Banks must have processes to independently review the
com prehensiveness and accuracy of loss data.
22.6 SP EC IFIC CRITERIA ON LOSS
DATA IDENTIFICATION, CO LLECTIO N
AND TREATM ENT
Building of the Standardised Approach
Loss Data Set
Building an acceptable loss data set from the available internal
data requires that the bank develop policies and procedures to
address several features, including gross loss definition, refer­
ence date and grouped losses.
Gross Loss, Net Loss, and Recovery
Definitions
Gross loss is a loss before recoveries of any type. Net loss is
defined as the loss after taking into account the impact of recov­
eries. The recovery is an independent occurrence, related to the
original loss event, separate in tim e, in which funds or inflows of
econom ic benefits are received from a third party.7
6 Tax effects (eg reductions in corporate income tax liability due to
operational losses) are not recoveries for purposes of the standardised
approach for operational risk.
7 Exam ples of recoveries are paym ents received from insurers, repay­
ments received from perpetrators of fraud, and recoveries of m isdi­
rected transfers.
Banks must be able to identify the gross loss amounts, non­
insurance recoveries, and insurance recoveries for all operational
loss events. Banks should use losses net of recoveries (including
insurance recoveries) in the loss dataset. However, recoveries
can be used to reduce losses only after the bank receives pay­
ment. Receivables do not count as recoveries. Verification of
payments received to net losses must be provided to supervi­
sors upon request.
The following items must be included in the gross loss com puta­
tion of the loss data set:
a. Direct charges, including impairments and settlem ents, to
the bank's P&L accounts and write-downs due to the opera­
tional risk event;
b. Costs incurred as a consequence of the event including
external expenses with a direct link to the operational risk
event (eg legal expenses directly related to the event and
fees paid to advisors, attorneys or suppliers) and costs of
repair or replacem ent, incurred to restore the position that
was prevailing before the operational risk event;
c. Provisions or reserves accounted for in the P&L against the
potential operational loss impact;
d. Losses stemming from operational risk events with a defini­
tive financial im pact, which are tem porarily booked in tran­
sitory and/or suspense accounts and are not yet reflected in
the P&L ("pending lo sses").8 Material pending losses should
be included in the loss data set within a tim e period com ­
mensurate with the size and age of the pending item; and
e. Negative econom ic im pacts booked in a financial account­
ing period, due to operational risk events impacting the
cash flows or financial statem ents of previous financial
accounting periods ("tim ing lo sses").9 Material "timing
losses" should be included in the loss data set when they
are due to operational risk events that span more than one
financial accounting period and give rise to legal risk.
8 For instance, in som e countries, the im pact of some events (e.g ., legal
events, dam age to physical assets) may be known and clearly identifi­
able before these events are recognised through the establishm ent of a
reserve. Moreover, the way this reserve is established (e.g ., the date of
discovery) can vary across banks or countries.
9 Tim ing im pacts typically relate to the occurrence of operational risk
events that result in the tem porary distortion of an institution's finan­
cial accounts (e.g ., revenue overstatem ent, accounting errors and
mark-to-market errors). W hile these events do not represent a true
financial im pact on the institution (net im pact over tim e is zero), if the
error continues across more than one financial accounting period, it
may represent a material m isrepresentation of the institution's financial
statem ents.
Chapter 22
The following items should be excluded from the gross loss
computation of the loss data set:
a. Costs of general m aintenance contracts on property, plant
or equipm ent;
b. Internal or external expenditures to enhance the business
after the operational risk losses: upgrades, im provem ents,
risk assessm ent initiatives and enhancem ents; and
c. Insurance premiums.
Banks must use the date of accounting for building the loss data
set. The bank must use a date no later than the date of account­
ing for including losses related to legal events in the loss data
set. For legal loss events, the date of accounting is the date
when a legal reserve is established for the probable estim ated
loss in the P&L.
Losses caused by a common operational risk event or by related
operational risk events over tim e, but posted to the accounts
over several years, should be allocated to the correspond­
ing years of the loss database, in line with their accounting
treatm ent.
22.7 EXCLUSIO N O F LO SSES
FROM THE LOSS CO M PO N EN T
Banking organisations may request supervisory approval to
exclude certain operational loss events that are no longer rel­
evant to the banking organisation's risk profile. The exclusion of
internal loss events should be rare and supported by strong ju s­
tification. In evaluating the relevance of operational loss events
to the bank's risk profile, supervisors will consider whether
the cause of the loss event could occur in other areas of the
bank's operations. Taking settled legal exposures and divested
businesses as exam ples, supervisors expect the organisation's
analysis to dem onstrate that there is no similar or residual legal
exposure and that the excluded loss experience has no rel­
evance to other continuing activities or products.
The total loss amount and number of exclusions must be dis­
closed under Pillar 3 with appropriate narratives, including total
loss amount and number of exclusions.
A request for loss exclusions is subject to a m ateriality thresh­
old to be set by the supervisor (for exam ple, the excluded loss
event should be greater than 5% of the bank's average losses).
In addition, losses can only be excluded after being included in
a bank's operational risk loss database for a minimum period (for
exam ple, three years), to be specified by the supervisor. Losses
related to divested activities will not be subject to a minimum
operational risk loss database retention period.
Basel III: Finalising Post-Crisis Reforms ■ 341
22.8 EXCLU SIO N S O F DIVESTED disclose their annual loss data for each of the ten years in the ILM
calculation window. This includes banks in jurisdictions that have
ACTIVITIES FROM THE BUSINESS opted to set ILM equal to one. Loss data is required to be reported
INDICATOR on both a gross basis and after recoveries and loss exclusions. All
banks are required to disclose each of the Bl sub-items for each of
Banking organisations may request supervisory approval to A n

the three years of the Bl component calculation window.

exclude divested activities from the calculation of the Bl. Such
exclusions must be disclosed under Pillar 3.

22.11 A N N EX : DEFINITION O F
22.9 INCLUSION O F LO SSES AND Bl BUSINESS INDICATOR CO M PO N EN TS *•
ITEMS RELATED TO M ERGERS AND The following P&L items do not contribute to any of the items of
ACQUISITION S the Bl:

• Income and expenses from insurance or reinsurance

Losses and the measurement of the Bl must include losses and Bl
items that result from acquisitions of relevant business and mergers.
22.10 DISCLOSURE
All banks with a Bl greater than €1bn, or which use internal loss
data in the calculation of operational risk capital, are required to
businesses
• Premiums paid and reim bursem ents/paym ents received from
insurance or reinsurance policies purchased
• Adm inistrative expenses, including staff expenses, outsourcing
fees paid for the supply of non-financial services (e.g., logisti­
cal, IT, human resources), and other administrative expenses
(e.g., IT, utilities, telephone, travel, office supplies, postage).

Business Indicator Definitions

P&L or Balance
Bl Component Sheet Items Description Typical Sub-Items

Interest, lease Interest income Interest income from all financial
and dividend assets and other interest income
(includes interest income from
financial and operating leases
and profits from leased assets)
• Interest income from loans and advances, assets
available for sale, assets held to maturity, trading
assets, financial leases and operational leases
• Interest income from hedge accounting derivatives
• O ther interest income
• Profits from leased assets

Interest Interest expenses from all finan­
expenses cial liabilities and other interest
expenses
(includes interest expense from
financial and operating leases,
losses, depreciation and impair­
ment of operating leased assets)
• Interest expenses from deposits, debt securities
issued, financial leases, and operating leases
• Interest expenses from hedge accounting derivatives
• O ther interest expenses
• Losses from leased assets
• Depreciation and im pairm ent of operating leased
assets

Interest earning Total gross outstanding loans, advances, interest bearing securities (including governm ent
assets (balance bonds), and lease assets measured at the end of each financial year
sheet item)

Dividend Dividend income from investments in stocks and funds not consolidated in the bank's finan­
income cial statem ents, including dividend income from non-consolidated subsidiaries, associates
and joint ventures

10 The Com m ittee will undertake a separate public consultation on the

operational risk disclosure tem plates.

342 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Business Indicator Definitions

P&L or Balance
Bl Component Sheet Items Description Typical Sub-Items

Services Fee and com ­ Income received from provid­
mission income ing advice and services. Includes
income received by the bank as
an outsourcer of financial services
Fee and commission income from:
• Securities (issuance, origination, reception, transm is­
sion, execution of orders on behalf of customers)
• Clearing and settlem ent; A sset m anagem ent; C us­
tody; Fiduciary transactions; Payment services;
Structured finance; Servicing of securitisations; Loan
commitments and guarantees given; and foreign
transactions

Fee and Expenses paid for receiving Fee and commission expenses from:
commission advice and services. Includes
• Clearing and settlem ent; Custody; Servicing of
expenses outsourcing fees paid by the
securitisations; Loan com m itm ents and guarantees
bank for the supply of financial
received; and Foreign transactions
services, but not outsourcing
fees paid for the supply of non-
financial services (eg logistical, IT,
human resources)

O ther operat­ Income from ordinary banking
ing income operations not included in other
Bl items but of similar nature
(income from operating leases
should be excluded)
• Rental income from investm ent properties
• Gains from non-current assets and disposal groups
classified as held for sale not qualifying as discontin­
ued operations (IFRS 5.37)

O ther operat­ Expenses and losses from ordi­
ing expenses nary banking operations not
included in other Bl items but of
similar nature and from opera­
tional loss events (expenses from
operating leases should be
excluded)
• Losses from non-current assets and disposal groups
classified as held for sale not qualifying as discontin­
ued operations (IFRS 5.37)
• Losses incurred as a consequence of operational loss
events (eg fines, penalties, settlem ents, replacem ent
cost of dam aged assets), which have not been provi-
sioned/reserved for in previous years
• Expenses related to establishing provisions/reserves
for operational loss events

Financial Net profit (loss) • Net profit/loss on trading assets and trading liabilities (derivatives, debt securities, equity
on the trading securities, loans and advances, short positions, other assets and liabilities)
book • Net profit/loss from hedge accounting
• Net profit/loss from exchange differences

Net profit (loss) • Net profit/loss on financial assets and liabilities measured at fair value through profit and
on the banking loss
book • Realised gains/losses on financial assets and liabilities not measured at fair value through
profit and loss (loans and advances, assets available for sale, assets held to maturity,
financial liabilities measured at amortised cost)
• Net profit/loss from hedge accounting
• Net profit/loss from exchange differences

Chapter 22 Basel III: Finalising Post-Crisis Reforms ■ 343

• Recovery of adm inistrative expenses including recovery of
payments on behalf of custom ers (e.g ., taxes debited to
customers)
• Expenses of premises and fixed assets (except when these
expenses result from operational loss events)
• Depreciation/am ortisation of tangible and intangible assets
(except depreciation related to operating lease assets, which
should be included in financial and operating lease expenses)
• Provisions/reversal of provisions (e.g ., on pensions, com m it­
ments and guarantees given) excep t for provisions related to
operational loss events
• Expenses due to share capital repayable on demand
• Impairment/reversal of impairment (e.g ., on financial assets,
non-financial assets, investments in subsidiaries, joint ven­
tures and associates)
• Changes in goodwill recognised in profit or loss
• Corporate income tax (tax based on profits including current
tax and deferred).

344 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 Learning Objectives
A fter com pleting this reading you should be able to:

Describe elem ents of an effective cyber-resilience Explain methods that can be used to assess the financia
fram ework and explain ways that an organization can impact of a potential cyber attack and explain ways to
becom e more cyber-resilient. increase a firm's financial resilience.

Explain resilient security approaches that can be used to

increase a firm's cyber resilience, and describe challenges
to their im plem entation.

E x c e rp t is C hapter 8 from Solving C yber Risk: Protecting Your Com pany and Society, by A n d re w Coburn, Eireann Leverett, and
G ordon Woo.

345
23.1 C H A N G IN G A P P R O A C H E S
T O R IS K M A N A G E M E N T
Identify, Protect, Detect, Respond,
Recover
The cyber risk m anagem ent fram ework proposed by the
National Institute of Standards and Technology (NIST) consists
A
of five functions:
1 . Identify. Develop an organizational understanding to man­
age cyber security risk to system s, people, assets, data, and
capabilities.
2. Protect. Develop and im plem ent appropriate safeguards to
ensure delivery of critical services.
3. D etect. Develop and im plem ent appropriate activities to
identify the occurrence of a cyber security event.
4. R esp o n d . Develop and im plem ent appropriate activities to
take action regarding a detected cyber security incident.
5. Recover. Develop and im plem ent appropriate activities to
maintain plans for resilience and to restore any capabili­
ties or services that were impaired due to a cyber security
incident.
C yber security in an organization typically places em pha­
sis on maintaining a secure perim eter, with an em phasis on
technology tools for m onitoring internal traffic and external
com m unications, and with minimal tolerance of external pen­
etration, m alware, or unauthorized softw are. C yber security
tools include antivirus softw are, firew alls, network traffic deep-
packet inspection, data m anagem ent system s, email security
system s, server gatew ays, w eb application firew alls, and many
others.
C yber security system design is a com plex and skillful process,
m atching the specific operations and needs of an organization
with the threats it faces, the tools available, and the budget
allocated. The values of individual com ponents of security are
hard to evaluate independently, because security depends
on the w eakest link in the chain - if one com ponent is w eaker
than others, then that is the one that will be exploited by
attackers.
Com panies spend on average around 3% of their information
technology (IT) capital expenditure budget on cyber security.1
2 he managed to land at an airbase, stopping just 20 feet from
Cyber security expenditure has grown rapidly, generating a
1 N IST (2018a), Cybersecurity Fram ew ork v1 .1.
2 Pacific C rest analyst Rob O w ens, quoted in Investor's Business Daily
N ews, 10 Ju n e 2016.
346 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
$120 billion industry today. Projections expect the industry to
continue to grow rapidly to reach hundreds of billions annually
worldwide in a few years.
However, the type of expenditure for typical cyber security bud­
gets is shifting. Traditional purchasing of hardware IT security
com ponents, such as servers, networking gear, data centers, and
physical infrastructure, is being augm ented by broader security
solutions, such as personnel training, non-computer platforms,
and internet of things (loT) security.3
Key trends include increasing em phasis on incident response,
shifting from intrusion prevention to intrusion tolerance, com-
partmentalization and 'credential silos' with protected end­
points, and risk m anagem ent in the supply chain. We discuss
each of these in this chapter.
Threat Analysis
M ost cyber security assessm ents begin with threat analysis.
In C hap ter 5, 'Know Your Enem y', we provide a profile of the
main threat actors and their driving m otivations. An organiza­
tion needs to evaluate the likelihood of being the prim ary
target of each of the main threat groups, or being caught
in the collateral dam age from their activities. O rganizations
will m onitor their cyber events - attem pted attacks, m alware
discovered, suspicious activity - typically in an incident log.
Analysis of the incident log provides im portant insights into the
characteristics and frequencies of attem pted attacks and the
overall threat.
2 3 .2 IN C ID E N T R E S P O N S E A N D
C R ISIS M A N A G E M E N T
Real-time Crisis Management: How
Fighter Pilots Do It
On May 1, 1983, high over the N egev desert of Israel, an F-15
Israeli A ir Force jet collided with an A-4 Skyhawk plane. The
im pact sheared off the right wing of the F-15 jet, which was
sent spinning. A second before pressing the ejector button,
the pilot pushed the throttle, lit the afterburner, gained speed,
and regained control of the plane. A t twice the normal speed,
the end of the runway. The ability to recover from unexpected
precarious and hazardous situations is the essence of resilience.
Cybersecurity Ventures, Cybersecurity M arket Report Q 4 2016.
This astonishing feat of resilience was accom plished through
a highly effective man-machine partnership. First, the intrinsic
aeronautic design of the F-15 meant that it acted like a rocket,
with sufficient lift being provided by the large surface area of
the stabilizers, fuselage, and what remained of the wings. Sec­
ond, the enterprising pilot had the presence of mind to light the
afterburner and accelerate his way out of a deep crisis.
There is much to learn from this exam ple of surprisingly success­
ful real-time crisis m anagem ent. Technology should be designed
to be robustly adaptive to threats both foreseen and unfore­
seen. The man-machine interface is crucial. Corporate staff
have to be trained and prepared for both the expected and the
unexpected. The aim of cyber resilience is to maintain a system's
capability to deliver the intended outcome at all tim es, including
tim es of crisis when regular delivery has failed. A wide range of
m easures, from backups to full disaster recovery, contribute to
cyber resilience, and to maintaining business continuity under
the most testing, unusual, and unexpected circum stances.
Rapid Adaptation to Changing Conditions
As defined by a Presidential Policy Directive, resilience is the
ability to prepare for and adapt to changing conditions and
withstand and recover rapidly from disruptions. Cyber resilience
analysts assess system deficiencies in disruption response, and
develop means of rectifying these weaknesses through cyber
security enhancem ents in prevention, detection, and reaction.
Organizations need to be agile in crisis response. Organizations
need to prepare, prevent, respond, and recover from any crisis
that may em erge.
C yber resilience requires a coherent strategy encompassing
people, processes, and technology. The human dimension is
especially important, because people can make im prudent secu­
rity decisions and take risky actions. On the other hand, under
crisis situations, people can rise in an extraordinary way to the
challenge of adversity. They can make excellent decisions under
intense pressure, coping well with the uncertainty over the trou­
ble they find them selves in and the viability of their em ergency
response plan.
Corporate decision making starts with the board of directors,
who have to drive forward the cyber resilience agenda and
involve the whole organization, extending to the supply chain,
partners, and custom ers. To balance risk with opportunity, a
corporate risk-based strategy needs to be put in place that man­
ages the vulnerabilities, threats, risks, and impacts. This strategy
has to include preparation for and recovery from a cyber attack.
A t the same tim e, costs need to be kept under control, user
convenience must be taken into account, and business require­
ments should be satisfied.
Cyber Risk Awareness in Staff
M icrosoft provides considerations for a cyber resilience pro­
gram .4 Am ongst the recom m endations is that every person with
corporate network access, including full-time em ployees, con­
sultants, and contractors, should be regularly trained to develop
a cyber-resilient mindset. This should include not only adhering
to IT security policies around identity-based access control, but
also alerting IT to suspicious events and infections as soon as
possible to help minimize time to rem ediation.
Training programs specifically geared towards developing a
cyber- resilient mindset are particularly productive. Many, cor­
porate training programs exist to help staff to deal safely with
social engineering scams. Even the most savvy of staff members
may fall victim to one of these scams, which prey upon all man­
ner of psychological, em otional, and cognitive weaknesses.
Magicians exploit these weaknesses to fool people with their
illusions. In the cognitive science literature, it is established that
providing misinformation about past events can reduce memory
accuracy and even create false m em ories. Phishing attacks and
social engineering use a wide variety of con tricks, misdirection,
and scams to try to get staff to reveal credentials, open toxic
attachm ents, follow false links, and carry out other tasks. Spot­
ting these tricks, questioning their veracity, and identifying the
clues to their fakeness are skills that need to be learned and
reinforced in staff behavior.
Business Continuity Planning
and Staff Engagement
All staff m em bers need a good understanding of business con­
tinuity issues. Those assigned specialist duties, such as planning
testing and incident response, need extra specific training, as all
em ergency responders do. Middle and senior managers have
their own responsibilities, and are required to understand and
adopt integrated cyber resilience m anagem ent best practice
and com pliance to standards. The key cyber resilience standards
that should be adopted are:
• ISO 27001, the international standard describing best prac­
tice for an information security m anagem ent system.
• ISO 22301, the international standard for business continuity.
Successful training can be achieved only with full staff engage­
ment. If the training is perceived as dull, tedious, and boring,
the results are likely to be disappointing. No matter how tech­
nically expert the training is, eliciting an enthusiastic human
response requires addressing an extra dim ension: psychology.
4 Johnson (2017).
Chapter 23 The Cyber-Resilient Organization ■ 347
One way of adding a psychological dimension to cyber resil­
ience training is to reward staff positively for good cyber
hygiene. Rewards might be handed out across the whole sp ec­
trum of cyber security issues of concern: reporting phishing
emails; preventing tailgating; reporting attem pted intrusions
via social engineering; reporting any USB memory sticks lost
or found; keeping desktop software patched and updated;
maintaining strong, confidential passwords; attending secu­
rity sem inars and w ebinars; not leaving laptops unattended;
and reporting bugs or vulnerabilities. Such incentivized train­
ing achieves m easurable and im pressive results. In one major
corporation, after 18 months participants were 50% less likely
to click on a phishing link and 82% more likely to report a
phishing em ail.5
Gaming and Exercises
One familiar field of human endeavor in which incentivized train­
ing is proven to work well is in playing com petitive gam es. The
application of gaming principles to business is given the self-
explanatory if contrived name 'gam ification'. It actually started
in m arketing, as com panies realized they could attract custom ­
ers more readily by enticing them with a game or com petition.
Some businesses have been using gamification in the workplace
as a way to boost em ployee m orale.6 The application to adver­
sarial situations like combating cyber risk may be more com pel­
ling and relevant than most. Am ongst other cyber security firms,
Kaspersky Lab has been adopting gamification technology in
its security awareness training programs. In 2017, Kaspersky
awarded a young talent lab prize to the US-based creators of a
gamification app designed to raise information security aw are­
ness am ongst millennials.
Th ere are four principles to gam ificatio n: defining a goal,
defining rules for reaching th at goal, setting up a feed b ack
m echanism , and m aking participation voluntary. G am ification
usually m eans aw arding points to em p lo yees who do the right
thing, with various form s of recognition, including badges,
prizes, and a leader board listing point to tals. Treating cyber
security as a co m p etitive gam e, with scores posted as in a
go lf tournam ent, is not inap p ro p riate. Unlike natural hazards
resilien ce, security against cyber attacks is a p ersisten t ad ver­
sarial gam e - the attackers are rew arded for their efforts and
industry, and so also should the d efen d ers be rew arded. The
more points th at staff m em bers m anage to accrue, the harder
5 W ood (2014).
6 Penenberg (2013).
348 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
it becom es for the ad versary to score points by causing
m ajor cyber loss and disrup tion. A d versarial e xe rcise s, such
as 'C ap tu re the Flag ' are good training fo r security staff and
tech n o lo g ists.
Nudging Behavior
Another way of using psychology to change staff behavior
is through adopting the nudge principle: encouraging good
cyber hygiene without having to reward staff accordingly. One
of the most famous original exam ples of nudging, quoted by
econom ics Nobel laureate William Thaler, one of the authors
of the nudge principle, is that of hygiene in men's restrooms.
Men can be nudged to make less floor mess simply by having a
marked target in the center of a urinal. No reward (or penalty)
of any kind is needed to encourage better hygiene. In line with
the previous golf tournam ent metaphor, one actual exam ple of
a marked target is a golf flag pin. A t the Cyber Security Summit
and Expo 2017, the chief operating officer at the UK Finan­
cial Conduct Authority suggested that staff members may be
nudged to talk more about cyber security, and explained that
far better cultural outcomes are then seen than with traditional
annual mandatory training regimes. She further suggested that
the same technique could be used with suppliers, who may be
an unsuspecting weak link in overall security. In addition to usual
due diligence, a regular conversation with suppliers on security
sets a positive nudging tone for a mutually beneficial enhanced
cyber security relationship.
23.3 R E S IL IE N C E E N G IN E E R IN G
Safety Management
In traditional safety management, the focus is on identifying
and defending against a prescribed set of hazards, using tech­
niques with limited ability to realistically represent the intricacies
of human and organizational influences adequately.7 Also, the
search for causal factors of failures is obscured by the social,
cultural, and technical characteristics of com plex engineered
systems. The concepts of resilience engineering address these
shortcomings, integrating safety, process, and financial m anage­
ment. Resilience engineering builds on safety engineering, but
treats faults and failures in socio-technical systems rather than
in purely technical systems. The focus of resilience engineering
is on the organization and on the socio-technical system in the
____________
7 W reathall (2006).
 THE C H A LLEN G E O F C Y B ER R E S ILIE N C E : TRUM P H O TELS
Hotels are at high risk of data breach attacks, particularly
major chains. Seven of the luxury hotels owned by presiden­
tial candidate Donald Trump were infected between May
2014 and June 2015 with malware that stole paym ent infor­
mation. This data breach ended up exposing 70,000 credit
card numbers and custom er records, and was discovered
only when multiple banks spotted hundreds of fraudulent
transactions on custom er accounts where the last legitimate
transaction was at Trump Hotels.
Cardholders were unaware of the breach until a notice was
posted on the Trump Hotels w ebsite four months after
the hotel chain had learned of the major data exfiltration.
This delay violated New York state laws stipulating timely
presence of accidents, errors, and disasters. In particular, resil­
ience engineering is well suited to systems that are tightly cou­
pled but intractable in the sense that they cannot be com pletely
described or specified.
In general term s, resilience is the ability of an organization to
recover to a stable state, allowing it to continue operations dur­
ing and after a major mishap or in the presence of continuous
significant stresses. Both of these contingencies are relevant for
cyber resilience. The m anagem ent challenge of building and
leading a resilient organization increases in com plexity as more
products and services are online and open to cyber disruption
by m alevolent hackers.
Hotel Keycard Failure Example
A sim ple exam ple is a hotel where room keycards fail after a
cyber attack. Black hats have dem onstrated how some digital
hotel keys can be read with a sim ple portable device. Even in
this dire situation, there has to be a backup plan to allow guests
to access their rooms securely. Availability is a vital pillar of resil­
ient cyber security; even after keycard failure, continuity of hotel
service must be m aintained, and guest rooms have to be avail­
able for use. Along with availability, confidentiality and integrity
of information are two other vital pillars of cyber security. These
also are major issues for the hotel industry because of data
breach of the hotel booking and payments system , and the
theft of credit card data. Hotels have becom e popular targets
because they have a business hospitality culture of openness. A
cyber attack hit 1200 franchised InterContinental hotels in the
last quarter of 2016. Hackers have declared open season on
the reservation and point-of-sale system s of the hospitality and
tourism industry.
consum er notifications regarding compromised data. Tim eli­
ness of security response is also a requirem ent of resilience.
Trump Hotels duly enhanced security m easures, including
em ployee training, com prehensive risk assessm ents, and reg­
ularly scheduled testing of system s - but not before another
data breach was discovered in March 2016.
Later that year, hackers broke into the Sabre SynXis Central
Reservations System , which facilitates online hotel booking
for som e of the largest hotel chains. The intrusion remained
undetected on the Sabre network for seven months, steal­
ing data between A ugust 2016 and March 2017. This was
the third credit card data breach affecting Trump Hotels in
three years.8
President Trump gave a public com mitment to keeping Am erica
safe in the cyber era.9 This com mitment extended to resilience:
building defensible governm ent networks and improving the
ability to provide uninterrupted and secure communications
and services under all conditions. Although a strident critic of
big governm ent, as a victim of data breaches in his hotel chain,
Trump may recognize that stronger cyber security regulations
may be needed and may need to be better enforced.
2 3 .4 A T T R IB U T ES O F A
C Y B E R -R E S IL IE N T O R G A N IZ A T IO N
Anticipate, Withstand, Recover,
and Evolve
In general, the com plexity of a system makes it difficult to clas­
sify failure states following a cyber attack, which can impact
an organization in innumerable ways. Yet, com plexity is a vital
system attribute enabling adaptation under external stress. The
individual links between people and their environm ent should
adapt under stress in a resilient manner. Because resilience is
an emerging property of com plex system s, it can be developed
through focus on attaining specific goals.
A cyber-resilient organization should aim to anticipate, w ith­
stand, recover, and evolve. Given their intrinsic interconnected­
ness, all four of these goals should be addressed sim ultaneously.
For exam ple, even while withstanding or recovering from
8 Seals (2017).
9 Trump (2017).
Chapter 23 The Cyber-Resilient Organization ■ 349
a cyber attack, a business m anager must anticipate further
attacks. Even while anticipating, withstanding, or recovering
from attacks, business processes that rely on them are con­
stantly evolving to address changing operational and technical
environments. And part of anticipation is withstanding stresses
within some bounded range.
Cyber resilience is just one aspect of resilience in general. An
organization that aspires to be cyber resilient should aim further
to be resilient against all potential stresses. A highly resilient
- 1n
organization will share the six attributes listed in Section 8.4.3.
In this list of attributes, which are not cyber-specific, there is a
well-m erited emphasis on human perform ance within the orga­
nization. This is appropriate since not only are security decision
making and preparedness the responsibility of the organiza­
tion's em ployees, but the staff m em bers them selves are also a
primary source of vulnerability to cyber attack, being susceptible
to social engineering deception, as well as the source of human
error in undertaking corporate security tasks.
Negative Attributes
Case studies of organizations that have suffered major data
breaches often highlight missing attributes for a resilient organiza­
tion. For example, security commentators referred negatively to
the security culture at Equifax, which discovered a massive data
breach on July 29, 2017, and announced it six weeks later on
Septem ber 7. In his testimony to a US House of Representatives
subcommittee on consumer protection, the Equifax C E O , Rick
Smith, justified the delay in communicating the data breach on the
grounds of avoiding further attacks and ensuring consumer protec­
tion measures could be put in place. A resilient organization would
have had detailed contingency plans in place for a data breach,
which would have expedited its crisis communication response.
The Equifax C E O also excused the communication delay with
reference to Hurricane Irma, which took down two large call cen­
ters in Septem ber, soon after the breach announcement. This is
a classic failure of resilience. Corporate preparedness for natural
hazards should include plans to overcome breakdowns in infra­
structure. Professional resilience engineers would not have been
astonished that some of the 15 million Britons affected by the
Equifax data breach were only notified eight months afterwards.
Six Positive Attributes for Resilience
For a consumer credit reporting agency, corporate resilience
should have been a business priority. The many millions of1
0 •
10 W reathall (2006).
350 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
consumers and businesses whose information was collected by
Equifax would have expected the agency to have been a para­
digm of resilience. But based on information publicly disclosed
after the breach, Equifax may have possessed all too few of the
following six attributes of a resilient organization. Indeed, in
respect of human performance, the C E O personally blamed a sin­
gle member of the company's security team, rather than recognize
that all errors are the outcome of organizational deficiencies, such
as a lack of resilience, for which the C E O is ultimately responsible.
1. Top-level com m itm ent to recognizing and valuing human
perform ance concerns, in both word and deed. An orga­
nization should provide continuous and extensive follow-
through to actions related to human perform ance.
2 . A ju s t culture supporting the reporting of issues up through
the organization. W ithout a just culture, the willingness of
staff to report problems will be eroded, as will the organiza­
tion's ability to learn about defensive weaknesses.
3 . A learning culture benefiting from both good and bad
experiences, and not responding to questions about secu­
rity issues with denial.
4 . A w areness of the true state of defenses, and their state of
degradation. Also, insight into the quality of human perfor­
mance, and the extent to which it is a problem.
5 . P reparedness for problem s, especially in human perfor­
mance. The organization should actively anticipate prob­
lems and prepare for them .
6 . Flexibility to adapt that maximizes ability to solve problems
without loss of functionality. It requires that im portant secu­
rity decisions may be made at lower organizational levels.
These six attributes are qualitative organizational attributes, which
have a significant bearing on quantitative resilience metrics: the
time and cost to restore operations, the time and cost to restore
system configurations, the time and cost to restore functionality
and performance, the degree to which the pre-disruption state is
restored, the potential disruption circumvented, and successful
adaptations within time and cost constraints.
Cyber Resilience Objectives
Because the cyber threat is so dynamic, many actions to improve
resilience may be effective for only a short duration. However,
common to all actions are various general cyber resilience objec­
tives, which are summarized next.
Adaptive Response
An adaptive response involves executing and monitoring the
effectiveness of actions that best change the attack surface,
maintain critical capabilities, and restore functional capabilities.
• Analytic Monitoring
Analytic monitoring involves gathering and analyzing data on
an ongoing basis and in a coordinated way to identify poten­
tial vulnerabilities, adversary activities, and dam age.
• Coordinated Defense
In any conflict situation, having multiple defenses is advanta­
geous, but they have to be carefully coordinated so that they
do not interfere negatively with each other, but rather have a
maximum positive effect.
• Deception
Sun Tzu's dictum that 'All war is based on deception' applies
to cyber warfare as well as older traditional forms of conflict.
Deception is an essential weapon of cyber defense, espe­
cially against a powerful adversary, such as a state-sponsored
threat actor.
• Privilege Restriction
Violation of privilege restriction has facilitated some major
cyber attacks. To minimize the impact of criminal action, privi­
leges should be carefully restricted.
• Random Changes
Static security, however strong, is progressively liable to be
eroded over tim e. Frequent randomized security actions that
make it more perplexing for an adversary to predict behavior
increase the chance of adversary detection.
• Redundancy
The value of redundancy in enhancing system safety is evi­
dent from elem entary reliability analysis. If the chance of fail­
ure of a key com ponent is one in a thousand, then the chance
of failure of two such com ponents, assumed to have indepen­
dent failure rates, is as low as one in a million.
• Segm entation
The attack surface of a system can be reduced if system com ­
ponents can be segm ented based on criticality to restrict the
dam age from exploits. Segm entation often employs either
physically distinct entities or virtualization of computing sub­
networks to provide the desired separation.
• Substantiated Integrity
It is crucial that critical systems and backups have not been cor­
rupted by an adversary. Their integrity needs to be substanti­
ated and data checked that they are not invalid or out of range.
23.5 IN CIDEN T RESPO N SE PLANNING
Forensic Investigation
The vast majority of internet crimes are left unreported. A tiny
proportion of cyber crimes are successfully prosecuted. Most
perpetrators are outside W estern jurisdiction, and even if they
are within the same jurisdiction as the victim , successful prosecu­
tion is difficult to achieve.
However, where a significant corporate cyber crim e has been
com m itted, som e level of criminal investigation is required for
legal reasons, as well as to com ply with obligations to share­
holders and other corporate stakeholders, and to enhance
resilience. This involves com puter forensics. A s with any
forensic investigation, diligence is needed when attending the
scene of a crim e, to ensure that significant evidence gathered
is adm issible. In particular, the following four principles must
be u p h eld :11
1. No action taken by law enforcem ent agencies, persons
em ployed within those agencies, or their agents should
change data, which may be subsequently relied upon in
court.
2 . W here a person finds it necessary to access original data,
that person must be com petent to do so, and be able to
give evidence explaining the relevance and the implications
of his or her actions.
3 . An audit trail or other record of all processes applied to
digital evidence should be created and preserved. An inde­
pendent third party should be able to exam ine those pro­
cesses and achieve the same result.
4. The person in charge of the investigation has overall
responsibility for ensuring adherence to the law and these
principles.
Forensic investigators not only must comply with these prin­
ciples; they also have to cope with insidious attem pts to thwart
com puter forensic analysis. This may include encryption, the
overwriting of data, and the modification of file m etadata. And
even where no such anti-forensic efforts have been m ade, a
shrewd defense lawyer can query in court the quality of evi­
dence of an intrusion - maybe the log file had been tam pered
with, or the origination of the internet protocol (IP) address was
fa ke d .1
12 Thinking through defense arguments is a valuable intel­
1
lectual exercise in cyber resilience, because it raises technical
issues that could lead to ideas for improving the cyber security
environment. One argum ent might be over identifying when
exactly a cyber security incident occurred. For exam ple reconcil­
ing the tim estam p for a connection to a Webserver might involve
clients in London, a server in Tokyo and various time zones and
daylight-saving adjustm ents.
11 A C P O (2012).
12 G rim es (2016).
Chapter 23 The Cyber-Resilient Organization ■ 351
Initial Breach Diagnosis
An initial step in incident response is to assess when security
was first breached. This is far from being a straightforward mat­
ter, as shown by the 2014 and subsequent 2013 Yahoo breach
revelations. The next step is to discover what system s have been
com prom ised, and what data has been exfiltrated or corrupted.
An essential aspect of any first response to an unfolding crisis is
conducting triage, which consists of classifying incidents, priori­
tizing them , and assigning incidents to appropriate personnel.13
Containm ent of dam age and prevention of its spreading are
then urgent actions before eradication of the threat and removal
of malware from the network. The mark of resilience in incident
response is restoration of system s to their normal operation. The
main challenges in recovery are in reconnecting networks and
confirming that system s have been successfully restored.
Thinking ahead is characteristic of a resilient m indset. Even
before, and preferably well before a major incident occurs,
plans should be drawn up for investigating incidents, as and
when they might occur, and undertaking extensive postincident
investigations. Com m unicating lessons learned to all stakehold­
ers in a transparent and tim ely manner is a crucial elem ent of a
resilient response. Am ongst the lessons will be insights into the
effectiveness of security m easures, and the costs and impacts
of cyber incidents. From such lessons the cost-effectiveness of
enhanced security measures can be better gauged.
2 3 .6 R E S IL IE N T S E C U R IT Y S O L U T IO N S
Resilient Software
Resilient software should have the capacity to withstand a fail­
ure in a critical com ponent, such as from a cyber attack, but
still recover in an acceptable predefined manner and duration.
Factors affecting resilience include com plexity, globalization,
interdependency, rapid change, level of system integration,
and behavioral influences. The com plex networked systems
prevalent in many organizations make it hard to provide a
service platform with consistent levels of resilience. W hen a
critical system fails, the required service may not be readily
deliverable, especially when there is high dem and. Furtherm ore,
net-centricity can introduce com plexities that lead to greater
chances of erro rs.14 Learning from failure is essential for a
resilient organization. When software fails, this is an opportunity
for additional resilience features to be introduced.
13 C R E S T (2013).
14 Murray et al. (2017).
352 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Security should be fully integrated within the developm ent pro­
cess, with built-in features such as defense in depth, running
with least privilege, and avoidance of security by obscurity. A
software developm ent life cycle (SDLC) is a series of phases that
provide a fram ework for developing software and managing it
through its entire life cycle. There is no specific technique or sin­
gle way to develop applications and software com ponents, but
there are established m ethodologies that organizations use and
models they follow to address different challenges and goals.
However well written and resilient the software is, and however
much the network perim eter defense has been hardened, a
determ ined, highly motivated (perhaps state-sponsored) cyber
attacker can eventually manage to find an entry point into any
system through some social engineering deception or zero day
exploit. Treating a twenty-first-century software system as a
medieval fortress with im pregnable entry points is itself a coun­
terproductive form of self-deception, and self-denial of reality
of the virtual world. This is detrim ental to cyber security in gen­
eral, and to maintaining resilience in particular. It is prudent to
accept that system intrusion will occur in the future, and to plan
a maximally resilient response. The three pillars of successful
response identified by Dr Eric Cole are detection, containm ent,
and control.15
Detection, Containment, and Control
In biology, a system's capacity to absorb and resist any dam­
age from internal or external mechanisms, and recover quickly,
is a measure of its resilience. The universal process of evolution
em bodies natural selection for resilience. A key criterion for fit­
ness is resilience. In healthcare, a doctor would advise a patient
that prevention is always better than cure. Hence those who
spend hours in the sun are urged to use sunscreen. Regular use of
sunscreen can halve the incidence of melanoma, which is a type
of skin cancer. If excessive sun exposure does eventually cause
melanoma, the sooner this is detected the better, so that effective
treatm ent can be given. Most importantly, any malignant tumor
should be found before it spreads to other parts of the body.
Rapid threat detection lies at the heart of resilient cyber secu­
rity. Imagine a cyber attack that targets a perceived security
weakness in a peripheral device such as a printer. If system
security extends to intrusion detection that monitors the device
memory for malicious attacks, then threat detection can auto­
matically instigate a reboot from a safe copy of the device's
operating system . By restoring the peripheral device without
business interruption, cyber resilience is achieved.
15 Cole (2015).
 C A SE STU D IES IN GERM AN S T E E L R ES ILIEN C E
In February 2016, Southeast Asian hackers exfiltrated tech­
nological intellectual property data from Thyssenkrup, one
of the world's largest steelm akers, Early detection and tim ely
counterm easures limited the loss from this professional
cyber espionage attack, which was discovered, continuously
observed, and analyzed by Thyssenkrup's com puter em er­
gency response team . This adm irably resilient response to
a cyber attack contrasts with what happened when a steel
mill in an undisclosed location in Germ any was targeted for
a cyber attack in 2014. (Thyssenkrup denied it was one of
its steel mills.) The motive for this apparently senseless act
of cyber vandalism remains unknown, but it does provide an
instructive contrasting case study in cyber nonresilience.
The attackers used spear phishing emails to access the steel
mill office IT network, com prom ise a multitude of systems,
and spread over to the production network. Failures accum u­
lated in individual control com ponents, and a blast furnace
was unable to be shut down in a regulated manner, which
resulted in extensive dam age. This cyber attack came as a
Minimize Intrusion Dwell Time
A resilient strategy for coping with a cyber attack should mini­
mize the intrusion dwell tim e, which is the tim e from initial sys­
tem com prom ise to the tim e the malware ceases to be effective.
Controlling dwell tim e means early detection with an appropri­
ate effective response. Ju st as with malignant cancer, the lateral
spread of intrusion should also be contained and controlled, so
as to minimize the number and extent of com prom ised systems.
Dwell tim es can be measured in months rather than days or
weeks because attackers are often ingeniously adaptive to new
security system s, and may change their threat signatures from
those detected by threat intelligence service providers. Spotting
anomalous behavior is a crucial aspect of resilient cyber security.
A network behavior anomaly detection (NBAD) program tracks
critical network characteristics in real time and generates an
alarm if an anomaly or unusual trend is detected that might sig­
nal a threat. Exam ples of such characteristics include increased
traffic volum e, bandwidth, and protocol use. Such a program
can also monitor the behavior of individual network subscribers.
For N BAD to be optimally effective, a baseline of normal
network or user behavior must be established over a period
of tim e. A large volume of network data can enable even a
com paratively m odest anomaly to be tracked and flagged up.
Inevitably, as in any anomaly detection system , there may be
false positives, such as when an em ployee decides to back
up the contents of a hard drive on a Saturday evening before
going away on vacation the following morning. The flip side of
shock not just to the steel mill security staff, but to the entire
cyber security industry in Germ any and beyond. Surprise is
the enem y of resilience.
It would not have been feasible for an outside vandal to have
physically gained access to the steel mill and sabotaged a
blast furnace. Basic site security would have detected the
unauthorized intrusion and prevented this kind of criminal
dam age. The cyber attack was not detected because it was
an advanced persistent threat (APT), executed carefully in
stages in a slow and stealthy way, keeping a low profile to
make detection difficult.16 A part from remaining undetected,
the attack was neither contained nor controlled.
A more resilient cyber defense strategy would have had a
network intrusion detection system (NIDS) deployed. This
strategy should also have maintained a strict separation
between business and production networks to contain the
attack, preventing it from spreading from the entry point to
the key industrial target.
anomaly detection, when dealing with an intelligent adversary
striving to keep illicit activities hidden within the noise, is the
possibility of false negatives. The international prize for smart
detection avoidance might be awarded to the Soviets who vio­
lated nuclear test ban treaties by autom atically timing the deto ­
nation of nuclear test explosions to coincide with the occurrence
of regional earthquakes. The seismic signal of a nuclear explo­
sion (the observational basis for nuclear test forensics) would
be hidden within the tail of the earthquake signal. This kind of
subtle trickery to evade detection ended with the Cold War, but
the ingenious cunning of the Russian chess mind in the age of
state-sponsored cyber attacks should not be underestim ated.
Anomaly Detection Algorithms
Anom aly detection algorithms use state-of-the-art artificial
intelligence methods, incorporating sophisticated Bayesian
techniques of statistical inference. These probabilistic tools
for searching for discrepancies have been refined using ideas
developed for Big Data analysis. Faster, cheaper, sim pler - but
less powerful - are signature-based detection methods. Rather
like a police biom etric database of fingerprints or D N A sam ples,
these methods rely on a database of signatures carried by
packets known to be sources of malicious activities. Signature-
based methods check for automated procedures supplied by
well-known hacker tools. These tend to have the same traffic
16 Bartman and Kraft (2016).
Chapter 23 The Cyber-Resilient Organization ■ 353
signatures every tim e, because com puter programs repeat over
and over again the same instructions.
Both anomaly and signature-based detection approaches should
be incorporated within an overall NIDS. As anyone who lives
in a gated community knows, reliance on the detection of an
intruder is far from being a resilient strategy for mitigating the
risk of burglary. The probability of detection can never be very
close to certainty, because the price of false alarms would be
unacceptable. Each house needs its own security system to
contain and control the criminal action of an intruder. Defense in
depth is a cornerstone of resilient security. Recognition of lateral
movements of a cyber attacker requires continuous monitoring
of the internal network, and a visual interface that provides the
right metrics for security analysts to gain situation awareness of
any intrusion. With these metrics, an intrusion can begin to be
contained and controlled.
Containm ent of the adverse im pacts of security breaches will
help avoid an escalation of loss and blunt the force of a cyber
attack, so as to make incident response more effective. C o n­
tainm ent might be achieved through network segm entation,
and redundancy m easures such as having logical and physi­
cal duplication. A nother containm ent approach that increases
resilience is designing system s so that they continue to function
and perform their tasks even when connectivity to external sys­
tem s is lost. With any security initiative, there is also an intrinsic
human com ponent that needs to be considered. Dealing with
an intrusion effectively requires a degree of security staff pre­
paredness that merits training and rehearsal of an em ergency
response plan.
Penetration Testing
In cyberspace, it is essential to understand the interrelationship
between vulnerability assessm ent and risk analysis.17 Much more
effort is directed towards the form er than the latter. But m ea­
suring work on vulnerability assessm ent is not measuring risk
reduction. For exam ple, a vulnerability scanner might determ ine
that a server is missing critical operating system patches by
detecting an outdated version of the operating system during a
network probe. This vulnerability might be rem edied simply by
a software update and a reboot. Assessing the corresponding
cyber risk reduction is not so straightforward. This would involve
explicitly devising an exploit to show that the missing patch
would allow an attacker to gain access to the server. This might
be a difficult task, not necessarily cost-effective for a work-
averse hacker.
17 G eorge (2016).
354 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
A penetration test (pen test to its friends) is the process of
conducting simulated attacks to discover how successful cyber
attacks might occur. Conducting a pen test to prove that a miss­
ing patch is a security issue typically raises the cost of testing,
and runs the expensive risk of potential system downtim e. Not
all pen testing is expensive; the sim plest type of pen testing
involves a handful of social engineering tricks, or taking advan­
tage of an easily guessable password. Some loT gadgets such
as a kitchen kettle leave the factory with a basic default pass­
word, which may not be changed by the forgetful or ignorant
purchaser. Like all professional occupations, pen testers come
with a wide range of knowledge, ability, and experience. The
best pen testers have deep knowledge of operating systems,
networking, scripting languages, and the like, and use a clever
combination of manual and autom ated tools to simulate attacks
with the same com plexity as might be conceived by a black hat.
Pen test results are typically reported on severity, exploit-
ability, and associated remediation actions. The information
obtained from pen testing can be used to plug security gaps,
improve attack response, and enhance cyber resilience. C o n­
trolling network entry and exit points and reducing the overall
attack surface will make it easier to respond to an attack, and
enable functionality to be restored more quickly. This therefore
increases an organization's resilience against cyber attacks.
The Risk-Return Trade-Off
W hereas junior security personnel may work obsessively to
reduce vulnerability where they find it, cost-conscious senior
m anagem ent and their accountants are particularly interested
in the risk-return trade-off. The actual level of risk reduction
achieved may in fact be lower than is optim istically perceived,
given the large security budget. For exam ple, within days of a
pen test, network changes may create new security challenges.
Pen testing is commonly used to address the problem of cyber
risk mitigation, instead of more empirical and scientific practices.
Although pen testers know what to charge for their professional
services, most pen testers cannot put a price on their success or
failure. Pen testers can make recom m endations on how to close
security gaps, and how to prioritize the necessary tasks. But no
two pen testers go about their assignm ent in the same way, and
pen testing is usually done on a limited set of targets. A cco rd­
ingly, pen testing is not strictly a risk m anagem ent exercise.
To provide another perspective on security risk m anagem ent,
consider the pen testing analog of red-teaming in counterterror­
ism studies. Ever since 9/11, security consultancies with exten­
sive military expertise have undertaken vulnerability assessments
for specific locations and events that might be targeted for a
terrorist attack. Red-teaming exercises are particularly valuable
in identifying gaps in security that would make a location or
event a com paratively soft target relative to other alternative
targets. By hardening any one potential target, e.g . deploying
additional perim eter security guards and installing CCTV, the
risk may be transferred to another soft target, in a process that
1Q
terrorism risk analysts recognize as target substitution. This
tactic should extend to cyber risk as well. Hackers (like terrorists)
follow the path of least resistance in their targeting, and if an
attractive designated target for a cyber attack has been hard­
ened, others lacking the benefit of pen testing or red-teaming
knowledge may becom e more likely to be attacked.
2 3 .7 F IN A N C IA L R E S IL IE N C E
Financial Consequences of a Cyber Attack
A major cyber attack on a corporation can impact it in numer­
ous adverse ways. Intellectual property and other confidential
information may be stolen; im portant com puter system files may
be corrupted or encrypted; denial of service may bring systems
down; physical dam age to corporate facilities and property may
be inflicted; psychological and bodily harm may be caused to
staff and custom ers; reputational dam age may be incurred, and
liability lawsuits may be filed. W hatever the impact, business
will be disrupted to an extent that depends on the resilience of
the organization. We describe many of these consequences and
illustrate some of these costs in the first two chapters: C hap­
ter 1, 'Counting the Costs of Cyber A ttacks', and Chapter 2,
'Preparing for C yber A ttacks'.
The bottom line for any commercial organization is the ultimate
financial cost. Each of the adverse impacts results in a financial
loss to the corporation. For publicly listed corporations, the stock
price is a resilience measure. For those publicly listed corporations
for which cyber security is paramount for customer confidence,
the impact of a severe cyber attack on stock price can be devas­
tating. As fallout from a massive identity theft data breach, the
stock price of Equifax fell precipitously by about one-third in one
week, before a new C E O was appointed in late Septem ber 2017
and started to turn the consumer credit reporting agency around.
But with further revelations that the data breach was worse than
previously thought, the stock price in mid-February 2018 was still
lower by 20% than it had been before the breach disclosure.
Financial Risk Assessment
Com panies have to make assessm ents of their risk and build
resilience into their balance sheet to withstand the types of1
8
18 Woo (2011).
shock that might be foreseeable. In the United States public
com panies are expected to file annual 10-K submissions to the
Securities and Exchange Commission that identify the key risks
to their business and to notify their shareholders and counter­
parties of those risks. The UK equivalent is the Long Term Viabil­
ity Statem ent (LTVS) reporting to the Financial Reporting Council
on liquidity. C yber risk is one of the most commonly reported
risks by com panies, declared in their 10-K and LTVS filings.
A cyber attack can cause sufficient loss to cause dam age to a
company's balance sheet, even for fairly sizeable organizations.
Exam ples include com panies having to issue profit warnings,
suffer credit dow ngrades, make em ergency loan provisions, and
see reduction in stock price, and ultimately the loss could be
severe enough to force the organization to cease trading. The
likelihood of cyber attacks causing a loss sufficient to trigger
each of these thresholds depends on the type of risk analysis we
have described, defining the odds of experiencing a cyber loss
of these levels of severity, com bined with the financial structure
of the organization, its liquidity, its access to capital reserves,
and analysts' interpretation of the event in term s of how it
might affect the future business model and position relative to
its com petitors.
Balance sheet resilience for the levels of financial shock that
might be inflicted by a cyber event can be achieved by having
all of the standard financial engineering processes to minimize
earnings volatility, including having sufficient liquidity margins,
reducing debt ratios, having access to em ergency loan provi­
sions, being able to cut costs to meet earnings targets, and
having cyber insurance to provide a level of financial indemnity
against the loss.
Reverse Stress Testing
For any specified cyber attack scenario designed as a financial
stress test, the implications for a corporation can be evaluated,
taking account of the myriad ways that it might affect business.
For a particularly severe scenario, a corporation's credit rat­
ing might be dow ngraded. The implications of cyber attacks
could start taking a higher priority in credit analysis. Moody's
Investors Service views material cyber threats in a similar vein
as other extraordinary event risks, such as those arising from
natural disasters, with any subsequent credit impact depending
on the duration and severity of the eve n t.19 W hile Moody's does
not explicitly incorporate cyber risk as a principal credit factor,
its fundamental credit analysis incorporates numerous stress­
testing scenarios, and a cyber event could be the trigger for one 1
1 Q
Moody's Investors Service (2015).
Chapter 23 The Cyber-Resilient Organization ■ 355
of those stress scenarios. In a 2015 report, Moody's identified Having extra personnel available for patching provides defense
several key factors to exam ine when determ ining a credit impact in depth. Operational redundancy of course costs money - this is
associated with a cyber event, including the nature and scope of the price of resilience. Deciding on how much defense in depth
the targeted assets or businesses, the duration of potential ser­ a corporation should have depends partly on regulation, and
vice disruptions, and the expected time to restore operations. partly on corporate risk appetite. The irony of the Equifax data
breach is that the C E O might well have stipulated a tight limit
Both the disruption duration and the operational restoration
to the cyber risk to which Equifax should have been exposed.
time are basic defining characteristics of resilience. A cyber-
Given the extrem e sensitivity of the identity data retained by
resilient organization should know just how bad a cyber attack
Equifax, customers would have been dismayed by any other
would need to be to threaten its viability, or to have its credit
cyber security policy. However, there was a disconnect between
rating dow ngraded. This is called reverse stress testing. Through
C E O instruction and actual operation. The implementation of
system atic reverse stress testing, measures can be developed to
this policy lacked the resilience required to ensure its practical
protect a corporation against such unacceptable outcom es.
effectiveness in a perpetually hostile cyber threat environment.
For insurance companies in the context of Solvency II, the con­
cept of reverse stress testing for an insurer's own risk and sol­
vency assessm ent (ORSA) is endorsed by the European Insurance Enterprise Risk Management
on
and Occupational Pensions Authority. A number of practical
Enterprise risk m anagem ent (ERM ) envisages an organizational
cyber reverse stress tests have been developed.2
212They have
0
process applied in developing strategy across the enterprise. It
been used as m anagem ent desktop exercises to identify opera­
is designed to identify events that might affect the organization,
tional weaknesses and areas that need attention.
and to help manage risk to within its risk appetite. The degree
of cyber resilience sought by an organization should be com ­
Defense in Depth mensurate with its risk appetite. Traditional ERM measures of
cyber risk typically do not quantify severity of financial loss in
The principles of engineering resilience go a long way in cyber
the event of a cyber incident. As the im portance of cyber risk
resilience. D efense in depth is a crucial objective in build­
increases am ongst organizations w orldw ide, ERM studies will
ing in system resilience. Even if one system fails, overlapping
help to specify optimal levels of cyber resilience investm ent.
system design will mean there is no single point of failure.
Too often, when a large corporation suffers a massive cyber
This contrasts m arkedly with a standard check-box approach
attack loss, the C E O is unable to explain whether the negative
to security, which sanctions system s with a minimum level of
outcom e was consistent with its risk appetite or resilience objec­
redundancy as having sufficient security. If this standard check­
tives. It is easier to attribute blame to staff error.
box approach were routine in the passenger airline industry,
there would be just a single pilot in the cockpit, rather than
two or three. Cyber Value at Risk
The Equifax C E O singled out one of the company's 250 security
C yber value at risk (VaR) is based on the general notion of VaR,
personnel as responsible for allowing the data breach: 'We now
widely used in the financial services industry. In finance, VaR is a
know that the vulnerable version of Apache Struts within Equifax
risk measure for a given portfolio and time horizon, defined as a
was not identified or patched. The human error was that the
threshold loss value. Specifically, given a low designated prob­
individual who's responsible for communicating in the organiza-
ability value X, e.g. 0.05, VaR expresses the threshold loss value
tion to apply the patch, did not'. Cyber security should not
such that the probability of the loss exceeding the VaR value is
be reliant on the error-free human action of any individual, just
the low number X. As with other types of risks, the concern is
as airline safety should not be reliant on the perfect, im pec­
not only with expected losses from cyber threats, but should
cable job perform ance of any one pilot. No com puter user can
incorporate an understanding of potentially more significant
presume that com puter software is bug-free, and no C E O can
losses that could occur with a small but finite probability. Cyber
presume that the successful m anagem ent of such bugs can be
VaR can be perceived as the value exposed given both common
achieved without some occasional human error.
and significant attack risks. Technically, financial value at risk
is defined as the maximum loss for a given confidence interval
20 EIO PA (2017). (say, with 95% certainty) on a given tim e horizon, e.g. one year.

