Chapter 5: Analysis of inherent risks

Transcription

1 Chapter 5: Analysis of inherent risks 5.1. Introduction The analysis of inherent risks seeks to ascertain the probability that the various risks to which an institution is exposed materialise and has a significant to high impact on the institution. Within the organisational structure mapped by the supervisor, this risk analysis is performed at the level of the functional activities. Risks with a high probability of leading to a significant impact merit enhanced supervisory attention, since, with regard to these risks, the degree of control must meet stricter standards. By estimating the probability of a risk event, the risks are ranked and, in combination with the weights assigned to risk categories (see section 5.6), input is obtained for the planning process. The risk analysis is based on default scores that are considered representative of the various risks within a certain functional activity (such as the credit risk within a mortgage business). Following a brief introduction about some important risk concepts, this Chapter deals with the question what risks should be assessed by the supervisor, what criteria are available for that purpose, what degree of depth should be pursued in the analysis, how the default scores presented within FIRM should be used and what scale should be employed when assessing the risks Some important concepts Inherent risks versus residual risks When assessing the probability of a risk event for each type of risk, a distinction should be made between inherent risks (also known as gross risks) and residual risks. Inherent risks An inherent risk is a risk that attaches inherently (apart from any controls) to the operations and products of an institution or to the environment in which an institution operates. The assessment of inherent risks is based on the institution s profile at the time when the risks are scored; this profile encompasses various elements, including: the product range, the market where the institution operates, the primary customer focus (corporate or retail); the nature and the intensity of competition; the IT environment, including the degree of automation; the composition of the investment portfolio; the composition of the loans portfolio; the group of insured persons/persons having pension entitlements; the geographical distribution. The risk analysis must focus to the extent possible on the inherent risks, abstracting from any existing controls. The operation of the controls forms part of the next stage of the risk analysis, which also includes an analysis of the effect which the controls have on the inherent risks. The characteristics listed above determine in part the severity of the inherent risks. For example: an institution which invests mainly in equities has a different inherent market risk from an institution investing mainly in bonds; an institution whose portfolio mainly includes savings-linked mortages has a different inherent credit risk from an institution with a portfolio consisting mainly of unit-linked mortgages with securities accounts; Chapter 5: Analysis of inherent risks Page 1 of 9

2 an institution which primarily serves corporate customers has a different risk profile from an institution primarily serving retail customers; an institution which sells mainly disability insurance has a different inherent operational risk from an institution mainly selling simple travel insurance. The above characteristics (leading to the institution s profile) often ensue from policies pursued in the past, as reflected in such factors as the product/market combination and the investment policy chosen. In the assessment of inherent risks, these choices are regarded as given facts. Residual risks Residual risks are the risks remaining after allowing for the effects of existing controls Impact and probability With regard to the various risks, the elements impact and probability are distinguished. Impact is the consequence of a risk event on the extent to which the supervisory authority achieves its objectives. Probability is the likelihood of a risk event. In many cases, the impact of a risk event and the appurtenant probability are interdependent. Thus, the probability of a market risk event leading to a major impact (e.g. a loss of value of 30%) is usually smaller than the probability of a market risk event leading to a minor impact (e.g. a loss of value of 5%). As a result, for a single risk, there may be a large number of combinations of impact and probability. This is illustrated in the figure below (where the vertical axis represents impact and the horizontal axis probability). Chapter 5: Analysis of inherent risks Page 2 of 9

3 Given this interdependence between impact and probability, it has been decided that the risk analysis should not include a separate assessment of the impact of a risk event. The probability is assessed on the basis of a given impact. It has been decided to assess the probability of a risk event as follows: The probability of the risk event leading to a significant to high impact on the four pillars of the supervisory objectives, being solvency, liquidity, organisation and control, and integr ity. 1 Such a significant to high impact may be quantified to a certain extent. For instance, a significant to high impact may consist of a more than considerable reduction (say, more than 10%) in actual solvency (buffers). In the present approach, however, it has been decided to leave this concept implicit, because the information required for a more quantitative approach (such as probability distributions and models) is not widely available. It is important, though, to ensure that risk events within a functional activity should not in all cases be related to the institution-wide solvency, since the probability of a risk event within a functional activity leading to such a major impact will normally be very low. 2 In this regard, the supervisor might make a (rough) estimate of the solvency to be assigned to the functional activity concerned. In addition, when assessing the probability of a risk event, reliance should also be placed on the qualitative criteria discussed later in this Chapter. 1 The supervisory objectives that are distinguished and the underlying legislation have already been dealt with earlier in this Manual. 2 Also see section 5.8 (Relating scores to the size of the activity). Chapter 5: Analysis of inherent risks Page 3 of 9

