Risk Management, PRMIA

September 30, 2008

Juncture 228-205

Juncture 228-205, disembark here for a free fall experience that will rock your life.

If we were to put a title around this month`s outcome, it would have to be 228-205; the straw that breaks the camel`s back if you want a different cliche.

There are many topics I would like to write a journal on but none seems so pertinent as the current state of the financial sector, equity markets and general liquidity, or well lack of it. If anyone perused the financial times weekend edition it is evident that they have a similar view. From their Doom and Boom to the Great Wall St of China, HSBC / KEB, toxic assets, time for bail out ... In fact the whole paper consisted of nothing more than a pessimistic focus on current state of the, well not a sub-prime lending crisis anymore or a credit crunch but a complete financial liquidity failure and asset write down disaster.

Let me just flick my eyes onto the Bloomberg screen for a moment (yes we still have internet connection and news feed): Nikkei down 544 bps at one point in the day, DOW down 778 points (its biggest drop ever in existence as the best part of over 1.2 trillion in market value is incinerated), S&P down 881bps (that is the biggest one day loss since 1987 crash), Nasdaq down 914, FTSE down 530, China escapes as it is on holidays but the rest of the screen is flashing red arrows. From Brazil to Taiwan it`s finding the floor and starting to dig.

228 205, that is there are 228 blind folk and 23 votes short of a green arrows and blue skies, well theoretically, the problems are more systemic than this. Ladies and Gentlemen you have to suffer some form of myopia or been sitting on a beach drinking pena-collada for weeks not to see the ramifications of your actions. It has taken 158 years to build Lehman`s the cotton picking banker (they started off trading cotton, interesting history and worth a read) and then I suppose just a few days to dissolve it.

What about Bear Stearns, quite a distance away if time is measured in units of bankruptcy or Merrill Lynch which has had a tumultuous year dating everyone from Temasek to General Electric before marrying its sweetheart BOA. Then the Freddie Fannie ugly twins; now that was always a disaster from inception. But it doesn't stop there, we have Wachovia, HBOS, AIG; the queues on this one went out the door and round the block in Singapore when AIG put its hand up for federal reserve liquidity support. It`s endless. It`s mayhem and it needs a solution.

Bloomberg article

Bloomberg:``On the worst day in global financial markets in 21 years, investors who have seen it all were left shaken. Sept. 30 (Bloomberg) Australian Prime Minister Kevin Rudd joined U.K. counterpart Gordon Brown in urging U.S. lawmakers to pass a financial rescue package and pledged to provide liquidity and take whatever action is necessary to ensure stability.``

The congress argument for rejection of the bailout package, there are many starting with;

If the US government becomes lender of last resort it is moving itself to a state owned institution of commercial debt, picked up by the tax payer and that might be deemed as communist, OH WOW. Surely any kind of centrally controlled regulation system (the current one is broken) could be classified as having some semblance of Marxism, I am sure we could draw parallels if we took enough cartesian twists and turns. The alternative package devised by congress was an insurance contract which would be instantly exercised and thus can`t be priced as it is a ``so deep in the money American put option``.

Let`s sit on this for a second the markets are falling out backwards so what is the cost of another second. In reality forget pointing fingers or fat cats, the regulatory system itself has failed and it is thus at least partially responsible for a rescue package. An insurance scheme for a house that is already on fire is unlikely to be suitable at this point-in-time, we have that already in the credit markets.

Posted by CausalEvents at 04:36 PM | Comments (3)

July 12, 2007

Who is up for a trolley of Herstatt?

An interesting trend that is beginning to amuse me is the ever increasing segmentation of exposure types. Only a few years ago, perhaps one generation and well before ISO 9000 standards on quality existed, banks in general really only saw risk in a handful of domains. The first is an obvious play because it in itself is the merchandise of underwriting risk and is well known as the business of insurance. Staying in the domain of putting a value (dare I say a bet) on a threat would also take in the business of market based investment which is known to most as market risk and this is defined by the Basel committee as the risk of losses in on-and off-balance-sheet positions arising from movements in market prices. The pure domain of choosing to put funds at risk or not would also translate to lending and credit risk features very heavily in the Basel Accord. Today however I look up on some of the risk news sites and we have a whole shopping trolley of risk products including but not limited to interest rate risk, energy risk, weather risk, political risk, country risk, model risk and a new comer 'Corporate Defense Management'. The latter I personally see as an extension of operational risk, none the less people are talking about it even though one does have this real sense that some of the community out there are creating their own spins on an event to lobby their circumstances favorably. These people seem to wrap up a threat in risk classification propaganda to give it credibility and fear, then sell the world a panacea to such a pathogen.

Now if I were to ask you 'Do you know your Herstatt Risk'? You'd probably ask what are you going on about Martin and yet Herstatt risk is the very creature that kicked this whole risk regulation game over in the world of banking.

So what is this Herstatt thing?

The regulators certainly know what it is and to them it is one of the worst demons of all risks because it could result in a total melt down of the financial sector specifically where institutions owe each other payments but have not settled. So where did it first arise?

