Transcription
OPERATIONAL RISK QUANTIFICATION:STRESS TESTSBy Mark Laycock, Thomson ReutersThe views and opinions expressed in this paper are those of the author and do notnecessarily reflect the official policy or position of Thomson Reuters.
CONTENTSWHAT IS A STRESS TEST?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4WHY HAVE STRESS TESTS?. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4SCOPE OF STRESS TESTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5OPERATIONAL RISK & STRESS TESTS. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 92OPERATIONAL RISK QUANTIFICATION: Stress testsOCTOBER 2014
ABOUT THE AUTHORMark Laycock consults on operational risk frameworks. He has recently published a book “Riskmanagement at the top: a guide to risk and its governance in financial institutions”. He has thirtyyears of experience in banking, including a period as a trader. Since 1999 his focus has been onoperational risk. He also works with the Operational Riskdata eXchange (ORX).Statement of intentPAPERS ON THE QUANTIFICATION OF OPERATIONAL RISKThis is the third in a series of five papers exploring the quantification of operational risk. The focus of this paper is on stresstesting, in particular as required by regulators.The four other papers focus on the AMA, scenarios, structural models and cost: benefit analysis. The last two papers aremore speculative as they consider quantification techniques that are not yet widespread in use.3OPERATIONAL RISK QUANTIFICATION: Stress testsOCTOBER 2014
WHAT IS A STRESS TEST?Stress tests are related to scenarios, as describedin a previous paper in this series. Stress tests areexercises to make assessments of the potentialimpact of an adverse future environment orevent on a bank. Stress testing can be carriedout at various organizational levels. Stresstests are a risk management tool that use anextreme, but plausible series of developmentsto assess the impact on the firm.1 These may bemore extreme conditions than those used forscenarios.A stress test will have a description of the event— for example, it might assume negative growthin GDP for three quarters, plus interest rates andforeign exchange rates — as well as other detailsabout the theoretical operating environment.The main difference between stress tests andscenarios is that part of the scenario output isthe likelihood of occurrence, or the frequency ofthe event, over a given time horizon. The focusof stress tests is upon the severity of the event;likelihood of occurrence is not needed.For example, the severity of loss at 99.9%may be a loss of 1,000. The scenario maythen discount this loss by the likelihood of ithappening over the next 12 months e.g. 0.5%.The stress test only focuses upon the severityat the 99.9%, or whatever confidence intervalis used.Stress tests are now part of the regulatorytoolset and are likely to be used on a regularbasis, for example annually.2 Stress tests arebeing used by various national regulators (forexample the UK and the USA) as well as supranational regulators, such as the EuropeanBanking Authority.If stress tests are an uncommon activity, thenfirms tend to have a short term effort that isoften very manual. However, if stress tests aregoing to be a regular activity, then firms need todevelop supporting infrastructure, possibly builtoff their scenario analysis framework.WHY HAVE STRESS TESTS?Stress tests, as a process, are intended to identifyand quantify risks to business portfolios. Theyhave been adopted by banking and insuranceregulators following the financial crisis.For individual firms, stress tests promote riskand capital management. The risk managementelement may include decisions about riskreduction or transfer. On other occasions it is thediscussion that leads to increased organizationalawareness and resilience.For the regulators, having a number of firmswithin their jurisdictions perform stress tests onthe same extreme but plausible environmentshas advantages: Benchmarking stress testing techniquesbetween firms, Benchmarking outcomes between firms, Gaining a better understanding of thesensitivities of a firm’s portfolio of assetsand business models, Aggregating the outcomes between firmsto arrive at an industry impact on a capital,balance sheet response and potentialconsequences for the wider economy, and Identifing potential systemic issues.The results of regulator-sponsored stress testswill be published, generating benefits froma degree of transparency. From a broader1 Based on Federal Reserve Supervision & Regulation letter 12-7 “Supervisory guidance on stress testing” and Office of theSuperintendent of Financial Institutions (OSFI), Canada, Guideline E-18.2 Bank of England (October 2013) “A framework for stress testing the UK banking system”.Bank of England (May 2014) “Summary offeedback received on the stress testing discussion paper”.Bank of England (April 2014) “Stress Testing the UK banking system: guidance for participating firms”.European Banking Authority (April 2014) “Methodological note EU wide stress tests 2014 – version 2”.4OPERATIONAL RISK QUANTIFICATION: Stress testsOCTOBER 2014
