Using Automated Decisioning and Business Rules to Improve Real-time Risk Management

Sandeep Gupta, Equifax James Taylor, Smart (enough) Systems August 2008

Technology Process

Compliance

Equifax is a registered trademark of Equifax Inc. Copyright 2008, Equifax Inc., Atlanta, Georgia.

All rights reserved. Do not copy or reproduce any part of this document without express written

authorization from Equifax.

Table of Contents Introduction to Decision Management and BRMS..................1

Inherent Risk Requires Sophisticated Decisioning..................1

The Power of Decision Management.........................................2

Automated Credit Risk Decisioning..........................................6

Decision Management and Credit Risk.....................................6

Optimizing Strategy Management.............................................9

Transition from Technology to Business Strategy.................13

Suggested Reading.....................................................................14

Equifax .........................................................................................14

1

Introduction to Decision Management and BRMS Inherent Risk Requires Sophisticated Decisioning Streamlining processes and improving decision making iscriticalasdemands intensifytominimizecreditrisk, increasecustomeracquisition,and improveretentionrates. In todaysfluctuating economic environment, companies, especiallyfinancial institutions, stand to make strong gains fromdecisionmanagement if it is applied correctly.This requiresthe integration of robust, automated decision managementsystems into operational processes.However, thesedecisionmanagement systemsmust be grounded in the context of asophisticated BusinessRuleManagement System (BRMS) inorderforcompaniestogaintheagility,profitabilityandnewgrowthtostaycompetitiveandsuccessfulinthemarketplace.

This white paper includes an introduction to decisionmanagement, written by James Taylor, one of the leadingexperts in the field.This introductiondelves into predictivemodels, business rules andChampionChallenger testing aselementsofsuccessfuldecisionmanagement.

Thispaperexaminestherelevanceofdecisionmanagementtocredit risk,howbusiness rules canbedefinedandmanagedand howwhatif analysis andChampionChallenger testingimproveresults.Youwilllearn:

What decision management is and what it requires Why decision management is essential for effective credit

risk management

Options for editing business rules Process and discipline for improving automated decisioning;

and

Approach for moving to business strategy management. This white paper is written for credit risk managers,technologists involved with decision management systems,and others interested in understanding more about creditdecisioning.

Equifaxhashelpedtheworldslargestbanksand

telecommunicationscompaniesimplementrulesbasedstrategiesthatachieveanoptimalbalancebetween

riskandnewaccountacquisition.

2

The Power of Decision Management Napoleon Bonaparte said, Nothing is more difficult, andthereforemoreprecious,thantobeabletodecide.Intodays24x7,customercentricandhypercompetitiveworld,thetimeand resources available to make decisions are moreconstrainedthanever.Operationaldecisionsthoserequiredto process highvolume transactions in frontline systemsand processes are under particular pressure. Decisionmanagementautomatingandimprovingthesehighvolumeoperational decisions is the only way organizations canensure that every operational decision is taken correctly,profitably and legally. Decision management developsautomateddecisionservicesusingbusinessrulestoautomatethosedecisions,addsanalytic insight to these servicesusingpredictiveanalyticsandallowsfortheongoingimprovementsofdecisionmakingthroughChampionChallengertesting.

Tomaximizetheefficiencyofabusinessprocess,youneedasmany automated decisions as possible. Correctly done, thisautomation eliminates subjectivity and enforces compliancewith regulations such as SarbanesOxley while increasingstraightthrough processing. Decision management boostsworkerproductivity,addsconsistencytothewayyouconductbusiness,andmanagesriskmoreprecisely.

There are four key elements to decision management. Itsabout finding, automating and improving decisions toimprove your business. It relies on business rules andbusiness rulesmanagement systems tomake it easier to seewhat ishappeningandeasierforthebusinesstocontrol it.Ituses data mining and predictive analytics to find the rightrules and to make those rules smarter by inferringinteresting things from the data you have, and its aboutongoingimprovementusingChampionChallenger.

