Exchange Ideas

Systems Risk

"Systems Risk" is in the position that Operational Risk was a decade ago (pre Basel II) in that everyone knows that Information Technology is a major issue in Financial Services but the industry has not found satisfactory ways of analysing and measuring the associated risks. Many business surveys point to IT being of vital interest to Boards and senior management, but we (the IT profession) keep screwing up - I would argue because, in part, neither the IT function nor business has yet learned how to manage risk.

 

« About Pat McConnell | Main | Ghosts of New Year's Past »

February 12, 2008

All that Glisters is not Gold

As banks, around the world, battle with the adverse impact of the subprime crisis, there is at least one very faint, very fine lining of silver within the swelling dark clouds.

As their income declines some firms will, surprisingly, become eligible for relief on their Operational Capital charge under Basel II. In fact, if they manage to run twelve consecutive quarters of losses, then their Operational Risk charge will drop to zero, i.e. they will be deemed to have no Operational Risk, but unfortunately will be bankrupt.

Given that subprime losses appear to be as much due to Operational Risk as Credit or Market risk: with lax lending practices, misselling of complex, little understood derivative securities (e.g. sub prime CDOs) and model misspecification by, among others, rating agencies - how could this make sense?

The answer of course is that, for those firms subject to the most basic capital calculation approaches of Basel II[1], Operational Risk Capital is deemed to related to Gross Income (GI), by a simple factor - C times GI.
[Note that C varies by approach but is a constant between 12% and 18%.]

Intuitively, the "frequency" of Operational Risk "loss events", should be tied, in some way, to the size of the firm, since there are many more opportunities to "screw up" in large firms, with lots of people, systems and diverse businesses around the world.

There is no reason to believe, however, that the "severity", or magnitude, of operational losses is tied to firm size, but more likely linked to the quality of the firms risk management controls. In any case, there is no evidence that, for Operational Risk, Income is a good proxy for firm size nor that, even if defensible, that there would be a simple linear relationship between Income and Operational Risk Capital. It is also unlikely that a decrease in Income would automatically indicate an improvement in Operational Risk Management.

A recent paper by Andreas Jobst [2], highlights the anomaly that, if another 9/11 event were to occur to US commercial banks, the losses would amount to less that 5% of their Gross Income under Basel rules, much less than the 15% specified in Basel II.

How did we arrive at such an Alice in Wonderland situation?
One reason is that the Basel II development process was fundamentally flawed. Basel II was a decade-long gabfest that produced little in the way of evidence-based agreement on how to quantify operational risks. Evidence was replaced by proclamations, from on high, on what banks were expected to quantify, and little more than pious generalizations, or dubious formulae, on how they were supposed to going about quantifying it [3].

The precise rules for calculating Operational Risk Capital emerged, opaquely, from a series of Quantitative Impact Studies (QIS), which analyzed small, unrepresentative samples of inconsistently classified operational loss data from banks around the world. The work of Jobst, and others, illustrates just how, in hindsight, unrepresentative that data turned out to be.

With its long-delayed roll-out in 2008, Basel II has picked up a head of steam and looks likely to continue to ignore all impediments in its tracks for some time yet, before its internal contradictions should eventually bring it to a stop - in Basel III(?).

There is little point, therefore, in railing against the new regulations, save that the industry is shaping up to make the same mistakes all over again.

The Solvency II regulations on Insurance, driven by the European Union but accepted in principle by global insurance regulators, has recommended the same overall structure as Basel II, with similar Pillars. It is as if CEIOPS, the lead European insurance regulator, has been seduced into believing that Basel II is a stunning success rather than, as the subprime crisis is demonstrating, an experiment in financial services regulation that is still unfolding. We can but hope that the standardized approaches proposed in Pillar 1 of Solvency II will make more economic sense than Basel.

Shakespeare's speech from the Merchant of Venice, which includes the observation that "all that glisters is not gold", also contains a warning that "gilded tombs do worms enfold". There is, of course, no suggestion here that the honey-colored headquarters of the Basel Committee in Aeschenplatz Basel, is a "gilded tomb", or that Basel II is "a can of worms".

References:
[1] Basel II identifies three "approaches" to calculating Operational Risk Capital, the Basic Indicator Approach (BIA), The Standardized Approach (TSA) and the Advanced Measurement Approach (AMA). Of these, the BIA and TSA are tied to average annual "Gross Income" (GI) whereas, the AMA allows firms to use their "own model" to estimate OR capital. Some jurisdictions have also identified an Alternative Standardized Approach (ASA), which employs Asset size for some business lines as a proxy for Gross Income. The precise definition of GI and Asset size varies by country regulator. http://www.bis.org/ and http://www.apra.gov.au

[2] Jobst, Andreas A., "Constraints of Consistent Operational Risk Measurement and Regulation: Data Collection and Loss Reporting". Journal of Financial Regulation and Compliance, 2007

[3] Note here I am referring to the so-called Pillar 1 rules of Basel II on the quantification of Operational Risk Capital. On the other hand, it must be admitted that, the regulations surrounding the other more qualitative "pillars" are much more specific about best practices in developing Operational Risk Management (ORM) processes, and hence much more useful in practice.

Posted by pjmcconnell at February 12, 2008 01:13 AM

Comments

Post a comment




Remember Me?

(you may use HTML tags for style)

What can I do with PRMIA online?