21 See References for list of publications by C C R S . Traditionally, the confidence levels have been estim ated under
22 Harm er (2017). the simplifying hypothesis that the underlying loss variability

356 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
can be represented by a bell-shaped normal distribution. This is
very convenient for mathematical analysis, because the sum of
any number of normal distributions is still normal. However, the
normal approxim ation is invalid for open-ended risks like cyber
risks, which recognize no bounds of geography and can increase
in severity scale by orders of m agnitude. A problem faced by
cyber risk analysts is the brief observational period of historical
data, which may not represent accurately the tail of the loss dis­
tribution, which could have a much fatter shape than any bell.
Re-Simulations of Historical Events
The historical record of cyber attacks is just a couple of decades
long. By conducting stochastic simulations of past cyber attacks
within this tim e window, cyber risk analysts can look beyond the
near horizon of history and scan the far horizon, gaining insight
into how large cyber losses might potentially have been. For
exam ple, suppose that a major bug (such as H eartbleed) had
been discovered by a black hat rather than by a white hat; what
might the cyber loss have been? Even though H ea rtb leed was
found first in 2014 by the G oogle security team , the alarming
potential for data exfiltration was dem onstrated by Chinese
hackers who, after the bug was disclosed, stole the personal
data of about 4.5 million patients of hospital group Comm unity
Health System s Inc. The hackers used stolen credentials to log
into the network posing as em ployees. O nce in, they hacked
their way into a database and stole millions of records. If this
bug had not been found by white hats and patched, many
criminal hacking groups might have followed this basic modus
operandi of using the H ea rtb leed bug to steal credentials, which
would then be a gateway of opportunity to exfiltrate very large
volumes of valuable data. With a com plete medical record sell­
ing on the dark web for high prices, the econom ic loss from tens
of millions of medical records alone might have been many bil­
lions of dollars.
The sensitivity of corporate vulnerability to cloud failure might
also be assessed by revisiting the most severe historical cloud
outages involving a cloud service provider, and contemplating
some downward counterfactuals where the situation, which was
bad already, turned for the worse because of poor resilience
of the cloud service provider. In 2015, a notable bug, XSA-148,
was found in the Xen hypervisor software by the cloud platform
security team at the Chinese multinational A lib ab a.23 This bug
would have allowed malicious code to be written into a hypervi­
sor's memory space. This vulnerability was probably the worst
ever seen affecting Xen, which is a free software project. It is
claimed that Xen has few er critical bugs than other hypervisors,
23 Luan (2016).
but this would be little consolation to an organization that suf­
fered loss through a Xen bug.
Counterfactual Analysis
Counterfactual analysis can also quantify the benefit from past
security enhancem ents, such as regular penetration testing, as
well as from the introduction of resilience measures to mitigate
the loss from cyber attacks. For exam ple, measures to stream ­
line the process of restoring backup systems in the event of a
ransomware attack might be assessed retrospectively for the
W annaCry attack of May 2017. Suppose that the kill switch had
not been found early on by Marcus Hutchins, and that Wanna­
Cry had spread w idely within the United States. How much
worse might the corporate cyber loss have been if an improved
backup restoration process had not been im plem ented? Due
consideration of past near misses such as this would encour­
age improved future preparedness for, and resilience against,
another ransomware attack.
This kind of counterfactual analysis would also help decide on
the cost-effectiveness of additional cyber resilience measures.
Suppose that an additional resilience technology had been
introduced several years ago. How much would the cyber losses
over this period have been reduced? A positive answer would
then lead to a quantitative assessm ent of whether the substan­
tial expenditure on this resilience enhancem ent is warranted by
prescribed corporate limits on its cyber risk appetite. Resilient
organizations are less prone to strategic surprise.
Building Back Better
In the depth of the financial crisis in Novem ber 2008, President­
elect Obam a's chief of staff, Rahm Em anuel, looked forward
optim istically: 'You never let a serious crisis go to w aste. And
what I mean by that - it's an opportunity to do things you
could not do b efo re'.24 In earthquake engineering, there is an
extended resilience concept that reconstruction after an earth­
quake should not merely aim to restore a building to its pre­
earthquake state, which was evidently seism ically vulnerable,
but to make it more earthquake-resistant in the future. This is
called building back better. The same concept applies to recon­
figuring a com puter system after a major cyber attack. Merely
restoring previous functionality with its exposed security vulner­
abilities is a poor short-term option; far superior is building in
more robust, enhanced security from the outset. For exam ple, if
overall system failure can be traced back to a single item failure,
which could have either a technological or human source, then
24 Selb (2008).
Chapter 23 The Cyber-Resilient Organization ■ 357
introducing some extra redundancy could mitigate this source of
cyber risk in the future.
A fter Target suffered a massive data breach in 2013, the task of
building back better started with Target doing something it had
never done before - appoint a chief information security officer
(CISO ). An experienced C ISO was hired from General Motors to
lead the post-breach response. Upgrading paym ent terminals
was clearly essential, and $100 million was spent to support
chip-and-PIN credit and debit cards, which had been introduced
in Europe some years before. W hether it was the cost of hiring a
top C ISO or upgrading payment term inals, even a simplified VaR
analysis would have dem onstrated these to be cost-effective
security enhancem ents, considering that custom er confidence
decline would have sharply limited its corporate cyber risk
appetite.
Events Drive Change
Cyber criminals learn from each other, and so do their victims.
Organizations can build back better, not just when they them ­
selves have suffered loss, but when others have had this mis­
fortune. The Target breach was a wake-up call not just for the
retailer's own m anagem ent, but for m anagem ent right across
corporate Am erica. A survey conducted of 20,000 IT practitio­
ners in the United States by the Ponemon Institute found that
respondents' security budgets increased by an average of 34%
in the year following the Target breach, with most of those funds
used for security information and event m anagem ent (50%), end
point security (48%), and intrusion detection and prevention
(44% ).25 Some 60% of respondents also said they made changes
to their operations and com pliance processes in response to
recent well-publicized data breaches: 56% created an incident
response team , 50% conducted training and awareness activi­
ties, 48% added new policies and procedures, 48% began using
data security effectiveness metrics, 47% added specialized edu­
cation for the IT security staff, and 41% added monitoring and
enforcem ent activities.
From such substantial rem edial security m easures, organiza­
tions show they can be fast learners in cyberspace, and the
cyber security m arket is seen to be highly adaptive, swift, and
responsive to new commercial opportunity. Indeed, the digital
revolution would not have happened so rapidly had it not been
for the spirit of technical enterprise and ingenuity that digital
pioneers have abundantly displayed in overcom ing enormous
challenges. Back in 1996, the Clinton-Gore vision of having
the internet in every Am erican school seem ed blighted by
25 Ponemon Institute (2015).
358 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the proliferation of carcinogenic asbestos in buildings, which
made it prohibitively expensive and risky to run internet cables
through old school walls. W i-Fi was the innovative and resilient
answer to a seem ingly form idable obstacle. In a most tim ely
fashion, W i-Fi was invented and first released for consum ers the
year afterw ards, 1997.
Transcending the physical barriers of old building construc­
tion, this seminal advance in educational opportunity has been
crucial in making internet access a basic right of a US citizen.
W i-Fi has also been a major opportunity for cyber crim inals,
especially public W i-Fi. Data over this type of open connec­
tion is often unencrypted and unsecured, and consequently
vulnerable to man-in-the-middle attacks w hereby sensitive data
can be intercepted. To keep at least one step ahead of cyber
crim inals, a continuous investm ent increase in security educa­
tion will be essential.
Education for Cyber Resilience
The universal availability to US schoolchildren of Wi-Fi is now
crucial for filling the looming cyber security skills gap. Demand
for cyber security professionals is growing faster than the overall
IT job m arket. Many more of the millennial cohort are needed
to train and work as cyber security professionals. The increasing
demand for young cyber security staff should serve a valuable
societal purpose in providing gainful em ploym ent for hackers of
rather m odest IT skill and knowledge, who might struggle to get
a well-paying job in a tight IT labor market.
Such average hackers m ight otherw ise drift into a life of petty
cyber crim e, purchasing from better-skilled cyber crim inals
off-the-shelf exp lo it toolkits that they could use to make
money illegally in cyb erspace. W ith dem and for talented cyber
security professionals outstripping supply now and into the
foreseeab le future, a life of cyber crim e makes little sense for
a highly able cyber security professional, unless he or she has
a penchant for illegal hacking, in which case legitim ate and
fulfilling governm ent em ploym ent at the National Security
A gency (NSA) or G overnm ent Com m unications H eadquarters
(G C H Q ) beckons. C o llectively, N SA and G C H Q may have
the best offensive cyber attack capability, which in itself is an
em ploym ent draw.
Aviation resilience in the skies ultimately depends on the skill,
training, and experience of airline pilots. The safety of airlines
varies quite significantly, even though their fleets of Boeing arid
Airbus aircraft may be quite similar. The cyber security of corpo­
rations also varies quite significantly, even though their M icro­
soft and Apple com puter systems may also be quite similar.
Cyberspace resilience ultimately depends on the skill, training,
and experience of smart cyber security professionals who have
the knowledge, capability, and motivation to defend their orga­
nization effectively against a continuous barrage of targeted and
random cyber attacks, some of which are m asterm inded by elite
state-sponsored hacking team s.
Improving the Cyber Profession
In any professional adversarial contest, the outcom e depends
heavily on the quality of the best players. Nobody appreciates
this as much as the North Koreans, Chinese, and Russians, with
their prestigious and highly com petitive cyber academ ies. To
match such training centers of cyber excellence, the UK National
C yber Security Centre has offered bursaries, specialist training,
and paid work placem ents to a thousand young British students.
This training initiative has had the support of major international
defense contractors, as well as the City of London Police.
More am bitiously, with additional US expenditure on national
security programs, the Pentagon could establish a US National
Cyber Academ y to defend the nation in cyberspace. This acad­
emy would be rather like the existing sea, land, and air acad­
emies at Annapolis, W est Point, and Colorado Springs. The
underlying rationale for this investm ent is the realization that
winning in cyberspace is fundam entally a m atter of cyber secu­
rity skill and expertise.
Beyond the governm ent, recruiting and retaining the best cyber
security staff should be a priority of every cyber-resilient organi­
zation. In 2018, 70% of C ISO s reckoned that lack of com petent
in-house staff was their top security threat. O ther than being tar­
geted by a cyber attack, the resilience of a corporation may be
severely tested if one or more of its leading cyber security team
were to leave. From the C ISO downwards, robust backup plans
need to be prepared for this contingency. M anagem ent consul­
tants highlight the im portance of both C ISO succession planning
and developing others to represent the C ISO . The sooner that
individuals are trained and prepared for this role, the more resil­
ient a corporation will be.
Chapter 23 The Cyber-Resilient Organization ■ 359
 Learning Objectives
A fter com pleting this reading you should be able to:

Define cyber-resilience and compare recent regulatory
initiatives in the area of cyber-resilience.
Describe current practices by banks and supervisors in
the governance of a cyber risk m anagem ent fram ework,
including roles and responsibilities.
Explain and assess current practices for the sharing of
cybersecurity information between different types of
institutions.
Describe practices for the governance of risks of intercon­
nected third-party service providers.

Explain methods for supervising cyber-resilience, testing

and incident response approaches, and cybersecurity and
resilience metrics.

E x c e rp t is rep rin ted from Cyber-Resilience: Range of Practices, by the Basel C om m ittee on Banking Supervision, D ecem b er 2018.