Explicit decisions

The first step in decision management is to find and makeexplicitthedecisionsthatdriveyourbusiness.Manyofthesedecisions involve the assessment of risk for a particulartransaction, customer or action. By making these riskdecisionsexplicit,youcanmakethem:

Flexible for increased agility and currency Visible and measurable

3

Business driven and owned Consistent across channels, systems and processes Compliant with regulations and policies Customer-centric

You can also ensure that these decisions embody yourstrategy and company values as well as the expertise andtribal knowledge of your experienced staff. Explicitdecisions, as we will see, also give you the opportunity totrulyleverageyourcorporatedataassets.

Business Rules and BRMS

Tomake itpossible tomanageexplicitdecisions,youneedaway to specify them clearly and consistently.Business rulesareused todefine thepolicies,regulationsandbestpracticesthatshouldbeused tomakeadecision. If thebusinessrulesforadecisionaretobeautomated,andtheywillneedtobeformost operational risk decisions, then they must beimplementedsotheycanbeeasilymanagedandedited.Thisrequires theuseofaBusinessRulesManagementSystemorBRMS. Using a BRMS allows business rules to be clearlydefinedandcorrectlyexecuted.Automateddecisioningworkslikeawelloiledmachinewhen the rulesbeingexecutedaredefinedwithoutanyambiguity.

Automatingthe implementationofbusinessrulesalsomakespolicymakers lives much easier. They can accuratelymeasure whether or not their policies are working byeliminating subjective manual enforcement and, using thewide rangeofuser interfacesprovidedbyaBRMS, theycanactuallytakecontroloftherulesdirectly.Thisallowsthemtoeditandrefinethemasnecessary.

Toachieveahighdegreeofautomationincreditdecisioning,riskmanagersneedaBRMSaswellaspartnersexperiencedinthe definition of decision rules to improve automateddecisions;proper tools to assistwith the analysis,definitionand execution ofdecisions; and appropriatedata to analyzetheresultsofapplyingtheirriskpolicy.

Data and Analytics

Business rules must work with data and the quality andavailability of thatdata is critical.The broader the range ofdatathatcanbeused,thewidertherangeofrulesthatcanbe

ABusinessRulesManagementSystemorBRMSisacompletesoftwareplatformfor

defining,managingandexecutingbusinessrulesinaninformationsystems

environment.

4

written and thebetter thequalityofdecision is likely tobe.Datamay consist of feeds from an external system (such asuser applications for credit cards) as well as data extractedfromsourcesthatprovideadditionalinformation(corporationlists, credit files, etc.).All thisbusiness informationmustbedefinedandmanagedsothatitcanbeusedtodefinebusinessrules.

Many times the input data is further aggregated.Generallytheseaggregationformulasarealsodefinedasbusinessrules.Anexampleofsucharulewouldbeonethatcalculatedtotaloutstanding balances unpaid within 30 days of invoice forbank cards opened within 180 days. These rules definecalculated attributeswhich are then available to subsequentrules.

Historical data also has a role to play. Using data miningtechniques,youcananalyzehistoricalperformance todefinerulesandthresholdsthatmakesenseforongoingoperations.Using established techniques to analyze historical applicantdata tobuild adecision tree, for instance, canhelp segmentnew customers into groups that are likely to responddifferentlytodifferenttreatments.Decisiontreescanbeeasilyrepresented as business rules, allowing them to be easilyintegratedintoautomateddecisions.

For a more sophisticated solution, a much higher levelstatisticalmodelexists,knownasascoremodelorscorecard.Scorecardscanbebuiltby individualorganizationson theirown data or by companies like Equifax against pooleddata from multiple companies. VantageScore is one suchexampleofapooleddatascorecard.

Thedefinitionofthesemodelsinvolvesmoreintenseanalysisofhistoricaldata.Dataisanalyzedtoseewhichattributesofacustomer or application contribute to the riskiness of thatparticular application. The extent to which each attributevalue contributes risk ismodeled and a score card created.Thesemodelscanberepresentedasasetofbusinessrules,butrealistic implementation of these models in an automateddecision requires the ability to specify the rules using acustom interface specifically designed for score cards. Withscorecardrulesdefinedinthesameenvironmentasallotherbusinessrules,youhaveacompletepictureaswellassupportforanendtoendrevisionprocess.

