OPERATIONAL RISK QUANTIFICATION: STRESS TESTS

OPERATIONAL RISK QUANTIFICATION: STRESS TESTSBy Mark Laycock, Thomson Reuters

The views and opinions expressed in this paper are those of the author and do not necessarily reflect the official policy or position of Thomson Reuters.

2 OPERATIONAL RISK QUANTIFICATION: Stress tests OCTOBER 2014

CONTENTSWHAT IS A STRESS TEST? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

WHY HAVE STRESS TESTS? . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4

SCOPE OF STRESS TESTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5

OPERATIONAL RISK & STRESS TESTS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6

SUMMARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9


Statement of intentPAPERS ON THE QUANTIFICATION OF OPERATIONAL RISKThis is the third in a series of five papers exploring the quantification of operational risk . The focus of this paper is on stress testing, in particular as required by regulators . The four other papers focus on the AMA, scenarios, structural models and cost: benefit analysis . The last two papers are more speculative as they consider quantification techniques that are not yet widespread in use .

ABOUT THE AUTHORMark Laycock consults on operational risk frameworks . He has recently published a book “Risk management at the top: a guide to risk and its governance in financial institutions” . He has thirty years of experience in banking, including a period as a trader . Since 1999 his focus has been on operational risk . He also works with the Operational Riskdata eXchange (ORX) .


WHAT IS A STRESS TEST?Stress tests are related to scenarios, as described in a previous paper in this series . Stress tests are exercises to make assessments of the potential impact of an adverse future environment or event on a bank . Stress testing can be carried out at various organizational levels . Stress tests are a risk management tool that use an extreme, but plausible series of developments to assess the impact on the firm .1 These may be more extreme conditions than those used for scenarios .

A stress test will have a description of the event — for example, it might assume negative growth in GDP for three quarters, plus interest rates and foreign exchange rates — as well as other details about the theoretical operating environment .

The main difference between stress tests and scenarios is that part of the scenario output is the likelihood of occurrence, or the frequency of the event, over a given time horizon . The focus of stress tests is upon the severity of the event; likelihood of occurrence is not needed .

For example, the severity of loss at 99 .9% may be a loss of 1,000 . The scenario may then discount this loss by the likelihood of it happening over the next 12 months e .g . 0 .5% . The stress test only focuses upon the severity at the 99 .9%, or whatever confidence interval is used .

Stress tests are now part of the regulatory toolset and are likely to be used on a regular basis, for example annually .2 Stress tests are being used by various national regulators (for example the UK and the USA) as well as supra-national regulators, such as the European Banking Authority .

If stress tests are an uncommon activity, then firms tend to have a short term effort that is often very manual . However, if stress tests are going to be a regular activity, then firms need to develop supporting infrastructure, possibly built off their scenario analysis framework .

WHY HAVE STRESS TESTS?Stress tests, as a process, are intended to identify and quantify risks to business portfolios . They have been adopted by banking and insurance regulators following the financial crisis .

For individual firms, stress tests promote risk and capital management . The risk management element may include decisions about risk reduction or transfer . On other occasions it is the discussion that leads to increased organizational awareness and resilience .

For the regulators, having a number of firms within their jurisdictions perform stress tests on the same extreme but plausible environments has advantages:

• Benchmarking stress testing techniques between firms,

• Benchmarking outcomes between firms,

• Gaining a better understanding of the sensitivities of a firm’s portfolio of assets and business models,

• Aggregating the outcomes between firms to arrive at an industry impact on a capital, balance sheet response and potential consequences for the wider economy, and

• Identifing potential systemic issues .

The results of regulator-sponsored stress tests will be published, generating benefits from a degree of transparency . From a broader

1 Based on Federal Reserve Supervision & Regulation letter 12-7 “Supervisory guidance on stress testing” and Office of the Superintendent of Financial Institutions (OSFI), Canada, Guideline E-18 .

2 Bank of England (October 2013) “A framework for stress testing the UK banking system” .Bank of England (May 2014) “Summary of feedback received on the stress testing discussion paper” . Bank of England (April 2014) “Stress Testing the UK banking system: guidance for participating firms” . European Banking Authority (April 2014) “Methodological note EU wide stress tests 2014 – version 2” .


perspective, this transparency, can boost confidence in the robustness of the sector . However, this requires an understanding of the purpose of stress testing and reactions to build resilience .

The regulators want to see an assessment, by the individual firms, of the stress test and possible outcomes . The discussion by management and the Board needs to include balance sheet impact, and in particular the impact on capital and the firm’s contingency plan . This review of these elements can be thought of as part of, or an extension to, the Internal Capital Adequacy Assessment Process (ICAAP) . If the events described in the stress tests arose, would the firm still be a going concern? In this case “going concern” includes not only adequate capital but also access to funding (one of the lessons from the financial crisis) . The capital adequacy can be achieved by balancing the available capital with the risks that the firm plans to take if the stress test operating environment materializes .