In 1974 a bank in Germany known as Herstatt was closed by the regulators leaving all its foreign-exchange positions open and unpaid, swiping an institution with an asset base of back then DM 2.07 billion in a matter of hours. Quite spectacular are the words the Bank For International Settlements now uses. Before Herstatt most threats created by banks were localised and manageable however Herstatt brought the world to a scary awakening through its foreign exchange business. In the end that foreign exchange business amounted to an unbelievable loss that was four times the size of the banks capital base.

Herstatts first mistake was to speculate on dollar appreciation and depreciation cycles which unfortunately for Herstatt moved in the opposite direction to their predictions. The problem was not so much in their strategy and for what its worth this is not the first or last investment strategy that fails on a market. The Herstatt case is unique in that the bank had 'borrowed' to finance their positions and they did this by taking foreign currency receipts in Europe and not making any of the US dollar payments.

Herstatt embodies a type of settlement risk which results from alternate layers of transaction settling in different time zones or perhaps where a banks netting system between segments of its clearing and settlement process is flawed in its workflow. Where foreign currency or asset backed swaps are involved Herstatt risk has a real potential to present itself especially with banks that have not mapped their clearing and settling procedures thus leaving pockets of fund catchment open. In the actual Herstatt bank case the institution was closed by the regulators sharply and even though the bank had taken payments for specific transactions and issued orders for more receipts, the US payment component did not clear because the US banking hours were behind that of Germany. The whole process was so convoluted that the three largest German banks that attempted to organise a joint bail out of Herstatt failed, there was simply a total lack of transparency about the magnitude of positions that had been taken and there were so many parties carrying the weight of the transactions it was extremely difficult to untangle. In the end a committee was formed to assist in the liquidation of Herstatt.

This committee and the potential magnitude of the event prompted many nations to also establish a central body for banking supervision which was passed into the Bank For International Settlements and just one year later that very committee adopted its 'Basel Concordat'. Basel Concordat put emphasis on host and home country authorities to share the supervisory responsibility for local banks entertaining foreign activities and was an outcome of Herstatt. So while so many risk analysts out there may never have heard of Herstatt, it very much affects their lives today. The Basel II accord is so globally impacting that it has been reckoned by many in the market as being the most impacting regulation pressed against financial institutions to date.

Posted by CausalEvents at 03:13 PM | Comments (1)

June 19, 2007

Well Intentioned is often not so in practice

In a macabre yet very sobering place there are two types of human dysfunction which are fascinating to watch played out and the Sarbanes-Oxley act seems to embody both of them. The first is a reactionary panic to an event and the second is the tenacious tendency of people to refuse to let go of something that is truly broken, they hold on in all hope that one day its purpose will be realised but in making that happen they pull everything else around them apart.

Lets be specific here, Sarbanes-Oxley was originally created as an outcome of the Enron event, the annihilation of Author Andersen and the Worldcom fraud well back in 2001 and its fair to say that enough people believe this that we are being partially prosaic stipulating it again however this isn't quite the case.

If we roll back a little further in time to the days of the 1973 market and the scandals of Penn Central as well as the corporate corruption payouts of Watergate we see the whole event playing out again, albeit in the past and congress at that time held many hearings into corporate governance policy. Much work was done over several years for what its worth which took us right into 1978 but nothing surfaced and for several reasons. Then in 1995 congress went through the process again and entered into a debate on tort reform legislation dubbed as PSLRA but still nothing substantial was enacted. In 2002 however, forty two witnesses presented over a period of about ten days of public hearings and the senate handed over to Sarbanes and Oxley. Enron was toast however Worldcom was coming to light and the senate needed to restore some semblance of public confidence in the investment community so both the senate and the house accepted the legislation. Interestingly the Sarbanes-Oxley act is so similar to the 1978 bill that it is apparently word-for-word in parts.

10 days and 42 debates, is that detailed?

George Bush certainly thought so and commented that 'SOX is the most far-reaching change to the securities laws since the New Deal.' and he wasn't wrong with that statement, but how far reaching are we talking about here?

National Venture Capital Association (NVCA) President Mark Heesen yesterday argued with congress that proposals by the Securities and Exchange Commission (SEC) and Public Company Accounting Oversight Board (PCAOB) should lower the costs of Sarbanes Oxley compliance for small companies. He is concerned that the accounting profession will not change its high cost practices but in the same token why should the cost of implementing Sarbanes-Oxley be transferred to accounting firms? Of course the big four firms do hold in part an oligopoly over 404 based audits and presently publicly listed firms are bearing the brunt of these costs. One could liken it to a permanent Enron tax on the business community for the foibles of some scaramouch of the past.

So how unpalatable is this cost and how far reaching is it?

Well Diane Casey-Landry, ACB president and CEO believes community banks should be exempt of 404 burdens because they are duplicative and thus they are nothing more than additional burden of costs.

Testifying before the House Small Business Committee: 'Bankers called again yesterday for community banks to be exempt from Securities and Exchange Commission internal control reporting requirements because smaller banks are already required to report to regulators and that the commission should further delay compliance with section 404'. Perhaps the solution to the 404 section is a permanent delay and this wouldn't be the first rescheduling of the mandate since it was released.