4 5.3. Risks to be assessed The risk analysis in a general sense focuses on the following risk categories with the underlying risk items as shown below: 3 Risk category Risk item Matching/interest rate risks interest rate currency liquidity inflation Market risks price volatility market liquidity concentration and correlation Credit risks default probability concentration and correlation loss given default exposure at default Insurance technical risks mortality disability loss concentration and correlation Environmental risks competition dependence reputation business climate Operational risks (pre)acceptance/transaction processing payment/clearing/settlement information product development cost staff sensitivity to fraud. Outsourcing risks business continuity integrity quality of services IT risks strategy and policies security controllability continuity. Integrity risks prejudice to third parties insider trading money laundering financing of terrorism improper conduct Legal risks legislation and regulation compliance liability enforceability of contracts Explanatory notes to the risk classification 3 For the definitions, the reader is referred to Annex B. Chapter 5: Analysis of inherent risks Page 4 of 9

5 NB 1: In practice, various risks will be more or less interrelated. Thus, several risks (including, for instance, the integrity risk) may affect the reputation risk. Also, the risk relating to the sensitivity to fraud may affect the institution s integrity, inadequate compliance with legislation may also involve an integrity risk and legal aspects in loan agreements may affect the credit risk. All this is due to the fact that each risk is usually underlain by more than one risk source (cause) which often exert an influence not just on one but on several of the risks mentioned. As a result, it may be difficult in some cases to relate a specific risk or risk source at an institution explicitly to one of the risks included in the above table. Considering the aim of the risk analysis within FIRM, this need not, however, be a problem. The aim is that the risks are identified and scored and that, subsequently, the quality of the controls is assessed. Establishing perfect and unequivocal matches between certain risks run by an institution and risks identified within FIRM is not an objective per se. However, when assessing the risks, the supervisor should consider to what extent, say, a potential legal risk also constitutes an integrity risk or in line with the example above a credit risk. Moreover, the supervisor should consider to what extent other risk events (including those relating to legal risks, integrity risks and risks of fraud) may detract from the institution s reputation or the integrity of the financial system. NB 2: The risk relating to banks liquidity has not been included in the model as a separate risk category, as the ratio of actual to required liquidity is seen as a reflection of the liquidity risk. As noted in section 2.3.2, the supervisor must, on the basis of that ratio, form an opinion about the adequacy of the liquidity position and, subsequently, assess liquidity management. NB 3: Finally, given the increasing importance of outsourcing within the financial sector and the increasing supervisory focus on outsourcing, it has been decided to explicitly include a risk category for outsourcing risk. The risk analysis for an individual functional activity generally focuses primarily on a subset of the above risks. These are the risks shown in the template which the supervisor has assigned to the functional activity in hand. As noted in Chapter 3 about the breakdown of the organisation, the template for a functional activity includes a limited number of risk categories with underlying items. These are the risk categories that are, in a general sense, relevant to the functional activity from a supervisory perspective. This does not mean that the risks which are not included in the template cannot by definition be applicable. At all times the supervisor must evaluate whether the template is complete for the case in hand. If he/she holds that additional risk categories are also relevant, he/she may opt to add one or more of such categories. Conversely, a certain risk category, though included in the template, may not be applicable in practice. In that event, the default score may be overwritten and replaced by not applicable. Cases in point are the risk categories operational risks and IT risks when all operations have been outsourced, or the risk category outsourcing risks when not a single operation has been outsourced. Each of these risk categories carries a weight (high, medium or low) serving as an indication of the importance assigned to it from a supervisory viewpoint. These templates apply both to regular functional activities and to group functions. There is a difference between the templates for regular functional activities and those for group functions in that the latter do not in all cases include a risk category. For an explanation, the reader is referred to Chapter 3 (Breakdown of the organisation), section 3.4. The risk analysis centres on an assessment of the probability of a risk event for the risk categories included in (and, where applicable, added to) the template. Chapter 5: Analysis of inherent risks Page 5 of 9

