Banks continue to evolve and enhance their Comprehensive Capital Analysis and Review (CCAR) operational risk loss estimation process. Now they have a renewed focus on the qualitative aspects of estimation, as well as the leverage of and integration with their existing operational risk management program.
The foundation of operational risk frameworks
Losses attributable to operational risk are a significant factor in Comprehensive Capital Analysis and Review (CCAR) loss projections for many banks. The CCAR process has matured, with regulators and financial institutions learning from each other in an ongoing and reinforcing cycle. Initially, the greater focus was on credit and market risk. But now the significant regulatory focus has shifted to operational risk.
An emerging regulatory focus—in line with sound day-to-day risk management—is to ensure that the CCAR loss estimation framework will be firmly grounded on the institution’s regular operational risk management process. In other words, the CCAR estimation can’t be a discrete process divorced from the institution’s operational control, monitoring, and mitigation functions. This is a key consideration as institutions design and evolves their CCAR operational loss framework to be more efficient, streamlined, and cost-efficient.
Overall operational risk framework considerations
Many institutions have designed their operational risk estimation frameworks to consider both historical and forward-looking approaches. Regulators are gradually becoming more open to looking at qualitative approaches to estimate forward-looking losses. But they still require institutions to look at their internal loss history and identify a correlation with macro-economic scenarios and events.
The first step toward managing operational risk begins as part of the first line of defense. This step is where business managers identify, own, and manage operational risks and the controls that mitigate the identified risks. Risk identification should include triggers that institutions use to identify potential control failures that may result in operational losses.
At regular intervals, the identified risks and controls are required to be evaluated for effectiveness. Many institutions have set up risk and control self-assessment (RCSA) to regularly evaluate the inherent risks present within:
- The institution
- The controls designed to mitigate them
- The resultant residual risks
These assessments help institutions identify material operational risks that potentially could go on to be significant influencers of operational losses. Material risks so identified are used in scenario analysis to estimate forward-looking events with low likelihood but that are plausible with high severity and impact.
An efficient and effective CCAR process should be grounded in and leverage the existing operational risk management framework. This ensures alignment between CCAR material risks and storylines and the actual risk profile and loss experience of the institution. The success of CCAR depends on the effectiveness of how upstream operational risk framework controls have been designed, monitored, and challenged.
To confirm compliance with regulatory requirements, institutions have broken down the operational risk loss estimation processes to logical components. There are four broad components defined:
- A quantitative model that uses historical data and attempts to model operational risk and macroeconomic relationships
- Scenario analysis for estimating losses related to forward-looking idiosyncratic events
- A legal loss component to estimate potential litigation losses
- Subject matter specialist (SMS) workshops to refine loss estimates from the previous components
The approach to estimating and stressing operational risk losses and ensuring all the individual components function efficiently requires a clearly designed governance structure supported by appropriate personnel. This structure is required to accommodate the escalation of issues to leadership, establish a conflict resolution process, and install continuous process improvement. The governance function should also include review and challenge across the different aspects of the CCAR operational risk loss estimation process.
Framework component considerations
Below, we address the individual components that make up an overall operational risk framework. We also summarize specific lessons learned and considerations from the individual components.
Quantitative models attempt to forecast operational risk-related losses across the CCAR forecast horizon based on historical loss experience and macro-economic variables. Industry experience over the last several years has led to a new consensus: Purely statistical approaches to CCAR projection models for operational risk are somewhat more elusive than models for other risk-related losses such as credit or market risk for several reasons, including:
• Institutions have made significant improvements to their operational risk event and loss data capture processes, particularly in the aftermath of the financial crisis. But this process has historically lagged data-driven quantitative modeling efforts in market and credit risk.
• The magnitude of institutions’ operational losses is typically driven by large idiosyncratic events that are difficult to model based on the available history.
• Except for certain types of operational risk that can be attributed to stress on control systems based on macroeconomic condition, most operational losses don’t demonstrate meaningful correlation. This is a fundamental assumption that drives most statistical models for CCAR.
Accordingly, many institutions adopt a combination of econometric models (where feasible) and extrapolations from historical data to project operational risk-related losses for CCAR. This, in turn, places a much heavier burden on the qualitative or judgmental scenario analysis processes to ensure adequate levels of losses are captured in the forecast.