361
24.1 IN T R O D U C T IO N
In March 2017, the G 20 Finance M inisters and Central Bank
G overnors noted that "the malicious use of information and
com munication technologies (ICT) could disrupt financial
services crucial to both national and international financial
system s, underm ine security and confidence, and endanger
financial sta b ility ".1
Regulated institutions' use of technology includes greater levels of
automation and integration with third-party service providers and
customers.1
2 This results in an attack surface that is growing and is
accessible from anywhere, and it incentivises cyber-adversaries to
increase their capabilities. Increased use of third-party providers
means that the perimeter of interest to financial sector regulators
has gotten bigger, and greater use of cloud services means that
the perimeter is also shared. Shared service models require regu­
lated institutions to think differently about how they build and
maintain their cyber-resilience in partnership with third parties.
Given the increase in the frequency, severity and sophistication
of cyber-incidents in recent years, a number of legislative, regu­
latory and supervisory initiatives have been taken to increase
cyber-resilience. A t the international level, the G7 issued Funda­
mental Elem ents of Cyber-security for the financial sector,3 and
the Com m ittee on Payments and M arket Infrastructures (CPMI)
issued, jointly with the International Organization of Securities
Comm issions (IO SC O ), guidance on cyber-resilience for financial
market infrastructures (FMIs) in June 2016.4 In the European
Union (EU), the European Commission's (EC) Fintech Action Plan
invites the European Supervisory Authorities to consider issuing
guidelines to achieve convergence on IC T risk.5
Against this backdrop, the Basel Com m ittee on Banking Super­
vision (BCBS) recognised the merits of approaching operational
1 See G 20, C om m unique: G 20 Finance M inisters and Central Bank
G overn o rs M eetin g , Baden-Baden, G erm any, 17-18 March 2017, www
.bundesfinanzm inisterium .de/Content/EN /Standardartikel/Topics/
Featured/G20/g20-com m unique.pdf?_blob= publicationFile& v= 3.
2 Many regulated institutions are adopting strategies that will see more
data stored and/or processed outside the perim eters of the regulated
institution while at the sam e tim e granting service providers (now grow ­
ing to what is commonly a multitude of providers) access to their envi­
ronments to perform business and technology processes.
3 See G 7, Fundam ental elem ents o f cyb ersecu rity fo r the financial sector,
O c to b e r 2016.
4 See C P M I-IO SC O : G uidance on cyber-resilience fo r financial m arket
infrastructures, Ju n e 2016.
5 The European Securities and M arkets Authority (ESM A ), the European
Banking Authority (EBA ), and the European Insurance and O ccupational
Pensions Authority (EIO PA), collective referred to as the "European
Supervisory A utho rities".
362 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
resilience beyond the purview of operational risk m anagem ent
and minimum capital requirem ents, and established the O p era­
tional Resilience Working Group (O RG) with the intention of
contributing to, inter alia, the international effort related to
cyber-risk in close coordination with the other international bod­
ies involved. The Com m ittee therefore requested that the O RG
provide this first assessm ent of observed cyber-resilience prac­
tices at authorities and firms.
The objective of this report is to identify, describe and compare
the range of observed bank, regulatory and supervisory cyber­
resilience practices across jurisdictions. In preparing this range
of practices docum ent, O RG members used the input provided
by their organisation to an FSB survey in April 2017, which led
to the publication of its stocktake of publicly released cyber­
security regulations, guidance and supervisory practices at both
the national and international level issued in O ctober 2017.
According to the FSB cyber-security stocktake, banking is the
only sector in financial services for which all FSB jurisdictions
have issued at least a regulation, guidance or supervisory prac­
tices. In addition, the FSB found that m em ber jurisdictions drew
upon a small body of previously developed national or interna­
tional guidance or standards of public authorities or private
bodies in developing their cyber-security regulatory and supervi­
sory schem es (mainly the 2016 C PIM I-IO SC O guidance, the US
National Institute of Standards and Technology (NIST) cyber­
security fram ework and the ISO 27000 series).6
Besides reviewing and com pleting their jurisdiction's responses
to the FSB survey questions, O RG members shared their direct
experiences and insights in order to provide a more concrete
and specific understanding of the main trends, progress and
gaps in the pursuit of cyber-resilience in the banking sector. Fur­
therm ore, additional insight was gained and findings were fine-
tuned through outreach to a broad set of industry stakeholders
including banks, utility and technology service providers, consul­
tancies and associations involved in dom estic and international
cyber-security m atters.
For the purpose of this report, the B C B S uses the FSB Lexicon
definition of cyber-resilience,7 which defines it as the ability of
an organisation to continue to carry out its mission by anticipat­
ing and adapting to cyber threats and other relevant changes in
the environm ent and by withstanding, containing and rapidly
recovering from cyber incidents. Although this paper focuses on
6 See NIST, Fram ew ork fo r im proving critical infrastructure cybersecurity,
16 April 2018, w w w .nist.gov/cyberfram ew ork/fram ew ork, which consists
of standards, guidelines and best practices to manage cyber- security-
related risk.
7 See FSB , C yb er Lexicon, 12 Ju n e 2018, w w w .fsb.org/w p-content/
uploads/P121118-l.pdf.
cyber-resilience, practices also relevant to the broader opera­
tional resilience context were considered. A distinction was also
drawn between cyber-risk m anagem ent (which deals with vul­
nerabilities and threats) and IT risk m anagem ent, the scope of
which is broader than the m atter at hand in this report. W here
appropriate, deeper dives on practices that reflect new
approaches or address w idely shared strategic concerns have
been perform ed O RG m em bers in the form of nine specific
case studies.
The rem ainder of this report is divided into the following
sections:
• Section 2 provides a high-level overview of current
approaches taken by jurisdictions to issue cyber-resilience
guidance standards.
• Section 3 assesses the range of practices regarding gover­
nance arrangem ents for cyber-resilience.
• Section 4 focuses on current approaches on cyber-risk man­
agem ent, testing, and incident response and recovery.
• Section 5 explores the various types of communications and
information-sharing.
• Section 6 analyses expectations and practices related to
interconnections with third-party services provides in the con­
text of cyber-resilience.
2 4 .2 C Y B E R -R E S IL IE N C E S T A N D A R D S
A N D G U ID E L IN E S
Most jurisdictions address cyber through the lens of IT and gen­
eral operational risk. Cyber-resilience expectations, which are
som etim es em bedded within high-level IT risk guidance, cover a
wide range of regulatory standards.8 The intent of IT risk guid­
ance is to com m unicate jurisdictions' expectations and encour­
age good practice. Guidance typically addresses governance,
risk m anagem ent, information security, IT recovery and m anage­
ment of IT outsourcing arrangem ents. W hile guidance is pre­
sented as operational risk or IT risk guidance, it effectively
provides coverage of cyber-risk m anagem ent as a subset of
these practices.
8 We note that while the majority of jurisdictions' cyber-resilience e xp e c­
tations are derived from common fram ew orks, eg NIST, each supervisory
authority has designed their own assessm ent tools, eg questionnaires.
A s a result, regulated entities are required to provide slightly different
information to each supervisory authority, even where the broad ques­
tions posed are the sam e. Banks and supervisory authorities may benefit
from harmonisation and standardisation, not just of supervisory exp ecta­
tions, but also of the information requested by supervisors and the tools
used to collect it.
Chapter 24 Cyber-Resilience: Range of Practices
Standards on general risk topics such as business continuity
planning and outsourcing contribute to the m anagem ent of a
wide range of risks and also have relevance to cyber-risk. Discus­
sion at the 2017 Information Technology Supervisors' Group
(ITSG) meeting highlighted that many countries are working on
updates to their outsourcing standards.9 The Australian Pruden­
tial Regulation Authority(APRA) is also considering whether the
term outsourcing remains relevant or whether service p ro vid er
risk m anagem ent might be more appropriate, recognising that
bank supply chains have becom e more com plex. Section 6 of
this report further discusses expectations and practices in rela­
tion to third-party interconnections.
Specific cyber-risk m anagem ent guidance has em erged in the
context of information security. A few jurisdictions have issued
specific cyber-risk m anagem ent or information security guidance,
including on the importance of effective cyber-security risk man­
agem ent (Hong Kong SAR), on early detection of cyber intru­
sions (Singapore), on the establishm ent of a cyber-security policy
(Brazil) and on the common procedures and methodologies for
the assessm ent of IC T risk (European Banking Authority (EBA)).
In jurisdictions where no specific cyber-security regulations exist
for the financial sector, supervisors encourage their regulated
entities to implement international standards and apply prescrip­
tive guidance, and supervisory practices align with the top-down
initiatives of national cyber-agencies. Most jurisdictions implement
key concepts from international and industry standards such as
NIST, ISO /IEC and C O B IT .10 Regulators also leverage supervisory
practices from the US (Federal Financial Institution Examining
Council (FFIEC) IT Examination Handbook) and the UK (CBEST).
Some jurisdictions are developing enforceable standards for
cyber-resilience in the financial sector. This is the them e of this
report's first case study (Box 24.1).
24.3 C Y B E R -G O V E R N A N C E
The majority of the regulators have issued either principles-
based guidance or prescriptive regulations, with varying levels
of maturity. In general, regulatory standards and supervisory
practices address enterprise IT risk m anagem ent but do not
include specific regulations or supervisory practices that cover
9 The Information Technology Supervisors' Group (ITSG) is an interna­
tional working group of IT supervisors which m eets annually to discuss
approaches to IT risk (including cyber-risk).
10 Control O bjectives for Information and Related Technologies (C O B IT)
is a good practice fram ew ork created by international professional
association IS A C A for information technology (IT) m anagem ent and IT
governance.
■ 363
 BO X 24.1 C A SE STUD Y 1: R EC EN T REG U LA TO RY INITIATIVES - THE
A U STRA LIA N , GERM AN AND US MINIMUM R EQ U IR EM EN TS
Australian Prudential Regulation Authority
(A P R A ) Prudential Standard CPS 234
Inform ation Security
This Prudential Standard aims to ensure that an APRA-regu-
lated entity takes measures to be resilient against information
security incidents (including cyber-attacks) by maintaining an
information security capability com m ensurate with informa­
tion security vulnerabilities and threats.
A key objective is to minimise the likelihood and impact of
information security incidents on the confidentiality, integrity
or availability of information assets, including information
assets managed by related parties or third parties. The board
of an APRA-regulated entity is ultimately responsible for
ensuring that the entity maintains its information security.
The key requirem ents of this Prudential Standard are that an
APRA-regulated entity must:
• clearly define the information security-related roles and
responsibilities of the board, senior m anagem ent, govern­
ing bodies and individuals;
• maintain its information security capability com m ensu­
rate with the size and extent of threats to its information
assets, and so that it enables the continued sound opera­
tion of the entity;
• im plem ent controls to protect its inform ation assets
com m ensurate with the criticality and sensitivity of
those inform ation assets, and undertake system atic te st­
ing and assurance regarding the effectiveness of those
controls; and
• notify A P R A of material information security incidents.
Supervisory Requirem ents fo r IT in Financial
Institutions (BaFin Circular 10/2017, BAIT)
The Germ an Banking A ct requires financial institutions to
dem onstrate that its risk m anagem ent com prises, among
other things, adequate technical and organisational resources
and adequate contingency planning, especially for IT
systems.
cyber-risk m anagem ent of critical business functions, intercon­
nectedness or third-party risk m anagem ent. Against this back­
drop, supervisory expectations and practices were identified
and analysed in the following areas relevant to governance:
• Cyber-security strategy
• M anagem ent roles and responsibilities
• Cyber-risk awareness culture
• Architecture and standards
• Cyber-security workforce
364 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
The circular on Minimum Requirem ents for Risk M anage­
ment (MaRisk) provides a com prehensive fram ework for the
m anagem ent of all significant risks, thereby concretising the
requirem ents of the Germ an Banking A ct. Com plem enting
MaRisk in this regard, the Banking Supervisory Requirements
for IT (BAIT) refines the Germ an Banking A ct.
The BA IT covers requirements with respect to:
• IT strategy and IT governance;
• information risk m anagem ent and information security
m anagem ent;
• user access m anagem ent;
• IT project m anagem ent and application developm ent;
• IT operations; and
• outsourcing and other external procurem ent of IT services.
US A g e n c ie s' N otice o f P ro p o se d Rulemaking
fo r N e w Cyber-Security Regulations fo r Large
Financial Institutions
Another exam ple is the joint announcem ent from the US Fed ­
eral Reserve, the O fficer of the Com ptroller of the Currency
(O C C ) and the Federal Deposit Insurance Corporation (FD IQ ,
which provided a notice of proposed rulemaking for new
cyber-security regulations for large financial institutions. The
intent is to address the type of serious cyber-incident that
could im pact safety and soundness. As announced, require­
ments will relate to cyber-risk governance, risk m anagem ent,
internal dependency m anagem ent, external dependency
m anagem ent, incident response, assurance m anagem ent of
third parties and audit.
The State of New York Departm ent of Financial Services has
also released cyber-security regulations that require regulated
intuitions in New York to have a cyber-security programme
designed to protect consumers' private data; a written policy
or policies that are approved by the board or a senior officer;
a C hief Information Security O fficer to help protect data and
systems; and controls and plans in place to help ensure the
safety and soundness of the financial services industry.
Cyber-Security Strategy Is Expected But
Not Required
Although most regulators do not require regulated entities to
develop a cyber-security strategy, all exp ect regulated institu­
tions to have a board-approved information security strategy,
policy and procedures under the broad remit of effective over­
sight of technology.
Many jurisdictions (eg Australia, Brazil and jurisdictions across
Europe) expect that cyber-risk should be covered by the
organisation-wide risk m anagem ent fram ework and/or inform a­
tion security fram ework which is monitored and reviewed by
senior executives.
Consistent with the previous observation regarding regulatory
expectations, most supervisors review regulated entities' infor­
mation security strategies, but very few require or evaluate those
entities' standalone cyber-security strategies. Exam iners typically
review an institution's information security strategy, information
security plans, and cyber-security implementation, including key
cyber-security initiatives and tim elines. They may also review its
practices for communicating with relevant stakeholders.
A variety of approaches can also be observed within regions:
while the FFIE C IT Examination Handbook in the US does not
specifically address the developm ent of a cyber-security strat­
egy, Canada's self-assessm ent guidance attem pts to determ ine
whether a regulated financial institution has established a cyber­
security strategy aligned with the institution's business strategy
and im plem entation plan. M exico does not have supervisory
practices focused on cyber-security strategy but has issued regu­
lations that direct banks to develop IT security strategies.
Jurisdictions enforce cyber-security strategy requirem ents using
three types of non-mutually exclusive regulatory approaches:
1. The regulator/authority implements cyber-security strategy
requirem ents, either sector-specific or across multiple indus­
tries, with which financial institutions have to comply. This
is a common approach in emerging market econom ies with
relative hom ogeneity in their banking systems.
2 . The financial institutions establish their own cyber-security
strategies in com pliance with principles-based risk m anage­
ment practices. Regulators review these strategies as part
of their assessm ent of an institution's overall risk m anage­
ment p ractices.11
3 . A third approach, prevalent in Europe, involves exam in­
ing whether financial entities have an IT strategy and the
accom panying security provisions.
Management Roles and Responsibilities
Recognition of the Importance of the Board of
Directors and Senior Management
Some jurisdictions have issued specific regulatory guidance and
requirements addressing cyber-governance roles and responsi­
bilities of the board of directors (BoD) and senior m anagem ent.
11 The Saudi Arabian M onetary Authority (SAM A) applied the first two of
these approaches by com pelling financial institutions to form ulate their
own cyber-security strategies while it developed supervisory practices
for im plem enting cyber-security strategy.
Chapter 24 Cyber-Resilience: Range of Practices
The majority of such guidance prioritises the roles and respon­
sibilities of the BoD and senior m anagem ent, while others have
prioritised them even more in overseeing overall business tech­
nology risks. O ther jurisdictions approach cyber-governance as a
risk that regulated entities are expected to address within their
existing risk m anagem ent fram eworks.
Alm ost all the jurisdictions em phasise the im portance of man­
agem ent roles and responsibilities for cyber-governance and
controls. In the US, EU and Jap an, high-level guidelines encour­
age global system ically im portant banks (G-SIBs) and dom es­
tic system ically im portant banks (D-SIBs) to im plem ent well
defined, risk-sensitive m anagem ent fram eworks under initiatives
taken by theBoD . In addition, the EB A implements granular and
prescriptive requirem ents, ensuring consistent cyber-security
regulation and supervision across the European banking sector.
Similarly, emerging market econom ies im plem ent more granular
and prescriptive cyber-security requirem ents.
Variety of Supervisory Approaches Regarding the
Second and Third Lines of Defence (3LD)
The majority of regulators have adopted the 3LD risk m anage­
ment model to assess cyber-security risk and controls. However,
most regulators do not require the implementation of 3LD at
regulated entities and do not prescribe precisely how responsi­
bilities should be distributed across the lines, as the expectation
is rather for banks them selves to clearly define responsibilities
and leave no gaps between the lines. As a result, supervisory
practices for assessing the degree of 3LD implementation vary
w idely, and there appears to be a greater supervisory focus on
the first and second lines of defence than on the third line across
jurisdictions, which could hamper the effectiveness of the 3LD
checks and balances model. In particular, only a few jurisdictions
have form ulated specific expectation regarding the independent
reporting line from the chief audit executive to the audit com ­
mittee of the BoD.
Cyber-Risk Awareness Culture
An awareness of cyber-risk by staff at individual banks and a
common risk culture across the banking industry are prerequi­
sites for maintaining cyber-resilience within the sector. Regula­
tors in most jurisdictions have published guidance emphasising
the im portance of risk awareness and risk culture for staff
and m anagem ent at all levels, including BoDs and third-party
em ployees. Regulatory requirem ents include increasing cyber­
security awareness and cyber-related staffing at regulated
entities. In some jurisdictions, regulators require cyber-security
awareness training during each phase of the em ploym ent pro­
cess, from recruitm ent to term ination.
■ 365
 BO X 24.2 C A SE STU D Y 2: R O LES AND R ESPO N SIB ILITIES O F C H IEF
INFORM ATION SEC U R ITY O F F IC E R S (CISOS) IN C Y B ER -G O V ER N A N C E
A widespread practice among large and globally active banks
is to establish a robust governance structure based on the
3LD model. Typically, in this model, the C ISO is the execu­
tive officer responsible for a bank's cyber-security m anage­
ment. The C ISO 's role is to serve as a circuit breaker and
to balance the firm's risk appetite with security protection
considerations long before introducing or expanding digi­
tal services or products. However, in most cases the C ISO
reports to the chief risk officer (CRO ) or to the chief informa­
tion officer (CIO ), with no independent reporting line to the
C E O or board of directors (BoD). C RO s typically place more
emphasis on com pliance over risk m anagem ent. Em erging
trends in cyber-governance indicate that the placem ent of
the C ISO under the C R O is not ideal because the two posi­
tions have inherently conflicting priorities. When the C ISO
attem pts to im plem ent risk-based cyber and IT security con­
trols that accom m odate technological innovation through the
"plan-do-check-act" (PDCA) cycle, the C RO may prioritise
com pliance over the benefits of technological innovation.
This dynamic can im pede the C ISO from effectively perform ­
ing his/her job function. In response, some global banks
are restructuring the C ISO role by having the C ISO report
directly to the C E O or BoD.
Regulated entities may be required to include non-disclosure
clauses within staff agreem ents. To mitigate insider threats,
some jurisdictions require new em ployees to com plete a screen­
ing and background verification process, while existing em ploy­
ees undergo a mandatory reverification process at regular
intervals. In some jurisdictions, regulators assess whether banks
have robust processes and controls in place to ensure their
em ployees, contractors and third-party vendors understand their
responsibilities, are suitable for their roles and have the requi­
site skills to reduce the risk of theft, fraud or misuse of facilities.
The majority of the regulators encourage the developm ent of a
common risk culture sufficient to ensure effective cyber-risk man­
agem ent. In some jurisdictions, regulators assess each bank's
cyber-risk appetite, considering such factors as the bank's busi­
ness model, core business strategy and key technologies. Some
jurisdictions view cyber-security as a critical business function,
since a cyber-attack could lead to the insolvency of individual
entities or even to widespread disruption of the entire sector.
Architecture and Standards
For most jurisdictions, general regulatory requirem ents for
architecture and standards are not in place, or there is a lack of
coverage. Only a small number of countries specifically highlight
control considerations and substantial supervisory guidance
366 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Considering the cyber-threat landscape, the Saudi Arabian
M onetary Authority (SAM A) issued a principle-based cyber­
security fram ework and mandated financial institution to
com ply with various range of control considerations men­
tioned in different topics of this fram ework.
O ne such topic addresses responsibilities of the C ISO in
the cyber-security com m ittee, security strategy, security
architecture, risk-based cyber-security solutions, operational
security, etc to ensure that cyber-security controls are applied
throughout the financial institution. This is reinforced with
the role of the cyber-security function in financial institutions
where SA M A requires financial institutions to have a cyber­
security function independent from the IT function. This
includes separate budgets and staff evaluations along with
the cyber-security function reporting directly to the C E O /
managing director or senior m anagem ent of the control func­
tion of the financial institution.
SAM A also requires financial institutions to perform periodic
self-assessments against the cyber-security fram ework, which
is subject to review (on- and off-site) by SAM A to determ ine
the level of com pliance and cyber-security maturity of the
financial institution.
for cyber-security architecture. For instance, the US FF IE C IT
Exam ination Handbook specifies that when discussing network
architecture, supervisors should confirm that the diagram s are
current, securely stored and reflective of a defence-in-depth
security architecture. In Saudi A rabia, practices covering cyber­
security architecture are subject to a periodic self-assessment.
Cyber-Security Workforce
The skills and com petencies of cyber-workforces, their regula­
tory fram eworks and the range of practices differ m arkedly
across jurisdictions. Som e jurisdictions have IT-specific standards
that address the responsibilities of the IT workforce and infor­
mation security functions, with particular attention to cyber­
security workforce training and com petencies. Their range of
supervisory practices covers the assessm ent of team divisions,
staff expertise (background and security checks of cyber-security
specialists), the staff training processes and the adequacy of
funding and resources to im plem ent the organisation's cyber­
security fram ework. Most of the jurisdictions are in the early
stages of im plem enting supervisory practices to monitor a
bank's cyber-workforce skills and resources. Their regulatory
schem es require regulated entities to manage risks but do not
set specific requirem ents to address cyber-security workforce
skills and resources.
 BO X 24.3 C A SE STUD Y 3: FRA M EW O RKS FOR P R O FESSIO N A L TRAIN IN G
IN C Y B ER -SEC U R ITY AND CER TIFICA TIO N PRO GRAM M ES
The Center for Financial Industry Information Systems
(FISC), a public-private partnership, was founded in Japan
in 1984 to promote the cyber-security initiatives of financial
institutions. FISC facilitates the exchange of staff between
financial sector supervisors, banks, and IT security vendors
by partnering with the private sector and supervisors. FISC's
efforts have resulted in the developm ent of FISC Guidelines
for cyber-security preparedness in Jap an , as well as cyber­
security education and training programs for its bankers.
Bank exam iners at the FSA and BoJ reference FISC G uid e­
lines to ensure a consistent and integrated supervisory
approach. The same structure can be found in the Finan­
cial Security Institute (FSI) founded in Korea in 2015. This
illustrates the effectiveness of cross-border public-private
partnerships when the supervisors leverage the industry for
cyber-security enhancem ent. A t a minimum, FISC's efforts
serve as a model for other jurisdictions transitioning from
prescriptive to more risk-based and incentive-com patible
regulatory models.
Bank of England (BoE): The BoE has established the C B E S T
accreditation for suppliers who offer threat intelligence and
penetration testing services who wish to be involved in the
C B E S T schem e. This is in addition to the accreditation for
individuals offered by the Council for Registered Ethical
The majority of regulators assess the cyber-security workforce
of the institutions through on-site inspections, where they have
the opportunity to talk with relevant specialists. Self-assessment
questionnaires are becoming common practice. Training pro­
cesses are particularly scrutinised. As staff com petence is integral
to cyber-security, authorities have been known to raise concerns
about the capability or qualifications of an institution's head
of IT or information security. Jurisdictions diverge in how they
regulate the roles and responsibilities of the IT and information
security staff. Some jurisdictions, including Argentina, Australia,
the EU, Japan and Saudi Arabia, issue regulations specifically
addressing IT staff's roles and responsibilities. Sometim es regula­
tions are em bedded in a jurisdiction's global governance fram e­
work, such as those issued in Switzerland. In regulations issued
by M exico, the US, and Saudi Arabia, regulatory requirements
addressing the roles and responsibilities of the IT and informa­
tion security functions are encom passed by requirements for the
BoD and senior managem ent. In South Africa, such regulations
are included in the national cyber-security strategy.
The range of practices and regulatory expectations for w ork­
force com petence is w ide, and many jurisdictions have not
form ulated any. The FISC in Japan and FSI in South Korea are
both exam ples where public authorities have set guidelines on
Chapter 24 Cyber-Resilience: Range of Practices
Security Testers (C R EST), ie the C R E S T Certified Threat Intel­
ligence M anager (CCTIM ) for providers of threat intelligence
services, and the C R E S T Certified Simulated A ttack M anager
(CCSAM ) and C R E S T Certified Simulated A ttack Specialist
(CC SA S) for providers of penetration testing services.
Monetary Authority of Singapore (MAS): MAS requires
financial institutions to have in place a com prehensive tech­
nology risk and cyber-security training programme for the
BoD. Such a programme may include periodic briefings con­
ducted by in-house cyber-security professionals or external
specialists. The goal is to help equip the BoD with the requi­
site knowledge to com petently exercise its oversight function
and appraise the adequacy and effectiveness of the financial
institution's overall cyber-resilience program m e.
Hong Kong Monetary Authority (HKMA): The HKM A's Pro­
fessional Developm ent Program (PDP) is one of the three ele­
ments of HKM A's Cybersecurity Fortification Initiative (CFI).
It seeks to increase the supply of qualified cyber-security
professionals in Hong Kong SAR. The HKM A has worked
with the Hong Kong Institute of Bankers and the Hong Kong
Applied Science and Technology Research Institute (ASTRI)
to develop a localised certification schem e and training pro­
gramme for cyber-security professionals.
appropriate cyber-security workforce m anagem ent. In other
jurisdictions, regulatory requirem ents for cyber-workforce man­
agem ent are limited to supervisory expectations, and there may
be no assessm ent by supervisors of cyber-security skills and staff
training at regulated entities. Only the Hong Kong, Singapore
and the UK have issued dedicated fram eworks to certify cyber­
workforce skills and com petencies.
2 4 .4 A P P R O A C H E S T O R ISK
M A N A G EM EN T , T ES T IN G A N D
IN C ID E N T R E S P O N S E A N D R E C O V E R Y *•
This section sets out a range of observed practices on cyber-risk
management, and incident response and recovery. It aims to identify
practices in the supervision of banks' cyber-resilience which could
inform future work. This section is divided into four sub-sections:
• Methods for supervising cyber-resilience
• Information security controls testing and independent
assurance
• Response and recovery testing and exercising
• Cyber-security and resilience metrics.
■ 367
Methods for Supervising Cyber-Resilience
Risk Specialists Assess Information Security
Management and Controls
Jurisdictions apply different approaches to supervise regulated
institutions' cyber-resilience. Most focus on key risks such as
cyber in the context of the scale, com plexity, business model
and previous findings, often assigning institutions to categories
to aid decisions about which institutions will be in scope for vari­
ous supervisory initiatives. Guided by existing international and
national legislation, a programme of supervision is then agreed
spanning financial and operational resilience matters.
Half of the jurisdictions in the EU have internal guidance
addressing the circum stances when the com petent authority
should conduct a cyber-security review. These include institu­
tions' own risk assessm ents, findings from on-site inspections or
questionnaires, and incidents (eg cyber incident trend analysis).
Risk specialists typically draw on docum entary evidence includ­
ing survey responses, physical inspections, incident reports,
and in-person m eetings to assess the adequacy of controls in
place. Many supervisory expectations are aligned with industry
standards (eg CO BIT, NIST) but approach, depth and breadth of
supervisory assessm ents vary between jurisdictions.
Most jurisdictions undertake off- and on-site reviews and inspec­
tions of regulated institutions' information security controls to
assess com pliance with regulatory standards and alignm ent with
good p ractice.12 Reviews are com pleted either as part of gen­
eral technology assessm ents or risk m anagem ent assessments
more broadly. They tend to focus on governance and strategy,
m anagem ent and fram eworks, controls, third-party arrange­
ments, training, monitoring and detection, response and recov­
ery, and information-sharing and communication.
The number, type, and nature of regulated institutions vary by
jurisdiction, as do the size of the specialist risk team s of the
regulator. Some jurisdictions (eg Australia, Brazil and Singapore)
have developed approaches to equip front-line supervisors with
knowledge and tools to assess (triage) IT risk issues. Techniques
used include guidelines on how to identify and evaluate IT
risk, questionnaires, risk assessm ents and tools to quantify risk
assessm ents. Additionally, a number of jurisdictions (eg Australia
and the UK) have powers to appoint an auditor or other third
party to provide a report to the regulator on a particular aspect
of the regulated institutions' risk m anagem ent, including cyber.
12 On-site reviews usually consist of one or more m eetings with regu­
lated institutions at their prem ises. Off-site reviews usually consist of
desk-based assessm ent of docum entation or a m eeting at the office of
the regulator.
368 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Jurisdictions Increasingly Engage With Industry
to Address Cyber-Resilience
Industry engagem ent is used to either influence industry behav­
iour, or to seek feedback and views to inform regulatory work.
For instance, the French Autorite de Controle Prudentiel et de
Resolution (ACPR) and the UK Prudential Regulation Authority
(PRA) both released discussion papers, on IT risk and opera-
tional resilience respectively, in 2018. Common methods of
engagem ent also include speaking at conferences and other
communications to reach a range of regulated entities and
industry participants.1
14
3
Some jurisdictions include third-party service providers in this
engagem ent. In the EU , both the European Commission EU
FinTech Lab and the EB A FinTech Knowledge Hub have organ­
ised events with regulators, supervisors, industry and third-party
service providers. Com m unicating key m essages through these
channels can be faster and more responsive.
Information Security Controls Testing
and Independent Assurance
Mapping and Classifying Business Services Should
Inform Testing and Assurance
Most jurisdictions (eg Australia, the EU , Hong Kong, Singapore
and the US) recognise the im portance of mapping and classify­
ing business services and supporting assets and services as a
basis for building resilience. A clear understanding of business
services and supporting assets (and their criticality and sensitiv­
ity) can be used to design testing and assurance of end-to-end
business services. This is typically com pleted as part of business
im pact analysis, recovery and resolution planning, reviewing
dependency of critical services on external third parties, and
scoping for assessm ents.
A number of jurisdictions assess institutions' monitoring and
surveillance of emerging threats, including real-time d etec­
tion capability, ability to detect adversaries before they move
between system s and relevant continuity and control policies.
Some jurisdictions perform them atic reviews (eg Sweden com ­
pleted a review of institutions' access controls and m anagem ent
13 See A C P R , "IT Risk", D iscussion Paper, March 2018, w w w .acpr
.banque-france.fr/sites/default/files/m edias/docum ents/it_risk.pdf; and
Bank of England and Financial Conduct Authority, "Building the UK
financial sector's operational resilience", D iscussion Paper, Ju ly 2018,
w w w .bankofengland.co.uk/Vm edia/boe/files/prudential-regulation/
discussion-paper/2018/dpll8.pdf.
14 Publications used include white papers, information papers, annual
reports and in some cases letters to industry.
of user access rights), while some m em bers use existing inter­
national standards, applying them to other types of institution
(eg South Africa applies the C PM I-IO SC O guidance on cyber­
resilience for FMIs to banks).
Independent assurance also provides m anagem ent and regula­
tors with an evaluation of whether appropriate controls have
been im plem ented effectively. Jurisdictions commonly also
leverage the m anagem ent information outputs of these activi­
ties, providing the regulator with another source of information
for their own assessm ents.
Penetration Testing
Cyber-security controls are im plem ented through risk-based
decisions against a regulated institution's risk appetite. Regu­
lated institutions typically test information security controls
applied to hardware, software and data to prevent, detect,
respond and recover from cyber-incidents.
Supervisors review and challenge regulated institutions'
approach to testing controls and the remediation of issues iden­
tified. This can include reviewing survey responses, threat and
vulnerability assessm ents, risk assessm ents, audit reports and
control testing reports (eg penetration testing, health checks).
Five EU jurisdictions have developed programmes of regulator-
led penetration tests and three (the E C B , the Netherlands
and the UK) have provided guidance for regulated institu­
tions on howto test. Tests are typically voluntary, funded by
the regulated institution and targeted at larger, more system ic
institutions. In particular, threat-led red team penetration tests
delivered by third-party threat intelligence and penetration tes­
ters are becoming more widespread. The majority of directed
penetration tests focus on regulated institutions' protective
and detective cyber-resilience capabilities, while a few also test
response and recovery capabilities.
In May 2018, the EC B published the European Fram ework for
Threat Intelligence-based Ethical Red Teaming (TIB ER -EU ),15
which is the first Europe-wide fram ework for controlled and
bespoke tests against cyber-attacks in the financial market. The
fram ework facilitates testing for cross-border entities under the
oversight of several authorities. It is up to the relevant authori­
ties and the entities them selves to determ ine if and when TIBER-
EU based tests are perform ed. Tests will be tailor-made and will
not result in a pass or fail - rather they will provide the tested
entity with insight into its strengths and w eaknesses, and enable
it to learn and evolve to improve cyber-maturity.
15 E C B , "E C B publishes European fram ew ork for testing financial sector
resilience to cyber-attacks", press release, 2 May 2018, w w w .ecb
.europa.eu/press/pr/date/2018/htm l/ecb. prl80502.en.htm l.
Chapter 24 Cyber-Resilience: Range of Practices
Taxonomy of Cyber-Risk Controls
W hile putting cyber-risk controls in place is only one aspect
of building cyber-resilience, many jurisdictions find review of
controls a ready way to engage with regulated institutions.
Some jurisdictions use taxonom ies of controls to understand
whether there are any gaps in the coverage of their supervisory
approach. Currently the taxonom ies are jurisdiction-specific
and do not rely on harmonised concepts and definitions. If an
authority is unable to assess a particular type of control, for
exam ple because it has no supervisory approach, assessm ent
method or the required skillset to assess the control, then that is
identified as a gap. An exam ple taxonom y of cyber or inform a­
tion security controls is included in A nnex A .
Response and Recovery Testing
and Exercising
Evaluation of Service Continuity, Response and
Recovery Plans and Continuous Learning
Evaluation of service continuity plans focuses on reviewing
alignm ent with institutions' risk m anagem ent fram eworks, the
business continuity m anagem ent strategies chosen, IT disaster
recovery arrangem ents and data centre strategies.
The majority of regulators require entities to establish a fram e­
work or policy for prevention, detection, response and recovery
activities, including incident reporting. Specific requirements
vary across supervisory authorities, and most are not specific
to cyber-risk. Indeed, few regulators have issued cyber-specific
business continuity or disaster recovery regulatory requirements
for the sector. A few jurisdictions, like China and India, have
prescribed cyber-incident response fram ework to be a key com ­
ponent of cyber-governance. The US also has supervisory guid­
ance regarding incident m anagem ent, covering identification
of indicator of com prom ise, analysis and classification of events
and escalation and reporting of incidents. Some authorities,
such as the Jap anese Financial Services Agency (JFSA ) and Bank
of Jap an , also focus on potential threats and information-sharing
to minimise delays in reporting cyber-incidents.
Evaluation of regulated institutions' incident response and
recovery plans focuses on how plans are triggered, institutions'
ability to im plem ent plans, preservation of data and specific
actions for "critical" technology. In Canada, the assessm ent of a
bank's internal and external communication plans and protocols
seeks to determ ine if all relevant stakeholders are included, to
avoid contagion.
Several jurisdictions (eg Australia, Belgium, Hong Kong, Japan and
the US) complete a supervisory review of post-incident learning.
■ 369
 BOX 24.4 C A SE STUDY 4: " E X E R C IS E R ESILIEN T SH IELD "
O ne exam ple of an international public-private exercise
was UK/US "E x e rc ise " Resilient Shield in 2015 - a joint
exercise with leading global financial firm s to enhance
cooperation and ability to respond effectively to a cyber­
incident in the finance sector. The exercise was not a test
of individual financial firm s or financial system s, but was
designed to im prove understanding across governm ents
and industry of inform ation-sharing, incident response han­
dling and public com m unications.
Participants included UK and US supervisory authorities,
governm ent departm ents and cyber-agencies. The exercise
exam ined how the UK and US could enhance cyber-security
cooperation by:
• enhancing processes and mechanisms for maintaining
shared awareness of cyber-security threats between US
and UK governm ents and the private sector;
This is conducted through the discussion of regulated institutions'
response and the root cause analysis, but no further standard
practice could be observed.
Joint Public-Private Exercising
Distinct from testing, most supervisors and banks use exercises
to train and practice how they would respond to an incident.
Cross-border international exercises have made this more visi­
ble. Exam ples include the UK/US exercise Resilient Shield
(Box 24.4) and the TITU S exercise in 2 0 1 5 ,16 as well as the G7
exercise under planning in 2018.
In the UK, the Sector Exercising Group (SEG ), which is a sub­
group of the Cross M arket O perational Resilience Group
(C M O RG ), manages the sector's annual exercise regim e, which
incorporates cyber-specific scenarios.17 In Jap an , the JF S A has
conducted tabletop exercises to improve cyber-security, and in
particular communication and coordination of response m echa­
nisms. O ver 100 regulated institutions including banks, credit
unions, insurance com panies and securities com panies partici­
pated in the 2017 exercise, which covered two cyber-scenarios.
A summary of results was then published to enable others to
draw lessons from the exercise.
16 TITU S was a crisis communication exercise for euro area financial mar­
ket infrastructures held in N ovem ber 2015.
17 C M O R G is a UK industry forum which is co-chaired by the Bank of
England and UK Finance and attended by senior representatives from
regulated institutions.
370 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• furthering mutual understanding of each country's cyber­
security information-sharing processes and incident response
coordination structures, including scenarios that may call for
a coordinated response and public communications; and
• exchanging best practices dom estically and between
the US and UK on a governm ent-to-governm ent and
government-to-financial sector basis.
The exercise did not:
• amount to a "cyber war gam e" or include live play;
• test the actions of law enforcem ent or the security and
intelligence agencies;
• seek to involve the entire range of the UK and US finance
sectors; or
• seek to test individual firms or financial system s, but
instead rehearse communication and coordination links.
Cyber-Security and Resilience Metrics
Cyber-Security and Resilience Metrics are Not
Yet Mature
Some jurisdictions have m ethodologies to assess or benchm ark
regulated institutions' cyber-security and resilience. Those juris­
dictions that have developed ways to assess cyber-security and
resilience have focused on reported incidents, surveys, penetra­
tion tests and on-site inspections. None of these m ethodologies
produce quantitative m etrics or risk indicators com parable to
those available for financial risks and resilience, eg standardised
quantitative metrics where established data are available.
Instead, indicators provide information on regulated institutions'
approach to building and ensuring cyber-security and resilience
more broadly. Supervisory authorities also rely on entities' own
m anagem ent information, although this differs across entities
and is not yet mature.
Emerging Forward-Looking Indicators of Resilience
It is common for jurisdictions (and often regulated institutions
them selves) to focus on backward-looking indicators of the
perform ance of the technology function. These indicators are
presented to Board members and executives as part of m anage­
ment information that regulators may review (exam ples can be
found in A nnex B).
Backward-looking indicators com m ent on past perform ance as
an indicator of future perform ance, which is reasonable when
institutions' operations and risk environm ent are relatively stable
over tim e and more or less independent from outside influ­
ences. However, cyber-risk frustrates this because adversaries
are dynamic, them selves adapting to institutions' responses and
protective m easures, som etim es changing their tactics and strat­
egies even in the space of a single cyber-incident. Distributed
denial of service (DDOS) incidents are a good exam ple, where
the volume and scale of disrupted internet traffic generated
has increased significantly in the last two years and adversaries
adapt their techniques in response to an institution's defences.
W hile backward-looking metrics continue to be important,
jurisdictions are increasingly recognising the need for forward-
looking indicators as direct and indirect metrics of resilience,
indicating whether a regulated institution is likely to be more or
less resilient in the event of a risk crystallising.
Regulated institutions are also seeking to improve metrics for
resilience more broadly. A nnex C contains cyber-centric metrics
collated by a sam ple set of regulated institutions for decision­
making bodies (boards and board sub-com m ittees). It is notable
that the data provided typically allow for trend information so
that the reviewer can assess if the situation is getting better
or worse. Some metrics track com pliance with internal policies
while others measure inherent risk. Patch ageing in particular is
a widespread and com parable metric.
This list of cyber-metrics collated by regulated entities can be
reviewed by regulators to gain insight into what may be col­
lected across the regulated population to gain an enhanced set
of cyber-metrics for measuring the state of cyber-resilience more
broadly. Collectively, these indicators can inform on the broad
adequacy of an institution's cyber- and operational resilience
levels for its business needs and risk appetite. However, no sin­
gle item taken in isolation is seen as a sufficient metric, and no
standard set of indicators has been identified so far to provide a
meaningful benchmark.
(1) the num bered circles next to the arrows indicate the "typ es" of info sharing as described in section 5.1 and Figure 24.2.
Sou rce: Basel Com m itte on Banking Supervision.
Chapter 24 Cyber-Resilience: Range of Practices
A number of jurisdictions (eg Australia, Canada, the ECB-SSM ,
Hong Kong, Singapore, the UK and the US) analyse survey
responses to assess regulated institutions' capabilities and
inform prioritisation of follow-up work. The outcom es of this
work tend to be institution-specific findings and remediation or
action plans which can be monitored over tim e, and/or them atic
reports. As such, they provide indicators and trends if per­
form ed on a regular basis. Results from the Australian surveys
are subsequently published to influence industry behaviour. In
the UK, them atic findings are often shared with participating
firms for the same purpose.
24.5 COM M UNICATION AND
SHARING O F INFORMATION
Most Basel Com m ittee jurisdictions have put in place cyber-secu­
rity information-sharing mechanisms, be they mandatory or vol­
untary, to facilitate sharing of cyber-security information among
banks, regulators and security agencies. These communications
are established for multiple purposes, including helping relevant
parties defend them selves against emerging cyber-threats.
This section sets out a range of observed cyber-security
information-sharing practices among banks and regulators. For
the purpose of this report, they are divided into five categories
according to the parties involved in the sharing. Figure 24.1
illustrates the interlinkages of the five types of practices.
Overview of Information-Sharing
Frameworks Across Jurisdictions
Among the five types of cyber-security information-sharing prac­
tices, sharing among banks; sharing from banks to regulators and
■ 371
 0% 20%
Typ e 1 - am ong banks
Typ e 2 - bank to regulator
Typ e 3 - am ong regulators 29%
Typ e 4 - regulator to banks 32%
Typ e 5 - with security agencies
□ W ith inform ation-sharing arrangem ent (either m andatory or voluntary, or both)
□ W ithout inform ation-sharing arrangem ent
Fiaure 24.2 Percentage of jurisdictions with/without information-sharing arrangement.
Sou rce: Basel Com m ittee on Banking Supervision.
sharing with security agencies are the most commonly observed.
Sharing among regulators is the least observed type. This is partly
due to the less systematic nature of information-sharing arrange­
ments between regulators, where it can happen on an ad hoc basis
at a bilateral level or within supervisory colleges, under specific
circumstance. Figure 24.2 illustrates the adoption rate of different
types of cyber-security information-sharing, both mandatory and
voluntary, by the jurisdictions covered by this report.
Different kinds of cyber-security information are shared by
banks and regulators, including cyber-threat inform ation,
information related to cyber-security incidents, regulatory and
supervisory responses in case of cyber-security incidents and/
or identifications of cyber-threat, and best practices related
to cyber-security risk m anagem ent. Depending on the type
of arrangem ent, the kind of information shared varies. For
instance, information related to cyber-security incidents is more
w idely observed in sharing from banks to regulators and with
security agencies, whereas cyber-threat inform ation/intelligence
is the most common kind of information shared among banks.
Various jurisdictions have put in place certain cyber-security
information-sharing arrangem ents to facilitate more effective
sharing of cyber-security information by banks and regulators.
Full adoption of all types of information-sharing arrangem ents
within a jurisdiction is still exceptional.
That said, it was also noted that for jurisdictions with observed
practices of information-sharing among banks, there are less
observed practices of information-sharing from regulators
to banks. This is probably attributable to the lesser need for
sharing by regulators to banks if an effective peer sharing
mechanism among banks already exists. Similarly, jurisdictions
with observed practices of information-sharing from banks to
regulators display lower rates of sharing with security agencies,
372 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
40% 60% 80% 100%
75% I 25%
75% I 25%
| 71%
68%
68% I 32%
potentially due to the allocation of responsibilities for cyber­
security information processing among regulators and security
agencies within a jurisdiction.
For some of the jurisdictions, both mandatory and voluntary
information-sharing arrangements are noted for the same type
of information-sharing arrangement. This is because voluntary/
mandatory sharing is sometimes applicable when different types
of information are being shared, or when information is shared
with different parties. For example, there is a mandatory require­
ment in Singapore for financial institutions to report relevant cyber­
security incidents to MAS, while cyber-threat information exchange
between MAS and the Cyber Security Agency (CSA) is voluntary.
O ther types of information-sharing arrangem ents are observed,
which include public announcem ent/disclosure of information
about cyber-security incidents and cross-sector inform ation­
sharing with public and private institutions. In particular, the range
of stakeholders involved in cyber-attacks typically includes non­
bank critical infrastructure operators, third-party service providers
and customers who could contribute to sharing information with
security agencies for further distribution to other sectors, or be
part of other setups such as a joint-industry groups.18
The rem ainder of this section summarises common practices
adopted by various jurisdictions, describes more specific prac­
tices adopted by individual jurisdictions and sum marises key
gaps observed.
18 This "o th er" type of information is shown in Figure 24.3. O ne
exam ple is the E B A guidelines on IC T Risk Assessm ent under the
Supervisory Review and Evaluation process (SREP) (EBA /G L/2017/05)
and recom m endations on outsourcing to cloud service providers (EBA /
R EC /2 0 1 7/03), which assum ed good information-sharing of IT risks
betw een banks and supervisors, although there was no specific require­
ment for banks to report security incidents to their supervisors.
 No of practices observed
0% 10% 20% 30% 40% 50% 60%
c
•O Cyber-threat information /
+-» 18 2 2 2 2 [l|
(U intelligence
E
Cyber-security incidents 20 18
&
Cyber-security regulatory
u 1 4
Q )
</i> responses
CD
_Q
Good practices F J 2 T|~2~ 2
u
M—
o
“O O ther p l|jl|
_r^
■ Type 1 - Sharing among banks □ Type 2 - Sharing from bank lo regulator ■ Type 3 - Sharing among regulators

□ Typ e 4 - Sharing from regulator □ Type 5 - Sharing with security agencies □ O thers
to banks

Fiaure 24.3 Kinds of information shared

Sou rce: Basel Com m ittee on Banking Supervision.