She also estimated that approximately fifty companies a year leave the Americas Community of Bankers NASDAQ listing and 20 percent of those are delisting primarily to reduce the burden created by the Sarbanes-Oxley Act, It is all a bit of a worry and yet American community banks unregistering is only the tip of the iceberg.

It is argued by many on Wall St that the introduction of Sarbanes-Oxley has had a major effect on the cooling off of listings on US capital markets particularly where firms have cross listed to raise market visibility or liquidity. In theory such companies would weigh up the costs of Sarbanes-Oxley against the benefits of being registered in the US and many businesses simply retreat to their home markets. The numbers are actually quite staggering with a 76% reported increase in registration cancellation on the period after Sarbanes-Oxley was released against the period before the act.

What is totally ironic about the delisting process in the context of the Sarbanes-Oxley act is the cure for corporate ills seems to have exacerbated the decease. To be concise when a company unregisters from a US exchange it enters into a pink sheet arrangement which is not regulated by the securities exchange commission and has very little compliance requirements at all. Most companies that used to be pink sheet listed were tightly held, low traded in volumes, often small businesses and many never met the requirements for a business traded on a national securities exchange. The argument here is that if one of the goals for Sarbanes-Oxley is to improve investor confidence then it has to have failed drastically if the companies that it is targeted for simply move into the clandestine world of pink sheets. What's worse is that investors generally feel uncomfortable with such arrangements and have a tendency to cash-in on their investments which over supplies the companies share volume deflating the share price of the business.

Way back in early 2006 the securities exchange commission which ultimately has the responsibility for enforcing the Sarbanes-Oxley act attempted to address the cost issues for section 404 of the mandate by exemplifying a companies 404 requirements when they had a market capitalisation of $100 million or less and revenue no greater than $125 million but such commercial classing of regulation is fraught with pitfalls, particularly where businesses spin off divisions to fall below the threshold.

Mr Levitt the former chairman of the SEC reasoned that it is probably the smaller public companies that are more likely to have control insufficiencies and should be watched most by analysts, he saw such a standard as pushing such businesses to a 'second class'.

So where and why did Sarbanes-Oxley go so wrong?

If one was to pull apart the mandate section by section, the rulings themselves seem harmless enough, by themselves and then capital markets welcome such standards. Actually the rulings are really quite straight forward and then the US economy is not the only one to take on such compliance initiatives. Even as far a field as India, registered entities have to comply with a revamped Clause 49 which has been likened as a 'SOX equivalent' in places. In Australia, the federal government has 'embarked on a comprehensive initiative' for Corporate Law Economic Reform Program or CLERP as it is more colloquially referenced.

Amazingly while the debate for a transparent accounting view of a business is not new or regionalised to the US, debates have raged on in congress for the best part of twenty years and still the outcome was poor. Professor Bainbridge believes 'that you'd have to show congress has a functional institutional memory' for it to evolve the program appropriately. such that the 1978 and 1995 legislative efforts were actually pertinent to the deliberations in 2002, seems implausible.'

So the US business community is left with ten days and forty two witnesses for a totally profound law rushed in so quickly that sections 307 on legal ethics weren't even adopted on the floor except through some parsimonious discussion.

Perhaps Sarbanes-Oxley went wrong less on what it attempts to achieve and more in its preparation and delivery. Perhaps some consideration of a wider impact on the business community that is already cooking needed to be taken into account.

Posted by CausalEvents at 05:36 PM | Comments (0)

May 11, 2007

MAS is CRAFTing a Risk Assessment

The benefits of the CRAFT approach to risk assessment in Singapore, drawing on the unique approach that the Monetary Authority of Singapore has engaged to measure risk across the Island.

Late last year I finished up on a subject that generated some interesting responses for principle based regulation and since that time I haven't blogged which some readers have made comment to. So to pick up where I left off we are going to look at another not dissimilar approach to regulation in South East Asia but before we do, please accept my apology for not publishing and I can guarantee since last year I have looked at a little bit more than principle based regulation, well we hope so. Specifically Causal Capital is in the process of building a new operational risk tool for banks and that has been consuming a lot of my time but more on that in another space.

So back to principle based regulation or perhaps risk based regulation and last month the Monetary Authority of Singapore published its framework for Impact and Risk Assessment of Financial Institutions and its approach is relatively fresh and novel but before we delve into the semantics of this CRAFT one needs a little bit of insight into Singapore.

Singapore is an island city state nested between Malaysia and Indonesia and it runs like clockwork with the Economist ranking Singapore as the 11th most advanced in quality of life globally. Geographically its small being about 50km's or so long and 30km's or so across yet it packs in one of the most dense financial sectors in the world. Singapore is successful because it manages economic and political volatility swiftly so that systemic threats are treated. The outcome of this management machination results in a stable landscape and that attracts foreign investment, business and working capital; the driving force for the success of the country.

The Monetary Authority of Singapore's recent publication embellishes this very instrument to wellbeing and should be viewed in this light.

Like the FSA (Financial Services Authority) in the United Kingdom, the MAS approach is principles based yet it is structured in a way that makes best use of resources at hand to ensure that the principles are targeted where they are most needed and it does this with an industry wide impact assessment known as CRAFT or to escape the acronym; Common Risk Assessment and Techniques.

