Why managing operational risk is so important

By Stanley Epstein - Principal Associate - Citadel Advantage

One of the most misunderstood terms, especially when one relates it to banking, is that little word “risk”. Banks, like any other firm or even individuals are exposed to many different forms of risk

This short article will explain what risk is and some of the different types of risk that banks and other financial institutions are exposed to in their everyday business activities.

The definition of “Risk” being “exposure to the chance of injury or loss” is a typical one (with thanks to Dictionary.com).

There may be other variations on this theme, but what we have is good enough. The key elements of “RISK” are EXPOSURE to the CHANCE of LOSS. Put another way; the possibility that something will cause a financial or other loss. This is the basis for understanding the different types of risks that banks face.

In its basic form, banks take in deposits and lend these deposits out in the form of loans. Should the borrower not repay his loan the bank is faced with what is called “credit risk”. Credit risk is the possibility that a borrower will be unable to make payment of the amount of the loan when it falls due. Credit risk is absolute. It’s the chance that the borrower will never be able to repay the loan. Credit risk and bankruptcy are closely linked.

Liquidity risk is on the other hand not absolute. Liquidity risk is the possibility that a borrower will be unable to make payment of the amount due at the time that it is due. However the reason for this could be cash flow issues. It does not imply that the borrower is insolvent as he may be waiting for funds due to him to arrive. In terms of Liquidity risk the borrower may still be able to repay the loan at a later time.

Between them, Credit risk and Liquidity risk are the major business risks that banks face because they are the major part of the business of banking.

Over the last few years there has been a growing awareness that Operational risk is another source of danger to a bank. This was given “official” voice and form in the Basel Accords, where Operational Risk has been defined as “the risk of direct or indirect loss resulting from inadequate or failed internal processes, people and systems or from external events”. 

Take note of this definition – it is very important.

Operational risk in terms of the Basel Accords has been subdivided into seven separate categories. We examine each of these categories and briefly explain what types of risks they cover.

• Internal Fraud. By and large this covers fraud by bank staff such as the stealing of assets, theft of client information, covering up errors, intentional mismarking of positions, bribery etc.
• External Fraud. This occurs where non-bank staff is involved such as in computer hacking, third-party theft, forgery.
• Employment Practices and Workplace Safety. Inequitable staff policies, workers compensation claims, employee health and safety issues.
• Clients, Products and Business Practice. This is a very wide field and generally covers market manipulation, antitrust issues, improper trading activities, bank product defects, fiduciary breaches, account churning. The sub-prime Mortgage debacle is a clear example of a product defect. The LIBOR rate rigging scandal falls into this category as well.
• Damage to Physical Assets. This covers things like natural disasters, terrorism and vandalism – anything that results in actual damage or destruction of the bank’s physical assets. These actions may be deliberate or purely accidental.
• Business Disruption and Systems Failures. Power failures, computer software and hardware failures. A hurricane or a flood that results in banking services being disrupted also falls into this category.
• Execution, Delivery and Process Management. This covers things like data capture errors, accounting errors, failure to meet legal reporting requirement, negligent loss of client assets.

There are other risks too, such as legal, reputational, market – the list goes on. But that is another story.

Basel II is the foundation for Basel III

Our last post, “Basel III for Dummies” has raised the question about Basel II (which is after all the foundation to the Basel III upgrade). What is it? How is it structured? What does it cover?

For those wanting a bit more information we post this quick overview of Basel II framework that sets capital requirements for banks and forms the basis for Basel III. Three pillars contains the rules & support (supervisor review, market discipline) that say how much eligible regulatory capital must be held against risk-weighted assets.

Basel II is also where Operational Risk was introduced into the equation.

This short informative video covers all these bases.

Reserve Bank of India's Draft Guidelines on Basle advanced measurement approach for calculating operational risk capital charge

The Reserve Bank of India has released draft guidelines on advanced measurement approach (AMA) for calculating operational risk capital charge. Comments/feedback on the draft guidelines have been requested from the Indian Banking industry before February 7.