Sharing Among Banks
Banks share inform ation (eg know ledge of a cyber-security
threat) with peer banks through established channels, mainly
to allow peer banks to take more tim ely action in response
to sim ilar threats. Although there is no common standard
for autom ated inform ation-sharing, regulators in most ju risd ic­
tions are not directly involved in bank-to-bank inform ation­
sharing but do play a role in facilitating the establishm ent of
voluntary sharing m echanism s for cyber-vulnerability, threat
and incident inform ation, and in som e cases indicators of
com prom ise.
Some jurisdictions have established public sector platforms to
accomplish information-sharing initiatives while others have
encouraged private sector developm ent of information-sharing
organisations. Three jurisdictions (Brazil, Japan and Saudi A ra ­
bia) have mandated cyber-security information-sharing among
banks through regulations or statutes.
O utside the information-sharing and analysis centre construct,
some jurisdictions have established public/private forums or
governm ent-led centres for information-sharing. In some juris­
dictions, local regulations on data protection are perceived to
be an obstacle to cyber-security information-sharing among
banks and may warrant a specific dialogue between banks and
their local or regional regulators.
Sharing of information and collaboration among banks depend
on the financial industry's culture and level of trust among par­
ticipants. Experience shows that a two-level information-sharing
structure through which information would be first shared on the
interpersonal level with a closer group and then be exchanged
at the company level with a broader group of banks helps build
trust into the system.
Sharing from Banks to Regulators
The sharing of cyber-security information from a bank to its
regulator(s)/supervisor(s) is generally limited to cyber-incidents
based on regulatory reporting requirem ents. Such requirements
are mainly established to (i) enable system ic risk monitoring
of the financial industry by regulator(s); (ii) enhance regulatory
requirem ents or issue recom m endations by regulator(s) to adjust
policies and strategies based on information collected; (iii) allow
appropriate oversight of incident resolution by regulator(s); and
(iv) facilitate further sharing of information with industry and
regulators to develop a cyber-risk response fram ework.
Reporting requirem ents are established by different authori­
ties for specific purposes depending on their mandate (eg
supervisory and regulatory functions, consumer protection and
further distribution of information to national cyber-security
agencies for system ic operators). Incident reporting by banks
to regulator(s) is a m andatory requirem ent in many jurisdictions,
with different scopes of requirem ents and ranges of applica­
tion. For jurisdictions already enforcing the requirem ent in the
past, the reporting obligation has a broader operational incident
scope, including cyber-incidents. The perim eter can include all
supervised institutions but is more often limited to system ically
im portant institutions. Nearly all institutions regulated in the EU
are required to report cyber-security incidents to the com petent
authorities. The requirements stem from supervisory fram eworks

Chapter 24 Cyber-Resilience: Range of Practices ■ 373

 BO X 24.5 C A SE STUDY 5: FS-ISAC - K E Y FEA TU RES AND B EN EFITS
The Financial Services Information-sharing and Analysis
Center (FS-ISAC) is a non-profit entity established in 1999 to
collect and provide financial services sector m em ber organ­
isations with information on potential vulnerabilities as well as
tim ely, accurate and actionable warnings of physical, opera­
tional and cyber-threats or attacks on the national financial
services infrastructure. Its members include banks, credit
unions, insurance com panies, investm ent com panies, financial
services regulators and law enforcem ent entities.
In addition to the core information-sharing platform, the FS-
ISAC hosts conferences and educational sem inars, conducts
sector and cross-sector contingency planning exercises, and
is an internationally recognised source for threat intelligence
information. Core elem ents of the FS-ISAC include:
• Rapid response: the FS-ISAC analyses and disperses
information and threat intelligence information among its
members through their proprietary real-time Critical Infra­
structure Notification System (CINS).
• Information analysis and sharing: the FS-ISAC receives
information from many sources that is verified and
(such as the Single Supervisory Mechanism (SSM) cyber-incident
reporting fram ework), EU directives (PSD2, NIS) and local law.
Some requirements also include the obligation to submit a root
cause analysis for the incident, or a full post-mortem or lessons
learnt after the incident.
Different scopes and perim eters may depend on the type of
authority (eg supervisors, regulators, national security) and their
mandate (ie national cyber-security agencies, consum er protec­
tion, banking supervision, etc), sector(s) involved (eg m ultisector
or specific: banks, significant banks, system ic operators, pay­
ment) and geographical range (eg national, multiregional). W hile
many of the supervisors focus only on reporting and tracking
incidents that have already taken place, some require proac­
tive monitoring and tracking of potential cyber-threats because
concerns about reputational risk may lead to a delay in incident
reporting by the regulated entity.
Based on these considerations, different reporting fram eworks
are also observed. These range from formal communications to
informal communications (eg free-text updates via email or ver­
bal updates over the phone).
Differences are noted in: (i) taxonom y for reporting; (ii) reporting
time fram e (im m ediately, after two hours, after four hours and
after 72 hours are exam ples of practices observed); (iii) tem ­
plates; and (iv) threshold to trigger an incident reporting. These
differences highlight the fragm entation issue facing the banks
operating in multiple jurisdictions or supervised by different
374 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
classified by type and severity. The information is then
sent out by CIN S and reaches members instantly. FS-ISAC
also conducts crisis calls if necessary, and has a team
working 24/7 to analyse any incoming data and dissem i­
nate information.
• Anonymised data: Information received and disseminated
through the FS-ISAC is considered confidential and stored in
a standalone, secure portfolio so that no threat or informa­
tion can be traced back to its source by any members and all
information is anonymously shared. This makes the FS-ISAC
a safe place for its members and encourages sharing.
• Member-driven: The members of the FS-ISAC run the
organisation, tailoring it specifically for the needs of the
financial industry.
• Recognised by US Financial Services Regulators: the
Federal Financial Institutions Exam ination Council, a
group consisting of federal and state US financial services
regulators, has recognised the FS-ISAC as a key threat
intelligence source and recom m ends financial institutions
participate in its process to identify, respond to and miti­
gate cyber-security threats and vulnerabilities.
authorities, as these banks are likely to be obliged to fill in vari­
ous tem plates with different taxonom y, reporting time frame
and threshold. This may increase their regulatory burden, con­
suming significant resources to ensure com pliance. It may be
possible for an authority with multiple functions to receive from
a bank multiple reports with distinct form ats for multiple tim es.
All incident reporting processes have a single direction flow, by
a bank to an authority, although an informal flow back can be
used for alerting firms in case of an incoming threat. By normal­
ising the prompt exchange of information between banks and
supervisors, reciprocal flow mechanisms can help remove the
possible stigma associated with incident reporting by banks,
thereby fostering effective and tim ely incident reporting.
Sharing Among Regulators
Regulators share information with fellow regulators, be they
dom estic or cross-border, as appropriate according to estab­
lished m andatory or voluntary information-sharing arrange­
ments. Cyber-security information shared among regulators
may include regulatory actions, responses and measures. C on­
sidering different types of cyber-security information-sharing,
information-sharing among regulators is the least observed
practice across jurisdictions, although it is expected that many
informal and ad hoc communication channels exist, such
as through supervisory colleges and memoranda of under­
standing. Cyber-fraud is becoming more sophisticated and
 BO X 24.6 C A SE STUDY 6: BILATERAL C Y B ER -SEC U R ITY IN FORM ATION -SHARING
B ETW EEN THE HONG KO N G M ONETARY AU TH O RITY (HKMA) AND THE
M ONETARY AU TH O RITY O F SIN G A P O R E (MAS)
Given the im portance of facilitating more cross-border cyber­
security information-sharing, the HKM A and MAS established
a bilateral cyber-security information-sharing fram ework in
the first quarter of 2018.
As part of the fram ework, the HKM A and MAS have agreed
upon four im portant guiding principles and key design fe a­
tures of the governance arrangem ent, the scope of inform a­
tion-sharing, a traffic light protocol, standard taxonom y and
dedicated communication channels.
• Voluntary: Given that some cyber-security information may
be highly sensitive, the sharing of information under the
fram ework should be voluntary, without creating any legal
obligations for the participating authorities.
• Tim ely: The HKM A and MAS recognise that tim ely sharing
of cyber-security information is of paramount im portance
to building an effective fram ework. The authorities have
therefore agreed that information about cyber-security
incidents should be shared as soon as possible to the
extent perm itted by law. If a cyber-security incident is
assessed to have the potential to spread to other jurisdic­
tions, the related information should be shared within
cross-jurisdiction, and sharing of cyber-security information
among regulators could assist in maintaining awareness of the
cyber-threat situation for tim ely guidance to be provided to
banks to protect financial system s against cyber-frauds.
Sharing from Regulators to Banks
Information-sharing from regulators to banks occurs through
established channels, based on the information the regulator
receives both from banks and other sources. Various jurisdictions
(eg Australia, China, Korea, Saudi Arabia, Singapore, Turkey and
the US) have established clear guidance in the form of standards
and practices to enable cyber-security information-sharing by
regulators to banks. In these jurisdictions, information flows
from the bank to the regulator, and the regulator assesses the
risk to the financial industry and shares the information with the
industry, as appropriate, based on the risk assessment. In cases
where the information is sensitive (eg contains customer-specific
or bank-specific information), the regulator anonymises or sum­
marises it to allow sharing.
Regulators with a regulator to bank sharing mechanism more
readily share publicly available information such as cyber-secu­
rity risk m anagem ent best practices. They use informal channels
such as industry sharing platforms (eg participation in industry
Chapter 24 Cyber-Resilience: Range of Practices
24 hours. Incom plete information about cyber-security
incidents can be shared so long as a reasonable degree of
validity has been ascertained.
• E ffe c tiv e : To ensure the efficacy of the fram ew ork, shar­
ing of cyber-security inform ation should not be limited
to inform ation related to those financial institutions
with an operation in both jurisdictions (ie unlike typical
supervisory college or m em oranda of understanding,
"supervisory locus" is not required to be established).
A taxonom y was also established with reference to
the Structured Threat Inform ation expression (STIX)
fram ew ork.
• C onfidential: The confidentiality of any information shared
between the authorities should be properly protected.
The fram ework will focus on the sharing of general infor­
mation such as the modus operandi of the attacks. The
authorities also adopted a Traffic Light Protocol (TLP) for
subsequent sharing of information.
The HKM A and MAS have been exchanging information
regarding real-life cyber-threats and cyber- security-related
regulatory responses and measures since April 2018.
forums), m eetings and informal communications to dissem inate
information to the banks.
In cases where non-public information is obtained by regula­
tors, the information is shared with selected parties via informal
m eetings or other informal communication vehicles, so as to
preserve anonymity and confidentiality of the institution(s)/
bank(s) im pacted by a cyber-attack, and maintain banks' confi­
dence and trust in the regulators generally.
Mandatory requirem ents for regulators to share information
with banks have only been established for a few jurisdictions (eg
China). A few other jurisdictions have put in place practices for
voluntary sharing (eg Singapore, the UK). However, many juris­
dictions have not put in place any standard practices for regula­
tors in the sharing of information with banks, nor established any
process or time fram e to enable tim ely, risk-based information­
sharing. Classification of information could ensure that the
appropriate audience could receive the appropriate information
and help to build trust between regulators and banks.
Sharing with Security Agencies
This section exam ines sharing of information by banks or regu­
lators with the security agencies operating in their respective
jurisdictions.
■ 375
 BOX 24.7 C A SE STUDY 7: CO M PU TER SEC U R IT Y IN CID EN T R ESP O N SE TEAM S
(CSIRTs) IN THE EU
The Network and Information Security (NIS) Directive is a
com ponent of EU legislation with the specific objective to
improve cyber-security throughout the EU. The requirements
came into full effect on 10 May 2018. The NIS Directive
defines different obligations across the EU , one of which con­
cerns the establishm ent of one or more Com puter Security
Incident Response Teams (CSIRTs) at national level for com ­
prehensive incident m anagem ent nationwide. Incident
reporting notification to national CSIRTs (directly or through a
com petent authority) is m andatory for entities identified as
O perators of Essential Services (O ES) and Digital Service Pro­
viders (DSP) (some banks have been included in the first cate­
gory). In some countries, com petent authorities for banks
1o
that have been identified as O ES are the supervisory
authorities, while in others it can be the Ministry of Finance
or a specific governm ent authority. The NIS Directive also
established the requirements to have a CSIRTs European net­
work (ie a dedicated network for all national CSIRTs, run by
Given that cyber-security incidents encountered by banks or
regulators could potentially be experienced by entities in other
sectors, effective communication of relevant cyber-security inci­
dents with security agencies could facilitate broader awareness
of cyber-threats in a tim ely manner, and enhance defensive m ea­
sures against adversaries.
For jurisdictions with operations of Com puter Em ergency Readi­
ness Team (CERT) or similar security agencies, these agencies
may act as focal points for cyber-security incident notification.
Banks or regulators share cyber-security information with these
agencies for broader circulation of information and collaboration
with other sectors within the country (eg public sector, civilian
sector, com puter community).
Jurisdictions have generally set out standards and practices
for critical infrastructure entities and regulators to share cyber­
security information with national security agencies. W hile
most jurisdictions adopt a voluntary approach, a few jurisd ic­
tions m andate formal sharing requirem ents. Some jurisdictions
(eg Luxem bourg, the US) have established sharing platforms
to facilitate multilateral sharing of cyber-security incident or
cyber-threat information. In the US, an online portal is available
for cyber-security information to be subm itted to the National1
9 duct A uthority (FC A ), the Bank of England, the Treasury,
19 As required by the NIS D irective, identification of O E S should have
been com pleted by O cto b er 2018.
376 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
the m em ber states, with its secretariat provided by the
European Network and Information Security Agency) with
the following com petencies:
• Exchange information on services, operations and coop­
eration capabilities
• Exchange and discussing information related to incidents
and associated risks (on request, on a voluntary basis)
• Identify a coordinated response to an incident (on request)
• Providing m em ber states support in addressing cross-
border incidents (on a voluntary basis)
• Issue guidelines concerning operational cooperation
• Discuss, explore and identify further forms of operational
cooperation (risks and incidents, early warnings, mutual
assistance, coordination)
• Discuss the capabilities and preparedness of certain
CSIRTs (on request from that CSIRT)
Cyber-security and Com m unications Integration C enter and
the US CERT. In Luxem bourg, the Com puter Incident Response
C enter (CIRCL) has established a Malware Information-sharing
Platform (MISP) to gather, review, report and respond to com ­
puter security threats and incidents. The MISP allows organisa­
tions to share information about malware and their indicators.
The aim of this trusted platform is to help improve the counter­
measures used against targeted attacks and set up preventive
actions and detection.
For jurisdictions with mandatory requirements for cyber-security
incident information-sharing with national security agencies
(Canada, France, Singapore and Spain), the sharing arrange­
ments are bilateral in general. Instead of requiring banks or reg­
ulators to share all cyber-security incidents, these jurisdictions
require cyber-security incidents affecting key operators of critical
infrastructure to be reported.
Som e jurisdictions have established procedures for relevant
inform ation to be exchanged voluntarily and bring to g eth er
relevant parties for coordination of responses to incidents. In
the UK, the A uthorities Response Fram ew ork can be invoked
by financial authorities to bring to g eth er the Financial C o n ­
the National Crim e A g en cy and the National Cyber-security
C entre to coordinate their response to a cyber-security
incident. M eetings and form al com m unications can be trig ­
gered as appropriate.
2 4 .6 IN T E R C O N N E C T IO N S W ITH
TH IR D PA RTIES
All jurisdictions recognise the challenge of gaining assurance
of an entity's cyber-resilience, a challenge both for regulators
with regard to financial institutions, and for financial institutions
with regard to their third-party service providers. Extensive
use of third-party services increases the challenge for ju risd ic­
tions and regulated institutions them selves to have full sight of
the controls in place, and the level of risk. For the purpose of
identifying the range of practices in relation to cyber-resilience,
"third parties" is understood in a broad sense, including: (i) all
form s of outsourcing (including cloud com puting services);
(ii) standardised and non-standardised services and products
that are typically not considered outsourcing (pow er supply,
telecom m unication lines, com m ercial hardware and softw are,
etc); and (iii) interconnected counterparties such as other insti­
tutions (financial or not) and FMIs (eg paym ent and settlem ent
system s, trading platform s, central securities depositories and
central counterparties).
Cyber-resilience practices in relation to third parties are analysed
across the following areas:
• Governance of third-party interconnections
• Business continuity and availability
• Information confidentiality and integrity
• Specific expectations and practices regarding visibility of
third-party interconnections
• Auditing and testing
• Resources and skills
Governance of Third-Party Connections
Widespread Expectations and Practices
Regulations across different jurisdictions require that insti­
tutions develop a m anagement- and/or board-approved
outsourcing (or organisational) fram ew ork that defines the
applicable roles and responsibilities, the outsourceable activi­
ties and concrete conditions for outsourcing, the specific risks
that need to be analysed (either prior to selection of a provider
or when substantially am ending/renewing an agreem ent) and
recurrent obligations (such as monitoring procedures or regular
risk assessm ents).
Regulators typically also require that institutions im plem ent
a contractual fram ework, defining generic rights, obligations,
roles and responsibilities of the institution and the service pro­
vider, specifying the responsibility for reviewing, approving
Chapter 24 Cyber-Resilience: Range of Practices
and signing contracts (eg involvement of a cyber- security func­
tion), with specifications on the result (ie an official, written and
detailed contract) and the applicability of the fram ework (typi­
cally also for intragroup outsourcing).
The regulatory expectations on risk assessm ents and contracts
tend to specify in a rather com prehensive way which risks (and
m itigating m easures) to cover, albeit m ostly in general term s.
N ext to a description of the nature of the service, the
exp ected results of the outsourcing, and the roles and respon­
sibilities of the service provider and the financial institution,
risk assessm ents and contracts are exp ected to include analysis
and clauses on strategic risk, com pliance risk, security risk (typ­
ical areas of attention are security m onitoring, patch m anage­
m ent, authentication solutions, authorisation m anagem ent and
data loss/breach procedures), business continuity risk, vendor
lock-in risk (the general ability of an institution to w ithdraw
from the service provider and to absorb the outsourced activ­
ity or transfer it to another service provider), counterparty risk
(the visibility into the service provider's organisation), country
risk, contractual risk, access risk (m eaning that financial institu­
tions and/or supervisors cannot audit the third-party connec­
tion due to inadequate contractual agreem ents) and
concentration risk.20
Along with the outsourcing and contractual fram eworks, regula­
tors typically expect that information, cyber-security and/or con­
tinuity fram eworks address some crucial aspects of third-party
arrangem ents to ensure the availability of critical system s and
the security of sensitive data that are accessible to, or held by,
third-party service providers. These aspects include the identifi­
cation and prioritisation of interconnections, as well as the clas­
sification and response to incidents with third parties according
to service agreem ents and the communication of these policies
to relevant external parties.
As regards supervisory practices, the following activities appear
to be widespread:
• Intrusive on-site inspections with respect to cyber-risk in rela­
tion to outsourcing. During such inspections, the outsourcing
fram ework, the applicable processes and the com pleteness
and adequacy of specific risk assessm ents and contracts will
typically be reviewed.
20 "Concentration risk" in this context does not refer to the potential
system ic risk to the industry as a w hole, but rather to the potential lack
of control of an individual firm over one single provider as multiple
activities are outsourced to the sam e service provider. These different
aspects of concentration risk are explained in Jo in t Forum , Outsourcing
in financial services, February 2005; and Com m ittee of European Bank­
ing Supervisors, G uidelines on outsourcing, D ecem ber 2006.
■ 377
• A s part of their off-site supervision practices, most jurisdic­
tions receive periodic statem ents or reports that assess the
outsourcing policies and risks at the financial institution.
These reports will typically contain statem ents on the exis­
tence and adequacy of outsourcing policies, processes, risk
assessm ents and contracts.
Expectations on the Scope of the Ecosystem and
Management of Third Parties
Some international standards explicitly recognise that institu­
tions may critically depend on third-party interconnections,
other than those that are typically considered outsourcing. The
C PM I-IO SC O guidance on cyber-resilience for FMIs discusses
the identification of cyber-risks and the coordination of resil­
ience efforts from the perspective of the ecosystem of an FMI.
The ISO 27031 standard specifies requirem ents for hardware,
software, telecom s, applications, third-party hosting services,
utilities and environmental issues, such as air conditioning, envi­
ronmental monitoring and fire suppression.
Some jurisdictions require that financial institutions enter into
a prior agreem ent with their clients when they offer financial
services via the internet that involve the consultation and man­
agem ent of personalised data or carrying out transactions (eg
precise description and demarcation of the responsibilities of
each party in using the technologies provided or recom m ended
BOX 24.8 C A SE STUD Y 8: R EG U LA T ED /C ER T IFIED THIRD PARTIES IN
LU XEM BO U RG
The Luxembourg governm ent has put in place a specific
regulation for com panies that supply specialised services to
financial institutions. For these "financial sector profession­
als" (PSFs), the same regulation for authorisation and ongoing
supervision by the Commission de Surveillance du Secteur
Financier (CSSF) applies as for the financial institutions them ­
selves. PSFs that exclusively offer operational services are
called support PSFs. By regulating and supervising technical,
administrative and communications-related activities, the
Luxembourg governm ent seeks to facilitate the outsourcing
of core activities by ensuring a high quality of service and pro­
fessional confidentiality. If a financial institution is outsourcing
to a PSF, the ultimate responsibility remains with the institu­
tion, in accordance with the Com m ittee of European Banking
Supervisors (CEBS) guidelines on outsourcing. However, in
some cases it is observed that an institution is more enticed
to neglect its monitoring and audit obligations, as it might
consider them to be performed by the supervisor.
Cloud service providers (CSPs) are not subject to this regu­
lation. The Luxembourg regulator (CSSF) defined specific
criteria for outsourcing that will be considered IT outsourcing
378 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
by the institution for the purpose of identifying and authenticat­
ing the client and validating the transactions).
In Luxem bourg, authorities have put in place a specific regula­
tion for com panies that supply specialised services to financial
institutions. For these "financial sector professionals", the same
regulation for authorisation and ongoing supervision applies as
for the financial institutions them selves (Box 24.8).
Consistent with the expanding scope of supervisory scrutiny
or regulated entities, in Europe legal mandates that regulate
interaction between institutions, supervisors and third-party pro­
viders are provided by the Mifid II D irective, and 12 com petent
authorities can directly review third parties involved in IT ser­
vices. In addition, specific expectations for control and location
of data are starting to em erge in the form of requirem ents that
the location of at least one data centre for cloud computing ser­
vices provided in the country or region (eg in the EU) be identi­
fied, or data ownership, control (Australia) and location (Brazil
and France) be identified and monitored as part of the outsourc­
ing agreem ent. Some jurisdictions (Germ any, Singapore and
Switzerland) further require a contractual clause that reserves
the right for institutions to intervene at, or give directives to, the
service provider.
Beyond the assurances required prior to engaging with third
parties, most jurisdictions also require either prior notification
based on a cloud computing infrastructure. If these criteria are
met, the specific obligations of C SS F circular 17/654 on cloud
computing apply. An institution can outsource directly to a
CSP or indirectly through a support PSF or a non-regulated
entity (which will outsource to CSP in a chain). The signatory
of the contract with the CSP can be either the financial
institution or the operator of the resources provisioned by the
CSP, who can be the support PSF or the non-regulated entity
outside of Luxem bourg. Several provisions on the governance
of cloud services apply, including the appointm ent of a cloud
officer for the cloud resources operating entity (which can be
the institution itself or a third party).
Depending on the m ateriality of the activity supported by
the cloud infrastructure, the institution needs prior approval
from the CSSF. If the outsourced activities are not m ate­
rial or if the cloud service contract is signed with a support
PSF, notification to the C S S F is sufficient. The C S S F circular
17/654 will be am ended by abolishing the notification of
non-material outsourcing and asking all financial institutions
to set up a register containing all outsourcing in the cloud
regardless of m ateriality.
 BO X 24.9 C A SE STUD Y 9: CLO U D S ER V IC E PR O V ID ER S' REG U LA TO RY CLO U D
SUMMITS
Some cloud service providers organise regulatory cloud sum­
mits that provide exam ples of how a supervisory college
model could work in practice when applied to a global tech­
nology provider.
These summits are organised with regulators and supervisors
with the objective of:
(i) holding cloud-focused discussions on the threats related
to cloud, the international regulatory landscape and the
cloud service provider's stance in this regard; and
(ii) providing the regulators with an opportunity to learn
about products, processes and practices and to discuss
approaches to supervise and gain assurance that financial
institutions using these cloud services operate in a safe
and sound manner.21
or prior authorisation of material (cloud) outsourcing activities.
To this end, jurisdictions have created questionnaires/tem plates
(sometimes specifically for IT outsourcing or cloud computing).
Although these are not harmonised in their coverage and m et­
rics across jurisdictions, they facilitate the creation and docu­
mentation of risk assessm ents locally.
By focusing on the products and services them selves, new
expectations for secure developm ent and procurem ent also
contribute to making regulations and practices future-proof.
In particular, specific requirem ents (eg regarding "internet
of things" system s in Japan) are in place for system s to be
designed, developed and operated under the principle of secu­
rity by design, considering that many individual devices, applica­
tions and systems will be interconnected in the future, providing
new opportunities and possibly introducing new vulnerabilities.
Observed Supervisory Practices
O verall, although jurisdictions' mandates to supervise third-party
service providers vary, supervisors have been using traditional
supervisory tools in order to ensure that the common exp ecta­
tions described above are met. Them atic exercises based on
self-assessment questionnaires to assess the cyber-security
and IT outsourcing risk of banks are a typical exam ple. Third-
party providers can also be reviewed during on-site reviews
and inspections, either on the basis of formal requirements or
21 In addition to these summits with regulators and supervisors, these
cloud service providers typically also organise com parable summits with
their most im portant financial custom ers.
Chapter 24 Cyber-Resilience: Range of Practices
Th e main part of the sum m its is usually organised into
sessions provided by the staff of the service provider.
Typically, one session consists of a panel discussion of
regulators (chosen by the cloud service provider) that starts
a dialog with the cloud service provider's staff, after which
the discussion is opened to all regulators. D iscussions are
typ ically not reco rded, but the cloud service provider's staff
takes notes.
Regulatory summits could also be organised by regulators or
an independent body to allow exam iners to understand the
products and com pliance controls so as to usefully com plete
their expertise and becom e more effective doing on-site
exam inations.
authority (as is done in Hong Kong, Singapore and the US) or
based on cooperation from service providers. For exam ple,
Australia engages with system ically important third-party service
providers which host critical systems for regulated institutions.
Periodic engagem ents are voluntary and focus on service provid­
ers' system ic role as opposed to their relationship with individual
institutions. This allows for a more open discussion of relevant
strategy, governance, customer engagem ent, controls and capa­
bilities (including those pertaining to cyber). It also can provide
useful insight into the maturity (or lack thereof) of regulated
institutions oversight practices, informing further supervisory
activities. They can also be used as a mechanism to influence the
provider regarding regulatory expectations and best practice.
In the same vein, supervisors can work directly with cloud sup­
pliers both on formal or informal grounds, to include the right
to audit in contracts for the financial industry (as in the Nether­
lands) or to take part in regulatory summits organised by major
cloud providers (including for discussions of assurance fram e­
works; see Box 24.9).
Against the above findings, a "supervisory college" model to
supervise and share information about large, internationally
active service providers (particularly cloud providers) could also
be a way to address the blind spots resulting from m andate limi­
tations and regulatory fragm entation.
Business Continuity and Availability
To safeguard the availability and continuity of critical business
activities in case of exceptional events or crises (eg cyber­
attacks), regulators typically request that financial institutions
■ 379
analyse these activities, to design and im plem ent appropriate
plans, procedures and technical solutions, and to adequately
test mitigating measures. The same holds true where critical
business activities depend on interconnections with third par­
ties, with regulations stressing the im portance of aligning the
business continuity plans of critical suppliers (and their subcon­
tractors) with the needs and policies of the financial institution in
term s of continuity and security.
It is common practice to request that recovery and resumption
objectives be defined for critical business activities from an end-
to-end perspective2
23 For instance, Italy specifies that among the
2
risk scenarios for the continuity of system ically im portant pro­
cesses that are docum ented and constantly updated, institutions
should include catastrophic events that affect essential opera­
tors and third-party infrastructures (eg large-scale cyber-attacks).
Typical activities and services that are considered by regulators
are cloud outsourcing, settlem ent processes or internet services
offered to custom ers.
Expectations with regard to plans and procedures typically
address tasks and responsibilities in processes for incident
m anagem ent and for response and recovery in case of material
disruptions, the information and communication needs from and
towards key internal and external stakeholders and the required
resources, including planned redundancy, so as to ensure the
prompt transfer of outsourced activities to a different provider
in case continuity or quality of the service provision are likely to
be affected.
Most regulators and international standards exp ect financial
institutions to test protective m easures periodically in order to
verify their effectiveness and efficiency and make adjustm ents
where necessary. A dvanced regulators require that tests for
critical activities are based on realistic and probable disrup­
tive scenarios, conducted at least on a yearly basis and that
service providers and significant counterparties are involved
through collaborative and coordinated resilience testing.
22 The analysis step typically involves a business im pact assessm ent (BIA)
identifying the most critical activities, resources and services, their inter­
nal and external dependencies, their acceptable recovery tim e fram es in
case of disruption, the events/scenarios (either natural or manmade) that
can affect these critical business activities and the potential im pacts of a
(major) disruption.
23 The C P M I-IO SC O guidance on cyber-resilience for financial m arket
infrastructures, for instance, specifies that a Financial M arket Infrastruc­
ture should, design and test its system s and processes to enable the
safe resumption of critical operations within two hours of a disruption
and to enable itself to com plete settlem ent by the end of the day of the
disruption, even in the case of extrem e but plausible scenarios. Some
banking supervisors have similar expectations for system ically im portant
functions.
These tests are typically com plem ented by audits and m oni­
toring activities (on availability, security incidents, etc) of the
outsourcing vendors.
In term s of business continuity and availability, com m onalities in
supervisory expectations and practices are observed, which are
mainly focused on the "standalone business continuity" of the
institutions. Such com monalities could provide an opportunity to
extend continuity and resilience testing to a more collaborative
and coordinated form that involves larger parts of the ecosys­
tem of a financial institution.
Information Confidentiality and Integrity
Confidentiality and integrity of information for third-party inter­
actions are commonly addressed in general data protection
requirem ents, through explicitly requiring contractual term s to
include confidentiality agreem ent and security requirements
for safeguarding the bank's and its custom ers' information.
In addition, banks are generally required to manage or take
appropriate steps to ensure The C PM I-IO SC O guidance on
cyber-resilience for financial market infrastructures, for instance,
specifies that a Financial M arket Infrastructure should, design
and test its system s and processes to enable the safe resump­
tion of critical operations within two hours of a disruption and
to enable itself to com plete settlem ent by the end of the day
of the disruption, even in the case of extrem e but plausible
scenarios. Some banking supervisors have similar expectations
for system ically im portant functions, that their service providers
protect their confidential information and that of their clients.
Steps include verifying, assessing and monitoring security prac­
tices and control processes of the service provider.
A growing num ber of ju risd ictio n s have cloud-specific
requirem ents, which range from requirem ents that inform a­
tion transferred to the cloud be su b ject to a contractual
clause and that different cloud-specific issues be considered
to ensure data secu rity, to more sp ecific requirem ents on
data location, data seg reg atio n , data use lim itations, security
and exit. O ne exam ple of data access lim itation is the p rohi­
bition im posed on staff of cloud service providers in Lu xem ­
bourg to access a bank's data w ithout the e xp licit ag reem ent
of the bank and w ithout a m echanism available to the bank to
d e te ct and control access.
In a num ber of jurisdictions, regulations exp licitly include
exp ectatio ns that outsourcing arrangem ents com ply with legal
and regulatory provisions on protection of personal data, con­
fidentiality and intellectual property. Evidence of more techni­
cal and operational requirem ents is more scattered and less
harm onised, with jurisdictions em phasising different aspects
of inform ation confidentiality and integrity, ranging from

380 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
exp licitly requiring encryption solutions for confidential data to
be under the banks' control, to regulating the transfers of data
abroad and requiring exp licit client consent for data handling
by third parties.
Specific Expectations and Practices with
Regard to the Visibility of Third-Party
Connections
In many jurisdictions the supervisory authority requests to be
informed about the material outsourcing agreem ents made by
supervised institutions and imposes some conditions on them ,
including about preserving a minimum level of visibility on the
outsourced functions by the supervised entity.
Beyond the prior notifications and authorisation processes,
supervised institutions are commonly expected to maintain an
inventory of outsourced functions and to receive regular reports
from service providers, mainly about m easurem ents of service
level agreem ents and the appropriate perform ance of controls.
Some jurisdictions also require sub- outsourcing activities to be
visible for the supervised entities so that the associated risks can
also be managed.
Inventorying expectations can be set in relation to IT assets in
some jurisdictions, such as the identification of both hardware
and software elem ents together with the function they are
related to (even for outsourced functions) in Luxem bourg.242
5 that these independent reports should be based on widely rec­
O ther fram eworks, such as the US FF IE C IT Exam ination Hand­
book and the C PM I-IO SC O guidance, focus on the connections
and information flows of financial institutions with external
parties.
The current practices inspired by the various expectations set at
national supervisory level and by international guidance play a
com plem entary role. W hile supervisory authorities' expectations
define activities that can fit into classical cyber-security fram e­
works (identify, protect, detect, respond and recover), standard
setting bodies have an organisational process-oriented
approach: for instance, ISO IEC 27036-2 addresses configuration
m anagem ent, information m anagem ent processes and the out­
sourcing relation termination processes, and ISA C A C O B IT 5
elaborates on the implementation of an information security
m anagem ent system . On the other hand, both ISO and the US
O cr
N IST fram ework recommend the identification, documentation
and categorisation of suppliers to address information security
issues, while ISA C A C O B IT 4.1 and 5 recommend to identify
24 See CSSF, C S S F Circular 01/27, 23 March 2001.
25 See NIST, Fram ew ork fo r im proving critical infrastructure cy b e rse cu ­
rity, version 1.1, draft 2,16 A p ril 2018.
Chapter 24 Cyber-Resilience: Range of Practices
suppliers and associated contracts and categorise them into
type, significance and criticality in order to establish a process
for their evaluation.
Analysis of supervisory expectations for the visibility of third-
party connections shows that the scope, form at and content of
supervisory authorities' information requests about material out­
sourcing vary greatly across jurisdictions.
Auditing and Testing
Supervisory expectations regarding the audit of third parties
(internal and/or external) are aligned in two areas. First, the
majority of the requirements state the necessity for the super­
vised organisations to guarantee the "rights to inspect and
audit" their service providers. Some jurisdictions require that
this right be cascaded to the significant subcontractors while
other jurisdictions (France, Switzerland and Singapore) have
granted this right directly to supervisory authorities.
Second, for several jurisdictions the audit opinion on the out­
sourcing arrangem ents may be form ed based on the report of
the service provider's external auditor. O thers accept pooled
audits, organised by multiple financial institutions,26 or audits
performed by the internal audit departm ent of a service pro­
vider, under the condition that the audit departm ent comply
with certain regulatory conditions. Some jurisdictions specify
ognised standards or be perform ed by auditors with adequate
skills and knowledge.
Current regulations focus on traditional outsourcing and, in
some cases, cloud computing providers. The scope of the
requirem ents for "rights to inspect and audit" critical third par­
ties is nonetheless still focused on the strict banking sector.
Shared and independent audit reporting on the critical intercon­
nections with third parties could therefore facilitate the audit
approach effectiveness and efficiency.
A s regards testing of the security requirem ents for outsourcing
and cloud com puting providers, although institutions are
generally required to m onitor their providers' com pliance,
most regulations are not aligned in term s of how com pliance
should be verified or te sted . O ne possible m ethod is the
application of supervisor-led or bank-led (intelligence-based)
red team ing exercises focused on interconnections. In the
EU , the scope of the T IB ER -EU test appears to include the
institution's critical functions that are outsourced to third-party
service providers.
26 As an exam ple, a group of eight European financial institutions per­
form ed a joint audit in Ju n e 2018 of a common cloud service provider.
■ 381
Resources and Skills
The Basel Com m ittee's Soun d Practices: Im plications o ffin te c h
develop m en ts for banks and bank supervisors, published in
February 2018, indicate that banks may require specialist com ­
petencies to assess whether their risk functions are capable of
maintaining effective oversight of the em erging risks posed by
new technologies.
This topic is usually covered by the broader outsourcing and
m anagem ent processes, with the expectation that the relevant
personnel have the necessary expertise, com petencies and qual­
ifications to effectively monitor outsourced services or functions
and are able to manage the risks associated with the outsourc­
ing beyond the mere com pliance dimension.
Regulators expect that institutions contract sufficient and quali­
fied personnel to ensure continuity in managing and monitoring
outsourced services or functions, even if key personnel leave the
institution or become otherwise unavailable. When institutions do
not have internal resources sufficient in know-how or number, the
general expectation is that external experts or technical resources,
such as consultants or specialists, would be proactively identified
to complement or supplement in-house personnel. In Belgium,
382 Financial Risk Manager Exam Part II: Operational Risk and Resiliency
institutions are required to provide a monitoring and replacement
plan for employees who are crucial for ensuring the proper func­
tioning of the critical activities, services and resources and who are
difficult to replace due to their specific expertise and limited num­
ber. Even beyond the supervised institution personnel, institutions
should also provide documentation to clients of financial internet
services on security awareness and responsibilities with regard to
their secure use to strengthen those connections.
As with the regulatory expectations, supervisory practices
mostly reflect com m onalities, as the assessm ent of human
resources and qualifications for managing third-party connec­
tions and relationships is usually done during on-site inspec­
tions. In those jurisdictions where financial supervisors have the
authority to exam ine third parties directly, they assess the suffi­
ciency and qualifications of staff at the third parties, and expect
the third parties to perform appropriate background checks.
Personnel who are Certified Information System s Security Pro­
fessionals or an organisation that conforms to the ISO 9001
Q uality M anagem ent System could provide additional assurance
that personnel have the necessary com petencies to manage
third-party connections.
Building the UK
Financial Sector's
Operational
Resilience
Learning Objectives
A fter com pleting this reading you should be able to:

Describe operational resilience and describe threats and
challenges to the operational resilience of a financial
institution.
Explain recom m ended principles, including tools and
m etrics, for maintaining strong operational resilience at
financial institutions.
Describe potential consequences of business disruptions,
including potential system ic risk impacts.
Define im pact tolerance; explain best practices and poten­
tial benefits for establishing the impact tolerance for a firm
or a business process.

Excerp t is reprinted from Building the UK Financial Secto r's O perational Resilience, Ju ly 2018, by permission of the Bank of England
and the Financial Conduct Authority. This article is a reproduction of a discussion paper, seeking views from stakeholders, and does
not represent current Bank of England, Prudential Regulation Authority or Financial Conduct Authority policy.

383
25.1 IN T R O D U C T IO N
1. This discussion paper (DP) is issued jointly by the Prudential
Regulation Authority (PRA), the Financial Conduct Authority
(FC A ), and the Bank of England (the Bank) in its capacity of
supervising financial market infrastructures (FMIs), (collectively
'the supervisory authorities').The purpose of this DP is to share
the supervisory authorities' thinking regarding operational
resilience and obtain feedback. Feedback is welcom ed from all
parts of the financial sector, as well as from consum ers, market
participants and other stakeholders, including other regulatory
organisations.
2. UK banks, building societies, credit unions, insurers, overseas
UK deposit takers with PRA regulated activity perm issions, PRA
regulated investm ent firms, F C A authorised and recognised
entities1 (collectively 'firm s'), and the FMIs supervised by the
Bank of England (recognised paym ent system s, specified service
providers, central securities depositories and central counterpar­
ties) may be particularly interested in responding, as any future
policy may be directly applicable to them .
3. Feedback is encouraged on how firms and FMIs currently
address the issues and risks discussed in this paper. The super­
visory authorities would welcom e responses to the questions
asked throughout the DP and listed in Section 8.
The Importance of Operational Resilience
4. O p eratio n al disruptions to the products and services that
firm s and FM Is provide have the potential to cause harm to
consum ers and m arket p articip an ts, threaten the viab ility of
firm s and FM Is, and cause instab ility in the financial system .
This DP fo cuses on how the provision of these products and
services can be m aintained. O p eratio n al resilience refers
to the ability of firm s, FM Is and the secto r as a w hole to
prevent, respond to, recover and learn from operational
disruptions.
5. From the perspective of firms and FMIs, there are numerous
challenges to making sure their businesses are resilient to opera­
tional disruption. These challenges have becom e more com plex
and intense in recent years, during a period of technological
change and in an increasingly hostile cyber environm ent. A d d i­
tional challenges occur where firms operate internationally or
1 Entities authorised, registered or recognised under the Financial Ser­
vices and M arkets A ct 2000 (FSM A) (eg investm ent or consum er credit
firm s or recognised investm ent exchanges) and authorised and/or reg­
istered under other regim es (eg, Paym ent Services Regulations 2017
(PSRs 2017), and Electronic M oney Regulations 2011 (EM Rs 2011)).
384 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
outsource a significant level of activities to third parties. Some of
these challenges are illustrated in Figure 25.1.
6. The operational resilience of firms and FMIs is a priority for
the supervisory authorities and is viewed as no less important
than financial resilience. A lack of resilience represents a threat
to the supervisory authorities' specific objectives as well as their
shared goal of maintaining financial stability (see Box 25.1).
7. The Bank and the supervisory authorities have interlinked
objectives, which include promoting financial stability. The super­
visory authorities consider that improvements in operational
resilience would be facilitated by complementary regulatory stan­
dards and supervisory approaches.
8. Figure 25.2 illustrates the objectives which are most likely to
be affected by operational resilience issues. It also illustrates
that the consum er protection objective is likely to be affected
more often, and by more firms, than the market integrity, the
safety and soundness, and financial stability objectives.
9. Interconnectedness occurs both within the UK and interna­
tionally. The supervisory authorities are engaged in international
fora supporting the developm ent of operational resilience prin­
ciples and standards. Common standards would help ensure
that operational resilience is not adversely affected by the loca­
tion of firms' and FM Is' infrastructure, and will assist regulatory
co-operation in the supervision of international firms.
10. Improving operational resilience might also be good for
com petition. A shared understanding of minimum standards
may help new entrants establish them selves in a market.
Important Concepts in the Supervisory
Authorities' Approach to Operational
Resilience
11. This DP discusses a number of im portant concepts which are
relevant to all firms and FMIs:
• The sup erviso ry authorities co nsid er th at the continuity of
business services is an essential com ponent of operational
resilien ce. A cco rd in g ly, firm s and FM Is should focus on
that outcom e when approaching operational resilience.
A voiding disruption to a particular system supporting a
business service is a contributing facto r to operational
resilience. But ultim ately it is the business service that
needs to be resilient— and needs to continue to be p ro­
vid e d . Th e sup erviso ry authorities envisage th at boards
and senior m anagem ent should assum e that individual
system s and processes th at support business services will
be d isru p ted , and increase the focus on back-up plans,
responses and recovery options.
 Technical Changing Keeping
innovation behaviours pace
Fintech Instant Skills
access gaps
Artificial Mobile
intelligence technology Obsolescence
Distributed Faster
ledger transactions
Crypto
assets
Fiq u re 25.1 Challenges to building operational resilience.
BO X 25.1: THE SU P ER V ISO R Y A U TH O R ITIES' O B JE C T IV E S
The Bank has an objective to protect and enhance the stability
of the financial system of the United Kingdom. The Bank sets
out in its Financial Stability Strategy•2
3*that financial stability is
the consistent supply of the vital services that the real economy
demands from the financial system. Those vital services are:
providing the main mechanism for paying for goods, services
and financial assets; intermediating between savers and bor­
rowers, and channelling savings into investment, via debt and
equity instruments; and insuring against and dispersing risk.
The Bank as supervisor of FMIs seeks to ensure that FMIs are
designed and operated in a safe way, and that they contribute
to reducing systemic risks in the vital payment, settlement and
clearing arrangements centred upon them. The Bank's opera­
tion of the Real Tim e Gross Settlement (RTGS) service and the
Clearing House Automated Payment System (CHAPS) also sup­
ports the delivery of the Bank's overall mission.
• Setting impact tolerances which quantify the amount of dis­
ruption that could be tolerated in the event of an incident
may be an efficient way for boards and senior m anagem ent
to set their own standards for operational resilience, prioritise
and take investm ent decisions. An exam ple would be a m axi­
mum acceptable outage tim e for a business service. Firms
and FMIs would test their ability to stay within their impact
tolerances in severe but plausible scenarios in order to iden­
tify vulnerabilities and take mitigating action. The supervisory
authorities may expect some firms and FMIs to consider any
2 Bank of England A ct 1998, section 2A: https://w w w .legislation.gov.uk/
ukpga/19 98 /11/section/2A#com m entary-key-8734b5fd971e45bdddb6
81573bfa3213.
3 Bank of England, Financial Stability Strategy: w w w .bankofengland
.co.uk/financial-stability.
Chapter 25 Building the UK Financial Sector's Operational Resilience
Challenging System
environment complexity
Cyber Third
incidents parties
Cost Concentration
pressures risk
Cross-border
dependencies
The PRA's and FC A 's objectives are also defined in the Finan­
cial Services and Markets A ct 2000 (FSM A). The PRA seeks to
promote the safety and soundness of the firms it supervises,
and contribute to the securing of an appropriate degree
of protection for those who are or may becom e insurance
policyholders. The PRA also has a secondary competition
objective. The FC A 's strategic objective is to ensure that
relevant markets work well. To advance its strategic objec­
tive, the FC A has three operational objectives: to secure an
appropriate degree of protection for consum ers, to protect
and enhance the integrity of the UK financial system, and to
promote effective com petition in the interests of consumers.
In achieving these objectives, both regulators seek to support
financial stability.
FPC impact tolerance when setting their own impact
4
tolerances.
i
• How firms and FMIs manage their response to operational
disruption is critical to maintaining confidence in the busi­
ness services they provide. The speed and effectiveness of
communications with those affected, including custom ers, is
an im portant part of their overall response and could help to
manage the expectations of those affected and maintain or
restore confidence in the firm 's business services.
4 This DP does not affect requirem ents or obligations under existing leg­
islation or international standards such as the C P M I-IO SC O principles for
Financial M arket Infrastructure, PSRs 2017 or the EM Rs 2011; any future
changes proposed would have regard to the existing international stan­
dards and other legal requirem ents, including EU requirem ents.
■ 385