As MAS puts it 'the supervisory work addresses themes that affect the industry as a whole and issues that cut across different financial service sectors' and it works by articulating an impact risk model across the entire financial sector by first evaluating the rate and impact of a specific risk for one institution, then bench marking that threat in a back drop against the financial sector as a whole.

The concise risk steps involve the investigation of risks in the context of each institution and a direct connection to the outcome or impact. By reviewing the importance of what is at risk and the impact, risks are collected for each institution individually and the overall exposure assessed. MAS combines the relative systemic importance of the threat and the risk outcome profile to dimension a close proximity to the impact and then rates this into one of four 'supervisory buckets' and for each institution in turn. Level 1 buckets have the greatest potential of affecting the goals of MAS and level 4 risks are concerns that need monitoring.

From a regulatory perspective CRAFT has some distinct advantages, primarily it is risk focused so that each regulatory decision is based against a threat rather than some bureaucratic policy that just remains for the sake of its existence. In addition to this, an action is not practiced in discrete and rigid steps but operates to resolve the present problem in the best manner and this makes the approach in Singapore very Principles Based. The neat part to it all is that when a risk is managed, transferred or mitigated a policy is relaxed to free up resources to the next most pertinent threat. From a commercial perspective financial institutions are not 'interfered' with unnecessarily which translates to a lower cost of compliance. Alternatively countries that have heavy regulation dissimulated by several regulatory bodies have a tendency to over regulate resulting in duplication and higher costs. Now while I can see specific analysts assailing such an avouchment, I can also find more chief executive officers whining in the peanut gallery of the stadium of regulation with some semblance of agreement.

The most effective outcome of CRAFT however is that it is ever evolving so as threats appear a course of action is mapped. This technique lends itself quickly to the analytics of trends of potential vulnerabilities so that they can be written into policy for a quick resolution. Something else novel about the MAS approach is that this sorting of threats is actually applied to all disciplines of risk equally. It takes in market, credit, liquidity and operational risk so the tendency to correlate interdependencies to highlight a resident pathogen between risks ensures that the focus is on resolution rather than finger pointing. This holistic approach is also ideal for defining systemic failure and failure from the network of dependencies between risk elements and all of this seems relatively obvious but so many other regulators treat risks in silos.

The regulatory document can be downloaded from the MAS website and it is a concise read being only 22 or so pages.

Posted by CausalEvents at 05:14 PM | Comments (0)

November 26, 2006

Principles based approach to regulation

About a month or so ago, the FSA released a statement encouraging what it calls as a Principle Based Approach to regulation. The FSA is often held in high esteem by other regulators globally as being forward looking to policy and enforcement but many critics argue their new initiative could be extremely complex to install.

To understand the dilemma one must first define what Principles Based Approach to regulation really means and that is best characterized by looking at the opposite. Non Principle Based Regulation. In reality there are two forms of Policy Enforcement that a regulator can entertain, the first which is opted by most regulators, is a set of rules that are created to ensure that regulated entities remain on a narrow road of practice; penalties are outlined for such institutions that decide to or accidentally waver from that path of practice. Each mistake is classified as a breach and can attract damages which are usually financial in nature but on extreme cases involve custodial sentences or license suspensions.

The benefit of such aphorisms is that they are usually transpicuous in nature however difficult such rulemakings are to meet or test. Where the problem lies is that different banks, products, processes and customer groups vary substantially and the regulator then has to use a nebulous gauge on each firm to understand whether the bank is behind or on the line. The concept of Principles Based Approach is top down and goals are set for firms on activities they work with rather than a staircase of rules that has to be ascended to reach the goal. As the FSA puts it, there is an emphasis on outcomes rather than how they are achieved and in many respects a room full of people given the same problem, are likely to go about solving it in alternate ways. While that generates plenty of new practices albeit some unorthodox the argument is then transferred to the result, has the goal actually been met.

Clearly the FSA is looking at a wider set of issues rather than a rule book, their move is also going to encourage a holistic approach to quality in measurement and throughout the full life cycle of a customer interaction. The new approach will also more than likely go against box ticking as such exercises require a rule staircase to be in place for checking against. The downside is that if you are a compliance manager that is not quite sure whether an action is on that line, best practice or perhaps needs investigation, then you are going to need a point of reference. You need to be able to debate specific structures on the grounds of their ability to meet a relatively unfastened desideratum. Then one must ask how is a breach to be enforced, how is it to be defended and what actually is a breach under such a system.

While the advantages of such regulation are clear I suspect that both the FSA and the industry at large are going to need to improve their analytical and creative abilities. Certainly the FSA will have to ensure resources are available for consultation and it will be interesting to see where they draw the line on offering advice. One does question though whether it is more straightforward a test of compliance or whether such predicaments still remain.

Posted by CausalEvents at 04:38 PM | Comments (2)

November 02, 2006

When the FDIC wins do the US banks loose?

In a recent article by Damian Paletta titled Rules on Capital Roil U.S. Bankers, it states that U.S. financial institutions will be at a disadvantage vs international competition because FDIC requires higher capital reserves (at least 5%) than Basel II ... Result is that 20 largest US banks will have competitive disadvantage.

