Comment on Basel 2001 Operational Risk capital proposals

Offering services in -

- Bank, Treasury & Risk Consulting

- Project Management

- Strategic Risk & Technology Management for Schools

Thursday, 31 May 2001

The Team Leader

Operational Risk Committee

Basel Committee on Banking Supervision

Bank for International Settlements

Basel SWITZERLAND

Dear Sir/Madam,

Consultative Documents: Operational Risk issued January 2001

We write in response to your consultative document on Operational Risk in support of the New Basel Capital Accord, which was issued in January 2001 for comment by 31 May 2001. We have also taken into account the subsequently issued Quantitative Impact Study papers in as much as they refer to operational risk.

These comments are deliberately brief. Please advise if there are matters that you would like to explore further with us.

1. Strategic Perspective

As the consultative document acknowledges, bank risk management is undergoing significant evolution, particularly in the areas other than credit and market risk.

The primary driver behind this evolution in developed markets is greater management and shareholder awareness of the impact both of risk incidents and of the competitive advantages possible in adopting risk-based capital allocation. In both cases the concern is with all risks that can undermine or affect an entity’s survival or prospects.

We would suggest that this has been a stronger driver than regulatory pressures, at least in countries with developed financial markets. Nonetheless, for many reasons including those to which your papers allude, progress has been uneven and patchy. Regulators are in a strong position to reinforce the drive towards better risk management, and it is clear from your consultative paper that this is one of your goals.

The danger is that premature codification of a regulatory requirement may stifle the experimentation into and exploration of various alternatives. In particular an emphasis on a measurement method that fails to take into account its ramifications for risk management may be counterproductive, and actually reduce the banking industry’s resilience as a sector and the professional development across its members.

We suggest that an essential requirement of any Basel proposal for operational risk capital is that it motivate and facilitate better risk management. We fear the current emphasis on loss incidents in the target “internal measurement approach” may fail this test.

Based on our experience working with banks that have implemented operational risk measurement models (based on different variations of loss modelling and bottom up assessments), a critical success factor is responsive feedback to line management. A measurement approach based on historic loss data rather than current risk management quality is unlikely to provide a basis for responsiveness to line manager actions.

Even the positive impact of highlighting and using the proposed scaling factors is not be sufficient. In most cases both the Type 1 and 2 indicators are scale of operations measures rather than indicators of the quality of risk management or controls. Although ratios such as loss per scale of operation would be readily achieved, there is little to support causative analysis or motivate management action.

While regulators are not responsible for the internal risk management approaches of banks, it should nonetheless be a critical priority for them to encourage better risk management (and of course the transparency of these practices where they exist to the markets).

Strategically we believe it is in the strategic interests of the banking industry (and the regulators) if the emphasis on collecting and collating loss data is balanced by an emphasis on standardising qualitative assessments. This would echo the emergence of the credit rating agencies in the credit risk arena, and would be consistent with the approach Basel is adopting in that domain. Clearly an emergence of operational risk rating agencies or their equivalent (perhaps in part from audit firms?) will take time, but probably less than it would take to generate a sufficient history of operational losses to reflect the full range of economic and political cycles.

2. Future Focus

It appears as if the current form of the proposals have a bias towards investment banking and in particular the back office processing of trading and sales. It is a pity that this has occurred at the same time as the relative importance of these activities in global banking as a whole appears to be declining.

Rather there should be much greater emphasis given to agency, trust and retail banking operations where the impact of technology and of technology failure is building rapidly.

As a general comment it is difficult to see how a good operational risk model for e-banking or any new banking development will be able to be built on historical loss experience.

3. Enterprise Focus

The choice to adopt a narrow definition of operational risk is, we believe, unfortunate. As well as reflecting the investment banking focus, it is in conflict with the increasing emphasis for banks and conglomerates to need to manage and measure risk on a whole of enterprise basis. This is a shareholder and management imperative, albeit a difficult one.

We believe the apparent advantage of a narrower definition, that of restricting losses to tangible and more cleanly defined damage and thereby allowing more common agreement across institutions of what is being measured, will prove illusive. Despite a strong attempt to define losses and classification categories in your papers, there will inevitably be definitional uncertainties and variations across regulatory jurisdictions, across markets and between individual banks. In many incidents brand impact is the most significant effect and will drives management response in a way that would appear counterproductive on your narrow measure of the incident. And regulatory arbitrage tendencies will, we believe, ensure that this becomes an ongoing festering sore rather than a short-term transitional issue.

Moreover the acknowledgement in your papers that there are still “other risks” clearly leaves open and unfinished the question of quantifying a bank’s regulatory capital. The current proposal merely adds a current burden without the assurance that it is encompassing the complete issue.

We believe it would be wiser to adopt a slower approach towards a clearer goal, that of addressing all the risks that face a banking institution. The problems with tangibility are certainly significant. But if the business, political and strategic risks can destroy banks, then the risks and the difficulties in managing and measuring them should be faced and not sidestepped. The danger with the current Basel approach is that it appears to support this sidestepping.

Conclusion

Thank you for the opportunity to comment on your proposals.

We certainly welcome the move to address risk other than credit and market. We feel however that the most favourable result will be achieved if Basel

§ openly acknowledges the range and significance of risks not captured under the credit, market risk and proposed operational risk capital approaches,

§ explicitly acknowledges a need for the evolving regulatory risk measure for non-market and non-credit risk to provide a consistent measure of all these risks and to do so in a manner that motivates and is compatible with enterprise wide management of these risks

§ adopts a preliminary capital allocation for these risks along the lines of the first two approaches currently proposed,

§ commits banking regulators, in addition to the loss data/scaling factor analysis for tangible losses, to also work with the industry on developing consistent broad measures/indicators of the “other risks” and to endorse such measurement methods as they are developed and proven, and

§ in the interim permits national regulators to allow a limited reduction in operational risk capital based on their qualitative overview of banks with developed risk management frameworks, provided that the bank documents and publishes their approach to operational risk management.

Yours sincerely

SIGNED

David Farmer

Chief Executive Officer