More firms likely to impact the
authorities' objectives more often
Fiq u re 2 5 .2 Impact of operational resilience on the objectives of the authorities.
• Operational resilience is already a responsibility of firms and
FM Is, and an outcom e supported by the existing regula­
tory fram ework. The supervisory authorities are considering
the extent to which they might supplem ent existing policies
to improve the resilience of the system as a whole, and to
increase the focus on this area within individual firms and
FM Is. They are reviewing existing policies, including those
on risk m anagem ent, outsourcing, controls and communi­
cation and business continuity plans, to ensure that these
continue to be effective, in light of market and technological
developm ents.
• The supervisory authorities are also reviewing their approach
to the assessm ent of operational resilience matters,
which may include an increased focus on firms' and FMIs'
non-financial resources. Gaining assurance that appropriate
impact tolerances are set, monitored and tested is likely to
be a key com ponent of future supervisory approaches.5
Discussion Paper Structure
12. Section 2 explains why the supervisory authorities con­
sider that managing operational resilience is most effectively
addressed by focusing on business services, rather than on
5 This DP has been written in the context of the current UK and EU
regulatory fram ew ork. The supervisory authorities will keep the dis­
cussed approach under review to assess w hether any changes would be
required due to changes in the UK regulatory fram ew ork, including those
arising once any new arrangem ents with the European Union take effect.
386 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Financial Policy Committee
Bank (FMI Supervision)
PRA and FCA
FCA
system s and processes. The section also explains that firms and
FMIs are more likely to be operationally resilient if they design
and manage their operations on the assumption that disruptions
will occur to their underlying system s and processes.
13. Section 3 explains that financial stability rests on the opera­
tional resilience of individual firms, FMIs and the system as a
whole. The FPC is establishing its tolerance for the length of any
period of disruption to the delivery of vital services the financial
system provides to the econom y in the context of cyber (an
'F P C impact tolerance'), as set out in its June 2018 Financial Sta­
bility Report (FSR).6 The supervisory authorities consider that
their approach to operational resilience described in this DP is
consistent with the FPC 's approach, and supports its agenda.
14. Section 4 suggests that the boards and senior m anage­
ment of firms and FMIs could set their own tolerances for
operational disruption, on the assumption that some (or all)
supporting system s and processes will fail. In setting impact
tolerances, the supervisory authorities suggest that a firm 's or
FM I's board or senior m anagem ent might prioritise those busi­
ness services which, if disrupted, have the potential to: threaten
the firm 's or FM I's ongoing viability; cause harm to consumers
and market participants; or undermine financial stability. The
section also highlights relevant existing regulatory standards
related to operational resilience that firms and FMIs are already
expected to meet.
6 Financial Stability Report, Ju n e 2018: https://w w w .bankofengland
.co.uk/financial-stability-report/2018/june-2018.
15. Section 5 expands the idea that firms and FMIs would
develop im pact tolerances for im portant business services.
These would provide clear metrics indicating when an opera­
tional disruption would represent a threat to a firm 's or FM I's
viability, to consumers and market participants or to financial
stability. The section discusses what impact tolerances are and
their purpose. To help inform the developm ent of the approach,
the supervisory authorities are particularly interested in metrics
firms and FMIs currently use.
16. Section 6 explains how supervisors could gain assurance
that firms and FMIs ensure the continuity of their most impor­
tant business services, and that boards and senior m anagem ent
are sufficiently engaged. The supervisory authorities are review ­
ing their existing approaches in light of the proposed focus on
business services, and are considering the role of scenario te st­
ing in this context.
17. Section 7 summarises the key concepts set out in the DP.
18. Section 8 is a com plete list of the questions in the DP.
19. This DP is part of the supervisory authorities' wider engage­
ment on this topic. Further dialogue on the financial sector's
operational resilience will occur through discussions with firms,
FMIs and other industry participants and through international
engagem ent.
20. A glossary of term s is provided in A nnex 1.
2 5 .2 O P E R A T IO N A L R E S IL IE N C E
O F B U S IN E S S S E R V IC E S
This section explains why the supervisory authorities consider
that managing operational resilience is most effectively
addressed by focusing on business services, rather than on sys­
tem s and processes. The section also explains that firms and
FMIs are more likely to be operationally resilient if they design
and manage their operations on the assumption that disruptions
will occur to their underlying system s and processes.
Focusing on Business Services
1. O p eratio n ally resilient business services provided by firm s
and FM Is d irectly sup p o rt resilient econom ic fu n ctio n s,7
enabling people to buy goods, borrow m oney and m arkets
7 A list of econom ic functions, defined for resolution purposes, was
set out in PRA Supervisory Statem ent 19/13. This list is reproduced in
A n n ex 2 of this DP to aid discussion.
Chapter 25 Building the UK Financial Sector's Operational Resilience
to tran sact. R esilient business services th erefo re support
financial stab ility.
2. The UK financial system is resilient if its economic functions can
continue to operate during potentially disruptive incidents at a
firm, FMI or across groups of firms. Resilience of the financial sys­
tem depends on both individual firms and FMIs and the intercon­
nections between them.
3. Continuity of business services is also critical to the viability
of individual firms and FM Is, and disruptions can cause harm to
consumers and market participants.
4. Th e sup erviso ry authorities b elieve that if firm s' and FM Is'
boards and senior m anagem ent focus on the operational
resilience of th eir m ost im portant business se rvices, this
would assist the sup erviso ry authorities in furthering their
o b jectives.
5. Priorities betw een firm s and FM Is and the sup erviso ry
authorities may not alw ays be aligned . It is possible that the
sup erviso ry authorities may believe that a disruption to a
business service would harm th eir o b jective s, w hile a firm or
FMI m ight co nsid er the disruption to be a m anageable risk.
Prioritising by Business Services
6. A business services approach is an effective way to prioritise
improvements to systems and processes. Firms and FMIs may cur­
rently prioritise the upgrading of their IT systems by: age; those
most prone to failure; anticipated cost of financial failure; or cost
of upgrade against available budget. Such considerations may be
inconsistent with an outcome focused on continuity of business
services. Looking at the systems and processes on the basis of
the business services they support may bring more transparency
to and improve the quality of decision making, thereby improv­
ing resilience. The supervisory authorities are keen to understand
which approaches to operational resilience firms and FMIs have
found most useful.
7. A focus on business services could help drive specific and
m easurable activities, including investm ent, that increase opera­
tional resilience. Firms and FMIs could set target metrics for the
continuity of im portant business services. Firms' and FMIs' abil­
ity to m eet their target metrics could then be tested, enabling
them to take action as necessary.
8. W hile this DP focuses on the delivery of business services,
operational disruption can also impact firm s' and FMIs' ability to
m eet other regulatory or contractual obligations. For exam ple,
firms are expected to ensure the confidentiality of data, or may
be required to provide tim ely and accurate financial reports.
Firms and FMIs also need an appropriate degree of resilience in
these and other areas.
■ 387
Building Resilient Business Services,
Assuming Disruption Will Occur
9. In order to build and deliver resilient business services, firms
and FMIs need the ability to: prevent disruption occurring to
the extent practicable; adapt system s and processes to continue
to provide services and functions in the event of an incident;
return to normal running promptly when the disruption is over;
and learn and evolve from both incidents and near misses. The
supervisory authorities consider that firms and FMIs would pay
attention to all of these aspects.
10. It is particularly im portant to plan on the basis that opera­
tional disruptions will occur. This is because it is not possible to
prevent every risk m aterialising, and dependencies are often
only identified once something has gone wrong. The assum p­
tion that operational disruptions will arise could be used to
inform strategy, planning and resourcing.
11. The supervisory authorities believe that an operationally
resilient firm or FMI would have in place:
• a clear understanding of their most im portant business ser­
vice or services;
• a com prehensive understanding and mapping of the systems
and processes that support these business services, including
those over which the firm or FMI may not have direct control.
This would include an understanding of the resilience of out­
sourced providers or entities within the same group but in
another jurisdiction;
• know ledge of how the failure of an individual system or
process could im pact the provision of the business service;
Business service: retail mortgages
Sales Application
1 i
Financial institutions
Organisational activities
i i
Business processes
i i
People Information
Technology Facilities
Fiq u re 2 5 .3 Understanding important business services.
388 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
• knowledge of which system s and processes are capable of
being substituted during disruption so that business services
can continue to be delivered;
• tested plans that would enable firms and FMIs to continue or
resume business services when disruptions occur;
• effective internal communication plans, escalation paths and
identified decision makers; and
• specific external communication plans for the most impor­
tant business services, which provide tim ely information for
custom ers, other market participants and the supervisory
authorities.
12. Firms' and FM Is' implementation of these elem ents would
be proportionate to their nature, scale and com plexity, as dis­
cussed in 'W hat this might mean for firms and FMIs in practice'
in Section 4.
13. Figure 25.3 illustrates the variety of system s and processes
that would need to be considered. This may be contrasted
with an incom plete view of resilience obtained by taking a
narrow focus on particular system s or processes considered in
isolation. In this exam ple, m ortgages are the im portant busi­
ness service, and there are a num ber of steps necessary from
origination through to custom er service. O nly by looking at all
of these stages— and where appropriate, at how elem ents of
this service get delivered by other parties— can a clear picture
be developed of how best to support the resilience of the
business service.
14. It would be neither possible nor an efficient use of resources
to attem pt to make every com ponent of an organisation com ­
pletely resilient to operational disruption. The supervisory
Underwriting Legal/valuation
i I
Third party
Organisational activities
Business processes
People Information
Technology Facilities
authorities recognise that firms and FMIs need to prioritise and
want this prioritisation to be well- considered and agreed at
the appropriate level. Under the approach outlined in this DP,
firm s' and FMIs' prioritisation would be informed by an effective
understanding of their most im portant business services and
underlying system s and processes.
Q u e stio n
A) W hat are readers' views on the proposed focus on con­
tinuity of business services? Would a service rather than
system s-based approach represent a significant change for
firms and FMIs com pared with existing practice? W hat other
approaches could be considered?
2 5 .3 O P E R A T IO N A L R E S IL IE N C E
O F FIR M S A N D FM IS *1
This section suggests that the boards and senior m anagem ent
of firms and FMIs would set impact tolerances for the opera­
tional disruption of business services, on the assumption that
some or all supporting system s and processes will fail. In set­
ting im pact tolerances, the supervisory authorities suggest that
a firm 's or FM I's board or senior m anagem ent might prioritise
those business services which, if disrupted, have the potential
to: threaten the firm 's or FM I's ongoing viability; cause harm
to consumers and m arket participants; or undermine financial
stability. The section also highlights relevant existing regulatory
standards related to operational resilience that firms and FMIs
are already expected to meet.
1. In view of the potentially severe consequences of poor
operational resilience, the supervisory authorities believe
operational resilience is a key issue on which boards and senior
m anagem ent should focus. A firm 's or FM I's resilience is the
result of its activities and choices, and will depend on its gov­
ernance, culture, corporate structure, controls and regulatory
fram ew ork.
2. To be effe ctive, boards and senior m anagem ent must
agree clear standards that they e xp e ct the execu tive of a
firm or FMI to m eet. Section 2 suggests that the supervisory
autho rities co nsid er th at they m ight best do this by focusing
on business services. Th e sup erviso ry authorities consider
th at boards and senior m anagem ent could go further by se t­
ting im pact to leran ces for disruption to the most im portant
business services.
3. An impact tolerance describes a firm 's or FM I's tolerance for
disruption to a particular business service, under the assumption
that disruption to the system s and processes supporting that
Chapter 25 Building the UK Financial Sector's Operational Resilience
service will occur. Impact tolerance is expressed by reference to
specific outcom es and m etrics. Such metrics could include the
maximum tolerable duration or volume of disruption, a measure
of data integrity or the number of custom ers affected.
4. Having im pact tolerances may help ensure that boards and
senior m anagem ent consider what the firm or FMI would do
when a disruptive event occurs, rather than only trying to mini­
mise the probability of disruption. This might include how to
handle the situation to minimise the consequences of disruption
as well as ensuring that the relevant business services continue
to be delivered within tolerance.
5. W hile an assumption that disruption will occur enables
greater clarity around the outcom e being sought, firm s and
FM Is may also need to think about the instances in which it
w ould, or would not, be acceptable to m eet a tolerance. This
DP describes such instances as scenarios.
6. The supervisory authorities may also consider setting their
own impact tolerances for firms or FMIs to m eet within the con­
text of severe, but plausible, scenarios.
7. In arriving at an im pact tolerance, boards or senior m anage­
ment would consider the commercial interests of the firm or FMI
and the objectives, rules, principles, expectations and guidance
of the relevant supervisory authorities. This section therefore
discusses:
• factors relating to the supervisory authorities' objectives that
are likely to be key com ponents in determ ining appropriate
im pact tolerances: when the viability of the firm or FMI is
threatened; the impact on consumers and market partici­
pants; and the impact on financial stability;
• existing rules, principles, expectations and guidance relat­
ing to operational resilience that firms and FMIs are already
required to m eet; and
• what this might mean for different types of firms and FMIs in
practice.
8. For the purposes of this DP, the supervisory authorities
envisage that how im pact tolerances are derived and justified
might be set out by firms and FMIs in a single docum ent-an
impact tolerance statem ent.
9. Firm s and FM Is could use th eir im pact to leran ces in
running th eir b usinesses: to take decisions on investm ents,
risk m anagem ent, business continuity planning and co rp o ­
rate structure. Section 5 discusses how im pact to leran ces
m ight be set and considered alongside existing risk ap p etite
statem en ts. The sup erviso ry autho rities are aw are that som e
firm s and FM Is may already be taking this approach, for
exam ple C P M I-IO S C O principles for financial m arket
■ 389
infrastructure (P FM I)8 indicate that an FMI should design and
te st its system s and processes to aim for the safe resum ption
of critical operations within tw o hours of a d isru p tio n ,9 but it
will be a new idea for o thers. It is also recognised that ind i­
vidual approaches to im pact to leran ces would be determ ined
by the nature, scale and co m p lexity of a firm 's or FM I's activi­
ties. Readers are encouraged to provide fe e d b ack on p rac­
tices that are already being em p lo yed, along with potential
difficulties in im plem enting the approach.
10. O nce im pact tolerances are set, they will be relevant to the
systems and processes supporting business services wherever
they are located. This includes the systems and processes of
outsourced service providers. This might require consideration
of the extent to which standards differ between jurisdictions. In
general, the impact tolerance for a particular business service
would still need to be met, regardless of the location of sup­
porting system s and processes.
Factors Relating to the Supervisory
Authorities' Objectives
Impact on the Viability of Firms and FMIs
11. Th e sup erviso ry authorities require firm s' and FM Is'
operations to be run in a sustainable m anner. Th e PRA
and the F C A , which prudentially supervises approxim ately
4 6 ,0 0 0 firm s, e xp e ct the firm s they sup ervise to run their
1n
businesses in a safe and sound manner. The Bank seeks to
ensure that FM Is operate in a safe w ay, in support of its
A A
financial stab ility o b jective . Prudently-run firm s and FM Is
should try to m aintain and increase th eir operational resil­
ience, particularly in response to evolving threats such as
cyber attacks.
12. The sup erviso ry authorities co nsid er firm s and FM Is
m ight assess their operational resilience in the co n text
of how disruptions to im portant business services m ight
threaten th eir ongoing viab ility. To identify business services
that support a firm 's or FM I's viab ility, boards and senior
8 A joint publication of the Com m ittee on Paym ents System s and Market
Infrastructures (CPM I) and the Technical Com m ittee of the International
Organization of Securities Com m issions (IO SC O ): w w w .bis.org/cpm i/
publ/d101a.pdf.
9 Principle 17.
10 The F C A is the prudential supervisor for approxim ately 46,000 firm s;
for 18,000 firm s, a regim e of minimum standards beyond both the prin­
ciple of business of financial prudence and the threshold condition of
appropriate resources exists.
11
Box 25.1 sets out the supervisory authorities' specific objectives.
390 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
m anagem ent m ight co nsid er which services, if d isrup ted ,
could lead to sig nificant loss of custom ers, m ajor financial
loss or reputational dam age. Exam p les m ight include: d is­
ruptions to the services that allow custom ers to tran sfer
funds betw een accounts; a bank not being able to extend
com m ercial fin an ce; an FMI not being able to co llect margin
paym ents; or an insurance com pany not being able to fund
and hedge its balance sheet.
13. Under requirem ents such as Internal Capital Adequacy
10 10
Assessm ent and Risk Control, boards and senior m anage­
ment should already be able to articulate those circum stances
which may lead to the firm 's or FM I's failure, develop their own
risk appetites and oversee delivery of risk mitigation. This
should include:
• an assessm ent of the adequacy of a firm 's or FM I's opera­
tional resources to maintain resilience, relevant to a firm 's or
FM I's ability to remain viable; and
• effective risk m anagem ent of their organisation, people, pro­
cesses and technology assets,1
14 all of which support the con­
3
1
2
tinuity of business service delivery during operational
disruptions.
Impact on Consumers and Market Participants
14. The supervisory authorities are also concerned by the poten­
tial harm that operational disruptions could cause to users of a
firm 's or FM I's business service, including both consumers and
market participants.
15. Harm to consum ers (such as an inability to access cash
deposits, savings, credit or other financial services) and harm to
market participants (such as an inability to price trades or to
com plete post-sale activities) arising from operational disrup­
tions is likely to manifest before risks to the viability of a firm or
FMI start to crystallise. As the FC A 's M ission15 requires it to con­
sider harm to consum ers, the FC A may engage with authorised
firms in relation to their m anagem ent of an operational disrup­
tion more frequently and at an earlier stage than the PRA, to
understand how they would seek to minimise the amount of
harm caused by operational disruption.
12 Internal Capital A d eq uacy Assessm ent Part of the PRA Rulebook:
w w w .prarulebook.co.uk/rulebook/Content/Part/211179/05-07-2018.
13 Risk Control Part of the PRA Rulebook: PRA w w w .prarulebook.co.uk/
rulebook/Content/Part/214146/05-07-2018.
14 For exam ple, B C B S Principles for the Sound M anagem ent of O p e ra­
tional Risk (B C B S 2011), PRA rulebook, Solvency II firm s, Conditions
Governing Business 3. Risk M anagem ent.
15 FC A , O ur Mission, April 2017: w w w .fca.org.uk/publication/corporate/
our-mission-2017.pdf.
 B O X 25.2: EXAMPLES OF HARM
Harm arising from operational resilience failures is illustrated
in the following exam ples. Some relate to the continuity of
business services, while others relate to the integrity of data.
Supply o f N e w Business Services:
• A retail bank's m ortgage application system fails to pres­
ent all relevant questions for custom ers or brokers to
answer, with the result that underwriting decisions start
to be based on incom plete disclosure. Harm m aterialises
in several ways: some m ortgage applications are rejected
and, once the error is detected, all the affected custom ­
ers experience delays while the additional information is
obtained from them .
Availability and Integrity o f Existing Business
Services:
• A software error results in duplicate Bacs Direct Debit pay­
ments being taken from custom ers' accounts. Some pay­
ees' bank accounts incur unauthorised overdraft charges.
What is Meant by 'Harm' in This Context?
16. Harm to consumers may arise, for exam ple, from disruption
to the:
• ongoing availability of existing business services, for exam ­
ple when claiming on an insurance contract, making loan
repaym ents, checking balances, or accessing deposits and
savings; and
• supply of new business services, for exam ple renewing a
general insurance contract, obtaining life insurance, receiving
a m ortgage advance or personal loan, or making a money
transfer.
17. Harm to m arket participants is concerned with the risks
that operational disruptions pose to the smooth operating of
financial m arkets and the potential threat to m arket confidence
that can result from a substantial disruption. Harm to m arket
participants and m arket integrity may arise from , for exam ple,
the failure of a shared facility or m arket infrastructure on which
the functioning of a m arket depends, uncontrolled access to
and misuse of m arket sensitive data, the inability to access
m arket data to price trad es, or the inability to com plete post­
sale activity.
18. The supervisory authorities invite discussion about how firms
and FMIs could be more active in assessing harm caused by
the disruption to business services. Identifying harm caused by
the disruption to business services could inform the setting of
im pact tolerances explained in Section 5.
Chapter 25 Building the UK Financial Sector's Operational Resilience
Some custom ers are unable to access cash when they
need it because their balances are incorrect.
• A system error at a consum er credit firm leads to inaccu­
rate (higher) debt repaym ent dem ands and consequential
effect on the custom ers' credit files.
Availability o f a Vital Link in a Value Chain:
• A custody bank is unable to confirm ownership of assets in
a tim ely way, which delays asset valuations, and sales can­
not be com pleted on the intended value dates.
• A disruptive event at a specialist trading venue prevents
trading of derivatives for a number of hours.
Unauthorised Access to Market Sensitive Data:
• A corporate liability insurer's file m anagem ent system is
upgraded. A fter the upgrade, all em ployees have access
to folders containing market sensitive data disclosed by
listed com panies, and the folder permissions error is not
identified for several months.
Impact on Financial Stability
19. The financial system com prises many participants who inter­
act to provide services to each other and the real UK econom y.
There are significant dependencies between participants. The
resilience of individual participants can thus depend on the
resilience of others, including the Bank (see Box 25.3). The resil­
ience of the financial system as a whole depends on the resil­
ience of individual participants and the interconnections that
exist between them .
20. Changing business models and increased outsourcing has
increased the dependence of participants on others, including,
in some cases, a limited number of technology providers, giv­
ing rise to concentration risk. This illustrates how, while tech­
nological innovation creates opportunities, including increasing
efficiency and enabling better risk m anagem ent, changing
technologies are also creating new risks. Cyber threats have
increased and have a greater propensity to be transm itted
between participants.
21. Supporting financial stability is reflected in each of the
supervisory authorities' objectives and their respective
approaches to supervision. The supervisory authorities do not
seek to ensure that no firm or FMI fails, but they do seek to
ensure that, in the event of failure, it is orderly and avoids sig­
nificant disruption to the UK economy.
22. Firm s and FM Is should consider the im pact of disruption
within th eir own businesses on consum ers and m arket
■ 391
 B O X 25.3: B U IL D IN G O P E R A T IO N A L R ESILIEN C E; THE B A N K A S A P R O V ID E R
OF PAYMENT A N D SETTLEM ENT SYSTEMS
The Bank recognises that it has its own part to play in build­
ing the operational resilience of the UK financial sector as
operator of the C H A PS and RTGS services. RTGS processes
an average of over £600 billion worth of transactions every
working day, of which approxim ately half is C H A PS settle­
ment. Firms and FMIs rely on the Bank's provision of these
services to move sterling around the financial market and the
real econom y.
The C H A PS paym ent system is used for high-value w hole­
sale paym ents as well as tim e-critical retail paym ents. The
Bank's RTG S settlem ent infrastructure holds accounts for
banks, building societies and other institutions. The Bank's
operational function holds itself to high standards and is
com m itted to a very low tolerance for any disruption to the
RTG S and C H A P S services. A s the operator of C H A P S , the
Bank is the 'system ic risk m anager' for the C H A PS system , a
role that includes understanding and managing risks across
the end-to-end C H A PS system . The Bank's operation of
C H A PS is independently supervised by the Bank's FMI
participants which rely upon them , and take this into
account when considering their approach to operational
resilience.
Existing Regulatory Requirements and
Expectations for Firms and FMIs
23. The supervisory authorities consider that setting impact
tolerances could play an im portant part in increasing the opera­
tional resilience of firms and FMIs. These would support existing
regulatory expectations and obligations. The supervisory author­
ities are reviewing the existing regulatory fram ework in the light
of the overall approach set out in this DP, and with regard to
existing international, European Union and dom estic require­
ments and regulatory fram eworks.
24. Each supervisory authority is responsible for a spectrum of
firm s or FM Is and each has its own rules, principles, e xp e cta­
tions, or guidance. N evertheless, common regulatory them es
apply across regulated entities including individual and col­
lective accountability for m atters that support operational
resilience. This is generally achieved by rules, principles,
expectations, or guidance on: m anagem ent and governance;
risk m anagem ent; internal controls for system s and pro­
cesses; contingency planning; and oversight of outsourcing
arrangem ents.
392 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
D irectorate on a non-statutory basis against the sam e stan­
dards as other paym ent system s.16*The Bank's Banking, Pay­
ments and Financial Resilience D irectorate also self-assesses
RTGS and C H A PS against the C PM I-IO SC O Principles for
Financial M arket Infrastructures annually. For RTG S, the Bank
com m issions an ISA E3402 external control audit and holds
an ISO 27001 certificate.
The Bank sets access criteria for firms that want direct access
to C H A PS, as well as operational and technical requirements
for RTGS and C H A PS. Assurance is sought from CH APS
Direct Participants that they m eet the rule book's require­
ments, com plem ented by a rigorous testing regim e. Require­
ments cover areas such as day-to-day operations; resilience
and contingency; technical m aintenance; network connectiv­
ity; and physical, environmental and information security.
Strengthening the resilience of RTGS and its flexibility to
respond to emerging threats is a key focus of the programme
to renew the RTGS service and supporting infrastructure.
25. Som e of the existing rules and standards are sum m arised
below. Those listed here cover key policy areas only and may
not necessarily be applicable to all firm s and FM I. Box 25.4
provides an exam ple of how som e existing regim es interact to
support operational resilience.
Existing Regulatory Requirements Relating
to the Viability of Firms and FMIs
M anagem ent and G overnance
26. An effective board is critical to ensuring a sound and
well-run business. The supervisory authorities set expectations
of the boards and senior m anagem ent of regulated firm s
and FM Is to run their businesses prudently and in support
of their objectives, including the continuing stability of the
financial system .
27. Boards should ensure there is sufficient challenge to
the executive and that they have access to people within
the business with appropriate technical skills. They should
16 See Box 2 of the 'Bank of England's supervision of financial m arket
infrastructures-annual report' for further explanation: w w w
.bankofengland.co.uk/news/2018/february/supervision-of-financial-
m arket-infrastructures-annual-report-2018.
 B O X 25.4: IN T E R A C T IO N O F R E G IM E S
The regulatory fram ework already features many require­
ments that help build the operational resilience of firms and
FM Is. A brief explanation of how the supervisory authori­
ties see the relationship between operational resilience and
policies on operational continuity in resolution and capital
requirem ents for operational risk is set out below.
Operational Resilience, Operational Continuity
in Resolution and Operational Risk
This DP on operational resilience is focused on the continuity
of business services and econom ic functions. The approach
set out in this DP includes an assumption that disruptions
to system s and processes will occur and focuses on firms'
and FM Is' responses to these disruptions. Tim e-to-recover
is often a key metric. O perational resilience is an outcome
which em erges from a wide array of practices and disciplines
undertaken by firms and FMIs.
Some of the UK's largest banks and building societies are
subject to the PRA's operational continuity in resolution
(O CIR) policy.17 O C IR policy aims to ensure the continuity of
critical functions, from an operational perspective, through
severe stress and resolution. It is similar to operational
also ensure the recruitm ent and training of suitable people
for relevant executive roles, drawing on additional skills
where relevant.
28. The PRA's Senior Managers and Certification Regime (SM&CR)
requires relevant firms to have a Senior Management Function
(SMF) responsible for the internal operations and technology of a
firm, SM F 2 4 .18 This includes operational resilience, cybersecurity
and operational continuity. The PRA and FC A have consulted on
the creation of an equivalent SM F as part of the extension of the
SM&CR to insurers, to be effective on 10 Decem ber 2018,19 and
FC A solo-regulated firms (FC A CP17/40). In respect of FC A solo-
regulated firms, this SM F would apply in 'enhanced firms', which
are generally those that are larger and more complex.
17 PRA Policy Statem ent 21/16 'Ensuring operational continuity in reso­
lution', Ju ly 2016: w w w .bankofengland.co.uk/prudential-regulation/
publication/2014/ensuring-operational-continuity-in-resolution.
18 PRA Supervisory Statem ent 28/15, 'Strengthening individual account­
ability in banking', May 2017: w w w .bankofengland.co.uk/prudential-
regulation/publication/2015/strengthening-individual-accountability-
in-banking-ss.
1o
Final policy published Ju ly 2018: w w w .bankofengland.co.uk/
prudential-regulation/publication/2018/strengthening-individual-
accountability-in-insurance-extension-of-the-sm cr-to-insurers.
Chapter 25 Building the UK Financial Sector's Operational Resilience
resilience in its focus on the continuity of services, but is nar­
rower as it focuses specifically on stress and resolution, and
events that might occur in those circum stances. O C IR policy
includes requirements to have resolution-proof contracts with
third parties and for firms to be able to map critical services
supporting critical functions.
Operational risk refers to the risk associated with inadequate
or failed processes, people or systems or from external events
including legal risk. It includes consideration of both the
severity of impact and the likelihood of loss occurring, in the
broader context of the requirement on firms to manage their
businesses prudently, or for those firms to whom the Capital
Requirements Regulation (CRR) applies, requiring capital to be
held against operational risks. In the latter case, the policy
aim is to minimise the impact and likelihood of such losses.
Loss can include financial loss and loss of availability or confi­
dence. Regulation relating to operational risk has tended to
focus on minimising the probability of risk events occurring
and ensuring firms can absorb financial losses when they do
occur. Good operational risk management and the holding of
capital against potential operational losses will help build oper­
ational resilience, but the ability to withstand financial loss is
not sufficient in itself to ensure continuity of business services.
29. Similarly for FM Is, the PFM I2
21 recommend that FMI boards
0
should explicitly define the roles and responsibilities for address­
ing operational risk and the FM I's operational risk-management
fram ework.
R isk M anagem ent
30. Risk m anagem ent should cover all typ es of risk, includ­
ing o p eratio n al, and firm s and FM Is are exp e cte d to id en­
tify, m onitor and m anage the risks they are or m ight be
exp o sed to.
31. FMIs in particular are encouraged to consider threats such as
natural disasters, terrorism , pandem ics and cyber attacks. FMIs
are also expected to assess the evolving nature of the opera­
tional risks they face on an ongoing basis so they can analyse
potential vulnerabilities and im plem ent appropriate defence
mechanisms.
20 Capital Requirem ents Regulation (575/2013) (CRR), A rticle 4.1(52):
https://eur-lex.europa.eu/legal-content/EN /TXT/PD F/?uri= C ELEX:32013
L0036& from =EN.
21 Principle 17 (O perational risk), consideration 2, of the C PM I-IO SC O
PFM I: w w w .bis.org/cpm i/publ/d101a.pdf.
■ 393
Internal C ontrols
32. To deliver a firm or FM I's board-led strategy and direction,
boards and senior m anagem ent must be able to exercise appro­
priate oversight and be confident their direction is being carried
out. This requires an effective internal control fram ework for
prioritisation, undertaking specific activities, internal reporting
and escalation.
33. The supervisory authorities' existing rules, principles, exp ec­
tations and guidance already require firms and FMIs to manage
their affairs in a responsible manner, which includes having ad e­
quate control systems in place. Effective internal controls should
ensure firms' and FM Is' core businesses are managed appropri­
ately, and that risks are dealt with.
B u sin ess C ontinuity and C on tin g en cy Planning
34. The supervisory authorities have requirem ents of firms and
FMIs to undertake appropriate contingency planning. Effective
prior planning for when something goes wrong enables firms
and FMIs to deal more efficiently with issues when disruptions
occur, potentially reducing their impact.
35. The supervisory authorities also require firms and FMIs to
maintain continuity plans explaining how they will respond and
recover following disruption. The approach in this DP could
require alignm ent of these plans with firm s' and FM Is' most
im portant business services and explanation of how they would
continue to operate.
O utsourcing and Critical S e rv ice P ro vid e rs
36. Boards' and senior m anagem ents' oversight also needs
to cover any activities outsourced to third-party providers, for
exam ple cloud service providers. W hile outsourcing can enable
firms and FM Is to m anage risks more effectively and at a
reduced cost, it can also give rise to new risks for which they
remain responsible.
37. Boards' and senior m anagem ents' o versig ht also needs
to include identification and understanding of the firm 's
or FM I's reliance on critical service pro vid ers. Th ese are
third party services critical to the continuous and adequate
functioning of the firm 's or FM I's o p eratio n s, for exam ple
inform ation tech n o lo g y, telecom m unications and m essaging
services.
38. Indeed, existing rules require dual-regulated firms to
avoid reducing the level of control or introducing additional
risk through outsourced arrangem ents. Similarly, FMIs are
expected to deal with outsourcing in a prudent way and ensure
that outsourced and critical service providers m eet the same
requirem ents as internally provided services.
394 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Existing Regulatory Requirements Relating to Harm
39. Existing requirements relevant to harm caused by operational
resilience come from different legal sources. These include:
domestic legislation, such as provisions in FSM A; sector-specific
legislation, such as the Payment Services Regulations 2017; super­
visory authorities' rules and guidance; and directly applicable
European legislation.
40. Existing requirem ents include obligations on firm s and
FM Is to put in place risk m anagem ent system s and business
contingency or continuity arrangem ents. The supervisory
authorities invite discussion about w hether the way that firm s
approach existing requirem ents is com patible with identifying
and preventing harm caused by disruption to business services.
Com m unications Plans
41. The supervisory authorities have been considering the role
of communications plans used at tim es of operational disrup­
tion. These can be im portant in mitigating consum er harm. It is
im portant that business continuity policies include prompt and
meaningful communication arrangem ents for internal and exter­
nal parties, including supervisory authorities, consum ers, other
clients and the press. The supervisory authorities are considering
whether there should be specific rules or further guidance on
the content of communications plans. For exam ple, the plans
could address how to get hold of key people, how to contact
operational staff, and how to contact consum ers, suppliers, and
the supervisory authorities.
42. The supervisory authorities recognise that harm may also
arise from the loss of, or unauthorised access to, personal, finan­
cial and other sensitive data relating to consumers and market
participants. The obligations on firms under, for exam ple, the
General Data Protection Regulation (G D PR)22 will be relevant to
operational resilience.
Existing Regulatory Requirements Relating
to Financial Stability
43. FMIs are typically unique in the services they provide to
other market participants and are an integral part of almost
all financial transactions. The financial system has a significant
dependency upon them . Given their role and the obligations
this creates, FMIs have an im portant role to play in promoting
financial stability.
22 Regulation (EU) 2016/679 O f The European Parliam ent And O f The
Council of 27 April 2016 on the protection of natural persons with
regard to the processing of personal data and on the free m ovem ent of
such data, and repealing Directive 95/46/EC (General Data Protection
Regulation): https://publications.europa.eu/en/publication-detail/-/publi
cation/3e485e15-11 bd-11e6-ba9a-01aa75ed71 a1/language-en.
 B O X 25.5: M A N A G IN G RISKS IN T H E E N D - T O - E N D
A payments network connects a number of participants:
the end users that want to make or receive paym ents; the
banks that hold the end-users' accounts and initiate the pay­
ment process following their custom ers' instruction; and the
payments system operator (FMI) that connects the banks
to enable the payments to be processed, transferred and
settled.
The resilience and robustness of the network depends on
both the processes and system s of each participant and the
nature of the connection between each participant. Threats
to the network could be introduced by any participant and
com m unicated to others via the network's connections.
If participants have concerns about the resilience of the pay­
ments network, their own resilience or the resilience of other
participants, each of them may im plem ent additional controls
before releasing payments or may limit or halt processing
44. The Bank expects FMIs to comply with the PFM I.23 The PFMI
were designed to enhance the safety and efficiency of FMIs, but
more broadly, to limit systemic risk and foster transparency and
financial stability. In this regard they include a principle that an
FMI's governance arrangements should support financial stability.
45. Specifically to manage system ic risk, an FMI should review
the risks that it bears from others as a result of interdependen­
cies, and develop appropriate risk m anagem ent tools. To this
end, FMIs impose and monitor standards and disciplines at
their m em bers to improve the robustness and resilience of the
service provided. These typically include satisfying the FMI that
adequate security and resiliency arrangem ents are in place,
including technical requirem ents (eg around messaging) to
access the FM I's infrastructure. FMIs should then have proce­
dures to ensure their members continue to m eet the standards
for m em bership.
46. FMIs should also work with their members to enhance stan­
dards and minimise the adverse effects of disruption when it
occurs. The standards need to be complementary to any regula­
tory standards, but it is also the case that these standards might
need to be more rigorous or be more granular to enable the
FMI to meet fully its obligations to its members and regulators.
Box 25.5 provides an example of how an FMI could work together
with its participants and other stakeholders to mitigate risk to
financial stability.
23 The PFMI are form ally applied to Central Counterparties and Central
Securities D epositories through the European regulatory regim es (EM IR
and CSD R). There is, however, no equivalent legislative fram ew ork
applying the PFMI to paym ent system s.
Chapter 25 Building the UK Financial Sector's Operational Resilience
PR O C E SSIN G O F PA Y M E N T S
paym ent instructions. When confidence in the integrity of
the entire system has been lost, such individual precaution­
ary controls could, in aggregate: create significant gridlock in
processing paym ents; reduce overall liquidity in the financial
m arkets; and potentially cause a build-up of unsettled posi­
tions and bilateral credit exposures among financial institu­
tions. In extrem e circum stances these actions could ultimately
im pede econom ic activity and disrupt financial stability. The
existence or fear of fraud and weaknesses in security arrange­
ments could also be reasons for concern by participants.
Individual firms and FMIs are responsible for their own robust­
ness and security. However, it is important that participants
work together to deliver the resilience of the end-to-end
processing of payments within the network. This is a good
exam ple of how an FMI can work together with its participants
and other stakeholders to mitigate risks to financial stability.
What This Might Mean for Firms
and FMIs in Practice
47. The supervisory authorities consider the ideas in this DP to
be applicable to all types of firms and FMIs. The application of
these ideas will, however, differ depending upon the nature and
com plexity of the relevant firm or FM I, including its size, activi­
ties and level of interconnectedness (and hence its impact on
others and the financial system). Generally, all firms and FMIs
would be considering two aspects in determ ining whether sig­
nificant change is required by any future policy:
• Have they identified their business services in a way that per­
mits the firm or FMI to link their activities to their business
objectives and the objectives of the supervisory authorities?
• Have they appropriately prioritised between business ser­
vices to ensure the most im portant ones are resilient to
operational disruption?
48. Figure 25.4 illustrates the steps firms and FMIs could go through
if policy were to be developed along the lines set out in this DP.
Large Firm s and F M Is
49. Large firms are likely to have many business services, while
FMIs typically have a single business service which is likely to be
significant to financial stability. There are numerous ways disrup­
tions to business services could im pact the supervisory authori­
ties' objectives.
50. Such firms and FMIs could be expected to consider their
impact tolerances for their most im portant business services. In
doing so, the supervisory authorities could also expect them to
■ 395
 Identify the most important business services and how much disruption could be tolerated
in what circumstances

the systems and processes that support these business services

how the failure of an individual system or process could impact the business service
Assess

using scenarios and by learning from experience, that resilience meets the firm's tolerance

Invest in ability to respond and recover from disruptions through having appropriate
systems, oversight and training
timely information to internal stakeholders, supervisory authorities, customers,
counterparties and other market participants
Fiq u re 2 5 .4 Improving operational resilience.
Firms and FM Is could consider the following issues. To be effective, the process would need to be repeated routinely, with lessons learned incorpo­
rated into each iteration.

take into account the work of the FPC , consider their contribu­
tion to econom ic functions, and use any FPC impact tolerances
to inform their own im pact tolerances. They could test them ­
selves regularly against their own severe but plausible opera­
tional scenarios. They could also ensure that they have
co-ordinated communications plans for internal functions, the
supervisory authorities, consumers and other market partici­
pants should tolerances be breached. As set out in the June
2018 FSR, some firms and FMIs may also be the subject of
stress testing developed by the Bank and the PRA, with input
from the FPC .
51. The supervisory authorities could review the work these
firms and FMIs undertake in relation to operational resilience
on a regular basis, and provide feedback as appropriate. If the
supervisory authorities identify concerns, they could take further
targeted action, with specific assessm ents of certain areas and,
if necessary, request remedial action.
52. In many instances, the ideas discussed in this DP are a natu­
ral extension of what large firms and FMIs and the supervisory
authorities already do.
most important business services. Identifying these two services,
and assuming disruptions to them will occur, could support a
smaller firm 's own risk m anagem ent and the setting of appropri­
ate impact tolerances.
55. Such firm s could undertake som e lim ited testing of their
operational resilien ce, based on their own scenario s. A p re­
designed scenario provided by the sup erviso ry authorities
may also be of use. Testing could be designed to reveal,
for exam p le, w hat im pact an incident would have on a
firm 's custom ers for a sp e cific business service and other
co nnected business se rvices, as w ell as how the continuity
planning arrangem ents seek to m itigate or prevent harm
to consum ers.
56. Firms could then address any deficiencies identified. This
could include: ensuring joined up communications between all
relevant functions within the firm (such as the business area that
owns the data, customer services, operations, technology, and
any third party providers); providing customers with information
and advice; and prioritising assistance to customers exposed to
the greatest harm.

