Operational risk capital under Basel II – dead on arrival?
As the ‘switch on’ date for Basel II approaches, there are growing concerns over how much capital is needed to cover operational risks. Pat McConnell investigates
With only a few months to go until the long-awaited implementation of Basel II on 1 January 2008, banks and regulators are putting their final touches to their policies, systems and capital calculations. Rumours abound in the market that, because of their emphasis on relatively low-risk retail banking – in particular, residential mortgages – Australian banks will be able, under new Basel II rules, to free up capital and return additional dividends to their shareholders.
Unlike the rules on credit risk, however, the impact of one area in the new regulations appears not to be running as smoothly as hoped. The proposal to allocate capital, for the first time, to cover operational risks has generated much heat, but unfortunately less light, in the banking and academic communities. There is little argument that improving the management of operational risks in financial institutions and allocating capital to cover unexpected losses arising from operational decisions is a good thing. The difficult question has always been ‘how much capital should be set aside to cover operational risks?’ Given that this question has been picked-over for almost 10 years, one would have hoped that the answer would be fairly clear by now. Unfortunately, it is not.
How to calculate operational risk capital (ORC) is far from obvious and resolution of this issue has been hampered, rather than helped, by global and local regulators. It is becoming obvious that this question with have to be addressed again after initial implementation of Basel II and that the current proposals are neither equitable nor sustainable – they may be ‘dead on arrival’.
Under so-called Pillar 1 of Basel II, banks are required to calculate ORC using one of three ‘approaches’:
• Basic indicator approach – using a formula supplied by regulators based on the firm’s gross income;
• Standardised approach – using a slightly different formula based on income and asset size by
business line; and
• Advanced measurement approach – using a model developed by the firm that must be approved by the local regulator, eg APRA in Australia.
These approaches are designed to cover different sectors of the banking market, the basic principle being that banks that are likely to have large operational risks are required to apply for approval to use an advanced measurement approach (AMA).
Basic and standardised approaches
Both the basic indicator (BIA) and standardised approach (SA) use regulator-supplied formulae to calculate ORC. In the BIA approach a bank must set aside capital for operational risk that is 15 per cent of gross income averaged over 3 years. In the SA approach the capital is calculated by business line using a ‘beta’ factor that ranges from 12 per cent to 18 per cent of gross income, a very rough average of 15 per cent.
There are two underlying assumptions here: operational risk is somehow related to average ‘gross income’; and the relationship/correlation is 15 per cent.Recent research throws doubt on these assumptions.In a recent study of historical operational loss data collected by an external supplier from across the industry, researchers found that ‘firm size’, explained only 5 per cent of the total value of reported losses.
In an other recent study considering losses resulting from the September 11 terrorist attack on the World Trade Centre, probably the greatest of operational risk event to date, researchers concluded that, if an event of similar severity were to occur again losses would account for less than 5 per cent of average gross income for the top 15 US banks. If one applies similar logic to the currency options losses at National Australia Bank (NAB) – the most spectacular operational risk event in the Australian market – the reported loss of $360 million would be, on average, only 3.8 per cent of the gross income of the ‘big four’ banks according to their 2005 reports. In effect, there would have to be something in the order of one NAB-size event each and every quarter to consume the BIA-calculated capital for each major bank – surely someone would notice and take action?
Have regulators set the BIA (and SA) factors too high? Should these factors be set lower, eg 10 per cent or even lower? And why is the value of these factors important? The role of banking regulators is to protect the soundness of the financial system and ‘excess’ capital held by regulated entities helps to ensure their goal – for regulators the capital held by banks should, within reason, be higher rather than lower. However, for shareholders the perspective is very different – excess capital is not available for income generating initiatives, reducing the firm’s ‘return on equity’. In particular smaller banks, which tend to be covered by the simpler ‘formulaic’ approaches, are at a competitive disadvantage to larger firms, making them attractive takeover targets for any firm able to free up the excess capital for their shareholders. Paradoxically, any small bank that does spend money on an initiative to improve efficiency and reduce operational risk, which results in decreased costs and increased income, will incur even more capital.
It has been suggested, somewhat cynically, that regulators have deliberately set the capital factors at such high levels, to ‘encourage’ firms to move towards the more ‘risk sensitive’ advanced measurement approach. While ethically challenged, such an argument might hold water if the AMA approach was significantly better than using the simple formula. However, the industry is experiencing serious problems when attempting to adopt a compliant AMA approach.
Advanced measurement approaches
Basel II notes that “internationally active banks and banks with significant operational risk exposures are expected to use an approach that is more sophisticated than the basic indicator approach and that is appropriate for the risk profile of the institution”. In practice, all large banks in Australia fall within this definition and have been ‘encouraged’ to apply for AMA accreditation. To qualify for using an AMA for capital calculation, a firm must satisfy quite stringent regulatory ‘standards’: qualitative standards – covering organisational requirements, such the creation of an independent operational risk function; and quantitative standards – covering the collection of operational loss data and the development of operational risk measurement models.
To qualify to use an AMA for calculating operational risk capital (ORC), regulators require that a bank must, in particular:
Be able to demonstrate that its approach captures potentially severe tail loss events. ... with a one year holding period and a 99.9th percentile confidence interval.
Track internal loss data ... based on a minimum five-year observation period.
Use relevant external data, especially when there is reason to believe that the bank is exposed to infrequent, yet potentially severe, losses.
Use scenario analysis of expert opinion in conjunction with external data to evaluate its exposure to high-severity events.