6 5.4. Assessing the level of inherent risks Scale for assigning scores The score for the probability of a risk event is assigned on the basis of the scale below. 1. Low The probability of a risk event leading to a significant to high impact is very low. 2. Fair The probability of a risk event leading to a significant to high impact is fair. However, if circumstances change, this probability may also change rapidly and possibly become material. Hence, the risk must be monitored. 3. Material The probability of a risk event leading to a significant to high impact is material. 4. High In the absence of adequate controls, a risk event will almost certainly arise and have a significant to high impact. Control of the risk by the institution merits a high level of attention. Not applicable If the risk is not applicable at all to the fucntional activity concerned, the supervisor must select this option. Unknown If the supervisor has as yet insufficient information about a certain risk to assign a score, he/she must select this option. As one of the aims of the analysis of risks and controls is to provide input for the planning and prioritisation process, the scores assigned must be well spread across the scale. Hence, supervisors are encouraged to be explicit when assigning scores and to use the full scale wherever possible Aids for assigning probability scores In order to support the supervisor in assigning scores, (general) assessment criteria are given for each individual risk category. For each risk, an indication is thus provided of the situations where a probability score of 1, 2, 3 or 4 would be justified. For further details, the reader is referred to the Annexes. Some of the assessment criteria do not in all cases apply to each individual institution. Moreover, the list of criteria is not exhaustive. The fact is that circumstances may arise within an institution that cannot be matched with the assessment criteria for the risk concerned, but which are yet relevant to an assessment of the risk level. Also, it may be possible that, within an individual institution, certain assessment criteria carry a greater weight than other criteria. In such cases, the supervisor must use his/her professional judgment to determine which score best matches the probability of an inherent risk event within the functional activity concerned. A number of the criteria presented in this Manual are fairly quantitative. It should be noted that they are no more than indicators and merely serve to provide guidance for the supervisor s qualitative assessment Default scores Explanatory notes to the use of default scores The choice of default scores for inherent risks (by risk category and by risk item) is underlain by the assumption that, for comparable operations, the inherent risks (abstracting from any form of control) will be comparable in terms of nature and magnitude. Chapter 5: Analysis of inherent risks Page 6 of 9

7 Chapter 3 (Breakdown of the organisation) describes how, for each functional activity, a link has been established with the appurtenant risks by means of templates. Each such template includes a number of risk categories, with weights (high, medium or low), that are considered relevant to the functional activity concerned. Each of the risk items within these linked risk categories has been assigned a default score for the probability of a risk event within the functional activity concerned giving rise to a significant or high impact. At the level of the risk category, this leads to a default score in the form of an arithmetic average. 4 The default scores have been assigned by the FIRM Expert Team on the basis of the average or most frequent profile of the functional activity concerned. This means that if, for a certain functional activity, the supervisor has selected the template for a mortgage business the risk default scores as they are considered relevant to a generic mortgage business are automatically shown. The default scores have been assigned on the basis of the so-termed point-in-time principle, meaning that they are based on current (market) conditions rather than on averages over a longer (economic) cycle. Within each functional activity, the default scores are provided with a brief explanation of the underlying assumptions (see the Annexes). These explanations seek to help answer the question whether the assumptions underlying the default scores are applicable within the functional activity concerned and whether or not they require adjustment (in which case the default score must be overwritten). On this basis, the supervisor assesses to what extent the risks as shown in the template are relevant to the functional activity and, hence, whether the default score is representative of the specific activity within the institution under examination. With the risk analysis proceeding in this manner on the basis of default scores assigned (and explained) in the templates, a positive contribution is made to uniformity in scoring inherent risks. Thus, the risk analysis becomes less dependent on the person performing it and, hence, more consistent across institutions Overwriting default scores If, in view of the risk profile of the activity concerned, the supervisor holds that one or more default scores as presented in FIRM are not representative of the functional activity under assessment, he/she must overwrite these default scores. In the event of comprehensive scoring, the default score is overwritten at the risk item level, in the event of simplified scoring at the risk category level. The supervisor replaces the default score with the score that, in his/her view, matches the probability of the relevant risk event inherently leading to a significant to high impact. Illustration 1: Functional activity Mortgages Risk: Credit risk - exposure at default Assumptions: Few interest-only mortgages (< x%) Few second mortgages or securities accounts (< y%) Adequate collateral Default score: 2 If the bank s portfolio includes many second mortgages combined with securities accounts, the default score might have to be overwritten and replaced by 3 or 4. 4 The default scores at risk item level are integers. The default score for the next higher risk category is derived from these default scores at risk item level (as an arithmetic average). This implies that the default scores for the risk categories are not by definition integers. Chapter 5: Analysis of inherent risks Page 7 of 9