Sm all o r M id-Sized Firm s
53. Sm aller firm s are likely to only have a few business services,
not all of which will be im portant to the firm s' viability, have
the potential to cause harm to consum ers, or im pact on finan­
cial stability. N evertheless, som e business services may be
pivotal to the firm or even to the w ider econom y. There is
likely to be a w ide range of different business services across
the sector.
54. A small bank or building society might identify operating
customer savings accounts and the provision of mortgages as its
57. The supervisory authorities could review the work such firms
undertake on a periodic basis. But it is less likely such firms
would be required to undertake further supervisory authority led
review work, unless the supervisory authorities have particular
cause for concern.
V ery Sm all Firm s
58. The sm allest firms, such as financial advisors with few
em ployees, are likely to only have few — perhaps only
one— im portant business services. Such firms are also likely to
have limited resources to increase their operational resilience.

396 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
59. Nevertheless, the supervisory authorities consider the pro­
posed fram ework could still be relevant and beneficial. They
envisage such a firm could:
• identify 'financial advice' as its im portant business service;
• identify how long it could operate as a business without
providing that service;
• consider the system s and processes it relies on— for
instance access to financial products and communication
to clients; and
• consider how these processes could be duplicated in the
event of some type of disruption, the length of tim e it might
take to set up alternative arrangem ents, and whether prior­
planning would be useful.
60. Such firms are likely to have limited supervisory engagem ent
in this area. N evertheless, thinking about the issue of opera­
tional resilience and what alternative arrangem ents could be
made may still be beneficial.
Q u e stio n s
B) How do boards and senior m anagem ent currently prioritise
their work on operational resilience?
C) W hat changes are firms and FMIs planning to make to
strengthen operational resilience over the next few years?
How involved are board m em bers in the planning, im ple­
mentation and em bedding of any changes? W hat are the
likely benefits and costs involved?
2 5 .4 C L E A R O U T C O M E S F O R
O P E R A T IO N A L R E S IL IE N C E
This section expands the idea that firms and FMIs would
develop im pact tolerances for im portant business services.
These would provide clear metrics indicating when an opera­
tional disruption would represent a threat to a firm 's or FM I's
viability, to consumers and market participants or to financial
stability. The section discusses what impact tolerances are and
their purpose. The supervisory authorities are particularly inter­
ested in metrics firms and FMIs currently use.
1. As discussed in Section 2, the supervisory authorities consider
that there is a benefit in boards and senior management having
a clear understanding of the level of resilience required for their
most important business services. To achieve this, they would
need to be able to identify the relative importance of business
services and be able to articulate the clear outcomes required.
2. The supervisory authorities envisage that the relative impor­
tance of business services can be derived by boards and senior
Chapter 25 Building the UK Financial Sector's Operational Resilience
management considering a firm's or FMI's business interests
alongside the supervisory authorities' objectives. A business service
that, if disrupted, represents a threat to a firm's or FMI's viability
is clearly important— likewise, a business service that, if disrupted,
could cause consumer harm, or impact financial stability.
3. The supervisory authorities are considering w hether firms
and FM Is should be required to set m etrics that describe an
intolerable level of disruption to their most im portant busi­
ness services, in a severe but plausible stress scenario— im pact
tolerances. As discussed in Section 4, it is im portant to note
that the im pact tolerance would apply to the provision of the
business service as opposed to the system s and process that
support it.
4. The supervisory authorities envisage that firms and FMIs would
determine their own impact tolerances. A firm or FMI would need
to be able to explain how the particular impact tolerance has been
arrived at for an important business service, how it relates to the
supervisory authorities' objectives, and in which scenarios a breach
of impact tolerances could be acceptable. These are likely to be
limited to the most severe, but plausible, scenarios.
5. Scenarios are im portant because they introduce proportional­
ity. They indicate how severe a disruption the firm or FMI antici­
pates being able to withstand, while remaining within its impact
tolerance. This is illustrated in Figure 25.5 in Case 1, where Sce­
nario 4 is so severe that it would be disproportionate for a firm
or FMI to stay within their im pact tolerance. Case 2 shows where
a firm or FMI might need to improve the system s and processes
supporting the business service, as less severe scenarios would
breach their impact tolerance.
6. Impact tolerances would need to be expressed clearly and
would be separate from any risk appetites or recovery time
objectives (RTO ). Impact tolerances express an upper limit
where a breach is to be avoided in all but the most extrem e
scenarios. Risk appetites and RTO s, on the other hand, tend
to express a desired outcom e that is achieved with high
probability. The supervisory authorities anticipate that firms and
FMIs would be able to explain the relationships between the
impact tolerances, risk appetites and RTOs they have set and
that the approaches are com plem entary.
7. As an exam ple of an impact tolerance in practice, the Bank
sets a tim e and volume-based impact tolerance as operator of
C H A P S .*1
24 The Bank states that all payments (volume) should be
24 See also the PFM I. Principle 17 (O perational risk) indicates that an
FMI should aim to resume operations within two hours following a dis­
ruptive event and com plete settlem ent by the end of the day, even in
extrem e circum stances.
■ 397
 Case 1: A firm or FMI considers its impact tolerance against Case 2: A firm or FMI considers its impact tolerance against
severe but plausible scenarios. Operational resilience is sufficient - severe but plausible scenarios. In this case, operational resilience
it is disproportionate to expect the firm or FMI not to breach its is not sufficient - the firm or FMI should take steps to improve
impact tolerance in the extreme scenario of scenario 4 . operational resilience.

Scenario 4 Scenario 4

1/1

_Q
Scenario 3 Scenario 3

<
uD
c
ru
i—
Scenario 2 _QJ Scenario 2
O
Scenario 1
Scenario 1
Low Low
---- ► —►
2 Day 2 Day
Time Time
outage outage

Key
• Scenario recovered within tolerance • Scenario recovered within tolerance
• Scenario not recovered within tolerance • Scenario not recovered within tolerance

Fig u re 2 5 .5 Combining impact tolerances and scenario testing to establish a proportionate level of operational
resilience.

settled by the end of the operating day (time) in all, even
Qr
extrem e, circum stances. The supervisory authorities envisage
that firms and FMIs may need to establish tim e-based impact
tolerances for services such as transferring funds between
accounts, the processing of m ortgages, and the ability to per­
form collateral m anagem ent.
for the most important business services, the supervisory authori­
ties seek to provide a focus for some of the existing work many
firms and FMIs will already be doing. For instance, firms and FMIs
would still set board-agreed risk appetites, but the supervisory
authorities consider these could be better informed by detailed
impact tolerance statem ents focused on the most important busi­
ness services. Similarly, there is still likely to be a need for setting

Current Approaches performance metrics on individual systems and processes which

support delivery of these services.
8. Many firms and FMIs will already be setting their own risk
9. The supervisory authorities are interested in understanding
appetites.*26 In suggesting the introduction of impact tolerances
how the approach outlined above differs from firms' or FMIs' cur­
rent activities. In particular, the supervisory authorities are keen to
nr
The Bank's tolerance is in line with Principle 17 of the PFM I, that understand what types of metrics firms and FMIs use and which
requires an FMI to aim to resume operations within two hours following
have proved most useful— whether these metrics relate to service
disruptive events, and to com plete settlem ent by the end of the day,
even in extrem e circum stances. downtime, volume of transactions, or anything else.

26 In line with the Basel Com m ittee on Banking Standards' Principles for
the Sound M anagem ent of O perational Risk (Principle 4 w w w .bis.org/
publ/bcbs195.pdf), the Basel Com m ittee and International Organization Potential Benefits of Setting Impact
of Securities Com m issions' joint Principles for Financial M arket Infra­
structures (Principle 2, w w w .bis.org/cpm i/publ/d101a.pdf), and EIO PA
Tolerances
G uidelines on System of G overnance (Guideline 19 (Operational Risk
10. The supervisory authorities consider that setting impact tol­
M anagem ent Policy): https://eiopa.europa.eu/Publications/Guidelines/
Fin al_EN _S o G _C lean .p d f). For PRA-regulated firm s, see PRA Supervisory erances for the most im portant business services could:
Statem ent 5/16 'Corporate governance: Board responsibilities', May
2016, w w w .bankofengland.co.uk/prudential-regulation/publication/2016/ a. support firms and FMIs in prioritising investm ent and
corporate-governance-board-responsibilities-ss. resource allocation;

398 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 b. provide a clear scope when firms and FMIs want to test
their own resilience; and
c. provide a focus for supervisory engagem ent.
11. By setting and articulating a clear im pact tolerance at
the business service level, it is possible to define alternative
processing procedures that can be deployed in case of dis­
ruption to system s and processes in order to remain within
im pact tolerance. An additional benefit is that it is possible
for firm s to also consider substitute options more broadly.
For exam ple, paym ents could be routed via other paym ent
schem es in order to remain within im pact tolerance, although
this may not be econom ically feasible or straight forward at
present for many firm s.
12. An im pact to leran ce approach could also address
other facto rs. For instance, firm s and FM Is may need to
m aintain policies for prioritising the provision of a certain
level of service in the event of a disruption. This will depend
on the typ e and severity of the operational disrup tion, and
the particular im pact the disruption would have. For exam p le,
if a bank sets an im pact to leran ce of delivering a p ercen t­
age of total paym ent transactio ns during a disruption, it
would also need a protocol for prioritising paym ents. Banks
could process paym ents in order of arrival, or prioritise time-
critical paym ents such as house purchases or paym ents to
vulnerab le p eo p le.
13. W hile an im pact tolerance is likely to focus on performance
during a single operational disruption, firms and FMIs could
also analyse business service delivery over a longer time period
to inform their wider risk m anagem ent. Analysis could include
the number of outages in a year, the total length of tim e that a
business service was impaired and the volume of transactions
disrupted.
Q u e stio n s
D) W hat are readers' views on the possibility of firms and FMIs
being asked to set im pact tolerances for their most impor­
tant business services?
E) W hat approach and m etrics do firm s and FMIs
currently use?
F) If these proposals would require some firms and FMIs to
update part of their existing risk m anagem ent fram ework,
what would this involve?
G) W hat are readers' views on producing an impact tolerance
statem ent as described? W hat relevant operational resil­
ience risk m anagem ent docum entation do firms and FMIs
already produce, and how does this differ from im pact toler­
ance statem ents?
Chapter 25 Building the UK Financial Sector's Operational Resilience
25.5 S U P E R V IS O R Y A S S E S S M E N T
O F O P E R A T IO N A L R E S IL IE N C E
This section explains how supervisors could gain assurance that
firms and FMIs ensure the continuity of their most important
business services, and that boards and senior m anagem ent are
sufficiently engaged. The supervisory authorities are reviewing
their existing approaches in light of the proposed focus on busi­
ness services, and are considering the role of scenario testing in
this context.
1. Th e sup erviso ry authorities anticip ate that a focus on
the operational resilience of firm s' and FM Is' m ost im por­
tant business services will offer the opp o rtunity to review
and consolid ate existing sup erviso ry tools and assessm ent
p ractices.
2. A future supervisory approach could cover four broad areas,
taking into account the specificities of the relevant regulatory
regimes for firms and FMIs:
• sector-wide work, including any potential stress testing devel­
oped by the Bank and the PRA with input from the FPC ;
• supervisory assessm ent of how firms and FMIs set and use
im pact tolerances;
• analysis of system s and processes that support business ser­
vices; and
• assurance that firms and FMIs have the capabilities to deliver
operational resilience and are in com pliance with existing
rules, principles, expectations and guidance.
3. The sup erviso ry authorities can dep loy a range of e x ist­
ing tools to d eliver the above, including questionnaires.
The sup erviso ry authorities are seeking to develop their
existing sup erviso ry approach in a targ eted and p ro p o rtio n­
ate manner.
4. Such an approach could provide the supervisory authori­
ties with a layered understanding of both the resilience of
individual firm s and FM Is, and the financial resilience of the
UK econom y.
Sector-Wide Work
5. As discussed in the June 2018 FSR (see Box 25.2), a stress­
testing approach will be developed by the Bank and the PRA,
with input from the FPC .
6. In addition, the supervisory authorities already help to coor­
dinate the sector exercising programme sponsored by the
Cross M arket O perational Resilience Group (C M O R G ), which
is chaired by the Bank and industry. These voluntary exercises
rehearse collective response m echanisms, including testing
■ 399
of communication lines, co-ordination arrangem ents and
decision-making processes. Participants are the supervisory
authorities, Governm ent, and firms and FMIs at the core of the
financial system . The aim is that in a real event the participants
are fam iliar with the actions they need to take, and that the
mitigating actions are im plem ented efficiently to achieve the
desired outcom es.
7. These exercises also identify ways in which collective response
arrangem ents might be strengthened. Several sector-wide exer­
cises have been organised in the past to rehearse the sector's
response to bomb threats, flu pandem ic, severe w eather and
travel disruption. More recently the supervisory authorities simu­
lated and tested the industry's response to an extended outage
of the Bank's RTGS system .
8. The supervisory authorities also participate in technical desk­
top exercises organised by the sector. These aim to assess the
potential impact from m arket disruption and consider how it
may be mitigated in a major event. Some of these exercises
have led to the developm ent of industry-owned resilience play-
books, which set out coordinated approaches to dealing with
particular scenarios.
Reviewing How Impact Tolerances
Are Set and Used
9. The supervisory authorities are considering how to review
the setting of impact tolerances, whether there is clear gov­
ernance and accountability, and how the impact tolerances
are tested. The translation of impact tolerances into actual
investm ent decisions and contingency planning is of particular
interest.
10. The supervisory authorities envisage im pact tolerance
statem ents being the responsibility of individual firm s and
FM Is, and would look to them to explain how their im pact
tolerances link to their ongoing viability, the potential harm to
consum ers and m arket participants, and any potential im pact
on financial stability. The supervisory authorities m ight not
agree with a firm 's or FM I's im pact tolerance statem ent. This
might be because the supervisory authorities have more infor­
mation than the firm or FM I, or because the relevant authority
m akes a different judgem ent. In such cases, the appropriate
supervisory authority would ask the firm or FMI to revise its
im pact tolerance.
11. The supervisory authorities may also consider setting their
own impact tolerances for firms or FMIs to m eet within the con­
text of severe, but plausible, scenarios.
400 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Analysis of Systems, People and
Processes that Support Business Services
12. The supervisory authorities would seek to gain further
assurance that firm s and FM Is have taken appropriate tangible
steps to increase their operational resilience. A t a m inimum,
firm s and FM Is would be able to map the system s, people
and processes that support their business services. This
would include d ep end encies outside of their firm and not be
restricted by geography. They would also ensure that they
have appropriate com m unications plans in place, for when
disruption to a business service occurs.
13. As explained earlier in this DP, the assum ption of fa il­
ure is likely to be fundam ental to the supervisory authorities'
approach. The supervisory authorities m ight focus on the back­
up system s, redundancies, substitutability arrangem ents and
other m easures firm s and FM Is have put in place and the
exten t to which a firm or FMI has self-assessed its resilience
using scenarios. Supervisors m ight also conduct targeted
assessm ents of firm s' and FM Is' operational infrastructure,
activities, decision-m aking and their supporting data.
Gaining Assurance that Firms and
FMIs Have the Capabilities to Deliver
Operational Resilience
14. The overall resilience of firm s and FM Is is the result of
how all their p ractices, processes and culture— co llectively
'cap a b ilitie s'— com bine to allow them to adapt and respond
to operational disruption. A s part of this approach, the super­
visory authorities would consider how effective the board
is in providing governance and leadership to their organ­
isation's resilience w ork, and in developing the necessary
cap ab ilities.
15. The supervisory authorities would be likely to use firms' and
FMIs' own risk m anagem ent as a starting point for operational
resilience supervision. They are also considering setting sce­
narios for firms to test (not dissimilar to some of the current
elem ents of the PRA's capital fram ework). An objective of using
scenarios would be to help determ ine which firms or FMIs need
to develop their operational resilience.
16. W here developm ent is required, firm s' and FM Is' actions
could include the identification and rehearsal of alternative pro­
cessing procedures; system design offering greater substitutabil­
ity at the service level; outsourcing; or third party substitutability
arrangem ents.
Supervisory Tools
17. Regular supervisory engagem ent and review of firm s' and
FM Is' own risk m anagem ent is already com plem ented by a
range of specific tools which the supervisory authorities cur­
rently apply on a proportionate basis. Such review w ork typ i­
cally targets specific risks and can be undertaken in a variety of
ways including questionnaires, sim ulations, skilled persons' or
exp erts' reports and w ider them atic review s. Firm s' recovery
and resolution plans and O C IR arrangem ents, where ap p li­
cable, can also be useful sources of inform ation for the supervi­
sory authorities.
18. The supervisory authorities could make an increased use
of questionnaires to assess operational resilience in future,
potentially drawing on existing fram eworks which support
assessm ent of firms' and FM Is' capabilities. Existing fram eworks
include the C PM I-IO SC O guidelines, the G7 Fundamental E le­
ments of Cybersecurity, the National Institute of Standards &
Technology (NIST) Cybersecurity Fram ework, and the National
C yber Security Centre (N CSC) Cyber Assessm ent Fram ework.
19. A capabilities assessm ent questionnaire could be derived
from the existing NIST principles, which set out that companies
should: identify potential vulnerabilities and sources of risk, seek
to protect them selves from threats, detect incidents, respond
to, and recover from disruptions.
Q u e stio n s
H) W hat operational resilience tests or scenarios do firms and
FMIs already consider and undertake for their own risk man­
agem ent purposes? W hat factors do firms and FMIs take
into account when devising operational resilience tests or
scenarios?
I) How do boards and senior m anagem ent currently gain assur­
ance over the operational resilience of their firm or FMI?
J) W hat are readers' views on the proposed developments to the
supervisory authorities' approach to operational resilience?
CON CLUSION 1
1. This DP aims to promote an open and constructive dialogue
with stakeholders, and share the supervisory authorities' current
thinking on how the operational resilience of the financial ser­
vices sector could be enhanced.
2. The supervisory authorities are exploring a busi­
ness services approach because it could be of value to
Chapter 25 Building the UK Financial Sector's Operational Resilience
organisations of all sizes as they m anage their resilience in
a dynam ic environm ent. A focus on business services could
help increase the transparency of firm s' and FM Is' resilience
w ork. It could drive better decision-m aking, as it would
enable prioritisation of resilience w ork and the associated
investm ent. It would provide a basis for firm s and FM Is to
set im pact to leran ces, set with reference to the supervisory
authorities' o b jectives. The supervisory authorities them selves
m ight also see the need to set im pact to lerances for som e
business services.
3. The concept of impact tolerance is core to the supervisory
authorities' thinking and may challenge firms and FMIs to think
differently. It encourages them to assume operational disrup­
tions will occur. This means that attention can be directed
towards minimising the impact of disruption on im portant busi­
ness services. Impact tolerance focuses firms, FMIs and the
supervisory authorities on the potential vulnerabilities in busi­
ness and operating models. The work they do to increase the
resilience of these need not be tied to specific threats, rather an
im portant business service should be made resilient to a wide
variety of threats.
4. Firms' and FMIs' processes, practices and culture need to
work effectively to achieve the increased level of operational
resilience that they and the supervisory authorities seek. This DP
suggests an approach for potential supervisory expectations and
assessm ent:
• Preparation: firms and FMIs identify and focus on the con­
tinuity of their most im portant business services as a means
of prioritising their own analysis, work and investm ent in
operational resilience. They set impact tolerances for their
im portant business services and are able to dem onstrate
substitutability or the capability to adapt processes during
disruption.
• Recovery: firm s and FM Is assum e disruptions will occur, and
develop the m eans by which they can adapt their business
processes and practices in the event of shocks in order to
preserve continuity of service.
• Com m unications: firm s and FM Is have strategies for com ­
m unicating with their internal and external stakeholders,
including the supervisory authorities and consum ers. This
should include how to handle the situation to minimise the
consequences of disruption.
• G overnance: firm s' and FM Is' boards and senior m anagem ent
are crucial in setting the business and operational strategies
and overseeing their execution in order to ensure operational
resilience.
■ 401
Responses and Next Steps
5. The supervisory authorities welcom e feedback on this
DP, including any specific suggestions, issues, or potential
alternatives.
6. The supervisory authorities will w ork to g eth er to reflect
on the feed b ack as they: develop potential proposals
for consultation; develop their resp ective supervisory
approaches; and w ork with the FP C as it develops its own
im pact to leran ces. The supervisory authorities will also be
drawing to g eth er existing policy m aterial related to o p era­
tional resilience in order to support firm s and FM Is to build
their resilience.
7. The supervisory authorities have found that collaboration with
firms, FMIs, security and other public and private sector organisa­
tions provides a constructive approach to promoting operational
resilience. They intend to continue this strategy, working with
other organisations in both authority- led and industry fora. The
supervisory authorities believe that cooperation in this area is vital
to achieving good operational resilience outcomes and financial
stability.
FEED B A C K AND Q UESTION S
1. The supervisory authorities encourage responses to the ques­
tions posed and any other observations that readers may have
in response to this DP by Friday 5 O ctober 2018. Responses
and input from a wide range of stakeholders including regulated
firms, FM Is, consum ers, industry bodies, auditors, specialist
third-party providers, professional advisors and other regulators
are welcom ed.
2. The supervisory authorities will use these responses to inform
current supervisory activity and future policy-making. The
supervisory authorities will share relevant information with the
FPC to inform its approach to building cyber resilience in the
UK financial system . They may publish extracts or summaries of
views from respondents.27
A) W hat are readers' views on the proposed focus on con­
tinuity of business services? Would a service rather than
systems-based approach represent a significant change for
firms and FMIs compared with existing practice? W hat other
approaches could be considered?
B) Would encouraging firms and FMIs to consider their contri­
bution to the vital services that the real economy demands
27 Respondents should indicate if they wish all or part of a response to
be kept confidential.
402 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
change the way they manage operational resilience, and if so
how? W hat additional costs would this incur?
C) How do boards and senior m anagem ent currently prioritise
their work on operational resilience?
D) W hat changes are firms and FMIs planning to make to
strengthen operational resilience over the next few years?
How involved are board members in the planning, im plem en­
tation and em bedding of any changes? W hat are the likely
benefits and costs involved?
E) W hat are readers' views on the possibility of firms and FMIs
being asked to set impact tolerances for their most impor­
tant business services?
F) W hat approach and m etrics do firm s and FMIs
currently use?
G) If these proposals would require some firms and FMIs to
update part of their existing risk m anagem ent fram ework,
what would this involve?
H) W hat are readers' views on producing an impact tolerance
statement as described? W hat relevant operational resilience
risk management documentation do firms and FMIs already
produce, and how does this differ from impact tolerance
statements?
I) W hat operational resilience tests or scenarios do firms and
FMIs already consider and undertake for their own risk man­
agem ent purposes? W hat factors do firms and FMIs take
into account when devising operational resilience tests or
scenarios?
J) How do boards and senior m anagem ent currently gain
assurance over the operational resilience of their firm
or FMI?
K) W hat are readers' views on the proposed developm ents
to the supervisory authorities' approach to operational
resilience?
A N N EX 1: GLO SSARY O F TERMS
Business Services
Products and services that a firm or FMI provides to its custom ­
ers. These will vary by firm or FM I, but exam ples could include
the delivery and m anagem ent of particular loan or insurance
products.
Capabilities
The practices, processes and culture within a firm or FMI that
deliver operational resilience.
Clearing House Automated Payment
System (CHAPS)
C H A PS is a sterling same-day system used to settle high-value
wholesale payments as well as time- critical, lower-value pay­
ments like buying or paying a deposit on a property.
Cloud Services
Cloud services are remote access services and infrastructure.
Continuity
In the context of this DP, continuity refers to the ongoing provi­
sion of a business service.
Economic Functions
The broad set of services the financial sector provides to the
UK econom y, and hence an aggregation of business services
that one, or more, firms or FMIs provide. For exam ple, the eco­
nomic function of retail m ortgages and secured lending would
com prise a number of individual business services. If sufficiently
significant in term s of both size and function, these econom ic
functions can becom e critical to the UK economy.
Financial Market Infrastructure (FMI)
A multilateral system among participating institutions, including
the operator of the system , used for the purposes of clearing,
settling, or recording paym ents, securities, derivatives, or other
financial transactions.
General Data Protection Regulation (GDPR)
The G eneral Data Protection Regulation (Regulation 2016/679)
regulates the processing of personal data relating to individuals
in the EU by other individuals, com panies or organisations.
Impact Tolerances
Describe firms' and FMIs' tolerance for disruption, under the
assumption that disruption to a particular business service will
occur. Impact tolerance is expressed by reference to specific
outcomes and metrics. Such metrics could include the maximum
tolerable duration or volume of disruption, the criticality of ensur­
ing data integrity or the number of customers affected. Impact
tolerances are different from risk appetite, in the sense that they
assume a particular risk has crystallised, but they will inform the
risk appetite of a firm or FMI's board and senior management.
Chapter 25 Building the UK Financial Sector's Operational Resilience
Impact Tolerance Statement
For the purposes of this DP, the supervisory authorities envisage
that how impact tolerances are derived and justified might be set
out in a single docum ent called an impact tolerance statem ent.
Integrity
In the context of this DP, integrity describes data being accurate
and com plete.
Operational Resilience
For the purposes of this DP, operational resilience refers to
the ability of firm s, FM Is and the system as a w hole to p re­
ven t, ad ap t and respond to , recover and learn from , o p e ra­
tional disrup tion. In this DP, the sup erviso ry authorities focus
on the continued d elivery of business services or econom ic
functions.
Operational Risk
Operational risk refers to the risk of loss from inadequate or failed
processes, people or systems or from external events. Threats to
firms' and FMIs' operations take a wide variety of forms.
Risk Appetite
A firm 's risk appetite is the amount and type of risk a firm is
willing to accept, or avoid, in order to achieve its business objec­
tives. When aggregated in a single docum ent, this is referred to
as a risk appetite statem ent.
Real Economy
The production of goods and services within an econom y.
Real-Time Gross Settlement (RTGS) Service
Infrastructure that holds accounts for banks, building societ­
ies and other institutions. The balances in these accounts can
be used to move money in real time between these account
holders. This delivers final and risk-free settlem ent.
Senior Manager's and Certification
Regime (SM&CR) and Senior Insurance
Managers Regime (SIMR)
Rules in the PRA Rulebook and F C A Handbook ('Senior
M anagem ent Functions' (SM F)) requiring firm s to appoint
■ 403
m anagers, approved by the regulator, who are responsible for
specific areas and each of the firm s' business functions and
activities. SM F24 in particular is the C h ief O perations func­
tion, which has responsibility for the internal operations and
technology, currently of banks, dual-regulated investm ent firms
and building societies.
Supervisory Authorities
The collective term for the PRA, the FC A , and the Bank of
England (in its capacity of supervising FMIs).
404 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
Systems and Processes
The underlying software, people, assets, policies and proce­
dures that support the delivery of business services.
Vital Services
The key services that the real economy demands from the financial
system: providing the main mechanism for paying for goods,
services and financial assets; intermediating between savers and
borrowers, and channelling savings into investment, via debt and
equity instruments; and insuring against and dispersing risk.
Striving for
Operational
Resilience
The Questions Boards
and Senior Management
Should Ask

Learning Objectives
A fter com pleting this reading you should be able to:

Com pare operational resilience to traditional business Describe elem ents of an effective operational resilience
continuity and disaster recovery approaches. fram ework and its potential benefits.

E x c e rp t is rep rin ted from Striving for O perational Resilience: The Questions Boards and Senior M anagem ent Should A sk, by Rico
Brandenburg, Tom Ivell, Evan Sekeris, M atthew G ru b er and Paul Lew is, b y perm ission o f O liver Wyman.

405
E X E C U T IV E S U M M A R Y
Operational resilience has becom e a key agenda item for boards
and senior m anagem ent. Increasing com plexity in processes and
IT, dependence on third parties, interconnectedness and data
sharing, and sophistication of malicious actors have made dis­
ruptions more likely and their im pact more severe. High-profile
exam ples of business and operational disruptions abound, cov­
ering all segm ents of the financial services industry.
Resilience is fundam entally different from traditional business
continuity (BC) and disaster recovery (DR). Th ese disciplines
have historically been heavily focused on physical events,
w ere designed and tested in organizational silos, and are, by
most organizations, prim arily view ed as a com pliance exercise.
O perational resilience, instead, focuses on the adaptability to
em erging threats, the d ep end encies and requirem ents for pro­
viding critical business services end-to-end (crossing organiza­
tional silos), and the broader econom ic as well as firm -specific
im pact of adverse operational events. It requires a m indset
shift in the organization away from resilience as a com pli­
ance exercise to resilience as a key organizational capability
that is everyone's responsibility to maintain and continuously
im prove.
Financial regulators have started to stipulate expectations
around m anagem ent of resilience, resilience reporting, and
effective oversight. In response, many firms are embarking or
will need to em bark on transformational programs to strengthen
their resilience to disruption, incidents, and attacks across all
operational resilience domains - technology, data, third parties,
facilities, operations, and people. In addition, boards and senior
m anagem ent need to provide effective challenge of their orga­
nization's resilience am bitions, program, and critical risks that
remain to their day-to-day operations.
Achieving operational resilience is inherently challenging given
the increasing com plexity of processes, technology infrastruc­
ture, and organizational silos. However, the business benefits
go beyond pure risk and com pliance, often forming an inherent
part of a firm 's value proposition.
This paper explores the key questions that boards and senior
m anagem ent should ask about their organization's level of
operational resilience.
26.1 W H Y N O W ?: N E E D F O R
O P E R A T IO N A L R E S IL IE N C E
Continuity of service has always been a priority for financial
firms. A fter all, disruptions can impact revenue, client exp eri­
ence, and franchise value.
406 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
O perational resilience is the ability o f an organization
to continue to provide business services in the face o f
adverse operational events by anticipating, preventing,
recovering from, and adapting to such events.
BC and DR have historically emphasized physical events (e.g .,
natural disaster, active shooter), are limited by organizational
boundaries, and are, by most organizations, primarily viewed as
a "check the box" exercise rather than true risk m anagem ent.
However, several trends in financial services have sharply
increased the need for more mature operational resilience
practices. Exh ib it 26.1 below explores the most im portant
trends, which we exp ect to continue to elevate the topic to
discussions at the top table.
These drivers have manifested them selves in high-profile busi­
ness and operational disruptions across the financial services
industry, both through internally-driven operational failures and
externally-driven malicious acts. These disruptions illustrate
some of the shortcom ings of traditional BC and DR approaches:
• Firm have more dependencies for service delivery than ever
before, but traditional approaches focus on assets in siloes and
ignore potentially critical components of end-to-end service
delivery.
• In a rapidly changing environm ent, traditional "check the
box" and reactive approaches focused solely on recovery
make firms much slower to adapt.
• By focusing on a standard set of disruption scenarios, tradi­
tional approaches provide a false sense of com fort that insti­
tutions are prepared for all scenarios.
Additionally, financial firms recognize the need for greater opera­
tional excellence (efficiency and effectiveness). Organizations that
manage to effectively address the combined need for operational
resilience and excellence will be able to unlock significant benefits
across the organization (e.g., operational loss, operational cost
and com plexity reduction, ability to support faster innovation
cycles, effective investment into operational capabilities).
26.2 B E N D , BU T D O N 'T B R E A K :
O P E R A T IO N A L R E S IL IE N C E
APPROACH
Operational resilience is the ability of an organization to continue to
provide business services in the face of adverse operational events
by anticipating, preventing, recovering from, and adapting to such
events. The fundamental principle is "bend, but don't break."
Even for many advanced institutions, adopting an operational
resilience approach will imply significant changes from tradi­
tional (more com pliance-focused) BC and DR. W hereas these
 DRIVER IMPACT ON EXPOSURE TO DISRUPTION

Com petition and custom er dem and are driving Increasing com plexity of processes and infrastructure
S C A LE A N D P A C E
the need for more disruptive innovations and faster required for product and service delivery, and risk of
O F IN N O V A TIO N
innovation cycles im balance between tim e to m arket and security/resilience

Availability of new technology, custom er expectations, Traditional (manual) fallback m ethods no longer viable,
C O N T IN U ED and desires for efficiency are driving increasing levels and more challenging to identify the "w eakest link"
D IG ITIZA TIO N of automation and faster adoption of digital delivery among connected digital system s
capabilities

Incum bent institutions rely on older technology Challenging to em bed risk and resilience requirem ents
R E LIA N C E O N L E G A C Y infrastructure that is less flexible, requires specialized in technology, which increases the exposure
IN FR A S TR U C TU R E knowledge to maintain, and is difficult to integrate to disruptive events
with new technologies and processes

Institutions are increasingly adopting outsourcing More difficult to gain a com prehensive view of the
EX TEN S IO N as a business strategy, expanding their reliance on firm 's third-party dependencies and exposure, as well
O F T H E SU PP LY CH AIN third parties (and their third parties' third parties) as to assess the risk and resilience posture of all
relevant third parties

Financial institutions are sharing more information More likely to be affected by vulnerabilities
IN T E R C O N N E C T E D N E S S
and services more broadly (partly through deliberate and disruptions in another part of the ecosystem
A N D SH A RIN G
governm ent policy)

C O N T IN U E D RISE IN C yb er attackers are innovating rapidly to identify new More challenging to prevent, detect, respond,
SO P H IS TIC A TIO N O F means of attack and ways of exploiting firms' and recover from cyber attacks
M A LIC IO U S A C T O R S vulnerabilities

Exhibit 26.1 Drivers of exposure to disruption.

traditional approaches focus solely on recovery, operational
resilience has a broader scope and needs to be integrated into
the risk-mitigation fabric of the organization.
Resilient organizations focus on anticipation, prevention and adap­
tation, rather than recovery actions once the "horse has bolted."
In addition, resilient organizations have creative ways to provide
critical business services in the event of a disruption, beyond simply
getting the technology up and running again (e.g., using branches
to service customers at scale when digital channels might be down).
Exhibit 26.2 shows the key characteristics of an operational
resilience approach com pared to most organizations' starting
point - traditional BC and DR.
Financial services regulators have begun to take note and are
beginning to focus on promoting operational resilience, versus
traditional BC and DR. The principles outlined in Exhibit 26.2 are
reflected in an increasing body of regulatory consultation and
guidance papers.
avoiding system ic disruptions, while sm aller institutions' objec­
tives will likely focus on maintaining shareholder value.
Global institutions will need to pay particularly close attention to
regulatory developm ents, as regulators in different jurisdictions
have not yet aligned on their expectations for firms.
R EC EN T R ESILIEN C E-R ELA T ED
REG U LA TO RY PUBLICATION S
JULY 2018
Bank of England/Prudential Regulation Authority/Financial
Conduct Authority discussion paper, "Building the UK
financial sector's operational resilience"
D ECEM BER 2018
European Central Bank guidance, "C yb er resilience over­
sight expectations for financial market infrastructures"

With the lessons from the financial crisis still fresh, regulators
have overlaid a "system ic" lens, prompting firms to exp lic­
itly consider and measure how disruptions would impact the
broader market. A t the same tim e, they are emphasizing that
resilience is applicable to all institutions, even if the objectives
for each institution might differ. For exam ple, Financial Market
Infrastructure's (FMI) resilience objectives will likely focus on
European Banking Authority consultation paper, "G u id e ­
lines on ICT and security risk m anagem ent"
M A R C H 2019
Monetary Authority of Singapore consultation papers, "Pro­
posed Revisions to Guidelines on Business Continuity Man­
agem ent" and "Technology Risk Management Guidelines"

Chapter 26 Striving for Operational Resilience ■ 407

 CATEGO RY OPERATIONAL RESILIENCE APPROACH
• Clearly defined accountability
of board and senior m anagem ent
• Resilience incorporated into risk appetite
statem ents and metrics across operational
risk types
• Com prehensive and actionable reporting
to drive continuous im provem ent
• Critical business services end-to-end
(ignoring organizational silos)
• Broader econom ic im pact of disruption,
in addition to firm-specific impact
• Com prehensive view of dependencies of
critical business service on organizational
assets (systems, data, third parties,
facilities, processes, and people)
• Resilience considerations em bedded
in the upfront design of business services
and organizational assets
• Business disruption scenarios tailored to
each critical service based on an aligned
and forward-looking risk assessm ent
• Tolerances for business disruption (impact
tolerances) based on bespoke scenarios
• Single incident response regime (unified
incident command) for all incident types
• Plans and capabilities m onitored, tested,
and adapted continuously •
• Em phasis on building trust among crisis
m anagem ent team to enable effective
response
Exhibit 26.2 Key characteristics of operational resilience.
408 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
TRADITIONAL APPROACH (BC/DR)
• Role of board and senior m anagem ent limited
to post-event response
• Resilience not an explicit consideration in risk
appetite statem ents and metrics
• "Com pliance-type" update on exercises
• Individual business units or specific
technology assets
• Firm -specific impact of disruption
• View of dependencies in most cases limited
to the business unit or directly linked
technology assets
• Continuity and recovery capabilities bolted
on to satisfy requirem ents
• Standard business disruption scenarios
across business units
• Standard tolerances for business disruption
(recovery tim e/point objectives) for all
scenarios
• Distinct incident response regimes
for different incident types, which may
negatively impact response times
• Plans and capabilities tested infrequently
(e.g ., annually)
• Little attention paid to dynamics
of crisis m anagem ent team
2 6 .3 H AS T H E O R G A N IZ A T IO N G O T
IT ?: IM PO R TA N T Q U E S T IO N S T O A S K
A B O U T O P E R A T IO N A L R E S IL IE N C E
Achieving operational resilience is inherently challenging and
com plex:
• It requires organizations to understand how all domains (tech­
nology, data, third parties, facilities, operations, and people)
impact critical service delivery and to build a consistent set of
resilience capabilities and controls across these domains.
• It depends on cross-functional, specialized expertise to evalu­
ate and measure the resilience of the organization in light of
the specific risks it faces.
• It relies on extensive coordination, collaboration, and prepara­
tion to ensure that the organization appropriately considers
resilience in all activities and is ready when the worst happens.
Given the com plexity of the topic, it is difficult for boards and
senior m anagem ent to assess the current level of operational
resilience and determ ine whether the organization is making
resilience investments in the right areas.
What questions should boards and senior m anagem ent
b e asking to provide meaningful challenge and oversight?
We believe that boards and senior m anagem ent should focus on
understanding the risk levels of their firms, assessing their firms'
readiness for disruptive scenarios, and gaining com fort that their
firms have a robust approach to resilience. Boards and senior
m anagem ent should also demand a minimum level of data to
support ongoing oversight of risk levels and the progress made
along the resilience journey.
Exhibit 26.3 contains a list of key questions on resilience that
boards and senior m anagem ent should ask their m anagem ent
team s.
If the answers to these questions are unsatisfactory, it could signal
that the organization needs to increase focus on resilience. In this
case, boards and senior management should request that their
organizations establish a formal maturity baseline and refocus exist­
ing initiatives or launch a new program to uplift their resilience.
2 6 .4 IM P R O V IN G R E S IL IE N C E :
G E T T IN G ST A R T ED
For firms needing to launch or reset their programs, we recom ­
mend starting small, providing transparency to the boards and
Chapter 26 Striving for Operational Resilience
senior m anagem ent, and getting resilience right for one critical
service before expanding the program.
Exhibit 26.4 lays out an approach to establishing an effective
operational resilience program that allows the organization to
enhance its capabilities without being overwhelm ed by the scale
of the effort.
Organizations that manage to establish effective operational
resilience programs will be able to realize the benefits of better
resilience as well as related business benefits:
• Reduce and optim ize their risk exposure, with improved vis­
ibility into their risks, better monitoring, a more proactive
approach to controls, and ability to deliver services even
when things go wrong.
• Better focus the organization and drive investm ent towards
the most im portant areas, based on a prioritization of their
critical business services.
• Be able to support the innovation agenda of the business
and enable faster innovation cycles without compromising on
risk m anagem ent by ensuring the organization is adaptable
and considers resilience up front.
• Be more effective and efficien t, leveraging a clear under­
standing of critical service d elivery to reduce costs
(e .g ., optim ize outsourcing relationships), stream line
processes (e .g ., introduce tools and autom ation), and
enhance efficacy (e .g ., identify and rem ediate steps that
introduce errors).
However, building an effective program is not easy. It will
require new skillsets; closer integration and alignm ent of risk,
IT, and the business; a cultural shift away from "operational
resilience is IT's responsibility" to "operational resilience is
everyone's responsibility;" and fundamental changes to how the
organization operates.
Boards and senior m anagem ent can help their organizations
overcom e these ch allen g es. Th ey can encourage the right
level of investm ent, drive a "to ne from the to p " to break
siloes and change culture, and set clear exp ectatio n s for
progress.
Ultimately, by asking the right questions and demanding
accountability when the answers are unsatisfactory, boards and
senior m anagem ent can play a pivotal role in enabling their
organizations to achieve resilience. With the growing com plex­
ity in financial services, it is incumbent on every organization
to take resilience seriously, and it is incum bent on boards and
senior m anagem ent to make sure their organization's resilience
program is on track.
■ 409
 □ W hat is our risk appetite for resilience risk?