perspective, this transparency, can boostconfidence in the robustness of the sector.However, this requires an understanding of thepurpose of stress testing and reactions to buildresilience.The regulators want to see an assessment,by the individual firms, of the stress testand possible outcomes. The discussion bymanagement and the Board needs to includebalance sheet impact, and in particular theimpact on capital and the firm’s contingencyplan. This review of these elements can bethought of as part of, or an extension to, theInternal Capital Adequacy Assessment Process(ICAAP). If the events described in the stresstests arose, would the firm still be a goingconcern? In this case “going concern” includesnot only adequate capital but also access tofunding (one of the lessons from the financialcrisis). The capital adequacy can be achievedby balancing the available capital with therisks that the firm plans to take if the stresstest operating environment materializes.By applying the stress tests to a significantpercentage of the industry simultaneously,the regulators can provide a reasonablenesstest to some of the envisaged managementresponses. For example, if access to short termfunding, in the form of certificates of depositor commercial paper, falls significantly (aspart of the stress test) then it is very unlikelythat every firm will be able to simultaneouslyincrease their volume of retail deposits by20%. Likewise, if all of the firms decide to sella particular asset class, then the prospectivebuyers may not be able to take the totalvolume and the price will be lower than whenthere is no selling pressure.SCOPE OF STRESS TESTSHaving established that regulator-specifiedstress tests are highly likely to become regularevents, the next step is to consider their scope.The regulator-specified stress tests are at5OPERATIONAL RISK QUANTIFICATION: Stress teststhe level of the total firm or group within thatjurisdiction. This has two implications. Firstly,the stress test looks at the balance sheet,capital position and management responseacross all of the risk types. The stress testsare not confined to the Pillar 1 risk types ofcredit, market and operational risk. Amongstthe Pillar 2 risk types, in addition to fundingliquidity, are issues such as pension fundshortfalls.Secondly, while stress tests are a relativelynew concept, their use by regulators can beexpected to grow. This growth can materializein two directions. One direction is that large,internationally active firms may have to startcompleting stress tests for host supervisors.The other direction is that more firms will berequired to complete stress tests in any givenjurisdiction.For the large, internationally active firms, coordination amongst the regulators in terms oftiming and potential stressful conditions willpromote processes with benefits for efficiency,consistency and knowledge. This consistencywill then support regulators assessing systemicrisk contagion between countries. For someof the very large firms, such as the SIFIs(systemically important financial institutions),the stress testing results will probably bediscussed in regulatory colleges arranged bythe home regulator.The scope of stress tests should not belimited to the regulator-described operatingenvironments. Firms are expected to identifyextreme, but plausible events that could alsohave severe consequences for the firm. These“self-stress tests” have been introduced bythe Bank of England Prudential RegulatoryAuthority and it will be interesting to seehow useful they are and how they develop.The need for the “self-stress test” arises asthe impact of a given regulatory-specifiedoperating environment will depend upon theOCTOBER 2014
business models and portfolios of individualfirms. The “self-stress test” promotes abetter understanding within the firm of theconvergence of events in a particular operatingenvironment, that could cause real problems.The stress operating environment canrepresent various periods into the future.For some of the individual risks, includingoperational risk, the stress test outcomes maydepend upon the path taken between todayand the period covered by the stress test. Forexample, a boom in 2016 followed by a bust in2017 is likely to have different consequencesto a “steady ship” followed by a “shallowrecessionary dip”.OPERATIONAL RISK & STRESS TESTSThe starting point for operational risk stresstesting is to see how existing data can be reused, in part or in its entirety. This is followedby consideration of the interaction betweenoperational risk and the other major risk types.Operational Risk Stress TestsThrough the internal and external loss datasets, plus the scenario program, major firmshave an inventory of ideas and issues that canbe developed and contribute to stress testing.The starting point with this data is to createa sub-set of the extreme, but plausible. Soasteroids landing on head office, or an