Quantitative models attempt to forecast operational risk-related losses across the CCAR forecast horizon based on historical loss experience and macro-economic variables. Industry experience over the last several years has led to a new consensus: Purely statistical approaches to CCAR projection models for operational risk are somewhat more elusive than models for other risk-related losses such as credit or market risk for several reasons, including:
• Institutions have made significant improvements to their operational risk event and loss data capture processes, particularly in the aftermath of the financial crisis. But this process has historically lagged data-driven quantitative modeling efforts in market and credit risk.
• The magnitude of institutions’ operational losses is typically driven by large idiosyncratic events that are difficult to model based on the available history.
• Except for certain types of operational risk that can be attributed to stress on control systems based on macroeconomic condition, most operational losses don’t demonstrate meaningful correlation. This is a fundamental assumption that drives most statistical models for CCAR.
Accordingly, many institutions adopt a combination of econometric models (where feasible) and extrapolations from historical data to project operational risk-related losses for CCAR. This, in turn, places a much heavier burden on the qualitative or judgmental scenario analysis processes to ensure adequate levels of losses are captured in the forecast.
Specific considerations
• Industry consensus, and regulatory acceptance, says that the size of individual operational loss events provides little correlation with macro-economic factors. Where stronger relationships do exist, they’re typically observed in the frequency of events driven by macro-economic factors. Consequently, common modeling practices include separately modeling the frequency of events and the expected severity of events.
• Models often incorporate higher percentiles of the event size (loss) distribution as a proxy for additional stresses under adverse and severely adverse scenarios as compared to the base scenario. Regulatory expectations assume that projected operating losses will be higher for adverse and severely adverse scenarios as compared to base scenarios.
• Not withstanding the industry consensus, regulatory expectations still require a thorough investigation of the data to identify whether meaningful correlations can be found (with appropriate segmentation) before falling back to an average-based approach.
Scenario Analysis
Scenario analysis is a process of obtaining the expert opinion of business line and risk managers to identify potential operational risk events and assess their outcome. Institutions use scenario analysis to estimate idiosyncratic losses with the help of SMS in the form of workshops. Typically, institutions conduct workshops on an annual basis to capture plausible forward-looking risks, which are high-severity, low-probability, and not adequately captured by the quantitative model.
Material operational risks specific to the institution are used as primary business inputs to the process and must be tailored to the lines of business, products, and services offered to customers and the events and loss history of the institution. They’re used to create the individual scenarios that would be used in the scenario analysis workshop discussion. Business unit heads, functional heads, SMSs, representation from the legal department, operational risk management representation, and scenario challengers who are independent of the business should attend the workshops. Where the participants aren’t able to attend, a delegate(s) should be nominated to participate in lieu of the original participant(s).
The process starts with the pre-workshop phase where discussions are held to develop storylines and narratives based on identified risks that are expanded and quantified during the workshop. In addition to the material operational risks, RCSA results, internal loss history, external loss history, and industry trends identified by the businesses are used as information that could help build out the scenario storyline. The scenarios should align with the operational risk profile specific to the institution. In the workshop, participants discuss the various outcomes of the scenarios and estimate operational loss amounts primarily driven by expert judgment. Workshops are held for multiple scenarios, and only a few are chosen by the experts to be used in CCAR submissions.
Specific considerations
• Discussion of the timing of losses materializing across the nine-quarter CCAR forecast period should be considered as part of the workshop sessions. Ideally, the discussion in the workshop should include both the magnitude and timing of the losses.
• The distribution of losses over the forecasted nine-quarter period should be stressed or otherwise analytically evaluated for the potential timing of concentrated losses, arising from transactional losses or regulatory fines. Institutions should be able to justify the appropriation of such concentrated losses over the CCAR time horizon.
• Bias mitigation is a necessary aspect of the workshop process. Bias education for the participants prior to the workshop sessions is helpful. An independent function that plays a challenging role during the workshops could encourage active identification and challenge of bias.
• Selection of a subset of scenarios from the scenario analysis program to be used in the CCAR submission usually involves expert judgment. If institutions have established empirical formulae that can be used to select relevant scenarios, they should ensure a robust justification of the methodology.
