Exchange Ideas

Systems Risk

"Systems Risk" is in the position that Operational Risk was a decade ago (pre Basel II) in that everyone knows that Information Technology is a major issue in Financial Services but the industry has not found satisfactory ways of analysing and measuring the associated risks. Many business surveys point to IT being of vital interest to Boards and senior management, but we (the IT profession) keep screwing up - I would argue because, in part, neither the IT function nor business has yet learned how to manage risk.

 

September 18, 2009

The Heffalump in the Room

"Help, help, a Horrible Heffalump, cried Piglet, It is awfully hard to be b-b-brave, when you are only a Very Small Animal": A.A. Milne

Unlike its moribund sibling Pillar 1, Pillar 3 of Basel II is alive and well and living in Australia.

In its implementation of Pillar 3 for Basel II, the Australian prudential regulator, APRA, has set 'minimum requirements for public disclosure' for advanced banks under its Prudential Standard - APS 300. Recently, the 'big four' Australian banks produced their APS 330 disclosures for the March 2009 quarter.

In reporting however, some banks have obviously concentrated on the word 'minimum' in the regulations, while others have focused on 'disclosure'. For example, ANZ produced a mere 7-page report, four pages of which were blank or pro-forma statements, and National Australia Bank (NAB) a 9-page report, three of which were fluff. On the other hand, Commonwealth Bank and Westpac both produced large reports (82 & 73 pages respectively) disclosing not only information on the firms' Risk Weighted Assets, upon which Minimum Regulatory Capital is to be calculated, but also quite detailed discussion on Risk Governance and Organization including sensitive topics such as 'risk appetite'. Congratulations to CommBank and Westpac! (see update below)

Now when comparing these disclosures, it must be remembered that here we are comparing apples against oranges (against cranberries and melons), since not all Risk Weighted Assets (RWA) are computed on the same basis. For example, Market Risk Assets are computed on the basis of a 99% confidence interval whereas Credit and Operational Risk are computed on the basis of a 99.9% confidence interval, or a 1 in 1,000 year loss event. However, since all of the banks are doing it wrong in the same way, we should be able to compare at least their numbers for Operational Risk.

Before looking at the computations for Operational Risk capital, it should be noted that Basel II requires that Risk Weighted Assets be multiplied by 8% to derive the required Minimum Regulatory Capital (MRC) and that Australian banks, in practice, maintain 'Total Capital' reserves at a higher 'capital ratio' that averages just over 11%. It should also be noted that the four major Australian banks (ANZ, NAB, Westpac and CommBank) are surprisingly (?) similar as regards their Total RWA, averaging some A$295 billion (with NAB highest and ANZ lowest). At 8%, this means that on average these banks must maintain some A$23 billion of regulatory capital - this is not loose change?

When considering only Operational Risk Weighted Assets the four banks are quite close, averaging some A$19.5 billion with ANZ (A$17.4 billion), NAB (A$23), Westpac (A$19.3) and Commbank (A$17.9). On average this means that these banks must maintain some A$1.5 billion of capital just to cover Operational Risks - certainly a not-insignificant 'cost of doing business'?

If we look at Operational RWA as a fraction of Total RWA, it averages some 6.6% for these banks.

But hold on a moment, under Basel II, isn't Operational Risk Capital supposed to be around 15% of Total Capital?

That after all was the basis that was used to set rules under the Basic and Standardised methods for calculating Operational Risk Capital for 'non-advanced' banks.

Have non-advanced banks been stiffed?

I believe so, they should be mad as hell, since historically it is the larger 'advanced' banks, such as NAB, that have incurred the losses that have brought down the wrath of regulators everywhere!

But that is a windmill that must remain un-tilted for the moment, there are even bigger questions raised by the Australian disclosures/ revelations on Operational Risk.

A close analysis of the detail of the published disclosures shows that while not large overall, at 6.6%, Operational Risk tends to be one of the largest risk categories reported.

For the major banks, Operational Risk tends to be the FOURTH largest risk category after Business, Mortgage and Specialised Lending. As reported, Operational Risk Weighted Assets are much greater than for example, Market Risk, Interest Rate Risk in the banking book, securitisation risk and even 'lending to banks' - has no one in Australia heard about the failure of Lehman yet?

If Operational Risk is so large, relatively, why are shareholders (and regulators for that matter) not jumping up and down demanding that overpaid bank executive get to grips with it and quickly!

As Australian banks typically estimate their 'cost of capital' at 12% this means that, even at 6.6%, Operational Risk Capital is costing an average A$188 million per year for each firm or about three quarters of a billion dollars in lost income/opportunity in the Australian banking sector.

Of course, we cannot completely eliminate Operational Risk, but surely, at these levels, bank executives should be being incentivised to reduce the overall cost to shareholders.

Operational Risk is the Heffalump in the regulatory room. No one really wants to talk about it since no one really knows what it is and no one knows how to go about reducing it.

In A.A. Milne's wonderful childrens story 'Winnie the Pooh', no one has ever seen a Heffalump, but everyone is sure that they exist because something/ someone is stealing the 'honey'. In real life, banks are losing money/honey as a result of not doing things properly but that does not mean that they have to create scary monsters, such as Operational Risk, to explain their inadequacies.

Operational Risk Capital is a benign conspiracy, regulators need a safety factor, or fluff, just in case they get it wrong and ORC is a nice candidate as no one knows what it is and banks are not going to scream too loudly since they know if it wasn't that, it would be something else.

But in a world where regulators are soon going to be multiplying risk-weighted assets by a new 'leverage ratio' wouldn't it make sense to multiple something meaningful by something sensible or we would just be going through the motions until the next crisis?