alieninvasion are out, but a pandemic is in. Otherextreme topics could include two simultaneousrogue trading incidents.In the scenarios white paper in this series,the concept of frequency and severity driverswas introduced. The drivers are factors thatinfluence the likelihood that an event willhappen or that will affect the size of the loss.One approach is to use extreme values forthe severity drivers or exposures, such as avolume of transactions or high levels of marketvolatility, or increasing the percentages ofloan application fraud as the basis for a stresstest. The stress test might push things a bit6OPERATIONAL RISK QUANTIFICATION: Stress testsfurther, for example not just a regulatory fine,but also a restriction on activity includingthe withdrawal of a license that renders theproduct or service impossible to execute.The sub-set of data from the scenarios shouldbe reviewed to see if any of the events wouldor could be influenced by the conditionsdescribed in the stress test operatingenvironment. For example, a scenario mightbe “unauthorized or rogue trading” in thetrading & sales business line. Assuming thatthe operating environment condition, asdescribed in the stress test, is a recession, thenprofits of the trading & sales business are likelyto be lower, leading to lower bonuses. So willthis environment encourage somebody witha “hero complex” to become a rogue traderin order to save the department’s bonus?Or could it lead to the emergence of moremalignant motives? If the answer is “maybe,”then the described operating environmentincreases the likelihood, and possibly theseverity, of rogue trading events. In a morebenign environment, a large loss may bebearable, but less tolerable when the stresstest conditions are putting the balance sheetunder pressure from other directions, suchas the credit portfolio. It is this pressure orstress from simultaneous effects arising from asingle set of conditions that the regulators aretesting.Other operational risk events that mightbe sensitive to the operating environmentdescribed in the stress test, include humanfactors such as the propensity for fraud whether internal or external.Continuing the human factor theme and beingexcessively cynical, firms do not usually getsued for mis-selling when the buyer is makingmoney. As a result, if the stress test conditionsindicate a loss for the client, then the firmsshould expect an increase in litigation.Other less obvious sources of risk driversOCTOBER 2014
include the envisaged management responseto the stress test conditions and the periodleading up to the time horizon underconsideration. A very simplistic example couldbe a reduction in the headcount of the noncustomer facing and non-operations areas.This includes risk management, compliance,reconciliations teams, etc. The stress testexpertise is then required to estimatethe impact of a reduction in the controlenvironment. There is also the “survivors’curse” to consider, when the remaining staffget increased personal stress levels due totheir increased volume of work and job relatedanxiety.In addition, or as an alternative to a reductionin headcount, there are likely to be reductionsin resources applied to risk mitigation projects.What are the implications of this change inemphasis for the “ordinary” operational risklosses?Operational risk events usually have threedates associated with them: A “date ofoccurrence”, a “date of discovery” and a “dateof recognition.” The date of recognition relatesto when the event is recognized in the P&L.For some events, the date of discovery mightbe several months or even years after thedate of occurrence. The date of recognition,when the loss hits the P&L, may also be afteranother gap of months. This sort of differenceneeds to be considered when extrapolatingfrom the current extreme, but plausibleevents for scenarios, to those that occur underthe stress tests. Likewise, events may occurduring the stress period e.g. 2017, but not bediscovered or materialize until 2018 or later.For the purpose of stress testing, this level ofdetail and granularity is probably excessive.Events can be assumed to be discovered andrecognized instantly.As can be gauged from the comments above,extrapolating from the current extreme and7OPERATIONAL RISK QUANTIFICATION: Stress testsplausible to the stress test conditions requiresconsiderable expert judgment and theapplication of logic, science and art.Interaction with Other Risk TypesFor an idea of the potential for interactionbetween major risk types during stressfulconditions, it is only necessary to explorethe mortgage-related losses and fines thatemerged during the financial crisis. Manyof these losses and fines related to failuresin due diligence processes at the outset ofthe mortgage origination and failures in theforeclosure processes. (Some of these arestill subject to litigation.) Process failures arean operational risk event. As the loss wastriggered by a deterioration in credit status, theoperational risk element can be viewed as anadditional