RegionsNorth AmericaOperational Risk and Basel II: The Dangers of Increased Flexibility

Operational Risk and Basel II: The Dangers of Increased Flexibility

Operational risk is not only the oldest known risk, but is also responsible for the largest loss amounts in the financial services sector. More surprising, it is the risk type for which we have the least data and which begs for increased research experience.

The lack of experience can easily be demonstrated, in part with a discussion on the definition and its categories: The Basel II definition includes losses from inadequate or failed internal processes, people and systems or from external events. While legal risk is included in this definition, some banks involve reputational and strategic risk, which is not explicitly required by Basel II. The term Operational Risk in Bank A is often not equal to the term Operational Risk in Bank B – a clear problem in itself.

Basel II presents – on the basis of their definition – three approaches for the calculation of operational risk with different requirements and regulations: The Basic Indicator approach, the Standardised Approach and the most sophisticated Advanced Measurement Approach. This Advanced Measurement Approach gives the most freedom in creating tailored concepts by each bank and is said to be the approach for which less capital needs to be held (although this – from an actual perspective – may not be correct for all banks!)

Basel II regulations concerning Advanced Measurement Approaches (AMA) for operational risk

The Advanced Measurement Approach allows for a range of credible concepts for the management and measurement of operational risk. The intention is to provide a guide or framework in which banks’ internal management approaches (assessment techniques etc.) can be developed, deployed and accepted for supervisory purposes.

The guideline provides supervisors and banks with a set of criteria that must be met in order to qualify for recognition. But those guidelines are formulated in a very open way. The lack of a detailed prescription in this approach brings challenges and benefits. On the one hand, many different custom-made approaches are allowed and equally valid; on the other hand, this makes it difficult for the regulators to find ways to analyse and assess these approaches.

Although the AMA is flexible, some requirements are in place. Structures have to be approved by the supervisors and banks are also required to use external data. Especially to calculate the tail of an operational loss distribution, such data will be of crucial importance.

Although certain boundaries and guidance is given for the use of AMA, the view of the supervisors will be critical to the interpretation of those regulations and for the assessment of the selected approach. The nature of AMA provides a degree of flexibility, but there is a need to further define the minimal standards in order to establish the credibility of the approach. Generally, it can be said that banks that aim for AMA or that are aiming at a good operational risk management out of a business perspective have a greater opportunity to fulfill requirements. The incentive should not only be that a bank will be able to hold less capital under AMA, but also, that the freedom to develop its own management frameworks leads to a risk management process that is tailored to the requirements of the bank, which in turn leads to better investment decisions within the bank.

Free choices with regard to the definition and assignment of events?

According to a BearingPoint study regarding regulatory compliance within financial institutions, there are still basic definitional issues on operational risk to be addressed. For example, not all institutions define and categorize operational losses the same way. While the out-of-pocket cost of a compliance breakdown may fit fairly neatly in the operational risk bucket, the cost of fixing the problem, from internal audit costs to legal costs, are not so clearly classified.

Furthermore not every loss event can be clearly assigned. Often there is a correlation between credit losses and losses resulting from operational failures. Think of a loan that is collateralized by real estate. If the loan defaults, it is clearly a credit loss, which feeds into the calculation for credit risk. However, if the legal certainty of the collateral agreement is not given (e.g. the original contract is lost) or the credit loss could have been detected earlier with more efficient internal processes, the loss could be categorized differently. Even a clear definition will not always work: Is every loss resulting from a credit event automatically a credit loss? One could argue: it doesn’t matter, as long as the assignment of loss events is consistent. Reality shows that every questionnaire is subject to personal circumstances.

Freedom in establishing quantitative measurement framework

Due to the fact that there is currently no standard in sight as regards how to measure operational risk, banks have a high degree of freedom in developing their own models to meet the requirements of the Advanced Measurement Approach. (Para 627, 628, 3rd Consultative Paper Basel II, April 2003). There is a wide range of possible quantitative approaches, ranging from trivial profit based models up to highly complex simulation models.

In any case, a solid history of internal and external data is necessary to calculate or validate the probability and the resulting loss of an operational risk event. This freedom in developing proprietary models holds the danger that a firm may choose an inadequate approach or may collect incorrect data material. Therefore, banks should be focusing seriously on the issue and should aim their activities on best practice solutions.

Alternatives of process design

In general, regulators have not clearly articulated a best practice process. Firms always have a choice, whether they follow a regulation word for word, or whether they lean back and look at the reason for the regulation and how it can be employed in a manner that serves the regulator and the company in question. When firms began to measure operational risk, it was often cited as ‘uncontrollable’ and ‘unmanageable’. However, since operational losses have been recorded, firms are receiving much better transparency as regards how their company is run and what the costs of poor processes and poor IT support actually are.

Solutions in the market

At the current stage of consultation, the market does not provide a comprehensive solution that addresses all required methods for quantitative analyses or qualitative process support. Many banks are still using several standalone solutions based on desktop spreadsheets or database applications to meet different operational risk requirements. There is a trend to implement client server solutions for the loss data baseto take advantage of a central organized database, i.e. avoiding double records of a single loss, but many smaller banks still maintain their own desktop-based solutions. On the other hand, several specialized tool providers have appeared to address this problem. While identification and qualification of losses are usually recognized automatically or by hand, the data collection for reporting is done by the central IT-system. Only a minority of banks have integrated the operational risk-reports in credit and market risk reporting or in the management information system. The various dimensions of operational risk, combined with a rising number of different standalone solutions and the absence of a technical one-shop approach, will produce a disproportionately high organizational and system-related expenditure.

How much flexibility do we need?

More knowledge has to be collected about the different issues described in this article before AMA requirements can be more clearly defined. The development of operational risk management systems will automatically lead to a focus on best practices, and leading banks will design approaches based on sound business decisions, taking into account risk and cost and not just regulatory compliance. These leading banks will ultimately define best practice in operational risk management.

All information provided is of a general nature and is not intended to address the circumstances of any particular individual or entity. Although we endeavor to provide accurate and timely information, there can be no guarantee that such information is accurate as of the date it is received or that it will continue to be accurate in the future. No one should act upon such information without appropriate professional advice after a thorough examination of the particular situation. The views and opinions are those of the author and do not necessarily represent the views and opinions of BearingPoint, Inc

Comments are closed.

Subscribe to get your daily business insights

Whitepapers & Resources

2021 Transaction Banking Services Survey
Banking

2021 Transaction Banking Services Survey

2y
CGI Transaction Banking Survey 2020

CGI Transaction Banking Survey 2020

4y
TIS Sanction Screening Survey Report
Payments

TIS Sanction Screening Survey Report

5y
Enhancing your strategic position: Digitalization in Treasury
Payments

Enhancing your strategic position: Digitalization in Treasury

5y
Netting: An Immersive Guide to Global Reconciliation

Netting: An Immersive Guide to Global Reconciliation

5y