As Winnie the Pooh so eloquently put it, "People who don't think probably don't have brains; rather, they have gray fluff that's blown into their heads by mistake."

Update:
Some correspondents have noted that banks such as NAB have, in the past, disclosed more than the minimum requirement, but just not in this quarter. Likewise, others, such as Commonwealth, have been less forthcoming in the past. This is fully accepted, but it is a shame that good news is not always 'disclosed' in this context, if only with an Internet reference?

Posted by pjmcconnell at 07:06 AM | Comments (0)

September 09, 2009

Basel II - Redux

"We come not to praise Basel, but to bury him"

No sooner has the warm soil settled on the grave of Basel II (see Basel II - Obituary), than previous friends and colleagues are slinking out of the shadows to discredit his memory.

In a recent web-cast, one of these Judas, Nancy Hunt head of capital markets policy at the FDIC (Federal Deposit Insurance Corporation) made the amazing claim that, had Basel II been implemented on time in the USA, "the US financial system would have been even worse off and required additional government intervention". Now remember that this comment comes from a senior official at a regulator that had responsibility for supervising some of the most egregious offenders in the 'sub prime' market, such as Countrywide, and has had to take over almost 90 failed banks already this year. Ms Hunt appears to be arguing that having no effective regulation is better than having some regulation. [Nurse, book one more place in the funny farm, please!]

More subtle, but more deadly to Basel's reputation, were the silky smooth words of the head of UK financial regulator (FSA) and member of the House of Lords, Lord Adair Turner, who in a review of the financial crisis, drove a dagger into the dying Basel, arguing that "the quality and quantity of overall capital in the global banking system should be increased, resulting in minimum regulatory requirements significantly above existing Basel rules" [I.e. Basel got it wrong!]

The closest disciples of Basel, the Basel Committee, have also been turned into Doubting Thomases and, getting a flea in their ear during the latest G20 Finance Ministers' meetings, rushed off to develop a new 'leverage ratio' as "a supplementary measure to the Basel II risk-based framework with a view to migrating to a Pillar 1 treatment based on appropriate review and calibration." [I.e. Keep it simple Stupid].

If Basel II could only get a sub-committee together to calculate the minimum amount of angular momentum required, he'd be spinning in his grave.

But Basel is not completely friendless. The redoubtable Christine Lagarde, the French Finance Minister, has demanded that Basel II be implemented fully and immediately in all jurisdictions, especially the USA. However, remembering that Mme. Lagarde has just presided over major debacles at Societe Generale and Caisse d'Epargne, her arguments might be less than convincing. [With friends like that, who needs enemies?]

Regulators should realize that, like Monty Python's parrot, Basel II in its current form is not resting, but is dead, "He's not pining! He's passed on! He's a stiff! Bereft of life, He rests in peace! He's kicked the bucket, shuffled off this mortal coil!"

So is there anything to be salvaged from the vast amounts of time and money spent on Basel II? The answer has to be Yes, since there were many excellent concepts proposed in Basel II, if the whole eventually proved to be definitely a lot less than the parts.

Going forward, Basel regulation should be split into two distinct 'streams', lets call them 'Risk Governance' and 'Risk Capital' for now.
[The movie franchise use of roman numerals by Basel should also be dropped, let II be the last?]

Roughly Risk Governance should include what is in Pillars 2 and 3 of Basel II, plus a lot of other concepts, such as Risk Appetite and Reputation Risk, which were excluded from the original because they could not be easily quantified. On the other hand, Risk Capital would cover the calculation of capital needed to support an institution and is likely to be, for the foreseeable future, a mish mash of current Pillar 1 proposals plus a ragbag of other ideas such as a "counter-cyclical capital buffer".

[Note to regulators, reporting of risk is an integral part of Risk Governance and not an optional add-on, like Pillar 3 of Basel II.]

In Risk Governance, regulators should set the standards for how risk should be managed in firms of different sizes and industry sectors and they should set the bar very high. Having set exacting standards, regulators should then get out of the business of measuring compliance against those standards (a clear conflict of interest), leaving that instead to independent third parties, which for argument's sake let's call 'risk auditors'.

Likewise for Risk Capital, regulators should set the standards for calculating the capital to support an institution's risk taking and then leave the job of measuring compliance to independent third parties, let's call these 'financial auditors', since this is really an accounting function.

The link between these two 'streams' would be that any 'leverage ratios' used to relate risky assets to capital should be determined, at least in part, by the quality of a particular firm's risk governance.

Removing regulators from the messy business of measuring compliance with standards at individual institutions should then free them to be able to look across the industry at systemic risks and trends, which is their role after all? Regulators would of course have to maintain a small surveillance section to ensure that audits, risk and financial, are carried out correctly.

Having introduced another layer of audit, the 'risk auditor', the obvious question arises who would do it, apart that is from the Big Four accounting firms who could generate millions in fees? But other sources of expertise are available: rating agencies, once they work out their new role in the industry after the CDO fiasco; actuaries, who already do risk compliance work; and consulting firms, with appropriate certification of course.

In the light of the obvious failures of regulation, leading in part to the Global Financial Crisis, there are thousands of suggestions on how to go forward (admittedly including those above), but before the current proposals are thrown away, some analysis of what worked and what didn't may prove valuable.

For Basel's newly found detractors, Mark Antony's words in Shakespeare's' Julius Caesar may be timely:

"You all did love him once, not without cause:
What cause withholds you then to mourn for him?
O judgment! Thou art fled to brutish beasts,
and men have lost their reason"

Et II Brute?

Posted by pjmcconnell at 03:21 AM | Comments (2)