severity driver on the credit loss. Orchronologically, was it an operational risk eventthat was uncovered by the credit risk event?The essential message from these USmortgage-related losses is the interactionbetween credit and operational risks. Stresstest conditions can crystallize this interaction.The scale of losses arising from this particularinteraction should probably be incorporatedinto the outcomes from stress testing.The operating environments described inthe stress tests are also likely to producereductions in risk appetite, for example marketrisk. This tactic might be to release capital tosupport other risks that cannot be so easilyreduced. How the trading book managesdown its market risk is expected to influencethe management response to the stress testoutcome.For example, the trading desk might be toldto reduce the market risk generated by theOTC derivatives portfolio. The trading deskenters into (a) an offsetting trade in anotherOTC derivatives contract. As the transactionhas the potential to increase credit risk, thedecision is taken to collateralize. The collateralOCTOBER 2014
has to be registered, the transactions have tobe revalued and changes must be made to theamount of collateral delivered. The collateralhas to be funded, putting incrementalemphasis upon obtaining the funds.regulatory scrutiny in response to societalpressures during periods of widespread stress.In turn, these severe losses can give rise toreputation effects, which in turn have knock-onimplications for future capital raising.Alternatively, the trading desk enters into(b) an offsetting trade with an exchange.Transacting with an exchange, as well as acentral counterparty, results in daily marginmovements and opportunities for errors. Themargin still has to be funded.At this point in the economic cycle and lookingback to the 2007/2008 financial crisis, itlooks as though operational risk saw a bigincrease in the risk profile, and losses are stillmaterializing.Both a & b result in an increase in operationalrisk due to an increased number of processes(collateral) or an increased use of the existingprocesses (collateral and movements ofmargin).Both a & b examples show how a reductionin risk appetite for one risk type can lead toincreases in other risk types. For managementthe issue is the relative change. For example,a reduction in one capital requirement by100 units, but an increase of 10 in anotherstill releases a net 90 units of capital. Alliedto these changes are probable changes involumes of transactions going through varioussystems. While there may be a reduction involumes of some transactions others can beexpected to increase. If the increase takesthe system over the designed capacity thenthe end result is likely to be an increase infailures of some form or other. It is arguablethat one of the causes behind the failure in theUS mortgage foreclosure processes was aninability to cope with the increased volumes.Some of these examples have focused uponthe frequency drivers — factors that are likelyto see an increased number of events — orthe severity drivers, considering the scale ofthe impact. Only the knowledge provided byhindsight applied at a considerable distancewill be able to determine whether the pastrecession increased the size of operationalrisk losses, especially fines and compensationpayments. Added to this is the likely increased8OPERATIONAL RISK QUANTIFICATION: Stress testsCapital ImplicationsThe potential individual losses that areexpected to occur in the stress test operatingenvironment are bad enough, but it does notend there. Longer term implications arise fromthe use of historic losses as inputs into theAMA capital calculation.If the stress test output assumes that there isa loss of 1 billion, then the effect on the firmis more than 1 billion, but less than 2 billion.Firstly there is the cash outflow of 1 billionaffecting the P&L and the return on equity.Then the loss goes into the AMA databaseof historic losses. In the year of the event, theincrease in operational risk capital due to theevent is expected to be less than 1 billion. Thiseffect is due to the diversification across theindividual losses. Further, this loss is likely tobe present in the historic database for the nextfive years to some degree or other, affectingfuture operational risk capital estimates.This retention of history also has an impacton the capital required during the period ofthe stress test, e.g. 2017. For example, if thereare projected to be major losses in 2015 or2016 then their impact will still be felt in the2017 AMA capital calculation for operationalrisk. This adds complexity to the stress testingresults for operational risk. Is this level ofcomplexity and precision required for theregulatory and management stress test result?This is too difficult for an external observer tosay.OCTOBER 2014