Since the quantitative standards were first mooted in the late-1990s, the industry, regulators and academics have been working on developing the theories, mathematical models and best practices needed to satisfy these criteria. This has proved to be a much more difficult exercise than first envisaged.
In October 2006, the Accord Implementation Group’s Operational Risk (AIGOR) subgroup of the Basel Committee released the results of a ‘range of practices’ study on the progress being made by the world’s largest banks towards developing advanced measurement approaches. While the AIGOR group reported progress in adopting consistent approaches to the adoption of qualitative standards, there is much less consistency when it comes to the calculation of operational risk capital. The study found that there was a “wide range” of practices for operational risk modelling across the industry, and warned that this “raises the possibility that banks with similar risk profiles could hold different levels of capital under the AMA if they rely on substantially different modelling approaches and assumptions”. AIGOR found that banks indeed are making very different assumptions and using very different modelling approaches to calculate ORC but that most banks have not “undertaken sufficient statistical or other analysis to justify their assumptions”.
In short, even at tis late stage, there is no industry consensus on how to model operational risk and to calculate operational risk capital, which is somewhat surprising given the time, money and intellectual effort expended by the world’s top banks. Not that the situation was completely unpredictable, industry experts have been raising doubts about the proposed approaches for some time.
The major problem facing the industry is the so-called ‘soundness standard’, ie the 99.9th percentile confidence interval. Before discussing the issues bedevilling the industry it is worth noting the definition of the ‘soundness standard’ for operational risk is linked to the identical standard required to calculate credit risk capital under Basel II. At first glance, the symmetry of adopting identical statistical confidence intervals (99.9 per cent) for both types of risk is appealing. However, it must be remembered that a large international bank will have tens, maybe hundreds, of thousands of commercial loans, and millions of smaller retail assets, such as credit cards and mortgages. Banks will also have many years of good historical data on credit defaults on which to base a model that measures credit risk to such a high confidence interval, ie up to 1 in 1,000 loans.
Lack of data
The problem in applying the same modelling approach to operational risk is that there is just not enough data on which to base such a high level of statistical certainty. Even the AIGOR admits that there is a “paucity” of internal loss data “relative to what is required to reasonably assess a bank’s operational risk profile” and that “relevant external data” and/or “scenario analysis” must be employed.
The difficulty of achieving the required soundness standard is illustrated by the results of the research into US losses collected by regulatory data collection exercises. In that study, which covered 23 banks, it was found that for most banks the median number of ‘operational loss events’ was less than 200, with only four banks reporting more than 2,500 losses with values over US$10,000. Furthermore, the bulk of losses appear to occur in just a few business lines and as a result of a small number of so-called ‘loss event types’, in particular fines by securities regulators. Even for large banks, the lack of comprehensive data makes the analysis of operational loss problematical, even at the firm level, to the confidence level required by regulators. For most banks, it appears that achieving such precision is a non-starter.Nor is the incorporation of external data and scenario analysis likely to ease the problem. The processes of selecting and scaling of ‘relevant’ external data and ‘envisioning’ operational loss scenarios are essentially qualitative activities, which are difficult, and almost impossible given the state of current knowledge, to estimate to such a high level of confidence.
There is clearly insufficient data on which to make robust statistical inferences to the level of confidence required in the 99.9 per cent soundness standard. In effect, this means that the operational risk capital numbers – calculated by AMA accredited banks and disclosed in annual reports from January 2008 – cannot be compared across banks without a very detailed knowledge of the data and assumptions used in developing the underlying models. Analysts and shareholders will be unable to ascertain whether firms are retaining sufficient capital to cover their unexpected operational losses, or if they are setting aside excess capital that could be usefully employed elsewhere. Given that one of the goals of Basel II is to improve ‘transparency’ of risk management, the operational risk capital regime clearly fails the transparency test.
What next?
Regulators are in a bind – how can capital be consistent and transparent across the industry? At this late stage, regulators have little option but to ‘tough it out’, insisting that there will be no change to regulations before January 2008. To do otherwise would bring down the wrath of the whole banking community. For example, to reduce the BIA factor, say from 15 per cent to 10 per cent or lower, would greatly help smaller banks but enrage the larger banks that have many spent millions of dollars in new systems that may end up calculating ORC to a higher level. It is obvious that the rules for calculating operational risk capital will have to be reviewed after 2008. There are several options for moving forward, not least relaxing the soundness standard to 99 per cent, 95 per cent or even a variable level based on historical data. Alternatively, capital could be based on the quality of the ‘qualitative standards’ achieved by an individual firm, effectively removing the differences between the various Pillar 1 approaches.
Alternatively, regulators could admit that the rules for calculating operational risk capital should indeed be reviewed and, together with the industry, instigate a series of independent studies on what is practically achievable, given the paucity of data available. With a predetermined timetable for implementing rule changes, say 2010, tensions between regulators and regulated firms would be reduced and a better overall outcome achieved in the longer term. This is quite a different approach than that taken to the development of operational risk rule in Basel II. To date regulators have set what are, in retrospect, unachievable targets expecting individual banks, in isolation, to develop innovative models to meet these unrealistic expectations. However until it is recognised, and admitted, that the results of the models being used to measure operational risk under Basel II are not credible, if only because for most banks there is just not enough data, the industry will be spinning its wheels, all the while spending money while achieving few tangible benefits.
Dr Patrick McConnell is a visiting fellow at Macquarie University Applied Finance Centre
where he teaches courses on managing operational risk
News