Martin, do you agree with this article?

Yours Sincerely,

Ted.

Ted, it is a sorry state of affairs isn't it and as the FDIC wins the US banking sector seems to loose. Unfortunately the article is correct although what is going on is not so and even if US banks put all their efforts at the accord right NOW they would still be behind the game. That is one argument fuelling the fire of debate and there is a solution to that specific issue but we won't entertain it here. The Basel II accord has three parts and many European banks have been spending recent history working on the biggest components and they are now on the second major objective of Pillar II. US banks however are at a standstill but many of them are in fact more sophisticated than they are being portrayed. The reason for this is that many internationally active US banks have offices in other locales which require them to reach a risk based and intricate perspective of the capital and many of them have been contributing to the QIS exercises in he US. Under current US law however they can't use these analytics and that then leaves them frustrated and impotent.

So what caused this problem, in part the US has so many regulators that non of them really see eye-to-eye on the capital requirements. The Federal Deposit Insurance Corporation, The Office of Thrift Supervision, The Federal Reserve Board, The Comptroller of Currency, the Securities Exchange Commission all have different perspectives, requirements and agendas and, it has seriously made transparent efforts for accord implementation in the US difficult. In some aspects the whole philosophy behind the mandate is being lost. The US has also had to struggle through SOX rulings which is a pre-control compliance exercise and has distracted many financial institutions away from this hot topic.

As stated in the article

A bank's capital, essentially calculated by subtracting liabilities from assets.

This is a naive view of reality because it assumes that liabilities and assets are stationary in value, perhaps only a position in time at best and the author Damian Paletta has done well to capture US outlook in this cliché. Both these balance sheet entities of liabilities and assets are in fact floating, variable, seasonal, influenced by many factors and importantly have a volatility coefficient. The accord in essence embodies that theory, it puts all banks on the path of measuring such factors in combination with those volatility levels and then ties capital against the gap.

Of course the US is trying to dig itself out of this embarrassing position by installing a consistent leverage ratio which puts a floor on the capital requirement but that again is an action that is counterintuitive to the risk based capital maxim itself and the FSA in the UK has rejected support of this leverage ratio. The European regulators are also standing strong and are committed to the agreed capital requirements directive which transposes Basel II capital adequacy rules into European Union Law and will be taken up by nearly all countries in the region. Australia, Japan, South East Asia, India and the Middle East will push forwards with their rulings as they have planned.

What is going to be interesting is to see what comes up next. What are your bets and many of us are wondering how Sheila Bair the chairman of the FDIC is going to react when pressure from the US banking community accelerates. What I am looking forward to is reading all the academic spin doctoring and propaganda that is emanating from these authorities because this is definitely going to become another exercise in duck and weave.

Posted by CausalEvents at 01:13 PM | Comments (0)

October 01, 2006

Taking Op Risk out of the cost centre cycle

Recently a close and quite astute customer of mine emailed me this statement.

>>Now I have started some jobs on the project above, I have a new point about operational risk. We all know OR cannot produce any profit. But I notice in the last risk manager meeting in BeiJing. ZhouWei, the audit department manager of BOC, said the risk department shall become a profitable unit, not a cost unit.

>>So I now will need to redefine OR through an extended meaning of OR. Any activity will bring on loss or reduce revenue is operational risk and in this way the audit department can increase revenue with the help of controlling of operational risk and gain the regard of senior management in bank.\\

It is an interesting dialectic I have come across before and a good bias for debate depending on ones point of view, so lets investigate these view points but before we do so there have been some startling figures published by institutions in and out of the financial sector over the last couple of years that we need to review as part of the argument.

Statement released by Accenture about 10 months ago from industry research:

Almost half (45 percent) of the executives interviewed said they expect to spend in excess of €50 million through 2007 on Basel II compliance, up significantly from 23 percent in last year’s survey. Banks now have a much better idea of their total cost of compliance than they did last year, with only 10 percent of survey respondents saying they remain unsure of the total cost, compared with 29 percent last year.

This is a massive cost centre number and while some banks are obviously taking Basel II seriously, the variance or spread of spends against institution sizes gives us all an insight in the fact that many banks are obviously struggling with very inefficient programs.

One of the problems many risk managers seem to express to me also tends to indicate that the measurement of operational risk competes with many alternative compliance initiatives such as Sarbanes and Oxley (SOX), Anti Money Laundering, Patriot Act, International Accounting Standards, miFID just to name a few. With only a limited budget an efficient group risk, treasury or accounts department will try and balance all risk investments, placing emphasis on the ones with the highest return. In this way the scope is also broadened and operational risk now competes with credit and market initiatives. In Australia many of the large banks were pertaining to gearing their risk practices this way, moving to internal ratings based approach in credit and slackening the operational risk camp to the basic and standardised structures however their moves were quashed by the regulator with this ruling.

Statement released by APRA on ERM May 2005

In Australia’s case, however, it may be possible to tailor a standardised approach that better meets our needs. That is because APRA’s requirement that all banks adopting one of the sophisticated, or internal ratings based approaches, for credit risk must also adopt the AMA for operational risk.