5

The precision of the resulting rules and models is directlyproportional to theavailabledata, thedefinedscenarios,andthecapabilitiesofthetoolsbeingused.SASandseveralothersuchtoolsarewidelyusedtoanalyzesamplepopulationsandto develop predictive models and rules. When using dataminingandanalyticstoimprovetheautomationofdecisions,it is best if you have information both about customersacceptedbyyourorganizationandabout thosenotaccepted.For most organizations automating risk management,however, data about rejected applications is not readilyavailableforanalysis.Thedatamaynothavebeencollectedatallor itmayhavebeencollected too inconsistently touse.Inthese circumstances, the use of pooled models such asVantageScoreisrecommended.

Champion Challenger

ChampionChallengertestingisusedtocontinuallyrefineandimprove decision making. Decisions require constantassessmentandmeasurementforanumberofreasons.Firstitcanbehardtotellatdecisiontimewhatisagoodandwhatisabaddecision.Forinstance,badcreditrisksmaynotshowupfor some timeafter theirapplication is initiallyaccepted.Bythe time it isclear thatsomeone isabadcreditrisk, it is toolate to go back and see if a different decision would haveresultedinlowerlosses,forinstance.Secondly,itisoftenhardto analyze the potential impact of a proposed change forsimilar reasons. If the proposed change would treat somecustomersinanewway,theremaywellbenodataabouthowthosecustomerswillrespondtothattreatmentandnowayoftellingwhatimpactthisbehaviorwillhaveonrisk.

ChampionChallengeraddressesbothoftheseissues.Itallowsfor the definition of champion and challenger paths at anystepof thedecision.Thechampion is theone thatwillbeapplied to most transactions and is either the currentapproach (if a change is being considered) or the approachyouexpecttodobest(ifyouaretryingtogatherinformationfor later comparison). The challengers might be newapproachesyouwish to testor alternatives thatwill letyougatherdataforfutureanalysis.ChampionChallengeralwaysuses only one champion path, but one or more challengerpathscanbedefined.Eachpathhasuniquedecisioninglogicbusinessrules,scorecardsandsoon.

6

Although both champion and challengers are deployed inproduction, the challenger strategies are generally executedforasmallersetofapplications.Onceanewstrategyhasbeenvalidated, then it can be applied to the entire production.Doingsoensuresthatifthestrategyupdatedoesnotproducethedesiredresult,thentheimpactislimitedtoamuchsmallerpopulation.Similarly,ifachampionstrategyisnotgettingtheresultsdesired,challengersthathavebeenrunninginparallelwilloffercluesastowhatmightworkbetter.

Automated Credit Risk Decisioning Decision Management and Credit Risk CreditriskdecisioningintheBRMSworldintegratesrelevantcreditandnoncredit information frommultipledatapoints,including scores, ratios, models, fraud tools, judgmentalcriteriaandpolicycompliancerules,andallows forrealtimecredit decisions. This empowers the frontline employees atbanks and retail stores to offer realtime creditgrantingdecisionsatthepointofsale.

Realtime riskdecisioninghasbecome increasingly complex,with theneed for actionable customer intelligencedeliveredfrom both internal and external databases. A good BRMSoffersthefollowing:

Centralized and automated risk decisioning processes across all sales channels

Consistent business decisions that are regulatory compliant across the enterprise

The ability to quickly modify centralized business rules or credit policies to accommodate changing market conditions.

Many legacy systems use hardwired business rules, whichmakes it extremely difficult to deploy centralized businessrules across the organization when circumstances change newbusinessacquisitionsforexample. ITdepartmentscanteasilymanagethischangeprocess.OnesolutionistodeployhostedorASPBRMSsystemswhichintegrateonlinewithlegacysystems. The business rules for todays automated credit riskdecisioningsystemnowresideoutsidethelegacysystem.

BRMStechnologyenablescustomerstodevelop

whatifstrategytestingofnewscoresandrule

matricesusingtheirownofflineandarchiveddata.