By applying the stress tests to a significant percentage of the industry simultaneously, the regulators can provide a reasonableness test to some of the envisaged management responses . For example, if access to short term funding, in the form of certificates of deposit or commercial paper, falls significantly (as part of the stress test) then it is very unlikely that every firm will be able to simultaneously increase their volume of retail deposits by 20% . Likewise, if all of the firms decide to sell a particular asset class, then the prospective buyers may not be able to take the total volume and the price will be lower than when there is no selling pressure .

SCOPE OF STRESS TESTSHaving established that regulator-specified stress tests are highly likely to become regular events, the next step is to consider their scope .

The regulator-specified stress tests are at

the level of the total firm or group within that jurisdiction . This has two implications . Firstly, the stress test looks at the balance sheet, capital position and management response across all of the risk types . The stress tests are not confined to the Pillar 1 risk types of credit, market and operational risk . Amongst the Pillar 2 risk types, in addition to funding liquidity, are issues such as pension fund shortfalls .

Secondly, while stress tests are a relatively new concept, their use by regulators can be expected to grow . This growth can materialize in two directions . One direction is that large, internationally active firms may have to start completing stress tests for host supervisors . The other direction is that more firms will be required to complete stress tests in any given jurisdiction .

For the large, internationally active firms, co-ordination amongst the regulators in terms of timing and potential stressful conditions will promote processes with benefits for efficiency, consistency and knowledge . This consistency will then support regulators assessing systemic risk contagion between countries . For some of the very large firms, such as the SIFIs (systemically important financial institutions), the stress testing results will probably be discussed in regulatory colleges arranged by the home regulator .

The scope of stress tests should not be limited to the regulator-described operating environments . Firms are expected to identify extreme, but plausible events that could also have severe consequences for the firm . These “self-stress tests” have been introduced by the Bank of England Prudential Regulatory Authority and it will be interesting to see how useful they are and how they develop . The need for the “self-stress test” arises as the impact of a given regulatory-specified operating environment will depend upon the


business models and portfolios of individual firms . The “self-stress test” promotes a better understanding within the firm of the convergence of events in a particular operating environment, that could cause real problems .

The stress operating environment can represent various periods into the future . For some of the individual risks, including operational risk, the stress test outcomes may depend upon the path taken between today and the period covered by the stress test . For example, a boom in 2016 followed by a bust in 2017 is likely to have different consequences to a “steady ship” followed by a “shallow recessionary dip” .

OPERATIONAL RISK & STRESS TESTSThe starting point for operational risk stress testing is to see how existing data can be re-used, in part or in its entirety . This is followed by consideration of the interaction between operational risk and the other major risk types .

Operational Risk Stress TestsThrough the internal and external loss data sets, plus the scenario program, major firms have an inventory of ideas and issues that can be developed and contribute to stress testing .

The starting point with this data is to create a sub-set of the extreme, but plausible . So asteroids landing on head office, or an alien invasion are out, but a pandemic is in . Other extreme topics could include two simultaneous rogue trading incidents .

In the scenarios white paper in this series, the concept of frequency and severity drivers was introduced . The drivers are factors that influence the likelihood that an event will happen or that will affect the size of the loss . One approach is to use extreme values for the severity drivers or exposures, such as a volume of transactions or high levels of market volatility, or increasing the percentages of loan application fraud as the basis for a stress test . The stress test might push things a bit

further, for example not just a regulatory fine, but also a restriction on activity including the withdrawal of a license that renders the product or service impossible to execute .

The sub-set of data from the scenarios should be reviewed to see if any of the events would or could be influenced by the conditions described in the stress test operating environment . For example, a scenario might be “unauthorized or rogue trading” in the trading & sales business line . Assuming that the operating environment condition, as described in the stress test, is a recession, then profits of the trading & sales business are likely to be lower, leading to lower bonuses . So will this environment encourage somebody with a “hero complex” to become a rogue trader in order to save the department’s bonus? Or could it lead to the emergence of more malignant motives? If the answer is “maybe,” then the described operating environment increases the likelihood, and possibly the severity, of rogue trading events . In a more benign environment, a large loss may be bearable, but less tolerable when the stress test conditions are putting the balance sheet under pressure from other directions, such as the credit portfolio . It is this pressure or stress from simultaneous effects arising from a single set of conditions that the regulators are testing .

Other operational risk events that might be sensitive to the operating environment described in the stress test, include human factors such as the propensity for fraud - whether internal or external .