So Australian banks can’t cherry pick as the saying goes, if they want sophisticated credit systems, they will run operational risk in its full capacity as well. To the outsider gearing credit up against the cost of an operational risk program may seem an immoral activity but now that operational risk is part of the Risk Weighted Assets under the Tier 1 / 2 capital holding it becomes another “portfolio” that is balanced in decision.

Before Basel II of course the measurement of operational risk was not prescribed, it didn’t have to be parametric and was usually budgeted from one year to the next. The Capital Accord changes this because it takes the market risk concept of VaR, translates that to credit, then to operational risk (OpVar) and in doing so the whole ethos of compliance is now at question.

Bankers that haven’t seen this evolutionary shift as significant may miss the objective underscore of the accord, we’ll call that the ‘x-factor’ for recurring reference purposes in this article. Let’s assume for the sake of argument there is a more accurate, perhaps useable measure of operational risk than opVar. Is this believable? Certainly OpVaR has its critics but hypothetically even if there was a more superior measure than OpVar, the industry would be unlikely to accept it because it would be on a different plane to that of market and credit. It would also not be transparent with industry data but from the perspective of our executive board, OpVaR allows us to measure a semblance of Risk Adjusted Return of Capital in the operational risk conduit. RAROC is traditionally common in the credit camp but increasingly we are hearing sophisticated risk managers such as Zhouwei from BOC talk about injecting investments into exercises that reduce exposure and measuring the risk reduction effect against the cost of those exercises. There is also the hope that the bank will be able to scale back its regulatory capital in the process as well as improve its measured operating position but that is an ongoing dispute with many regulators at present.

On the far extreme away from RAROC we'll take a pure compliance exercise such as SOX. I came across this grand avouchment from Bob Garrat the professor at Cass Business School some months ago and I have dropped it in here because it sums up what this article drives at in quite an enigmatic manner.

'Sarbanes-Oxley is a greater threat to capitalism than Karl Marx.' He believes that the codes around Sarbanes and Oxley are well with their intentions but that regulation might have just gone too far. 'The orgy of box-ticking has developed into a bonanza for the people who got us into this mess in the first place.'

I picked on Sarbanes and Oxley because it is often the responsibility of the operational risk department and it isn’t a parametric exercise. It doesn’t furnish our executive board with a comparable measure of ‘risk adjusted potential loss’ and in this essence it differs to Basel II as it is a pre-control exercise rather than post control, or to be blunt it misses our x-factor.

Nice and one can sympathise with risk managers such Bob Garrat who realise that ticking off a compliance to do list or in-disparately installing controls isn’t a targeted risk exercise. It is expensive but it may not be the best use of a risk budget as it doesn't put cost, threat and return next to each other in a comparable manner even though theoretical risk performance improves and hopefully the company reaches the regulation standard.

Compliance and Operational risk do overlap however they are very alternate management disciplines not to be confused. It is here though that the problem lies. Compliance without Operational Risk is simply nothing more than a policing agenda and Operational Risk without compliance doesn’t seem to have a channel for enforcement, its pre-designed strategies seem to have little measure for success or failure and become whimsical political hype for the customers and shareholders. Yet when compliance takes a lead, banks suffer escalating regulatory costs without the same margins of return; that is there seems to be this shortfall between performance, number of risk events and cost of compliance.

Posted by CausalEvents at 04:50 AM | Comments (0)

June 19, 2006

Transformation and the regulators

Over the last couple of months I have been speaking with a number of clients who are considering a transformation of their product lines and in some cases completely overhauling the banking group structure. In this article we are going to briefly look at the regulatory requirements that have to be met for such a metamorphosis in business offerings.

Specifically these banks are looking to cross sell on traditional product classes and perhaps seek out new companion facilities that they could offer to this existing customer base. Given their infrastructure nature, clientele demographics or market penetration they generally look to form symbiotic partnerships with other international entities so that they can quickly enter foreign markets. Sometimes the strategy is to broaden the balance sheet indiscriminately however in many cases the intention is to replicate their unique value offering elsewhere. They may be leaders in one market segment but inevitably reach a point of saturation in which to sustain a healthy level of growth they naturally embark on a complete transformation and of course successful businesses have the reserves or can attract mezzanine investors to realize such a vision.

These types of restructures are usually enterprise wide and often involve a change to the type of license being held and in some cases a complete merger between one or more institution may be the final outcome. All very exciting however the question that is always raised somewhere in the discussion is; what do we need to do with the regulators to ensure that new strategies we propose are endorsed and don’t attract the wrong kind attention. Then one has to question what the regulators are really looking for anyway?

Coincidently the Bank For International Settlements has recently (April 2006) just updated its Core Principles for Effective Banking Supervision that it has developed with fellow supervisors. The aim of this update is to supersede the 1997 mandate and BIS is currently seeking comments from the industry sector on this latest release. Importantly this document furnishes us with a good insight on what is required of any bank as it transforms and we are going to briefly discuss it here.