7

Editing Business Rules for Credit Decisioning

Asnotedabove,businessrulesarecriticaltoeffectivedecisionautomation and management. Because business rulesrepresent the point of intersection between business knowhow, analytic insight and systemsdevelopment, it is crucialthat they be accessible to multiple audiences. Business andtechnicalusersmustbeabletorepresentbusinessrulesusingseveraldifferentmetaphors,suchasifthenelsestatements,decisionnodesinarulesflowdiagram,decisiontables,crosstabs, and decision trees. A good rules editor must have aprovision to define these business rules using any of thesemetaphors.

The firstmetaphor is thatof rules flow.A rules flowallowsthe definition of the steps within a decision that must beexecuted to make the decision correctly. Each step mightconsistofasetofrulesorascorecardtoexecute.Byallowingsteps and branches to be defined, the BRMS can handle allaspectsofadecision,improvingagilityandcompleteness.

Figure1:ExampleofRulesFlow

It isalso fairlycommon tohavemultiple taskpointsdefinedaspartoftherulesflow.Forexample, ifbusinessrulesreachcertainconclusions, then they shouldperforma specific tasksuchasaccessadefineddatasource,mailaletterorsendanemail. Although the performance of these tasks is not theresponsibilityofthebusinessrulestools,theymustprovideamechanismtodepicthowtheseactivitieswilltakeplace.

8

Havingdefinedtheoverallflow,businessruleswillneedtobedefined for thevarious stepswithin the flow.Business rulesmight be defined as If...Then...Else conditional statements,each independentlymanaged by theBRMS, or as a table ofrules,sometimescalledadecisiontable.Otheroptionsincludetemplatebasedrulesanddecisiontrees.

Figure2:TypesofRules

Oncetheinitialsetofbusinessruleshasbeendefinedusingatoolanddeployedinproduction,amechanismmustexistforrevisions.EaseofrevisionandtheresultingbusinessagilityisaprimarybenefitofusingbusinessrulesandaBRMS.

Many times these changes are obvious and do not requireextensivevalidationortestingpriortodeploymenttotheliveproduction system. This is especially true if the BRMS hasbeen used to control the editing of these rules and if itprovidesamechanismtopromotesuchchangestoproductionwithoutanyITinvolvementdirectlybythepolicymanagers.

Inothercases,achangewillrequireadegreeofvalidationandtestingprior toproduction.By consideringhow theupdatescome about the analysis of input application data and

9

results,forinstanceyoucandeterminethedifferentdegreesofvalidationandtestingrequired.

Figure3:BusinessUserEditingofRules

Optimizing Strategy Management Theflexibilityandeaseofmanagementprovidedbybusinessrules and a BRMS can and should be exploited tocontinuously optimize business strategy. ChampionChallenger testing isone approachwhileofflinehypothesistestingisanother.

One of the most effective ways to optimize strategies is toconstantly challenge the status quo. Lenders who becomecomplacent and allow the same strategy to be used forextended periods are likely to be outperformed by moreaggressivecompetitors.ChampionChallenger testing is idealfor those who want to continually refine their strategies.ChampionChallengercombinesrealresultsactualcustomersaretreatedbythechallengerstrategieswithminimalrisk.

WithChampionChallenger testing, aplanned change or analternative being considered is deployed in production butappliedtoonlyasmallsetofapplications.Thisenablesyoutogather information about the performance of the alternativestrategywhilelimitingimpact.

10

Figure4:ChampionChallengerRules

Champion Challenger testing should allow for theimplementation of gating criteria, allowing applicationprocessing flow to trackwhichpathwas actually taken.Aninteresting problem exists where multiple challenger pathsmay be required to validate multiple updates to a singleoverallbusinessrulesset.Oneshouldbecarefultoensurethistypeof implementationdoesnotgiverise toseveralpossiblepaths of execution, as each gatewill split the path.Amoreappropriatestrategy,usedpriortothenextgateinarulesset,would requirea splitof theprevious challenger to convergeagainwhile thesamepreviousgatingcriteriawouldbeusedwithconsistency.