The Reserve Bank had announced timeline for implementation of advanced approaches for computation of regulatory capital under the Basel II framework in India in July 2009. The guidelines for the standardized approach (TSA)/alternate standardized approach (ASA) for operational risk were issued in March 2010 and those for internal models approach (IMA) for market risk were issued in April 2010. The Reserve Bank had, in July 7, 2009, advised banks that they can, among other things, apply for migrating to Advanced Measurement Approach (AMA) for Operational Risk from April 1, 2012 onwards.

Singapore’s DBS told to set aside S$230 million more for operational risk

The Singapore Monetary Authority (MAS) has asked the DBS Group to set aside S$230 million (US$170.5 million) additional regulatory capital for operational risk following the breakdown of the bank's network on July 5.

Analysts said the demand for regulatory capital shows that the MAS is sending a message to all banks operating in the city-state that it will not tolerate banking services disruptions in one of Asia's main banking centers.

Banking services at the Singapore branches and automated teller machines at DBS and its unit, POSB, were disrupted following technical problems last month. The services were restored within a few hours. See “Huge IT failure at Singapore bank” and “IBM employee fingered as culprit in massive DBS outage”.

Singapore, which is the Asian headquarters for many private banks such as Credit Suisse, competes against Hong Kong in the fields of wealth management and funds.

"This incident has revealed weaknesses in DBS Bank's technology and operational risk management control," the central bank said in a statement.

MAS also highlighted several steps DBS should take to ensure such incidents are avoided.

The central bank also said it has recently written to the CEOs of all financial institutions to remind them of maintaining robust technology risk management systems.

"MAS will not hesitate to take appropriate supervisory action against any financial institution which fails to meet the standards," it said.

DBS said in a statement the additional regulatory capital would result in the bank's pro-forma Tier 1 capital and total capital adequacy ratio to come down by 0.2 percentage points to 12.9 percent and 16.3 percent respectively.

"DBS would like to assure customers that taking into account the regulatory capital charge, our total capital adequacy ratio is still comfortably above the required levels," DBS CEO Piyush Gupta said in the statement.

DBS, which conducted an investigation with its main vendor IBM to determine what caused the first such major disruption for the bank, said it has taken several steps to prevent such breakdowns in the future.

"DBS is deeply sorry for the outage and once again, my apologies to our customers for all the inconvenience caused," Gupta said in the statement.

Sins of the Risk Managers

Have risk managers really been doing their jobs properly? According to many they certainly have not. I came across this interesting item on the sum2llc Blog. It is certainly worth a read.

Click on the post title or the link below.
http://sum2llc.wordpress.com/2009/09/28/day-of-atonement-al-chet-for-risk-managers/

Download the CA DIGEST here!

We have just published the new edition of the CA DIGEST.

Download it by clicking the Post Link.

Whats the lead story? Why there is no need for a Basel III plus all the latest on Payment Systems, Operational Risk, Remittances and much, much more.

Managing Liquidity Risk – The 2007 Crisis

By Stanley Epstein - Principal Associate & Director of Citadel Advantage

This is the first of a series of articles on Liquidity and Liquidity Risk that we shall be publishing over the next few months.

The whole question of Liquidity Risk Management has become very topical of late spurred on by the initial liquidity crisis in 2007, which occurred in the early stages of the subsequent financial collapse. More and more frequently I find myself being asked the same question or a variation of it “what is the best way to ensure that my bank’s Liquidity Risk Management is on a sound basis?”

The subject is vast. And depending on exactly what you are trying to achieve, so too are the answers.

Before even attempting to paint a broad picture as to the key issues to be addressed in ensuring sound Liquidity Risk Management, I would like to take a step or two back – and explain some of the key principles and issues the surround liquidity management.

Liquidity in the first instance depends on the exact use that the word is being put to. Let me explain. In a pure sense liquidity is defined as the ease and certainty with which an asset can be converted into cash. Money, or cash on hand, is the most liquid asset. Market liquidity on the other hand is the term that refers to an asset's ability to be easily converted through an act of buying or selling without causing a significant movement in the price and with minimum loss of value of the underlying asset. Accounting liquidity is a measure of the ability of a debtor to pay their debts as and when they fall due. It is usually expressed as a ratio or a percentage of current liabilities.

