Operational Risk Management and the Case of Albania

Operational Risk Definition and Principles

Operational risk is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events”. This definition includes legal risk, whereas strategic and reputational risks are excluded. Legal risk includes, but is not limited to, exposure to fines, penalties, or punitive damages resulting from supervisory actions, as well as private settlements. (Basel II, part II, the first pillar, page 144)

In the table below, it is a detailed description of each of the elements mentioned above, compounding operational risk.

It happens that operational risk sometimes is considered as all risks other than credit and market ones and only systems & IT related, but such approach is not correct.

Operational risk is a new and important topic for all the banks in the world. Its measurement and management techniques are under development and there is a lack of publicly available historical loss data. On the other hand, operational risk management is being required by Basel II to be considered for capital adequacy calculation purposes.

It is important for every institution to identify and measure operational risk, since failures in this regard negatively impact profitability. Therefore, banks that measure and manage operational risk can reduce earnings volatility as well as the likelihood of an operational event becoming a “capital event”. On the other hand risk modeling of an institution that underestimates (or arbitrarily sets) capital for operational risk can distort decision making and performance evaluation.

Such topic becomes more and more important considering the fact that businesses are becoming more complex, changing rapidly, operationally intensive, and technology reliant. Banks that measure and manage operational risk are likely to be less susceptible to systemic problems.

There are several advantages related with the operational risk measurements, such as it follows banks to identify sources of operational losses, allows banks to identify operational loss outcomes that they have exposure to, but have yet to experience and provides a framework for modeling extreme events through scenario analyses of low frequency, high impact events.

Operational Risk data suggest that there exist two kinds of events:

the losses of high frequency/low severity the low frequency/high severity events that are more important.

In June 2011 the Basel Committee on Banking Supervision published its “Principles for the Sound Management of Operational Risk”, revised later in 2014. The aim was to provide guidance to banks on the management of operational risk. There are eleven principles, which incorporate the lessons from the financial crisis and the evolution of sound practice for management of operational risk. These Principles cover governance, the risk management environment and the role of disclosure, and address the three lines of defence (business line management, an independent corporate operational risk management function and an independent review).

Operational Risk and Basel II

Several risks are included in the Basel 2 capital adequacy framework. The main one is credit risk, followed by market and operational risk. The later was not included in the calculation of capital adequacy ratio in Basel 1, therefore it is a novelty as well as an added value from the risk assessment perspective.

The table below gives a comparison between the main risk categories described in pillar 1 of Basel 2.

Basel II sets three measurement methodologies for calculating Operational Risk capital charge “in a continuum of increasing sophistication and risk sensitivity”.

The first one is Basic Indicator Approach (BIA), which is calculated as 15% of average gross income for whole business over three years.

The second one is the Standardized Approach (SA) which calculates the Gross Income (GI) for eight business types considered separately with capital charges ranging from 12% to 18%.

The third one is the Advanced Measurement Approach (AMA) which requires an Independent risk management function and three years historical internal loss data and modeling based on combination of inputs and external model verification.

Basel II sets three measurement methodologies for calculating Operational Risk capital charge “in a continuum of increasing sophistication and risk sensitivity”.

Basic indicator approach (BIA): is the most straightforward approach. It uses a revenue-based proxy for scale and therefore risk at institutional/corporate level and an industry-wide calibrated rate, alpha factor for the institution. The capital requirement (K) is a multiple (alpha = 15%) of the average (positive) annual gross income as per formula below.

The Standardized Approach divides bank’s activities into eight lines of business (BL), where each BL is assigned an exposure indicator which is as in the BIA and each BL assigned a single multiplier (beta) to reflect its relative riskiness. The formula of calculation is below.

The chart below, describes in a schematic way the composition of Basel 2 capital adequacy framework.

The adoption of Standardized Approach is subject to compliance with some specific requirements, based on Basel acceptance criteria, such as:

Board of Directors involvement

Implementation of an Operational Risk framework/system with integrity

Operational Risk resources

Bottom-up processes

Identification of “killer” risks as well as routine ones

Dynamic processes

Determination of risk appetite

Systematic tracking of losses

Both of the methods above are subject to some weaknesses, since the Income element is considered as a poor proxy for risk. On the other hand, there is no differentiation in capital for better managed institutions (lower operational risk loss profile for a given business size). There is no link at any internal Operational Risk management processes, only via the qualifying criteria to develop such processes. There are few incentives to reduce Operational Risk capital, apart from qualifying for an AMA (which includes use of the allocation mechanism and factoring in diversification benefits).

External risk transfer such as insurance coverage is not recognized and there is inconsistency with approaches for market risk and credit risk.

Advanced Measurement Approach (AMA) allows significant flexibility in using an internal risk measure as the basis for regulatory capital. It must be based on internal losses. Use of the AMA is subject to supervisory approval.

Therefore it is needed to perform some adjustments to the above for material changes in the measured control environment, or business mix, to the minimum gross loss threshold allowed to vary between and/or within banks (but must be broadly consistent with a bank’s peers) as well as considering insurance coverage, partial use exception.

To classify losses for regulatory purposes, Basel created 7 event types:

Internal Theft and Fraud

External Theft and Fraud

Employment Practices and Workplace Safety

Clients, Products and Business Practices

Damage to Physical Assets

Business Disruption and Systems Failures

Execution Delivery and Processes Management

Internal models are expected to deliver several benefits, such as:

Positive effects on reputation and perception by stakeholders (shareholders, clients, rating agencies, clients, etc. )

Flexibility with financial innovation

Reduce regulatory and economic capital

Reduction of compliance costs

Incentives to improve risk management processes and procedures.