Figure5:SettinggatingpercentagesforChampionChallengerstrategy

11

ChampionChallengertestingallowsfortestingtobedone inthe live system. Another approach involves conductingpredictiveanalysiswiththesampledatatoarriveatadesiredresult.Priortotheapplicationofanynewstrategywithintheproductionsystem,evenonebeingdeployedasachallenger,anofflineanalysisagainst thehistoricalapplications shouldbeconducted.Youcancomparewith thehistoricalresults toensurethatthechangedoesindeedimproveresults.

This kind of whatif analysis allows for the testing of newscores,rulematricesandotherhypotheticalscenariosagainstoffline, archived data without impacting your productionenvironment. You can effectively test the impact of anychanges to score cut, policy changes, crosssell assignment,datasourceassignment,decisionassignmentor lineofcreditassignment.

Here isasimple illustrationofhow rulesediting,ChampionChallengerstrategiesandhypothesistestingworktogether:

Figure6:HowwhatifanalysisandChampionChallengerworktogether

There are certainpartsof aproduction rules flow thatmustnotexecuteintheofflineenvironment.Ineachbusinesscasetheseelementswillneedtobereplacedwithmockservicesor simulators.Forexample,aparticularproductionbusinessrulemaycause thegenerationofanemail.However, in thecaseofwhatifanalysis,anactualemailmustnotbecreated.Anotherscenariomightbe thata realcreditapplicationmaybe accessed.However,with offline analysis, the previouslyusedcreditfilemustbereused.

12

Reusechallengesexistwhenaccessingarchiveddatabecausetheactualinformationmaybedatedandmustbeadjustedsothatwhentherulesareexecuted,thecomparisonisdoneinanappropriate context. A good example of this involves anactivity in a consumers credit file thatmay be analyzed todetermine its age.When thisdata is analyzed in an offlineenvironment six months later, it may produce differentresults.For thisreason,either thedata in thecredit filemustbe adjusted for the age of the data, or the context of theexecutionmustbeadjusted tomove the timebackwhen theactualexecutionhadtakenplaceinproduction.

So,foraneffectiveofflineorwhatifanalysisforthevalidationof an enhanced predictive model with historical data, anappropriate toolmust facilitate proper execution as definedabove. Not only that, the facility must also assist with thecreation of alternate business rules scenarios and with theidentificationofdatasets from thearchive to testagainst theentire population. Testing against a target sample may behinderedwiththeanalysisoftheruleschangeseffectiveness.

The biggest question still remains around how to developsuggestedchangestothebusinessrules.Aspreviouslystated,updatesuggestionsgenerallyarederivativesofhistoricaldataanalysiscombinedwiththefeedbackdata(performancedata)inorder to comparehow thedecisions faredwith theactualresults. Determining whether a decision to approve aconsumerforacreditcardwasagoodresultorabadoneisaclassicillustrationofthispoint.

Atthebasiclevel,adataminingtoolmayappearappropriateto conduct this type of analysis in order to review variouscharacteristics of input data against the historical decisionrendered as well as the performance results. Once analysissuch as this is conducted, it may be almost impossible todefine a strategy that eliminates all risks.Thus, the analysisturns to goalbased optimization. For example, if awirelessoperatorhasacustomerbaseof50millionwithawriteoffof$40million,itmaysetacorporatetargetofreducingitswriteoff to$25millionbutnot reducing the customerbasebelow$48million.Withthistypeofdecision,riskisstillpresentthateitheroneorboth targetsmay stillbemissed.Nevertheless,theobjectivenowbecomessettingthecreditpolicytoachievethesetargets.

13

Thistypeofcreditpolicyanalysisanddefinitionnowbecomesanexerciseforoperationsresearchandmorespecificallyturnsintoconstraintbasedoptimization.Incertaincases,ithasbeenshown thatevenwithasampledatasetof50,000,more than20millionscenarioshavetobeevaluatedinordertocomeupwithanewbusinessrulessettomeetdesiredgoals.