SUMMARYThe benefits of stress testing for regulators,senior firm management and Boards, meanthat this genie is unlikely to be put back intoits bottle. At the time of writing, it looks asthough stress tests will become part of theregular regulatory toolkit. In turn this meansthat firms should start considering appropriateinfrastructure to support this regular activity.The current population of firms participatingin stress testing either have the regulatoryapproval to use the AMA or are close toapproval. In turn these firms will have datain the form of internal and/or externallosses that can be used to explore stress testconsequences alongside their existing portfolioof scenarios.The challenge is looking at the stressconditions determined by the regulatorsand mapping these to the operational riskscenarios already developed by the firm.Mapping economic factors representinga recession and a given fall in the valueof collateral, such as property supportingmortgages, to the Basel event types requiressome thought.If the firm’s existing scenarios have identified alimited universe of risk drivers then these canbe reviewed for how they may react or respondto the operating environment conditions ofthe stress test. Some of these risk driversmay be linked to human factors and others tothe number and value of transactions whichcan be affected by the alternative operatingenvironment described in the stress test.In addition to the stand alone operationalrisk issues, there is the feedback loop ofmanagement decisions responding to thestress test conditions. Will the potential actionssignificantly increase operational risk? Will theactions take place early or late in the periodcovered by the stress test, e.g. February orNovember 2017?9OPERATIONAL RISK QUANTIFICATION: Stress testsFurther complicating the issue is theinteraction between the risk types. Thiscan lead to reducing one risk type whilstsimultaneously increasing another. This risktransformation may be implicit in variouspotential risk reduction strategies.Finally, there are the implications of theassumed losses under the stress testconditions for the immediate and long termoperational risk capital requirement. Thisis due to the use of historic data, directlyor indirectly, as inputs to the AMA capitalcalculations.While experts may find it difficult to completescenarios, operational risk stress tests requireeven more imagination and understandingof interactions. Having a good scenarioprogram that identifies frequency and severitydrivers, which may or may not be linked to theeconomic conditions outlined by the regulatorsis important. Investment in the scenarioprogram facilitates the completion of stresstesting.While the current regulatory focus on stresstesting centers on economic conditions, thefirm may want to consider its own stress tests.In the current environment it is possible toimagine stress tests around cyber security.Alternatively, extend reverse scenarios forbusinesses into reverse stress testing todetermine what sequence of events wouldresult in a business ceasing to be viable.While stress tests may currently be appliedonly to banks, their success as a regulatory toolfor gathering information and insight meansthat non-bank SIFIs and parts of the plumbingfor the financial system may also be asked tocomplete them.Today stress testing for operational risk ischallenging!OCTOBER 2014
THOMSON REUTERS ACCELUS The Thomson Reuters Governance, Risk & Compliance (GRC) business delivers a comprehensive setof solutions designed to empower audit, risk and compliance professionals, business leaders, and theBoards they serve to reliably achieve business objectives, address uncertainty, and act with integrity.Thomson Reuters Accelus connects business transactions, strategy and operations to the everchanging regulatory environment, enabling firms to manage business risk. A comprehensiveplatform supported by a range of applications and trusted regulatory and risk intelligence data,Accelus brings together market-leading solutions for governance, risk and compliance management,global regulatory intelligence, financial crime, anti-bribery and corruption, enhanced due diligence,training and e-learning, and board of director and disclosure services.Thomson Reuters has been named as a category leader in the Chartis RiskTech Quadrant ForOperational Risk Management Systems, category leader in the Chartis RiskTech Quadrant forEnterprise Governance, Risk and Compliance Systems and has been positioned by Gartner, Inc. in itsLeaders Quadrant of the “Enterprise Governance, Risk and Compliance Platforms Magic Quadrant.”Thomson Reuters was also named as Operational Risk Software Provider of the Year Award in theOperational Risk and Regulation Awards 2013 and 2014.For more information, visit accelus.thomsonreuters.com 2014 Thomson Reuters GRC01847/10-14
OPERATIONAL RISK & STRESS TESTS The starting point for operational risk stress testing is to see how existing data can be re-used, in part or in its entirety . This is followed by consideration of the interaction between operational risk and the other major risk types . Operational Risk Stress Tests Through the internal and external loss data