On Site Supervision of Operational Risk:

The main objective of the on-site supervision process is having a wider understanding of the way banking operations (business and risk profile) are carried out as well as the assurance the regulatory framework is being implemented correctly.

Depending on the scope of inspection (full, targeted, etc. ) on-site analysis of Op Risk may involve several business areas or functions. Such as the business lines, central/local administrative departments, compliance issues and internal control system.

The on-site examiners may perform full analysis for overall examination and integration of results from focused analysis as well as Focused analysis such as cross sectorial, compliance, by business line ect. According to the scope of inspection, on-site examiners select the proper tool (for final rating refers to off-site matrix).

Qualitative analysis is the core business of inspections due to the endogenous nature of Operational Risk (dependence on firm’s processes) as well as the fact that Operational risk is present in every sector.

Regarding quantitative analysis it aims to verify a proper calculation of capital requirement and the significance of calculated risk compared to business.

The operational risk is evaluated in three dimensions, its causes (what did not happened), its events (what happened) and Consequences (impacts of what happened).

It is important to evaluate as well whether the internal control has been sufficient to control causes and whether mitigating measures are adequate to minimize impacts.

Operational Risk in Albania

By decision nr 3 dt 19. 01. 2011 of the Supervisory Council of Bank of Albania approved the regulation on Operational risk management. The concept of operational risk management was introduced for the first time as a regulatory standard for the Albanian banking system, even though some of the banks had made progress with this regard, thanks to the fact that their mother banks are in the European Union countries. The approval of this regulation was a step forward toward the implementation of the EU best standards as well as Basel committee recommendations. The regulation introduced the definition of operational risk as well as qualitative requirements.

Based on article 4, point 3/a of the regulation “operational risk” is defined as the risk of loss resulting from inadequate or failed internal processes, people and systems or from external events. This definition includes legal risk, but excludes reputational and strategic risk.

An important topic in the regulation is the establishment of the operational risk management system, which includes:

the identification, with regard to/depending on the entity’s activity size, of the operational risk at the entity;

the comprehensiveness of the expected events which may arise material operational risks to the entity (including those set forth in Annex 1 of this Regulation);

the policies to identify, assess, monitor and control or mitigate this risk, including and specifying (whenever possible) the allowed limits of the operational risk;

the more prior actions for the entity in the management process of operational risk, also including the scale and the transfer way of this risk out from the entity

Such system was not formalized until its introduction as a regulatory obligation and the Steering Committee has been defined as the responsible authority for the establishment and development of the operational risk management system of the bank. On the other hand, the Steering Council shall ensure that the system for the operational risk management goes through an effective and comprehensive internal control process by an independent, qualified and responsible staff.

Each bank should follow the necessary steps for the operational risk management, such as:

The identification and assessment of the operational risk

The monitoring and reporting of the operational risk

Control and mitigation of the operational risk

Having in place a Business Continuity Plan

From the supervisory point of view, banks are required to report periodically to Bank of Albania their risk events that may trigger significant losses. According to the regulation, there are 8 type of events: Internal fraud

External fraud

Employment practices and workplace safety

Clients, products and business practices of the activities

Damage to physical assets

Business disruption and system failures

Execution, delivery and processes management

On the other hand, the regulation gives a list of the business lines as well as the activities related with each of them. The business lines are the same as those mentioned above in point 2.

Regarding the risk indicators, the regulation lists 7 key ones, as follows:

Legal case

Client complaints

Authorities complaints

Circulation of employees

Failure/interruption of the bank basic program

Doubtful operations with cards

Spread in cashiers’ balance sheet

All the banks and the non-banking financial institutions report periodically the abovementioned information to the Supervision Department of Bank of Albania and the later uses such information for its offsite analysis as well as on-site inspections.

Even though the regulation includes only qualitative criteria, the operational risk quantitative measurement is foreseen in the regulation “On capital adequacy ratio”. This regulation, approved in July 2013 from the Supervisory Council of Bank of Albania, is compliant with Basel 2 and includes three methods for the calculation of operational risk for capital adequacy purposes, the basic indicator approach, the standardized approach and the alternative indicators for certain business lines. In this way, it is completed even the quantitative element of operational risk management process.

Bank of Albania performs on-site inspections for operational risk, including IT risk issues. According to the Supervision Annual Report for 2014, the examinations carried out that year show that operational risk management has been improving upon the completion of the units in charge of this function, and the consolidation of the processes for the collection of data and the reporting of operational events. Banks show progress with regards to the perception on the importance of the internal analysis of operational risk data, and the use of the techniques to reduce this risk.

Conclusions

The introduction of the operational risk in the Basel 2 framework is an added value to the risk management practices in the banking system all over the world. Its quantification through three main approaches will make possible the allocation of capital charge for operational risk, by addressing in this way the concerns regarding the existence of such risks and the possible losses caused by a failure in the systems, people and internal processes. On the other hand, the principles for sound management of operational risk, will serve as a guideline for supervisors to assess the compliance of the banking system with these principles.

The situation in Albania is quite complete, first by implementing qualitative criteria as regulatory standards as well as by setting up a reporting framework of key risk indicators and losses incurred by business line. Second, the quantification of operational risk for capital adequacy ratio calculation purposes is an important step forward toward the implementation of Basel 2 and best supervisory standards.

References