Transition from Technology to Business Strategy In order to navigate the complexities of todays businesslandscape where economic, regulatory and compliancepressures continue tomount, companies are seeking amorerobust decision management strategy to effectively andefficiently address their changing needs when it comes tostreamlining the application and riskdecisioningprocess, aswell as supporting ongoing change control and strategydevelopment.

When implementing a decision management solution,companiesshouldlookforatechnologysolutionthatprovidesthefollowingbenefits:

Easily edit business rules to respond rapidly to changing market conditions, without the need for programming support;

Test and optimize new business rules before rolling them into production.

With these capabilities, companies can focus on businessstrategy,not technicaldetails. Ifanewbusinessstrategycanbeimplementedquicklyandaccurately,thenbusinessownerscancontinuouslyimproveandrefinetheirstrategy.

Inaddition,aBRMScangobeyond justautomatingbusinessdecisions. For instance, aproblem thathashaunted telecomoperatorsaswellas financial institutions ishow tooptimizeofferstotheircustomersandeliminatesubjectivityassociatedwithCustomerServiceRep(CSR)decisions.AdecisionmadebyaCSRregardingabestofferislikelynotconsistentacrossthe entire company, because it is based on the subjectiveknowledgeofthe individualCSR.Asolutiontothisprobleminvolves using a BRMS to make consistent offer decisionsbased on the established business rules around such offers.

Anationaltelecommunicationscompanyachieved

comprehensivepolicyautomationacrossallsaleschannelsbyworkingwithEquifaxtoimplement150multidimensionaldecisionmatrices,analyzingdatafromsevendisparate

sources.

14

These offers can further be optimized by leveraging onlinedemographic and lifestyle data that helps customize evenautomated decisions around offers for new products andservices.

Suggested Reading Smart (Enough) Systems: How to Deliver CompetitiveAdvantage by Automating Hidden Decisions, by JamesTaylorandNeilRaden.Copyright2007byPrenticeHall.

TheBusinessRuleRevolution,RunningBusiness theRightWay,byBarbaravonHalleandLarryGoldbergwithguestcontributionbyJohnZachman.Copyright2006byHappyAbout.

Case study: Business Rule Management Systems andFinancial Services: Equifax as a Case Study, by ArianaMicheleMoore.Copyright2005byCelent.

Equifax Equifaxhasprovenexperiencehelpingcustomers implementbestofbreed automated risk decisioning processes.Equifaxs InterConnect platform offers specialized stateoftheartbusinessrulesmanagementforcreditriskdecisioning.Equifax leverages the combined value of our predictivesciences team, alongwith ourprofessional services team, tohelp customersbetterevaluate theirhistorical loandecisionsand creditpolicies to increase automateddecision rates andimprovecreditriskmanagement.PleasecontactyourEquifaxsales representative to find out how Equifax can help yourbusinessimplementrealtimeriskdecisioning.

About the Authors

Sandeep Gupta is Vice President, Strategic SoftwareDevelopment for Equifax. Mr.Gupta is responsible for themanagementofsoftwaredevelopmentintheB2BspacefortheInterConnectsuiteofsoftwareproductsatEquifax.

Mr. Gupta oversees the development of tools to providesolutions in identitymanagementand riskbasedapplicationprocessing,includingtheuseofbusinessrulestechnologiesto

15

automate decisions and improve maintenance of decisionrules.

James Taylor is one of the leading experts in decisionmanagement. Author of the first book on the subject, he isCofounder of Smart (enough) Systems, a consultingcompany dedicated to helping companies adopt andexploit decision management. You can reach him atjames@smartenoughsystems.com You can also find outmore about decision management at the Smart(enough) Systems blog: www.smartenoughsystems.com/wp.

Equifax, VantageScore and InterConnect are registered trademarks of Equifax Inc. All other trademarks and service marks not owned by Equifax Inc. or its subsidiaries that appear in this publication are the property of their respective owners. Copyright 2008, Equifax Inc., Atlanta, Georgia. All rights reserved. Printed in the U.S.A.

EFS-797-ADV8/08