Regulatory Guidance
In 2011, it was the first time that institutions were formally required to submit their CCAR reports. During the initial three years, the Federal Reserve (Fed) had specific operational risk feedback to individual institutions. In 2014, one of the key focus areas that impacted operational risk was the risk identification process. The Fed required institutions to establish robust processes that would support risk identification, risk measurement, and risk management. The following year, material risk identification became a key theme. Regulators wanted to understand if institutions had a comprehensive process for identifying the full range of relevant risks arising from their specific business mix and exposures. This included risks that became apparent only under stress.
Four years later, we saw the release of regulatory guidance in the form of supervision and regulation (SR) letters from the division of banking supervision and regulation (SR 15-18 and SR 15-19). These letters laid out the supervisory expectations for capital planning, including requirements tied to the size and scope of operations, activities, and systemic importance of the institution. The relevant operational risk sections identified key themes such as the risk identification process, approaches to operational loss estimation, and the quality and use of data. In addition, large and complex institutions were required to use scenario analysis in their operational loss projections. During this time, the Fed made several enhancements to its models used to estimate operational risk stress capital.
The regulators continue to focus on risk identification as a major theme. Based on the 2018 review and assessment results, regulatory expectations included the establishment and implementation of a comprehensive, institution-wide risk identification process that enables capture and measurement of risks. Additionally, a big focus included the assumptions and analysis designed to address known data or model weaknesses, challenge the strategic or other management actions during a given stress event, or support elements of the forward-looking assessment that remain difficult to model and therefore require the application of well-governed business judgment.
Litigation Loss Component
The forecast includes losses from known litigation events or potential losses from unknown litigation events. Individual open cases with material loss exposure greater than a specified threshold are considered in the litigation loss estimation process. Losses from known litigation events are assessed and calculated with inputs from the institution’s legal group. The calculations consider the assessment of potential stress on the litigation outcomes. For the unknown litigation events, institutions usually consider scenario analysis as a method to estimate potential losses. Either a legal expert provides input during the institution’s scenario analysis workshops or the legal team has its own scenario analysis workshops for litigation events.
Specific considerations
• Legal loss estimates that are derived using expert judgment should be sufficiently justified, including losses impacted during periods of stress. While estimating idiosyncratic legal losses for developing litigation events, the legal department has a better understanding of the developing event. The legal team should document the rationale supporting the estimation while submitting loss estimates.
• Date assignments for loss events (especially legal loss) that impact the institution over time shouldn’t be based on judgment. Institutions should clearly lay out guidelines regarding the recognition of timing of a loss event based on the occurrence of the event.
Loss refinement and aggregation
Loss refinement and aggregation is an expert-driven process to review and refine initial loss forecast derived from the quantitative model, scenario analysis process, and litigation loss components. It’s often facilitated by the operational risk management function through a series of workshops. Experts discuss and challenge modeling approaches and result from the scenario analysis and litigation loss components during the workshops. These workshops serve the purpose of capturing risk drivers of operational losses that aren’t completely or only partially captured in the previous components. The workshop process follows a clear and logical order of discussion of different risk taxonomies, review of the estimation approach, discussion of loss projections, and adjustment if any.
Specific considerations
• While workshops may be conducted in multiple phases for logistical reasons, final aggregation and loss refinement should be performed once all the other components of the CCAR operational risk process are executed.
Moving forward with the operational risk framework
The components discussed above, including the quantitative model, make up the significant components of the CCAR operational risk framework. What ties all these individual pieces together is the stewardship of the operational risk management function. Operational risk management should ensure consistent implementation and sustained performance of an institution’s operational risk framework. It’s the institution’s responsibility to ensure that the framework provides comprehensive coverage across the different operational risk event types and to perform ongoing validation of not just the individual components, but the overall operational risk framework.
As part of a broader effort to improve the sustainability of an institution’s CCAR operational risk loss estimation forecasting efforts, firms need to not only strengthen the individual components but also ensure that the framework is grounded in and leverage the business-as-usual operational risk management framework.
Courtesy- https://www2.deloitte.com/us/en/pages/advisory/articles/establishing-operational-risk-framework-banking.html/#top