In banking and financial services, liquidity is the ability of a bank (or other financial organization) to meet its commitments when they fall due. Managing liquidity is a daily process (in fact in today’s real-time world, this has become a real-time process too) requiring bankers to monitor and project cash flows to ensure that adequate liquidity is maintained. In a banking environment that liquidity may be needed to fund customer transfers and settlements or to meet other demands generated by the banks business with its clients (advances, letters of credit, commitments and other business transactions that banks undertake).

There are many other definitions of liquidity too. Suffice to say that the brief summary above should serve to explain the concept and to illustrate the notion that there are many variations of this.

Almost every financial transaction or financial commitment has implications for a bank's liquidity. Liquidity risk management helps make certain of a bank's ability to meet cash flow obligations. Remember that this ability can be severely affected by external events and the behavior of other parties to the transaction. Liquidity risk management is critical because a liquidity shortfall at a single bank can have system-wide repercussions, called systemic risk. The inability of one bank to fund, for example, its end-of-day payment system obligations could have a knock-on effect on other banks in the system, which could lead to financial collapse. Indeed, the central bank, as the lender of last resort, stands ready with a safety net to help out individual banks (or even the greater “system”). We witnessed this on a massive scale over the past two years in the U.S., Europe, Asia and elsewhere. However getting this assistance often carries an almost impossible price – reputation. Banks that get themselves into this sort of trouble pay a terrible price in terms of the loss of confidence amongst members of the public, investors and depositors alike. Often this price is so high that the stricken bank does not recover.

The market chaos that began in mid-2007 brought into very sharp focus the importance of liquidity to the effective functioning of financial markets as well as the banking industry. Before the crisis, asset markets were buoyant and funding was readily available at low cost. The sudden change in market conditions clearly showed just how quickly liquidity can disappear and that the lack of liquidity (the correct term is illiquidity) can last for a very long period of time indeed.

So we arrive at the summer of 2007. From August onward the worldwide banking system came under severe stress. To make matters worse developments in financial markets over the previous decade had increased the complexity of liquidity risk and its management. The result was widespread central bank action to support the functioning of money markets and, in some cases, individual banks as well.

It was pretty clear at this point that many banks had failed to take account of a number of basic principles of liquidity risk management. Why? Well in all probability, in a world where liquidity was plentiful and cheap, it didn’t seem to matter much.

Many of the banks that carried the greatest exposure did not even have an adequate framework that satisfactorily accounted for the liquidity risks required by their individual products and business lines. Because of this, incentives at the business level were out of alignment with the overall risk tolerance of these banks.

Many of these banks had not really considered the quantity of liquidity they might require to meet contingent obligations because they simply dismissed the notion of ever having to fund these obligations as being highly unlikely.

In a similar vein many banks saw as highly unlikely too, any severe and prolonged liquidity disruptions. Neither did they conduct stress tests that took account of the chance of a market wide crisis (that is one that affects the whole industry rather than just a single other participant) or the depth or duration of the problems. Banks also did not link their plans for contingency funding to the results of their stress tests. And to add insult to injury they also sometimes assumed that irrespective of what happened their traditional funding sources would remain available to them.

With these events still fresh in the minds of banks and bank regulators the BIS (Bank for International Settlements) based “Basel Committee on Banking Supervision” published a document entitled “Liquidity Risk Management and Supervisory Challenges” during in February 2008.

The crisis had revealed many of the critical issues, outlined above, that had patently been overlooked. Based on this, the Basel Committee has conducted a basic review of its earlier “Sound Practices for Managing Liquidity in Banking Organisations”, which had been published in 2000. In their new document their guidance has been significantly expanded into eight key areas. These key areas cover the following principles;

• banks need to determine how much liquidity risk they are prepared to accept,
• banks must keep a level of liquidity commensurate with their needs,
• the costs of liquidity must be allocated to the banks business activities,
• all the liquidity risks must be identified and measured,
• tests that simulate extreme conditions must be developed and used,
• liquidity contingencies must be planned for,
• intraday liquidity risk must be managed, and
• open disclosure is supported as a method for sustaining market discipline.

So what is this new guidance all about? I will be covering Basel Committee’s advice on these key issues and the subsequent industry response in more detail in a series of subsequent articles.