Continuing the human factor theme and being excessively cynical, firms do not usually get sued for mis-selling when the buyer is making money . As a result, if the stress test conditions indicate a loss for the client, then the firms should expect an increase in litigation .

Other less obvious sources of risk drivers


include the envisaged management response to the stress test conditions and the period leading up to the time horizon under consideration . A very simplistic example could be a reduction in the headcount of the non-customer facing and non-operations areas . This includes risk management, compliance, reconciliations teams, etc . The stress test expertise is then required to estimate the impact of a reduction in the control environment . There is also the “survivors’ curse” to consider, when the remaining staff get increased personal stress levels due to their increased volume of work and job related anxiety .

In addition, or as an alternative to a reduction in headcount, there are likely to be reductions in resources applied to risk mitigation projects . What are the implications of this change in emphasis for the “ordinary” operational risk losses?

Operational risk events usually have three dates associated with them: A “date of occurrence”, a “date of discovery” and a “date of recognition .” The date of recognition relates to when the event is recognized in the P&L . For some events, the date of discovery might be several months or even years after the date of occurrence . The date of recognition, when the loss hits the P&L, may also be after another gap of months . This sort of difference needs to be considered when extrapolating from the current extreme, but plausible events for scenarios, to those that occur under the stress tests . Likewise, events may occur during the stress period e .g . 2017, but not be discovered or materialize until 2018 or later . For the purpose of stress testing, this level of detail and granularity is probably excessive . Events can be assumed to be discovered and recognized instantly .

As can be gauged from the comments above, extrapolating from the current extreme and

plausible to the stress test conditions requires considerable expert judgment and the application of logic, science and art .

Interaction with Other Risk Types For an idea of the potential for interaction between major risk types during stressful conditions, it is only necessary to explore the mortgage-related losses and fines that emerged during the financial crisis . Many of these losses and fines related to failures in due diligence processes at the outset of the mortgage origination and failures in the foreclosure processes . (Some of these are still subject to litigation .) Process failures are an operational risk event . As the loss was triggered by a deterioration in credit status, the operational risk element can be viewed as an additional severity driver on the credit loss . Or chronologically, was it an operational risk event that was uncovered by the credit risk event?

The essential message from these US mortgage-related losses is the interaction between credit and operational risks . Stress test conditions can crystallize this interaction . The scale of losses arising from this particular interaction should probably be incorporated into the outcomes from stress testing .

The operating environments described in the stress tests are also likely to produce reductions in risk appetite, for example market risk . This tactic might be to release capital to support other risks that cannot be so easily reduced . How the trading book manages down its market risk is expected to influence the management response to the stress test outcome .

For example, the trading desk might be told to reduce the market risk generated by the OTC derivatives portfolio . The trading desk enters into (a) an offsetting trade in another OTC derivatives contract . As the transaction has the potential to increase credit risk, the decision is taken to collateralize . The collateral


has to be registered, the transactions have to be revalued and changes must be made to the amount of collateral delivered . The collateral has to be funded, putting incremental emphasis upon obtaining the funds .

Alternatively, the trading desk enters into (b) an offsetting trade with an exchange . Transacting with an exchange, as well as a central counterparty, results in daily margin movements and opportunities for errors . The margin still has to be funded .

Both a & b result in an increase in operational risk due to an increased number of processes (collateral) or an increased use of the existing processes (collateral and movements of margin) .

Both a & b examples show how a reduction in risk appetite for one risk type can lead to increases in other risk types . For management the issue is the relative change . For example, a reduction in one capital requirement by 100 units, but an increase of 10 in another still releases a net 90 units of capital . Allied to these changes are probable changes in volumes of transactions going through various systems . While there may be a reduction in volumes of some transactions others can be expected to increase . If the increase takes the system over the designed capacity then the end result is likely to be an increase in failures of some form or other . It is arguable that one of the causes behind the failure in the US mortgage foreclosure processes was an inability to cope with the increased volumes .

Some of these examples have focused upon the frequency drivers — factors that are likely to see an increased number of events — or the severity drivers, considering the scale of the impact . Only the knowledge provided by hindsight applied at a considerable distance will be able to determine whether the past recession increased the size of operational risk losses, especially fines and compensation payments . Added to this is the likely increased

regulatory scrutiny in response to societal pressures during periods of widespread stress . In turn, these severe losses can give rise to reputation effects, which in turn have knock-on implications for future capital raising .

At this point in the economic cycle and looking back to the 2007/2008 financial crisis, it looks as though operational risk saw a big increase in the risk profile, and losses are still materializing .

Capital ImplicationsThe potential individual losses that are expected to occur in the stress test operating environment are bad enough, but it does not end there . Longer term implications arise from the use of historic losses as inputs into the AMA capital calculation .