8 Illustration 2: Functional activity Pension fund not outsourced or reinsured Risk: Market risk price volatility Assumptions: Mainly fixed-rate instruments (> x%) Small proportion of equities and real estate (< y%) Default score: 2 If the pension fund s portfolio includes more equities, the default score might have to be overwritten and replaced by 3 or 4. The considerations underlying the decision to overwrite the default score should be recorded within FIRM. It is not just the score itself that is important; equally important are the reasons and backgrounds underlying the score assigned. FIRM offers a text field where this background information may be recorded. This information should include an indication of how up to date the sources are on which the assessment has been based. In addition, within FIRM, a link can be established with a document in Trim/Rondo. For an overview of the default scores for each functional activity, the reader is referred to the Annexes Weights The risk categories included in the templates have all been assigned weights (high, medium or low). These weights serve to indicate the importance which is assigned to the category concerned from a supervisory perspective. The reasons for using weights are related to the fact that certain risk categories (such as operational risk, IT risk and integrity risk) feature relatively more often in the templates than other risk catagories (such as credit risk and matching risk). As a result, the former risk categories would carry a relatively greater weight in the aggregate scores that are calculated and in some cases the relative weight of, for instance, the credit risk and the matching risk in the aggregate scores would fail to reflect by a considerable margin the weight which these risks represent from a supervisory perspective. In order to adjust for this discrepancy, credit risk, matching risk, market risk and insurance technical risk have been assigned high weights in the relevant functional activities, whereas all other risks have been assigned medium weights Simplified versus comprehensive risk scoring In principle, risks are assessed using simplified scoring. For each risk category, one score is assigned. However, the supervisor may opt for comprehensive scoring of a risk category, leading to an assessment (score) for each underlying risk item. This decision to apply comprehensive scoring may be made for each individual risk category, so that comprehensive scoring may be used for some risk categories and simplified scoring for others. This may be illustrated as follows: in the case of comprehensive scoring, the following scores are assigned: Market risk: Inherent risk Score for inherent risk for probability of risk event for item price volatility Score for inherent risk for probability of risk event for item market liquidity Score for inherent risk for probability of risk event for item concentration and correlation The supervisor may decide to use comprehensive scoring if he/she is of the opinion that the additional work, on the one hand, and the value thus to be added, on the other, are adequately balanced. Comprehensive scoring will normally be applied only to (major risks within) highly critical functional activities. Hence, in this regard the depth of the analysis depends on the supervisor s professional judgment. However, normally simplified scoring is applied. Chapter 5: Analysis of inherent risks Page 8 of 9

9 5.8. Relating scores to the size of the activity When assessing the probability that a risk event within a functional activity will lead to a significant to high impact, the supervisor should interpret the term significant to high impact in relation to size of the functional activity concerned. This serves to prevent that, within large functional activities, the degree of probability of a high impact will be automatically high and, within small functional activities, automatically low. The distinction between large and small functional activities is, after all, indicated by weights. For further details, the reader is referred to Chapter 3 (Breakdown of the organisation). Chapter 5: Analysis of inherent risks Page 9 of 9