I______________ I □ W hat KRIs and KPIs provide us with a com prehensive view of our
maturity and uplift program?

□ W ho is accountable in the 1st and 2 nc* lines of defense for managing,

G O V ER N A N C E
monitoring, and reporting on resilience?

□ Does the organization understand the dependencies of critical

business services on organizational assets?
□ W hat are our most critical assets that impact service delivery?

O R G A N IZ A T IO N A L □ How does our approach to resilience change the way we manage

FO C U S operations, technology, and third parties?

□ W hat is our measure of criticality?

< > □ W hat are our critical business services and why?

□ How are we leveraging existing definitions of criticality and critical

business services (e.g ., from resolution planning)?
IN TEG R A TIO N
□ W hat is our im pact on custom ers and the financial system?

□ W hat are the most im portant resilience risks for the organization?

□ How do we monitor and manage the level of resilience of the

organization?
M EA SU R EM EN T □ How is risk appetite reflected in our impact tolerances?

□ In which scenarios are we outside of our defined im pact tolerances?

—.P1--- □ How do we make sure we are effectively prepared for different

disruption events?

□ How frequently are we testing our response and recovery capabilities

P R EP A R ED N ESS for different disruptive scenarios?

Exhibit 26.3 Resilience questions for boards and senior management.

410 ■ Financial Risk Manager Exam Part II: Operational Risk and Resiliency
 • Assign accountability and develop an operating model for resilience
ESTA BLISH
• Conduct a resilience maturity assessm ent to establish a baseline
T H E FO U N D A TIO N
of the organization's capabilities

• Articulate the organization's critical business services

• Define the target resilience maturity ambition for the organization

PRO VID E VISIBILITY
T O T H E BO A RD • Identify an initial set of metrics (including resilience program metrics)
to provide ongoing reporting to the board

• Run a pilot on one critical service to enhance resilience:

- Identify key dependencies and assess risks
FO C U S ON A SIN G LE - Define impact tolerances and evaluate resilience through scenarios
C R IT IC A L SER V IC E - Craft an im provem ent roadmap

• Identify key learnings and program enhancem ents to facilitate

the rollout of the program more broadly

• Establish the program to drive resilience im provem ents based on

EXPA N D lessons learned from the pilot and identified areas of enhancem ent
T H E PRO G RAM
• Expand the program to enhance capabilities and roll out a resilience
approach across the remaining critical services
Exhibit 26.4 Key steps for establishing an effective operational resilience program.

Chapter 26 Striving for Operational Resilience ■ 411

 LIOGRAPHY
A rbib, M. A . (Ed.) (1995), The Handbook of Brain Theory and Neural
N etworks, The MIT Press.
Adelson, M., and G oldberg, M. (2009), On the Use of M odels by
Standard & Poor's Ratings Services, w w w .standardandpoors.com
(accessed February 2010).
Akhavein, J ., Fram e, W. S., and W hite, L. J . (2001), The Diffusion of
Financial Innovations: An Exam ination of the Adoption of Small Busi­
ness C redit Scoring by Large Banking O rganization, The W harton
Financial Institution Center, Philadelphia, USA.
A lbareto, G ., Benvenuti, M ., M oretti, S. e ta /. (2008), L'organizzazione
dell'attivita creditizia e I'utilizzo di tecniche di scoring nel sistema
bancario italiano: risultati di un'indagine cam pionaria, Banca d'ltalia,
Q uestioni e Econom ia e Finanza, 12.
Altm an, E. I. (1968), Financial Ratios, Discrim inant Analysis and Predic­
tion of Corporate Bankruptcy, Journ al o f Finance, 23 (4).
Altm an, E. I. (1989), Measuring Corporate Bond M ortality and Perfor­
m ance, Jo u rn a l o f Finance, X L IV (4).
Altm an, E. I., and Saunders, A . (1998), C red it risk m easurem ent: D evel­
opm ents over the last 20 years, Jo u rn a l o f Banking and Finance, 21.
Altm an, E ., Haldem an, R., and Narayanan P. (1977), Zeta Analysis: a New
Model to Identify Bankruptcy Risk of Corporation, Jo u rn a l o f Banking
and Finance, 1.
Altm an, E. I., Resti, A ., and Sironi A . (2005), Recovery Risk, Riskbooks.
Bank of Italy (2002), Annual Report 2001, Rome.
Bank of Italy (2006), New Regulations for the Prudential Supervision of
Banks, Circular 263, w w w .bancaditalia.it (accessed February 2010).
Baron, D ., and Besanko, D. (2001), Strategy, Organization and Incen­
tives: Global Corporate Banking at Citibank, Industrial and C o rpo ra te
Change, 10 (1).
Basel Com m ittee on Banking Supervision (1999a), C red it Risk M odelling:
Current Practices and A pplications, Basel, Switzerland.
Basel Com m ittee on Banking Supervision (1999b), Principles for the
M anagem ent of C red it Risk, Basel, Switzerland.
Basel Com m ittee on Banking Supervision (2000a), Range of Practice in
Banks' Internal Ratings System s, Discussion paper, Basel, Sw itzerland.
Basel Com m ittee on Banking Supervision (2000b), C redit Ratings and
Com plem entary Sources of C redit Q uality Information, Working
Papers 3, Basel, Sw itzerland.
Basel Com m ittee on Banking Supervision (2004 and 2006), International
Convergence of Capital M easurem ent and Capital Standards. A
Revised Fram ew ork, Basel, Switzerland.
Basel Com m ittee on Banking Supervision (2005a), Studies on Validation
of Internal Rating System s, W orking Papers 14, Basel, Switzerland.
Basel Com m ittee on Banking Supervision (2005b), Validation of Low-
default Portfolios in the Basel IT Fram ew ork, N ew sletter 6, Basel,
Sw itzerland.
Basel Com m ittee on Banking Supervision (2006), The IRB Use Test:
Background and Im plem entation, N ew sletter 9, Basel, Sw itzerland.
Basel Com m ittee on Banking Supervision (2008), Range of Practices and
Issues in Econom ic Capital M odeling, Consultative Docum ent, Basel,
Switzerland.
Basel Com m ittee on Banking Supervision (2009), Strengthening the
Resilience of the Banking Sector, Consultative Docum ent, Basel,
Sw itzerland.
Basilevsky, A . T. (1994), Statistical Factor Analysis and Related M ethods:
Theory and A pplications, John W iley & Sons Ltd.
Beaver, W. (1966), Financial Ratios as Predictor of Failure, Jo u rn a l o f
A cco u n tin g Research, 4.
Berger, A . N., and Udell, L. F. (2001), Small Business Credit Availability and
Relationship Lending: the Importance of Bank Organizational Structure,
US Federal Reserve System Working Papers, W ashington, D C , USA.
Berger, A . N ., and Udell, L. F. (2006), A more com plete conceptual
fram ew ork for SM E Finance, Jo u rn a l o f Banking, 30.
Berger, A . N ., Fram e, W. S., and Miller, N. H. (2002), C red it Scoring and
the Availability, Price and Risk of Small Business C red it, US Federal
Reserve System W orking Papers, W ashington, D C , USA.
Berger A . N ., Klapper, L. F., and Udell, G . F. (2001), The A bility of Banks
to Lend to Inform ationally O paque Small Businesses, US Federal
Reserve System Working Papers, W ashington, D C, USA.
Berger, A . N ., Miller, N. H., and Petersen, M. A . (2002), Does Function
Follow Organizational Form ? Evidence from the Lending Practices of
Large and Small Banks, US National Bureau of Econom ic Research
W orking Papers, 8752, C am bridge, M A, USA.
Blochwitz, S., and Eigerm ann, J . (2000). Unternehm ensbeurteilung
durch Diskrim inanzanalyse mit qualitativen M erkm alen, Zeitschrift fur
betriebsw irtschaftliche Forschung.
Bohn, J . R. (2006), Structural M odeling in Practice, W hite Paper,
Moody's KMV.
Boot, A . W. (2000), Relationship Banking: W hat Do We Know? Jo u rn a l o f
Financial Interm ediation, 9.
Boot, A . W ., and Thakor, A . V. (2000), Can Relationship Banking Survive
Com petition? The Jo u rn a l o f Finance, 55.
Brunetti, G ., Coda, Y., and Favotto, F. (1984), Analisi, previsioni, simu-
lazioni econom ico-finanziarie d'im presa, Etas Libri.
Brunner, A ., Krahnen, J . P., and W eber, M. (2000), Information
Production in C red it Relationships: on the Role of Internal Ratings in
Com m ercial Banking, W orking Paper 10, C en ter for Financial Studies
of University of Frankfurt, Germ any.
Burroni, M., Q uagliariello, M ., Sabatini, E ., and Tola, V. (2009), Dynamic
Provisioning: Rationale, Functioning, and Prudential Treatm ent,
Q uestioni di Econom ia e Finanza, 57, Bank of Italy.
Buzzell, R. D. (2004), The PIMS Program of Strategy Research: A Retro­
spective A ppraisal, Jo u rn a l o f Business Research, 57 (5).
Buzzell, R. D ., and G ale, B. T. (1987), The PIMS principles, The Free
Press.
Cangem i, B., De Servigny, A ., and Friedm an, C . (2003), C red it Risk
Tracker for Private Firm s, Technical Docum ent, Standard & Poor's.
Com m ittee of European Banking Supervisors (2005), G uidelines on the
Im plem entation, Validation and Assessm ent of A dvanced M easure­
ment (AM A) and Internal Ratings Based (IRB) A pproaches.
Christodoulakis, G ., and Satchell, S. (2008), The Analytics of Risk
Validation, Elsevier.
De Laurentis, G . (1993), II rischio di credito, Egea.
De Laurentis, G . (2001), Rating interni e credit risk m anagem ent,
Bancaria Editrice.
De Laurentis, G . (Ed.) (2005), Strategy and Organization of Corporate
Banking, Springer.
De Laurentis, G ., and G ab b i, G . (2010), The Model Risk in C redit
Risk M anagem ent Processes, in Model Risk Evaluation Handbook
(eds. G . N. G regoriu, C . Hoppe, and C . S. W ehn), M cGraw-Hill.
De Laurentis, G ., and G andolfi, G . (Eds.) (2008), II gestore im prese,
Bancaria Editrice.
De Laurentis, G ., Saita, F., and Sironi, A . (Eds.) (2004), Rating interni e
controllo del rischio di credito, Bancaria Editrice.
De Lerm a, M .; G ab b i, G ., and M atthias, M. (2007), C A R T Analysis of
Q ualitative Variables to Improve C red it Rating Processes, http://www
.g reta.it/cred it/cred it2006/po ster/7_G ab bi_M atthias_D eLerm a.pd f
(accessed February 2010).
De Servigny, A ., and Renault, O . (2004), M easuring and Managing
C red it Risk, M cGraw-Hill.
414 ■ Bibliography
De Servigny, A ., Varetto, F., Salinas, E. et al. (2004), C red it Risk Tracker
Italy, Technical Docum entation, w w w .standardandpoors.com
(accessed February 2010).
DeYoung, R., Hunter, W. C ., and Udell, G . F. (2003), The Past Present and
Probable Future for Com m unity Banks, W orking Paper 14, Federal
Reserve Bank of Chicago, USA.
Diam ond, D. (1984), Financial Interm ediation and D elegated M onitoring,
The R eview o f E co n o m ic Stu dies, 51 (3).
Draghi, M. (2008), A System with More Rules, More C ap ital, Less Debt
and More Transparency, Sixth Com m ittee of the Italian Senate, Fact­
finding Inquiry into the International Financial Crisis and Its Effects
on the Italian Econom y, Rom e, http://w w w .bancaditalia.it (accessed
February 2010).
Draghi, M. (2009), A ddress by the G overnor of the Bank of Italy, Annual
M eeting of the Italian Banking Association, 8 Ju ly 2009, Rome, http://
w w w .bancaditalia.it (accessed February 2010).
Dwyer, D. W ., Kocagil, A . E ., and Stein, R. M. (2004), Moody's KM V
R iskcalc™ v3.1 M odel, Technical Docum ent, http://www.m oodyskm v
.com /research/files/w p/RiskCalc_v3_1 _M o d e l.p d f (accessed February
2010 ) .
Ely, D. P , and Robinson, K. J . (2001), Consolidation, Technology and
the Changing Structure of Banks' Small Business Lending, Fed era l
R eserve Bank o f Dallas E co n o m ic and Financial Review , First Quarter.
Engelm ann, B., and Rauhmeier, R. (Eds.) (2006), The Basel II Risk Param ­
eters, Springer.
Fisher, R. A . (1936), The Use of Multiple M easurem ents in Taxonom ic
Problem s, Annals o f Eu g en ics, 7.
Finger, C . (2009a), IRC Com m ents, RiskM etrics G roup, Research Monthly
(February).
Finger, C . (2009b), VAR is from Mars, Capital is from Venus, Risk-M etrics
G roup, Research Monthly (April).
Fram e, W. S., Srinivasan, A ., and W oosley, L. (2001), The Effect of C red it
Scoring on Small Business Lending, Jo u rn a l o f M o n ey C re d it and
Banking, 33.
G anguin, B ., and Bilardello, J . (2005), Fundam entals of Corporate C redit
Analysis, M cGraw-Hill.
G iri, N. C . (2004), M ultivariate Statistical Analysis: Revised and
Expanded, C R C Press.
G rassini, L. (2007), Corso di Statistica A ziend ale, Appunti sull'analisi
statistica dei bilanci, http://w w w .ds.unifi.it/grassini/laura/Pistoia1/
in d exEA P T2007_08.h tm (accessed February 2010).
Golder, P. A ., and Yeomans, K. A . (1982), The Guttm an-Kaiser Criterion as
a Predictor of the Num ber of Common Factors, The Statistician, 31 (3).
G upton, G . M ., Finger, C . C ., and Bhatia, M. (1997), C redit M etrics, Tech­
nical Docum ent, W orking Paper, J P Morgan, http://w w w .riskm etrics
.com /publications/techdocs/cm tdow .htm l (accessed February 2010).
IASB (2009), Basis for Conclusions on Exposure Draft, Financial Instru­
m ents: Am ortized C ost and Im pairm ent, 6 N ovem ber 2009.
Ito, K. (1951), On Stochastic Differential Equations, American Mathematical
Society, 4.
Jackso n , P., and Perraudin, W. (1999), Regulatory Im plications of C redit
Risk M odelling, C red it Risk M odelling and the Regulatory Im plica­
tions Conference (June 1999), Bank of England and Financial Services
Authority, London.
Landau, S., and Everitt, B. (2004), A handbook of statistical analyses
using SPSS-PASW , C R C Press.
Loehlin, J . C . (2003), Latent Variable M odels— An Introduction to Factor,
Path, and Structural Equation Analysis, Lawrence Erlbaum A ssociates.
Lopez, J ., and Saidenberg, M. (2000), Evaluating credit risk models,
Journ al o f Banking and Finance, 24.
Lyn, T. (2009), Consum er C redit M odels— Pricing, Profit and Portfolios,
O xford Scholarship O nline.
Maino, R., and M asera, R. (2003), Medium Sized Firm and Local
Productive System s in a Basel 2 Perspective, in Industrial Districts
and Firm s: The Challenge of G lobalization, M odena University, Italy,
Proceedings, http://w w w .econom ia.unim ore.it/convegni_sem inari/
C G _sep t03/p ap ers.htm l (accessed February 2010).
Maino, R., and M asera, R. (2005), Im presa, finanza, m ercato. La gestione
integrata del rischio, E G E A .
M asera, R. (2001) II Rischio e le Banche, Edizioni II Sole 24 O re, Milano.
M asera, R. (2005), Rischio, Banche, Im prese, i nuovi standard di Basilea,
Edizioni II Sole 24 O re.
M asera, R., and Mazzoni, G . (2006), Una nota sulle attivita di Risk e
Capital M anagem ent di un interm ediario bancario, Ente Luigi Einaudi,
Q uaderni, 62.
M erton, R., (1974), On the Pricing of Corporate D ebt: the Risk Structure
of Interest Rates, Journ al o f Finance, 29.
Modigliani, F., and Miller, M. H. (1958), The Cost of Capital, Corporation
Finance and the Theory of Investment, Am erican Econom ic Review, 48.
Moody's Investor Services (2000), Benchm arking Q uantitative Default
Risk M odels: a Validation M ethodology (March).
Moody's Investor Service (2007), Bank Loan Recoveries and the Role
That Covenants Play: W hat Really M atters? Special Com m ent (July).
Moody's Investor Service (2008), Corporate Default and Recovery Rates
1920-2007 (February).
Nixon, R. (2006), Study Predicts Foreclosure for 1 in 5 Subprim e Loans,
N Y Tim es (20 D ecem ber 2006).
O eN B and FM A (2004), Rating M odels and Validation, O esterreichische
Nationalbank and Austrian Financial M arket Authority.
Petersen, M. A ., and Rajan, R. G . (1994), The Benefits of Lending Rela­
tionships: Evidence from Small Business Data, Journ al o f Finance, 49.
Petersen, M. A ., and Rajan, R. G . (2002), Does Distance Still M atter? The
Information Revolution in Small Business Lending, Jo u rn a l o f Finance,
57 (6).
Pluto, K., and Tasche, D. (2004), Estimating Probabilities of Default on
Low Default Portfolios, Deutsche Bundesbank Publication (Decem ber).
Porter, M. (1980), Com petitive Strategy, Free Press.
Porter, M. (1985), Com petitive A dvantage: Creating and Sustaining
Superior Perform ance, Free Press.
Rajan, R. G . (1992), Insiders and O utsiders: the Choice Betw een Rela­
tionship and Arm s Length D ebt, Jo u rn a l o f Finance, 47.
Resti, A ., and Sironi, A . (2007), Risk M anagem ent and Shareholders'
Value in Banking, John W iley & Sons Ltd.
Saita, F. (2007), Value at risk and bank capital m anagem ent, Elsevier.
Schwizer, P. (2005), Organizational Structures, in Strategy and O rganiza­
tion of Corporate Banking (Ed. G . De Laurentis), Springer.
Sharpe, W. (1964), Capital A sset Prices: a Theory of M arket Equilibrium
under Conditions of Risk, Jo u rn a l o f Finance, 19.
Sobehart, J . R., Keenan, S. C ., and Stein, R. M. (2000), Validation
M ethodologies for Default Risk M odels, A lg o Research Q uarterly, 4
(1/2) (M arch/June).
Standard & Poor's (1998), Corporate Ratings Criteria, http://w w w
.standardandpoors.com .
Standard & Poor's (2008), Corporate Ratings Criteria, http://w w w
.standardandpoors.com .
Standard & Poor's (2009), D efault, Transition, and Recovery: 2008
Annual Global Corporate Default Study and Rating Transitions.
Standard & Poor's (2009a), Annual Global Corporate Default Study and
Rating Transitions, http://w w w .standardandpoors.com .
Standard & Poor's (2009b), Global Structured Finance Default and
Transition Study 1978-2008: C red it Q uality of Global Structured
Securities Fell Sharply in 2008 Am id Capital M arket Turmoil, http://
w w w .standardandpoors.com .
Standard & Poor's (2009c), G uide to C red it Rating Essentials, 21 August
2009, http://w w w .standardandpoors.com .
Steeb, W. H. (2008), The Nonlinear W orkbook: Chaos, Fractals, Neural
N etw orks, G enetic Algorithm s, G ene Expression Program m ing,
Support Vector M achine, W avelets, Hidden M arkov M odels, Fuzzy
Logic with C++, Java and Sym bolic C++ Program s: 4th edition, World
Scientific Publishing.
Stevens, J . (2002), A pplied M ultivariate Statistics for the Social Sciences,
Lawrence Erlbaum A ssociates.
Tan; P.-N., Steinbach, M., and Kumar, V. (2006), Introduction to Data
Mining, Addison-W esley.
Tarashev, N. A . (2005), An Em pirical Evaluation of Structural C redit
Risk M odels, Working Papers No. 179, BIS M onetary and Econom ic
D epartm ent, Basel, Switzerland.
Thompson, M., and Krull, S. (2009), In the S&P 1500 Investment-Grade
Stocks Offer Higher Returns over the Long Term, Standard and Poor's
Market Credit and Risk Strategies (June), http://www.standardandpoors
.com.
Thurstone, L. L. (1947), Multiple Factor Analysis, University of Chicago
Press, Chicago.
Treacy, W. F., and C arey, M. S. (1998), C red it Risk Rating at Large U.S.
Banks, US Fed era l R eserve Bulletin (N ovem ber).
Treacy, W. F., and C arey, M. S. (2000), C red it Risk Rating System s at
Large U .S. Banks, Jo u rn a l o f Banking and Finance, 24.
Tukey, J . W. (1977), Exploratory Data Analysis, Addison-W esley.
Udell, G . F. (1989), Loan Q uality Com m ercial Loan Review and Loan
O fficer Contracting, Journ al o f Banking and Finance, 13.
Vasicek, O . A . (1984), C redit Valuation, W hite Paper, Moody's KMV
(March).
W ehrspohn, U. (2004), Optim al Sim ultaneous Validation Tests of Default
Probabilities D ependencies and C redit Risk M odels, http://ssrn.com /
abstract=591961 (accessed February 2010).
W ilcox, J . W. (1971), A G am bler's Ruin Prediction of Business Failure
Using Accounting Data, Sloan M an ag em en t Review , 12 (3).
Bibliography ■ 415
 INDEX

A anchoring bias, 128

ancillary processes, 226
A as, K., 213
A ng , A ., 232
absolute risk m easurem ent, 204
Anti-Kickback Statute, 154
A B X index, 180
anti-money laundering (AM L), 152
acceptance, of rating system s, 163-164
supervisory activity, 290
accounting perform ance vs. econom ic value, 21-22
anxiety bias, 128
accounting problem , 22
A pplied Science and Technology Research Institute (ASTRI), 367
accuracy, data quality, 154
arbitrage, convertible bonds and, 179
accuracy indexes, for validation, 167
asset-liability m anagem ent (ALM ), 262
Acharya, V. V., 273, 277
asset m anagem ent, O pRisk data, 131-132
acquisition/divestiture analysis, 201
assets under m anagem ent (AUM ), 131
adaptive response, in cyber resilience, 351
Association of C ertified Fraud Exam iners Report to the Nation
add-on factor, 226
(2006), 153
advanced IRB (A-IRB) approach, 331
asym m etries distribution, 24
advanced m easurem ent approach (AM A), 117, 313, 314, 333
asym ptom atic single-risk-factor (ASRF) m odel, 219, 220
for loss estim ation, 253
asym ptotic single risk factor m odel, 310
advanced persistent threat (APT), 353
at the margin, 20
adverse price m ovem ents, 119
audit findings, 8
after the fact, 25
audit, of third parties, 381
aggregate risk capital, 189
Australian crisis, 82
aggregating risks, 22-23
Australian Prudential Regulation Authority (APRA ), 82, 96, 363, 364
aggregation. See also risk aggregation
auto lending, 273
challenges, 225
A utorite de Controle Prudentiel et de Resolution (A C PR), 368
of projections, 262-263
availability bias, 127
of risk m easure, 208
available capital, 2 0 1 ,2 0 5
A IG , 297
available-for-sale (AFS) securities, 252-253
A llen, L „ 273
available stable funding (ASF), 323
Alliant C red it Union, 32
A X A Rosenberg G roup LLC , 174
allowance for loan and lease losses (ALLL), 262
Am erican A ir Force, 128
Am erican A xle C o ., 178 B
am ortised cost, 343 back-testing, 145-146, 168-171, 217, 227
analytic monitoring, in cyber resilience, 351 backward-looking indicators, of resilience, 370-371
balance sheet, 261-262 operational risk capital, 313
liability side of, 230 Pillar 2, 309, 310
m odeling, 274-275 Pillar 3, 309, 310
Bangia, A ., 222, 270 regulation, 122, 160, 164
Bankers Trust, 184 validation principles, 215
bank exposures, 312 Basel II.5, 318-319
bank holding com panies (BH Cs), 236-238 Basel II A ccords, 152-153
docum enting decisions, 243 Basel III, 319
internal capital planning (See capital planning) capital conservation buffer, 321-323
internal control fram ew ork, 239 capital, definition of, 320
policies and procedures, 240-241 CVA risk fram ew ork, 323, 332-333
scenario design, 245-246 finalising post-crisis reform s, 337-344
banking book internal ratings-based (IRB) approach, 323-324, 331-332
formal stress testing, 270 leverage ratio, 321, 333-334
interest rate risk in, 196, 198, 227-233 liquidity risks, 323-324
optionality in, 229-230 operational risk fram ew ork, 324, 333
vs. trading book, 233 output floor, 334-335
banking conduct and culture post-crisis reform s, 322
assessm ent of industry progress, 86-97 standardised approach for credit risk, 323, 328-331
effective three lines of defense, 94-95 transitional arrangem ents, 335-336
holding m anagers accountable, 97 basic indicator approach (BIA), 313
investor view, 91 basis risk, 176
m indset of, 88-89 Bear Stearns, 266
perform ance m anagem ent and incentives, 91-92 benchm arking, 168-171, 217
regulators, supervisors, enforcem ent authorities, and industry benchm ark m odels, 145, 252
standards, 95-97 Berkow itz, J ., 270
senior accountability and governance, 89-91 bias, in scenario analysis, 127
skills and capabilities required of regulators, 103 bid-ask spread, 229
staff developm ent and prom otions, 92-94 bilateral clearing, 294, 296
training for lasting behavioral change, 104 bilateral cyber-security information-sharing, 375
Banking Executive Accountability Regime (B EA R ), 82, 96 binomial test, 168
Banking Standards Board (BSB), 97, 104, 111 BIS, 190, 270
Banking Supervisory Requirem ents for IT (BA IT), 364 Black, F„ 228
Bank of England, 304, 305, 323, 367, 384 Black-Scholes biases/m odel, 174
Bank of England A ct 1998, 385 board and m anagem ent engagem ent, 72
bankruptcy, 19, 300-301 board of director (BO D ), 4
Bank Secrecy A ct (BSA ), 152, 287, 290 capital planning and, 241-242
banks' pricing behaviour, 230-231 in cyber-security, 365
banks share inform ation, 373 governance, 5-7
Banziger, Hugo, 32 recom m endations for, 55-57
Barings Bank, 313 responsibilities regarding service providers, 282
Basel A ccord , 126, 304 risk m anagem ent, 147
Basel Com m ittee, 214 board reporting, 242
interest rate risk, principles for, 231 Board to Banker, 65
Principle 16, 227 bootstrap procedures, 167
validation principles, 215 bottom-up process, 50, 56
Basel Com m ittee on Banking Supervision (BCBS), 138, 160, 210, 304, 305 Boudoukh, J ., 273
base-level m etrics, 156 Brace, A ., 228
Basel I, 304-309 Breuer, T. M ., 210
goal of, 305 broker-dealers risk, 132
risk-based capital ratio, 305-309 Buehler, Kevin, 32
Basel II, 2, 194 burned-out capital, 185
credit risk capital, 310-312 business continuity (BC ), 403, 406
event type, 117-119 financial m arket infrastructures (FM Is), 394
innovations of, 309 of service providers, 287

418 ■ Index
business cycle, 191 assessing capital adequacy im pact, 261-263
business disruption and system failures (BD SF), 119-120 BH C scenario design, 245-246
business environm ent and internal control environm ent factors (B EIC Fs), capital policy, 243-245
123-126 estim ation m ethodologies for losses, revenues, and expenses,
key risk indicators (KRIs), 125 246-261
risk control self-assessm ent (RCSA), 124-125 foundational risk m anagem ent, 238-239
business im pact assessm ent (BIA), 380 governance, 241-243
business im pacts, of data quality, 152-153 internal controls, 239-241
business im pact view, 157 Capital Plan Rule, 236, 237, 242, 245
business indicator (Bl), 333, 338, 339 capital policy, 243-245
business indicator com ponent (BIC), 323, 333, 338, 342-343 contingency plan, 244-245
business-level use, of econom ic capital, 199-200 goals and targets, 244
business line m anagem ent, 134 w eak, 244
business perform ance capital requirem ents, 96
enterprise risk m anagem ent (ERM ), 30-31 Capital Requirem ents Regulation (CRR), 393
business planning process, 49-52 captive finance, 178
business process m appings, 8 capture the flag, 348
business process view, 157 cash flow m appings, 176
business resiliency, 5, 12 cash flows, 22, 176
business resum ption, service provider contracts and, 286 catastrophe bonds, 31
business risk, 209 catastrophe exposure, 154
business services, 402 C D S indexes, 176
availability and integrity of existing, 391 C D X .N A .IG , 176
building resilient, 388-389 Central Bank of Ireland, 267
focusing on, 387 central banks, 304
prioritising by, 387 central clearing, 294-296
supply of new, 391 central counterparty (C C P), 294, 299
system s and processes, 404 and bankruptcy, 300-301
business unit (BU), 4 1 ,4 6 , 47, 49 defined, 294
in O T C m arkets, 295
central risk function, 133-134
C challenger m odels, 240
calibration, quantitative validation, 168 change-control processes, 203
Cam pa, J . M ., 231 charge-off m odels, 250, 252
Canabarro, E ., 273 chief information officer (C IO ), 366
capital chief information security officers (CISO ), 366
for credit risk, 310-312 chief risk officer (C RO ), 14, 16, 31-32, 366
definition of, 320 China Banking Regulatory Com m ission (C B R C ), 96
for m arket risk, 308-309 chi-square test, 168
for operational risk, 313 Chrysler, 178
Tier 1 and Tier 2, 305 Citigroup, 89
capital adequacy assessm ent, 196-197, 202, 261-263 classification tests, for validation, 167
capital adequacy process (CA P), 236 Clearing House Autom ated Paym ent System (C H A PS), 385,
principles of, 237 392, 403
capital asset pricing model (CA PM ), 184 clearing houses, 295
Capital Assistance Program (C A P), 267 C learPo rt, 295, 301
capital budgeting, 192, 201 clients, products and business practices (CPBP) risk, 118-119
decision rule, 188-189 C L O , 177
risk-adjusted return on capital (R A R O C ), 185-186 closeout horizon, 226
capital conservation buffer (C C B ), 321-323 cloud service providers (CSPs), 378
capital m anagem ent regulatory cloud sum m its, 378
decisions, 183 cloud services, 403
process, 192 C M B S, 180
Capital M anagem ent Policy, 69 C M B X , 180
capital planning, 236-237 C M E G roup, 295

Index ■ 419
Cochrane, J . H .( 232 consistency
C o h eren t Stress Testing (Rebonato), 271 data quality, 154-155
C o le, Eric Dr., 352 rating system s, 164
collection threshold, 121-122 Consum er Financial Protection Bureau (C FP B ), 96, 326
Collins and Aikm an, 178 consum er loans, 229
com m ercial banking, 59 contagion approach, 219
com m ercial real estate (C R E), 330 context bias, 128
Com m ission de Surveillance du Secteur Financier (C SSF), 378 contingency considerations, of service providers, 287
com m ittee com position, 8 contingency plan
Com m ittee of European Banking Supervisors (C EB S ), 267, 268, 378 capital, 244-245
Com m ittee on Global Financial Stability (C G FS ), 231, 270 service provider contracts and, 286
Com m ittee on M arket Best Practices (CM BP), 38 contingent convertible bonds (CoCos), 324-325
Com m ittee on Paym ents and M arket Infrastructures (CPM I), 362 continuity m anagem ent, 12
Com m ittee on Paym ents System s and M arket Infrastructures (CPM I), 390 contraction risk, 229
com m ittee operation, 8 control and mitigation
com m ittee structure, 8 risk m anagem ent environm ent, 5, 10-11
Com m on Equity T ie r 1 (C ET1) capital, 328 Control O bjectives for Information and Related Technologies (CO BIT), 363
common risk currency, 209 convertible bonds, 176
Com m onwealth Bank of Australia (CBA ) G roup, 39, 71-75 Cooke ratios, 305
com m unications plans, FM Is, 394 coordinated defense, in cyber resilience, 351
com parative advantage in risk-bearing, 15 copulas, 195, 211, 212, 220
com parative analysis, 9 The C ore Principles fo r E ffective Banking Supervision (Basel
com pensation, service provider contracts and, 284 Com m ittee), 2
com pleteness Core Principles M e th o d o lo g y (Basel Com m ittee), 2
of databases, 122 core risk level, 187
of data quality, 154 core risks, 14, 187
of rating system s, 163 corporate culture, 106-108
com plex m etric, 156 corporate exposures, 312
com pliance risk, 239 corporate finance, 129
data quality, 152, 154 corporate governance, enterprise risk m anagem ent (ERM ), 33
com pliance risks, 282 corporate operational risk function (C O R F), 3-4
com prehensive approach, 310 corporate risk manager, 14
Com prehensive Capital Analysis and Review (C C A R ), 93, 236, 237, 325 corporate treasury, 14
com prehensive risk m easure, 319 correspondent banking, 291-292
com prehensive validation costs, service provider contracts and, 284
evaluation of, 143-144 Council for Registered Ethical Security Testers (C R ES T), 352, 367
ongoing monitoring, 144-145 countercyclical capital buffer (C C yB ), 321, 322
outcom es analysis, 145-146 counterparties
com puter em ergency readiness team (C ER T), 376 credit risk engines, 226
Com puter Incident Response C en ter (C IRC L), 376 defaults of, 257
com puter security incident response team s (CSIRTs), 376 high risk, 226
concentration risk, 282, 377 margined vs. non-margined, 225
identification, 226 counterparty credit exposure, 223
conduct, defined, 78 m easurem ent, 224
confidence-based im pacts, data quality, 152 range of practices, 225-227
confidence level counterparty credit risk, 273
risk-adjusted return on capital (R A R O C ), 188 m arket risk and, 255-256
risk aggregation and, 210 counterparty credit risk (CC R), 196, 197
risk m easures and, 207 ancillary processes and, 226
confidentiality challenges, 223-225
of information for third-party interactions, 381-382 model validation, 227
service provider contracts and, 284-285 operational-risk-related challenges, 224-225
conservatism , 248 country risks, 282

420 ■ Index
C P M I-IO SC O guidance, 369, 378, 380 cyber-fraud, 374
credit conversion factors, 307 cyber-resilience
credit equivalent amount, 307, 308 adaptation to changing conditions, 347
credit loan loss-estimation approaches, 250 business continuity planning and staff engagem ent, 347-348
Cred itM etrics, 187, 219, 271 challenge of, 349
credit portfolio m anagem ent, 199 communication and sharing of information, 371-376
credit portfolio m odels, supervisory concerns relating to, 221-222 defined, 362
credit risk, 23 gam ification, 348
assessm ent, 153 incident response planning, 351-352
capital for, 310-312 and independent assurance, 368-369
copulas and, 220 information security controls testing, 368-369
counterparty, 196, 197, 223-227 interconnections with third parties, 377-382
data quality, 153-154 negative attributes, 350
dependency m odelling, 195, 197, 218-222 nudging behavior, 348
interest rate risk and, 232-233 objectives, 350-351
internal ratings-based (IRB) approach for, 331-332 organization, attributes of, 349-351
and m arket risk, 224 positive attributes, 350
price of, 231 real-time crisis m anagem ent, 346-347
retail and w holesale, 249 response and recovery testing and exercising, 369-370
risk aggregation, 209 risk awareness in staff, 347
standardised approach for, 328-331 risk m anagem ent fram ew ork, 346
CreditRisk+ , 219, 220, 271 safety m anagem ent, 348-349
credit substitution approach, 313 security solutions, 352-355
credit support annex (C SA ), 225, 296 standards, 347
credit valuation adjustm ent (CVA), 256, 273, 323, 324, 332-333 standards and guidelines, 363, 364
C R E S T C ertified Sim ulated A ttack M anager (C C SA M ), 367 supervising m ethods, 368
C R E S T C ertified Sim ulated A ttack Specialist (C C SA S ), 367 threat detection, 352-353
C R E S T C ertified Threat Intelligence M anager (C C TIM ), 367 training program s, 347
Critical Infrastructure Notification System (CIN S), 374 cyber-risk controls, taxonom y of, 369
critical service providers, 394 cyber-security, 346
cross-industry architecture and standards, 366
high dependence on specialized skills, 85-86 information-sharing practices, interlinkage of, 371
ineffective leadership and m anagem ent skills, 86 m anagem ent roles and responsibilities, 365
lack of diversity, 85 and resilience m etrics, 370-371
misaligned incentives, 86 risk awareness culture, 365-366
presence of dom inant com panies, 85 strategy, 364-365
Cross M arket O perational Resilience Group (C M O R G ), 370, 399 threat analysis, 346
Crouhy, Michel, 188 w orkforce, 366-367
crow ded trades, 225 C yb er Security A gency (C SA ), 372
C-suite, 99, 100 Cybersecurity Fortification Initiative (CFI), H KM A's, 367
culture C yb er Security Summit, 348
dashboards, 107 cyber threats, 391
defined, 78 cyber war gam e, 370
of distribution, 108
of production, 108
cure period, 225 D
currency, data and, 155 Dai, Q „ 228
current exposure, 223 dam age to physical assets (DPA), 121
current exposure m ethod, 306 Dang, T. V., 278
custom er and product profitability analysis, 200 Das, S. R., 221
custom er com plaints, service provider contracts and, 286 databases
custom er due diligence (CD D ), 291 com pleteness of, 122
custom er segm entation, 199, 200 external, 126