If the stress test output assumes that there is a loss of €1 billion, then the effect on the firm is more than €1 billion, but less than €2 billion . Firstly there is the cash outflow of €1 billion affecting the P&L and the return on equity . Then the loss goes into the AMA database of historic losses . In the year of the event, the increase in operational risk capital due to the event is expected to be less than €1 billion . This effect is due to the diversification across the individual losses . Further, this loss is likely to be present in the historic database for the next five years to some degree or other, affecting future operational risk capital estimates .

This retention of history also has an impact on the capital required during the period of the stress test, e .g . 2017 . For example, if there are projected to be major losses in 2015 or 2016 then their impact will still be felt in the 2017 AMA capital calculation for operational risk . This adds complexity to the stress testing results for operational risk . Is this level of complexity and precision required for the regulatory and management stress test result? This is too difficult for an external observer to say .


SUMMARYThe benefits of stress testing for regulators, senior firm management and Boards, mean that this genie is unlikely to be put back into its bottle . At the time of writing, it looks as though stress tests will become part of the regular regulatory toolkit . In turn this means that firms should start considering appropriate infrastructure to support this regular activity .

The current population of firms participating in stress testing either have the regulatory approval to use the AMA or are close to approval . In turn these firms will have data in the form of internal and/or external losses that can be used to explore stress test consequences alongside their existing portfolio of scenarios .

The challenge is looking at the stress conditions determined by the regulators and mapping these to the operational risk scenarios already developed by the firm . Mapping economic factors representing a recession and a given fall in the value of collateral, such as property supporting mortgages, to the Basel event types requires some thought .

If the firm’s existing scenarios have identified a limited universe of risk drivers then these can be reviewed for how they may react or respond to the operating environment conditions of the stress test . Some of these risk drivers may be linked to human factors and others to the number and value of transactions which can be affected by the alternative operating environment described in the stress test .

In addition to the stand alone operational risk issues, there is the feedback loop of management decisions responding to the stress test conditions . Will the potential actions significantly increase operational risk? Will the actions take place early or late in the period covered by the stress test, e .g . February or November 2017?

Further complicating the issue is the interaction between the risk types . This can lead to reducing one risk type whilst simultaneously increasing another . This risk transformation may be implicit in various potential risk reduction strategies .

Finally, there are the implications of the assumed losses under the stress test conditions for the immediate and long term operational risk capital requirement . This is due to the use of historic data, directly or indirectly, as inputs to the AMA capital calculations .

While experts may find it difficult to complete scenarios, operational risk stress tests require even more imagination and understanding of interactions . Having a good scenario program that identifies frequency and severity drivers, which may or may not be linked to the economic conditions outlined by the regulators is important . Investment in the scenario program facilitates the completion of stress testing .

While the current regulatory focus on stress testing centers on economic conditions, the firm may want to consider its own stress tests . In the current environment it is possible to imagine stress tests around cyber security . Alternatively, extend reverse scenarios for businesses into reverse stress testing to determine what sequence of events would result in a business ceasing to be viable .

While stress tests may currently be applied only to banks, their success as a regulatory tool for gathering information and insight means that non-bank SIFIs and parts of the plumbing for the financial system may also be asked to complete them .

Today stress testing for operational risk is challenging!

© 2014 Thomson Reuters GRC01847/10-14

The Thomson Reuters Governance, Risk & Compliance (GRC) business delivers a comprehensive set of solutions designed to empower audit, risk and compliance professionals, business leaders, and the Boards they serve to reliably achieve business objectives, address uncertainty, and act with integrity .

Thomson Reuters Accelus connects business transactions, strategy and operations to the ever-changing regulatory environment, enabling firms to manage business risk . A comprehensive platform supported by a range of applications and trusted regulatory and risk intelligence data, Accelus brings together market-leading solutions for governance, risk and compliance management, global regulatory intelligence, financial crime, anti-bribery and corruption, enhanced due diligence, training and e-learning, and board of director and disclosure services .

Thomson Reuters has been named as a category leader in the Chartis RiskTech Quadrant™ For Operational Risk Management Systems, category leader in the Chartis RiskTech Quadrant™ for Enterprise Governance, Risk and Compliance Systems and has been positioned by Gartner, Inc . in its Leaders Quadrant of the “Enterprise Governance, Risk and Compliance Platforms Magic Quadrant .” Thomson Reuters was also named as Operational Risk Software Provider of the Year Award in the Operational Risk and Regulation Awards 2013 and 2014 .

THOMSON REUTERS ACCELUS™

For more information, visit accelus.thomsonreuters.com

OPERATIONAL RISK QUANTIFICATION: STRESS TESTS

Documents

Transcript of OPERATIONAL RISK QUANTIFICATION: STRESS TESTS