There are in fact 25 components that make up the core principles and for quick reference they have been listed below:

Principle 1: Objectives, Independence, Powers, Transparency and Cooperation
Principle 2: Permissible activities
Principle 3: Licensing Criteria
Principle 4: Transfer or significant ownership
Principle 5: Major Acquisitions
Principle 6: Capital Adequacy
Principle 7: Risk Management Process
Principle 8: Credit Risk
Principle 9: Problem Assets, provisions and reserves
Principle 10: Large exposure limits
Principle 11: Exposures to related parties
Principle 12: Country and transfer risks
Principle 13: Market Risk
Principle 14: Liquidity Risk
Principle 15: Operational Risk
Principle 16: Interest Rate Risk
Principle 17: Internal Control and Audit
Principle 18: Abuse of financial services
Principle 19: Supervisory Approach
Principle 20: Supervisory Techniques
Principle 21: Supervisory Reporting
Principle 22: Accounting and disclosure
Principle 23: Corrective and remedial powers of supervisors
Principle 24: Consolidated Supervision
Principle 25: Home-host relationships

Compliance aside, a major emphasis that should always be high on the planners agenda for these bank-wide transformations are principles 6, 7, 8, 9, 11, 12, 13, 14, 15, 16, 22, 25 as they are entirely risk focused or have heavy risk components. These will require the construction of a framework that consists of policies, methodologies and infrastructure and, will consume equal amounts of high budget and resource. Specifically the home-host relationship principle has been at the centre of contentions throughout the evolution of the Basel II accord and is an extremely complex piece of work. Principle 12, country risk has very few widely excepted benchmarking processes and isn’t formally written about enough to give senior managers that many options, so it can also be a bewildering activity to tackle as it lacks industry accepted guidelines.

From the regulator perspective, they are unlikely to forgo on quality of implementation for any principle and when banks leap outwards a special focus is likely to be applied to principle 14 and principle 6; the liquidity and capital adequacy of the bank. In fact the actually process of transformation will more than likely stress this ratio and banks that are going to engage in international relationships will need to establish an applicable Basel requirement if it doesn’t already exist. The supervisor of course has the power to impose a specific capital charge and/or limits on all material risk exposures if they deem there to be inherent risk during or after the amalgamation.

The Basel Capital Accord was designed to apply only to internationally active banks, which must calculate and apply capital adequacy ratios on a consolidated basis, including subsidiaries undertaking banking and financial business. Jurisdictions adopting the new capital adequacy framework would apply such ratios on a (Reference documents: International convergence of capital measurement and capital standards, July 1988; and International convergence of capital measurement and capital standards: a revised framework, June 2004.)

In respect to timing this is a long process and in some cases more than one regulator is going to be involved which complicates what would seem a straight forward audit, review, tick off and fee. In Principle 5 for example, the regulators can actually impede or prohibit the process if they deem the bank is engaging with a foreign entity in countries where secrecy laws or other regulations prohibit information flows deemed necessary for adequate consolidated supervision and these laws apply broadly to banks that even invest in institutions that aren’t financially regulated or holding a license. A bank intermingling with a non regulated entity might seem quite intriguing however it is actually quite common as companies such as brokerages, front office sales operators, financiers and other related firms often provide the transforming bank with valuable access to additional customers and that is a great target market for leveraging existing successful products abroad.

Finally for banks that are looking at creating these complex alliances, a special project team needs to be established to manage these principles, budget has to be set aside for transferring changes to liquidity during the process and the entire blueprint of the negotiation and final operating model needs to be readily available for regulators to peruse, so without doubt there is going to be a lot of delicate work ahead.

Posted by CausalEvents at 03:46 PM | Comments (0)

May 02, 2006

Recent trends in regulation

One of the less talked about risk categories in operational risk is yet the most featured in news and would have to be “regulation risk”. It certainly is a constituent in several places of the Basel accord and can be found either entirely or in part in event classifications such as Suitability, Disclosure and Fiduciary, Improper Business & Market Practices, Advisor Services, Monitoring and Reporting as well as in employment practices where discrimination and relations can be enforced. It has even been found in fraud as we shall shortly see.

What is interesting with regulation risk is that it is invitingly and intrinsically intertwined with behavior modification and that seems to be the approach the Financial Services Authority (FSA) is taking at present. Without doubt they are adamant to create an effective enforcement process as a method to achieve this behavioral change and Margaret Coles’ the head of enforcement at the FSA has recently delivered a speech that was also picked up by the Financial Times on this subject. She stated in particular, the FSA expects management to take responsibility for ensuring firms identify risks and increasingly individual managers are going to be held accountable for their inappropriate actions and their negligence. Now the FSA has never really been known as a regulatory animal who’s bark is louder than its bite and only last month they filed a case against Capita Financial, for £300,000 for failure to prevent actual and attempted frauds with the ominous quip “a failing that may be shared by most regulated firms”. What is interesting with this case is that it is quite a new angle for enforcement with regulators and they do not often place internal fraud at the top of the agenda list for punishment handouts however the regulatory landscape is changing.