Index ■ 421
data collection, 165 D epartm ent of Defense G uidelines on Data Q uality, 153
data, for loss estim ation, 249 dependency modelling
data governance (D G ), 152 in credit risk, 195, 197, 218-222
data quality, 253-254 shortcom ings of, 221-222
accuracy, 154 use of, 222
business im pacts of poor, 152-153 derivatives bonds, 31
checks, 216 Derm an, E ., 228
com pleteness, 154 Deutsche Bank, 32
com pliance risk, 152, 154 developm ent risk, 154
confidence-based im pacts, 152 differences of opinion, 96
consistency, 154-155 digital service providers (DSP), 376
control, 155-156 Dim akos, X . K., 213
credit risk, 153-154 direct m arket access, 132
currency, 155 directors, role of, 112
developm ent risk, 154 disaster recovery (DR), 406
dim ensions, 154 disclosure
em ployee fraud and abuse, 153 econom ic capital and, 203
financial im pacts, 152 role of, 5, 12
information flaws, 153 stress testing, 268, 275-277
inspection, 155-156 discrim inatory power, 166, 167
insurance exposure, 154 discussion paper (DP), 384
issues view, 156-157 integrity, 403
mapping business policies to data rules, 155 structure, 386-387
other dim ensions of, 155 dispute resolution, service provider contracts and, 285
oversight, 155-156 distorted risk m easures, 206, 207
productivity im pacts, 152 distributed denial of service (D D O S), 371
reasonableness, 155 diversifiable risk, 14
and revenue assurance, 153 diversification
risk im pacts, 152 assum ptions, 204
satisfaction im pacts, 152 effect, 189-190
scorecard, 156 inter-risk, 210-211
underbilling, 153 docum entation
uniqueness, 155 for capital planning, 241
validating rating m odels, 164-166 risk m anagem ent, 149
dataset, 162-165 docum enting decisions, BH Cs with, 243
deadw eight costs, 14 Dodd-Frank A ct, 236, 275
debt-to-equity ratio, 183 dom estically system ically im portant (D-SIBs), 321, 325
deception, in cyber resilience, 351 due diligence, service providers and, 283-284, 291
decision-m aking, 141 Duffie, D „ 221, 296
authority, 16 dynam ic simulation m odel, 229
econom ic capital to, 25-26
financial aspects of, 138
process, 42 E
decom position, of risk m easure, 208 earnings at risk (EaR), 228, 230
default econom ic capital, 182, 183. See also risk capital
events of, 296 adequacy assessm ent, 196-197, 202
service provider contracts and, 285 business-level use, 199-200
default m ode m odel, 220 challenges in, 198
default probabilities, 163 change-control processes, 203
default risk charge, 335 counterparty credit risk, 196, 197, 223-227
Delphi C o rp ., 178 to decision-m aking, 25-26
Delphi technique, 128 defined, 194, 198, 213
delta risk, 298 dependency m odelling, credit risk, 195, 197, 218-222
De N ederlandsche Bank (DN B), 95 governance and, 194, 199-205

422 ■ Index
 for interest rate risk, 196, 198, 227-233 European Banking Authority (EB A ), 91, 267, 269, 274, 362, 363
internal model validation, 214-218 European Fram ew ork for Threat Intelligence-based Ethical Red Teaming
recom m endations, 196-198 (TIBER-EU ), 369
risk aggregation, 195, 197, 208-214 European Insurance and O ccupational Pensions Authority (EIO PA ), 314
risk identification, 197 European Securities and M arkets Authority (ESM A ), 362
risk m easures, 194-195, 197, 205-208 European Supervisory Authorities, 362
senior m anagem ent involvem ent, 202 events of default, 296
supervisory concerns relating to, 203-205 exception VAR, 309
transparency and m eaningfulness, 205 excess equity, 17
unit involved, 203 exchange-traded m arket, 294, 300
uses, 194, 199-205 execution, delivery, and process m anagem ent (ED PM ), 117-118
validation, 195, 197 "E xe rcise " Resilient Shield, UK/US, 370
econom ic functions, 403 existing regulatory requirem ents
econom ic value added (EVA), 34, 185 relating to financial stability, 394-395
econom ic value of equity (EVE), 228, 230 relating to harm, 394
econom ic value vs. accounting perform ance, 21-22 relating to viability of firm s and FM Is, 392-394
em ployee engagem ent, 107 exp ected losses (EL), 34, 188, 250, 311, 312
em ployee fraud and abuse, 153 exp ected operational losses, 123
em ploym ent practices and w orkplace safety (EPW S), 120-121 exp ected revenues, 185
end-to-end processing of paym ents, 395 exp ected shortfall (ES), risk m easures and, 206, 207
Enron, 219 exposure at default (EAD)
enterprise risk, 68 loss estim ation and, 250
enterprise risk m anagem ent (ERM ) value, 223
benefits of, 29-31 extension risk, 230
business perform ance, 30-31 external auditors, 2, 3
chief risk officer, 31-32 external com m unication, 202
com ponents of, 32-35 external databases, 126
corporate governance, 33 external data collection and analysis, 8
and corporate level risk com m ittee, 21 external dependencies, 12
data and technology resources, 35 external frauds, 120
definitions, 28-29 external loss data, 8
determ ining, 16-20 external resources, risk m anagem ent, 148-149
im plem enting, 20-26 extrem e value theory (EVT)
leadership, 21 defined, 228
line m anagem ent, 33-34 draw backs, 228
micro benefits of, 15-16
organizational effectiveness, 29
portfolio m anagem ent, 34 F
risk analytics, 34 factor-based capital allocation approach, 16
risk reporting, 29-30 factor loading, 232
shareholder value, 14-16 failure resolution m echanism s, 296
stakeholder m anagem ent, 35 Fannie M ae, 266
enterprise-w ide levels, 41 FASB Statem ents, 260
enterprise-w ide use, econom ic capital and, 200-202 fat tails, 22, 24
entities, 282 Federal D eposit Insurance Corporation (FD IQ ), 364
Equifax, 350 Federal Financial Institution Exam ining Council (FFIEC ), 282, 285, 363
equity capital, 24 Federal Insurance O ffice's (FIO ), 130
equity tranche, 178 Federal Reserve Bank, 236, 237
Ernst & Young, 154 Federal Reserve Bank of New York, 96
escrow agreem ents, 285 Federal Reserve's Capital Plan Rule, 236
estim ation m ethodologies feed er m odels, 240
general expectations, 246-249 Feldm an, M atthew, 32
loss-estimation, 249-257 Fender, I., 270
PPNR projection, 257-261 Financial Action Task Force's (FATF), 290

Index ■ 423
financial condition, of service providers, 286-287 debt, 19
Financial Conduct Authority (FC A ), 91, 384 internal controls, 394
Financial Consum er A gency of Canada (F C A C ), 96 m anagem ent and governance, 392-393
financial crisis outsourcing and critical service providers, 394
2000-2007, 131 risk m anagem ent, 393
2007-2009, 187 Fisher's r2, 167
financial distress, 17, 18, 24 Fitch rating, 182
financial im pacts, data quality, 152 fixed diversification, 211
Financial Industry Information System s (FISC), 367 Fixed Income, Currencies and Com m odities M arket Standards Board,
Financial Industry Regulatory Authority (FIN RA), 96 97, 104
financial institutions, 183 fixed-rate m ortgages, 229
contract provisions and considerations, 284-286 Flannery, M. J ., 266
defined, 282 flight to quality, 262, 272
failed, 304 floating-rate bond, 230
operations and internal controls, 284 Foglia, A ., 270
perform ance and condition, 283-284 Ford, 178
financial m arket infrastructures (FM Is), 362, 384, 389-397, 403 Ford M otor C red it C o. (FM C C ), 178
business continuity, 394 foreign-based service providers, 286, 287
com m unications plans, 394 foreign-exchange (FX) risks, 28
and contingency planning, 394 forensic investigation, 351
existing regulatory requirem ents, 392-395 foundational risk m anagem ent, 238-239
and expectations for firms and, 392-395 foundation IRB (F-IRB) approach, 331
im pact tolerances, 403 frailty approach, 221
internal controls, 394 A Fram ew ork fo r Internal C ontrol System s in Banking O rganisations
large firm s and, 395-396 (Basel Com m ittee), 2
m anagem ent and governance, 392-393 frauds
outsourcing and critical service providers, 394 cyber-fraud, 374
in practice, 395-397 em ployee fraud and abuse, 153
risk m anagem ent, 393 external, 120
small or mid-sized firm s, 396 internal, 120
very small firm s, 396-397 Freddie Mac, 266
Financial Policy Com m ittee, 326 Friedm an, Paul, 174
financial regulators, 406 full m odelling/Sim ulation, 211, 212
financial sector professionals, 378 full-revaluation m ethods, 257
Financial Security Institute (FSI), 367 fully diversified capital, 190
Financial Services and M arkets A ct 2000 (FSM A), 384, 385 funding liquidity, 278
Financial Services Information-sharing and Analysis C enter (FS-ISAC), 374 futures contracts, 295
financial stability futures exchange clearing, 295
existing regulatory requirem ents relating to, 394-395
im pact on, 391-392
Financial Stability Board (FSB), 97, 108, 318 G
Financial Stability O versight Council (FSO C ), 326 G am bacorta, L., 231
Financial Stability Report (FSR), 385 gam ification, 348
Financial Stability Strategy, 385 gam ing, 128
financial terrorism , 290. See also money laundering and financial gap risk, 225
terrorism (M L/FT) risk m anagem ent G A R C H (General Autoregressive Conditional H eteroscedasticity), 232
FinTech Know ledge Hub, 368 Gaussian copula, 220, 221
FinTech Lab, 368 Gaussian copula model, one-factor, 310
Fiori, R „ 232 G eneral Data Protection Regulation (G D PR), 403
fire sale, 187 G eneral Motors (GM ), 178
firms G eneral Motors A ccep tance C o. (G M A C ), 178
business continuity, 394 Germ an Banking A ct, 364
com m unications plans, 394 Germ an steel resilience, 353
and contingency planning, 394 G ibson, M. S., 270

424 ■ Index
Global Banking Education Standards Board, 97 IBM O pVantage, 126
global system ically im portant banks (G-SIBs), 321, 325, IC E Clear, 295
333-334 IFRI and C R O Forum (2007) survey, 201, 203, 205, 207, 212
global system ically im portant insurers (G-SII), 321 im plem enting ERM
G oldstein, I., 277 aggregating risks, 22-23
Gonzales-M inguez, J . M., 231 econom ic capital to make decisions, 25-26
good risk, 110 econom ic value vs. accounting perform ance, 21-22
G o o g le, 133 governance of, 26
G ordy, M. B „ 310, 311 inventory risks, 20-21
G ordy m odel, 319, 320 measuring risks, 24
G orton, G ., 278 regulatory vs. econom ic capital, 24-25
governance incentive com pensation review, 286
board of directors, 5-7 incident response planning, in cyber resilience
capital planning and, 241-243 forensic investigation, 351
cyber, 363-367 initial breach diagnosis, 352
econom ic capital and, 194, 199-205 income simulation m odels, 230
of ERM , 26 increm ental default risk charge (IDRC), 319
operational, 4-5 increm ental risk charge (IRC), 318-319
risk m anagem ent, 146-149 indem nification, service provider contracts and, 285
risk organization and, 134-135 inexpert opinion, 128
senior accountability and, 89-91 information flaw s, 153
senior m anagem ent, 5, 7-8 information security controls, 368-369
Gram m -Leach-Bliley A ct of 1999, 153 information security m anagem ent, 368
granular credit-risk rating system , 251 information-sharing
gross incom e, 313, 314 from banks to regulators, 373-374
gross loss, 340-341 cross-border cybersecurity, 375
group-level use, econom ic capital and, 200-202 fram ew orks across jurisdictions, 371-372
G roup Risk A p p etite Statem ent (RAS), 72-73 percentage of jurisdictions, 372
G roup Risk M anagem ent, 61 from regulators to banks, 375
with security agencies, 375-376

H sharing among banks, 373

sharing among regulators, 374-375
haircut, for securities financing activities, 227
types of, 373
Heath, D ., 228
information technology (IT), 28
hedge, 15
Information Technology Supervisors' Group (ITSG ), 363
held-to-maturity (HTM ) security, 252-253
initial margin, 294
Hickman, A ., 271
determ ination of, 298
high-quality liquid assets (H Q LA ), 323, 324
Institute of International Finance (IIF), 108
historical averages, 255
Institute of Risk M anagem ent (IRM), 108
holding m anagers accountable, 97
insurance, service provider contracts and, 285
Holmstrom, B., 278
interest rate risk
Hong Kong M onetary Authority (HKM A), 96, 367, 375
assessm ent of, 228-229
Hopper, G ., 273
in the banking book, 196, 198, 227-233
hotel keycard failure, 349
credit risk and, 232-233
house price index (HPI), 253, 272, 277
defined, 227
huddle bias, 128
m easurem ent challenges, 229-233
hurdle rate, 188-189
sources of, 227
hybrid approach, 175
stress testing, 231-232
hybrid capital, 275
internal audit, 4, 217, 239-240, 287
hypothetical portfolio testing, 216-217
function, 161
risk m anagem ent, 148
I Internal Capital A dequacy Assessm ent and Risk Control, 390
IA CPM and ISD A study, 218, 220-222 internal capital adequacy assessm ent process (IC A A P), 195,
lannotti, S., 2 3 1 ,2 3 2 198, 310

Index ■ 425
internal controls Kupiec, P. H., 270
for capital planning, 239-241 Kuritzkes, A ., 266
service providers and, 287
internal data collection, 253-254
internal dependencies, 12 L
internal frauds, 120 Large Exposures Fram ew ork, 320
internal loss data, 121, 340 leadership, 47, 49, 100
collection and analysis, 8 capabilities, 84
Internal Loss M ultiplier (ILM ), 324, 333, 338-339 legal exposures, 255
internal m odels approach, 225 legal risks, 282, 338
internal operational risk culture, 4 Lehm an, 266
internal ratings-based (IRB), 160 lending technology, 165
approach, 274, 310-311 Leung, Mona, 32
for asset classes, 331 leverage ratio
bank, corporate, and sovereign exposures, 312 Basel III fram ew ork, 333-334
for credit risk, 331-332 capital requirem ents, 321
retail exposures, 312-313 license, service provider contracts and, 285
internal rating system s, 162 limits on liability, service provider contracts and, 285
internal reporting, 201 line m anagem ent, enterprise risk m anagem ent (ERM ), 33-34
International Accounting Standards Board, 123 line of business (LO B) m anagem ent, 46
International Association of C red it Portfolio M anagers (IA CPM ), 218, liquidity, 299-300
220-222 liquidity coverage ratio (LCR), 323-324, 328
International Association of Insurance Supervisors (IAIS), 304 living wills, 324-325
International Financial Reporting Standard 9 (IFRS 9), 95 loan-to-value (LTV) ratio, 329
International M onetary Fund, 109 logistic regression, 163
International Organization of Securities Com m issions (IO SC O ), 300, 304, London Interbank O ffered Rate (LIBO R), 295
362, 390 long tail distribution, 22
International Organization of Standardization (ISO 31000), 29 look-back option, 187
International Sw aps and D erivatives Association (ISDA), 218, 220-222, Lopez, J . ; 312
296, 307 loss data identification
inter-risk diversification, 210-211 general criteria, 340
inventory risks, 20-21 specific criteria, 340-341
investor, 91 loss data set, 340
ISD A m aster agreem ent, 296 loss-distribution approach (LDA), 254-255
ISO 22301, 347 losses
ISO 27001, 347 exclusion of, 341
issuer defaults, 257 inclusion of, 342
loss-estimation m ethodology
available-for-sale (AFS), 252-253
J charge-off m odels, 252
Jap an ese Financial Services A g ency (JFS A ), 369 correlation with m acroeconom ic factors, 254
Jo in t Policy Statem ent on Interest Rate Risk, 271 counterparty and issuer defaults, 257
joint public-private exercising, 370 credit loan approaches, 250
Jo in t Statem ent on Innovative Efforts to Com bat M oney Laundering data and segm entation, 249
and Terrorist Financing, 290 expected loss approaches, 250
Jo rio n , R, 273 held-to-maturity (HTM ), 252-253
historical averages, 255
internal data collection and data quality, 253-254
K legal exposures, 255
Karolyi, G . A . , 107 loss-distribution approach (LD A), 254-255
Kaspersky Lab, 348 m arket risk and counterparty credit risk, 255-256
KMV, 187 operational-loss-estim ation approaches, 254
Koyluoglu, H. U., 271 operational risk, 253

426 ■ Index
 overview , 249 capital for, 308-309
P/L estim ates, 257 counterparty credit risk and, 255-256
rating transition m odels, 251 counterparty EA D estim ation challenges and, 223-224
regression m odels, 254 credit risk and, 224
retail and w holesale credit risk, 249 defined, 209
revaluation, 257 risk aggregation, 209
risk m itigants, 257 M arket Risk Am endm ent, 168, 307, 309
roll-rate m odels, 251-252 m arket variables, 15, 52, 53, 160
scalar adjustm ents, 252 marking-to-model, 175
scenario analysis, 255 mark-to-market
stress scenarios, 256 m ode, 220, 221
translating scenarios to risk factor shocks, 256-257 value, 178
vintage loss m odels, 252 m atrix reporting, 134
loss given default (LG D ), 223, 273 maturity adjustm ent factor, 312
credit-risk-related challenges to, 224 M cKinsey & C o ., 32
loss estim ation and, 250 measuring risks, 24
Luxem bourg regulator, 378 mezzanine tranche, 178
migration m atrices, for validation, 167
minimum capital requirem ent (M CR), 315
M Minimum Requirem ents for Risk M anagem ent (M aRisk), 364
machine learning, 93 Mizuho Securities, 133
M acquarie University Risk Culture Scale, 110 model errors, 174-175
m acroeconom ic factors modeling
correlation with operational-risk, 254 balance sheet, 275
scenario analysis based on, 232 independent review of, 240
macro-prudential stress testing, 266, 268, 269 losses, 273-274
M adoff, Bernie, 131 revenues, 274-275
M alware Information-sharing Platform (M ISP), 376 model quality, 139
m anagem ent actions, econom ic capital and, 204 model replication, 216
m anagem ent incentives, 200 model risk m anagem ent, 139-140
m anagem ent information system s (MIS), 238, 241 model validation
m anagem ent oversight, 216 elem ents of com prehensive validation, 143-146
managing information risk and other third-party products, 146
business im pact view, 157 vendor validation, 146
business process view, 157 m odified loss-distribution approach, 254-255
data quality issues view, 156-157 M onetary Authority of Singapore (M AS), 96, 367, 372, 375
managing scorecard view s, 157 money laundering and financial terrorism (M L/FT) risk m anagem ent
Manheim index, 273 application of standard practices, 290
mappings correspondent banking, 291-292
business policies to data rules, 155 custom er due diligence and acceptance, 291
business process, 8 governance, 290
cash flow, 176 international scope, 292
risk m easures, quality of, 176 risk assessm ent, 291
margin, 294 specific activities, 290
marginal capital, 190 transaction and m onitoring, 291
marginal econom ic capital requirem ent, 184 wire transfers, 292
margin calls, 300 Monte Carlo Sim ulation, 196, 226
margined counterparty, 225 Monte Carlo VaR, 176
Mark, C ., 311 M oody's, 17, 174, 182
m arket data, 175, 176 M oody's/KM V (M KM V), 219
m arket participant identifier (M PID), 132 M organ, D. R , 278
m arket participants, 390 M organ, J . P., 321
m arket risk, 23, 174 m ortgage-backed securities (M BSs), 229

Index ■ 427
m ortgages, 229 business services, 387-389
m ortgage servicing right (MSR) assets, 260 focusing on, 387
Mosser, P. C ., 270 prioritising by, 387
capabilities, 402

N clear outcom es for, 397-399

current approaches, 398
naked access, 132
executive sum m ary, 406
NarW est, 120
of firm s and FM Is, 389-397
Nasdaq 100 Index, 133
im portance of, 384
National Association of Insurance Com m issioners (N AIC), 130, 314
im proving, 409-411
National Australia Bank, 39, 62-67
need for, 406
National Institute of Standards and Technology (NIST), 346, 362
operational continuity in resolution, 393
negative convexity, 177
and operational risk, 393
net income after capital charge (N IA C C ), 185
potential benefits of setting im pact tolerances, 398-399
net interest incom e, 259-260, 313
and settlem ent system s, 392
net loss, 340-341
supervisory assessm ent of, 399-401
net present value (NPV), 17, 20, 34, 185
supervisory authorities' approach to, 384-386
net replacem ent ratio (NRR), 307, 308
O perational Resilience Working Group (O RG ), 362
net stable funding ratio (N SFR), 323-324, 328
operational risk m anagem ent
netting, 307
governance, 4-5
over-the-counter (O TC ) m arket and, 296
principles for, 3-6
N etwork and Information Security (NIS) D irective, 376
risk m anagem ent environm ent, 5
network intrusion detection system (NIDS), 353
role of disclosure, 5, 12
net w orth, 266
operational risks, 23, 174, 282, 403
non-core risks, 14, 15
capital for, 313
nonfinancial risks, 270
capital requirem ent, 333
non-interest expense, 261
defined, 209, 338
non-interest incom e, 260-261
losses, 340
non-margined counterparty, 225
loss-estimation and, 253
non-maturity deposits, 230
operational resilience and, 393
Nonpublic Personal Information (NPPI), 285
regression m odels, 254
Northern Rock, 323, 324
operators of essential services (O ES), 376
nudge principle, 348
O pRisk data
adding costs to losses, 123
O asset m anagem ent, 131-132
observation period, 167 business disruption and system failures (BD SF), 119-120
off-balance sheet exposure, 229, 258, 306 business environm ent and internal control environm ent factors
credit conversion factors for, 307, 331 (B EIC Fs), 123-126
O ffice of C red it Ratings, 326 clients, products and business practices (CPBP) risk, 118-119
O ffice of the Com ptroller of the Currency (O C C ), 96 com pleteness of database, 122
O ffice of the Superintendent of Financial Institutions (O SFI), 96 corporate finance, 129
O fficer of the Com ptroller of the Currency (O C C ), 364 dam age to physical assets (DPA), 121
on-balance sheet exposure, 229, 258 elem ents of, 121-123
one-factor Gaussian copula m odel, 310 em ploym ent practices and w orkplace safety (EPW S), 120-121
ongoing basis, 41 execution, delivery, and process m anagem ent (ED PM ), 117-118
ongoing consultation, 191 external databases, 126
ongoing monitoring, 144-145 external frauds, 120
operational continuity in resolution (O CIR) policy, 393 insurance, 130-131
operational data governance, 156 internal frauds, 120
operational-loss-estim ation approaches, 254 internal loss data, 121
operational resilience, 403, 409 policy, 135
approach, 406-408 profile, 129-133
bank paym ent, 392 provisioning treatm ent of exp ected , 123
building services, 388-389 recoveries and near m isses, 122

428 ■ Index
 retail banking, 129-130 PPNR projection m ethodologies, 257
retail brokerage, 132-133 net interest incom e, 259-260
risk organization and governance, 133-135 non-interest expense, 261
scenario analysis, 127-129 non-interest incom e, 260-261
setting collection threshold and possible im pacts, 121-122 observed practices, 258-259
tim e period for resolution, 123 robust projections, 258
trading and sales, 129 preferred risk, 56
O ption Adjusted Spread (O A S), 232 prepaym ent risk options, 229
options, scenario analysis based on, 232 pre-SCAP, 268
O rganisation of Econom ic Co-operation and D evelopm ent (O E C D ), 306 presentation bias, 127
organizational culture, 106 Presidential Policy D irective, 347
organizational design, 133 Pricew aterhouseCoopers, 153
organizational effectiveness, enterprise risk m anagem ent (ERM ), 29 Pricew aterhouseCoopers Survey, 202
organized trading facilities (O TFs), 297 pricing transactions, 184
original equipm ent m anufacturers (O EM s), 178 principal com ponents decom position, 232
original exposure m ethod, 306-307 principles for financial m arket infrastructure (PFM I), 389-390
other-than-tem porary im pairm ent (O TTI), 252, 253 privilege restriction, in cyber resilience, 351
outsourcing, 11, 394 probability of default (PD), 18, 188, 223
risk m anagem ent, 281-288 credit-risk-related challenges to, 224
oversight process, service providers and, 286-287 loss estim ation and, 250
over-the-counter (O TC ) m arket process verification, 144
bilateral clearing, 294, 296 Professional D evelopm ent Program (PDP), H KM A's, 367
C C P s and bankruptcy, 300-301 profitability analysis, 200
central clearing, 294-296 profit and loss attribution, 217
clearing in, 294-296 Prom pt Corrective Action (PC A ), 321
convergence of, 300 Prudential Regulation Authority (PRA), 368, 384
defined, 294 Prudential Standard C PS 234, 364
events of default, 296 putable bonds, 230
im pact of changes, 299-300
initial margin, 298-299 Q
netting, 296
qualitative processes, for validation, 215-216
post-crisis regulatory changes, 297-299
qualitative review, 215
role of C C P in, 295
quantitative approach, 138
uncleared trades, 297
Q uantitative Im pact Studies (QIS), 309
over/under confidence bias, 128
quantitative processes
ownership, service provider contracts and, 285
for validation, 216-217

P R
param eter review group, 191 ratings stability, 167
penetration test, 369 rating system s, 160
perform ance standards, service provider contracts and, 284 acceptance, 163-164
phishing attacks, 347 com pleteness, 163
Piazzesi, M ., 232 consistency, 164
Pillar 2, 309, 310 design, 162-164
Pillar 3, 309, 310 objectivity, 163
plan-do-check-act (PD CA) cycle, 366 supervisory validation of, 160
P/L estim ates, 257 rating transition m odels, 251
point-in-time (PIT), 188 real econom y, 403
portfolio m anagem ent, enterprise risk m anagem ent (ERM ), 34 Real-Time Gross Settlem ent (RTGS) Service, 385, 392, 403
position data, 175 Rebonato, R., 271, 273
post-crisis regulatory changes, 297-299 recovery, 340-341
post-SCAP, 268 recovery tim e objectives (RTO)
potential exposure, 223 operational resilience, 397

Index ■ 429
redundancy, in cyber resilience, 351 range of practices, 210-211
regression m odels, 254 supervisory concerns relating to, 213-214
regulation, 103 risk analytics, 34
regulators share inform ation, 374-375 risk appetite fram ew ork (RAF)
regulatory capital vs. econom ic, 24-25 capturing different risk types, 47-48
regulatory cloud sum m its, 378 case studies, 59-75
regulatory-type approach, 222 for firm s, 55-59
rehypothecation, 300 im plem entation, 41-43
relative risk m easurem ent, 204 practices, 43-55
reputational risks, 239, 282 principal, 39-41
required stable funding (RSF), 323 role of stress testing, 52-55
Research Task Force of the Basel Com m ittee, 210 risk appetites, 5, 14, 33, 38, 68-72, 166, 403
residential m ortgage-backed securities (RM BS), 176, 180, 253 benefits of, 41, 48-49
resilience, 347, 406. See also cyber-resilience; operational resilience into businesses, 45-47
backward-looking indicators, 370-371 and capital planning, 51
resilience engineering dynam ic tool, 48-49
hotel keycard failure, 349 evolution of, 74-75
safety m anagem ent, 348-349 and liquidity planning, 51
resilience m etrics, cyber-security and, 370-371 operational resilience, 397
resilient organizations, 407 and perform ance m anagem ent, 51
resilient softw are, 352 and risk culture, 44-45
retail banking, 129-130, 231 and strategic planning, 51
retail exposures, 312-313 Risk A p p etite Statem ent (RAS),62
return on assets (RO A), 260 risk assessm ent, 8. See also risk self assessm ent (RSA)
return on capital (RO C), 184 risk aversion, 7
return on capital at risk (R O C A R ), 201 risk awareness culture, cyber, 365-366
return-on-risk, 67 risk-based capital allocation, 16
return on risk-adjusted assets (RO RA A ), 184 risk-based pricing, 199-200
return on risk-adjusted capital (R O R A C ), 201 risk budget, 63, 65, 66
return trade off, 56 risk capacity, defined, 60
revaluation m ethodology, 257 risk capital, 182
revenue assurance, 153 active portfolio m anagem ent for entry/exit decisions, 183
revised IRB fram ew ork, 331 diversification and, 189-190
right to audit, service provider contracts and, 284 em erging uses of, 182-184
risk-adjusted perform ance m easurem ent (RAPM ), 182, 184-185 and incentive com pensation, 183
risk-adjusted return on capital (R A R O C ), 30 m easurem ent, 182
for capital budgeting, 185-186 perform ance m easurem ent, 183
and capital budgeting decision rule, 188-189 pricing transactions, 184
confidence level, 188 risk-adjusted return on capital, 184-192
default probabilities, 188 risk control self-assessm ent (RCSA), 8, 124-125
econom ic capital and, 199-200 risk culture (RC), 40, 73
horizon, 186-188 change and challenge, 110-113
hurdle rate, 188-189 culture dashboards, 107
for perform ance m easurem ent, 186-190 culture survey, 107
point-in-time (PIT) vs. through-the-cycle (TTC ), 188 custom er perceptions and outcom es, 107
in practice, 190-192 drivers and effects, 109-110
with qualitative factors, 191-192 measuring culture and cultural progress, 107
vs. shareholder value added (SVA), 201 reduce m isconduct risk, 112
risk-adjusted return on risk-adjusted assets (RA RO A ), 201 and risk appetite, 44-45
risk aggregation, 43, 54-55 scope and definition, 108-109
econom ic capital and, 195, 197 validation, 107
fram ew ork, 208-209 risk departm ents, 133-134
m ethodology, 209-210 risk diversification effect, 183

430 ■ Index
risk factor m odel, 310 risk posture, 50-52, 62-66
risk factor shocks, 256-257 risk reporting, 29-30
risk identification risk-return trade-off, 15-16
for bank holding com panies (BH Cs), 238-239 risks
econom ic capital and, 197 com prehensive capture of, 204
risk m anagem ent, 20 covariance m atrix of, 213
board of directors, 147 grouping of, 209
docum entation, 149 and perform ance indicators, 9
external resources, 148-149 risk self assessm ent (RSA), 8
financial m arket infrastructures (FM Is), 393 risk settings, 63, 65, 66
governance, 146-149 risk setting statem ents (RSSs), 67
internal audit, 148 risk tolerance, 5
macro benefits of, 14-15 risk types, 187
model developm ent and im plem entation, 140-141 risk-weighted assets (RW As), 258, 261-262, 273, 275, 305, 306, 321
model inventory, 149 roll-rate m odels, 251-252
model use, 141-142 advantages, 251
model validation, 142-146 Rosenberg, J . V., 213
overview of, 138-140 Royal Bank of Canada, 39, 59-62
policies and procedures, 147 Rudebusch, G . D ., 232
programs for service providers, 282-288 Rutter A ssociates LLC , 199
purpose and scope, 138
recom m endations for, 58-59
roles and responsibilities, 147-148 S
senior m anagem ent, 147 Sabre SynXis Central Reservations System , 349
Risk M anagement and Modelling Group (RM M G) (Basel Com m ittee), 198 safety m anagem ent, 348-349
risk m anagem ent environm ent, 8-11 Sapra, H., 277
business resiliency and continuity, 5, 12 Sarbanes-O xley A ct, 33, 152, 287
control and m itigation, 5, 10-11 Saunders, A ., 273
identification and assessm ent, 5, 8-9 S B C W arburg, 119
monitoring and reporting, 5, 9-10 scalar adjustm ents, 252
operational risk m anagem ent, 5 scenario analysis, 9, 127-129
risk manager, 175 for bank holding com panies (BH Cs), 255
risk m easures, 19, 24 based on G A R C H m odels, 232
bank holding com panies and, 238 based on historical distributions, 232
calculation of, 207-208 based on m acroeconom ic factors, 232
desirable characteristics, 205-206 based on options, 232
econom ic capital and, 194-195, 197 based on principal com ponent decom position of yield curve, 232
supervisory concerns relating to, 208 linking credit and interest rate risk, 232-233
types of, 206, 207 scenario design, bank holding com panies (BH Cs), 245-246
risk m easures, quality of scenarios, 127
C redit Correlation (2005), 176-179 Schuerm ann, T., 213
mapping issues, 176 scorecard view s, 157
model risk, 174-180 Scotiabank, 39, 68-71
subprim e default m odels, 180 Scott, H., 266
valuation risk, 174-175 Sector Exercising Group (SEG ), 370
variability of VaR estim ates, 175-176 Securities and Exchange Com m ission (SEC ), 96, 326
risk m etric, 210 Securities and Futures Authority, 119
RiskM etrics, 270, 271 Securities and Futures Com m ission's (SFC's), 96
risk m itigants, 257 securitizations, 176
risk organization security m aster data, 175
firm w ide policy, 134 segm entation
governance, 134-135 in cyber resilience, 351
risk departm ents, 133-134 for loss estim ation, 249

Index ■ 431
self-regulation, 107 spectral risk m easures, 206, 207
senior accountability sponsored access arrangem ents, 132
applicability, 90 spread duration, 231
board-level conduct m anagem ent reporting, 89-90 square root of tim e rule, 187
board responsibilities and involvem ent, 89 stakeholder m anagem ent, 35
data quality and availability, 89-90 stand-alone capital, 190
and governance, 89-91 standard deviation, 206, 207
modeling behavior, 90 Standard Initial Margin Model (SIM M ), 298-299
relevance and effectiveness, 90 standardised approach
role of asset ow ners, 90 application of, 339
third-party fund m anagers, 90 Basel II, 310-311
usefulness, 90 Basel III, finalising post-crisis reform s, 322
Senior Insurance M anagers Regim e (SIMR), 403-404 capital for, 313
senior m anagem ent, 161 for credit risk, 328-331
capital planning and, 242-243 loss data set, 340
com m itm ent, 191 operational risk capital requirem ent, 339
in cyber-security, 365 use of loss data under, 339-340
econom ic capital and, 197, 202 standardised credit risk assessm ent approach (SCRA), 329
governance, 5, 7-8 Standard & Poor's, 182
recom m endations for, 57-58 static simulation m odel, 229
responsibilities regarding service providers, 282 statutory capital, 22
risk m anagem ent, 147 Steering Com m ittee on Im plem entation (SCI), 38
Senior M anagem ent Function (SM F), 393 stranded capital, 24
Senior M anagers and Certification Regime (SM &CR), 393, strategic planning, 201
403-404 strategic risks, 239
Senior Supervisors Group (SSG ), 38 capital, 185
service-level agreem ents (SLAs), 156 stressed VaR, 318
service providers stress m etrics, 41
board of directors and senior m anagem ent responsibilities, 282 stress testing, 41 -4 3 , 168-171
business continuity of, 287 balance sheet and income statem ent dynam ics, 275
business m odel, 283 for bank holding com panies (BH Cs), 239
contingency plan of, 286 and Basel rules, 325
defined, 282 Bayesian approach, 271
due diligence and selection, 283-284 counterparty credit risk exposure and, 226
financial condition of, 286-287 designing the scenarios, 271-272
foreign-based, 286, 287 disclosure, 267, 268, 275-278
multinationals valued, 304 in interest rate m odelling, 231-232
oversight and monitoring of, 286-287 in literature, 270-271
risk m anagem ent program s, 282-288 losses and revenues, 272-275
risks from use of, 282 m acroprudential, 269
shareholder value added (SVA) vs. R A R O C , 201 role of, 52-55, 204
Sharpe ratio, 185 scenario-based, 239
Sheffield Elicitation Fram ew ork (SH ELF), 128, 129 validation and, 217
sim ple approach, 310 subcontracting, service provider contracts and, 286
sim ple sum m ation, 211, 212 supervision, 103
single-factor m odels, 228 supervisors, 93
Single Supervisory Mechanism (SSM ), 374 role of, 2-3
Singleton, K. J ., 228 supervisory assessm ent
software developm ent life cycle (SD LC ), 352 analysis of system s, 400
solvency capital requirem ent (SCR), 315 gaining assurance, 400
Solvency II, 314-315 people and processes that support business services, 400
sovereign exposures, 312 sector-wide work, 399-400
specific risk (SR), 308 supervisory tools, 401
capital for, 309 tolerances, 400

432 ■ Index
supervisory authorities, 404 trade control, lack of skills in, 116
factors relating to, 390-392 trading book vs. banking book, 233
objectives, 385 transition m atrix, 18
Supervisory Capital Assessm ent Program (SC A P), 236, 266-269 transparency, 197, 205
supervisory college m odel, 378 Treacy, W. F., 311
supervisory validation, 160 treasury bond, 295
suspicious activity report (SA R),287 Trump Hotels, 349
Sw apCIear, 295, 301 Turnbull, M alcolm, 82
swap execution facilities (SEFs), 297, 326
system developm ent risks, 153
system downtim e, 125
u
UAW, 178
system ically im portant financial institutions (SIFIs), 321
UBS, 32
system ic issues, 103
UK Financial Conduct Authority, 97
system im plem entation, 215
UK Senior M anagers and Certification Regim e (SM CR), 97
system integration, 144
unauthorised access, to m arket sensitive data, 391
system slow tim e, 125
uncleared trades, 297
underbilling, revenue assurance and, 153

T underinvestm ent problem , 15

under-reporting events, 122
Tarashev, N ., 222
underwriting risk, 315
tax benefits of debt, 17
unexpected loss, 311, 312
t-copula, 220
unfiltered access, 132
technology service provider (TSP) risk, 282
unintended consequences, 97
term ination, service provider contracts and, 285
uniqueness, data quality and, 155
testing, of third parties, 381
unit of account, 209-210
Thaler, W illiam , 348
USA PA TRIO T A ct, 152
third lines of defence (3LD), in cyber-security, 365
use test, 215
third-party fund m anagers, 90
third-party products, 146
third-party services, 377 V
auditing and testing, 381 validating rating models
business continuity and availability, 379-380 data quality, 164-166
governance of, 377-379 internal validation, 160
information confidentiality and integrity, 380-381 profiles, 160-161
regulated/certified, 378 qualitative validation, 162-166
resources and skills, 382 quantitative validation, 166-171
supervisory expectations for visibility, 381 regulatory validation, 160
third-party vendors, 161 roles of internal validation units, 161-162
threshold, 17 validation, 3
through-the-cycle (TTC ), 188 econom ic capital and, 195, 197
Thyssenkrup, 353 of inputs and param eters, 216
TIB ER -EU (European Fram ew ork for Threat Intelligence-based Ethical of internal econom ic capital m odels, 214-218
Red Team ing), 369 of m odels, 240
tick-box, 41 qualitative, 215-216
tick the box com pliance, 130 quantitative, 216-217
T ie r 1 C apital, 305, 320 supervisory concerns relating to, 218
T ie r 2 C apital, 305 valuation risk, 174-175
tim e horizons, 187, 208, 210, 229 value-at-risk (VaR), 19, 196
tim e period for resolution, 123 calculation m ethodology, 182
tolerance statem ent, im pact, 403 as C C R exposure engine, 226
top-down process, 50 for counterparty credit exposure m easurem ent, 223, 224
total capital, 305 risk-adjusted return on capital (R A R O C ), 30
total loss absorbing capacity (TLA C ), 324 risk measures and, 206, 207
total risk, 14 stressed, 318

Index ■ 433
value chain, availability of vital link, 391 W eibull distribution, 314
variance-covariance m atrix, 195, 211-213 W ells Fargo, 96
variation margin, 294, 300 w holesale credit risk, 249
vega risk, 298 w holesale funding, 320
vendor validation, 146 W ilks' A, 167
verification, 3 W illiam s, Jo h n , 96
vetting, 164 wire transfers, 292
vintage loss m odels, 252 w orkforces, cyber, 366-367
Visteon, 178 Working Group on Risk A p p etite (W G RA ), 39
vital services, 404 wrong-way risk, 224, 226
volatility, levels of, 19 W ym an, Oliver, 100
Volcker Rule, 326

Z
W zero tolerance, 40
W achovia, 266 Zhu, H., 222, 296
W ashington Mutual, 266

434 Index