If Capita Financial thought they were alone in edge regulatory risk they are also joined by Citicorp who have been tripped for alleged “institutional insider trading” and again the root cause appears to be an internal oversight. In Citicorp’s case the bank was supposedly not managing information flow between internal departments that operate in adjacent business functions and which benefit symbiotically from occasional good communication. Knowledge sharing is generally a good business practice and ensures the company takes advantage of potential opportunities but in some circumstances it crosses a boarder of law and in the eyes of the regulator, this case has conflicting goals with some potential downsides.

SMH News Article

Then back to Europe and Detusche who is again in the spotlight with a fine of £6.3 million for misconduct over a block trade and its former head of equities has received the largest personal penalty imposed by the FSA however, if that wasn’t enough for this bank, they are also under scrutiny for possible market abuse both in the Spain and France.

What appears to be the common thread, is that management are being held accountable for their lack of insight in their business controls or managing how these controls interact in the complex framework of products, value chains and policy. Certainly where there is sloppy execution the regulators appear to be tightening what they might classify as ‘a case’ and if trends continue they are more than likely to become virulent in pursuing such breeches.

Perhaps in the situations above, it is outmoded policies that exist and persist in these complex organizations. Such policies were once accepted yesterday but today take these institutions into questionable activity spaces. Whether these events are due to lack of regulatory knowledge, diligence of staff to detect and correct weak controls or in some instances simple risk taking “do and hope”; what seems apparent is that with regulation exposure an increasing hole of certainty for those who chose to skirt the law as well as those who fail to enforce it, efforts industry wide are going to have to improve for the hall of fame to slow on its tally.

Posted by CausalEvents at 12:09 AM | Comments (0)

February 14, 2006

Should rules have classes?

There has been some division lately in the SEC on a stance for the negation of section 404 of the Sarbanes & Oxley act. This argument seems to have been exacerbated as it only targets specific companies that are above a revenue watermark.

Feb 1, 2006 (SmartPros) The Securities and Exchange Commission should not succumb to political pressure and allow smaller public companies to be exempt from 404 requirements of the Sarbanes-Oxley Act, said Arthur Levitt, former chairman of the SEC.

Click here for full article.

Interestingly this is not the first heckle over section 404. In March 2005, the SEC further extended the compliance dates for non-accelerated filers and foreign private issuers over 404 by a year. Back then the commissions chief accountant Donald Nicolaisen stated that the extension was to provide enough time for issuers to objectively manage what he quoted was a hard look at internal controls. Alan Beller, the director of the division for corporation finance added that section 404 had the potential of improving the reliability of governance reporting and although it was a huge effort for some companies, it is those companies that should use the extension not to delay but improve the quality of their efforts.

So just under a year on and the section 404 debates still seem very much in play. For those not familiar with 404, we have paraphrased it below:

+ Section 404
Management Assessment of Internal Controls

(1) State the responsibility of management for establishing and maintaining an adequate internal control structure and procedures for financial reporting; and

(2) Contain an assessment, as of the end of the issuer's fiscal year, of the effectiveness of the internal control structure and procedures of the issuer for financial reporting.

Section 404, 409, 302 are without doubt pieces of work or whole projects in their own right and simply cant be met through rulings or policies, but require the company to set about building a credible operational risk framework. This framework of course needs to be sensitive to measuring potential events that may affect the business and be representative of such a measurement in an ongoing fashion. No matter the size of the business there is going to be an expanse, where obviously some the largest companies will suffer the highest costs.

+ What the SEC is proposing & Levitts Issues

The SEC advisory committee on smaller public companies recently recommended that public companies with a market cap of less than $100 million and revenue of no more than $125 million would be exempt completely from 404 requirements.

The former chairman of the SEC sees that it is smaller companies that are most likely to have control problems and yet least watched by analysts. He believes that by creating a different standard, small businesses are relegated to a second-class position which hinders their growth.

+ A Wider Issue releasing 404 culpability

From another perspective there are more pertinent concerns that strike me as worthy of consideration which orbit around discriminatory rule making. The most obvious of which is that such divisions leave gaps for exploitation.

A company of market capitalisation of $100 million could actually be quite a large organisation from a resource perspective however to avoid the rule the board may strategically divide the business up into entities that all fall below the threshold and thus escape Sarbanes & Oxley. Simply stating one set of laws under one condition and another set of mandates for a different class of business are also too loose and the SEC would have to define precise guidelines to close such loop holes, sadly this all complicates what is currently quite a tidy ruling.

A more obscure indisposition of discriminatory rule making is that it sets a president. 404 is applicable or not so because it is perceived difficult and expensive to achieve for small businesses. Now that is a platform for any business to argue for any compliance agenda when an industry is under stress. Then of course if 404 is such an enigmatic hurdle what about 409 and 302, should they be questioned as well. Its a slippery slope of erosion of values and each section of the act leans on other components for completeness. Take one component out and the overall act has a very different meaning. Finally on a point that few seemed to have raised; is where investor funds are pooled across a conglomerate of companies all falling under bar but when unified together are well past the mark, how are they to be treated.

What does seem evident is this remonstration of 404 seems to be a reactive one that needs further thought. Considering revenue in isolation of other business indicators is really unlikely to be a true representation of the risk a business contains and hence interferes with the potential a business has to meet the act.

Posted by CausalEvents at 01:12 PM | Comments (0)